[Lex] Fix a crash in updateConsecutiveMacroArgTokens.

Fixes https://github.com/llvm/llvm-project/issues/60722.

Differential Revision: https://reviews.llvm.org/D144054

(cherry picked from commit 341dd6076b123946f79a3148b660d6579f9683a7)

2 files changed, 27 insertions, 2 deletions

diff --git a/clang/lib/Lex/TokenLexer.cpp b/clang/lib/Lex/TokenLexer.cpp
index c6968b9f417e..ebe7dd66c118 100644
--- a/clang/lib/Lex/TokenLexer.cpp
+++ b/clang/lib/Lex/TokenLexer.cpp
@@ -1020,8 +1020,16 @@ static void updateConsecutiveMacroArgTokens(SourceManager &SM,
     SourceLocation Limit =
         SM.getComposedLoc(BeginFID, SM.getFileIDSize(BeginFID));
     Partition = All.take_while([&](const Token &T) {
-      return T.getLocation() >= BeginLoc && T.getLocation() < Limit &&
-             NearLast(T.getLocation());
+      // NOTE: the Limit is included! The lexer recovery only ever inserts a
+      // single token past the end of the FileID, specifically the ) when a
+      // macro-arg containing a comma should be guarded by parentheses.
+      //
+      // It is safe to include the Limit here because SourceManager allocates
+      // FileSize + 1 for each SLocEntry.
+      //
+      // See https://github.com/llvm/llvm-project/issues/60722.
+      return T.getLocation() >= BeginLoc && T.getLocation() <= Limit
+         &&  NearLast(T.getLocation());
     });
   }
   assert(!Partition.empty());
diff --git a/clang/test/Lexer/update_consecutive_macro_crash.cpp b/clang/test/Lexer/update_consecutive_macro_crash.cpp
new file mode 100644
index 000000000000..c66e734a4894
--- /dev/null
+++ b/clang/test/Lexer/update_consecutive_macro_crash.cpp
@@ -0,0 +1,17 @@
+// RUN: %clang -cc1 -fsyntax-only -verify %s 2>&1
+
+#define X(val2) Y(val2++) // expected-note {{macro 'X' defined here}}
+#define Y(expression) expression ;
+
+void foo() {
+  // https://github.com/llvm/llvm-project/issues/60722:
+  //
+  // - Due to to the error recovery, the lexer inserts a pair of () around the
+  //   macro argument int{,}, so we will see [(, int, {, ,, }, )] tokens.
+  // - however, the size of file id for the macro argument only takes account
+  //   the written tokens  int{,} , and the extra inserted ) token points to the
+  //    Limit source location which triggered an empty Partition violation.
+  X(int{,}); // expected-error {{too many arguments provided to function-like macro invocation}} \
+                 expected-error {{expected expression}} \
+                 expected-note {{parentheses are required around macro argument containing braced initializer list}}
+}