[Bug libfortran/102106] New: Intermittent Segfault with associate to derived type with polymorphic component

[Bug libfortran/102106] New: Intermittent Segfault with associate to derived type with polymorphic component

[everythingfunctional at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102106

            Bug ID: 102106
           Summary: Intermittent Segfault with associate to derived type
                    with polymorphic component
           Product: gcc
           Version: 11.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libfortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: everythingfunctional at protonmail dot com
  Target Milestone: ---

I'm using version Ubuntu 11.1.0-1ubuntu1~21.04 on Pop!OS.

The following program segfaults sometimes. I believe this bug specifically has
to do with the association to a return value with a polymorphic component, but
I occasionally see similar errors when associating to more complicated derived
types (i.e. derived types with derived type components, with derived type
components, etc.), even if they aren't polymorphic. I think it only happens if
there is an allocatable component somewhere in the hierarchy though.

I've been encountering this bug (and possibly other related ones) occasionally
for a while now, and was finally able to reproduce it in something small to
hopefully be able to isolate it.

program main
    type :: sub_class_t
    end type

    type :: with_polymorphic_component_t
        class(sub_class_t), allocatable :: sub_obj_
    end type

    associate(obj => with_polymorphic_component_t(sub_class_t()))
    end associate
end program

Note: in my testing this segfaults about 1 out of every 10 executions

[Bug fortran/102106] Freeing unallocated memory, with associate to derived type with polymorphic component

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102106

Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fxcoudert at gcc dot gnu.org
            Summary|Intermittent Segfault with  |Freeing unallocated memory,
                   |associate to derived type   |with associate to derived
                   |with polymorphic component  |type with polymorphic
                   |                            |component
          Component|libfortran                  |fortran
   Last reconfirmed|                            |2021-12-16
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
Confirmed on aarch64-apple-darwin21, where it occurs systematically at -O0 (but
not higher optimisation).

It is not a library bug, but a front-end issue. The backtrace is the following:

* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00000001c47719b8 libsystem_kernel.dylib`__pthread_kill + 8
    frame #1: 0x00000001c47a4eb0 libsystem_pthread.dylib`pthread_kill + 288
    frame #2: 0x00000001c46e2314 libsystem_c.dylib`abort + 164
    frame #3: 0x00000001c45c7a1c libsystem_malloc.dylib`malloc_vreport + 552
    frame #4: 0x00000001c45cb060 libsystem_malloc.dylib`malloc_report + 64
    frame #5: 0x00000001c45b9fa8 libsystem_malloc.dylib`free + 500
    frame #6: 0x0000000100003ea4 a.out`MAIN__ at a.f90:9:65
    frame #7: 0x0000000100003ef4 a.out`main at a.f90:11:11
    frame #8: 0x00000001000150f4 dyld`start + 520

There is only one call to free() generated,

[Bug fortran/102106] Freeing unallocated memory, with associate to derived type with polymorphic component

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102106

--- Comment #2 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
There is only one call to free() generated, and it is called on an address that
does not point to allocated memory, so it should not be too hard to determine
what is happening.

[Bug fortran/102106] Freeing unallocated memory, with associate to derived type with polymorphic component

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102106

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Paul Thomas <pault@gcc.gnu.org>:

https://gcc.gnu.org/g:eac493851f07df98213ecf67a5e9ab41a7babcd2

commit r13-7121-geac493851f07df98213ecf67a5e9ab41a7babcd2
Author: Paul Thomas <pault@gcc.gnu.org>
Date:   Sat Apr 8 09:04:13 2023 +0100

    Fortran: Fix some of the bugs in associate [PR87477]

    2023-04-08  Paul Thomas  <pault@gcc.gnu.org>

    gcc/fortran
            PR fortran/87477
            * iresolve.cc (gfc_resolve_adjustl, gfc_resolve_adjustr): if
            string length is deferred use the string typespec for result.
            * resolve.cc (resolve_assoc_var): Handle parentheses around the
            target expression.
            (resolve_block_construct): Remove unnecessary static decls.
            * trans-array.cc (gfc_conv_expr_descriptor): Guard string len
            expression in condition. Improve handling of string length and
            span, especially for substrings of the descriptor.
            (duplicate_allocatable): Make element type more explicit with
            'eltype'.
            * trans-decl.cc (gfc_get_symbol_decl): Emit a fatal error with
            appropriate message instead of ICE if symbol type is unknown.
            (gfc_generate_function_code): Set current locus to proc_sym
            declared_at.
            * trans-expr.cc (gfc_get_expr_charlen): Retain last charlen in
            'previous' and use if end expression in substring reference is
            null.
            (gfc_conv_string_length): Use gfc_conv_expr_descriptor if
            'expr_flat' is an array. Add post block to catch deallocation
            of temporaries.
            (gfc_conv_procedure_call): Assign the parmse string length to
            the expression string length, if it is deferred.
            (gfc_trans_alloc_subarray_assign): If this is a deferred string
            length component, store the string length in the hidden comp.
            Update the typespec length accordingly. Generate a new type
            spec for the call to gfc_duplicate-allocatable in this case.
            * trans-io.cc (gfc_trans_transfer): Scalarize transfer of
            deferred character array components.

    gcc/testsuite/
            PR fortran/87477
            * gfortran.dg/associate_47.f90 : Enable substring test.
            * gfortran.dg/associate_51.f90 : Update an error message.
            * gfortran.dg/goacc/array-with-dt-2.f90 : Add span to
            uninitialzed dg-warnings.

            PR fortran/85686
            PR fortran/88247
            PR fortran/91941
            PR fortran/92779
            PR fortran/93339
            PR fortran/93813
            PR fortran/100948
            PR fortran/102106
            * gfortran.dg/associate_60.f90 : New test

            PR fortran/98408
            * gfortran.dg/pr98408.f90 : New test

            PR fortran/105205
            * gfortran.dg/pr105205.f90 : New test

            PR fortran/106918
            * gfortran.dg/pr106918.f90 : New test

[Bug fortran/102106] Freeing unallocated memory, with associate to derived type with polymorphic component

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102106

Paul Thomas <pault at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Paul Thomas <pault at gcc dot gnu.org> ---
Fixed on mainline

Thanks for the report

Paul