detect integer overflow inside arms of conditional operator with non-constant expression

[nlewycky]

Summary

Descend into both the true and false expressions of a ConditionalOperator when the condition can't be evaluated and we're in an evaluation-mode that says we should continue evaluating.

[rsmith]

LGTM

lib/AST/ExprConstant.cpp

void CheckPotentialConstantConditional(const ConditionalOperator *E) {
     Error(E, diag::note_constexpr_conditional_never_const);
   }
 
 
   template<typename ConditionalOperator>
   bool HandleConditionalOperator(const ConditionalOperator *E) {
     bool BoolResult;
     if (!EvaluateAsBooleanCondition(E->getCond(), BoolResult, Info)) {
-      if (Info.checkingPotentialConstantExpression() && Info.noteFailure())
+      if (Info.checkingPotentialConstantExpression() && Info.noteFailure()) {
         CheckPotentialConstantConditional(E);
         return false;
       }
+      if (Info.noteFailure()) {
+        StmtVisitorTy::Visit(E->getTrueExpr());
+        StmtVisitorTy::Visit(E->getFalseExpr());
+      }
+      return false;
+    }
 
     Expr *EvalExpr = BoolResult ? E->getTrueExpr() : E->getFalseExpr();
     return StmtVisitorTy::Visit(EvalExpr);
   }
 
 protected:
   EvalInfo &Info;
   typedef ConstStmtVisitor<Derived, bool> StmtVisitorTy;

test/Sema/integer-overflow.c

 
 // expected-warning@+4 {{overflow in expression; result is 536870912 with type 'int'}}
 // expected-warning@+3 {{array index 536870912 is past the end of the array (which contains 10 elements)}}
 // expected-note@+1 {{array 'a' declared here}}
   uint64_t a[10];
   a[4608 * 1024 * 1024] = 1i;
 
 // expected-warning@+1 2{{overflow in expression; result is 536870912 with type 'int'}}
+  (void)((i ? (4608 * 1024 * 1024) : (4608 * 1024 * 1024)) + 1);
+
+// expected-warning@+1 2{{overflow in expression; result is 536870912 with type 'int'}}
   return ((4608 * 1024 * 1024) + ((uint64_t)(4608 * 1024 * 1024)));
 }
 
 struct s {
   unsigned x;
   unsigned y;
 } s = {
   .y = 5,