runtime/pprof: fatal error: slice bounds out of range

[eliasnaur]

From the android/arm builder:

https://build.golang.org/log/a61b7f04a2f8c6d00424e7c606935f33a3cf57d6

fatal error: slice bounds out of range

goroutine 41 [running]:
runtime.throw(0xf714f1ee, 0x19)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/panic.go:608 +0x60 fp=0xc6cdff0c sp=0xc6cdfef8 pc=0xf6ff82f4
runtime.panicslice()
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/panic.go:51 +0x88 fp=0xc6cdff20 sp=0xc6cdff0c pc=0xf6ff6a8c
runtime.(*profBuf).read(0xc6896000, 0x0, 0x2, 0xc6cc8000, 0xc6d0c380, 0xf7017568, 0xf71fff34, 0xf731abf0, 0x11312)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/profbuf.go:507 +0x640 fp=0xc6cdff5c sp=0xc6cdff20 pc=0xf70084c0
runtime/pprof.readProfile(0x5f5e100, 0x0, 0x0, 0x1fff4, 0xc6ce4010, 0x0, 0x3ffa)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/cpuprof.go:205 +0x54 fp=0xc6cdffa4 sp=0xc6cdff5c pc=0xf6fd0124
runtime/pprof.profileWriter(0xf7200e10, 0xc6fec000)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/pprof/pprof.go:780 +0x60 fp=0xc6cdffe4 sp=0xc6cdffa4 pc=0xf71337dc
runtime.goexit()
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/asm_arm.s:871 +0x4 fp=0xc6cdffe4 sp=0xc6cdffe4 pc=0xf70289c0
created by runtime/pprof.StartCPUProfile
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/pprof/pprof.go:764 +0x110

goroutine 1 [chan receive]:
testing.(*T).Run(0xc68c00a0, 0xf714e0fb, 0x16, 0xf71fffd4, 0x1)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/testing/testing.go:886 +0x2fc
testing.runTests.func1(0xc68c0000)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/testing/testing.go:1126 +0x68
testing.tRunner(0xc68c0000, 0xc6841f00)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/testing/testing.go:834 +0xb8
testing.runTests(0xc680c200, 0xf7305f10, 0x18, 0x18, 0x40)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/testing/testing.go:1124 +0x278
testing.(*M).Run(0xc68b2b00, 0x0)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/testing/testing.go:1041 +0x154
main.main()
	_testmain.go:88 +0x16c

goroutine 39 [runnable]:
syscall.Syscall(0x37, 0x6, 0x4, 0x800, 0x0, 0x0, 0x0)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/syscall/asm_linux_arm.s:14 +0x8
syscall.fcntl(0x6, 0x4, 0x800, 0x0, 0x0, 0x0)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/syscall/zsyscall_linux_arm.go:418 +0x34
syscall.SetNonblock(0x6, 0xf7149e01, 0x4, 0x80001)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/syscall/exec_unix.go:108 +0x68
os.newFile(0x6, 0xf7149c6c, 0x2, 0x2, 0x0)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/os/file_unix.go:149 +0x14c
os.Pipe(0xc6e40010, 0x0, 0x0, 0xc6d0a3c0)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/os/pipe_linux.go:32 +0x9c
os/exec.(*Cmd).writerDescriptor(0xc6e3e000, 0xf7200e10, 0xc6e3c020, 0x0, 0xc6e40010, 0xe6b64600)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/os/exec/exec.go:280 +0x38
os/exec.(*Cmd).stdout(0xc6e3e000, 0x0, 0x0, 0x0)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/os/exec/exec.go:256 +0x2c
os/exec.(*Cmd).Start(0xc6e3e000, 0x1, 0xc6e3c020)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/os/exec/exec.go:381 +0xb4
os/exec.(*Cmd).Run(0xc6e3e000, 0xc6e3c020, 0xc6e3e000)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/os/exec/exec.go:315 +0x1c
os/exec.(*Cmd).CombinedOutput(0xc6e3e000, 0x31, 0xc6cddfa8, 0x1, 0x1, 0xc6e3e000)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/os/exec/exec.go:534 +0x104
runtime/pprof.TestCPUProfileWithFork(0xc68c00a0)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/runtime/pprof/pprof_test.go:346 +0x19c
testing.tRunner(0xc68c00a0, 0xf71fffd4)
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/testing/testing.go:834 +0xb8
created by testing.(*T).Run
	/private/var/folders/f6/d2bhfqss2716nxm8gkv1fmb80000gn/T/workdir-host-darwin-amd64-eliasnaur-android/go/src/testing/testing.go:885 +0x2dc

[mvdan]

I'm very confused by this panic. The code in question is:

if len(data) > numData {
        data = data[:numData]
} else {
        numData -= len(data) // available in case of wraparound
}

The arithmetic seems fine to me. Perhaps something is modifying the slice concurrently, meaning a race?

I'd imagine this is a bug in runtime, not runtime/pprof. Unless the latter messes with the runtime package somehow.

/cc @hyangah @heschik

[mvdan]

Another one, this time on linux-mipsle: https://build.golang.org/log/d3630cdce490ad62605eab9cedf237e667b5d43e

So it has nothing to do with Android nor ARM.

[mvdan]

More likely explanation - numData ends up being negative. Though that's likely not the root cause of all this.

[gopherbot]

Change https://golang.org/cl/138857 mentions this issue: runtime: log profile record buffer overflow/underflow

[rsc]

Duplicate of #24991.