[Bug fortran/99255] New: ICE in gfc_dt_upper_string, at fortran/module.c:441

[Bug fortran/99255] New: ICE in gfc_dt_upper_string, at fortran/module.c:441

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99255

            Bug ID: 99255
           Summary: ICE in gfc_dt_upper_string, at fortran/module.c:441
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Affects versions down to at least r5,
with a missing attribute allocatable or pointer :
(follow-up of pr95980)


$ cat z1.f90
program p
   type t
      character(:), allocatable :: c
   end type
   class(t) :: x
   select type (y => x)
   end select
end


$ cat z2.f90
program p
   type t
      character(:), allocatable :: c(:)
   end type
   class(t) :: x
   select type (y => x)
   end select
end


$ gfortran-11-20210221 -c z1.f90
f951: internal compiler error: Segmentation fault
0xda031f crash_signal
        ../../gcc/toplev.c:327
0x6fecd0 gfc_dt_upper_string(char const*)
        ../../gcc/fortran/module.c:441
0x69e74a get_unique_type_string
        ../../gcc/fortran/class.c:490
0x69f191 get_unique_hashed_string
        ../../gcc/fortran/class.c:524
0x6a2678 gfc_build_class_symbol(gfc_typespec*, symbol_attribute*,
gfc_array_spec**)
        ../../gcc/fortran/class.c:672
0x6f9393 gfc_match_select_type()
        ../../gcc/fortran/match.c:6449
0x719244 match_word
        ../../gcc/fortran/parse.c:65
0x719244 decode_statement
        ../../gcc/fortran/parse.c:428
0x71aa7c next_free
        ../../gcc/fortran/parse.c:1316
0x71aa7c next_statement
        ../../gcc/fortran/parse.c:1548
0x71c0eb parse_spec
        ../../gcc/fortran/parse.c:3967
0x71eebc parse_progunit
        ../../gcc/fortran/parse.c:5896
0x7205b1 gfc_parse_file()
        ../../gcc/fortran/parse.c:6437
0x76dbcf gfc_be_parse_file
        ../../gcc/fortran/f95-lang.c:212

[Bug fortran/99255] ICE in gfc_dt_upper_string, at fortran/module.c:441

[zeccav at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99255

Vittorio Zecca <zeccav at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zeccav at gmail dot com

--- Comment #1 from Vittorio Zecca <zeccav at gmail dot com> ---
A sanitized version of the compiler fails earlier at class.c line 487
"if (derived->attr.unlimited_polymorphic)"

~/local/gcc-150221-sanitized/bin/gfortran -S z1.f90
=================================================================
==8457==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000172d
at pc 0x000000496c01 bp 0x7fffca9abcd0 sp 0x7fffca9abcc8
READ of size 1 at 0x60400000172d thread T0
    #0 0x496c00 in get_unique_type_string
../../gcc-150221/gcc/fortran/class.c:487
    #1 0x4972c9 in get_unique_hashed_string
../../gcc-150221/gcc/fortran/class.c:524
    #2 0x498610 in gfc_build_class_symbol(gfc_typespec*, symbol_attribute*,
gfc_array_spec**) ../../gcc-150221/gcc/fortran/class.c:672
    #3 0x709d96 in copy_ts_from_selector_to_associate
../../gcc-150221/gcc/fortran/match.c:6237
    #4 0x70dc8a in gfc_match_select_type()
../../gcc-150221/gcc/fortran/match.c:6431
    #5 0x7f2b01 in match_word ../../gcc-150221/gcc/fortran/parse.c:65
    #6 0x7f4b32 in decode_statement ../../gcc-150221/gcc/fortran/parse.c:428
    #7 0x7fd6c8 in next_free ../../gcc-150221/gcc/fortran/parse.c:1316
    #8 0x7fe845 in next_statement ../../gcc-150221/gcc/fortran/parse.c:1548
    #9 0x80cb86 in parse_spec ../../gcc-150221/gcc/fortran/parse.c:3967
    #10 0x81bef7 in parse_progunit ../../gcc-150221/gcc/fortran/parse.c:5896
    #11 0x821732 in gfc_parse_file() ../../gcc-150221/gcc/fortran/parse.c:6437
    #12 0xa64b7c in gfc_be_parse_file
../../gcc-150221/gcc/fortran/f95-lang.c:212
    #13 0x33fa43d in compile_file ../../gcc-150221/gcc/toplev.c:457
    #14 0x34097a2 in do_compile ../../gcc-150221/gcc/toplev.c:2197
    #15 0x340a39f in toplev::main(int, char**)
../../gcc-150221/gcc/toplev.c:2336
    #16 0x7f24cb9 in main ../../gcc-150221/gcc/main.c:39
    #17 0x15054552b1e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)
    #18 0x41958d in _start
(/home/vitti/1TB/local/gcc-150221-sanitized/libexec/gcc/x86_64-pc-linux-gnu/11.0.0/f951+0x41958d)

