This is the mail archive of the gcc-bugs@gcc.gnu.org mailing list for the GCC project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[Bug fortran/52774] New: A check is needed to prevent deallocation in realloc-lhs


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52774

             Bug #: 52774
           Summary: A check is needed to prevent deallocation in
                    realloc-lhs
    Classification: Unclassified
           Product: gcc
           Version: 4.6.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: patnel97269-gfortran@yahoo.fr


A check is needed to prevent deallocation and nullification of D.1880.p.data if
it is equal to p1.p.data, after the function call.

This has been reported at http://gcc.gnu.org/ml/fortran/2012-03/msg00141.html

Here is the message of Paul Richard Thomas : 

A reduced and tidied testcase that exhibits the
problem is:
program test
  implicit none
  type po
    real(8), dimension(:), allocatable :: p
  end type
  type(po) :: p1
  allocate(p1%p(1))
  p1=toto(p1)
  print *, p1%p
contains
  function toto(dd) result(y)
    type(po) ::dd,y
    deallocate(dd%p)
  end function toto
end program test

The call to toto gives the following code:
          D.1880 = p1;
          p1 = toto (&p1);
          if (D.1880.p.data != 0B)
            {
              __builtin_free ((void *) D.1880.p.data);
            }
          D.1880.p.data = 0B;

Thus, if dd is deallocated within toto, without reassigning something
to dd%p, the address of p.data is retained by D.1880 and so it is
doubly freed.  This can be tested by adding an assignment to dd%p,
after the deallocation, whereupon everything works as it should.  For
example,
program test
  implicit none
  type po
    real(8), dimension(:), allocatable :: p
  end type
  type(po) :: p1
  allocate(p1%p(1))
  p1=toto(p1)
  print *, p1%p
contains
  function toto(dd) result(y)
    type(po) ::dd,y
    deallocate(dd%p)
    dd%p = [1d0, 2d0]
    y = dd
  end function toto
end program test


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]