[Bug fortran/30720] New: runtime: check for empty array slices before allocating a negative amount of memory

[Bug fortran/30720] New: runtime: check for empty array slices before allocating a negative amount of memory

[dfranke at gcc dot gnu dot org]

The program below terminates with a runtime error due to an attempt to allocate
a negative amount of memory. The error occurs while allocating memory for a
temporary, empty, array slice. 

$> cat pr.f90
program runtime_error
  REAL    :: a(5), b
  INTEGER :: l, u
  l = 4
  u = 2

  a = (/ 1.0, 2.0, 3.0, 4.0, 5.0 /)
  b = f(a(l:u) - 3.0)

  CONTAINS
    REAL FUNCTION f(x)
      REAL, DIMENSION(:), INTENT(in) :: x
      f = sum(x)
    end function
END PROGRAM


There are two issues here:
 a) the runtime error as described above

$> gfortran-svn -O -fdump-tree-original -fdump-tree-optimized pr.f90

from dump-tree-original:
      int4 D.1036;
      void * D.1035;
      int4 D.1034;
      struct array1_real4 atmp.7;
      int4 D.1032;
      int4 D.1031;

      D.1031 = l;
      D.1032 = u;
      atmp.7.dtype = 281;
      atmp.7.dim[0].stride = 1;
      atmp.7.dim[0].lbound = 0;
      atmp.7.dim[0].ubound = u - D.1031;
      D.1034 = (u - D.1031) + 1;
      D.1035 = _gfortran_internal_malloc (D.1034 * 4);
      atmp.7.data = D.1035;

from dump-tree-optimized:
  void * SR.31;
  [...]
  SR.31 = _gfortran_internal_malloc (-4);
  _gfortran_internal_free (SR.31);


Here, if l > u+1, D.1035 will be negative and trigger the runtime error.
In this case, a runtime check whether the slice is empty before calling
_gfortran_internal_malloc() would result in code not stopping with a
(seemingly) unrelated error message.


 b) missed optimization during constant folding:
from dump-tree-original:
      struct array1_real4 atmp.7;

      atmp.7.dtype = 281;
      atmp.7.dim[0].stride = 1;
      atmp.7.dim[0].lbound = 0;
      atmp.7.dim[0].ubound = -1;
      atmp.7.data = 0B;
      [...]
      _gfortran_internal_free (atmp.7.data);

from dump-tree-optimzed:
  _gfortran_internal_free (0B);

If the boundaries are known at compile time, e.g. a(4:2), no memory is
allocated for the array descriptor, but _gfortran_internal_free(0B) is called
nonetheless. This call is still visible after optimization.

$> gfortran-svn -v
gcc version 4.3.0 20070126 (experimental)


-- 
           Summary: runtime: check for empty array slices before allocating
                    a negative amount of memory
           Product: gcc
           Version: 4.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: dfranke at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #1 from fxcoudert at gcc dot gnu dot org  2007-02-06 20:34 -------
Confirming this bug (both of them, actually).

For the missed-optimization, I think there's no reason to keep a library
function _gfortran_internal_free(x) that is equivalent to "if(x) free(x);", we
should generate that code directly.


-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
           Keywords|                            |missed-optimization, wrong-
                   |                            |code
      Known to fail|                            |4.3.0
   Last reconfirmed|0000-00-00 00:00:00         |2007-02-06 20:34:23
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #2 from fxcoudert at gcc dot gnu dot org  2007-02-06 21:00 -------
The wrong-code bug happens in gfc_trans_create_temp_array. For some reason, the
function argument to that function is false, and the code present to take care
of negative extent is not triggered. Thomas, you're the one who introduced this
argument:

2006-06-15  Thomas Koenig <Thomas.Koenig@online.de>

        * trans-array.h (gfc_trans_create_temp_array):  Add bool
        argument.
        * trans-arrray.c (gfc_trans_create_temp_array): Add extra
        argument "function" to show if we are translating a function.
        If we are translating a function, perform checks whether
        the size along any argument is negative.  In that case,
        allocate size 0.

do you remember why always performing that check (ie, turn function to be
always true) is not the right thing to do?


-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tkoenig at gcc dot gnu dot
                   |                            |org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #3 from fxcoudert at gcc dot gnu dot org  2007-02-06 23:13 -------
To keep things separate, I filed PR30723 for the missed optimization.


-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|missed-optimization         |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #4 from fxcoudert at gcc dot gnu dot org  2007-02-06 23:16 -------
Created an attachment (id=13018)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=13018&action=view)
Patch for this bug

Here's the patch I propose. It makes the code simpler by using a cond_expr
instead of using different statement blocks. Regtested in an earlier version on
i686-linux, regtesting of the current version in progress.


-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |fxcoudert at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[tkoenig at gcc dot gnu dot org]

------- Comment #5 from tkoenig at gcc dot gnu dot org  2007-02-07 17:52 -------
Hi FX,


> do you remember why always performing that check (ie, turn function to be
> always true) is not the right thing to do?

