[Bug fortran/33554] New: Runtime segfault with nested derived types with -O0

[Bug fortran/33554] New: Runtime segfault with nested derived types with -O0

[anlauf at gmx dot de]

Hi,

the attached program crashes at runtime when compiled *without* optimization:

% gfc -g gfcbug72.f90 -fbounds-check -fbacktrace -O0 && ./a.out
 before construct_temp, size (temp) =           2

Program received signal 11 (SIGSEGV): Segmentation fault.

Backtrace for this error:
  + /lib/libc.so.6 [0x4007cbf8]
  + function __gfcbug72_MOD_setup (0x8049CA4)
    at line 23 of file gfcbug72.f90
  + in the main program
    at line 40 of file gfcbug72.f90
  + /lib/libc.so.6(__libc_start_main+0xce) [0x40068d3e]


-- 
           Summary: Runtime segfault with nested derived types with -O0
           Product: gcc
           Version: 4.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: anlauf at gmx dot de
  GCC host triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] Runtime segfault with nested derived types with -O0

[anlauf at gmx dot de]

------- Comment #1 from anlauf at gmx dot de  2007-09-25 17:41 -------
Created an attachment (id=14252)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=14252&action=view)
Demo code


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] Seg.fault: Default initialization of derived type uses initialized values

[burnus at gcc dot gnu dot org]

------- Comment #2 from burnus at gcc dot gnu dot org  2007-09-25 19:16 -------
Work around:  Change the intent to INOUT in:
  subroutine construct_temp (temp)
    type (t_temp), intent(out) :: temp (:)

or - which is effectively the same - remove the default initializer:

  type t_datum
    character(len=8) :: mn = ''

>From the dump:

construct_temp (temp)
{
  int8 ubound.0;
  int8 stride.1;
  if (temp != 0)
    {
      {
        int8 D.888;
        int8 D.887;

        D.887 = offset.2;
        D.888 = ubound.0;

Question to the reader: Which value has ubound and offset in the assignment
above?


-- 

burnus at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |burnus at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   GCC host triplet|i686-pc-linux-gnu           |
           Keywords|                            |wrong-code
   Last reconfirmed|0000-00-00 00:00:00         |2007-09-25 19:16:45
               date|                            |
            Summary|Runtime segfault with nested|Seg.fault: Default
                   |derived types with -O0      |initialization of derived
                   |                            |type uses initialized values


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] Seg.fault: Default initialization of derived type uses uninitialized values

[dominiq at lps dot ens dot fr]

------- Comment #3 from dominiq at lps dot ens dot fr  2007-09-25 20:08 -------
On Darwin8 I get:

[karma] f90/bug% gfc -O0 -fbounds-check -fbacktrace -g pr33554.f90
[karma] f90/bug% a.out
 before construct_temp, size (temp) =           2
 Enter  construct_temp, size (temp) =           2
 Leave  construct_temp
 after  construct_temp
 before construct_temp, size (temp) =           2
 Enter  construct_temp, size (temp) =           2
 Leave  construct_temp
 after  construct_temp

I get the same result with different options, or with g95 and xlf.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] Seg.fault: Default initialization of derived type uses uninitialized values

[anlauf at gmx dot de]

------- Comment #4 from anlauf at gmx dot de  2007-09-26 05:19 -------
(In reply to comment #2)

This appears to be a regression, as the following version does not crash:
GNU Fortran (GCC) 4.3.0 20070416 (experimental)

while it occurs with
GNU Fortran (GCC) 4.3.0 20070907 (experimental) [trunk revision 128220]
and later.

> From the dump:
> 
> construct_temp (temp)
> {
>   int8 ubound.0;
>   int8 stride.1;
>   if (temp != 0)
>     {
>       {
>         int8 D.888;
>         int8 D.887;
> 
>         D.887 = offset.2;
>         D.888 = ubound.0;
> 
> Question to the reader: Which value has ubound and offset in the assignment
> above?

The dump produced by the 20070416 version looks quite different.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[anlauf at gmx dot de]

------- Comment #5 from anlauf at gmx dot de  2007-09-26 07:10 -------
(In reply to comment #4)

I found backups of other gfortran versions:

Working:
GNU Fortran (GCC) 4.3.0 20070420 (experimental)

Failing:
GNU Fortran (GCC) 4.3.0 20070805 (experimental)

So it's a regression.


