[flang][AIX] zero-sized array crash

[kkwli]

Reproducer

  integer, allocatable :: a(:)
  allocate(a(0))
  inquire(iolength=iol) a
end

$ flang-new zero.f90
$ ./a.out

fatal Fortran runtime error(/home/kli/zero.f90:3): Bad address for I/O item -- null base address or subscripts out of range
IOT/Abort trap (core dumped)

Original test: https://github.com/llvm/llvm-test-suite/blob/main/Fortran/gfortran/torture/execute/iolength_1.f90

[llvmbot]

@llvm/issue-subscribers-flang-runtime

Author: Kelvin Li (kkwli)

Reproducer ```fortran integer, allocatable :: a(:) allocate(a(0)) inquire(iolength=iol) a end ```

$ flang-new zero.f90
$ ./a.out

fatal Fortran runtime error(/home/kli/zero.f90:3): Bad address for I/O item -- null base address or subscripts out of range
IOT/Abort trap (core dumped)

Original test: https://github.com/llvm/llvm-test-suite/blob/main/Fortran/gfortran/torture/execute/iolength_1.f90

[llvmbot]

@llvm/issue-subscribers-bug

Author: Kelvin Li (kkwli)

Reproducer ```fortran integer, allocatable :: a(:) allocate(a(0)) inquire(iolength=iol) a end ```

$ flang-new zero.f90
$ ./a.out

fatal Fortran runtime error(/home/kli/zero.f90:3): Bad address for I/O item -- null base address or subscripts out of range
IOT/Abort trap (core dumped)

Original test: https://github.com/llvm/llvm-test-suite/blob/main/Fortran/gfortran/torture/execute/iolength_1.f90

[DanielCChen]

There is another variation that could be caused by the same issue.

program main
  real, allocatable :: a1(:)
  allocate( a1(2:1) )
  a1 = real(4, 8)
end

fatal Fortran runtime error(/home/cdchen/temp/b.f:4): Assign: mismatched ranks (1 != 0) in assignment to unallocated allocatable
IOT/Abort trap(coredump)

[DanielCChen]

Another variation

real, allocatable :: r1(:)
allocate(r1(1:0))
print*, allocated(r1)
end

flang-new -ffree-form t.f

a.out
F

Where XLF, ifort and gfortran all produce
T

[klausler]

Does AIX's malloc return a null pointer for a zero-byte allocation size? That would explain all of this behavior. If so, then the few places in the runtime that call std::malloc could be adjusted to allocate single bytes instead of zero bytes when that case comes up.

[kkwli]

Does AIX's malloc return a null pointer for a zero-byte allocation size? That would explain all of this behavior. If so, then the few places in the runtime that call std::malloc could be adjusted to allocate single bytes instead of zero bytes when that case comes up.

Yes, it looks like std::malloc(0) returns nullptr on AIX.

#include <cstdio>
#include <cstdlib>
int main() {
  printf("%d\n", std::malloc(0) == nullptr);
}

The code outputs 1 on AIX and 0 on Linux.

[klausler]

Thanks for checking. I think that you can fix this by altering the few code sites in the runtime that call std::malloc to allocate a single byte when the byte count is zero.

[kkwli]

Thanks for checking. I think that you can fix this by altering the few code sites in the runtime that call std::malloc to allocate a single byte when the byte count is zero.

Thanks for the suggestion.

[kkwli]

I dug out the investigation I did a while back. For this case, I think the problem is on the compiler side. The IR looks like:

define void @_QQmain() #0 {
  %1 = alloca { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] }, align 8
  %2 = alloca { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] }, align 8
  %3 = alloca i32, i64 1, align 4
  %4 = call ptr @malloc(i64 0)
  %5 = insertvalue { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] } { ptr undef, i64 ptrtoint (ptr getelementptr (i32, ptr null, i32 1) to i64), i32 20180515, i8 1, i8 9, i8 2, i8 0, [1 x [3 x i64]] [[3 x i64] [i64 1, i64 0, i64 ptrtoint (ptr getelementptr (i32, ptr null, i32 1) to i64)]] }, ptr %4, 0
  store { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] } %5, ptr %2, align 8
  %6 = load { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] }, ptr %2, align 8
  store { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] } %6, ptr @_QFEa, align 8
  %7 = call ptr @_FortranAioBeginInquireIoLength(ptr @_QQclXf46e0db4e0b10e4a726f3527d30f1e53, i32 3)
  %8 = load { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] }, ptr @_QFEa, align 8
  store { ptr, i64, i32, i8, i8, i8, i8, [1 x [3 x i64]] } %8, ptr %1, align 8
  %9 = call i1 @_FortranAioOutputDescriptor(ptr %7, ptr %1)
  %10 = call i64 @_FortranAioGetIoLength(ptr %7)
  %11 = trunc i64 %10 to i32
  store i32 %11, ptr %3, align 4
  %12 = call i32 @_FortranAioEndIoStatement(ptr %7)
  ret void
}

The malloc(0) returns NULL on AIX and hence the addr field in the descriptor is initialized accordingly. In ExtractElement, with p equal to zero, it gets into the error situation.

if (!p) {
  io.GetIoErrorHandler().Crash("Bad address for I/O item -- null base "
                                 "address or subscripts out of range");
}