When working on this, I hit numerous testsuite regressions
when always checking for negative extents, and I couldn't find
out why.  So I only fixed the code path for the particular PR.

If you find something that works without that argument (which is
a bit of a kudge), so much the better.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #6 from fxcoudert at gcc dot gnu dot org  2007-02-07 19:10 -------
(In reply to comment #5)
> If you find something that works without that argument (which is
> a bit of a kudge), so much the better.

The patch I attached removes this argument, and it gives no regression on the
testsuite. I also simplified the conditional expression by using a COND_EXPR
instead of generating different blocks. Would you mind looking at it to see if
you spot anything odd?


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[tkoenig at gcc dot gnu dot org]

------- Comment #7 from tkoenig at gcc dot gnu dot org  2007-02-07 20:49 -------
(In reply to comment #6)

> The patch I attached removes this argument, and it gives no regression on the
> testsuite. I also simplified the conditional expression by using a COND_EXPR
> instead of generating different blocks. Would you mind looking at it to see if
> you spot anything odd?

>From eyballing the patch, it looks OK.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #8 from fxcoudert at gcc dot gnu dot org  2007-02-09 20:31 -------
Subject: Bug 30720

Author: fxcoudert
Date: Fri Feb  9 20:31:18 2007
New Revision: 121773

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=121773
Log:
        PR fortran/30720

        * trans-array.c (gfc_trans_create_temp_array): Remove use of the
        function argument. Always generate code for negative extent.
        Simplify said code.
        * trans-array.h (gfc_trans_create_temp_array): Change prototype.
        * trans-expr.c (gfc_conv_function_call): Remove use of last argument
        of gfc_trans_create_temp_array.
        * trans-intrinsic.c (gfc_conv_intrinsic_array_transfer): Likewise.
        * trans-stmt.c (gfc_conv_elemental_dependencies): Likewise.

        * gfortran.dg/array_function_1.f90: New test.

Added:
    trunk/gcc/testsuite/gfortran.dg/array_function_1.f90
Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/trans-array.c
    trunk/gcc/fortran/trans-array.h
    trunk/gcc/fortran/trans-expr.c
    trunk/gcc/fortran/trans-intrinsic.c
    trunk/gcc/fortran/trans-stmt.c
    trunk/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] [4.2/4.1 only] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|4.3.0                       |4.2.0 4.1.2
      Known to work|                            |4.3.0
            Summary|runtime: check for empty    |[4.2/4.1 only] runtime:
                   |array slices before         |check for empty array slices
                   |allocating a negative amount|before allocating a negative
                   |of memory                   |amount of memory
   Target Milestone|---                         |4.2.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] [4.2/4.1 only] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #9 from fxcoudert at gcc dot gnu dot org  2007-02-16 12:19 -------
Subject: Bug 30720

Author: fxcoudert
Date: Fri Feb 16 12:19:01 2007
New Revision: 122039

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=122039
Log:
2007-02-16  Francois-Xavier Coudert  <coudert@clipper.ens.fr>

        PR fortran/30720
        * trans-array.c (gfc_trans_create_temp_array): Remove use of the
        function argument. Always generate code for negative extent.
        Simplify said code.
        * trans-array.h (gfc_trans_create_temp_array): Change prototype.
        * trans-expr.c (gfc_conv_function_call): Remove use of last argument
        of gfc_trans_create_temp_array.
        * trans-intrinsic.c (gfc_conv_intrinsic_array_transfer): Likewise.
        * trans-stmt.c (gfc_conv_elemental_dependencies): Likewise.

2007-02-16  Francois-Xavier Coudert  <coudert@clipper.ens.fr>

        PR fortran/30611
        * trans-intrinsic.c (gfc_conv_intrinsic_repeat): Evaluate
        arguments only once. Generate check that NCOPIES argument is not
        negative.

2007-02-16  Thomas Koenig  <Thomas.Koenig@online.de>

        PR libfortran/30389
        * gfortran.h:  Remove gfc_simplify_init_1.
        * arith.h:  Remove third argument from gfc_compare_string.
        * arith.c(gfc_compare_expression):  Remove third argument
        from call to gfc_compare_string.
        (gfc_compare_string):  Remove third argument xcoll_table.
        Remove use of xcoll_table.
        * misc.c(gfc_init_1):  Remove call to gfc_simplify_init_1.
        * simplify.c(ascii_table):  Remove.
        (xascii_table): Likewise.
        (gfc_simplify_achar):  ICE if extract_int fails.  Remove use of
        ascii_table.  Warn if -Wsurprising and value < 0 or > 127.
        (gfc_simplify_char):  ICE if extract_int fails. Error if
        value < 0 or value > 255.
        (gfc_simplify_iachar):  Remove use of xascii_table.
        Char values outside of 0..255 are an ICE.
        (gfc_simplify_lge):  Remove use of xascii_table.
        (gfc_simplify_lgt):  Likewise.
        (gfc_simplify_lle):  Likewise.
        (gfc_simplify_llt):  Likewise.
        (invert_table):  Remove.
        (gfc_simplify_init_1):  Remove.

