Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
cmd/compile: incorrect code generation bug when taking slice[:0] #29502
What version of Go are you using (
@FiloSottile how come we've marked this freshly opened bug for Go1.12 yet it also exists for Go1.11 but also when Go1.12 is just about to be released(at least according to the schedule)? Perhaps we can mark this for backport?
I've bisected this to bdc7d56 on the 1.11 branch.
Before the prove pass, we have
where b10 will panic. v10 is constant 0, and v56 is the slice len, which is
i.e. v45 = v31 + 1. This looks correct.
The prove pass derives that v70 (Geq64) is false, therefore unconditionally goes to the panic block.
The prove pass' debug output is below, which looks ok to me until the last line.
I'm not familiar enough with the prove code to tell where it actually does wrong. The "disprove" seems to come from an unsatisfiable condition v63 >= v45, where
So it seems something related to overflow...
…erflow in prove pass In the case of x+d >= w, where d and w are constants, we are deriving x is within the bound of min=w-d and max=maxInt-d. When there is an overflow (min >= max), we know only one of x >= min or x <= max is true, and we derive this by excluding the other. When excluding x >= min, we did not consider the equal case, so we could incorrectly derive x <= max when x == min. Updates #29502. Fixes #29503. Change-Id: Ia9f7d814264b1a3ddf78f52e2ce23377450e6e8a Reviewed-on: https://go-review.googlesource.com/c/156019 Reviewed-by: David Chase <firstname.lastname@example.org> (cherry picked from commit 2e217fa) Reviewed-on: https://go-review.googlesource.com/c/163724 Run-TryBot: Cherry Zhang <email@example.com> Reviewed-by: Brad Fitzpatrick <firstname.lastname@example.org> TryBot-Result: Gobot Gobot <email@example.com>