x/exp/shiny: fatal error: found bad pointer in Go heap (darwin/amd64/gldriver)

[jnjackins]

What version of Go are you using (go version)?

Tested on 1.7.3, and on tip:
go version devel +b21743c Thu Nov 17 20:53:01 2016 +0000 darwin/amd64

What operating system and processor architecture are you using (go env)?

OS X El Capitan 10.11.6

go env
GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/jnj"
GORACE=""
GOROOT="/Users/jnj/src/go"
GOTOOLDIR="/Users/jnj/src/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/jd/y9ctzjjx7278y6_lvtvgtb0m0000gn/T/go-build268919578=/tmp/go-build -gno-record-gcc-switches -fno-common"
CXX="clang++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

What did you do?

I was running into this issue with some window resize handling code, but this crash seems to be related to allocating textures and buffers. Here is a minimal reproducer (if I remove any of the NewBuffer or NewTexture calls, or remove win.Publish(), the program exits successfully).

https://play.golang.org/p/vsmjMKZ0-H

What did you expect to see?

Either the program successfully exits, or prints a reasonable error message.

What did you see instead?

On Go 1.7.3, the program prints "published" and then hangs indefinitely. On tip, the program prints "published" and then crashes:

published
runtime: pointer 0xc420049ea0 to unallocated span idx=0x24 span.base()=0xc420044000 span.limit=0x0 span.state=3
runtime: found in object at *(0xc420035e70+0x8)
object=0xc420035e70 k=0x621001a s.base()=0xc420034000 s.limit=0x0 s.sizeclass=0 s.elemsize=0 s.state=_MSpanStack
 *(object+0) = 0x40b74c0
 *(object+8) = 0xc420049ea0 <==
fatal error: found bad pointer in Go heap (incorrect use of unsafe or cgo?)

runtime stack:
runtime.throw(0x40fe5f4, 0x3e)
	/Users/jnj/src/go/src/runtime/panic.go:596 +0x95
runtime.heapBitsForObject(0xc420049ea0, 0xc420035e70, 0x8, 0x417bba0, 0x0, 0x700000209748, 0x4043b39, 0x4111858)
	/Users/jnj/src/go/src/runtime/mbitmap.go:433 +0x2bb
runtime.scanblock(0xc420035e70, 0x18, 0x4100866, 0xc42001f828)
	/Users/jnj/src/go/src/runtime/mgcmark.go:1192 +0xea
runtime.scanframeworker(0x700000209a68, 0x700000209b58, 0xc42001f828)
	/Users/jnj/src/go/src/runtime/mgcmark.go:917 +0xfc
runtime.scanstack.func1(0x700000209a68, 0x0, 0x700000209901)
	/Users/jnj/src/go/src/runtime/mgcmark.go:811 +0x6e
runtime.gentraceback(0xffffffffffffffff, 0xc420035e30, 0x0, 0xc4200001a0, 0x0, 0x0, 0x7fffffff, 0x700000209c58, 0x0, 0x0, ...)
	/Users/jnj/src/go/src/runtime/traceback.go:378 +0x1085
runtime.scanstack(0xc4200001a0, 0xc42001f828)
	/Users/jnj/src/go/src/runtime/mgcmark.go:834 +0x265
runtime.scang(0xc4200001a0, 0xc42001f828)
	/Users/jnj/src/go/src/runtime/proc.go:851 +0x209
runtime.markroot.func1()
	/Users/jnj/src/go/src/runtime/mgcmark.go:256 +0x6d
runtime.systemstack(0x700000209d90)
	/Users/jnj/src/go/src/runtime/asm_amd64.s:330 +0xab
runtime.markroot(0xc42001f828, 0x5)
	/Users/jnj/src/go/src/runtime/mgcmark.go:261 +0x1d5
runtime.gcDrainN(0xc42001f828, 0x10000, 0x402e558)
	/Users/jnj/src/go/src/runtime/mgcmark.go:1139 +0xee
runtime.gcAssistAlloc1(0xc420001ba0, 0x10000)
	/Users/jnj/src/go/src/runtime/mgcmark.go:537 +0x127
runtime.gcAssistAlloc.func1()
	/Users/jnj/src/go/src/runtime/mgcmark.go:451 +0x33
runtime.systemstack(0xc42001e600)
	/Users/jnj/src/go/src/runtime/asm_amd64.s:314 +0x79
runtime.mstart()
	/Users/jnj/src/go/src/runtime/proc.go:1102

