[flang] flang crashes with CHECK(IsVariable(v)) failed in CoarrayRef::set_stat() on invalid STAT= specifier in coindexed reference
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
The following code:
```fortran
subroutine s1()
rVar1 = rCoarray[1,2,3,STAT=MASK(2)]
end subroutine s1
```
Resulted in this output:
```
fatal internal error: CHECK(IsVariable(v)) failed at flang/lib/Evaluate/variable.cpp(101)
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /usr/lib/llvm-22/bin/flang -fc1 -triple x86_64-pc-linux-gnu -emit-obj -mrelocation-model pic -pic-level 2 -pic-is-pie -target-cpu x86-64 -resource-dir /usr/lib/llvm-22/lib/clang/22 -mframe-pointer=all -o /tmp/test-5ec3b6.o -x f95 /tmp/test.f90
#0 0x00007ff4edcc9d5f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-22/lib/libLLVM.so.22.1+0x4dc7d5f)
#1 0x00007ff4edcc75d7 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-22/lib/libLLVM.so.22.1+0x4dc55d7)
#2 0x00007ff4edccab2a (/usr/lib/llvm-22/lib/libLLVM.so.22.1+0x4dc8b2a)
#3 0x00007ff4e899e330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x00007ff4e89f7b2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#5 0x00007ff4e899e27e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#6 0x00007ff4e89818ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#7 0x0000556bec9ed61c (/usr/lib/llvm-22/bin/flang+0x2b2061c)
#8 0x0000556bec69fc05 Fortran::evaluate::CoarrayRef::set_stat(Fortran::evaluate::Expr>&&) (/usr/lib/llvm-22/bin/flang+0x27d2c05)
#9 0x0000556beb0f6337 Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::CoindexedNamedObject const&) (/usr/lib/llvm-22/bin/flang+0x1229337)
#10 0x0000556beb0ed2fc Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::Designator const&) (/usr/lib/llvm-22/bin/flang+0x12202fc)
#11 0x0000556beb1695b5 (/usr/lib/llvm-22/bin/flang+0x129c5b5)
#12 0x0000556beb10b1f8 std::optional> Fortran::evaluate::ExpressionAnalyzer::ExprOrVariable(Fortran::parser::Expr const&, Fortran::parser::CharBlock) (/usr/lib/llvm-22/bin/flang+0x123e1f8)
#13 0x0000556beb10adb5 Fortran::evaluate::ExpressionAnalyzer::IterativelyAnalyzeSubexpressions(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x123ddb5)
#14 0x0000556beb0f0f93 Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x1223f93)
#15 0x0000556beb113225 Fortran::evaluate::ArgumentAnalyzer::AnalyzeExprOrWholeAssumedSizeArray(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x1246225)
#16 0x0000556beb112bc0 Fortran::evaluate::ArgumentAnalyzer::AnalyzeExpr(Fortran::parser::Expr const&) (/usr/lib/llvm-22/bin/flang+0x1245bc0)
#17 0x0000556beb1044a3 (/usr/lib/llvm-22/bin/flang+0x12374a3)
#18 0x0000556beb103cdf Fortran::evaluate::ExpressionAnalyzer::Analyze(Fortran::parser::AssignmentStmt const&) (/usr/lib/llvm-22/bin/flang+0x1236cdf)
#19 0x0000556beb12463c (/usr/lib/llvm-22/bin/flang+0x125763c)
#20 0x0000556beb11a426 (/usr/lib/llvm-22/bin/flang+0x124d426)
#21 0x0000556beb116c7e (/usr/lib/llvm-22/bin/flang+0x1249c7e)
#22 0x0000556beb172a75 (/usr/lib/llvm-22/bin/flang+0x12a5a75)
#23 0x0000556beb1143b7 Fortran::semantics::ExprChecker::Walk(Fortran::parser::Program const&) (/usr/lib/llvm-22/bin/flang+0x12473b7)
#24 0x0000556beb348051 Fortran::semantics::Semantics::Perform() (/usr/lib/llvm-22/bin/flang+0x147b051)
#25 0x0000556beaa9791e Fortran::frontend::FrontendAction::runSemanticChecks() (/usr/lib/llvm-22/bin/flang+0xbca91e)
#26 0x0000556beaa9c7da Fortran::frontend::CodeGenAction::beginSourceFileAction() (/usr/lib/llvm-22/bin/flang+0xbcf7da)
#27 0x0000556beaa96f9e Fortran::frontend::FrontendAction::beginSourceFile(Fortran::frontend::CompilerInstance&, Fortran::frontend::FrontendInputFile const&) (/usr/lib/llvm-22/bin/flang+0xbc9f9e)
#28 0x0000556beaa7ee7f Fortran::frontend::CompilerInstance::executeAction(Fortran::frontend::FrontendAction&) (/usr/lib/llvm-22/bin/flang+0xbb1e7f)
#29 0x0000556beaa9bba0 Fortran::frontend::executeCompilerInvocation(Fortran::frontend::CompilerInstance*) (/usr/lib/llvm-22/bin/flang+0xbceba0)
#30 0x0000556beaa7cd34 fc1_main(llvm::ArrayRef, char const*) (/usr/lib/llvm-22/bin/flang+0xbafd34)
#31 0x0000556beaa7bfa4 main (/usr/lib/llvm-22/bin/flang+0xbaefa4)
#32 0x00007ff4e89831ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#33 0x00007ff4e898328b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#34 0x0000556beaa7af45 _start (/usr/lib/llvm-22/bin/flang+0xbadf45)
flang-22: error: unable to execute command: Aborted (core dumped)
flang-22: error: flang frontend command failed due to signal (use -v to see invocation)
Ubuntu flang version 22.1.8 (++20260613092238+e80beda6e255-1~exp1~20260613092253.78)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm-22/bin
flang-22: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
flang-22: note: diagnostic msg: /tmp/test-2abdd8
flang-22: note: diagnostic msg: /tmp/test-2abdd8.sh
flang-22: note: diagnostic msg:
********************
```
To reproduce:
```
flang ./test.f90
```
Compiler version:
```
Ubuntu flang version 22.1.8 (++20260613092238+e80beda6e255-1~exp1~20260613092253.78)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm-22/bin
```
*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*
Contributor guide
Research direction
Reproduce the crash with flang using the Fortran code in test.f90, then inspect flang/lib/Evaluate/variable.cpp and CoarrayRef::set_stat(), identified by the stack trace. Determine how the invalid STAT= specifier is handled and ensure compilation no longer aborts; add or update a regression test if the surrounding test structure identifies a suitable location.
Written by the indexing model from the issue text.
Assessment
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100