[Bug fortran/88404] ICE (tree check) with -fsanitize=thread on Fortran2003 code

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88404

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2018-12-10 00:00:00         |
          Component|sanitizer                   |fortran

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The reason is we have

 <component_ref 0x7ffff6a54c90
    type <pointer_type 0x7ffff6a465e8
        type <array_type 0x7ffff6a46540 type <integer_type 0x7ffff688f348
character(kind=1)>
...
    arg:0 <mem_ref 0x7ffff6a57c08
        type <void_type 0x7ffff688ff18 void VOID
            align:8 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff688ff18
            pointer_to_this <pointer_type 0x7ffff6896000>>
...
    arg:1 <field_decl 0x7ffff6a451c8 cs type <pointer_type 0x7ffff6a465e8>
        unsigned DI t.f90:4:0 size <integer_cst 0x7ffff687ab70 64> unit-size
<integer_cst 0x7ffff687ab88 8>
        align:64 warn_if_not_align:0 offset_align 128 offset <integer_cst
0x7fff

thus a COMPONENT_REF indexing void_type.  This is created by the Fortran FE
here:

#3  0x00000000009c84ee in structure_alloc_comps (der_type=0x30bda80, 
    decl=<indirect_ref 0x7ffff6a56f80>, dest=<tree 0x0>, rank=0, purpose=1, 
    caf_mode=1)
    at /space/rguenther/src/gcc-sccvn/gcc/fortran/trans-array.c:8578
8578                                      decl, cdecl, NULL_TREE);
(gdb) l
8573            case DEALLOCATE_ALLOC_COMP:
8574
8575              gfc_init_block (&tmpblock);
8576
8577              comp = fold_build3_loc (input_location, COMPONENT_REF, ctype,
8578                                      decl, cdecl, NULL_TREE);
8579

here 'decl' is

(gdb) p debug_tree (decl)
 <indirect_ref 0x7ffff6a56f80
    type <void_type 0x7ffff688ff18 void VOID
        align:8 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff688ff18
        pointer_to_this <pointer_type 0x7ffff6896000>>

    arg:0 <component_ref 0x7ffff6a54870
        type <pointer_type 0x7ffff6896000 type <void_type 0x7ffff688ff18 void>
            public unsigned DI
...

which is built by build_fold_indirect_ref_loc, dereferencing a generic
pointer:

#1  0x0000000000a0632f in gfc_conv_procedure_call (se=0x7fffffffd3f0, 
    sym=0x31258b0, args=0x30c50c0, expr=0x0, append_args=0x0)
    at /space/rguenther/src/gcc-sccvn/gcc/fortran/trans-expr.c:5780
5780                    tmp = build_fold_indirect_ref_loc (input_location,
tmp);
(gdb) l
5775                  /* The derived type is passed to
gfc_deallocate_alloc_comp.
5776                     Therefore, class actuals can handled correctly but
derived
5777                     types passed to class formals need the _data
component.  */
5778                  tmp = gfc_class_data_get (tmp);
5779                  if (!CLASS_DATA (fsym)->attr.dimension)
5780                    tmp = build_fold_indirect_ref_loc (input_location,
tmp);
5781                }