#1265 cobc segfault: EVALUATE with a condition-name subject and a relation-condition object
Versions: GnuCOBOL 3.2.0 (Ubuntu gnucobol3 3.2-4build1) and 3.3-dev r5751 (CI snapshot 3.3-dev.138 of 2026-10-29), x86_64 Linux. Both re-run 2026-10-30.
Attached: evcb.cob (legal program, crashes) and evcg.cob (invalid program, accepted by -fsyntax-only, then crashes).
evcb.cob:
IDENTIFICATION DIVISION.
PROGRAM-ID. EVCB.
DATA DIVISION.
WORKING-STORAGE SECTION.
01 N PIC 9 VALUE 1.
88 IS-ONE VALUE 1.
88 IS-TWO VALUE 2.
PROCEDURE DIVISION.
EVALUATE IS-TWO
WHEN N = 2 DISPLAY "MATCH"
WHEN OTHER DISPLAY "NO MATCH"
END-EVALUATE
STOP RUN.
1. evcb.cob crashes the compiler
3.2.0, cobc -std=cobol2014 -fformat=free -x evcb.cob, exit 139:
unknown (signal)
cobc: aborting compile of evcb.cob at line 12 (PROGRAM-ID: EVCB)
cobc: Please report this!
Segmentation fault
The same output and exit 139 with -fsyntax-only in place of -x, and with the default dialect (no -std).
3.3-dev r5751, the same command, exit 139:
attempt to reference invalid memory address (signal SIGSEGV)
cobc: aborting compile of evcb.cob at line 12 (PROGRAM-ID: EVCB)
cobc: Please report this!
Segmentation fault
Again the same with -fsyntax-only and with the default dialect.
2. evcg.cob passes the syntax check, then crashes in codegen
evcg.cob is evcb.cob with line 10 changed to WHEN N DISPLAY "MATCH" (and PROGRAM-ID EVCG).
cobc -std=cobol2014 -fformat=free -fsyntax-only evcg.cob: no output, exit 0, on both versions.
3.2.0, cobc -std=cobol2014 -fformat=free -x evcg.cob, exit 139:
unknown (signal)
cobc: aborting codegen for evcg.cob, last statement at line 9 (PROGRAM-ID: EVCG)
cobc: Please report this!
Segmentation fault
3.3-dev r5751, the same command, exit 139:
attempt to reference invalid memory address (signal SIGSEGV)
cobc: aborting codegen for evcg.cob, last statement at line 9 (PROGRAM-ID: EVCG)
cobc: Please report this!
Segmentation fault
Expected
evcb.cob is legal and prints MATCH: IS-TWO is false (N is 1) and N = 2 is false, so the truth values match. ISO/IEC 1989:2023 (the same rules are in the 2014 and 2002 editions):
- §14.9.13.3 syntax rule 7 b): "Condition-2 or the words TRUE or FALSE appearing as a selection object shall correspond to condition-1 or the words TRUE or FALSE in the set of selection subjects."
- §14.9.13.3 syntax rule 10 and Table 15 (combination of operands in the EVALUATE statement): a Condition object with a Condition subject is "Y".
- §14.9.13.4 general rule 3 e): "Any selection subject specified by condition-1 is assigned a truth value according to the rules for evaluating conditional expressions."
- §14.9.13.4 general rule 4 a) 3.: "If the truth value of the selection subject and selection object match, the result of the analysis is true."
evcg.cob is an invalid combination (Table 15, row "[NOT] identifier", is blank under "Condition"; syntax rule 7 a)), so it should get a diagnostic instead of a crash.
Where we think the fix belongs
evaluate_test in cobc/typeck.c: for a subject that is not TRUE or FALSE and an object that is not a level-88 reference, it builds the regular comparison subject = object, which passes the level-88 subject to the comparison as a value operand. A condition-name subject should be classified as a condition (compare truth values with a condition object), and a value object paired with it refused per Table 15. We had no debugger available, so the crash frame was not captured; the location is inferred from the source and from cobc's own abort messages.
Related: #15 fixed an earlier EVALUATE segfault with an identifier subject and a level-88 object. This is the reverse combination, which that check does not cover.
