[Bug fortran/15335] New: [gfortran] runtime error "Attempt to allocate a non-positive amount of memory"

[Bug fortran/15335] New: [gfortran] runtime error "Attempt to allocate a non-positive amount of memory"

[Tobias dot Schlueter at physik dot uni-muenchen dot de]

This reduced testcase exhibits a problem in memory allocation for temporaries:
  program Driver
    real :: a(4,4)
    call factor
contains
    subroutine Factor
      real :: A(4, 4), B(4), lu(4,4)
      integer:: p(4)
      do M = 1, 4
          LU(P(I), M) = Reduce (LU(P(I), M), LU(P(I), 1: M - 1), LU(P(1: M - 1), M))
      end do

      return
    end subroutine Factor  
    function Reduce (A, Row, Col)
      real :: A, Row(:), Col(:)
      reduce = 0
    end function Reduce
  end program Driver
[tobi@marktplatz meissner]$ gfortran reduced.f90
[tobi@marktplatz meissner]$ ./a.out
Fortran runtime error: Attempt to allocate a non-positive amount of memory.
[tobi@marktplatz meissner]$

After removing either the loop in factor or the declaration in main the program
yields a segfault instead, so this is a out-of-bound memory access. Valgrind
confirms this:
[tobi@marktplatz meissner]$ valgrind ./a.out
==1649== Memcheck, a.k.a. Valgrind, a memory error detector for x86-linux.
==1649== Copyright (C) 2002-2003, and GNU GPL'd, by Julian Seward.
==1649== Using valgrind-2.0.0, a program supervision framework for x86-linux.
==1649== Copyright (C) 2000-2003, and GNU GPL'd, by Julian Seward.
==1649== Estimated CPU clock rate is 799 MHz
==1649== For more details, rerun with: -v
==1649==
==1649== Use of uninitialised value of size 4
==1649==    at 0x804853D: factor.1 (in /home/tobi/src/tests/meissner/a.out)
==1649==    by 0x804874F: MAIN__ (in /home/tobi/src/tests/meissner/a.out)
==1649==    by 0x8048782: main (in /home/tobi/src/tests/meissner/a.out)
==1649==    by 0x24F3F1: __libc_start_main (in /lib/libc-2.3.3.so)
==1649==
==1649== Invalid read of size 4
==1649==    at 0x804853D: factor.1 (in /home/tobi/src/tests/meissner/a.out)
==1649==    by 0x804874F: MAIN__ (in /home/tobi/src/tests/meissner/a.out)
==1649==    by 0x8048782: main (in /home/tobi/src/tests/meissner/a.out)
==1649==    by 0x24F3F1: __libc_start_main (in /lib/libc-2.3.3.so)
==1649==    Address 0x5B73AC is not stack'd, malloc'd or free'd
Fortran runtime error: Attempt to allocate a non-positive amount of memory.
==1649==
==1649== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)
==1649== malloc/free: in use at exit: 0 bytes in 0 blocks.
==1649== malloc/free: 4 allocs, 4 frees, 16712 bytes allocated.
==1649== For a detailed leak analysis,  rerun with: --leak-check=yes
==1649== For counts of detected errors, rerun with: -v
[tobi@marktplatz meissner]$

-- 
           Summary: [gfortran] runtime error  "Attempt to allocate a non-
                    positive amount of memory"
           Product: gcc
           Version: tree-ssa
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: fortran
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: Tobias dot Schlueter at physik dot uni-muenchen dot de
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux
  GCC host triplet: i686-pc-linux
GCC target triplet: i686-pc-linux


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] [gfortran] runtime error "Attempt to allocate a non-positive amount of memory"

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |tree-ssa


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] [gfortran] runtime error "Attempt to allocate a non-positive amount of memory"

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-05-07 03:55 -------
I get the following warnings with -O1 -W -Wall:
pr15335.f90: In function `reduce':
pr15335.f90:15: warning: unused parameter `col'
pr15335.f90:15: warning: unused parameter `a'
pr15335.f90:15: warning: unused parameter `row'
pr15335.f90: In function `factor':
pr15335.f90:4: warning: unused variable `a'
pr15335.f90:4: warning: unused variable `b'
pr15335.f90: In function `MAIN__':
pr15335.f90:13: warning: unused variable `a'
pr15335.f90: In function `factor':
pr15335.f90:10: warning: 'i' is used uninitialized in this function
pr15335.f90: In function `reduce':
pr15335.f90:19: warning: unused parameter 'a'
pr15335.f90:19: warning: unused parameter 'row'
pr15335.f90:19: warning: unused parameter 'col'


So I do not know if the use of the uninitialized variable causing the problem, no it is not, I 
initialized it to 1 and still got the error.

