Implied-do with allocatable-component causes wrong code
A Fortran compiler bug led to heap-use-after-free errors when reshape-like intrinsics with allocatable components were used in nested implied-do array construc…
The Fortran compiler was generating incorrect code for nested implied-do array constructors that used transformational intrinsics like RESHAPE with result types containing allocatable components. This occurred because argument temporaries were being freed before their contents were deep-copied into the result, leading to heap-use-after-free and incorrect runtime values. The fix repositions the block append for freeing temporaries until after the deep-copy loop, ensuring the source data remains live during the copy.
In Details
The trans-expr.cc file in the Fortran frontend handles expression translation. Specifically, gfc_conv_procedure_call manages the conversion of procedure calls, including intrinsic functions. Transformational intrinsics, when dealing with allocatable components, perform a shallow byte-copy, meaning the result's component pointers alias the argument temporaries. The bug arose when these temporaries were freed prematurely, leading to a use-after-free scenario during the deep-copy phase. The correction ensures the post-block append (which frees temporaries) happens after the deep-copy loop, p…
For Context
Compilers translate human-readable source code into machine code. Fortran, a language often used in scientific computing, has features like 'implied-do' loops for array construction and 'allocatable components' which are parts of data structures that can dynamically resize. 'Transformational intrinsics' are built-in functions that reshape or manipulate arrays. When a program used a nested implied-do loop to create an array with dynamically resizable parts and applied a transformational intrinsic, the compiler was mishandling the memory. It was releasing temporary memory locations too soon, before the data was fully copied to its final destination. This caused the program to try and read from memory that had already been freed, leading to crashes or incorrect results. The fix ensures the memory is held until all data is safely copied.