<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/122002>122002</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [flang] stack-overflow in Fortran::evaluate::GetShapeHelper::CreateShape
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            flang
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          yype
      </td>
    </tr>
</table>

<pre>
    Hi there, flang crashes from a stack-overflow on the following test case:

```fortran
complex, parameter :: n(n)
end
```

Tested version(s): 19.1.0, trunk (ASAN build)

This test case can crash flang without the presence of ASAN: https://godbolt.org/z/GMz8xbf39


Partial ASAN dump:

<details>
<summary>Click me</summary>

```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: <path>/bin/flang -fc1 -triple x86_64-unknown-linux-gnu -emit-obj -mrelocation-model pic -pic-level 2 -pic-is-pie -target-cpu x86-64 -resource-dir <path>/lib/clang/20 -mframe-pointer=all -o /tmp/asan_crash2-188458.o -x f95-cpp-input /tmp/asan_crash2.f90
  #0 0x000055ef32c6c84b backtrace (<path>/bin/flang+0x2e6884b)
  #1 0x000055ef33e1c91d llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /repo/llvm-project-250107-trunk/llvm/lib/Support/Unix/Signals.inc:727:8
  #2 0x000055ef33e14e37 llvm::sys::RunSignalHandlers() /repo/llvm-project-250107-trunk/llvm/lib/Support/Signals.cpp:0:5
  #3 0x000055ef33e1e5e4 SignalHandler(int) /repo/llvm-project-250107-trunk/llvm/lib/Support/Unix/Signals.inc:0:3
  #4 0x00007f3113df5520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
  #5 0x000055ef32cb315b __asan_memset (<path>/bin/flang+0x2eaf15b)
  #6 0x000055ef3a56265f Fortran::evaluate::GetShapeHelper::CreateShape(int, Fortran::evaluate::NamedEntity&) const /repo/llvm-project-250107-trunk/flang/lib/Evaluate/shape.cpp:81:36
  ... manually truncated
#873 0x000055ef38d950c1 std::optional<std::vector<std::optional<Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>>, std::allocator<std::optional<Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>>>>> Fortran::evaluate::GetShape<Fortran::evaluate::Expr<Fortran::evaluate::SomeKind<(Fortran::common::TypeCategory)0>>>(Fortran::evaluate::FoldingContext&, Fortran::evaluate::Expr<Fortran::evaluate::SomeKind<(Fortran::common::TypeCategory)0>> const&, bool) /repo/llvm-project-250107-trunk/flang/include/flang/Evaluate/shape.h:250:12
#874 0x000055ef39596d47 std::optional<Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>> Fortran::evaluate::ApplyElementwise<Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)0>, Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, Fortran::evaluate::SomeKind<(Fortran::common::TypeCategory)0>>(Fortran::evaluate::FoldingContext&, Fortran::evaluate::Operation<Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)0>, Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, Fortran::evaluate::SomeKind<(Fortran::common::TypeCategory)0>>&, std::function<Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>> (Fortran::evaluate::Expr<Fortran::evaluate::SomeKind<(Fortran::common::TypeCategory)0>>&&)>&&) /repo/llvm-project-250107-trunk/flang/lib/Evaluate/fold-implementation.h:0:36
#875 0x000055ef3959660e ~_Function_base /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:243:11
#876 0x000055ef3959660e ApplyElementwise<Fortran::evaluate::Convert<Fortran::evaluate::Type<Fortran::common::TypeCategory::Integer, 8>, Fortran::common::TypeCategory::Integer>, Fortran::evaluate::Type<Fortran::common::TypeCategory::Integer, 8>, Fortran::evaluate::SomeKind<Fortran::common::TypeCategory::Integer> > /repo/llvm-project-250107-trunk/flang/lib/Evaluate/fold-implementation.h:1632:3
#877 0x000055ef3959660e Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>> Fortran::evaluate::FoldOperation<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)0>(Fortran::evaluate::FoldingContext&, Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)0>&&) /repo/llvm-project-250107-trunk/flang/lib/Evaluate/fold-implementation.h:1721:18
#878 0x000055ef3957b73c operator()<Fortran::evaluate::Convert<Fortran::evaluate::Type<Fortran::common::TypeCategory::Integer, 8>, Fortran::common::TypeCategory::Integer> > /repo/llvm-project-250107-trunk/flang/lib/Evaluate/fold-implementation.h:0:18
#879 0x000055ef3957b73c Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>> Fortran::common::log2visit::Log2VisitHelper<5ul, 8ul, Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::ExpressionBase<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>::Rewrite(Fortran::evaluate::FoldingContext&, Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>&&)::'lambda'(auto&&), std::variant<Fortran::evaluate::Parentheses<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Negate<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Add<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Subtract<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Multiply<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Divide<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Power<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Extremum<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)0>, Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)2>, Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)1>, Fortran::evaluate::ImpliedDoIndex, Fortran::evaluate::TypeParamInquiry, Fortran::evaluate::DescriptorInquiry, Fortran::evaluate::Constant<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::ArrayConstructor<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Designator<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::FunctionRef<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>>>(Fortran::evaluate::ExpressionBase<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>::Rewrite(Fortran::evaluate::FoldingContext&, Fortran::evaluate::Expr<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>&&)::'lambda'(auto&&)&&, unsigned long, std::variant<Fortran::evaluate::Parentheses<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Negate<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Add<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Subtract<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Multiply<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Divide<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Power<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Extremum<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)0>, Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)2>, Fortran::evaluate::Convert<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>, (Fortran::common::TypeCategory)1>, Fortran::evaluate::ImpliedDoIndex, Fortran::evaluate::TypeParamInquiry, Fortran::evaluate::DescriptorInquiry, Fortran::evaluate::Constant<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::ArrayConstructor<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::Designator<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>, Fortran::evaluate::FunctionRef<Fortran::evaluate::Type<(Fortran::common::TypeCategory)0, 8>>>&&) /repo/llvm-project-250107-trunk/flang/include/flang/Common/visit.h:46:7
AddressSanitizer:DEADLYSIGNAL
=================================================================
==592121==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe133f3b18 (pc 0x55ef32cb315b bp 0x7ffe133f4350 sp 0x7ffe133f3b20 T0)
    #0 0x55ef32cb315b (<path>/bin/flang-20+0x2eaf15b) (BuildId: b0badf8d95053aba610642d45dedc2818ec6eece)
    ... manually truncated

SUMMARY: AddressSanitizer: stack-overflow (<path>/bin/flang-20+0x2eaf15b) (BuildId: b0badf8d95053aba610642d45dedc2818ec6eece) 
==592121==ABORTING
flang-20: error: unable to execute command: Aborted
flang-20: error: flang frontend command failed due to signal (use -v to see invocation)
flang version 20.0.0git (https://github.com/llvm/llvm-project.git ac604b2fa6ff0344a555954069721c0db7b874f9)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: <path>/bin
Build config: +assertions, +asan
flang-20: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
flang-20: note: diagnostic msg: /tmp/asan_crash2-82ca71
flang-20: note: diagnostic msg: /tmp/asan_crash2-82ca71.sh
flang-20: note: diagnostic msg: 

********************

