Committed after Rainer confirmed the fix in bugzilla.
commit d8b00bf2e1514cd132a9febaa9849ab46cd316f5 (HEAD -> master, origin/master,
origin/HEAD)
Author: Christopher Albert <[email protected]>
Date: Fri Mar 13 20:50:07 2026 +0100
fortran: Fix use-after-free in CLASS component error recovery [PR124482]
Best regards,
Jerry
On 3/14/26 11:26 AM, Jerry D wrote:
The attached patch fixes the regression found by Rainer on Solaris Spark. It
manifests on x86_64 as invalid reads identified by valgrind.
I did confirm the valgrin errors before the patch and that they go away after
the patch. This is sufficient reason to commit this. I did not hear back from
Rainer yet in the PR, however if we fix it he will see in his regular builds.
Regression tested on x86_64. Valgrind tested.
OK for mainline?
I will consider backporting to 15 if reasonable. Likely this will be a combining
of the original fix for 106946 and this one. (easy to do).
Regards,
Jerry
From: Christopher Albert <[email protected]>
Date: Fri, 13 Mar 2026 20:50:07 +0100
Subject: [PATCH] fortran: Fix use-after-free in CLASS component error recovery
[PR124482]
The error recovery added in r16-8021 (PR106946) freed CLASS container
symbols when removing invalid CLASS components from a derived type.
However, gfc_build_class_symbol reuses existing containers when multiple
components share the same class type and attributes. Freeing the
container for a failed component also invalidated it for previously
committed components, causing a use-after-free detectable with valgrind
and manifesting as a SEGV on Solaris/SPARC.
Fix by deferring CLASS container cleanup until after all failed
components are unlinked, then freeing the container only if no remaining
component still references it.
gcc/fortran/ChangeLog:
PR fortran/124482
* decl.cc (gfc_match_data_decl): Defer CLASS container cleanup
until after all failed components are unlinked. Check remaining
component list before freeing a shared container.
Signed-off-by: Christopher Albert <[email protected]>
