llvm / llvm/llvm-project

[flang] flang crashes with CHECK(IsVariable(v)) failed in CoarrayRef::set_stat() on invalid STAT= specifier in coindexed reference

Closed
#208,889 1 comment 0 reactions 0 assignees View on GitHub
crash flang:frontend generated by fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```fortran
subroutine s1()
rVar1 = rCoarray[1,2,3,STAT=MASK(2)]
end subroutine s1
```

Resulted in this output:
```
fatal internal error: CHECK(IsVariable(v)) failed at flang/lib/Evaluate/variable.cpp(101)
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /usr/lib/llvm-22/bin/flang -fc1 -triple x86_64-pc-linux-gnu -emit-obj -mrelocation-model pic -pic-level 2 -pic-is-pie -target-cpu x86-64 -resource-dir /usr/lib/llvm-22/lib/clang/22 -mframe-pointer=all -o /tmp/test-5ec3b6.o -x f95 /tmp/test.f90
#0 0x00007ff4edcc9d5f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-22/lib/libLLVM.so.22.1+0x4dc7d5f)
#1 0x00007ff4edcc75d7 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-22/lib/libLLVM.so.22.1+0x4dc55d7)
#2 0x00007ff4edccab2a (/usr/lib/llvm-22/lib/libLLVM.so.22.1+0x4dc8b2a)
#3 0x00007ff4e899e330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x00007ff4e89f7b2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#5 0x00007ff4e899e27e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#6 0x00007ff4e89818ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#7 0x0000556bec9ed61c (/usr/lib/llvm-22/bin/flang+0x2b2061c)
#8 0x0000556bec69fc05 Fortran::evaluate::CoarrayRef::set_stat(Fortran::evaluate::Expr>&&) (/usr/lib/llvm-22/bin/flang+0x27d2c05)
#9 0x0000556beb0f6337 Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::CoindexedNamedObject const&) (/usr/lib/llvm-22/bin/flang+0x1229337)
#10 0x0000556beb0ed2fc Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::Designator const&) (/usr/lib/llvm-22/bin/flang+0x12202fc)
#11 0x0000556beb1695b5 (/usr/lib/llvm-22/bin/flang+0x129c5b5)
#12 0x0000556beb10b1f8 std::optional> Fortran::evaluate::ExpressionAnalyzer::ExprOrVariable(Fortran::parser::Expr const&, Fortran::parser::CharBlock) (/usr/lib/llvm-22/bin/flang+0x123e1f8)
#13 0x0000556beb10adb5 Fortran::evaluate::ExpressionAnalyzer::IterativelyAnalyzeSubexpressions(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x123ddb5)
#14 0x0000556beb0f0f93 Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x1223f93)
#15 0x0000556beb113225 Fortran::evaluate::ArgumentAnalyzer::AnalyzeExprOrWholeAssumedSizeArray(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x1246225)
#16 0x0000556beb112bc0 Fortran::evaluate::ArgumentAnalyzer::AnalyzeExpr(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x1245bc0)
#17 0x0000556beb1044a3 (/usr/lib/llvm-22/bin/flang+0x12374a3)
#18 0x0000556beb103cdf Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::AssignmentStmt const&) (/usr/lib/llvm-22/bin/flang+0x1236cdf)
#19 0x0000556beb12463c (/usr/lib/llvm-22/bin/flang+0x125763c)
#20 0x0000556beb11a426 (/usr/lib/llvm-22/bin/flang+0x124d426)
#21 0x0000556beb116c7e (/usr/lib/llvm-22/bin/flang+0x1249c7e)
#22 0x0000556beb172a75 (/usr/lib/llvm-22/bin/flang+0x12a5a75)
#23 0x0000556beb1143b7 Fortran::semantics::ExprChecker::Walk(Fortran::parser::Program const&) (/usr/lib/llvm-22/bin/flang+0x12473b7)
#24 0x0000556beb348051 Fortran::semantics::Semantics::Perform() (/usr/lib/llvm-22/bin/flang+0x147b051)
#25 0x0000556beaa9791e Fortran::frontend::FrontendAction::runSemanticChecks() (/usr/lib/llvm-22/bin/flang+0xbca91e)
#26 0x0000556beaa9c7da Fortran::frontend::CodeGenAction::beginSourceFileAction() (/usr/lib/llvm-22/bin/flang+0xbcf7da)
#27 0x0000556beaa96f9e Fortran::frontend::FrontendAction::beginSourceFile(Fortran::frontend::CompilerInstance&, Fortran::frontend::FrontendInputFile const&) (/usr/lib/llvm-22/bin/flang+0xbc9f9e)
#28 0x0000556beaa7ee7f Fortran::frontend::CompilerInstance::executeAction(Fortran::frontend::FrontendAction&) (/usr/lib/llvm-22/bin/flang+0xbb1e7f)
#29 0x0000556beaa9bba0 Fortran::frontend::executeCompilerInvocation(Fortran::frontend::CompilerInstance*) (/usr/lib/llvm-22/bin/flang+0xbceba0)
#30 0x0000556beaa7cd34 fc1_main(llvm::ArrayRef, char const*) (/usr/lib/llvm-22/bin/flang+0xbafd34)
#31 0x0000556beaa7bfa4 main (/usr/lib/llvm-22/bin/flang+0xbaefa4)
#32 0x00007ff4e89831ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#33 0x00007ff4e898328b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#34 0x0000556beaa7af45 _start (/usr/lib/llvm-22/bin/flang+0xbadf45)
flang-22: error: unable to execute command: Aborted (core dumped)
flang-22: error: flang frontend command failed due to signal (use -v to see invocation)
Ubuntu flang version 22.1.8 (++20260613092238+e80beda6e255-1~exp1~20260613092253.78)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm-22/bin
flang-22: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
flang-22: note: diagnostic msg: /tmp/test-2abdd8
flang-22: note: diagnostic msg: /tmp/test-2abdd8.sh
flang-22: note: diagnostic msg:

********************
```

To reproduce:
```
flang ./test.f90
```

Compiler version:
```
Ubuntu flang version 22.1.8 (++20260613092238+e80beda6e255-1~exp1~20260613092253.78)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm-22/bin
```

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with flang using the Fortran code in test.f90, then inspect flang/lib/Evaluate/variable.cpp and CoarrayRef::set_stat(), identified by the stack trace. Determine how the invalid STAT= specifier is handled and ensure compilation no longer aborts; add or update a regression test if the surrounding test structure identifies a suitable location.

Written by the indexing model from the issue text.

Assessment

Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.