[Bug libfortran/49885] New: Segmentation fault when writing to an automatic character array

[Bug libfortran/49885] New: Segmentation fault when writing to an automatic character array

[mathewc at nag dot co.uk]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

           Summary: Segmentation fault when writing to an automatic
                    character array
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libfortran
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: mathewc@nag.co.uk


> uname -a
Linux tiree.nag.co.uk 2.6.27.41-170.2.117.fc10.x86_64 #1 SMP Thu Dec 10
10:36:29 EST 2009 x86_64 x86_64 x86_64 GNU/Linux

> gfortran --version
GNU Fortran (GCC) 4.7.0 20110723 (experimental)

> cat gf.f90
subroutine s(nb)
  integer :: nb
  character (max(80,nb)) :: bad_rec(1)
  write (bad_rec,'(I1)') 0
end
call s(10)
end

> gfortran gf.f90 ; ./a.out
Segmentation fault

Note that the program executes fine if declaration for bad_rec is changed to
any of:

  character (nb) :: bad_rec(1)
  character (max(80,nb)) :: bad_rec

[Bug libfortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[burnus at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

Tobias Burnus <burnus at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
      Known to work|                            |4.1.2, 4.3.4, 4.4.0, 4.5.3
           Keywords|                            |wrong-code
   Last reconfirmed|                            |2011.07.28 12:51:59
                 CC|                            |burnus at gcc dot gnu.org
     Ever Confirmed|0                           |1
            Summary|Segmentation fault when     |[4.6/4.7 Regression]
                   |writing to an automatic     |Segmentation fault when
                   |character array             |writing to an automatic
                   |                            |character array
   Target Milestone|---                         |4.6.2
      Known to fail|                            |4.6.1, 4.7.0

--- Comment #1 from Tobias Burnus <burnus at gcc dot gnu.org> 2011-07-28 12:51:59 UTC ---
Confirmed. Thanks for the bug report.

Works: 2010-07-12-r162074*
Fails: 2010-07-16-r162255**
(* This build was not clean but included the "fn spec" attributes patch.
 ** Vanilla build.)

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[burnus at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

Tobias Burnus <burnus at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libfortran                  |fortran

--- Comment #2 from Tobias Burnus <burnus at gcc dot gnu.org> 2011-07-28 12:58:54 UTC ---
Moved to "fortran", it's not a libgfortran issue but definitely a compiler-code
gen issue. Variant:

  print *, len(bad_rec)     ! << print correctly: 80
  bad_rec(1)(1:2) = 'abc'   ! << "works", but ...
  print *, bad_rec(1)(1:2)  ! << prints garbage

If the character(len=) expression is replaced by just the passed string length
("len=nb") it works.

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[burnus at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

Tobias Burnus <burnus at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |domob at gcc dot gnu.org

--- Comment #3 from Tobias Burnus <burnus at gcc dot gnu.org> 2011-07-28 14:02:35 UTC ---
Daniel, as it is your patch, could you have a look?

Working 162218
Failing 162219

Thus, the regression is caused by:

http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=162450
2010-07-23  Daniel Kraft  <d@domob.eu>

    PR fortran/44709
    * gfortran.h (gfc_find_symtree_in_proc): New method.
    * symbol.c (gfc_find_symtree_in_proc): New method.
    * match.c (match_exit_cycle): Look for loop name also in parent
    namespaces within current procedure.


I think we had some similar issue before where the solution was to replace
gfc_start_block by gfc_init_block. Maybe the same cure helps here as well?

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[burnus at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

--- Comment #4 from Tobias Burnus <burnus at gcc dot gnu.org> 2011-07-28 14:06:46 UTC ---
(In reply to comment #3)
> Thus, the regression is caused by:

Ups, wrong patch. The person and the PR were correct, the cited patch was not.

Correct patch, which causes the regression:

http://gcc.gnu.org/viewcvs?view=revision&revision=162219 
See PR 44709 comment 3     (Rev. 162450 was a follow-up patch.)

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[domob at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

Daniel Kraft <domob at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |domob at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #5 from Daniel Kraft <domob at gcc dot gnu.org> 2011-07-28 14:40:03 UTC ---
Taking this.

