https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71203
--- Comment #6 from Harald Anlauf <anlauf at gmx dot de> --- For the case 3a, setting a breakpoint at expr.c:1684, I get: (gdb) l 1679 length = end - start + 1; 1680 1681 chr = (*newp)->value.character.string = gfc_get_wide_string (length + 1); 1682 (*newp)->value.character.length = length; 1683 memcpy (chr, &p->value.character.string[start - 1], 1684 length * sizeof (gfc_char_t)); 1685 chr[length] = '\0'; 1686 return true; 1687 } 1688 (gdb) print length $19 = -1 The problem appears to be the apparently negative string length.