Not safe to share Spans from one ParseSess to another

[dtolnay]

Fixes #590 and probably fixes #574.

Spans in the AST returned by parse_item_from_source_str and other parsing
functions contain byte offsets into the source code they were parsed from. The
pretty printer uses these Spans here to preserve the representation of
literals when parsing and printing back out unmodified.

In this bug, the byte offset of a string in the input to
parse_item_from_source_str coincidentally matched the byte offset of a totally
different string in the input to parse_crate_from_file called here by
Syntex. The Span from the former triggered the pretty printer to write out the
content of the latter.

By using the same ParseSess, Spans from the two parse_* calls never collide.

[dtolnay]

@erickt @oli-obk I found two other suspicious ParseSess::new() calls here and here. Let me know if you agree those need to be fixed. I also found this but I think it is okay because the parsed item immediately gets respanned.

[oli-obk]

Isn't the issue only if the newly created ParseSess is used to parse from a str? So only the second one is bad. But I might be wrong.

[dtolnay]

The first one passes the bad ParseSess to to_tokens here. The to_tokens can use the ParseSess to parse strings, for example here.

[erickt]

@dtolnay: r+ on this change. Do you think it'd just be best for us to replace all spans with dummy spans in these cases? Or if we should thread ExtCtxts through these cases to use the same ParseSess objects?

[dtolnay]

@erickt as far as I understand the issue, in theory respanning to DUMMY_SP is sufficient to fix any problems of not using the right ParseSess.

In practice fold.rs has a ton of holes around not handling spans correctly. I have hit 9 so far with syn (I have a unit test that parses a file with syn, prints it back out, parses both the output and the original using syntex, respans them to dummy spans, and asserts they are the same). I still need to push those fixes upstream.

[dtolnay]

I released serde_codegen 0.8.14 with this fix and I filed serde-deprecated/aster#116 and serde-deprecated/syntex#100 to follow up on the other occurrences.

[norru]

Fixes #574