But I see that P(1: M - 1) is P(1: 0) when M is 1 (which is the first time through the loop) so 
it is trying to allocating a size of 0 which causes the error. 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] [gfortran] runtime error "Attempt to allocate a non-positive amount of memory"

[Tobias dot Schlueter at physik dot uni-muenchen dot de]

------- Additional Comments From Tobias dot Schlueter at physik dot uni-muenchen dot de  2004-05-07 11:31 -------
Subject: Re:  [gfortran] runtime error  "Attempt to allocate
 a non-positive amount of memory"

pinskia at gcc dot gnu dot org wrote:
> ------- Additional Comments From pinskia at gcc dot gnu dot org  2004-05-07 03:55 -------
> So I do not know if the use of the uninitialized variable causing the problem, no it is not, I 
> initialized it to 1 and still got the error.
> 
No, this testcase is heavily reduced. This is the smallest I could get 
it without changing the error message. I didn't care about uninitialized 
variables. Indeed, this makes running valgrind kinda pointless :-/

> But I see that P(1: M - 1) is P(1: 0) when M is 1 (which is the first time through the loop) so 
> it is trying to allocating a size of 0 which causes the error. 

That's true. Reduced testcase:
	dimension a(1:4), b(1)
	i=1
	b = maxloc(a(1:i-1)+1.)
	end

The problem is that, when creating a temporary array, we don't check if 
it is actually of length zero.

- Tobi



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] [gfortran] runtime error "Attempt to allocate a non-positive amount of memory"

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-05-07 11:39 -------
Confirmed, than.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
           Keywords|                            |wrong-code
   Last reconfirmed|0000-00-00 00:00:00         |2004-05-07 11:39:31
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] [gfortran] runtime error "Attempt to allocate a non-positive amount of memory"

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|3.5.0                       |---


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[tobi at gcc dot gnu dot org]

------- Additional Comments From tobi at gcc dot gnu dot org  2004-10-07 23:44 -------
New testcase (I changed memory.c to allow zero-length allocations):
	dimension a(1:4), b(1)
	i=1
	b = maxloc(a(1:i-2)+1.)
	end
gives the new error message:
Fortran runtime error: Attempt to allocate a negative amount of memory.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|runtime error  "Attempt to  |runtime error  "Attempt to
                   |allocate a non-positive     |allocate a negative amount
                   |amount of memory"           |of memory"


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-11-18 12:33 -------
*** Bug 18539 has been marked as a duplicate of this bug. ***

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |paul dot richard dot thomas
                   |                            |at cea dot fr


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[paul dot richard dot thomas at cea dot fr]

------- Additional Comments From paul dot richard dot thomas at cea dot fr  2004-11-18 13:22 -------
This example gives a segmentation fault with Cygwin and gfortran 20041114

>       integer:: p(4)

Initialising p(4) = (/1,2,3,4/) gets rid of the fault and the programme runs to 
completion.  I do not think that this is entirely the same as #18539, which 
seems to be specific to Tru64 (and Linux?)  

Note that with p initialised, DRIVER still segment faults on Tru64 because i is 
unitialised (this should also fail under Cygwin.....). If, I set I to 1, for 
example, then, finally I get the request for negative memory.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[fxcoudert at gcc dot gnu dot org]

------- Additional Comments From fxcoudert at gcc dot gnu dot org  2005-04-18 12:03 -------
Using the testcase from comment #4, it seems clear that there is no check on
whether the slice selected has negative width...

    atmp.2.dim[0].stride = 1;
    atmp.2.dim[0].lbound = 0;
    atmp.2.dim[0].ubound = i - 3;
    D.489 = i - 2;
    atmp.2.data = (real4[0:] *) _gfortran_internal_malloc (D.489 * 4);

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fxcoudert at gcc dot gnu dot
                   |                            |org
   Last reconfirmed|2005-02-17 05:04:45         |2005-04-18 12:03:58
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[tobi at gcc dot gnu dot org]

------- Additional Comments From tobi at gcc dot gnu dot org  2005-04-18 21:32 -------
(In reply to comment #7)
> Using the testcase from comment #4, it seems clear that there is no check on
> whether the slice selected has negative width...

