x/tools/gopls: impossible SEGV in regexp/syntax.MatchRunePos

[adonovan]

#!stacks
"sigpanic" && "MatchRunePos:+9"

Issue created by stacks.

Yet more corruption: either Inst.Rune is a corrupt slice (len + data are inconsistent), or SP is invalid, as there are only two instructions that can fail at this line:

func (i *Inst) MatchRunePos(r rune) int {
	rune := i.Rune

	switch len(rune) {
	case 0:
		return noMatch

	case 1:
		// Special case: single-rune slice is from literal string, not char class.
		r0 := rune[0] <--------- panic here
		if r == r0 {
			return 0
		}
		if Flags(i.Arg)&FoldCase != 0 {
                         --- possible panic while spilling r0 here ---
			for r1 := unicode.SimpleFold(r0); r1 != r0; r1 = unicode.SimpleFold(r1) {
				if r == r1 {
					return 0
				}
			}
		}

TEXT regexp/syntax.(*Inst).MatchRunePos(SB) /Users/adonovan/w/goroot/src/regexp/syntax/prog.go
  prog.go:204           0x10030ef70             f9400b90                MOVD 16(R28), R16                               
  prog.go:204           0x10030ef74             eb3063ff                CMP R16, RSP                                    
  prog.go:204           0x10030ef78             54001109                BLS 136(PC)                                     
  prog.go:204           0x10030ef7c             f81d0ffe                MOVD.W R30, -48(RSP)                            
  prog.go:204           0x10030ef80             f81f83fd                MOVD R29, -8(RSP)                               
  prog.go:204           0x10030ef84             d10023fd                SUB $8, RSP, R29                                
  prog.go:205           0x10030ef88             a9410c02                LDP 16(R0), (R2, R3)             load Inst.Rune data and len
  prog.go:207           0x10030ef8c             f100087f                CMP $2, R3                       switch len               
  prog.go:226           0x10030ef90             5400018d                BLE 12(PC)                       B case01
  ...
case1:  
  prog.go:213           0x10030efcc             b9800042                MOVW (R2), R2             here??     load rune[0] after len check
  prog.go:214           0x10030efd0             6b02003f                CMPW R2, R1                                     
  prog.go:214           0x10030efd4             54000140                BEQ 10(PC)                                      
  prog.go:217           0x10030efd8             b9400803                MOVWU 8(R0), R3                                 
  prog.go:217           0x10030efdc             360003c3                TBZ $0, R3, 30(PC)                              
  prog.go:226           0x10030efe0             b90043e1                MOVW R1, 64(RSP)                                
  prog.go:213           0x10030efe4             b90027e2                MOVW R2, 36(RSP)          here??     spill r0

(The above is arm64 code but the corresponding amd64 instructions are essentially identical.)

This stack CX-PMg was reported by telemetry:

• crash/crash
• runtime.throw:+9
• runtime.sigpanic:+33
• regexp/syntax.(*Inst).MatchRunePos:+9
• regexp/syntax.(*Inst).MatchRune:=196
• regexp.(*machine).step:+35
• regexp.(*machine).match:+50
• regexp.(*Regexp).doExecute:+21
• regexp.(*Regexp).allMatches:+9
• regexp.(*Regexp).FindAllIndex:+5
• golang.org/x/tools/gopls/internal/server.findLinksInString:+2
• golang.org/x/tools/gopls/internal/server.goLinks:+86
• golang.org/x/tools/gopls/internal/server.(*server).DocumentLink:+14
• golang.org/x/tools/gopls/internal/protocol.serverDispatch:+291
• golang.org/x/tools/gopls/internal/lsprpc.(*streamServer).ServeStream.ServerHandler.func3:+5
• golang.org/x/tools/gopls/internal/lsprpc.(*streamServer).ServeStream.handshaker.func4:+52
• golang.org/x/tools/gopls/internal/protocol.Handlers.MustReplyHandler.func1:+2
• golang.org/x/tools/gopls/internal/protocol.Handlers.AsyncHandler.func2.2:+3

golang.org/x/tools/gopls@v0.18.1 go1.24.1 darwin/amd64 other (1)

[adonovan]

cc: @prattmic

[gabyhelp]

Related Issues

• x/tools/gopls: panic in aeshashbody on behalf of mapaccess2_faststr: string memory corrupted #71367
• x/tools/gopls: index out of range (crash) #42927
• x/tools/gopls: crashed when parsing invalid URL #37882 (closed)
• x/tools/gopls: SEGV while clearing memory in newobject #71561
• x/tools/gopls: CodeAction: nil panic in findMatchingDiagnostics #71028 (closed)
• x/tools/gopls: automated issue report (crash) #40449 (closed)
• x/tools/gopls: panic in internal/golang.activeParameter #69552 (closed)
• x/tools/gopls: Highlight: nil deref panic on CompositeLiteral with no type #68918 (closed)
• x/tools/gopls: crash in testFuncs with *error argument #70927 (closed)
• runtime: possible memory corruption caused by CL 304470 "cmd/compile, runtime: add metadata for argument printing in traceback" #49075 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}