[Bug fortran/110677] New: UBSAN error: load of value 1818451807, which is not a valid value for type 'expr_t' when compiling pr49213.f90

[Bug fortran/110677] New: UBSAN error: load of value 1818451807, which is not a valid value for type 'expr_t' when compiling pr49213.f90

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110677

            Bug ID: 110677
           Summary: UBSAN error: load of value 1818451807, which is not a
                    valid value for type 'expr_t' when compiling
                    pr49213.f90
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jamborm at gcc dot gnu.org
            Blocks: 63426
  Target Milestone: ---
              Host: x86_64-linux-gnu
            Target: x86_64-linux-gnu

With master revision r14-2537-g18dac101678b8c and ubsan-bootstrapped compiler,
I am getting the following error when compiling our own test
gcc/testsuite/gfortran.dg/pr49213.f90:

worker@tiber:~/buildworker/tiber-gcc-ubsan/objdir/gcc>
UBSAN_OPTIONS="halt_on_error=1 print_stacktrace=1"
/home/worker/buildworker/tiber-gcc-ubsan/objdir/gcc/testsuite/gfortran3/../../gfortran
-B/home/worker/buildworker/tiber-gcc-ubsan/objdir/gcc/testsuite/gfortran3/../../
-B/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libgfortran/
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/testsuite/gfortran.dg/pr49213.f90
-fdiagnostics-plain-output -fdiagnostics-plain-output -O0 -pedantic-errors
-B/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libgfortran/.libs
-L/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libgfortran/.libs
-L/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libgfortran/.libs
-L/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libatomic/.libs
-B/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libquadmath/.libs
-L/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libquadmath/.libs
-L/home/worker/buildworker/tiber-gcc-ubsan/objdir/x86_64-pc-linux-gnu/./libquadmath/.libs
-lm -o /tmp/pr49213.exe
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:1401:30:
runtime error: load of value 1818451807, which is not a valid value for type
'expr_t'
    #0 0x79124e in resolve_structure_cons
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:1401
    #1 0xda4d76 in resolve_generic_f
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:2852   
    #2 0xda4d76 in resolve_function
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:3367
    #3 0xda839e in gfc_resolve_expr(gfc_expr*)
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:7313
    #4 0xda839e in gfc_resolve_expr(gfc_expr*)
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:7275
    #5 0xdef0e0 in gfc_resolve_code(gfc_code*, gfc_namespace*)
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:12314
    #6 0xdfe227 in resolve_codes
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:18027
    #7 0xdfe09a in resolve_codes
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:18008
    #8 0xd8965a in gfc_resolve(gfc_namespace*)
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:18062
    #9 0xd8965a in gfc_resolve(gfc_namespace*)
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/resolve.cc:18041
    #10 0xd3f387 in resolve_all_program_units
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/parse.cc:6862
    #11 0xd3f387 in gfc_parse_file()
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/parse.cc:7118
    #12 0xed0bfe in gfc_be_parse_file
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/fortran/f95-lang.cc:229  
    #13 0x2adde20 in compile_file
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/toplev.cc:444
    #14 0xab5e55 in do_compile
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/toplev.cc:2126
    #15 0xab5e55 in toplev::main(int, char**)
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/toplev.cc:2282   
    #16 0xab8fb1 in main
/home/worker/buildworker/tiber-gcc-ubsan/build/gcc/main.cc:39
    #17 0x7fd8e6557baf in __libc_start_call_main (/lib64/libc.so.6+0x27baf)
(BuildId: 1390809fc3a065502adfa6735d294c2c86aebe4d)
    #18 0x7fd8e6557c78 in __libc_start_main_alias_1 (/lib64/libc.so.6+0x27c78)
(BuildId: 1390809fc3a065502adfa6735d294c2c86aebe4d)
    #19 0xab93f4 in _start ../sysdeps/x86_64/start.S:115


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63426
[Bug 63426] [meta-bug] Issues found with -fsanitize=undefined

[Bug fortran/110677] UBSAN error: load of value 1818451807, which is not a valid value for type 'expr_t' when compiling pr49213.f90

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110677

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pault at gcc dot gnu.org

--- Comment #1 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I believe the testcase fails with UBSAN since its introduction in
r14-2160-g3521768e8e3c44 (Fortran: Enable class expressions in
structure constructors [PR49213]).

It can be reproduced without UBSAN by adding an assert like:

diff --git a/gcc/fortran/resolve.cc b/gcc/fortran/resolve.cc
index 8e018b6e7e8..66735e163b3 100644
--- a/gcc/fortran/resolve.cc
+++ b/gcc/fortran/resolve.cc
@@ -1392,6 +1392,10 @@ resolve_structure_cons (gfc_expr *expr, int init)
            }
        }

+      gcc_assert (cons->expr->ts.type != BT_CHARACTER
+                 || !comp->ts.u.cl
+                 || !comp->ts.u.cl->length
+                 || comp->ts.u.cl->length->expr_type != 1818451807);
       /* For strings, the length of the constructor should be the same as
         the one of the structure, ensure this if the lengths are known at
         compile time and when we are dealing with PARAMETER or structure

[Bug fortran/110677] UBSAN error: load of value 1818451807, which is not a valid value for type 'expr_t' when compiling pr49213.f90

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110677

--- Comment #2 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed a fix on the mailing list:
  https://gcc.gnu.org/pipermail/gcc-patches/2023-August/627379.html

...and also posted it to the Fortran mailing list:
  https://gcc.gnu.org/pipermail/fortran/2023-August/059687.html

[Bug fortran/110677] UBSAN error: load of value 1818451807, which is not a valid value for type 'expr_t' when compiling pr49213.f90

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110677

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:84e122c34834d9dea189c10fe0bf60c4d1a99fae

commit r14-3224-g84e122c34834d9dea189c10fe0bf60c4d1a99fae
Author: Martin Jambor <mjambor@suse.cz>
Date:   Tue Aug 15 17:13:44 2023 +0200

    Fortran: Avoid accessing gfc_charlen when not looking at BT_CHARACTER (PR
110677)

    This patch addresses an issue uncovered by the undefined behavior
    sanitizer.  In function resolve_structure_cons in resolve.cc there is
    a test starting with:

          if (cons->expr->ts.type == BT_CHARACTER && comp->ts.u.cl
              && comp->ts.u.cl->length
              && comp->ts.u.cl->length->expr_type == EXPR_CONSTANT

    and UBSAN complained of loads from comp->ts.u.cl->length->expr_type of
    integer value 1818451807 which is outside of the value range expr_t
    enum.  If I understand the code correctly it the entire load was
    unwanted because comp->ts.type in those cases is BT_CLASS and not
    BT_CHARACTER.  This patch simply adds a check to make sure it is only
    accessed in those cases.

    During review, Harald Anlauf noticed that length types also need to be
    checked and so I added also checks that he suggested to the condition.

    Co-authored-by: Harald Anlauf <anlauf@gmx.de>

    gcc/fortran/ChangeLog:

    2023-08-14  Martin Jambor  <mjambor@suse.cz>

            PR fortran/110677
            * resolve.cc (resolve_structure_cons): Check comp->ts is character
            type before accessing stuff through comp->ts.u.cl.

[Bug fortran/110677] UBSAN error: load of value 1818451807, which is not a valid value for type 'expr_t' when compiling pr49213.f90

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110677

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Should be fixed now.