goroutine 5 [GC assist marking]:
runtime.systemstack_switch()
	/Users/jnj/src/go/src/runtime/asm_amd64.s:268 fp=0xc420039d58 sp=0xc420039d50
runtime.gcAssistAlloc(0xc420001ba0)
	/Users/jnj/src/go/src/runtime/mgcmark.go:454 +0x13b fp=0xc420039d98 sp=0xc420039d58
runtime.mallocgc(0x68, 0x40e1f60, 0xc420396001, 0xa)
	/Users/jnj/src/go/src/runtime/malloc.go:577 +0x9ca fp=0xc420039e38 sp=0xc420039d98
runtime.newobject(0x40e1f60, 0x300000)
	/Users/jnj/src/go/src/runtime/malloc.go:801 +0x38 fp=0xc420039e68 sp=0xc420039e38
golang.org/x/exp/shiny/driver/gldriver.(*screenImpl).NewBuffer(0x418d7e0, 0x400, 0x300, 0xa, 0x0, 0x0, 0x0)
	/Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/screen.go:47 +0xe5 fp=0xc420039ef8 sp=0xc420039e68
main.main.func1(0x4177a00, 0x418d7e0)
	/Users/jnj/tmp/main.go:48 +0x3e4 fp=0xc420039fc0 sp=0xc420039ef8
golang.org/x/exp/shiny/driver/gldriver.driverStarted.func1()
	/Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/cocoa.go:105 +0x40 fp=0xc420039fe0 sp=0xc420039fc0
runtime.goexit()
	/Users/jnj/src/go/src/runtime/asm_amd64.s:2184 +0x1 fp=0xc420039fe8 sp=0xc420039fe0
created by golang.org/x/exp/shiny/driver/gldriver.driverStarted
	/Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/cocoa.go:107 +0x35

goroutine 1 [syscall (scan), locked to thread]:
golang.org/x/exp/shiny/driver/gldriver._Cfunc_startDriver()
	golang.org/x/exp/shiny/driver/gldriver/_obj/_cgo_gotypes.go:281 +0x41
golang.org/x/exp/shiny/driver/gldriver.main(0x40fefe8, 0x0, 0xc420049f68)
	/Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/cocoa.go:98 +0x51
golang.org/x/exp/shiny/driver/gldriver.Main(0x40fefe8)
	/Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/gldriver.go:26 +0x2f
golang.org/x/exp/shiny/driver.main(0x40fefe8)
	/Users/jnj/src/golang.org/x/exp/shiny/driver/driver_darwin.go:15 +0x2b
golang.org/x/exp/shiny/driver.Main(0x40fefe8)
	/Users/jnj/src/golang.org/x/exp/shiny/driver/driver.go:24 +0x2b
main.main()
	/Users/jnj/tmp/main.go:52 +0x2d

goroutine 17 [syscall, locked to thread]:
runtime.goexit()
	/Users/jnj/src/go/src/runtime/asm_amd64.s:2184 +0x1

goroutine 6 [select, locked to thread]:
golang.org/x/exp/shiny/driver/gldriver.drawLoop(0xc420080000, 0x1)
	/Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/cocoa.go:153 +0x2b9
created by golang.org/x/exp/shiny/driver/gldriver.preparedOpenGL
	/Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/cocoa.go:83 +0xf4
exit status 2

[jnjackins]

shiny version:

commit 03962049e143533dbf9467cffb8a52a15595b718
Author: Nigel Tao <nigeltao@golang.org>
Date:   Sun Nov 6 17:20:55 2016 +1100

[randall77]

Maybe a dup of #17785 ?
It has the same "scanning a stack span as if it were a 16-byte object span" signature.

