[Bug fortran/39879] New: double free or corruption abort with gfortran

[Bug fortran/39879] New: double free or corruption abort with gfortran

[david dot sagan at gmail dot com]

The program (see attachment) was run on Linux. Platform details:

uname -a:
    Linux lnx180c.lns.cornell.edu 2.6.9-67.0.1.ELsmp #1 SMP Wed Dec 19 15:44:14
CST 2007 i686 i686 i386 GNU/Linux

cat /etc/redhat-release:
    Scientific Linux SL release 4.5 (Beryllium)

Compiler:
    GNU Fortran (GCC) 4.4.0 


Compile and run results:
> gfortran tao_program.f90
> ./a.out
 Setting bunch_params         113         113
 Have set
 After 1st set
 Setting bunch_params         113         113
 Have set
*** glibc detected *** double free or corruption (top): 0x09f873a0 ***
Abort


-- 
           Summary: double free or corruption abort with gfortran
           Product: gcc
           Version: 4.4.0
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: fortran
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: david dot sagan at gmail dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] double free or corruption abort with gfortran

[david dot sagan at gmail dot com]

------- Comment #1 from david dot sagan at gmail dot com  2009-04-24 06:36 -------
Created an attachment (id=17686)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=17686&action=view)
Example program which shows the bug


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] double free or corruption abort with gfortran

[dominiq at lps dot ens dot fr]

------- Comment #2 from dominiq at lps dot ens dot fr  2009-04-24 08:54 -------
Confirmed for gfortran 4.3.3, 4.4.0, and trunk; no error with 4.2.3.

g95 0.91 gives:

 Setting bunch_params 113 113
 Have set
 After 1st set
 Setting bunch_params 113 113
 Have set
 End
Remaining memory: 10848 bytes at 00800218 allocated at line 95 of pr39879.f90
Remaining memory: 60 bytes at 00100418 allocated at line 92 of pr39879.f90
Remaining memory: 224 bytes at 00100318 allocated at line 89 of pr39879.f90
Remaining memory: 60 bytes at 00100478 allocated at line 92 of pr39879.f90
Remaining memory: 10848 bytes at 00802e18 allocated at line 96 of pr39879.f90

and g95 0.92 (Apr 22 2009)

...
 End
Remaining memory: 68 bytes at 001003b8 allocated at line 92 of pr39879.f90
Remaining memory: 228 bytes at 001002b8 allocated at line 89 of pr39879.f90
Remaining memory: 68 bytes at 00100418 allocated at line 92 of pr39879.f90
Remaining memory: 10848 bytes at 00802e18 allocated at line 96 of pr39879.f90

Adding the lines

  deallocate (u%model%bunch_params)
  deallocate (u%design%bunch_params)
  deallocate (u%design, u%model)
  deallocate (s%u)

make g95 0.91 happy, g95 0.92 gives

...
 End
At line 102 of file pr39879_db.f90
Traceback: not available, compile with -ftrace=frame or -ftrace=full
Fortran runtime error: Deallocated a bad pointer

gfortran 4.2.3 is also happy, while the other versions give

...
 Have set
a.out(67213) malloc: *** error for object 0x809200: double free
*** set a breakpoint in malloc_error_break to debug
 End
a.out(67213) malloc: *** error for object 0x809200: double free
*** set a breakpoint in malloc_error_break to debug


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] double free or corruption abort with gfortran

[david dot sagan at gmail dot com]

------- Comment #3 from david dot sagan at gmail dot com  2009-04-24 13:06 -------
Corrected severity.


-- 

david dot sagan at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|major                       |critical


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] double free or corruption abort with gfortran

[kargl at gcc dot gnu dot org]

------- Comment #4 from kargl at gcc dot gnu dot org  2009-04-24 14:17 -------
This is a fortran problem.  It will never be given
a Severity of Critical or Major, which are typically
used by the GCC developers to denote bootstrap problems
or a problems with the C compiler.