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[domob at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

--- Comment #6 from Daniel Kraft <domob at gcc dot gnu.org> 2011-07-29 17:00:12 UTC ---
For the record, with the original test case and -fdump-tree-original, I get:

s (integer(kind=4) & restrict nb)
{
  character(kind=1) bad_rec[1][1:.bad_rec];
  integer(kind=4) .bad_rec;
  bitsizetype D.1567;
  sizetype D.1568;
  bitsizetype D.1569;
  sizetype D.1570;

  {
    integer(kind=4) D.1566;
    integer(kind=4) M.2;

    M.2 = 80;
    D.1566 = *nb;
    if (D.1566 > M.2)
      {
        M.2 = D.1566;
      }
    .bad_rec = MAX_EXPR <M.2, 0>;
    D.1567 = (bitsizetype) (sizetype) NON_LVALUE_EXPR <.bad_rec> * 8;
    D.1568 = (sizetype) NON_LVALUE_EXPR <.bad_rec>;
    D.1569 = NON_LVALUE_EXPR <SAVE_EXPR <D.1567>> + 7 & -8;
    D.1570 = NON_LVALUE_EXPR <SAVE_EXPR <D.1568>>;
        character(kind=1) bad_rec[1][1:.bad_rec];
  }
...some code that does the write...

.bad_rec has the correct value (80) later on in the print-statement.  However,
the code above (last line before }) looks to me as if bad_rec was created just
inside the shown block -- and is later no more available on the stack or
something, thus crashing the program.

So it seems that evaluating the max(...) creates the block shown above, and the
allocation of the automatic array is accidentally placed inside that block. 
This seems like a plausible cause for this bug.

Now I'll try to find out how to fix it.

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P4

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[domob at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

--- Comment #7 from Daniel Kraft <domob at gcc dot gnu.org> 2011-08-02 17:55:38 UTC ---
This seems to be fixed by changing gfc_start_block in
trans-array.c:gfc_trans_auto_array_allocation to gfc_init_block.  That's the
way it already was in trans-decl.c:gfc_trans_auto_character_variable, which
contains very similar code but did not create the "extra" scope.

I'll regtest this patch and submit if it does not introduce other failures.

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[domob at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

--- Comment #8 from Daniel Kraft <domob at gcc dot gnu.org> 2011-08-02 20:10:17 UTC ---
Author: domob
Date: Tue Aug  2 20:10:13 2011
New Revision: 177211

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=177211
Log:
2011-08-02  Daniel Kraft  <d@domob.eu>

    PR fortran/49885
    * trans-array.c (gfc_trans_auto_array_allocation): Change
    gfc_start_block to gfc_init_block to avoid spurious extra-scope.

2011-08-02  Daniel Kraft  <d@domob.eu>

    PR fortran/49885
    * gfortran.dg/auto_char_dummy_array_3.f90: New test.

Added:
    trunk/gcc/testsuite/gfortran.dg/auto_char_dummy_array_3.f90
Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/trans-array.c
    trunk/gcc/testsuite/ChangeLog

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[domob at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

--- Comment #9 from Daniel Kraft <domob at gcc dot gnu.org> 2011-08-02 20:15:08 UTC ---
Fixed on trunk.  I will also backport to 4.6 later, and then close the PR.

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[domob at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

--- Comment #10 from Daniel Kraft <domob at gcc dot gnu.org> 2011-08-03 09:37:14 UTC ---
Author: domob
Date: Wed Aug  3 09:37:11 2011
New Revision: 177249

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=177249
Log:
2011-08-03  Daniel Kraft  <d@domob.eu>

    PR fortran/49885
    * trans-array.c (gfc_trans_auto_array_allocation): Change
    gfc_start_block to gfc_init_block to avoid spurious extra-scope.

2011-08-03  Daniel Kraft  <d@domob.eu>

    PR fortran/49885
    * gfortran.dg/auto_char_dummy_array_3.f90: New test.

Added:
   
branches/gcc-4_6-branch/gcc/testsuite/gfortran.dg/auto_char_dummy_array_3.f90
Modified:
    branches/gcc-4_6-branch/gcc/fortran/ChangeLog
    branches/gcc-4_6-branch/gcc/fortran/trans-array.c
    branches/gcc-4_6-branch/gcc/testsuite/ChangeLog

[Bug fortran/49885] [4.6/4.7 Regression] Segmentation fault when writing to an automatic character array

[domob at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49885

Daniel Kraft <domob at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #11 from Daniel Kraft <domob at gcc dot gnu.org> 2011-08-03 09:40:40 UTC ---
Backported to 4.6.  Closing the PR now.