Confirm.

Valgrind shows:

==11328== Invalid read of size 8
==11328==    at 0x6CBB86: fold_convert_loc (fold-const.c:1856)
==11328==    by 0x58E7A3: allocate_temp_for_forall_nest_1 (trans-stmt.c:2583)
==11328==    by 0x58F394: gfc_trans_assign_need_temp (trans-stmt.c:2702)
==11328==    by 0x59284C: gfc_trans_forall_1 (trans-stmt.c:3158)
==11328==    by 0x551DFF: trans_code (trans.c:1205)

Failing is the following line in fold-const.c
  tree orig = TREE_TYPE (arg);
which is the second argument in the following line of allocate_temp_for_forall_nest_1:
   unit = fold_convert (gfc_array_index_type, TYPE_SIZE_UNIT (type));

It is set in gfc_trans_assign_need_temp:

  if (expr1->ts.type == BT_CHARACTER && expr1->ts.u.cl->length)
    ...
  else
    type = gfc_typenode_for_spec (&expr1->ts);

For the example, expr1->ts.type == BT_CHARACTER but expr1->ts.u.cl->length == NULL.

The symbol itself has:
(gdb) p *expr1->symtree->n.sym->ts.u.cl->length->value.integer._mp_d
$8 = 10

And the size is given by the expression:
(gdb) p expr1->ref->u.ss.start->expr_type 
$19 = EXPR_VARIABLE

Created attachment 21513 [details]
The beginings of a fix

This PR is going to drive me mad!

The immediate cause is a failure to get the TYPE_SIZE_UNIT to calculate the size of the temporary needed for the assignment.  This fixes that part of the problem but moves the focus to the assignment itself.  Something is badly wrong with the temporary's TREE_TYPE but I do not see what it is right now.

Let this be the record of where I got to....

Paul

Hi Paul,

The problem may well be where Joe pointed it out.

In

  if (expr1->ts.type == BT_CHARACTER && expr1->ts.u.cl->length)
    {
      if (!expr1->ts.u.cl->backend_decl)
	{
	  gfc_se tse;
	  gfc_init_se (&tse, NULL);
	  gfc_conv_expr (&tse, expr1->ts.u.cl->length);
	  expr1->ts.u.cl->backend_decl = tse.expr;
	}
      type = gfc_get_character_type_len (gfc_default_character_kind,
				         expr1->ts.u.cl->backend_decl);
    }

the fact that expr1 has a substring reference is not taken into account,
so it might be necessary to calculate the length of the string
from expr1->ref->u.ss.end - expr1->ref.u.ss.start + 1.  You may have
to take care not to calculate any functions twice, though.

Hope this helps a little bit.

Still fails:

ig25@linux-fd1f:~/Krempel/Forall> valgrind /home/ig25/lib/gcc/x86_64-unknown-linux-gnu/4.9.0/f951 bug.f90 
==24599== Memcheck, a memory error detector
==24599== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==24599== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==24599== Command: /home/ig25/lib/gcc/x86_64-unknown-linux-gnu/4.9.0/f951 bug.f90
==24599== 
 bug==24599== Invalid read of size 2
==24599==    at 0x786F01: fold_convert_loc(unsigned int, tree_node*, tree_node*) (tree.h:3797)
==24599==    by 0x5FE16F: allocate_temp_for_forall_nest_1(tree_node*, tree_node*, stmtblock_t*, tree_node**) (trans-stmt.c:3270)
==24599==    by 0x5FEA47: gfc_trans_assign_need_temp(gfc_expr*, gfc_expr*, tree_node*, bool, forall_info*, stmtblock_t*) (trans-stmt.c:3391)
==24599==    by 0x602DE0: gfc_trans_forall_1(gfc_code*, forall_info*) (trans-stmt.c:3868)
==24599==    by 0x5A6847: trans_code(gfc_code*, tree_node*) (trans.c:1569)
==24599==    by 0x5CD8AE: gfc_generate_function_code(gfc_namespace*) (trans-decl.c:5397)
==24599==    by 0x565800: gfc_parse_file() (parse.c:4468)
==24599==    by 0x5A20E5: gfc_be_parse_file() (f95-lang.c:189)
==24599==    by 0x94D725: compile_file() (toplev.c:543)
==24599==    by 0x94F5A9: toplev_main(int, char**) (toplev.c:1876)
==24599==    by 0x5A38454: (below main) (in /lib64/libc-2.15.so)
==24599==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

This PR is fixed by the patch at https://gcc.gnu.org/ml/fortran/2014-08/msg00114.html. Test that can be executed:

subroutine bug
  character(len=10) :: F_string
  character(len=1), dimension(:), pointer :: p_chars
  allocate(p_chars(10))
  p_chars = ['a','b','c','d','e','f','g','h','i','j']
  forall (i=1:len(F_string))
    F_string(i:i) = p_chars(i)
  end forall
  print *, F_string
  deallocate(p_chars)
end subroutine bug
call bug()
end

[Book15] f90/bug% a.out
 abcdefghij

Author: burnus
Date: Sat Aug 30 18:47:04 2014
New Revision: 214757

URL: https://gcc.gnu.org/viewcvs?rev=214757&root=gcc&view=rev
Log:
2014-08-30  Tobias Burnus  <burnus@net-b.de>

        PR fortran/62278
        PR fortran/44735
        PR fortran/60593
        * dependency.c (gfc_check_dependency): Allow for optimizations
        in the pointer-alias check.


Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/dependency.c

The fix looks good.

Commit the test case from comment #5 and close?

Author: fxcoudert
Date: Mon May  4 14:27:14 2015
New Revision: 222766

URL: https://gcc.gnu.org/viewcvs?rev=222766&root=gcc&view=rev
Log:
	PR fortran/44735
	* gfortran.dg/pr44735.f90: New test.

Added:
    trunk/gcc/testsuite/gfortran.dg/pr44735.f90
Modified:
    trunk/gcc/testsuite/ChangeLog

Testcase committed, closing as FIXED.