Bug 37744 - ICE-on-invalid with ISO_C_BINDING
Summary: ICE-on-invalid with ISO_C_BINDING
Status: RESOLVED WORKSFORME
Alias: None
Product: gcc
Classification: Unclassified
Component: fortran (show other bugs)
Version: 4.3.2
: P3 normal
Target Milestone: ---
Assignee: Mikael Morin
URL:
Keywords: error-recovery, ice-on-invalid-code
Depends on:
Blocks: 32630
  Show dependency treegraph
 
Reported: 2008-10-06 09:31 UTC by Dennis Wassel
Modified: 2012-03-04 19:47 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail: 4.3.4, 4.4.0, 4.5.0, 4.5.1, 4.6.0
Last reconfirmed: 2010-07-27 11:29:21


Attachments
pr.f90 (292 bytes, text/plain)
2008-10-06 09:33 UTC, Dennis Wassel
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dennis Wassel 2008-10-06 09:31:23 UTC
f951 hangs or segfaults on this invalid piece of code, after printing the correct diagnostic message.
The example is very sensitive to changes (even comments or whitespace), causing f951 to either hang, segfault or abort gracefully; this version provokes a segfault. The compiler can be provoked to hang by
a) invoking gfortran -march=i686 -mtune=generic pr.F90
b) removing the _C_BOOL modifier from .FALSE.

Output is

$ gfortran -v pr.F90
Driving: gfortran -v pr.F90 -lgfortranbegin -lgfortran -lm -shared-libgcc
Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: ../gcc-4.3.2/configure --enable-version-specific-runtime-libs -enable-languages=c,c++,fortran --program-suffix=-4.3.2 --with-arch=core2 --with-tune=core2
Thread model: posix
gcc version 4.3.2 (GCC) 
COLLECT_GCC_OPTIONS='-v' '-shared-libgcc' '-mtune=core2' '-march=core2'
 /usr/local/libexec/gcc/i686-pc-linux-gnu/4.3.2/cc1 -E -lang-fortran -traditional-cpp -D_LANGUAGE_FORTRAN -quiet -v pr.F90 -mtune=core2 -march=core2 -o /tmp/ccY5rhzV.f95
ignoring nonexistent directory "/usr/local/lib/gcc/i686-pc-linux-gnu/4.3.2/../../../../i686-pc-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/local/include
 /usr/local/lib/gcc/i686-pc-linux-gnu/4.3.2/include
 /usr/local/lib/gcc/i686-pc-linux-gnu/4.3.2/include-fixed
 /usr/include
End of search list.
COLLECT_GCC_OPTIONS='-v' '-shared-libgcc' '-mtune=core2' '-march=core2'
 /usr/local/libexec/gcc/i686-pc-linux-gnu/4.3.2/f951 /tmp/ccY5rhzV.f95 -ffree-form -quiet -dumpbase pr.F90 -mtune=core2 -march=core2 -auxbase pr -version -fpreprocessed -fintrinsic-modules-path /usr/local/lib/gcc/i686-pc-linux-gnu/4.3.2/finclude -o /tmp/ccWmyykH.s
GNU F95 (GCC) version 4.3.2 (i686-pc-linux-gnu)
	compiled by GNU C version 4.3.2, GMP version 4.2.2, MPFR version 2.3.1.
GGC heuristics: --param ggc-min-expand=64 --param ggc-min-heapsize=64448
pr.F90:22.19:

  foo%flags(trouble) = .FALSE._C_BOOL
                  1
Error: Symbol 'trouble' at (1) has no IMPLICIT type
f951: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

I plugged f951 into the debugger and it said the culprit is here:
gfc_undo_symbols () at gcc/fortran/symbol.c:2180

I cannot follow this any further myself right now.
Good hunting!
Comment 1 Dennis Wassel 2008-10-06 09:33:55 UTC
Created attachment 16464 [details]
pr.f90

s|.FALSE._C_BOOL|.FALSE.| to cause f951 to hang instead of segfaulting.
Comment 2 Daniel Franke 2008-12-09 19:12:12 UTC
Confirmed. As is, the testcase hangs for me and does not ICE. However, valgrind shows

==3159==                                                                                                            
pr37744.f90:22.19:                                                                                                    

