[Bug fortran/113799] New: gfc_replace_expr: double free detected ?

[Bug fortran/113799] New: gfc_replace_expr: double free detected ?

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

            Bug ID: 113799
           Summary: gfc_replace_expr: double free detected ?
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

Created attachment 57350
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57350&action=edit
F90 source code

For the attached F90 source code, I get this 

test $ ~/gcc/results/bin/gfortran -c ./Evaluate/folding20.f90
free(): double free detected in tcache 2
f951: internal compiler error: Aborted
0xf581f9 crash_signal(int)
        /home/dcb38/gcc/working/gcc/../../trunk.20210101/gcc/toplev.cc:317
0x7658aa gfc_replace_expr(gfc_expr*, gfc_expr*)
       
/home/dcb38/gcc/working/gcc/../../trunk.20210101/gcc/fortran/expr.cc:640
0x7658aa simplify_intrinsic_op(gfc_expr*, int)
       
/home/dcb38/gcc/working/gcc/../../trunk.20210101/gcc/fortran/expr.cc:1324
0x7658aa gfc_simplify_expr(gfc_expr*, int)
       
/home/dcb38/gcc/working/gcc/../../trunk.20210101/gcc/fortran/expr.cc:2317

The source code is from the flang testsuite in clang.

The bug has existed since sometime before 20240107.

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[mikael at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

Mikael Morin <mikael at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-07
             Status|UNCONFIRMED                 |NEW
                 CC|                            |mikael at gcc dot gnu.org

--- Comment #1 from Mikael Morin <mikael at gcc dot gnu.org> ---
Reduced:

module m
  implicit none
  real, parameter :: inf = real(z'7F800000')
  real, parameter :: someInf(*) = [inf, 0.]
  logical, parameter :: test_rminval_someInf = minval(-someInf) == -inf
end

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[mikael at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

Mikael Morin <mikael at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |10.5.0, 11.4.0, 12.3.0,
                   |                            |13.2.0, 14.0

--- Comment #2 from Mikael Morin <mikael at gcc dot gnu.org> ---
Reproduced with all versions I have here (14.0, 13.2, 12.3, 11.4 and 10.5).

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

--- Comment #3 from anlauf at gcc dot gnu.org ---
(In reply to Mikael Morin from comment #2)
> Reproduced with all versions I have here (14.0, 13.2, 12.3, 11.4 and 10.5).

... but passes with -fno-range-check ...

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

--- Comment #4 from anlauf at gcc dot gnu.org ---
It's the simplification of minval:

program p
  implicit none
  real, parameter :: inf = real(z'7F800000')
  real, parameter :: someInf(*) = [inf, 0.]
  print *, minval(-someInf)
end

pr113799.f90:5:26:

    5 |   print *, minval(-someInf)
      |                          1
Error: Arithmetic overflow at (1)
free(): invalid pointer
f951: internal compiler error: Aborted
0x10e0f3f crash_signal
        ../../gcc-trunk/gcc/toplev.cc:317
0x99d4f8 gfc_replace_expr(gfc_expr*, gfc_expr*)
        ../../gcc-trunk/gcc/fortran/expr.cc:640
0x99d4f8 simplify_intrinsic_op
        ../../gcc-trunk/gcc/fortran/expr.cc:1324
0x99d4f8 gfc_simplify_expr(gfc_expr*, int)
        ../../gcc-trunk/gcc/fortran/expr.cc:2320
0xa2c469 resolve_operator
        ../../gcc-trunk/gcc/fortran/resolve.cc:4605
0xa288c5 gfc_resolve_expr(gfc_expr*)
        ../../gcc-trunk/gcc/fortran/resolve.cc:7342
[...]

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

--- Comment #5 from anlauf at gcc dot gnu.org ---
Even worse: it's the unary minus:

  print *, -someInf

pr113799.f90:5:19:

    5 |   print *, -someInf
      |                   1
Error: Arithmetic overflow at (1)
free(): invalid pointer
f951: internal compiler error: Aborted

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |7.5.0, 8.5.0, 9.5.0

--- Comment #6 from anlauf at gcc dot gnu.org ---
It appears that we have an inconsistency in the handling of arithmetic
errors during simplification.

check_result has:

  if (val == ARITH_OK || val == ARITH_OVERFLOW)
    *rp = r;
  else
    gfc_free_expr (r);


while reduce_unary has:

  for (c = gfc_constructor_first (head); c; c = gfc_constructor_next (c))
    {
      rc = reduce_unary (eval, c->expr, &r);

      if (rc != ARITH_OK)
        break;

      gfc_replace_expr (c->expr, r);
    }

With -fno-range-check, ARITH_OVERFLOW does not appear.

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |anlauf at gcc dot gnu.org

--- Comment #7 from anlauf at gcc dot gnu.org ---
Created attachment 57366
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57366&action=edit
Patch

This patch changes reduce_unary to continue in the case of overflow
encountered during walking through array ctors and returning the error
at the end.

This also fixes other simple examples like:

  integer, parameter :: n = huge(1)
  integer, parameter :: m(*) =  [-(n + 1)]
  print *, -m
end

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |anlauf at gcc dot gnu.org
             Status|NEW                         |ASSIGNED
           Priority|P3                          |P4
           Keywords|wrong-code                  |error-recovery

--- Comment #8 from anlauf at gcc dot gnu.org ---
Submitted: https://gcc.gnu.org/pipermail/fortran/2024-February/060208.html

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Harald Anlauf <anlauf@gcc.gnu.org>:

https://gcc.gnu.org/g:b3d622d70ba209b63471fc1b0970870046e55745

commit r14-8902-gb3d622d70ba209b63471fc1b0970870046e55745
Author: Harald Anlauf <anlauf@gmx.de>
Date:   Thu Feb 8 21:51:38 2024 +0100

    Fortran: error recovery on arithmetic overflow on unary operations
[PR113799]

            PR fortran/113799

    gcc/fortran/ChangeLog:

            * arith.cc (reduce_unary): Remember any overflow encountered during
            reduction of unary arithmetic operations on array constructors and
            continue, and return error status, but terminate on serious errors.

    gcc/testsuite/ChangeLog:

            * gfortran.dg/arithmetic_overflow_2.f90: New test.

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

--- Comment #10 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Harald Anlauf
<anlauf@gcc.gnu.org>:

https://gcc.gnu.org/g:ec8303dea72ed4f9ae9fdf3c996a0deef6809351

commit r13-8558-gec8303dea72ed4f9ae9fdf3c996a0deef6809351
Author: Harald Anlauf <anlauf@gmx.de>
Date:   Thu Feb 8 21:51:38 2024 +0100

    Fortran: error recovery on arithmetic overflow on unary operations
[PR113799]

            PR fortran/113799

    gcc/fortran/ChangeLog:

            * arith.cc (reduce_unary): Remember any overflow encountered during
            reduction of unary arithmetic operations on array constructors and
            continue, and return error status, but terminate on serious errors.

    gcc/testsuite/ChangeLog:

            * gfortran.dg/arithmetic_overflow_2.f90: New test.

    (cherry picked from commit b3d622d70ba209b63471fc1b0970870046e55745)

[Bug fortran/113799] gfc_replace_expr: double free detected ?

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113799

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
   Target Milestone|---                         |13.3
             Status|ASSIGNED                    |RESOLVED

--- Comment #11 from anlauf at gcc dot gnu.org ---
Fixed on mainline for gcc-14, and backported to 13-branch, as this is
needed for the backport of the fix for pr103707.

Closing.