https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128509
Bug ID: 128509
Summary: Double free with a parenthesized array constructor of
a type with allocatable components
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: fortran
Assignee: unassigned at gcc dot gnu.org
Reporter: jvdelisle at gcc dot gnu.org
Target Milestone: ---
Found by Harald Anlauf while reviewing the patch for PR128357.
module m
implicit none
type :: t
integer :: c = 7
integer, allocatable :: v(:)
end type
contains
subroutine s (x)
type(t), intent(in) :: x(:)
if (x(2)%v(2) /= 2) stop 1
end subroutine
subroutine work ()
type(t) :: ta(2)
ta(1) = t (1, [1])
ta(2) = t (2, [2, 2])
call s (([ta]))
end subroutine
end module
program p
use m
call work ()
end program
$ gfortran -fsanitize=address -g pr.f90 && ./a.out
ERROR: AddressSanitizer: attempting double-free
call s ([ta]) and call s ((ta)) are fine. The components of ta are
freed twice, after the call and at the end of WORK. ([ta]) is an
operator expression, so gfc_conv_expr_descriptor copies the
constructor's elements into its temporary without copying their
allocatable components, and those components are freed after the
call. The elemental case, call se (([ta])), fails the same way,
because expr_may_alias_variables does not look through the
parentheses. ([ta, ta]), ([f()]) and ([ta(1), ta(2)]) fail too.
