[Bug fortran/110987] New: Segmentation fault after finalization of a temporary variable

[Bug fortran/110987] New: Segmentation fault after finalization of a temporary variable

[chilikin.k at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

            Bug ID: 110987
           Summary: Segmentation fault after finalization of a temporary
                    variable
           Product: gcc
           Version: 13.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: chilikin.k at gmail dot com
  Target Milestone: ---

Created attachment 55720
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55720&action=edit
Test case

The attached test program works fine with gfortran 12.2.0 and crashes with
a segmentation fault when compiled with gfortran 13.2.0. The compilation
command is

gfortran -g -o test test.f90

The segmentation fault happens when the function T1_GET_NEXT() tries to access
SELF%NEXT(1)%T1, which is deallocated and overwritten:

$ valgrind ./test

==1651009== Invalid read of size 8
==1651009==    at 0x40251D: __test_module_MOD_t1_get_next (in test)
==1651009==    by 0x403678: MAIN__ (in test)
==1651009==    by 0x4036D0: main (in test)
==1651009==  Address 0x4e92d48 is 8 bytes inside a block of size 16 free'd
==1651009==    at 0x48399AB: free (vg_replace_malloc.c:538)
==1651009==    by 0x402876: __test_module_MOD_t1_destructor (in test)
==1651009==    by 0x401812: __test_module_MOD___final_test_module_T1 (in test)
==1651009==    by 0x4035CF: MAIN__ (in test)
==1651009==    by 0x4036D0: main (in test)
==1651009==  Block was alloc'd at
==1651009==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==1651009==    by 0x4026AF: __test_module_MOD_t1_set_n_next (in test)
==1651009==    by 0x402466: __test_module_MOD_t2_constructor (in test)
==1651009==    by 0x402E93: MAIN__ (in test)
==1651009==    by 0x4036D0: main (in test)

The corresponding part of the output of

$ objdump -S ./test | less

is attached. The final-subroutine call which incorrectly deallocates memory
happens at 4035cd, between the calls of __test_module_MOD_t3_constructor and
__test_module_MOD_t1_set_n_next. Thus, the finalization seems to happen for
the temporary variable allocated as the result of T3() call, which is assigned
then to X3, and the memory corresponding to

    CLASS(T1_POINTER), ALLOCATABLE :: NEXT(:)

is probably the same for that temporary variable and X3 (in contradiction with
10.2.1.3.13 item (2) of Fortran 2018?).

May be related to the fix of bug 80524.

[Bug fortran/110987] Segmentation fault after finalization of a temporary variable

[chilikin.k at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

--- Comment #1 from Kirill Chilikin <chilikin.k at gmail dot com> ---
Created attachment 55721
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55721&action=edit
Objdump of the corresponding code

[Bug fortran/110987] Segmentation fault after finalization of a temporary variable

[chilikin.k at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

--- Comment #2 from Kirill Chilikin <chilikin.k at gmail dot com> ---
Some additional information:

$ gfortran -g -o test test.f90 -fdump-tree-original
$ cat test.f90.005t.original | head -n 747 | tail -n 26
  {
    struct t3 zero.25;
    struct array00_t3 desc.26;
    struct t3 D.4638;

    desc.26.dtype = {.elem_len=80, .rank=0, .type=5};
    desc.26.data = (void * restrict) &zero.25;
    desc.26.span = (integer(kind=8)) desc.26.dtype.elem_len;
    {
      struct array00_t3 desc.27;

      desc.27.dtype = {.elem_len=80, .rank=0, .type=5};
      desc.27.data = (void * restrict) &x3;
      desc.27.span = (integer(kind=8)) desc.27.dtype.elem_len;
      __final_test_module_T1 (&desc.27, 80, 0);
    } 
    D.4638 = x3;
    x3 = (struct t3) t3_constructor ();
    if ((struct t1_pointer[0:] * restrict) D.4638.t1.next._data.data != 0B)
      {
        __builtin_free ((void *) D.4638.t1.next._data.data);
        (struct t1_pointer[0:] * restrict) D.4638.t1.next._data.data = 0B;
      }
    D.4638.t1.next._vptr = (struct __vtype_test_module_T1_pointer * {ref-all})
&__vtab_test_module_T1_pointer;
    __vtab_test_module_T3._final (&desc.26, __vtab_test_module_T3._size, 0);
  }

The call of __vtab_test_module_T3._final is on desc.26 pointing to otherwise
unused zero.25.

