[Bug fortran/47674] New: gfortran.dg/realloc_on_assign_5.f03: Segfault at run time

[Bug fortran/47674] New: gfortran.dg/realloc_on_assign_5.f03: Segfault at run time

[burnus at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

           Summary: gfortran.dg/realloc_on_assign_5.f03: Segfault at run
                    time
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: fortran
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: burnus@gcc.gnu.org
                CC: pault@gcc.gnu.org


gfortran.dg/realloc_on_assign_5.f03 segfaults here; it works if I unset the
environment variable MALLOC_CHECK_.

Valgrind shows:

Invalid read of size 1
   at 0x4C285C8: memmove (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x400B41: MAIN__ (realloc_on_assign_5.f03:15)
   by 0x400BF7: main (realloc_on_assign_5.f03:18)
Address 0x5b524c1 is 0 bytes after a block of size 1 alloc'd
   at 0x4C26682: realloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x400B0C: MAIN__ (realloc_on_assign_5.f03:15)
   by 0x400BF7: main (realloc_on_assign_5.f03:18)

Excerpt from the test:
  a = 'ab'   ! OK
  a = (a(2:2)) ! seems to fail
thus
  print '(">",a,"<")', a
prints ">", STX (start of text character), "<" and a new line. Without
MALLOC_CHECK_ the desired ">b<" and a new line is printed.


DUMP: The first "if" does not make sense - at least in this special case - and
there is the issue that "a" is also used on the RHS without using a temporary.

        D.1531 = .a;
        if (D.1531 != 0)
          {
            if ((<unnamed-unsigned:64>) D.1531 <= 1)
              {
                __builtin_memmove (a, &(*a)[2]{lb: 1 sz: 1}, D.1531);
              }
            else
              {
                __builtin_memcpy (a, &(*a)[2]{lb: 1 sz: 1}, 1);
                __builtin_memset (a + 1, 32, D.1531 + 0x0ffffffffffffffff);
              }
          }

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time

[burnus at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

--- Comment #1 from Tobias Burnus <burnus at gcc dot gnu.org> 2011-02-12 19:24:21 UTC ---
The file was added for PR 47523.

The issue is that there is no temporary generated - but the LHS is dependent on
the LHS. This should only occur for "LHS = LHS(substring)" where no temporary
is needed for the RHS expression but where a reallocation happens. If no
reallocation happens, memmove takes care of possibly overlapping memory. And if
there is a more complicated expression on the RHS, a temporary should always be
present. Thus, the issue should only occur for
  a = a(1:2)
or
  a = (((( a(1:2) ))))

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[burnus at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

--- Comment #2 from Tobias Burnus <burnus at gcc dot gnu.org> 2011-08-03 07:23:18 UTC ---
The problem seems to be that for strings, the dependency resolver does not
trigger: as there are no strides, certain dependencies are already handled, but
it fails if the LHS/RHS variables are the same and LHS is reallocated because
of a different (shorter) string length.

dependency.c's gfc_dep_resolver has:

        case REF_SUBSTRING:
          /* Substring overlaps are handled by the string assignment code
             if there is not an underlying dependency.  */
          return (fin_dep == GFC_DEP_OVERLAP) ? 1 : 0;

which returns 0 for:

  string = string(1:2) ! Issue: Realloc without temporary

trans-expr.c's alloc_scalar_allocatable_for_assignment handles scalars, where
the value might bet wrong.

A similar issue exists for arrays, though here there are provisions for adding
temporaries. (Cf. also trans-array.c's gfc_alloc_allocatable_for_assignment.)

I am not quite sure whether which if any part should be handled in the
depenedency analysis and which in the assignment code. At least the scalar
assignment code does not seem provide for temporaries at all.


A related issue is PR 49954: ICE with concatenated array strings.

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[tkoenig at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

Thomas Koenig <tkoenig at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dominiq at lps dot ens.fr

--- Comment #3 from Thomas Koenig <tkoenig at gcc dot gnu.org> 2013-04-08 20:25:49 UTC ---
*** Bug 56594 has been marked as a duplicate of this bug. ***

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-06-16
     Ever confirmed|0                           |1

--- Comment #4 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
Confirmed.

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |howarth at nitro dot med.uc.edu

--- Comment #5 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
*** Bug 55484 has been marked as a duplicate of this bug. ***

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

--- Comment #6 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
gfortran.dg/realloc_on_assign_5.f03 also fails at run time when compiled with 
-fsanitize=address.

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[tkoenig at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

Thomas Koenig <tkoenig at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tkoenig at gcc dot gnu.org

--- Comment #7 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
*** Bug 60542 has been marked as a duplicate of this bug. ***

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

Bernd Edlinger <bernd.edlinger at hotmail dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bernd.edlinger at hotmail dot de

--- Comment #8 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
Hmm...,

I just noticed, that it also fails if MALLOC_CHECK_ is defined,
although MALLOC_PERTURB_=237 without MALLOC_CHECK_ does nothing.

$ gfortran realloc_on_assign_5.f03
$ MALLOC_CHECK_=3 ./a.out 

Program aborted. Backtrace:
#0  0x7F46086BB307
#1  0x7F46086BC9E2
#2  0x7F460878E6D8
#3  0x400C0B in MAIN_

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

Thomas Koenig <tkoenig at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |tkoenig at gcc dot gnu.org

--- Comment #9 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
I have a patch (not a pretty one, though).

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

--- Comment #10 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
Author: tkoenig
Date: Mon Jan  5 17:15:17 2015
New Revision: 219193

URL: https://gcc.gnu.org/viewcvs?rev=219193&root=gcc&view=rev
Log:
2015-01-05  Thomas Koenig  <tkoenig@gcc.gnu.org>

    PR fortran/47674
    * dependency.c:  Update copyright years.
    (gfc_discard_nops):  Add prototype.
    * dependency.c (discard_nops):  Rename to gfc_discard_nops,
    make non-static.
    (gfc_discard_nops):  Use gfc_discard_nops.
    (gfc_dep_difference):  Likewise.
    * frontend-passes.c  Update copyright years.
    (realloc_strings):  New function.  Add prototype.
    (gfc_run_passes):  Call realloc_strings.
    (realloc_string_callback):  New function.
    (create_var):  Add prototype.  Handle case of a
    scalar character variable.
    (optimize_trim):  Do not handle allocatable variables.

2015-01-05  Thomas Koenig  <tkoenig@gcc.gnu.org>

    PR fortran/47674
    * gfortran.dg/realloc_on_assign_25.f90:  New test.

Added:
    trunk/gcc/testsuite/gfortran.dg/realloc_on_assign_25.f90
Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/dependency.c
    trunk/gcc/fortran/frontend-passes.c
    trunk/gcc/testsuite/ChangeLog

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

--- Comment #11 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
Author: tkoenig
Date: Mon Jan  5 19:21:12 2015
New Revision: 219195

URL: https://gcc.gnu.org/viewcvs?rev=219195&root=gcc&view=rev
Log:
2015-01-05  Thomas Koenig  <tkoenig@gcc.gnu.org>

    PR fortran/47674
    * dependency.h:  Actually commit changes.



Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/dependency.h

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

--- Comment #12 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
Is there interesting in further backporting?

If not, I would close this as fixed.

[Bug fortran/47674] gfortran.dg/realloc_on_assign_5.f03: Segfault at run time for deferred (allocatable) string length

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47674

Thomas Koenig <tkoenig at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #13 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
Fixed, as nobody expressed interest in further backporting.