[Bug fortran/114827] New: Valgrind reports errors with class(*) assignment

["neil.n.carlson at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114827

            Bug ID: 114827
           Summary: Valgrind reports errors with class(*) assignment
           Product: gcc
           Version: 13.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: neil.n.carlson at gmail dot com
  Target Milestone: ---

I'm trying to pin down a malloc corruption error ("malloc(): corrupted top
size") that happens during finalization of a derived type object. I'm still
working on paring things down to a reportable reproducer, but the traceback
hinted at a possible problem with the assignment of a class(*) variable to
another allocatable class(*) variable when the dynamic type of the rhs is
character. I've turned that bit into the following example which compiles and
runs without error, but when run under valgrind it reports several invalid
writes, which suggests to me that the executable is doing something wrong.

Note that if the assignment to the allocatable class(*) variable is replaced by
a sourced-allocation, the valgrind output is completely clean.

$ cat foo.f90
program main
  call run
contains
  subroutine run
    class(*), allocatable :: y
    call foo('fubarfubarfubarfubarfubarfu', y)
  end subroutine 
  subroutine foo(a, b)
    class(*), intent(in) :: a
    class(*), allocatable :: b
    b = a
    !allocate(b, source=a) ! VALGRIND REPORTS NO INVALID WRITES 
  end subroutine
end program

$ gfortran -g -O0 foo.f90

$ valgrind -s ./a.out
==587107== Memcheck, a memory error detector
==587107== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==587107== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==587107== Command: ./a.out
==587107== 
==587107== Invalid write of size 2
==587107==    at 0x484F353: memmove (vg_replace_strmem.c:1410)
==587107==    by 0x401230: __copy_character_1.0 (foo.f90:1)
==587107==    by 0x401368: foo.1 (foo.f90:11)
==587107==    by 0x4013E1: run.2 (foo.f90:6)
==587107==    by 0x401258: MAIN__ (foo.f90:2)
==587107==    by 0x401485: main (foo.f90:2)
==587107==  Address 0x4e57ac0 is 0 bytes inside a block of size 1 alloc'd
==587107==    at 0x484280F: malloc (vg_replace_malloc.c:442)
==587107==    by 0x4012C2: foo.1 (foo.f90:11)
==587107==    by 0x4013E1: run.2 (foo.f90:6)
==587107==    by 0x401258: MAIN__ (foo.f90:2)
==587107==    by 0x401485: main (foo.f90:2)
==587107== 
==587107== Invalid write of size 1
==587107==    at 0x484F383: memmove (vg_replace_strmem.c:1410)
==587107==    by 0x401230: __copy_character_1.0 (foo.f90:1)
==587107==    by 0x401368: foo.1 (foo.f90:11)
==587107==    by 0x4013E1: run.2 (foo.f90:6)
==587107==    by 0x401258: MAIN__ (foo.f90:2)
==587107==    by 0x401485: main (foo.f90:2)
==587107==  Address 0x4e57ada is 10 bytes after a block of size 16 in arena
"client"
==587107== 
==587107== 
==587107== HEAP SUMMARY:
==587107==     in use at exit: 0 bytes in 0 blocks
==587107==   total heap usage: 22 allocs, 22 frees, 13,585 bytes allocated
==587107== 
==587107== All heap blocks were freed -- no leaks are possible
==587107== 
==587107== ERROR SUMMARY: 27 errors from 2 contexts (suppressed: 0 from 0)
==587107== 
==587107== 1 errors in context 1 of 2:
==587107== Invalid write of size 1
==587107==    at 0x484F383: memmove (vg_replace_strmem.c:1410)
==587107==    by 0x401230: __copy_character_1.0 (foo.f90:1)
==587107==    by 0x401368: foo.1 (foo.f90:11)
==587107==    by 0x4013E1: run.2 (foo.f90:6)
==587107==    by 0x401258: MAIN__ (foo.f90:2)
==587107==    by 0x401485: main (foo.f90:2)
==587107==  Address 0x4e57ada is 10 bytes after a block of size 16 in arena
"client"
==587107== 
==587107== 
==587107== 26 errors in context 2 of 2:
==587107== Invalid write of size 2
==587107==    at 0x484F353: memmove (vg_replace_strmem.c:1410)
==587107==    by 0x401230: __copy_character_1.0 (foo.f90:1)
==587107==    by 0x401368: foo.1 (foo.f90:11)
==587107==    by 0x4013E1: run.2 (foo.f90:6)
==587107==    by 0x401258: MAIN__ (foo.f90:2)
==587107==    by 0x401485: main (foo.f90:2)
==587107==  Address 0x4e57ac0 is 0 bytes inside a block of size 1 alloc'd
==587107==    at 0x484280F: malloc (vg_replace_malloc.c:442)
==587107==    by 0x4012C2: foo.1 (foo.f90:11)
==587107==    by 0x4013E1: run.2 (foo.f90:6)
==587107==    by 0x401258: MAIN__ (foo.f90:2)
==587107==    by 0x401485: main (foo.f90:2)
==587107== 
==587107== ERROR SUMMARY: 27 errors from 2 contexts (suppressed: 0 from 0)