Yes, I remember that I suggested behaving the same way for the allocation of a
negative amount of memory in internal_malloc as for a zero allocation.  I don't
remember if this failed (say, e.g. because the scalarizer still creates a loop
which does something silly then), or if I didn't do this, because I believed
(maybe because someone told me so) that it wouldn't work.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[fxcoudert at gcc dot gnu dot org]

------- Comment #18 from fxcoudert at gcc dot gnu dot org  2006-03-02 09:37 -------
(In reply to comment #17)
> For i=3 or greater, gfortran and ifort agree on the value of b.  However, for
> the above, gfortran now gives 0, whilst ifort gives 1.  I happen to think that
> 0 makes more sense but.... does anybody know the accepted result?

I think this is PR 25378. The correct answer is undefined as per F95, and is 1
as per F2003.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[pault at gcc dot gnu dot org]

------- Comment #17 from pault at gcc dot gnu dot org  2006-03-01 23:45 -------
OK I have written a patch that fixes:

        real :: a(1:4) = (/((i-1)**2,i=1,4)/)
        real :: b(1)

        i=2

        b = maxloc(a(1:i-2)+1.)
        print *, b

        end


For i=3 or greater, gfortran and ifort agree on the value of b.  However, for
the above, gfortran now gives 0, whilst ifort gives 1.  I happen to think that
0 makes more sense but.... does anybody know the accepted result?


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[paul dot richard dot thomas at cea dot fr]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1328 bytes --]



------- Comment #16 from paul dot richard dot thomas at cea dot fr  2006-03-01 16:43 -------
Subject: RE:  runtime error  "Attempt to allocate a negative amount of memory"

That's true.... QED.... QCD?

> -----Message d'origine-----
> De : tobi at gcc dot gnu dot org [mailto:gcc-bugzilla@gcc.gnu.org]
> Envoyé : mercredi 1 mars 2006 17:39
> À : THOMAS Paul Richard 169137
> Objet : [Bug fortran/15335] runtime error "Attempt to allocate a
> negative amount of memory"
> 
> 
> 
> 
> ------- Comment #13 from tobi at gcc dot gnu dot org  
> 2006-03-01 16:39 -------
> (In reply to comment #12)
> > What about the testcase from comment #4?  I believe that's valid.
> 
> D'oh, no it ain't because the RHS and the LHS in the 
> assignment to b aren't
> conforming.
> 
> 
> -- 
> 
> tobi at gcc dot gnu dot org changed:
> 
>            What    |Removed                     |Added
> --------------------------------------------------------------
> --------------
>              Status|NEW                         |RESOLVED
>          Resolution|                            |INVALID
> 
> 
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335
> 
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug, or are watching someone who is.
> 


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[fxcoudert at gcc dot gnu dot org]

------- Comment #15 from fxcoudert at gcc dot gnu dot org  2006-03-01 16:42 -------
(In reply to comment #12)
> What about the testcase from comment #4?  I believe that's valid.

I agree. The segfault in the original code is OK, but the "Attempt to allocate
a negative amount of memory" error message on your code:

        dimension a(1:4), b(1)
        i=1
        b = maxloc(a(1:i-2)+1.)
        end

is not OK. a(1:i-2) should be a zero-sized array slice.


-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2005-11-01 21:45:02         |2006-03-01 16:42:35
               date|                            |
            Summary|runtime error  "Attempt to  |runtime error "Attempt to
                   |allocate a negative amount  |allocate a negative amount
                   |of memory"                  |of memory"


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[paul dot richard dot thomas at cea dot fr]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 980 bytes --]



------- Comment #14 from paul dot richard dot thomas at cea dot fr  2006-03-01 16:41 -------
Subject: RE:  runtime error  "Attempt to allocate a negative amount of memory"

Oh hi, Tobi!  How are you?

