[Bug fortran/100651] New: Weird memory corruption with multiple triggers

[Bug fortran/100651] New: Weird memory corruption with multiple triggers

[matthew.thompson at nasa dot gov]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

            Bug ID: 100651
           Summary: Weird memory corruption with multiple triggers
           Product: gcc
           Version: 11.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: matthew.thompson at nasa dot gov
  Target Milestone: ---

Created attachment 50838
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50838&action=edit
Reproducing program

This is a bug that is tripped by GCC 9.3.0, 10.1.0, and 11.1.0 (at least, but I
only have access to those) on Linux and macOS. For the rest of this bug report,
I'll be using macOS (as it's my main workstation). First:

❯ gfortran -v
Using built-in specs.
COLLECT_GCC=gfortran
COLLECT_LTO_WRAPPER=/Users/mathomp4/installed/Core/gcc-gfortran/11.1.0/libexec/gcc/x86_64-apple-darwin19.6.0/11.1.0/lto-wrapper
Target: x86_64-apple-darwin19.6.0
Configured with: ../gcc-11.1.0/configure
--prefix=/Users/mathomp4/installed/Core/gcc-gfortran/11.1.0
--enable-languages=c,c++,fortran
--with-sysroot=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.1.0 (GCC)

If you compile and run (NOTE: the -g -O0 is not necessary, I only use it to
make the traceback a bit better):

❯ gfortran -g -O0 opt_string.F90
❯ ./a.out
 opt_string.F90         122 T
 opt_string.F90         123   542594713
a.out(15473,0x1129d4e00) malloc: can't allocate region
:*** mach_vm_map(size=140733735985152, flags: 100) failed (error code=3)
a.out(15473,0x1129d4e00) malloc: *** set a breakpoint in malloc_error_break to
debug
Operating system error: Cannot allocate memory
Memory allocation failure in xrealloc

Error termination. Backtrace:
#0  0x103249de2 in ???
#1  0x10324aab5 in ???
#2  0x10324acb3 in ???
#3  0x10324939a in ???
#4  0x10347a455 in ???
#5  0x10346bb99 in ???
#6  0x1034740a7 in ???
#7  0x1034792be in ???
#8  0x10347a237 in ???
#9  0x103231c2d in __test_intnode_MOD_test_casting_fail
        at /Users/mathomp4/F90Files/TomOptStringGCCBug/opt_string.F90:124
#10  0x103231c5c in MAIN__
        at /Users/mathomp4/F90Files/TomOptStringGCCBug/opt_string.F90:135
#11  0x103231c98 in main
        at /Users/mathomp4/F90Files/TomOptStringGCCBug/opt_string.F90:132

The (runtime) error disappears if *any* of the following 3 lines are commented
out/deleted:
* Line 31 (generic assignment)
* Line 85 (unused component of a derived type)
* Line 121 (unused local variable)

On Linux the output is:

$ ./a.out
 opt_string.F90         122 T
 opt_string.F90         123 -1431350024
Operating system error: Cannot allocate memory
Memory allocation failure in xrealloc

Error termination. Backtrace:
#0  0x2aaaaaf20a07 in write_character
        at ../../../gcc-11.1.0/libgfortran/io/write.c:1416
#1  0x2aaaaaf25ba6 in list_formatted_write_scalar
        at ../../../gcc-11.1.0/libgfortran/io/write.c:1900
#2  0x400cef in __test_intnode_MOD_test_casting_fail
        at /home/mathomp4/F90Files/TomOptStringGCCBug/opt_string.F90:124
#3  0x400d1e in MAIN__
        at /home/mathomp4/F90Files/TomOptStringGCCBug/opt_string.F90:135
#4  0x400d55 in main
        at /home/mathomp4/F90Files/TomOptStringGCCBug/opt_string.F90:132

[Bug fortran/100651] Weird memory corruption with multiple triggers

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

G. Steinmetz <gscfq@t-online.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |gscfq@t-online.de

--- Comment #1 from G. Steinmetz <gscfq@t-online.de> ---

Confirmed on my environment (x86_64-pc-linux-gnu), that example gives :

$ a.out
 T
  -279921664
Operating system error: Cannot allocate memory
Memory allocation failure in xrealloc

Error termination. Backtrace:
#0  0x40d217 in write_character
        at ../../../libgfortran/io/write.c:1416
#1  0x41227e in list_formatted_write_scalar
        at ../../../libgfortran/io/write.c:1900
#2  0x402688 in __test_intnode_MOD_test_casting_fail
        at .../pr100651.f90:126
#3  0x4026b7 in MAIN__
        at .../pr100651.f90:136
#4  0x4026ee in main
        at .../pr100651.f90:133


Initialization completed without "optional" and "present..." :

