bufio: panic in ReadSlice

[bradfitz]

Running an http stress program with lots of network timeouts, I saw this crash go by.

Line 260 is:

                // Search new part of buffer
                if i := bytes.IndexByte(b.buf[n:b.w], delim); i >= 0 {

panic: runtime error: slice bounds out of range

goroutine 1 [running]:
bufio.(*Reader).ReadSlice(0xf8403b9d20, 0x333100000000000a, 0x0, 0x0, 0x0, ...)
        /Users/bradfitz/go/src/pkg/bufio/bufio.go:260 +0x385
net/http.readLineBytes(0xf8403b9d20, 0x0, 0x0, 0x0, 0x0, ...)
        /Users/bradfitz/go/src/pkg/net/http/chunked.go:92 +0x50
net/http.readLine(0xf8403b9d20, 0x0, 0x0, 0x0, 0x0, ...)
        /Users/bradfitz/go/src/pkg/net/http/chunked.go:114 +0x49
net/http.(*chunkedReader).beginChunk(0xf8401bbe40, 0x1325c)
        /Users/bradfitz/go/src/pkg/net/http/chunked.go:47 +0x28
net/http.(*chunkedReader).Read(0xf8401bbe40, 0xf840086000, 0x2000, 0x2000, 0x1eda08, ...)
        /Users/bradfitz/go/src/pkg/net/http/chunked.go:65 +0x88
net/http.(*body).Read(0xf8401ff740, 0xf840086000, 0x2000, 0x2000, 0x30, ...)
        /Users/bradfitz/go/src/pkg/net/http/transfer.go:539 +0x8c
io/ioutil.devNull.ReadFrom(0x0, 0xf8400bd7e0, 0xf8401ff740, 0x0, 0x0, ...)
        /Users/bradfitz/go/src/pkg/io/ioutil/ioutil.go:137 +0x8f
io.Copy(0xf840071210, 0x0, 0xf8400bd7e0, 0xf8401ff740, 0x0, ...)
        /Users/bradfitz/go/src/pkg/io/io.go:352 +0xa2

[bradfitz]

Comment 1:

At first I thought this was the wrapped io.Reader returning something suspicious that
confused bufio, but I imagine this is just buggy concurrent access.

Owner changed to @bradfitz.

Status changed to Accepted.

[bradfitz]

Comment 2:

Can't reproduce, so I'm going to assume it was a race.

Status changed to Retracted.

[gopherbot]

Comment 3 by jgrahamc:

I have a case where I can reproduce this crash. In this case the caller of
bufio.ReadSlice is the memcached package but it's a similar problem. I get an out of
bounds error on line 260 of bufio.go.  Right now I get the crash in a very large program
under heavy load.  Will attempt to isolate a small test case.

[davecheney]

Comment 4:

I had a similar problem which was solved by
https://code.google.com/p/go/source/detail?r=cd3ad8805953999b6de7de7b3f043bd6bd1b4e32
Check that n in that bufio method is not negative.

[davecheney]

Comment 5:

Owner changed to @davecheney.

Status changed to WaitingForReply.

[rsc]

Comment 6:

Dave, that commit is about package http. Is that really the one you meant?

[davecheney]

Comment 7:

I'm sorry, I meant this change
https://code.google.com/p/go/source/detail?r=03a6b8c9c396b3de2c2c755362416b32ee875400.
The root cause was a call to an io.Reader was returning the values -1, err, resulting in
code like this
http://play.golang.org/p/9CVH1WDGxo

[rsc]

Comment 8:

This issue was closed by revision f0d9ccb.

Status changed to Fixed.