  foo%flags(trouble) = .FALSE.
                  1           
Error: Symbol 'trouble' at (1) has no IMPLICIT type
==3159== Invalid read of size 4                    
==3159==    at 0x80C88BB: gfc_delete_symtree (symbol.c:2269)
==3159==    by 0x80C898C: gfc_undo_symbols (symbol.c:2723)  
==3159==    by 0x80A35E4: decode_statement (parse.c:267)    
==3159==    by 0x80A46C4: next_statement (parse.c:661)      
==3159==    by 0x80A6DFB: gfc_parse_file (parse.c:3781)     
==3159==    by 0x80EC438: gfc_init_constants (trans-const.c:197)
==3159==    by 0x80D6CDC: gfc_be_parse_file (f95-lang.c:236)    
==3159==    by 0x83B7FC2: toplev_main (toplev.c:968)            
==3159==    by 0x40D1004: (below main) (in /lib/libc-2.6.1.so)  
==3159==  Address 0x42893e8 is 0 bytes inside a block of size 1,676 free'd
==3159==    at 0x4023F2A: free (vg_replace_malloc.c:323)                  
==3159==    by 0x80C81B5: gfc_free_namespace (symbol.c:3065)              
==3159==    by 0x80EC438: gfc_init_constants (trans-const.c:197)          
==3159==    by 0x80D6CDC: gfc_be_parse_file (f95-lang.c:236)              
==3159==    by 0x83B7FC2: toplev_main (toplev.c:968)                      
==3159==    by 0x40D1004: (below main) (in /lib/libc-2.6.1.so)

[snipped many more invalid reads/writes]

==3159==
==3159== ERROR SUMMARY: 78 errors from 19 contexts (suppressed: 7 from 1)
==3159== malloc/free: in use at exit: 212,092 bytes in 976 blocks.
==3159== malloc/free: 2,238 allocs, 1,268 frees, 522,550 bytes allocated.
==3159== For counts of detected errors, rerun with: -v
==3159== searching for pointers to 976 not-freed blocks.
==3159== checked 2,261,148 bytes.
Comment 3 Dennis Wassel 2009-05-04 08:55:54 UTC
Also fails with 4.3.3:

gfortran -v pr37744.f90
Driving: gfortran -v pr37744.f90 -lgfortranbegin -lgfortran -lm -shared-libgcc
Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: ../gcc-4.3.3/configure --prefix=/localdata --program-suffix=-4.3.3 --enable-languages=c,c++,fortran --with-gmp=/localdata --with-mpfr=/localdata --enable-version-specific-runtime-libs
Thread model: posix
gcc version 4.3.3 (GCC)
COLLECT_GCC_OPTIONS='-v' '-shared-libgcc' '-mtune=generic'
 /localdata/libexec/gcc/i686-pc-linux-gnu/4.3.3/f951 pr37744.f90 -quiet -dumpbase pr37744.f90 -mtune=generic -auxbase pr37744 -version -fintrinsic-modules-path /localdata/lib/gcc/i686-pc-linux-gnu/4.3.3/finclude -o /tmp/ccQTr6UN.s
GNU F95 (GCC) version 4.3.3 (i686-pc-linux-gnu)
        compiled by GNU C version 4.3.3, GMP version 4.3, MPFR version 2.4.1-p5.
warning: GMP header version 4.3 differs from library version 4.3.0.
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
pr37744.f90:22.19:

  foo%flags(trouble) = .FALSE._C_BOOL
                   1
Error: Symbol 'trouble' at (1) has no IMPLICIT type
f951: internal compiler error: Segmentation fault
Comment 4 Dominique d'Humieres 2009-05-04 09:06:46 UTC
Also ICE on trunk r147065 powerpc-apple-darwin9 or r147085 i686-apple-darwin9.

Comment 5 Dominique d'Humieres 2009-08-13 17:05:05 UTC
At revision 150706 the ICEs go away on *-apple-darwin9 with -fwhole-file (see pr41059).
Comment 6 Dennis Wassel 2009-08-17 11:58:57 UTC
Also fails with 4.3.4 for me.
What has changed is the fact that I cannot provoke it to hang anymore, I just get ICEs, which is some progress :)
Unfortunately I cannot test it with trunk because of PR39849.
Comment 7 Daniel Franke 2010-05-19 16:29:40 UTC
Not related to types - this is more about namespace cleanup. Reduced testcase:

PROGRAM Main
  USE, INTRINSIC :: iso_c_binding
  CALL C_F_POINTER(rws, xrws)
  XXX                 ! any error will do
END PROGRAM Main

SUBROUTINE F()
END SUBROUTINE F

valgrind:
==24940== Invalid read of size 4
==24940==    at 0x8173957: gfc_delete_symtree (symbol.c:2374)
==24940==    by 0x4131BD5: (below main) (libc-start.c:226)
==24940==  Address 0x4308fc8 is 0 bytes inside a block of size 1,692 free'd
==24940==    at 0x4024B3A: free (vg_replace_malloc.c:366)
==24940==    by 0x812A3F5: gfc_free (misc.c:51)
==24940==    by 0x4131BD5: (below main) (libc-start.c:226)

