[Bug fortran/104063] New: gcc/fortran/trans-expr.c:5831:20: runtime error: load of value 215872256, which is not a valid value for type 'ar_type'

[Bug fortran/104063] New: gcc/fortran/trans-expr.c:5831:20: runtime error: load of value 215872256, which is not a valid value for type 'ar_type'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104063

            Bug ID: 104063
           Summary: gcc/fortran/trans-expr.c:5831:20: runtime error: load
                    of value 215872256, which is not a valid value for
                    type 'ar_type'
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: burnus at gcc dot gnu.org, pault at gcc dot gnu.org
            Blocks: 63426
  Target Milestone: ---

I see the following UBSAN error:

$ ./xgcc -B.
/home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/pr103366.f90 -c
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans-expr.c:5831:20:
runtime error: load of value 215872256, which is not a valid value for type
'ar_type'
    #0 0x6bbab6 in gfc_conv_gfc_desc_to_cfi_desc
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans-expr.c:5831
    #1 0xf09be4 in gfc_conv_procedure_call(gfc_se*, gfc_symbol*,
gfc_actual_arglist*, gfc_expr*, vec<tree_node*, va_gc, vl_embed>*)
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans-expr.c:6804
    #2 0x1018cab in gfc_trans_call(gfc_code*, bool, tree_node*, tree_node*,
bool)
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans-stmt.c:423
    #3 0xe19807 in trans_code
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans.c:1984
    #4 0xedb754 in gfc_generate_function_code(gfc_namespace*)
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans-decl.c:7651
    #5 0xedb251 in gfc_generate_contained_functions
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans-decl.c:5774
    #6 0xedb251 in gfc_generate_function_code(gfc_namespace*)
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/trans-decl.c:7583
    #7 0xc597b4 in translate_all_program_units
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/parse.c:6651
    #8 0xc597b4 in gfc_parse_file()
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/parse.c:6938
    #9 0xdfc8ee in gfc_be_parse_file
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/fortran/f95-lang.c:216
    #10 0x2b34940 in compile_file
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/toplev.c:452
    #11 0x9cff59 in do_compile
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/toplev.c:2158
    #12 0x9cff59 in toplev::main(int, char**)
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/toplev.c:2310
    #13 0x9d5581 in main
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/build/gcc/main.c:39
    #14 0x7ffff78855bf in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x7ffff788567b in __libc_start_main_impl ../csu/libc-start.c:409
    #16 0x9d57a4 in _start
(/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-ubsan/objdir/gcc/f951+0x9d57a4)


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63426
[Bug 63426] [meta-bug] Issues found with -fsanitize=undefined

[Bug fortran/104063] gcc/fortran/trans-expr.c:5831:20: runtime error: load of value 215872256, which is not a valid value for type 'ar_type'

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104063

--- Comment #1 from Tobias Burnus <burnus at gcc dot gnu.org> ---
>From the code, I wonder whether a 'ref->type == REF_ARRAY' is missing as ...

      if (e->expr_type == EXPR_VARIABLE
          && e->ref
          && e->ref->u.ar.type == AR_FULL

... and whether more is needed to handle derived type components. In
particular,
the code has:

      class(*) :: x(..)
      call s(x)         ! Used to ICE here

with "s"'s dummy being 'type(*) :: x(..)'. (I wonder whether that translates to
x%_data(AR_FULL).)

Hence, use 'gfc_array_ref *ar = gfc_find_array_ref (...)' here?