[Bug fortran/64578] New: Seg-fault and ICE with unlimited polymorphic array pointer function

[Bug fortran/64578] New: Seg-fault and ICE with unlimited polymorphic array pointer function

[damian at sourceryinstitute dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

            Bug ID: 64578
           Summary: Seg-fault and ICE with unlimited polymorphic array
                    pointer function
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: damian at sourceryinstitute dot org

The code below seg faults with a gfortran 5.0 build dated 20141222 and
generates an internal compiler error when the print statement is uncommented. 
The same code compiles, executes without error, and the print statement prints
"T" with the Cray compiler.  Similar code also compiles and executes cleanly
with the Intel and NAG compilers, although I didn't test this exact (reduced)
case with Intel and NAG.

Damian


$cat unlim-poly-array-ptr-func.f90 
  type foo 
     real, allocatable :: component(:)
  end type 
  type (foo), target :: f
  class(*), pointer :: ptr(:)
  allocate(f%component(1),source=[0.])
  call associate_pointer(f,ptr)
  ptr => return_pointer(f)  ! runtime segmentation fault
 !print *,associated(return_pointer(f)) ! ICE 
contains
  subroutine associate_pointer(this, item)
    class(foo), target :: this
    class(*), pointer :: item(:)
    item => this%component
  end subroutine 
  function return_pointer(this) 
    class(foo), target :: this
    class(*), pointer :: return_pointer(:)
    return_pointer => this%component
  end function 
end
$gfortran unlim-poly-array-ptr-func.f90 
$./a.out

Program received signal SIGSEGV: Segmentation fault - invalid memory reference.

Backtrace for this error:
#0  0x7FA26BE8EBB7
#1  0x7FA26BE8DDB0
#2  0x7FA26B39949F
#3  0x400F55 in return_pointer.3443 at unlim-poly-array-ptr-func.f90:0
#4  0x400A46 in MAIN__ at unlim-poly-array-ptr-func.f90:0
Segmentation fault (core dumped)
$gfortran --version | head -1
GNU Fortran (GCC) 5.0.0 20141222 (experimental)

[Bug fortran/64578] Seg-fault and ICE with unlimited polymorphic array pointer function

[damian at sourceryinstitute dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #1 from Damian Rouson <damian at sourceryinstitute dot org> ---
P.S. For the submitted case, a simple workaround is to switch the source
allocation to an assignment.  That simple workaround is an option in the
intended application code, wherein the derived type component is also an
unlimited polymorphic variable.

[Bug fortran/64578] Seg-fault and ICE with unlimited polymorphic array pointer function

[damian at sourceryinstitute dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #2 from Damian Rouson <damian at sourceryinstitute dot org> ---
In Comment 1, I meant to write "is _not_ an option"

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[janus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

janus at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-01-13
            Summary|Seg-fault and ICE with      |[OOP] Seg-fault and ICE
                   |unlimited polymorphic array |with unlimited polymorphic
                   |pointer function            |array pointer function
     Ever confirmed|0                           |1

--- Comment #3 from janus at gcc dot gnu.org ---
I can confirm both problems with 4.9 and trunk. 4.8 rejects the test case with
some (bogus?) error.

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[janus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #4 from janus at gcc dot gnu.org ---
The backtrace for the ICE is:


   print *,associated(return_pointer(f)) ! ICE 
 1
internal compiler error: in fold_convert_loc, bei fold-const.c:2345
0x80c725 fold_convert_loc(unsigned int, tree_node*, tree_node*)
    /home/jweil/gcc/gcc50/trunk/gcc/fold-const.c:2345
0x6c3615 gfc_conv_associated
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-intrinsic.c:6569
0x6c3615 gfc_conv_intrinsic_function(gfc_se*, gfc_expr*)
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-intrinsic.c:7674
0x6a7848 gfc_conv_function_expr
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-expr.c:5849
0x6a7e12 gfc_conv_expr(gfc_se*, gfc_expr*)
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-expr.c:6609
0x6ac964 gfc_conv_expr_reference(gfc_se*, gfc_expr*)
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-expr.c:6744
0x6c8485 gfc_trans_transfer(gfc_code*)
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-io.c:2335
0x67c917 trans_code
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans.c:1853
0x6c6290 build_dt
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-io.c:1862
0x67c937 trans_code
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans.c:1825
0x69d96f gfc_generate_function_code(gfc_namespace*)
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/trans-decl.c:5806
0x639db0 translate_all_program_units
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/parse.c:4947
0x639db0 gfc_parse_file()
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/parse.c:5144
0x678ab5 gfc_be_parse_file
    /home/jweil/gcc/gcc50/trunk/gcc/fortran/f95-lang.c:228

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[dominiq at lps dot ens.fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #5 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
I don't see the segmentation fault on x86_64-apple-darwin14 and 4.9.(2|3) or
trunk (5.0 with or without patches). However I get the ICE if I remove the
comment. Note that with 4.8.(4|5) I get the following error for the test in
comment 0:

  ptr => return_pointer(f)  ! runtime segmentation fault
  1
Error: Different ranks in pointer assignment at (1)

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[janus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #6 from janus at gcc dot gnu.org ---
Reduced test case for the ICE:

  print *, associated(return_pointer()) ! ICE
contains
  function return_pointer()
    class(*), pointer :: return_pointer(:)
  end function 
end

ICEs with 4.8, 4.9, trunk. Rejected by 4.7, because class(*) is not supported.