$ a.out
 T
           7
 err_msg: foo bar

[Bug fortran/100651] Weird memory corruption with multiple triggers

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

--- Comment #2 from G. Steinmetz <gscfq@t-online.de> ---

Simplified a bit :


$ cat z1.f90
module m
   type :: t
   contains
      procedure, pass(this) :: assign_to_string
      generic :: assignment(=) => assign_to_string
   end type
contains
   subroutine assign_to_string(string, this)
      character(:), allocatable, intent(out) :: string
      class(t), intent(in) :: this
   end
   subroutine assert_code(err_msg)
      character(:), optional, allocatable, intent(inout) :: err_msg
      err_msg = 'foo bar'
   end
   function to_int(err_msg) result(ptr)
      integer :: ptr
      character(:), optional, allocatable, intent(inout) :: err_msg
      ptr = 1
      call assert_code(err_msg)
   end
end
program main
   use m
   type, extends(t) :: t2
      real(8) :: value = 1
   end type
   type(t2) :: x
   integer :: n
   character(:), allocatable :: err_msg
   x = t2(2)
   n = to_int(err_msg)
   print *, 'allocated :', allocated(err_msg)
   print *, 'len :      ', len(err_msg)
!  print *, 'len_trim : ', len_trim(err_msg)
   print *, 'err_msg :  ', err_msg
end


$ cat z2.f90
module m
   type :: t
   contains
      procedure, pass(this) :: assign_to_string
      generic :: assignment(=) => assign_to_string
   end type
contains
   subroutine assign_to_string(string, this)
      character(:), allocatable, intent(out) :: string
      class(t), intent(in) :: this
   end
   subroutine assert_code(err_msg)
      character(:), allocatable, intent(inout) :: err_msg
      err_msg = 'foo bar'
   end
   function to_int(err_msg) result(ptr)
      integer :: ptr
      character(:), allocatable, intent(inout) :: err_msg
      ptr = 1
      call assert_code(err_msg)
   end
end
program main
   use m
   type, extends(t) :: t2
      real(8) :: value = 1
   end type
   type(t2) :: x
   integer :: n
   character(:), allocatable :: err_msg
   x = t2(2)
   n = to_int(err_msg)
   print *, 'allocated :', allocated(err_msg)
   print *, 'len :      ', len(err_msg)
!  print *, 'len_trim : ', len_trim(err_msg)
   print *, 'err_msg :  ', err_msg
end



$ gfortran-12-20210516 z1.f90 -g -O0 && ./a.out
 allocated : T
 len :                 0
Operating system error: Cannot allocate memory
Memory allocation failure in xrealloc

Error termination. Backtrace:
#0  0x40d1c7 in write_character
        at ../../../libgfortran/io/write.c:1416
#1  0x41222e in list_formatted_write_scalar
        at ../../../libgfortran/io/write.c:1900
#2  0x40265e in MAIN__
        at .../z1.f90:36
#3  0x4026a4 in main
        at .../z1.f90:24


$ gfortran-12-20210516 z2.f90 -g -O0 && ./a.out
 allocated : T
 len :                 7
 err_msg :  foo bar

[Bug fortran/100651] Weird memory corruption with multiple triggers

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Iain Sandoe <iains at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |iains at gcc dot gnu.org

--- Comment #3 from Iain Sandoe <iains at gcc dot gnu.org> ---
could you please:

* identify the linux and macOS platforms affected (add to target in the BZ
here) 

* identify if this is a regression (i.e. does 8.5 work as expected?)
 we adjust the title to read [N,M,O Regression blah blah] if that is so.

[Bug fortran/100651] Weird memory corruption with multiple triggers

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Iain Sandoe <iains at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |x86_64-linux-gnu,
                   |                            |x86_64-apple-darwin
   Last reconfirmed|                            |2021-07-29
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #4 from Iain Sandoe <iains at gcc dot gnu.org> ---
(In reply to Iain Sandoe from comment #3)
> could you please:
> 
> * identify the linux and macOS platforms affected (add to target in the BZ
> here) 
> 
> * identify if this is a regression (i.e. does 8.5 work as expected?)
>  we adjust the title to read [N,M,O Regression blah blah] if that is so.

NM.. I checked it - it fails for at least gcc5.5+ on Darwin and 8.3+ on Linux
(so not a regression - but the fortran folks probably should look at it).

(disclaimer: I didn't read the code - just tested that it failed on several
systems)

[Bug fortran/100651] Weird memory corruption with multiple triggers

[matthew.thompson at nasa dot gov]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

--- Comment #5 from Matt Thompson <matthew.thompson at nasa dot gov> ---
Iain,

The Linux system would be SUSE Linux Enterprise Server 12 SP3. The macOS system
is macOS 11.5.1.

