https://gcc.gnu.org/g:13401a86e75fb0a36ae85c59a93ee38837f32f90
commit r17-5094-g13401a86e75fb0a36ae85c59a93ee38837f32f90 Author: Paul Thomas <[email protected]> Date: Mon Oct 12 15:15:42 2026 +0100 Fortran: [PDT] (3/16) Parameterized derived type errors [PR82173] 2026-10-12 Paul Thomas <[email protected]> gcc/fortran PR fortran/82173 * trans-array.cc (structure_alloc_comps): The contribution of the lbound must be multiplied by the accumulated size to obtain the offset. * trans-decl.cc (gfc_trans_deferred_vars): Add a minor format correction. gcc/testsuite/ PR fortran/82173 * gfortran.dg/pdt_bug5.f90: New test. Diff: --- gcc/fortran/trans-array.cc | 6 +++++- gcc/fortran/trans-decl.cc | 3 ++- gcc/testsuite/gfortran.dg/pdt_bug5.f90 | 16 ++++++++++++++++ 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/gcc/fortran/trans-array.cc b/gcc/fortran/trans-array.cc index abc606dc627f..80411f9df1a9 100644 --- a/gcc/fortran/trans-array.cc +++ b/gcc/fortran/trans-array.cc @@ -11209,10 +11209,14 @@ structure_alloc_comps (gfc_symbol * der_type, tree decl, tree dest, gfc_rank_cst[i], size); size = gfc_evaluate_now (size, &fnblock); + tmp = fold_build2_loc (input_location, + MULT_EXPR, + gfc_array_index_type, + lower, size); offset = fold_build2_loc (input_location, MINUS_EXPR, gfc_array_index_type, - offset, size); + offset, tmp); offset = gfc_evaluate_now (offset, &fnblock); tmp = fold_build2_loc (input_location, MINUS_EXPR, gfc_array_index_type, diff --git a/gcc/fortran/trans-decl.cc b/gcc/fortran/trans-decl.cc index a614e71eced2..b5b51cbaaab8 100644 --- a/gcc/fortran/trans-decl.cc +++ b/gcc/fortran/trans-decl.cc @@ -5153,7 +5153,8 @@ gfc_trans_deferred_vars (gfc_symbol * proc_sym, gfc_wrapped_block * block) if (sym->ts.type == BT_DERIVED && sym->ts.u.derived - && (sym->ts.u.derived->attr.pdt_type || sym->ts.u.derived->attr.pdt_comp)) + && (sym->ts.u.derived->attr.pdt_type + || sym->ts.u.derived->attr.pdt_comp)) { is_pdt_type = true; gfc_init_block (&tmpblock); diff --git a/gcc/testsuite/gfortran.dg/pdt_bug5.f90 b/gcc/testsuite/gfortran.dg/pdt_bug5.f90 new file mode 100644 index 000000000000..181aad100e89 --- /dev/null +++ b/gcc/testsuite/gfortran.dg/pdt_bug5.f90 @@ -0,0 +1,16 @@ +! { dg-do run } +! Heap corruption: parameterized array component with a non-default +! lower bound was freed incorrectly at scope exit. +! See attachment to PR82173 comment 10 - reproducers/bug5-lower-bound-double-free.f90 +program p + type :: t(n) + integer, len :: n = 1 + integer :: a(0:n) + integer :: b(-n:0) + end type + type(t(3)) :: p1 + p1%a = 1 + p1%b = 2 + if (sum (p1%a) /= 4) stop 1 ! correct value, then "double free or corruption (out)" + if (sum (p1%b) /= 8) stop 2 ! ditto +end program