$ gdb ./test
(gdb) b 102
Breakpoint 1 at 0x4033ca: file test.f90, line 102.
(gdb) r
Breakpoint 1, test_program () at test.f90:102
102       X3 = T3()
(gdb) p x2
$1 = ( t1 = ( n_next = 1, next = ( _data = (( t1 = ( _data = 0x4062a0 <x1>,
_vptr = 0x406140 <__test_module_MOD___vtab_test_module_T1> ) )), _vptr =
0x4061a0 <__test_module_MOD___vtab_test_module_T1_pointer> ) ), x =
1.40129846e-45 )
(gdb) b t1_destructor
Breakpoint 2 at 0x4027f0: file test.f90, line 49.
(gdb) ignore 2 3
Will ignore next 3 crossings of breakpoint 2.
(gdb) c
Breakpoint 2, test_module::t1_destructor (self=...) at test.f90:49
49          IF (ALLOCATED(SELF%NEXT)) THEN
(gdb) backtrace
#0  test_module::t1_destructor (self=...) at test.f90:49
#1  0x0000000000401813 in test_module::__final_test_module_T1 (array=...,
    byte_stride=80, fini_coarray=.FALSE.) at test.f90:90
#2  0x00000000004035d0 in test_program () at test.f90:102
(gdb) p self
$2 = ( n_next = 1, next = ( _data = (( t1 = ( _data = 0x4062a0 <x1>, _vptr =
0x406140 <__test_module_MOD___vtab_test_module_T1> ) )), _vptr = 0x4061a0
<__test_module_MOD___vtab_test_module_T1_pointer> ) )

But in the compiled program, it seems to finalize X2%T1.

[Bug fortran/110987] Segmentation fault after finalization of a temporary variable

[chilikin.k at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

--- Comment #3 from Kirill Chilikin <chilikin.k at gmail dot com> ---
The derived type T3 has zero components but not zero length as it extends T1;
the test does not crash after the following changes:

diff --git a/gcc/fortran/trans.cc b/gcc/fortran/trans.cc
index 961b0b5a573..e5d12f25e5e 100644
--- a/gcc/fortran/trans.cc
+++ b/gcc/fortran/trans.cc
@@ -1624,7 +1624,7 @@ gfc_finalize_tree_expr (gfc_se *se, gfc_symbol *derived,
     }
   else if (derived && gfc_is_finalizable (derived, NULL))
     {
-      if (derived->attr.zero_comp && !rank)
+      if ((derived->components == NULL) && !rank)
        {
          /* Any attempt to assign zero length entities, causes the gimplifier
             all manner of problems. Instead, a variable is created to act as
@@ -1685,7 +1685,7 @@ gfc_finalize_tree_expr (gfc_se *se, gfc_symbol *derived,
        }
     }

-  if (derived && derived->attr.zero_comp)
+  if (derived && (derived->components == NULL))
     {
       /* All the conditions below break down for zero length derived types. 
*/
       tmp = build_call_expr_loc (input_location, final_fndecl, 3,

[Bug fortran/110987] Segmentation fault after finalization of a temporary variable

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |anlauf at gcc dot gnu.org,
                   |                            |pault at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-04

--- Comment #4 from anlauf at gcc dot gnu.org ---
Confirmed.

Adding Paul so that he gets attention of this issue.

(The suggested change in comment#3 does indeed fix the crash,
but he should know the surrounding code better than anybody else.)

[Bug fortran/110987] Segmentation fault after finalization of a temporary variable

[jhaiduce at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

John Haiducek <jhaiduce at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jhaiduce at gmail dot com

--- Comment #5 from John Haiducek <jhaiduce at gmail dot com> ---
Created attachment 57326
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57326&action=edit
Additional test case

This is an additional test case, which appears to trigger the same bug under
slightly different circumstances.

[Bug fortran/110987] Segmentation fault after finalization of a temporary variable

[jhaiduce at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

--- Comment #6 from John Haiducek <jhaiduce at gmail dot com> ---
I encountered what appears to be the same bug under slightly different
conditions; I've attached the corresponding code (see attachment named
"Additional test case"). In this code the crash occurs when finalizing an
object of a type that inherits from a parent type, where the child type has no
data members of its own.

There are several workarounds that prevent the segmentation fault in this test:
- Create the object with the default constructor rather than using a custom
constructor
- Add a data member to the child type
- Remove the final routine from the child type

I posted the code in the attached "Additional test case" on the Fortran
Discourse (see discussion at
https://fortran-lang.discourse.group/t/segmentation-fault-when-finalizing-an-inherited-type-with-custom-constructor/7319).
From the discussion it was determined that this code triggers a segmentation
fault with the following compiler/OS combinations:
- gfortran 13.2.0 on Ubuntu 23.10 and FreeBSD 14.0
- gfortran 13.2.1 on Fedora 38
- gfortran 13.2.0-13.2.1 on MacOS (arm)

The segmentation fault does not occur on the following compiler/OS
combinations:
- gfortran 11.4.0 on Ubuntu 23.10
- gfortran 12.2.0 on FreeBSD 14.0
- gfortran 14.0.1 experimental on Windows (but in this case there are still
indications of incorrect behavior; no segfault occurred but a print statement
added to the end of the code did not produce any output)

The program also reportedly runs as expected when compiled with ifort.

