[Clang][Sema] Fix templated array size calculation.

clang/docs/ReleaseNotes.rst

@@ -403,6 +403,7 @@ Bug Fixes to C++ Support
 - Avoided a redundant friend declaration instantiation under a certain ``consteval`` context. (#GH107175)
 - Fixed an assertion failure in debug mode, and potential crashes in release mode, when
   diagnosing a failed cast caused indirectly by a failed implicit conversion to the type of the constructor parameter.
+- Fix erroneous templated array size calculation leading to crashes in generated code. (#GH41441)
 
 Bug Fixes to AST Handling
 ^^^^^^^^^^^^^^^^^^^^^^^^^

clang/lib/Sema/SemaExprCXX.cpp

@@ -2151,7 +2151,8 @@ ExprResult Sema::BuildCXXNew(SourceRange Range, bool UseGlobal,
 
   // Per C++0x [expr.new]p5, the type being constructed may be a
   // typedef of an array type.
-  if (!ArraySize) {
+  // Dependent case will be handled separately.
+  if (!ArraySize && !AllocType->isDependentType()) {
     if (const ConstantArrayType *Array
                               = Context.getAsConstantArrayType(AllocType)) {
       ArraySize = IntegerLiteral::Create(Context, Array->getSize(),

clang/test/SemaCXX/GH41441.cpp

@@ -0,0 +1,46 @@
+// RUN: %clang --target=x86_64-pc-linux -S -fno-discard-value-names -emit-llvm -o - %s | FileCheck %s
+// RUN: %clang_cc1 %s -fsyntax-only -verify
+
+namespace std {
+  using size_t = decltype(sizeof(int));
+};
+void* operator new[](std::size_t, void*) noexcept;
+
+// CHECK: call void @llvm.memset.p0.i64(ptr align 1 %x, i8 0, i64 8, i1 false)
+// CHECK: call void @llvm.memset.p0.i64(ptr align 16 %x, i8 0, i64 32, i1 false)
+template <typename TYPE>
+void f()
+{
+    typedef TYPE TArray[8];
+
+    TArray x;
+    new(&x) TArray();
+}
+
+template <typename T>
+void f1() {
+  int (*x)[1] = new int[1][1];
+}
+template void f1<char>();
+void f2() {
+  int (*x)[1] = new int[1][1];
+}
+
+int main()
+{
+    f<char>();
+    f<int>();
+}
+
+// expected-no-diagnostics
+template <typename T> struct unique_ptr {unique_ptr(T* p){}};
+
+template <typename T>
+unique_ptr<T> make_unique(unsigned long long n) {
+  return unique_ptr<T>(new T[n]());
+}
+
+auto boro(int n){
+	typedef double HistoryBuffer[4];
+	return make_unique<HistoryBuffer>(n);
+}