-- 

anlauf at gmx dot de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Seg.fault: Default          |[4.3 regression] Seg.fault:
                   |initialization of derived   |Default initialization of
                   |type uses uninitialized     |derived type uses
                   |values                      |uninitialized values


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[dominiq at lps dot ens dot fr]

------- Comment #6 from dominiq at lps dot ens dot fr  2007-09-26 07:45 -------
> Failing:
> GNU Fortran (GCC) 4.3.0 20070805 (experimental)

Did you try a more recent version? I don't see the problem with

Target: powerpc-apple-darwin8
gcc version 4.3.0 20070925 (experimental) (GCC) -> revision 128768


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[burnus at gcc dot gnu dot org]

------- Comment #7 from burnus at gcc dot gnu dot org  2007-09-26 07:53 -------
> I found backups of other gfortran versions:

More tests:
Works: 2007-07-23-r126835
Fails: 2007-07-25-r126902

This probably caused by:
http://gcc.gnu.org/ml/gcc-cvs/2007-07/msg00745.html
r126885 | pault | 2007-07-24 21:15:27 +0200 (Di, 24 Jul 2007) | 36 lines
2007-07-24 Paul Thomas <pault@gcc.gnu.org>
        PR 31205
        PR 32842
        * trans-expr.c (gfc_conv_function_call): Remove the default
        initialization of intent(out) derived types.
[...]


> > GNU Fortran (GCC) 4.3.0 20070805 (experimental)
> Did you try a more recent version?
Yes, it is crashing with today's version and yesterday's -ftree-dump-original
looks wrong; the problem with memory-access bugs is that it is quite random
whether it is detected or not - even valgrind does not always detect it. (It
does here, which is no surprise as the program crashes with a segmentation
fault.)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[dominiq at lps dot ens dot fr]

------- Comment #8 from dominiq at lps dot ens dot fr  2007-09-26 08:10 -------
Now I get a bus error, but I have to use:

gfc -m64 -g pr33554.f90 -O0

with

gfc -m64 -g pr33554.f90 -fbounds-check -O0

the bus error disappear.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[pinskia at gcc dot gnu dot org]

-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.3.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[pault at gcc dot gnu dot org]

------- Comment #9 from pault at gcc dot gnu dot org  2007-09-27 21:31 -------
> This probably caused by:
> http://gcc.gnu.org/ml/gcc-cvs/2007-07/msg00745.html
> r126885 | pault | 2007-07-24 21:15:27 +0200 (Di, 24 Jul 2007) | 36 lines
> 2007-07-24 Paul Thomas <pault@gcc.gnu.org>
>         PR 31205
>         PR 32842
>         * trans-expr.c (gfc_conv_function_call): Remove the default
>         initialization of intent(out) derived types.

I'd better look into it then hadn't I?

Perhaps, Tobias, we had better start a meta-PR of regressions that I have
caused? :-)

Paul


-- 

pault at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |pault at gcc dot gnu dot org
                   |dot org                     |
             Status|NEW                         |ASSIGNED
   Last reconfirmed|2007-09-25 19:16:45         |2007-09-27 21:31:46
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[pault at gcc dot gnu dot org]

------- Comment #10 from pault at gcc dot gnu dot org  2007-10-01 04:39 -------
(In reply to comment #9)
> > This probably caused by:
> > http://gcc.gnu.org/ml/gcc-cvs/2007-07/msg00745.html
> > r126885 | pault | 2007-07-24 21:15:27 +0200 (Di, 24 Jul 2007) | 36 lines
> > 2007-07-24 Paul Thomas <pault@gcc.gnu.org>
> >         PR 31205
> >         PR 32842
> >         * trans-expr.c (gfc_conv_function_call): Remove the default
> >         initialization of intent(out) derived types.
> 

Yes, the initialization is occurring in the wrong place in
gfc_trans_deferred_vars.  It looks to be easily fixable.  I'll be onto it
tonight.

Paul


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[pault at gcc dot gnu dot org]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 3806 bytes --]



------- Comment #11 from pault at gcc dot gnu dot org  2007-10-01 07:01 -------
(In reply to comment #10)
> Yes, the initialization is occurring in the wrong place in
> gfc_trans_deferred_vars.  It looks to be easily fixable.  I'll be onto it
> tonight.

I figured out how to do it on the way to work.  The patch below fixes the
regression and is regtesting (slowly, under Cygwin!).

The trick is to make sure that the block doing the initialization is added to
the top of the function body, so that it follows all the setting of bounds and
offsets.