Yes, the testcase from comment #4 is valid.  It is also identical to PR26017.

Paul

> -----Message d'origine-----
> De : tobi at gcc dot gnu dot org [mailto:gcc-bugzilla@gcc.gnu.org]
> Envoyé : mercredi 1 mars 2006 17:37
> À : THOMAS Paul Richard 169137
> Objet : [Bug fortran/15335] runtime error "Attempt to allocate a
> negative amount of memory"
> 
> 
> 
> 
> ------- Comment #12 from tobi at gcc dot gnu dot org  
> 2006-03-01 16:37 -------
> What about the testcase from comment #4?  I believe that's valid.
> 
> 
> -- 
> 
> 
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335
> 
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug, or are watching someone who is.
> 


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[tobi at gcc dot gnu dot org]

------- Comment #13 from tobi at gcc dot gnu dot org  2006-03-01 16:39 -------
(In reply to comment #12)
> What about the testcase from comment #4?  I believe that's valid.

D'oh, no it ain't because the RHS and the LHS in the assignment to b aren't
conforming.


-- 

tobi at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[tobi at gcc dot gnu dot org]

------- Comment #12 from tobi at gcc dot gnu dot org  2006-03-01 16:37 -------
What about the testcase from comment #4?  I believe that's valid.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[paul dot richard dot thomas at cea dot fr]

------- Comment #11 from paul dot richard dot thomas at cea dot fr  2006-03-01 16:30 -------
I believe that this PR should be closed as resolved.  Since p is uninitialized
in the original test case, it can and does produce out of range array
references for lu(comment #6).  The following development of the testcase runs
fine:

  program Driver
    real :: a(4,4)
    call factor
contains
    subroutine Factor
      real :: A(4, 4), B(4), lu(4,4)
      integer:: p(4)=(/1,2,3,4/)
      integer:: I
      I = 1
      do M = 1, 4
          LU(P(I), M) = Reduce (LU(P(I), M), LU(P(I), 1: M - 1), LU(P(1: M -
1), M))
      end do

      return
    end subroutine Factor  
    function Reduce (A, Row, Col)
      real :: A, Row(:), Col(:)
      print *, "size of row=", size(row)
      print *, "size of col=", size(col)
      reduce = 0
    end function Reduce
  end program Driver

producing

$ ./a
 size of row=           0
 size of col=           0
 size of row=           1
 size of col=           1
 size of row=           2
 size of col=           2
 size of row=           3
 size of col=           3

which shows that the programmer must take care of his or her array references!

The question of what to do with negative memory requests is of course tied up
by the confusion with integer overflows as the error message in
memory.c(allocate) says.  PR26017 is an unambiguous case where this error
should not be triggered and will function as a placeholder for this type of
problem. 


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[tobi at gcc dot gnu dot org]

------- Comment #10 from tobi at gcc dot gnu dot org  2006-01-10 00:10 -------
(In reply to comment #9)
> We don't get an error message but instead we call  _gfortran_internal_malloc
> with a zero value and invoked undefined behavior in malloc.

No.  This is specifically guarded against:

   69 /* Allocate memory for internal (compiler generated) use.  */
   70 
   71 void *
   72 internal_malloc_size (size_t size)
   73 {
   74   if (size == 0)
   75     return NULL;
   76 
   77   return get_mem (size);
   78 }
   79 
   80 extern void *internal_malloc (GFC_INTEGER_4);
   81 export_proto(internal_malloc);
   82 
   83 void *
   84 internal_malloc (GFC_INTEGER_4 size)
   85 {
   86 #ifdef GFC_CHECK_MEMORY
   87   /* Under normal circumstances, this is _never_ going to happen!  */
   88   if (size < 0)
   89     runtime_error ("Attempt to allocate a negative amount of memory.");
   90 
   91 #endif
   92   return internal_malloc_size ((size_t) size);
   93 }


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335

[Bug fortran/15335] runtime error "Attempt to allocate a negative amount of memory"

[pinskia at gcc dot gnu dot org]

------- Comment #9 from pinskia at gcc dot gnu dot org  2006-01-09 23:55 -------
We don't get an error message but instead we call  _gfortran_internal_malloc
with a zero value and invoked undefined behavior in malloc.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15335