[Bug fortran/110987] [13/14 Regression] Segmentation fault after finalization of a temporary variable

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Segmentation fault after    |[13/14 Regression]
                   |finalization of a temporary |Segmentation fault after
                   |variable                    |finalization of a temporary
                   |                            |variable
   Target Milestone|---                         |13.3

[Bug fortran/110987] [13/14 Regression] Segmentation fault after finalization of a temporary variable

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

--- Comment #7 from anlauf at gcc dot gnu.org ---
(In reply to John Haiducek from comment #6)
> I encountered what appears to be the same bug under slightly different
> conditions; I've attached the corresponding code (see attachment named
> "Additional test case"). In this code the crash occurs when finalizing an
> object of a type that inherits from a parent type, where the child type has
> no data members of its own.
> 
> There are several workarounds that prevent the segmentation fault in this
> test:
> - Create the object with the default constructor rather than using a custom
> constructor
> - Add a data member to the child type
> - Remove the final routine from the child type

After the patch in comment#3 the testcase in comment#5 runs cleanly under
valgrind for me.

> - gfortran 14.0.1 experimental on Windows (but in this case there are still
> indications of incorrect behavior; no segfault occurred but a print
> statement added to the end of the code did not produce any output)

I added

  print *, kid% name

and it printed

 Name

[Bug fortran/110987] [13/14 Regression] Segmentation fault after finalization of a temporary variable

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P4
                 CC|                            |law at gcc dot gnu.org

[Bug fortran/110987] [13/14 Regression] Segmentation fault after finalization of a temporary variable

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

Paul Thomas <pault at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |pault at gcc dot gnu.org

--- Comment #8 from Paul Thomas <pault at gcc dot gnu.org> ---
Since I just submitted the fix for this and pr113885, I had better take it :-)

Paul

[Bug fortran/110987] [13/14 Regression] Segmentation fault after finalization of a temporary variable

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Paul Thomas <pault@gcc.gnu.org>:

https://gcc.gnu.org/g:3c793f0361bc66d2a6bf0b3e1fb3234fc511e2a6

commit r14-9719-g3c793f0361bc66d2a6bf0b3e1fb3234fc511e2a6
Author: Paul Thomas <pault@gcc.gnu.org>
Date:   Fri Mar 29 07:23:19 2024 +0000

    Fortran: Fix a gimplifier ICE/wrong result with finalization [PR36337]

    2024-03-29  Paul Thomas  <pault@gcc.gnu.org>

    gcc/fortran
            PR fortran/36337
            PR fortran/110987
            PR fortran/113885
            * trans-expr.cc (gfc_trans_assignment_1): Place finalization
            block before rhs post block for elemental rhs.
            * trans.cc (gfc_finalize_tree_expr): Check directly if a type
            has no components, rather than the zero components attribute.
            Treat elemental zero component expressions in the same way as
            scalars.

    gcc/testsuite/
            PR fortran/113885
            * gfortran.dg/finalize_54.f90: New test.
            * gfortran.dg/finalize_55.f90: New test.

    gcc/testsuite/
            PR fortran/110987
            * gfortran.dg/finalize_56.f90: New test.

[Bug fortran/110987] [13 Regression] Segmentation fault after finalization of a temporary variable

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

Paul Thomas <pault at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14 Regression]          |[13 Regression]
                   |Segmentation fault after    |Segmentation fault after
                   |finalization of a temporary |finalization of a temporary
                   |variable                    |variable

--- Comment #10 from Paul Thomas <pault at gcc dot gnu.org> ---
Needs backporting. Summary changed.

[Bug fortran/110987] [13 Regression] Segmentation fault after finalization of a temporary variable

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

--- Comment #11 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Paul Thomas <pault@gcc.gnu.org>:

https://gcc.gnu.org/g:9f204cc695d27d0b8eb69d9a4d266261171185ae

commit r13-8690-g9f204cc695d27d0b8eb69d9a4d266261171185ae
Author: Paul Thomas <pault@gcc.gnu.org>
Date:   Fri Mar 29 07:23:19 2024 +0000

    Fortran: Fix a gimplifier ICE/wrong result with finalization [PR36337]

    2024-03-29  Paul Thomas  <pault@gcc.gnu.org>

    gcc/fortran
            PR fortran/36337
            PR fortran/110987
            PR fortran/113885
            * trans-expr.cc (gfc_trans_assignment_1): Place finalization
            block before rhs post block for elemental rhs.
            * trans.cc (gfc_finalize_tree_expr): Check directly if a type
            has no components, rather than the zero components attribute.
            Treat elemental zero component expressions in the same way as
            scalars.

    gcc/testsuite/
            PR fortran/113885
            * gfortran.dg/finalize_54.f90: New test.
            * gfortran.dg/finalize_55.f90: New test.

    gcc/testsuite/
            PR fortran/110987
            * gfortran.dg/finalize_56.f90: New test.

    (cherry picked from commit 3c793f0361bc66d2a6bf0b3e1fb3234fc511e2a6)

[Bug fortran/110987] [13 Regression] Segmentation fault after finalization of a temporary variable

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110987

Paul Thomas <pault at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #12 from Paul Thomas <pault at gcc dot gnu.org> ---
Fixed on all affected branches. Thanks for the report.

Paul