0x60400000172d is located 29 bytes inside of 48-byte region
[0x604000001710,0x604000001740)
freed by thread T0 here:
    #0 0x15054647d797 in __interceptor_free
../../../../gcc-150221/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0xa1cd6f in gfc_delete_symtree(gfc_symtree**, char const*)
../../gcc-150221/gcc/fortran/symbol.c:2964
    #2 0xa25801 in gfc_restore_last_undo_checkpoint()
../../gcc-150221/gcc/fortran/symbol.c:3706
    #3 0xa25a5f in gfc_undo_symbols()
../../gcc-150221/gcc/fortran/symbol.c:3739
    #4 0x80175f in reject_statement ../../gcc-150221/gcc/fortran/parse.c:2678
    #5 0x7f2bb0 in match_word ../../gcc-150221/gcc/fortran/parse.c:70
    #6 0x7f42d9 in decode_statement ../../gcc-150221/gcc/fortran/parse.c:361
    #7 0x7fd6c8 in next_free ../../gcc-150221/gcc/fortran/parse.c:1316
    #8 0x7fe845 in next_statement ../../gcc-150221/gcc/fortran/parse.c:1548
    #9 0x8088f0 in parse_derived ../../gcc-150221/gcc/fortran/parse.c:3387
    #10 0x80c81b in parse_spec ../../gcc-150221/gcc/fortran/parse.c:3928
    #11 0x81bef7 in parse_progunit ../../gcc-150221/gcc/fortran/parse.c:5896
    #12 0x821732 in gfc_parse_file() ../../gcc-150221/gcc/fortran/parse.c:6437
    #13 0xa64b7c in gfc_be_parse_file
../../gcc-150221/gcc/fortran/f95-lang.c:212
    #14 0x33fa43d in compile_file ../../gcc-150221/gcc/toplev.c:457
    #15 0x34097a2 in do_compile ../../gcc-150221/gcc/toplev.c:2197
    #16 0x340a39f in toplev::main(int, char**)
../../gcc-150221/gcc/toplev.c:2336
    #17 0x7f24cb9 in main ../../gcc-150221/gcc/main.c:39
    #18 0x15054552b1e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)

previously allocated by thread T0 here:
    #0 0x15054647dc47 in __interceptor_calloc
../../../../gcc-150221/libsanitizer/asan/asan_malloc_linux.cpp:154
    #1 0x83c3e31 in xcalloc ../../gcc-150221/libiberty/xmalloc.c:162
    #2 0xa1cade in gfc_new_symtree(gfc_symtree**, char const*)
../../gcc-150221/gcc/fortran/symbol.c:2934
    #3 0xa20eed in gfc_get_sym_tree(char const*, gfc_namespace*, gfc_symtree**,
bool) ../../gcc-150221/gcc/fortran/symbol.c:3384
    #4 0xa21e11 in gfc_get_ha_sym_tree(char const*, gfc_symtree**)
../../gcc-150221/gcc/fortran/symbol.c:3469
    #5 0x6df4b3 in gfc_match_sym_tree(gfc_symtree**, int)
../../gcc-150221/gcc/fortran/match.c:706
    #6 0x84d6f7 in match_variable ../../gcc-150221/gcc/fortran/primary.c:4024
    #7 0x84f424 in gfc_match_variable(gfc_expr**, int)
../../gcc-150221/gcc/fortran/primary.c:4168
    #8 0x6e1a00 in gfc_match(char const*, ...)
../../gcc-150221/gcc/fortran/match.c:1162
    #9 0x6e2894 in gfc_match_assignment()
../../gcc-150221/gcc/fortran/match.c:1340
    #10 0x7f2b01 in match_word ../../gcc-150221/gcc/fortran/parse.c:65
    #11 0x7f42d9 in decode_statement ../../gcc-150221/gcc/fortran/parse.c:361
    #12 0x7fd6c8 in next_free ../../gcc-150221/gcc/fortran/parse.c:1316
    #13 0x7fe845 in next_statement ../../gcc-150221/gcc/fortran/parse.c:1548
    #14 0x8088f0 in parse_derived ../../gcc-150221/gcc/fortran/parse.c:3387
    #15 0x80c81b in parse_spec ../../gcc-150221/gcc/fortran/parse.c:3928
    #16 0x81bef7 in parse_progunit ../../gcc-150221/gcc/fortran/parse.c:5896
    #17 0x821732 in gfc_parse_file() ../../gcc-150221/gcc/fortran/parse.c:6437
    #18 0xa64b7c in gfc_be_parse_file
../../gcc-150221/gcc/fortran/f95-lang.c:212
    #19 0x33fa43d in compile_file ../../gcc-150221/gcc/toplev.c:457
    #20 0x34097a2 in do_compile ../../gcc-150221/gcc/toplev.c:2197
    #21 0x340a39f in toplev::main(int, char**)
../../gcc-150221/gcc/toplev.c:2336
    #22 0x7f24cb9 in main ../../gcc-150221/gcc/main.c:39
    #23 0x15054552b1e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)

SUMMARY: AddressSanitizer: heap-use-after-free
../../gcc-150221/gcc/fortran/class.c:487 in get_unique_type_string

[Bug fortran/99255] ICE in gfc_dt_upper_string, at fortran/module.c:441

[dominiq at lps dot ens.fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99255

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-04-18
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

[Bug fortran/99255] ICE in gfc_dt_upper_string, at fortran/module.c:441

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99255

--- Comment #2 from anlauf at gcc dot gnu.org ---
Replacing

  class(t) :: x

by

  class(t), allocatable :: x

avoids the ICE.  Could be an error recovery issue.