-- 

kargl at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|critical                    |normal
           Priority|P3                          |P4


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] double free or corruption abort with gfortran

[david dot sagan at gmail dot com]

------- Comment #5 from david dot sagan at gmail dot com  2009-04-24 14:27 -------
Sorry. I was going by the documentation on the link ("crashes, loss of data,
severe memory leak"). Thanks for the information.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] double free or corruption abort with gfortran

[kargl at gcc dot gnu dot org]

------- Comment #6 from kargl at gcc dot gnu dot org  2009-04-24 17:59 -------
The problem is due to the null() in 

    character(200), pointer :: descrip => null() 

If you comment out this statement or remove '=> null()',
then the code compiles and runs.  A slighly reduced testcase
is

module test_struct

  interface assignment (=)
    module procedure tao_lat_equal_tao_lat
  end interface

  type bunch_params_struct
    integer n_live_particle          
  end type

  type tao_lattice_struct
    type (bunch_params_struct), allocatable :: bunch_params(:)
    type (bunch_params_struct), allocatable :: bunch_params2(:)
  end type

  type tao_universe_struct
    type (tao_lattice_struct), pointer :: model, design
    character(200), pointer :: descrip => null() 
  end type

  type tao_super_universe_struct
    type (tao_universe_struct), allocatable :: u(:)          
  end type

  type (tao_super_universe_struct), save, target :: s

  contains

    subroutine tao_lat_equal_tao_lat (lat1, lat2)
      implicit none
      type (tao_lattice_struct), intent(inout) :: lat1
      type (tao_lattice_struct), intent(in) :: lat2
    end subroutine

end module

program tao_program
  use test_struct
  implicit none
  type (tao_universe_struct), pointer :: u
  integer n
  allocate (s%u(1))
  u => s%u(1)
  allocate (u%design, u%model)
  n = 112
  allocate (u%model%bunch_params(0:n), u%design%bunch_params(0:n))
  u%model = u%design
  u%model = u%design
end program


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] double free or corruption abort with gfortran

[kargl at gcc dot gnu dot org]

-- 

kargl at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2009-04-24 18:00:01
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4/4.5 Regression] double free or corruption abort with gfortran

[burnus at gcc dot gnu dot org]

-- 

burnus at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |burnus at gcc dot gnu dot
                   |                            |org
           Keywords|                            |wrong-code
      Known to work|                            |4.2.1
            Summary|double free or corruption   |[4.3/4.4/4.5 Regression]
                   |abort with gfortran         |double free or corruption
                   |                            |abort with gfortran
   Target Milestone|---                         |4.3.4


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4/4.5 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #7 from pault at gcc dot gnu dot org  2009-04-25 18:06 -------
(In reply to comment #6)

With the pointer initialization, the assignment   u%model = u%design
is translated to:

  {
    struct tao_lattice_struct D.1667;

    D.1667 = *u->design;
    tao_lat_equal_tao_lat (u->model, &D.1667);
    if (D.1667.bunch_params.data != 0B)
      {
        __builtin_free (D.1667.bunch_params.data);
      }
    D.1667.bunch_params.data = 0B;
    if (D.1667.bunch_params2.data != 0B)
      {
        __builtin_free (D.1667.bunch_params2.data);
      }
    D.1667.bunch_params2.data = 0B;
  }

Thus the data pointers are doubly freed because they are not nullified in
u->design

Once the initialization is gone, the assignment becomes

  tao_lat_equal_tao_lat (u->model, u->design);

and the cause of the problem has vanaished.

Paul


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4/4.5 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #8 from pault at gcc dot gnu dot org  2009-04-26 16:49 -------
I have an "obvious"  (ie. after three hours staring at it:-( ) fix that is
regtesting.  I'd better take the PR!

Paul


-- 

pault at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |pault at gcc dot gnu dot org
                   |dot org                     |
             Status|NEW                         |ASSIGNED
   Last reconfirmed|2009-04-24 18:00:01         |2009-04-26 16:49:50
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4/4.5 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #9 from pault at gcc dot gnu dot org  2009-04-26 19:22 -------
(In reply to comment #8)
> I have an "obvious"  (ie. after three hours staring at it:-( ) fix that is

Index: gcc/fortran/resolve.c
===================================================================
--- gcc/fortran/resolve.c       (revision 146772)
+++ gcc/fortran/resolve.c       (working copy)
@@ -6645,7 +6645,8 @@
       if (rhs->expr_type == EXPR_VARIABLE
            && rhs->symtree->n.sym->ts.type == BT_DERIVED
            && has_default_initializer (rhs->symtree->n.sym->ts.derived)
-           && (lhs->symtree->n.sym == rhs->symtree->n.sym))
+           && (lhs->symtree->n.sym == rhs->symtree->n.sym)
+           && !(rhs->ref || lhs->ref))
         code->ext.actual->next->expr = gfc_get_parentheses (rhs);

       return true;

which regtests OK but I need a day or so to dwell on.  Although the above is my
doing, I do not recall for the life of me why a temporary had to be added in
this case.  I will attempt to recall that and figure out exactly which cases
are counter-indicated.

