[Bug fortran/58803] Proc-pointer component: free_components deallocates twice pointer p->tb at symbol.c:2068

["burnus at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58803

Tobias Burnus <burnus at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
                 CC|                            |burnus at gcc dot gnu.org,
                   |                            |janus at gcc dot gnu.org
            Summary|free_components deallocates |Proc-pointer component:
                   |twice pointer p->tb at      |free_components deallocates
                   |symbol.c:2068               |twice pointer p->tb at
                   |                            |symbol.c:2068

--- Comment #1 from Tobias Burnus <burnus at gcc dot gnu.org> ---
The problem is that in free_components one frees:

2054    free_components (gfc_component *p)
...
2058      for (; p; p = q)
2059        {
2060          q = p->next;
2061
2062          gfc_free_array_spec (p->as);
2063          gfc_free_expr (p->initializer);
2064          free (p->tb);
2065
2066          free (p);
2067        }

Here:
  p->name == "f1"
  p->tb == (gfc_typebound_proc *) 0x17e0070

when one then cycles to p = q (i.e. to p->next), one has:
  p->name == "f2"
  p->tb == (gfc_typebound_proc *) 0x17e0070

 * * *

In decl.c's match_ppc_decl:

  /* Parse attributes.  */
  tb = XCNEW (gfc_typebound_proc);
  tb->where = gfc_current_locus;
  m = match_binding_attributes (tb, false, true);
...
  /* Match PPC names.  */
  ts = current_ts;
  for(num=1;;num++)
...
      c->tb = tb;


Possible patch:

diff --git a/gcc/fortran/decl.c b/gcc/fortran/decl.c
index 3a8175f..9c9fd4f 100644
--- a/gcc/fortran/decl.c
+++ b/gcc/fortran/decl.c
@@ -5057,3 +5057,10 @@ match_ppc_decl (void)

-      c->tb = tb;
+      if (num == 1)
+    c->tb = tb;
+      else
+    {
+      c->tb = XCNEW (gfc_typebound_proc);
+      c->tb->where = gfc_current_locus;
+      *c->tb = *tb;
+    }