<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/135624>135624</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Use of Fortran TRANSFER intrinsic with argument of derived type containing allocatable causes double-free abort
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          krefson
      </td>
    </tr>
</table>

<pre>
    Passing a derived type as the first argument to the TRANSFER intrinsic is arguably a bug in the Fortran standard, but flang's handling of it is sub-optimal.  (Compiling without complaint, but causing run-rime memory issues).

````fortran
    program transfer_test
 type mytype
         real, allocatable, dimension(:) :: c
        end type mytype
        
        type(mytype) :: a, b

        allocate(a%c(8))
        
        b = transfer(a, b)

        write(*,*) 'Storage (as integer) of a = ', storage_size(a)/storage_size('a')
        write(*,*) 'Storage (as integer) of b = ', storage_size(b)/storage_size('a')
                
        print *, 'Allocation status(a,b)=', allocated(a%c),allocated(b%c)
        if( allocated(b%c)) deallocate(b%c)
        print *, 'Allocation status(a,b)=', allocated(a%c),allocated(b%c)
        if( allocated(a%c)) deallocate(a%c)
 end program transfer_test
````

Following the TRANSFER statement the allocatable in the **input** argument, a, becomes deallocated, and valgrind shows that the memory has been freed.

A slightly more comprehensive test program is [struct_xfer.f90](https://github.com/user-attachments/files/19736198/struct_xfer.f90.txt)

See also my [posting to fortran-lang](https://fortran-lang.discourse.group/t/transfer-of-type-with-ultimate-allocatable-component/9570)

Other compilers also show a variety of undefined behaviour. gfortran for example manages to produce a shallow copy of `mytype`, but also generates a double-free error.

I suggest at least issuing a warning to expect undefined run-time behaviour!
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzEVs1u4zYQfhr6MrAhU_6RDj54kwropS027TkYSSOJLUUKJGXHffpiKNlRFtlFgR4aKJZNDme--fuG6L1qDdFJ7L-I_fMKx9BZd_rLUeOtWZW2vp1-YyHTAkJNTl2ohnAbCNBD6Aga5XwAdO3YkwkQbFz9_ev5l5fip6-gTHDKeFWB8lEKS30DhHJsQZkoW1gXHBrwAU2NrhbyCcoxQKPRtEIePXRoas0QbAMqsCY_lms7BNWj3gAImT3ZflBR5qpCZ8cAle0HjcqEu74Kx-iHG83aqZ6gp966GyjvR_JC5huRnPk5JI-nmbCJ5AwAMDjbOuyBl3xD7jWQD7wXA9Lf-DWLxj9HqNk6am0rDFhq4p-16sl4ZY2QmUjPQubAr_QM1eI0mfoTvSLJFzJxQ2azxLsejD5P7txlZxAsj0LuKyGzTMicn-T8jd4SRPr8cHM6wQqj7ELu6lRUKORZyKf4mYOQx5dgHbbEiUHPNUAtq8k5gRh1C3lklX4SfPXq7xlYLmTxzaqQR4zy-X80Xf7AdPnvTMc4LXEMTpkAEwpWfZ7CrGws6DD6OXpRf_o8G78no37PRi7k03K5vC-_21KNkBl8KiRzqGmR4k9O_79I8XtIcXGaa_57TbZsy6kKC6u1vXJLf6AcdoYmMupo2Xt3wokhOCszjGH6-qCv6HAsdapsT36BNNISmhouqFunTA2-s1fmQJwMzWzSoYeSyEDjiOqZUs7gtWq7oG_QW0eRmxx1zAIXAnbw4bbyIPZffHBjFV7fGnKbJk_E_lnIrAth8JEwCiGLVoVuLDeV7YUsRk9ujSFg1bEfXsiiUZpZrdjmx_SwzbNY3B-0bsJbeLT0C3GsvIX-xgAG60OMrIWZA9eRjj8Bstzf1MpXdnSeNq2z4yBkEfh_zuXaNmumqjWT9HrUTOCB1oscrTk01sRcFPn-mDwA_ho6cjFySpPzE1jOASBc0CkKN-7x0dTUKEM1lNThRdnRbaCdMbIvQG_YD5qgR4MteXZxcLYeKwIE3zGYK1R2iOrEIZnZ9ZDcB0m03JIhh4E8z0U7MnTOOJBz1s1p_xn82LacXQygCX2Iw2Yapld0Zo4wvQ1UhQV0HlGBR9TDByG3q_qU1nma44pO2-Nud0iP2V6uulO6y_KyPGBW7ZojUiWbrJZETXmQ-90h263USSZyn-y2u22aHlO5OZaUN7TFfFsfS4ml2CXUo9IbrS_9xrp2FYfiaZvuD3K30liS9vGOIKWh6zQyhZR8ZXAnPrQux9aLXaKVD_5dTVBB0-kPTxzL-6D_5HLA9fB-ibDNx6tGZU1AFaO1bGce6Nyji-hjaV1YjU6fftAsjG5-rQdn_6SKi-1-DShmpy8n-U8AAAD__xqc48o">