On the Linux machine, I can confirm the error with (I only have some versions
of GCC available):

* 8.3.0
* 9.2.0
* 10.1.0
* 11.1.0

On the macOS where I just built 11.2.0, I see the same crash.

Now, with 7.4.0 and 6.5.0 (can only test on Linux), I don't get the run-time
crash. Instead, I believe it works...sort of? To wit:

$ ./a.out
 opt_string.F90         122 T
 opt_string.F90         123       10922
 err_msg: foo bar, err_msg: foo bar, err_msg: foo bar, err_msg: foo bar,
err_msg: foo bar, err_msg: foo bar, err_msg: foo bar, err_msg: foo bar,
err_msg: foo bar, err_msg: foo bar, err_msg: foo bar, err_msg: foo bar,
err_msg: foo bar, err_msg: foo bar, err_msg: foo bar, err_msg: foo bar,
err_msg: foo bar,...

That last bit goes on for a while. This isn't the intended behavior. Intel
2021.3 does:

$ ./a.out
 opt_string.F90         122 T
 opt_string.F90         123           7
 err_msg: foo bar

and NAG 7.0_7048 does:

$ ./a.out
 opt_string.F90 122 T
 opt_string.F90 123 7
 err_msg: foo bar

We are unsure why GNU is doing this...recursive-like behavior? It's not like
the routine is called in a loop!

[Bug fortran/100651] [9/10/11/12 Regression] Weird memory corruption with multiple triggers

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Iain Sandoe <iains at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Weird memory corruption     |[9/10/11/12 Regression]
                   |with multiple triggers      |Weird memory corruption
                   |                            |with multiple triggers

--- Comment #6 from Iain Sandoe <iains at gcc dot gnu.org> ---
(In reply to Matt Thompson from comment #5)

Thanks for the additional checks.

> $ ./a.out
>  opt_string.F90         122 T
>  opt_string.F90         123           7
>  err_msg: foo bar
> 
> and NAG 7.0_7048 does:
> 
> $ ./a.out
>  opt_string.F90 122 T
>  opt_string.F90 123 7
>  err_msg: foo bar

Then, this is indeed a regression:

gcc-5.5:
 /source/test/fortran/pr100651.F90         122 T
 /source/test/fortran/pr100651.F90         123       32727
 err_msg: foo bar

gcc-6-5;
 /source/test/fortran/pr100651.F90         122 T
 /source/test/fortran/pr100651.F90         123       32767
 err_msg: foo bar    ????H\?

gcc-7.5
 /source/test/fortran/pr100651.F90         122 T
 /source/test/fortran/pr100651.F90         123       32767
 err_msg: foo bar0000????H\?

gcc8.5:
 /source/test/fortran/pr100651.F90         122 T
 /source/test/fortran/pr100651.F90         123  1569183428
t(23248,0x106ee05c0) malloc: can't allocate region
*** mach_vm_map(size=140734762573824) failed (error code=3)
t(23248,0x106ee05c0) malloc: *** set a breakpoint in malloc_error_break to
debug
Operating system error: Cannot allocate memory
Memory allocation failure in xrealloc

Error termination. Backtrace:
#0  0x106659f9d
.. etc.

[Bug fortran/100651] [9/10/11/12 Regression] Weird memory corruption with multiple triggers

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |9.5
           Keywords|                            |wrong-code

[Bug fortran/100651] [9/10/11/12 Regression] Weird memory corruption with multiple triggers

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P4

[Bug fortran/100651] [10/11/12/13 Regression] Weird memory corruption with multiple triggers

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.5                         |10.4

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9 branch is being closed

[Bug fortran/100651] [10/11/12/13 Regression] Weird memory corruption with multiple triggers

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug fortran/100651] [11/12/13/14 Regression] Weird memory corruption with multiple triggers

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.

[Bug fortran/100651] [11/12/13/14 Regression] Weird memory corruption with multiple triggers

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fxcoudert at gcc dot gnu.org
   Last reconfirmed|2021-07-29 00:00:00         |2023-11-25
             Target|x86_64-linux-gnu,           |
                   |x86_64-apple-darwin         |

--- Comment #10 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
Further reduced to this:

meau /tmp $ cat a.f90
program main
  character(:), allocatable :: err_msg
  call to_int(err_msg)
  print *, 'allocated :', allocated(err_msg)
  print *, err_msg(1:7)
  print *, 'len :      ', len(err_msg)
  print *, 'err_msg :  ', err_msg
contains
  subroutine assert_code(err_msg)
    character(:), optional, allocatable :: err_msg
    err_msg = 'foo bar'
  end
  subroutine to_int(err_msg)
    character(:), optional, allocatable :: err_msg
    call assert_code(err_msg)
  end
end
meau /tmp $ gfortran a.f90 -O0 -g && ./a.out
 allocated : T
 foo bar
 len :          39026212
Operating system error: Cannot allocate memory
Memory allocation failure in xrealloc