By the way, David, thanks for the report!

Paul


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4/4.5 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #10 from pault at gcc dot gnu dot org  2009-04-28 05:16 -------
Subject: Bug 39879

Author: pault
Date: Tue Apr 28 05:16:19 2009
New Revision: 146871

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=146871
Log:
2009-04-28  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * trans_expr.c (gfc_conv_procedure_call): Deep copy a derived
        type parentheses argument if it is a variable with allocatable
        components.

2009-04-28  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * gfortran.dg/alloc_comp_assign_10.f90: New test.

Added:
    trunk/gcc/testsuite/gfortran.dg/alloc_comp_assign_10.f90
Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/trans-expr.c
    trunk/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4/4.5 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #11 from pault at gcc dot gnu dot org  2009-04-28 05:29 -------
Subject: Bug 39879

Author: pault
Date: Tue Apr 28 05:29:44 2009
New Revision: 146872

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=146872
Log:
2009-04-28  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * trans_expr.c (gfc_conv_procedure_call): Deep copy a derived
        type parentheses argument if it is a variable with allocatable
        components.

2009-04-28  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * gfortran.dg/alloc_comp_assign_10.f90: New test.

Modified:
    trunk/gcc/fortran/trans-expr.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #12 from pault at gcc dot gnu dot org  2009-04-28 06:07 -------
Fixed on trunk

Will do 4.4 and 4.3 in a week or so.

Thanks for the report

Paul


-- 

pault at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[4.3/4.4/4.5 Regression]    |[4.3/4.4 Regression] double
                   |double free or corruption   |free or corruption abort
                   |abort with gfortran         |with gfortran


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #13 from pault at gcc dot gnu dot org  2009-05-10 10:44 -------
Subject: Bug 39879

Author: pault
Date: Sun May 10 10:44:22 2009
New Revision: 147336

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=147336
Log:
2009-05-10  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * trans_expr.c (gfc_conv_procedure_call): Deep copy a derived
        type parentheses argument if it is a variable with allocatable
        components.

2009-05-10  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * gfortran.dg/alloc_comp_assign_10.f90: New test.

Added:
    branches/gcc-4_4-branch/gcc/testsuite/gfortran.dg/alloc_comp_assign_10.f90
Modified:
    branches/gcc-4_4-branch/gcc/fortran/ChangeLog
    branches/gcc-4_4-branch/gcc/fortran/trans-expr.c
    branches/gcc-4_4-branch/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #14 from pault at gcc dot gnu dot org  2009-05-10 16:09 -------
Subject: Bug 39879

Author: pault
Date: Sun May 10 16:09:02 2009
New Revision: 147346

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=147346
Log:
2009-05-10  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * trans_expr.c (gfc_conv_procedure_call): Deep copy a derived
        type parentheses argument if it is a variable with allocatable
        components.

2009-05-10  Paul Thomas  <pault@gcc.gnu.org>

        PR fortran/39879
        * gfortran.dg/alloc_comp_assign_10.f90: New test.

Added:
    branches/gcc-4_3-branch/gcc/testsuite/gfortran.dg/alloc_comp_assign_10.f90
Modified:
    branches/gcc-4_3-branch/gcc/fortran/ChangeLog
    branches/gcc-4_3-branch/gcc/fortran/trans-expr.c
    branches/gcc-4_3-branch/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879

[Bug fortran/39879] [4.3/4.4 Regression] double free or corruption abort with gfortran

[pault at gcc dot gnu dot org]

------- Comment #15 from pault at gcc dot gnu dot org  2009-05-10 16:09 -------
Fixed on 4.3, 4.4 and 4.5 - thanks for the report.

Paul


-- 

pault at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39879