[Bug c/119366] [15 Regression] ICE: "free(): invalid pointer" in diagnostic_context::finish() (diagnostic.cc:427) with -Wfatal-errors

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119366

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:24b6d2014035073870d9d8dae9152fc16fc319fd

commit r15-8447-g24b6d2014035073870d9d8dae9152fc16fc319fd
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Mar 19 15:03:42 2025 -0400

    diagnostics: fix crash in urlifier with -Wfatal-errors [PR119366]

    diagnostic_context's dtor assumed that it owned the m_urlifier pointer
    and would delete it.

    As of r15-5988-g5a022062d22e0b this isn't always the case -
    auto_urlify_attributes is used in various places in the C/C++ frontends
    and in the middle-end to temporarily override the urlifier with an
    on-stack instance, which would lead to delete-of-on-stack-buffer crashes
    with -Wfatal-errors as the global_dc was cleaned up.

    Fix by explicitly tracking the stack of urlifiers within
    diagnostic_context, tracking for each node whether the pointer is
    owned or borrowed.

    gcc/ChangeLog:
            PR c/119366
            * diagnostic-format-sarif.cc (test_message_with_embedded_link):
            Convert diagnostic_context from one urlifier to a stack of
            urlifiers, where each node in the stack tracks whether the
            urlifier is owned or borrowed.
            * diagnostic.cc (diagnostic_context::initialize): Likewise.
            (diagnostic_context::finish): Likewise.
            (diagnostic_context::set_urlifier): Delete.
            (diagnostic_context::push_owned_urlifier): New.
            (diagnostic_context::push_borrowed_urlifier): New.
            (diagnostic_context::pop_urlifier): New.
            (diagnostic_context::get_urlifier): Reimplement in terms of stack.
            (diagnostic_context::override_urlifier): Delete.
            * diagnostic.h (diagnostic_context::set_urlifier): Delete decl.
            (diagnostic_context::override_urlifier): Delete decl.
            (diagnostic_context::push_owned_urlifier): New decl.
            (diagnostic_context::push_borrowed_urlifier): New decl.
            (diagnostic_context::pop_urlifier): New decl.
            (diagnostic_context::get_urlifier): Make return value const; hide
            implementation.
            (diagnostic_context::m_urlifier): Replace with...
            (diagnostic_context::urlifier_stack_node): ... this and...
            (diagnostic_context::m_urlifier_stack): ...this.
            * gcc-urlifier.cc
            (auto_override_urlifier::auto_override_urlifier): Reimplement.
            (auto_override_urlifier::~auto_override_urlifier): Reimplement.
            * gcc-urlifier.h (class auto_override_urlifier): Reimplement.
            (auto_urlify_attributes::auto_urlify_attributes): Update for
            pass-by-reference.
            * gcc.cc (driver::global_initializations): Update for
            reimplementation of urlifiers in terms of a stack.
            * toplev.cc (general_init): Likewise.

    gcc/testsuite/ChangeLog:
            PR c/119366
            * gcc.dg/Wfatal-bad-attr-pr119366.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>