Paul

Index: gcc/fortran/trans-decl.c
===================================================================
*** gcc/fortran/trans-decl.c    (révision 128833)
--- gcc/fortran/trans-decl.c    (copie de travail)
*************** gfc_trans_vla_type_sizes (gfc_symbol *sy
*** 2558,2563 ****
--- 2558,2600 ----
  }


+ /* Initialize INTENT(OUT) derived type dummies.  */
+ static tree
+ init_intent_out_dt (gfc_symbol * proc_sym, tree body)
+ {
+   stmtblock_t fnblock;
+   gfc_init_block (&fnblock);
+   gfc_formal_arglist *f;
+   gfc_expr *tmpe;
+   tree tmp;
+   tree present;
+
+   for (f = proc_sym->formal; f; f = f->next)
+     {
+       if (f->sym && f->sym->attr.intent == INTENT_OUT
+           && f->sym->ts.type == BT_DERIVED
+           && !f->sym->ts.derived->attr.alloc_comp
+           && f->sym->value)
+       {
+         gcc_assert (!f->sym->attr.allocatable);
+         gfc_set_sym_referenced (f->sym);
+         tmpe = gfc_lval_expr_from_sym (f->sym);
+         tmp = gfc_trans_assignment (tmpe, f->sym->value, false);
+
+         present = gfc_conv_expr_present (f->sym);
+         tmp = build3 (COND_EXPR, TREE_TYPE (tmp), present,
+                       tmp, build_empty_stmt ());
+         gfc_add_expr_to_block (&fnblock, tmp);
+         gfc_free_expr (tmpe);
+       }
+     }
+
+   gfc_add_expr_to_block (&fnblock, body);
+   return gfc_finish_block (&fnblock);
+ }
+
+
+
  /* Generate function entry and exit code, and add it to the function body.
     This includes:
      Allocation and initialization of array variables.
*************** gfc_trans_deferred_vars (gfc_symbol * pr
*** 2612,2617 ****
--- 2649,2659 ----
                    && proc_sym->ts.type == BT_COMPLEX);
      }

+   /* Initialize the INTENT(OUT) derived type dummy arguments.  This
+      should be done here so that the offsets and lbounds of arrays
+      are available.  */
+   fnbody = init_intent_out_dt (proc_sym, fnbody);
+
    for (sym = proc_sym->tlink; sym != proc_sym; sym = sym->tlink)
      {
        bool sym_has_alloc_comp = (sym->ts.type == BT_DERIVED)
*************** gfc_trans_deferred_vars (gfc_symbol * pr
*** 2709,2735 ****
          gcc_assert (f->sym->ts.cl->backend_decl != NULL);
          if (TREE_CODE (f->sym->ts.cl->backend_decl) == PARM_DECL)
            gfc_trans_vla_type_sizes (f->sym, &body);
-       }
-
-       /* If an INTENT(OUT) dummy of derived type has a default
-        initializer, it must be initialized here.  */
-       if (f->sym && f->sym->attr.intent == INTENT_OUT
-           && f->sym->ts.type == BT_DERIVED
-           && !f->sym->ts.derived->attr.alloc_comp
-           && f->sym->value)
-       {
-         gfc_expr *tmpe;
-         tree tmp, present;
-         gcc_assert (!f->sym->attr.allocatable);
-         gfc_set_sym_referenced (f->sym);
-         tmpe = gfc_lval_expr_from_sym (f->sym);
-         tmp = gfc_trans_assignment (tmpe, f->sym->value, false);
-
-         present = gfc_conv_expr_present (f->sym);
-         tmp = build3 (COND_EXPR, TREE_TYPE (tmp), present,
-                       tmp, build_empty_stmt ());
-         gfc_add_expr_to_block (&body, tmp);
-         gfc_free_expr (tmpe);
        }
      }

--- 2751,2756 ----


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[pault at gcc dot gnu dot org]

------- Comment #12 from pault at gcc dot gnu dot org  2007-10-02 08:03 -------
Subject: Bug 33554

Author: pault
Date: Tue Oct  2 08:03:07 2007
New Revision: 128950

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=128950
Log:
2007-10-02  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/33554
        * trans-decl.c (init_intent_out_dt): New function.
        (gfc_trans_deferred_vars): Remove the code for default
        initialization of INTENT(OUT) derived types and put it
        in the new function.  Call it earlier than before, so
        that array offsets and lower bounds are available.

2007-10-02  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/33554
        * gfortran.dg/intent_out_2.f90: New test.


Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/trans-decl.c
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gfortran.dg/intent_out_2.f90


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[pault at gcc dot gnu dot org]

------- Comment #13 from pault at gcc dot gnu dot org  2007-10-02 08:46 -------
Fixed on trunk

Paul


-- 

pault at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554

[Bug fortran/33554] [4.3 regression] Seg.fault: Default initialization of derived type uses uninitialized values

[patchapp at dberlin dot org]

------- Comment #14 from patchapp at dberlin dot org  2007-10-06 15:10 -------
Subject: Bug number PR33554

A patch for this bug has been added to the patch tracker.
The mailing list url for the patch is
http://gcc.gnu.org/ml/gcc-patches/2007-10/msg00030.html


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=33554