[Bug analyzer/107711] [13 Regression] ICE with "-fanalyzer -Wunused-macros" since r13-4073-gd8aba860b34203

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:f9ed1d24ee46f5ca759c35a1f51fa163d7529ea6

commit r13-4130-gf9ed1d24ee46f5ca759c35a1f51fa163d7529ea6
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Nov 17 12:34:56 2022 -0500

    c, analyzer: fix ICE with -fanalyzer and -Wunused-macros [PR107711]

    PR analyzer/107711 reports an ICE since r13-4073-gd8aba860b34203 with
    the combination of -fanalyzer and -Wunused-macros.

    The issue is that in c_translation_unit::consider_macro's call to
    cpp_create_reader I was passing "ident_hash" for use by the the new
    reader, but that takes ownership of that hash_table, so that ident_hash
    erroneously gets freed when c_translation_unit::consider_macro calls
    cpp_destroy, leading to a use-after-free in -Wunused-macros, where:

    (gdb) p pfile->hash_table->pfile == pfile
    $23 = false

    and it's instead pointing at the freed reader from consider_macro,
    leading to a use-after-free ICE.

    Fixed thusly.

    gcc/c/ChangeLog:
            PR analyzer/107711
            * c-parser.cc (ana::c_translation_unit::consider_macro): Pass NULL
            to cpp_create_reader, rather than ident_hash, so that the new
            reader gets its own hash table.

    gcc/testsuite/ChangeLog:
            PR analyzer/107711
            * gcc.dg/analyzer/named-constants-Wunused-macros.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>