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[janus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #7 from janus at gcc dot gnu.org ---
In fact also a normal class pointer is sufficient to trigger the ICE. It
doesn't need to be unlimited, but it needs to be an array:

  type foo
  end type
  print *, associated(return_pointer())   ! ICE
contains
  function return_pointer()
    class(foo), pointer :: return_pointer(:)
  end function 
end

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[paul.richard.thomas at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

paul.richard.thomas at gmail dot com <paul.richard.thomas at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |paul.richard.thomas at gmail dot c
                   |                            |om

--- Comment #8 from paul.richard.thomas at gmail dot com <paul.richard.thomas at gmail dot com> ---
(In reply to janus from comment #6)
> Reduced test case for the ICE:
> 
>   print *, associated(return_pointer()) ! ICE
> contains
>   function return_pointer()
>     class(*), pointer :: return_pointer(:)
>   end function 
> end
> 
> ICEs with 4.8, 4.9, trunk. Rejected by 4.7, because class(*) is not
> supported.

The above ICE is fixed with:

Index: /svn/trunk/gcc/fortran/trans-intrinsic.c
===================================================================
*** /svn/trunk/gcc/fortran/trans-intrinsic.c    (revision 219297)
--- /svn/trunk/gcc/fortran/trans-intrinsic.c    (working copy)
*************** gfc_conv_associated (gfc_se *se, gfc_exp
*** 6544,6550 ****
--- 6544,6554 ----
          arg1se.expr = build_fold_indirect_ref_loc (input_location,
                                 arg1se.expr);
        if (arg1->expr->ts.type == BT_CLASS)
+         {
            tmp2 = gfc_class_data_get (arg1se.expr);
+           if (GFC_DESCRIPTOR_TYPE_P (TREE_TYPE (tmp2)))
+         tmp2 = gfc_conv_descriptor_data_get (tmp2);
+         }
        else
          tmp2 = arg1se.expr;
          }

such that

  type foo
    integer :: i
  end type
  logical :: l
  class(foo), pointer :: ptr(:)
  print *, associated(return_pointer())   ! ICE
  print *, associated(return_pointer1())   ! ICE
  ptr => return_pointer1 ()
  select type (ptr)
    type is (foo)
      print *, ptr%i
  end select
contains
  function return_pointer()
    class(foo), pointer :: return_pointer(:)
    return_pointer => NULL()
  end function
  function return_pointer1()
    class(foo), pointer :: return_pointer1(:)
    allocate (return_pointer1(2), source = foo(99))
  end function
end

does the right thing....

[pault@localhost pr55901]# ./a.out
 F
 T
          99          99

The runtime segfault remains because the code for the call to return_pointer in
the full example is
    {
      struct __class__STAR_1_0p ptrtemp.12;
      struct __class_MAIN___Foo_t class.11;

      ptrtemp.12 = return_pointer (&class.11);
      (struct __vtype__STAR *) ptr._vptr = (struct __vtype__STAR *)
ptrtemp.12._vptr;
      ptr._data = ptrtemp.12._data;
    }

ie. bizarrely, none of the fields in class.11 are set. I'll see if I can
understand why.

Cheers

Paul

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

Paul Thomas <pault at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pault at gcc dot gnu.org

--- Comment #9 from Paul Thomas <pault at gcc dot gnu.org> ---
I had a quick look this morning to see if I could understand the reason for the
last remark of my previous comment.

The statements responsible for setting the _data and the _vptr fields of
class.11 are certainly visited but never make it into the code. It is as if the
parmse.pre and .post are not added. I could not see why.

If the rhs of the pointer assignment to return_pointer is set to NULL(), the
code behaves correctly.

I'll give it another go tonight.

Paul

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[paul.richard.thomas at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #10 from paul.richard.thomas at gmail dot com <paul.richard.thomas at gmail dot com> ---
This fixes the other part of the problem:

*************** gfc_trans_pointer_assignment (gfc_expr *
*** 6917,6922 ****
--- 7033,7039 ----
          rse.expr = gfc_class_data_get (rse.expr);
            else
          {
+           gfc_add_block_to_block (&block, &rse.pre);
            tmp = gfc_create_var (TREE_TYPE (rse.expr), "ptrtemp");
            gfc_add_modify (&lse.pre, tmp, rse.expr);

*************** gfc_trans_pointer_assignment (gfc_expr *
*** 6988,6993 ****
--- 7105,7111 ----
          }
        else
          {
+           gfc_add_block_to_block (&block, &rse.pre);
            tmp = gfc_create_var (TREE_TYPE (rse.expr), "ptrtemp");
            gfc_add_modify (&lse.pre, tmp, rse.expr);

rse is reinitialized in both blocks just a few lines later so that the rse.pre
information is lost. Therefore, class.11 is never set.

I'll take this on and submit the patch tomorrow.