[jnjackins]

I think it's important to note that this issue has been going on for at least a year, only recently it started crashing rather than hanging forever. I just tried with go1.5:

(I sent SIGQUIT after a few seconds)

$ go version
go version go1.5 darwin/amd64
$ go run main.go 
published
^\SIGQUIT: quit
PC=0x405c80b m=0
signal arrived during cgo execution

goroutine 1 [chan receive, locked to thread]:
runtime.mach_semaphore_wait(0x1203, 0xa113, 0xc800000000, 0x4014be2, 0x4010f3f, 0x4257f60, 0x404f819, 0xffffffffffffffff, 0xc82002f200, 0x7fff5fbfbbfc, ...)
    /Users/jnj/src/go/src/runtime/sys_darwin_amd64.s:407 +0xb fp=0x7fff5fbfbb90 sp=0x7fff5fbfbb88
runtime.semasleep1(0xffffffffffffffff, 0xc82002f200)
    /Users/jnj/src/go/src/runtime/os1_darwin.go:385 +0xe5 fp=0x7fff5fbfbbc8 sp=0x7fff5fbfbb90
runtime.semasleep.func1()
    /Users/jnj/src/go/src/runtime/os1_darwin.go:401 +0x29 fp=0x7fff5fbfbbe8 sp=0x7fff5fbfbbc8
runtime.systemstack(0x7fff5fbfbc00)
    /Users/jnj/src/go/src/runtime/asm_amd64.s:278 +0xab fp=0x7fff5fbfbbf0 sp=0x7fff5fbfbbe8
runtime.semasleep(0xffffffffffffffff, 0x0)
    /Users/jnj/src/go/src/runtime/os1_darwin.go:402 +0x36 fp=0x7fff5fbfbc20 sp=0x7fff5fbfbbf0
runtime.notesleep(0x42583b0)
    /Users/jnj/src/go/src/runtime/lock_sema.go:169 +0x100 fp=0x7fff5fbfbc50 sp=0x7fff5fbfbc20
runtime.stoplockedm()
    /Users/jnj/src/go/src/runtime/proc1.go:1268 +0xae fp=0x7fff5fbfbc70 sp=0x7fff5fbfbc50
runtime.schedule()
    /Users/jnj/src/go/src/runtime/proc1.go:1590 +0x6e fp=0x7fff5fbfbca8 sp=0x7fff5fbfbc70
runtime.park_m(0xc820000180)
    /Users/jnj/src/go/src/runtime/proc1.go:1698 +0x18b fp=0x7fff5fbfbcd0 sp=0x7fff5fbfbca8
runtime.mcall(0x405aa2a)
    /Users/jnj/src/go/src/runtime/asm_amd64.s:204 +0x5b fp=0x7fff5fbfbce0 sp=0x7fff5fbfbcd0

goroutine 17 [syscall, locked to thread]:
runtime.goexit()
    /Users/jnj/src/go/src/runtime/asm_amd64.s:1696 +0x1

goroutine 6 [select, locked to thread]:
golang.org/x/exp/shiny/driver/gldriver.drawLoop(0xc82007a000, 0x1)
    /Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/cocoa.go:153 +0x481
created by golang.org/x/exp/shiny/driver/gldriver.preparedOpenGL
    /Users/jnj/src/golang.org/x/exp/shiny/driver/gldriver/cocoa.go:83 +0x117

rax    0xe
rbx    0x1203
rcx    0x7fff5fbfbb88
rdx    0x7fff5fbfbc00
rdi    0x1203
rsi    0x4257f60
rbp    0x42582a0
rsp    0x7fff5fbfbb88
r8     0x42582a0
r9     0x38
r10    0x0
r11    0x286
r12    0x20
r13    0x41c18f6
r14    0xfffffff
r15    0x38
rip    0x405c80b
rflags 0x286
cs     0x7
fs     0x0
gs     0x0
exit status 2