```
</details>

The test case was generated by a fuzzer.
</pre>

<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzsW11T27rW_jXiRuOMLH_EueDCBNIyLy0MsN8z-4qR7eVEu7LkI8kh6cX57WckJyShKdBSoD3DjKck7vLSo6VnfchZYsbwqQQ4RMkRSo4PWGdnSh8uly0cFKpaHn7k2M5AA6JjXAsmp7jUzMzA4FqrBjNsLCu_BGoOuhbqFivp5HGthFC3XE6xBWNxyQygKEfEXynpr1ppq5lEJC9V0wpYuEFaplkDFjR2D0Q5lohmEtERIjnIavv5Xt01GAsVnoM2XDlh44SjHIejQTggTqfVnfyCEc3yq_wzLjouql6he3zGzQYkLpnsZ7ia7S23M9VZP6lWgwFZAlY1dprcIDNrW-OQ0gmik6mqCiXsQOkpopOviE4-fPqaLYo6Wo2GSH7BtOVMeA246pp2Y5hoXIFlXBgUnfTfTdc0TC9RdDIWvPyCG0DRGNHJ5v49m7oBzk7yqxNsuqLhFjNcdFOsoVXaYqvuA-Z21hWDUjWIToSYr_8ErVb_QGkRnXBjOjCITjCTFeayFF0F3h69nQpWfrGalTBAJL9ybNiaFRkgMrrQaqpZg5medg1I64bHKBq3zM7cDOik4BLRSW_xoC5DHFjNWwF4kaU3aRx08otUtzIQXHaLYCo7HEDDbaCKf3DQaBCqZJYrGTSqAoFbXuKg5WUgYA4C0_4LN0HLAQeW6SnYoGw7pz5IYxxoMKrTJQQV17vIBC8QnZQOGaITSnDQ1I6gQau4tKBRdMyEwIHCiE5s0yI6YYbJG28bGoRZFifZQOFggetREpRtG3DZdnav-KAeuQXEGNGIYLIghJAkgTqiZVpmcbGxtSPz9yyI6BFZUEizLC56mnuF4bbCCMJyFFbYL7n3M7M0_YcLzaX163jtRkI02whpdnujjNXAGkRT51pcWkRHbjaOYvfYE9CEhGQYeP_bIpi36VXXOk4iOvlL8oW7waeSCTPgskRRPqRDFOXZGj29hz6GaLgP_WUnez0fmawEaOMM9VyAa2Rl62hNUJQna1zRPVyQQIx3ECCavZiRHJRoDSVeQRnWURhGVZ0klHierJWtnOnOifr_KAdGDVJPmpgmlGxRJtnlYBGFSYFvbjxjG2gM2CfwkNVhss3DdFspS1KaJjWerFKBX0OYM9ExC_23D2CvZqyFjyBa52_u3lgDs-Bvr807fkjHZ9ZAdSItt0vP2xEulTT2iSuyms3KiidrzXRiHIAVK7LQrUXqZzkYDHDDZMeEWPrkUzILPnXRKBvuUCarRgkpQ2xs1UNVrQtkTLjgv743h9IqvX1nS-qBaZ8sWv2wxPWy7TNKtiNUqqZRciMyZhamSi8RHfmEmrnF7i863mBnwgfi3xXq-noK256L9ko18H9cVj-KeGPX7AHtEyUqLqdjJS0s7CoUvx3e3ptWMAqlxNOj3dq3VnXF1p1v_GyGopwmLuSFdO1L8bYvjZJRWsXDvb70ttR7aG3ythXLEwGuMrrl5hHmjZWcg7Yvh5eO8Y8S4GHuPRPMi_nYL3Ww8xa0r0DfV--VVi_dyTx1J8vHzf_Snv6N7V83azibpH7zu_n83BKnVqIKuNudu_jkKe4DMVlXOz4MJ_fDcEoA_-dmslqVm8JtrRGddEbf1YiDwd1407LcX56G4Vrw3j-bdFEieuSvXrjg1u1Vja1u1pzoE0ccucQRrhGn-xC_XCh-2lL6O6fSwtRtG77jRU97-qmO_QuBfZfKPwUf9_70IuQN04iudk6eDMN9ZHjLOPJIZnpitnntRPIrE-pvmSlfOKaGQ-o2kWG25mW2y8thMYxKrPziK92_2PijQ9RL-jjZseRonyV_Gw_ffkioKZ1zw23_9UxN6f-7r-vXH-OkE15R_-ct9zWPDw_GcCWP2GOp9LkbLCdwCbeaO0q87sb5uTa8q9mcJKJDwZqiYogOEc1YZ9VGYrvenTPNmXzEsS-YBmlnYMC8IQ8-w9R_fjMAefVNEfKKo191hdWsfMFM9iiET52wvBXLN4RwzOe8eksSXKhbeNtoaDU0XfOGEH7LkupPQkz_OMTh44hPm1ZwqI7Vqaz6X-AfQX7BNGtO5b877oZ42OvBlJq3VumnyY-VNPbRtPayyUJrtvQ4dLf60eXNYiYYPpXsbUGsX-FcQv0KP888-vrsvaD8lQVlusLbSd8FVGGh3Cbrvc58rzPf68z3OvO9znyvM9_rzPc683-szvzJ1_jfdqiM-zHpxL-v9W-d4xRF-RARVwy4YvWKSW75V9-3dnySH5_9fXX64XN-5rt7j__4az2LZERDGvafTy4vzy9RlOM9JtjTLc56KUwWw7qGMIrqqAgzF3zaEpPFTuth0W6JxVFCsGl3HqQEX981MN610e7oeKBhMaDkXs-ikz7quKhOXT2MC1KwqvYte0nECpaGJI1pFScVVCXNwgzKFKCEDYLvdwKS_OqvT5_yy7-faKpXwo33rml-dH55ffr5AyL53YhRjkFr5bF2khUCsFUYFlB2FrDzRyb96HmhdD_pvc_2Xd-1djsoWa0fxDXjAipcdV6tj1DCTaszgIO5vweAuZyvWr97m_fKVmcBMCUDMiBT7ttUf6zxfeCeYmVK4oLWLK1rEsUxS5JklMQkHQ1pWJKqGBbZMK5H_djXvq_cTel7Xev-uIEGVmHfp-5EW2X4ApH81GUkIaA65npvezzJ_YLiUsmaT70IPWLGgHazN33CPmLGn6fYNrRUPnTiirOpVMbyEjemV0ByRJ9x9ccZ-tMG-fV1Pv6Irz-e4Mn52dn5v04_f8CT07OTK3x97m8f_fUBX55cnF9eI3804EJDq1UJxkCF-_b71eENf9CAGaNK7rwF607iPsHfCWjAvtUUKsxsr--Jc97XpZ_Rkg3DX6FjYGY_ZP5fsQI752H86ZDdUySOdLB1xOWWGTwFCdqbr1hihuvu61fQg4PqMKpG0YgdwGE4jFKaDeOIHMwORxkUJIvjlFSEDmlUEDqskyxiSVSNyjA-4IeU9HmTUhIlZDBKSJpVURUVNdBkFKGYQMO4GDgnGyg9PfDnSg5DSgmhB4IVIIw_hUTpKr9SlBwf6EPvlUU3NSgmghtrNiost8IfXeqfSI7vB00un9FZftBpcfjzx2VWM5sf0v8GAAD__5teSWo">