https://gcc.gnu.org/g:865f86e9c65e364fbb0310d744395659b3ed3506
commit r16-9061-g865f86e9c65e364fbb0310d744395659b3ed3506 Author: Artur Pietrek <[email protected]> Date: Thu May 21 15:29:10 2026 +0200 ada: Fix finalize address for arrays of protected types Make_Address_For_Finalize emits a -Descriptor_Size shift whenever the array's first subtype is unconstrained, but does not check whether the object has a controlled component. For arrays of protected types Has_Controlled_Component is False so no dope vector is allocated, but at scope exit the incorrect finalize address is dereferenced, which may lead to EXCEPTION_ACCESS_VIOLATION, or silent error. gcc/ada/ChangeLog: * exp_ch7.adb (Make_Address_For_Finalize): check Has_Controlled_Component predicate before emitting the shift to be consistant with what Is_Constr_Array_Subt_With_Bounds says. Diff: --- gcc/ada/exp_ch7.adb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gcc/ada/exp_ch7.adb b/gcc/ada/exp_ch7.adb index c62529c49084..3b9943e2740f 100644 --- a/gcc/ada/exp_ch7.adb +++ b/gcc/ada/exp_ch7.adb @@ -5463,11 +5463,12 @@ package body Exp_Ch7 is -- subtype, its Finalize_Address primitive expects the address of -- an object with a dope vector (see Make_Finalize_Address_Stmts). -- This is achieved by setting Is_Constr_Array_Subt_With_Bounds, - -- but the address of the object is still that of its elements, - -- so we need to shift it back to skip the dope vector. + -- whose predicate also requires Has_Controlled_Component, so we + -- have to check for the controlled component here, too. if Is_Array_Type (Utyp) and then not Is_Constrained (First_Subtype (Utyp)) + and then Has_Controlled_Component (Utyp) then Obj_Addr := Shift_Address_For_Descriptor
