[Bug fortran/111851] New: f951: Segmentation fault at gfc_delete_symtree

[Bug fortran/111851] New: f951: Segmentation fault at gfc_delete_symtree

[canu7 at yahoo dot es]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111851

            Bug ID: 111851
           Summary: f951: Segmentation fault at gfc_delete_symtree
           Product: gcc
           Version: 13.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: canu7 at yahoo dot es
  Target Milestone: ---

I'm using the following gfortran version on Arch Linux:

```
Using built-in specs.
COLLECT_GCC=gfortran
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-pc-linux-gnu/13.2.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /build/gcc/src/gcc/configure
--enable-languages=ada,c,c++,d,fortran,go,lto,objc,obj-c++ --enable-bootstrap
--prefix=/usr --libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man
--infodir=/usr/share/info --with-bugurl=https://bugs.archlinux.org/
--with-build-config=bootstrap-lto --with-linker-hash-style=gnu
--with-system-zlib --enable-__cxa_atexit --enable-cet=auto
--enable-checking=release --enable-clocale=gnu --enable-default-pie
--enable-default-ssp --enable-gnu-indirect-function --enable-gnu-unique-object
--enable-libstdcxx-backtrace --enable-link-serialization=1
--enable-linker-build-id --enable-lto --enable-multilib --enable-plugin
--enable-shared --enable-threads=posix --disable-libssp --disable-libstdcxx-pch
--disable-werror
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.2.1 20230801 (GCC) 
```

Here is the reduced code that causes the segmentation fault:

```Fortran
SELECT TYPE (rvec2ASSOCIATE(
```

This is the result of executing it directly with `f951`:
```
/usr/lib/gcc/x86_64-pc-linux-gnu/13.2.1/f951 test.f90
f951: internal compiler error: Segmentation fault
0x1a0e9c4 internal_error(char const*, ...)
        ???:0
0x7be65c gfc_delete_symtree(gfc_symtree**, char const*)
        ???:0
0x7c3f84 gfc_restore_last_undo_checkpoint()
        ???:0
0x793804 gfc_parse_file()
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.archlinux.org/> for instructions.
```

This is the gdb backtrace on the segmentation fault:
```
#0  0x00000000006b193f in delete_root (t=0x2b60890) at
/usr/src/debug/gcc/gcc/gcc/fortran/bbt.cc:150
#1  0x00000000007be65d in delete_treap (compare=0x79c650
<compare_symtree(void*, void*)>, t=0x2b60890, old=0x7fffffffdd90)
    at /usr/src/debug/gcc/gcc/gcc/fortran/bbt.cc:185
#2  gfc_delete_bbt (compare=0x79c650 <compare_symtree(void*, void*)>,
old=0x7fffffffdd90, root=0x2bbfce0) at
/usr/src/debug/gcc/gcc/gcc/fortran/bbt.cc:197
#3  gfc_delete_symtree (root=0x2bbfce0, name=<optimized out>) at
/usr/src/debug/gcc/gcc/gcc/fortran/symbol.cc:2969
#4  0x00000000007c3f85 in gfc_restore_last_undo_checkpoint () at
/usr/src/debug/gcc/gcc/gcc/fortran/symbol.cc:3714
#5  0x000000000076b342 in gfc_undo_symbols () at
/usr/src/debug/gcc/gcc/gcc/fortran/symbol.cc:3747
#6  reject_statement () at /usr/src/debug/gcc/gcc/gcc/fortran/parse.cc:2905
#7  0x00000000007638ae in match_word (old_locus=0x7fffffffdf00, subr=0x73eb20
<gfc_match_select_type()>, str=0x0) at
/usr/src/debug/gcc/gcc/gcc/fortran/parse.cc:72
#8  decode_statement () at /usr/src/debug/gcc/gcc/gcc/fortran/parse.cc:430
#9  0x000000000076f8c2 in next_free () at
/usr/src/debug/gcc/gcc/gcc/fortran/parse.cc:1406
#10 next_statement () at /usr/src/debug/gcc/gcc/gcc/fortran/parse.cc:1638
#11 0x0000000000793805 in gfc_parse_file () at
/usr/src/debug/gcc/gcc/gcc/fortran/parse.cc:6789
#12 0x00000000007ced05 in gfc_be_parse_file () at
/usr/src/debug/gcc/gcc/gcc/fortran/f95-lang.cc:229
#13 0x0000000000d630c1 in compile_file () at
/usr/src/debug/gcc/gcc/gcc/toplev.cc:444
#14 0x00000000006ad7fb in do_compile (no_backend=false) at
/usr/src/debug/gcc/gcc/gcc/toplev.cc:2125
#15 toplev::main (this=<optimized out>, argc=<optimized out>, argv=<optimized
out>) at /usr/src/debug/gcc/gcc/gcc/toplev.cc:2277
#16 0x00000000006ae0e2 in main (argc=<optimized out>, argv=<optimized out>) at
/usr/src/debug/gcc/gcc/gcc/main.cc:39

```

And this is the line and the values that I think causes the problem:
```
0x00000000006b193f in delete_root (t=0x2b60890) at
/usr/src/debug/gcc/gcc/gcc/fortran/bbt.cc:150
Downloading source file /usr/src/debug/gcc/gcc/gcc/fortran/bbt.cc
150       if (t->left->priority > t->right->priority)                           
(gdb) p t
$1 = (gfc_bbt *) 0x2b60890
(gdb) p t->left 
$2 = (gfc_treap *) 0xf1
(gdb) p t->right 
$3 = (gfc_treap *) 0x2bba400
```

And finally, here is a Compiler Explorer link reproducing the bug:
https://godbolt.org/z/z7W35ra4s

Hope is enough information to pin-point the problem.

[Bug fortran/111851] f951: Segmentation fault at gfc_delete_symtree

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111851

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |ice-on-invalid-code,
                   |                            |memory-hog
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-10-17

--- Comment #1 from anlauf at gcc dot gnu.org ---
Confirmed.

Note that it is recommended to limit the virtual memory before trying
the reproducer with 14-mainline.

On 14-mainline I see an infinite loop in delete_treap instead of the
traceback in comment#0.

All versions since at least 7 crash; this may be a variant of another
existing PRs on crippled code.

[Bug fortran/111851] f951: Segmentation fault at gfc_delete_symtree

[kargl at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111851

kargl at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kargl at gcc dot gnu.org

--- Comment #2 from kargl at gcc dot gnu.org ---
Oddly, I'm seeing an ICE due to the assert() at line 3131 in 
symbol.cc(gfc_release_symbol).  I don't see the memory hog issue.  If I comment
out that assert() and let gfortran proceed, I see

% gfcx -c a.f90
a.f90:1:28:

    1 | SELECT TYPE (rvec2ASSOCIATE(
      |                            1
Error: Syntax error in argument list at (1)


On FreeBSD I use the following for configure

../gccx/configure --prefix=$HOME/work/x --enable-languages=c,c++,fortran,lto \
  --enable-bootstrap --disable-nls --disable-multilib --enable-libsanitizer