[gcc r13-4130] c, analyzer: fix ICE with -fanalyzer and -Wunused-macros [PR107711]

[David Malcolm <dmalcolm@gcc.gnu.org>]

https://gcc.gnu.org/g:f9ed1d24ee46f5ca759c35a1f51fa163d7529ea6

commit r13-4130-gf9ed1d24ee46f5ca759c35a1f51fa163d7529ea6
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Nov 17 12:34:56 2022 -0500

    c, analyzer: fix ICE with -fanalyzer and -Wunused-macros [PR107711]
    
    PR analyzer/107711 reports an ICE since r13-4073-gd8aba860b34203 with
    the combination of -fanalyzer and -Wunused-macros.
    
    The issue is that in c_translation_unit::consider_macro's call to
    cpp_create_reader I was passing "ident_hash" for use by the the new
    reader, but that takes ownership of that hash_table, so that ident_hash
    erroneously gets freed when c_translation_unit::consider_macro calls
    cpp_destroy, leading to a use-after-free in -Wunused-macros, where:
    
    (gdb) p pfile->hash_table->pfile == pfile
    $23 = false
    
    and it's instead pointing at the freed reader from consider_macro,
    leading to a use-after-free ICE.
    
    Fixed thusly.
    
    gcc/c/ChangeLog:
            PR analyzer/107711
            * c-parser.cc (ana::c_translation_unit::consider_macro): Pass NULL
            to cpp_create_reader, rather than ident_hash, so that the new
            reader gets its own hash table.
    
    gcc/testsuite/ChangeLog:
            PR analyzer/107711
            * gcc.dg/analyzer/named-constants-Wunused-macros.c: New test.
    
    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

Diff:
---
 gcc/c/c-parser.cc                                     |  2 +-
 .../gcc.dg/analyzer/named-constants-Wunused-macros.c  | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/gcc/c/c-parser.cc b/gcc/c/c-parser.cc
index f3c79996fb0..1bbb39f9b08 100644
--- a/gcc/c/c-parser.cc
+++ b/gcc/c/c-parser.cc
@@ -1717,7 +1717,7 @@ private:
       return NULL_TREE;
 
     cpp_reader *old_parse_in = parse_in;
-    parse_in = cpp_create_reader (CLK_GNUC89, ident_hash, line_table);
+    parse_in = cpp_create_reader (CLK_GNUC89, NULL, line_table);
 
     pretty_printer pp;
     pp_string (&pp, (const char *) tok.val.str.text);
diff --git a/gcc/testsuite/gcc.dg/analyzer/named-constants-Wunused-macros.c b/gcc/testsuite/gcc.dg/analyzer/named-constants-Wunused-macros.c
new file mode 100644
index 00000000000..0b31cc42d78
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/named-constants-Wunused-macros.c
@@ -0,0 +1,19 @@
+/* Regression test for interaction of named constants in -fanalyzer with
+   -Wunused-macros (PR analyzer/107711).  */
+
+/* { dg-additional-options "-Wunused-macros" } */
+
+#include "analyzer-decls.h"
+
+/* Various constants used by the fd state machine.  */
+
+#define O_ACCMODE 42   /* { dg-warning "-: macro \"O_ACCMODE\" is not used" } */
+#define O_RDONLY  0x1  /* { dg-warning "-: macro \"O_RDONLY\" is not used" } */
+#define O_WRONLY  010  /* { dg-warning "-: macro \"O_WRONLY\" is not used" } */
+
+void test_sm_fd_constants (void)
+{
+  __analyzer_dump_named_constant ("O_ACCMODE"); /* { dg-warning "named constant 'O_ACCMODE' has value '42'" } */
+  __analyzer_dump_named_constant ("O_RDONLY"); /* { dg-warning "named constant 'O_RDONLY' has value '1'" } */
+  __analyzer_dump_named_constant ("O_WRONLY"); /* { dg-warning "named constant 'O_WRONLY' has value '8'" } */
+}