Paul

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #11 from Paul Thomas <pault at gcc dot gnu.org> ---
Author: pault
Date: Sat Jan 17 20:44:07 2015
New Revision: 219802

URL: https://gcc.gnu.org/viewcvs?rev=219802&root=gcc&view=rev
Log:
2015-01-17  Paul Thomas  <pault@gcc.gnu.org>

    PR fortran/64578
    * trans-expr.c (gfc_trans_pointer_assignment): Make sure that
    before reinitializing rse, to add the rse.pre to block before
    creating 'ptrtemp'.
    * trans-intrinsic.c (gfc_conv_associated): Deal with the class
    data being a descriptor.

2015-01-17  Paul Thomas  <pault@gcc.gnu.org>

    PR fortran/64578
    * gfortran.dg/unlimited_polymorphic_21.f90: New test

Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/trans-expr.c
    trunk/gcc/fortran/trans-intrinsic.c
    trunk/gcc/testsuite/ChangeLog

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[dominiq at lps dot ens.fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #12 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
AFAICT gfortran.dg/unlimited_polymorphic_21.f90 has not yet been committed.

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #13 from Paul Thomas <pault at gcc dot gnu.org> ---
Author: pault
Date: Sun Jan 18 15:52:49 2015
New Revision: 219818

URL: https://gcc.gnu.org/viewcvs?rev=219818&root=gcc&view=rev
Log:
2015-01-18  Paul Thomas  <pault@gcc.gnu.org>

    PR fortran/64578
    * trans-expr.c (gfc_trans_subcomponent_assign): Use a deep copy
    for allocatable components, where the source is a variable.

2015-01-18  Paul Thomas  <pault@gcc.gnu.org>

    PR fortran/64578
    * gfortran.dg/block_13.f08: New test

Added:
    trunk/gcc/testsuite/gfortran.dg/block_13.f08
Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/trans-expr.c
    trunk/gcc/testsuite/ChangeLog

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[paul.richard.thomas at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #14 from paul.richard.thomas at gmail dot com <paul.richard.thomas at gmail dot com> ---
Ignore comment 13! I screwed up the Change Logs for PR57959.

Paul

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[paul.richard.thomas at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #15 from paul.richard.thomas at gmail dot com <paul.richard.thomas at gmail dot com> ---
(In reply to Dominique d'Humieres from comment #12)
> AFAICT gfortran.dg/unlimited_polymorphic_21.f90 has not yet been committed.

You are absolutely correct. I just notice it when applying Andre's patch for
PR60255 with view to committing it. I have been rushing a bit too much with
this flood of patches. "More haste, less speed", as we anglo-saxons say :-)

I'll commit it with the patch for PR60255

Thanks

[Bug fortran/64578] [OOP] Seg-fault and ICE with unlimited polymorphic array pointer function

[pault at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64578

--- Comment #16 from Paul Thomas <pault at gcc dot gnu.org> ---
Author: pault
Date: Sun Jan 18 22:01:29 2015
New Revision: 219827

URL: https://gcc.gnu.org/viewcvs?rev=219827&root=gcc&view=rev
Log:
2015-01-18  Andre Vehreschild  <vehre@gmx.de>
        Janus Weil <janus@gcc.gnu.org>

    PR fortran/60255
    * class.c (gfc_get_len_component): New.
    (gfc_build_class_symbol): Add _len component to unlimited
    polymorphic entities.
    (find_intrinsic_vtab): Removed emitting of error message.
    * gfortran.h: Added prototype for gfc_get_len_component.
    * simplify.c (gfc_simplify_len): Use _len component where
    available.
    * trans-expr.c (gfc_class_len_get): New.
    (gfc_conv_intrinsic_to_class): Add handling for deferred
    character arrays.
    (gfc_conv_structure): Treat _len component correctly.
    (gfc_conv_expr): Prevent bind_c handling when not required.
    (gfc_trans_pointer_assignment): Propagate _len component.
    * trans-stmt.c (class_has_len_component): New.
    (trans_associate_var): _len component treatment for associate
    context.
    (gfc_trans_allocate): Same as for trans_associate_var()
    * trans.h: Added prototype for gfc_class_len_get.

2015-01-18  Andre Vehreschild  <vehre@gmx.de>

    PR fortran/60255
    * gfortran.dg/unlimited_polymorphic_2.f03: Removed error.
    * gfortran.dg/unlimited_polymorphic_20.f03: New test.

2015-01-18  Paul Thomas  <pault@gcc.gnu.org>

    PR fortran/64578
    * gfortran.dg/unlimited_polymorphic_21.f90: New test

Added:
    trunk/gcc/testsuite/gfortran.dg/unlimited_polymorphic_20.f90
    trunk/gcc/testsuite/gfortran.dg/unlimited_polymorphic_21.f90
Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/class.c
    trunk/gcc/fortran/gfortran.h
    trunk/gcc/fortran/simplify.c
    trunk/gcc/fortran/trans-expr.c
    trunk/gcc/fortran/trans-stmt.c
    trunk/gcc/fortran/trans.h
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gfortran.dg/unlimited_polymorphic_2.f03