From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id BA7DC3854809; Wed, 23 Dec 2020 23:29:47 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org BA7DC3854809
From: "guez at lmd dot ens.fr" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug fortran/98433] double free detected in tcache 2, after merge of
 structures
Date: Wed, 23 Dec 2020 23:29:47 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: fortran
X-Bugzilla-Version: 9.3.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: guez at lmd dot ens.fr
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P4
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-98433-4-upwz3X7O4J@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-98433-4@http.gcc.gnu.org/bugzilla/>
References: <bug-98433-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Dec 2020 23:29:47 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D98433

--- Comment #2 from Lionel GUEZ <guez at lmd dot ens.fr> ---
Sure, the issue goes away if you specify the components.

When you say "the likely correct line", do you imply that the line without =
the
components is incorrect? I would insist that the line without the component=
s is
correct. See for example Adams, Fortran 2003 Handbook, 2009, section 7.5.2:
"Derived-type intrinsic assignment is performed as if the assignment were
expanded, component-by-component with corresponding elements from the varia=
ble
and the expression, into separate assignment statements. [...] If the compo=
nent
is allocatable:
a. if it is allocated, it is deallocated.
b. if the corresponding component of the expression is allocated, the varia=
ble
component is allocated with the same dynamic type and type parameters and,
if it is an array, with the same bounds. [...]"

gfortran usually implements this well, as we can see when we replace the me=
rge
with a simple x3 =3D x2. But there is something wrong here in gfortran when=
 it
encounters the combination of derived-type assignment, merge function, and
being in a subroutine.

Since the line without the components is valid, the crash is a bug. (I might
add that, of course, I produced the simplest possible test case but, in my
original program, the allocatable component in the derived type is only one=
 of
several components and so, it is not an equivalently satisfying code to
manually assign all components one by one.)=