The problem is in the code generated for the to_int subroutine, handling the
optional aspect. We can see above that the string is allocated and set
correctly. However, the length is not correctly set. You can see from the dump:

__attribute__((fn spec (". w ")))
void to_int (character(kind=1)[1:*_err_msg] * * err_msg, integer(kind=8) *
_err_msg)
{
  {
    character(kind=1)[1:*_err_msg] * * D.3001;
    integer(kind=8) D.3002;

    D.3001 = err_msg != 0B ? err_msg : 0B;
    D.3002 = err_msg != 0B ? *_err_msg : 0;
    assert_code (D.3001, &D.3002);
  }
}

The string length passed as second argument to assert_code is a pointer to a
local variable, and its value will not be propagated back into _err_msg (the
string length passed to to_int).

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |anlauf at gcc dot gnu.org

--- Comment #11 from anlauf at gcc dot gnu.org ---
Possibly related: pr93762 (see Steve's analysis).

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

--- Comment #12 from anlauf at gcc dot gnu.org ---
Created attachment 56690
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56690&action=edit
Draft patch

Very rough patch that fixes this PR and also pr93762.
Need more thorough testing.

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |10.5.0, 11.4.1, 12.3.1,
                   |                            |13.2.1, 14.0, 7.5.0, 8.5.0,
                   |                            |9.5.0

--- Comment #13 from anlauf at gcc dot gnu.org ---
Updating the known-to-fail versions.

I have doubts that this is a regression.  The dump-tree even of 7.5.0
shows the same problem as the other listed versions.

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

--- Comment #14 from anlauf at gcc dot gnu.org ---
(In reply to anlauf from comment #12)
> Created attachment 56690 [details]
> Draft patch

Regtests cleanly btw.

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=93762
           Assignee|unassigned at gcc dot gnu.org      |anlauf at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #15 from anlauf at gcc dot gnu.org ---
Submitted: https://gcc.gnu.org/pipermail/fortran/2023-November/059965.html

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

--- Comment #16 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Harald Anlauf <anlauf@gcc.gnu.org>:

https://gcc.gnu.org/g:27ce74fa23c93c1189c301993cd19ea766e6bdb5

commit r14-6081-g27ce74fa23c93c1189c301993cd19ea766e6bdb5
Author: Harald Anlauf <anlauf@gmx.de>
Date:   Fri Dec 1 22:44:30 2023 +0100

    Fortran: deferred-length character optional dummy arguments
[PR93762,PR100651]

    gcc/fortran/ChangeLog:

            PR fortran/93762
            PR fortran/100651
            * trans-array.cc (gfc_trans_deferred_array): Add presence check
            for optional deferred-length character dummy arguments.
            * trans-expr.cc (gfc_conv_missing_dummy): The character length for
            deferred-length dummy arguments is passed by reference, so that
            its value can be returned.  Adjust handling for optional dummies.

    gcc/testsuite/ChangeLog:

            PR fortran/93762
            PR fortran/100651
            * gfortran.dg/optional_deferred_char_1.f90: New test.

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

--- Comment #17 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Harald Anlauf
<anlauf@gcc.gnu.org>:

https://gcc.gnu.org/g:7a2f4af9b1b12d8b1f1b4cf4ddb812f2a48ce9ff

commit r13-8142-g7a2f4af9b1b12d8b1f1b4cf4ddb812f2a48ce9ff
Author: Harald Anlauf <anlauf@gmx.de>
Date:   Fri Dec 1 22:44:30 2023 +0100

    Fortran: deferred-length character optional dummy arguments
[PR93762,PR100651]

    gcc/fortran/ChangeLog:

            PR fortran/93762
            PR fortran/100651
            * trans-array.cc (gfc_trans_deferred_array): Add presence check
            for optional deferred-length character dummy arguments.
            * trans-expr.cc (gfc_conv_missing_dummy): The character length for
            deferred-length dummy arguments is passed by reference, so that
            its value can be returned.  Adjust handling for optional dummies.

    gcc/testsuite/ChangeLog:

            PR fortran/93762
            PR fortran/100651
            * gfortran.dg/optional_deferred_char_1.f90: New test.

    (cherry picked from commit 27ce74fa23c93c1189c301993cd19ea766e6bdb5)

[Bug fortran/100651] [11/12/13/14 Regression] Bad handling of optional, allocatable character argument

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100651

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.5                        |13.3
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #18 from anlauf at gcc dot gnu.org ---
Fixed on mainline for gcc-14, and on 13-branch.