cmd/pprof: nil pointer dereference when reading memory profiles

[mewmew]

go tool pprof works just fine with CPU profiles, but crashes for memory profiles with a nil pointer dereference.

$ go version
go version devel +0c8fe34 Tue Apr 7 17:48:03 2015 +0000 linux/amd64

$ go get github.com/llir/llvm/asm/lexer
$ go test -run=NONE -bench=. -cpuprofile=lexer.prof -memprofile=lexer.mprof github.com/llir/llvm/asm/lexer
$ go tool pprof lexer.test lexer.prof
Entering interactive mode (type "help" for commands)
(pprof) top5
1300ms of 2040ms total (63.73%)
Dropped 11 nodes (cum <= 10.20ms)
Showing top 5 nodes out of 36 (cum >= 840ms)
      flat  flat%   sum%        cum   cum%
     390ms 19.12% 19.12%      390ms 19.12%  runtime.indexbytebody
     360ms 17.65% 36.76%     1150ms 56.37%  github.com/llir/llvm/asm/lexer.lexLetter
     220ms 10.78% 47.55%      380ms 18.63%  github.com/llir/llvm/asm/lexer.(*lexer).next
     200ms  9.80% 57.35%      200ms  9.80%  runtime.memeqbody
     130ms  6.37% 63.73%      840ms 41.18%  github.com/llir/llvm/asm/lexer.(*lexer).accept
$ go tool pprof lexer.test lexer.mprof
panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x8 pc=0x486a1a]

goroutine 1 [running]:
regexp.(*bitState).reset(0x0, 0xc, 0x12, 0x0)
    /home/u/go/src/regexp/backtrack.go:70 +0x2a
regexp.(*machine).backtrack(0xc2080fcd80, 0x7f9b04fc2c38, 0xc2080fce58, 0x0, 0xc, 0x0, 0x2)
    /home/u/go/src/regexp/backtrack.go:314 +0x117
regexp.(*Regexp).doExecute(0xc2080f0aa0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc2081f2320, 0xc, 0x0, 0x0, ...)
    /home/u/go/src/regexp/exec.go:449 +0x413
regexp.(*Regexp).MatchString(0xc2080f0aa0, 0xc2081f2320, 0xc, 0xc208263980)
    /home/u/go/src/regexp/regexp.go:400 +0x6e
cmd/pprof/internal/profile.(*Profile).Prune(0xc2080822a0, 0xc2080f0aa0, 0xc2080f0be0)
    /home/u/go/src/cmd/pprof/internal/profile/prune.go:30 +0x23a
cmd/pprof/internal/profile.(*Profile).RemoveUninteresting(0xc2080822a0, 0x0, 0x0)
    /home/u/go/src/cmd/pprof/internal/profile/prune.go:94 +0x479
cmd/pprof/internal/driver.PProf(0x7f9b04fc2790, 0xb87390, 0x9e25c8, 0x9e2bb8, 0x7f9b04fc2750, 0xc2080f6670, 0x7f9b04fc2708, 0xc208026150, 0x0, 0x0, ...)
    /home/u/go/src/cmd/pprof/internal/driver/driver.go:110 +0x998
main.main()
    /home/u/go/src/cmd/pprof/pprof.go:28 +0x250

goroutine 17 [syscall, locked to thread]:
runtime.goexit()
    /home/u/go/src/runtime/asm_amd64.s:1671 +0x1

[dspezia]

I cannot reproduce with tip anymore.

Here is the recent history of the regexp package:

 +485f348 Michael Matloob 2015-04-17 17:10:07 +0000 regexp: set b.cap[0] and b.cap[1] only when captures requested
 +a513088 Matthew Brennan 2015-04-09 09:38:23 +0000 regexp: skip backtracker for long programs
 +fc9a234 Brad Fitzpatrick 2015-03-23 19:17:52 +0000 regexp: fix link to RE2 syntax
 +9323862 Michael Matloob 2015-03-23 16:17:42 +0000 regexp: port RE2's bitstate backtracker to the regexp package

It appears the OP demonstrated the issue between the introduction of the RE2's bitstate backtracker, and the corresponding later fixes.

I have checked that the problem can be reproduced by using version +0c8fe34 (the one used by the OP), and not anymore by using version +a513088 (the one including Matthew Brennan's fix).

So, I believe the problem is already fixed, and this issue can be closed.

[bradfitz]

This might have been https://go-review.googlesource.com/#/c/2571/