[Bug fortran/124482] [16 Regression] SEGV in resolve_cyclic_derived_type

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124482

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jerry DeLisle <jvdelisle@gcc.gnu.org>:

https://gcc.gnu.org/g:d8b00bf2e1514cd132a9febaa9849ab46cd316f5

commit r16-8102-gd8b00bf2e1514cd132a9febaa9849ab46cd316f5
Author: Christopher Albert <albert@tugraz.at>
Date:   Fri Mar 13 20:50:07 2026 +0100

    fortran: Fix use-after-free in CLASS component error recovery [PR124482]

    The error recovery added in r16-8021 (PR106946) freed CLASS container
    symbols when removing invalid CLASS components from a derived type.
    However, gfc_build_class_symbol reuses existing containers when multiple
    components share the same class type and attributes.  Freeing the
    container for a failed component also invalidated it for previously
    committed components, causing a use-after-free detectable with valgrind
    and manifesting as a SEGV on Solaris/SPARC.

    Fix by deferring CLASS container cleanup until after all failed
    components are unlinked, then freeing the container only if no remaining
    component still references it.

    gcc/fortran/ChangeLog:

            PR fortran/124482
            * decl.cc (gfc_match_data_decl): Defer CLASS container cleanup
            until after all failed components are unlinked.  Check remaining
            component list before freeing a shared container.

    Signed-off-by: Christopher Albert <albert@tugraz.at>