2007-02-16  Brooks Moses  <brooks.moses@codesourcery.com>

        PR 30381
        PR 30420
        * simplify.c (convert_mpz_to_unsigned): New function.
        (convert_mpz_to_signed): New function, largely based on
        twos_complement().
        (twos_complement): Removed.
        (gfc_simplify_ibclr): Add conversions to and from an
        unsigned representation before bit-twiddling.
        (gfc_simplify_ibset): Same.
        (gfc_simplify_ishftc): Add checks for overly large
        constant arguments, only check the third argument if
        it's present, carry over high bits into the result as
        appropriate, and perform the final conversion back to
        a signed representation using the correct sign bit.
        (gfc_simplify_not): Removed unnecessary masking.

2007-02-16  Francois-Xavier Coudert  <coudert@clipper.ens.fr>

        PR fortran/30720
        * gfortran.dg/array_function_1.f90: New test.

2007-02-16  Francois-Xavier Coudert  <coudert@clipper.ens.fr>

        PR fortran/30611
        * gcc/testsuite/gfortran.dg/repeat_1.f90: New test.

2007-02-16  Thomas Koenig  <Thomas.Koenig@online.de>

        PR libfortran/30389
        * gfortran.dg/achar_2.f90:  New test.
        * gfortran.dg/achar_3.f90:  New test.

2007-02-16  Brooks Moses  <brooks.moses@codesourcery.com>

        * gfortran.dg/chkbits.f90: Added IBCLR tests; test calls
        for different integer kinds.
        * gfortran.dg/ishft.f90: Renamed to ishft_1.f90...
        * gfortran.dg/ishft_1.f90: ...Renamed from ishft.f90.
        * gfortran.dg/ishft_2.f90: New test.
        * gfortran.dg/ishft_3.f90: New test.

2007-02-16  Francois-Xavier Coudert  <coudert@clipper.ens.fr>

        PR fortran/30611
        * intrinsics/string_intrinsics.c (string_repeat): Don't check
        if ncopies is negative.

Added:
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/achar_2.f90
      - copied unchanged from r121255,
trunk/gcc/testsuite/gfortran.dg/achar_2.f90
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/achar_3.f90
      - copied unchanged from r121255,
trunk/gcc/testsuite/gfortran.dg/achar_3.f90
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/array_function_1.f90
      - copied unchanged from r121773,
trunk/gcc/testsuite/gfortran.dg/array_function_1.f90
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/ishft_1.f90
      - copied unchanged from r120634,
trunk/gcc/testsuite/gfortran.dg/ishft_1.f90
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/ishft_2.f90
      - copied unchanged from r120634,
trunk/gcc/testsuite/gfortran.dg/ishft_2.f90
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/ishft_3.f90
      - copied unchanged from r120634,
trunk/gcc/testsuite/gfortran.dg/ishft_3.f90
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/repeat_1.f90
      - copied unchanged from r121581,
trunk/gcc/testsuite/gfortran.dg/repeat_1.f90
Removed:
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/ishft.f90
Modified:
    branches/gcc-4_2-branch/gcc/fortran/ChangeLog
    branches/gcc-4_2-branch/gcc/fortran/arith.c
    branches/gcc-4_2-branch/gcc/fortran/arith.h
    branches/gcc-4_2-branch/gcc/fortran/gfortran.h
    branches/gcc-4_2-branch/gcc/fortran/misc.c
    branches/gcc-4_2-branch/gcc/fortran/simplify.c
    branches/gcc-4_2-branch/gcc/fortran/trans-array.c
    branches/gcc-4_2-branch/gcc/fortran/trans-array.h
    branches/gcc-4_2-branch/gcc/fortran/trans-expr.c
    branches/gcc-4_2-branch/gcc/fortran/trans-intrinsic.c
    branches/gcc-4_2-branch/gcc/fortran/trans-stmt.c
    branches/gcc-4_2-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_2-branch/gcc/testsuite/gfortran.dg/chkbits.f90
    branches/gcc-4_2-branch/libgfortran/ChangeLog
    branches/gcc-4_2-branch/libgfortran/intrinsics/string_intrinsics.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720

[Bug fortran/30720] [4.1 only] runtime: check for empty array slices before allocating a negative amount of memory

[fxcoudert at gcc dot gnu dot org]

------- Comment #10 from fxcoudert at gcc dot gnu dot org  2007-02-16 15:55 -------
Fixed on mainline and 4.2. Empty slices are hopelessly broken on 4.1, I think,
so closing.


-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to fail|4.2.0 4.1.2                 |4.1.2
      Known to work|4.3.0                       |4.3.0 4.2.0
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30720