[Bug fortran/100651] [11/12/13/14 Regression] Weird memory corruption with multiple triggers

["fxcoudert at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fxcoudert at gcc dot gnu.org
   Last reconfirmed|2021-07-29 00:00:00         |2023-11-25
             Target|x86_64-linux-gnu,           |
                   |x86_64-apple-darwin         |

--- Comment #10 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
Further reduced to this:

meau /tmp $ cat a.f90
program main
  character(:), allocatable :: err_msg
  call to_int(err_msg)
  print *, 'allocated :', allocated(err_msg)
  print *, err_msg(1:7)
  print *, 'len :      ', len(err_msg)
  print *, 'err_msg :  ', err_msg
contains
  subroutine assert_code(err_msg)
    character(:), optional, allocatable :: err_msg
    err_msg = 'foo bar'
  end
  subroutine to_int(err_msg)
    character(:), optional, allocatable :: err_msg
    call assert_code(err_msg)
  end
end
meau /tmp $ gfortran a.f90 -O0 -g && ./a.out
 allocated : T
 foo bar
 len :          39026212
Operating system error: Cannot allocate memory
Memory allocation failure in xrealloc


The problem is in the code generated for the to_int subroutine, handling the
optional aspect. We can see above that the string is allocated and set
correctly. However, the length is not correctly set. You can see from the dump:

__attribute__((fn spec (". w ")))
void to_int (character(kind=1)[1:*_err_msg] * * err_msg, integer(kind=8) *
_err_msg)
{
  {
    character(kind=1)[1:*_err_msg] * * D.3001;
    integer(kind=8) D.3002;

    D.3001 = err_msg != 0B ? err_msg : 0B;
    D.3002 = err_msg != 0B ? *_err_msg : 0;
    assert_code (D.3001, &D.3002);
  }
}

The string length passed as second argument to assert_code is a pointer to a
local variable, and its value will not be propagated back into _err_msg (the
string length passed to to_int).