runtime/coverage: slice bounds out of range in (*emitState).VisitFuncs

[bcmills]

#!watchflakes
post <- log ~ `panic: runtime error: slice bounds out of range` && log ~ `\s*runtime/coverage\.\(\*emitState\)\.VisitFuncs`

(Pulled out from #55311 (comment).)

2023-02-27 19:43 linux-arm64-longtest go@002bc94e cmd/go.TestScript (log)

vcs-test.golang.org rerouted to http://127.0.0.1:40571
https://vcs-test.golang.org rerouted to https://127.0.0.1:44117
go test proxy running at GOPROXY=http://127.0.0.1:39707/mod
2023/02/27 20:09:52 http: TLS handshake error from 127.0.0.1:39140: read tcp 127.0.0.1:44117->127.0.0.1:39140: read: connection reset by peer
2023/02/27 20:09:52 http: TLS handshake error from 127.0.0.1:39110: EOF
2023/02/27 20:09:52 http: TLS handshake error from 127.0.0.1:39170: EOF
2023/02/27 20:09:55 http: TLS handshake error from 127.0.0.1:51238: EOF
--- FAIL: TestScript (0.07s)
    --- FAIL: TestScript/cover_pkgall_imports (5.98s)
        script_test.go:134: 2023-02-27T20:10:24Z
...
            panic: runtime error: slice bounds out of range [:4294970564] with capacity 28534

            goroutine 1 [running]:
            panic({0x1ca960?, 0x40000160f0?})
            	/tmp/workdir/go/src/runtime/panic.go:1015 +0x5cc fp=0x40000cb330 sp=0x40000cb280 pc=0x7206c
            runtime.goPanicSliceAcap(0x100000cc4, 0x6f76)
            	/tmp/workdir/go/src/runtime/panic.go:139 +0xa8 fp=0x40000cb370 sp=0x40000cb330 pc=0x6f118
            runtime/coverage.(*emitState).VisitFuncs(0x40000aa140, 0x4000028770)
            	/tmp/workdir/go/src/runtime/coverage/emit.go:541 +0x698 fp=0x40000cb4b0 sp=0x40000cb370 pc=0x162c98
            internal/coverage/encodecounter.(*CoverageDataWriter).writeCounters(0x40000789c0, {0x20e438, 0x40000aa140})
...
            testing.(*M).Run.func4()
            	/tmp/workdir/go/src/testing/testing.go:1901 +0x28 fp=0x40000cbc90 sp=0x40000cbc70 pc=0x17da78
            testing.(*M).Run(0x40000aa0a0)
            	/tmp/workdir/go/src/testing/testing.go:1948 +0xe70 fp=0x40000cbee0 sp=0x40000cbc90 pc=0x17d770
            main.main()
            	_testmain.go:78 +0x1f0 fp=0x40000cbf70 sp=0x40000cbee0 pc=0x19b620
            runtime.main()
            	/tmp/workdir/go/src/runtime/proc.go:250 +0x398 fp=0x40000cbfd0 sp=0x40000cbf70 pc=0x76628
            runtime.goexit()
            	/tmp/workdir/go/src/runtime/asm_arm64.s:1172 +0x4 fp=0x40000cbfd0 sp=0x40000cbfd0 pc=0xcd644

I feel like this might already have a fix CL, but I can't seem to find it..?

(attn @thanm)

[thanm]

Thanks, I will take a look.

[mknyszek]

Hey @thanm, doing a sweep over all Go 1.21 issues. Any updates here? Is this resolved? Thanks.

[thanm]

This is still unresolved as far as I know. Thanks.

[winglq]

Hi,
We've met the slice out of range issue in our code.
I did some analysis on this. The coverage data is stored at 0x163c2fa as following, it's not 4bytes aligened.

root@perf-dev:~/lq/jfs/cmd/meta# objdump -x meta.test |grep covctrs
000000000163c2fa l     O .noptrbss      0000000000000000              runtime.covctrs
0000000001650408 l     O .noptrbss      0000000000000000              runtime.ecovctrs

I watched the address of the value which leads to out of range using gdb and it was changed by the following assemble codes.

   0x0000000000a204d7 <+23>:    mov    %rax,0x70(%rsp)
   0x0000000000a204dc <+28>:    movl   $0x1,0xc1bf9a(%rip)        # 0x163c480 <jfs/cmd/meta.goCover_3af296631fdd__131>
=> 0x0000000000a204e6 <+38>:    mov    0xaea51c(%rip),%edx        # 0x150aa08 <jfs/cmd/meta.goCover_3af296631fdd_P>

address 0x163c480 is 4byte aligned, this is not correct as the slice starts from an unaligned address and each elment is 4 bytes length, but we got an address aligned element.
Currently I did not found out which code leads to the issue, hope this could provide some information to you.

[winglq]

After some investigating I found the unalignment is due to a global buffer which is not 4byte aligned in code.