[clang] Prevent possible use-after-free

[kadircet]

Summary

This prevents further parsing of tokens (that'll be freed) inside method
body by propagating EOF emitted by reaching code completion token up the parsing
stack.

[ilya-biryukov]

LGTM. Thanks for getting to the bottom of this!

clang/lib/Parse/ParseObjc.cpp

3768

Suggestion

clang/lib/Parse/ParseObjc.cpp

if (Tok.getLocation() != OrigLoc) {
     // leftover tokens.
     // Since this is an uncommon situation that should be avoided, use the
     // expensive isBeforeInTranslationUnit call.
     if (PP.getSourceManager().isBeforeInTranslationUnit(Tok.getLocation(),
                                                      OrigLoc))
       while (Tok.getLocation() != OrigLoc && Tok.isNot(tok::eof))
         ConsumeAnyToken();
   }
-  // Clean up the remaining EOF token.
+  // Clean up the remaining EOF token, only if it's inserted by us. Otherwise
+  // this might be code-completion token, which must be propagated to callers.
+  if (Tok.is(tok::eof) && Tok.getEofData() == MCDecl)
     ConsumeAnyToken();
 }

clang/test/Parser/objc-delayed-method-use-after-free.m

+// Make sure we don't trigger use-after-free when we encounter a code completion
+// token inside a objc method.
+@interface Foo
+@end
+
+@implementation Foo
+- (void)foo {
+
+// RUN: %clang_cc1 -fsyntax-only -Wno-objc-root-class -code-completion-at=%s:%(line-1):1 %s | FileCheck %s
+// CHECK: COMPLETION: self : [#Foo *#]self
+  [self foo];
+}
+@end