https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98433
Bug ID: 98433
Summary: double free detected in tcache 2, after merge of
structures
Product: gcc
Version: 10.1.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: fortran
Assignee: unassigned at gcc dot gnu.org
Reporter: guez at lmd dot ens.fr
Target Milestone: ---
This is the output of `gcc -v` on my machine:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/9/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:hsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu
9.3.0-17ubuntu1~20.04' --with-bugurl=file:///usr/share/doc/gcc-9/README.Bugs
--enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,gm2 --prefix=/usr
--with-gcc-major-version-only --program-suffix=-9
--program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--libdir=/usr/lib --enable-nls --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new
--enable-gnu-unique-object --disable-vtable-verify --enable-plugin
--enable-default-pie --with-system-zlib --with-target-system-zlib=auto
--enable-objc-gc=auto --enable-multiarch --disable-werror --with-arch-32=i686
--with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib
--with-tune=generic
--enable-offload-targets=nvptx-none=/build/gcc-9-HskZEa/gcc-9-9.3.0/debian/tmp-nvptx/usr,hsa
--without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu
--host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 9.3.0 (Ubuntu 9.3.0-17ubuntu1~20.04)
Here is a test program for the bug:
$ cat test_bug_merge.f90
module bug_merge_m
implicit none
contains
subroutine bug_merge
type t
real, allocatable:: v(:)
end type t
type(t) x1, x2, x3
allocate(x1%v(1))
x1%v = 1.
allocate(x2%v(1))
x2%v = 2.
x3 = merge(x1, x2, .false.)
print *, "x3%v = ", x3%v
end subroutine bug_merge
end module bug_merge_m
program test_bug_merge
use bug_merge_m, only: bug_merge
implicit none
call bug_merge
end program test_bug_merge
And here is the result of compilation and execution:
$ gfortran test_bug_merge.f90
$ a.out
x3%v = 2.00000000
free(): double free detected in tcache 2
Program received signal SIGABRT: Process abort signal.
Backtrace for this error:
#0 0x146659050d3a
#1 0x14665904fed5
#2 0x146658e7e20f
#3 0x146658e7e18b
#4 0x146658e5d858
#5 0x146658ec83ed
#6 0x146658ed047b
#7 0x146658ed20ec
#8 0x55a871b8756c
#9 0x55a871b8759c
#10 0x55a871b875d5
#11 0x146658e5f0b2
#12 0x55a871b8711d
#13 0xffffffffffffffff
Aborted (core dumped)
I think there is nothing wrong in the program. x1 and x2 are well defined. The
error disappears if I replace the merge line with a simple x3 = x2. The error
also disappears if I inline the content of the subroutine in the main program
unit. Also, the program works with the Intel compiler.