gdb:
Program received signal SIGSEGV, Segmentation fault.
0x081739b2 in gfc_find_symtree (st=0x2e1, name=0xb7eece00 "shape") at /home/daniel/svn/gcc-svn/gcc/fortran/symbol.c:2393
2393          c = strcmp (name, st->name);
(gdb) bt
#0  0x081739b2 in gfc_find_symtree (st=0x2e1, name=0xb7eece00 "shape") at /home/daniel/svn/gcc-svn/gcc/fortran/symbol.c:2393
#1  0x08173969 in gfc_delete_symtree (root=0x8c54760, name=0xb7eece00 "shape") at /home/daniel/svn/gcc-svn/gcc/fortran/symbol.c:2374
#2  0x08174473 in gfc_undo_symbols () at /home/daniel/svn/gcc-svn/gcc/fortran/symbol.c:2845
#3  0x081385ff in decode_statement () at /home/daniel/svn/gcc-svn/gcc/fortran/parse.c:271
#4  0x0813a0e9 in next_free () at /home/daniel/svn/gcc-svn/gcc/fortran/parse.c:722
#5  0x0813a4d2 in next_statement () at /home/daniel/svn/gcc-svn/gcc/fortran/parse.c:907
#6  0x0813e6a6 in gfc_parse_file () at /home/daniel/svn/gcc-svn/gcc/fortran/parse.c:4220
#7  0x0817cbba in gfc_be_parse_file (set_yydebug=0) at /home/daniel/svn/gcc-svn/gcc/fortran/f95-lang.c:239
#8  0x084cfe1b in compile_file () at /home/daniel/svn/gcc-svn/gcc/toplev.c:1049
#9  0x084d1ed8 in do_compile () at /home/daniel/svn/gcc-svn/gcc/toplev.c:2393
#10 0x084d1f9e in toplev_main (argc=2, argv=0xbffff3c4) at /home/daniel/svn/gcc-svn/gcc/toplev.c:2435
#11 0x0820961b in main (argc=2, argv=0xbffff3c4) at /home/daniel/svn/gcc-svn/gcc/main.c:35

Comment 8 Dennis Wassel 2010-07-13 11:36:55 UTC
Also fails with 4.5.0 (release version) using Daniel's reduced testcase

$ gfortran -c pr37744.f90 
pr37744.f90:4.2:

  XXX                 ! any error will do
  1
Error: Unclassifiable statement at (1)
pr37744.f90:3.19:

  CALL C_F_POINTER(rws, xrws)
                   1
Error: Type mismatch in argument 'cptr' at (1); passed REAL(4) to TYPE(c_ptr)
f951: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.


$ gfortran --version
GNU Fortran (GCC) 4.5.0
Copyright (C) 2010 Free Software Foundation, Inc.

GNU Fortran comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of GNU Fortran
under the terms of the GNU General Public License.
For more information about these matters, see the file named COPYING
Comment 9 Dominique d'Humieres 2010-07-26 13:25:34 UTC
Note that since revision 162531 (-fwhole-file is now the default) the tests in this pr no longer give ICEs. However these ICEs reappear when the tests are compiled with -fno-whole-file.
Comment 10 Tobias Burnus 2010-07-26 13:31:45 UTC
(In reply to comment #9)
> Note that since revision 162531 (-fwhole-file is now the default) the tests in
> this pr no longer give ICEs. However these ICEs reappear when the tests are
> compiled with -fno-whole-file.

Then, I am inclined to close it as WONTFIX. As written elsewhere: -fno-whole-file is deprecated and I want to remove it early in 4.7 (though others disagree).
Comment 11 Dominique d'Humieres 2010-07-26 13:45:30 UTC
(In reply to comment #10)
> > Note that since revision 162531 (-fwhole-file is now the default) the tests in
> > this pr no longer give ICEs. However these ICEs reappear when the tests are
> > compiled with -fno-whole-file.
>
> Then, I am inclined to close it as WONTFIX. As written elsewhere:
> -fno-whole-file is deprecated and I want to remove it early in 4.7 (though
> others disagree).

Well, I am among those who disagree. I think the flag -fno-whole-file will be quite useful to locate remaining failure due to -fwhole-file and I seriously doubt that the list will be exhausted before stage 3 of 4.7 (in addition I don't see the interest of irregular options: if you want to get rid of the -fno-whole-file, you should also remove -fwhole-file and all the associated machinery!-). 

I think this PR should be left open as P5 and enhancement. If some day the options -f(no-)?while-file and the corresponding code are removed, then it could be close as wontfiw or invalid.
Comment 12 Mikael Morin 2010-07-27 11:29:21 UTC
I might take a look someday.
It seems a namespace is freed to soon. -fwhole-file works as it retains namespaces till the end.
Comment 13 Mikael Morin 2010-07-28 12:45:15 UTC
(In reply to comment #12)
> It seems a namespace is freed to soon. 
Reminder to self: symbol.c's build_formal_args creates a namespace for c_f_pointer and c_f_proc_pointer. May be related.
Comment 14 Daniel Franke 2010-12-30 03:07:14 UTC
(In reply to comment #12)
> I might take a look someday.
> It seems a namespace is freed to soon. -fwhole-file works as it retains
> namespaces till the end.

You may also want to have a look at PR41093.
Comment 15 Mikael Morin 2012-03-04 19:47:27 UTC
Cannot reproduce anymore, even with -fno-whole-file.