cmd/compile: miscompile of global array initialization

[wdvxdr1123]

Go version

go1.26rc1

Output of go env in your module/workspace:

linux/amd64

What did you do?

run syscall test&benchmark

What did you see happen?

runtime: pointer 0x205e021d84f0 to unallocated span span.base()=0x205e021d2000 span.limit=0x205e021da000 span.state=0
runtime: found in object at *(0x782880+0x1380)
object=0x782880 s=nil
fatal error: found bad pointer in Go heap (incorrect use of unsafe or cgo?)

runtime stack:
runtime.throw({0x5ff83e?, 0x6?})
	/home/workspace/go/src/runtime/panic.go:1229 +0x48 fp=0x7f2bb6ffcbb8 sp=0x7f2bb6ffcb88 pc=0x495648
runtime.badPointer(0x7f2c00035c68, 0x205e021d84f0, 0x782880, 0x1380)
	/home/workspace/go/src/runtime/mbitmap.go:1334 +0x165 fp=0x7f2bb6ffcc08 sp=0x7f2bb6ffcbb8 pc=0x4316a5
runtime.findObject(0x20?, 0x2?, 0x2?)
	/home/workspace/go/src/runtime/mbitmap.go:1386 +0x9e fp=0x7f2bb6ffcc40 sp=0x7f2bb6ffcc08 pc=0x493d9e
runtime.scanblock(0x782880, 0xd592, 0x7f2c48e44f80, 0x205e01c69260, 0x0)
	/home/workspace/go/src/runtime/mgcmark.go:1502 +0xdd fp=0x7f2bb6ffcca0 sp=0x7f2bb6ffcc40 pc=0x43fbfd
runtime.markrootBlock(0x601ca8?, 0x40?, 0x40?, 0x35be1bf43b6e8f?, 0x457ff5?)
	/home/workspace/go/src/runtime/mgcmark.go:351 +0x54 fp=0x7f2bb6ffcce0 sp=0x7f2bb6ffcca0 pc=0x43d6d4
runtime.markroot(0x205e01c69260, 0x3, 0x1)
	/home/workspace/go/src/runtime/mgcmark.go:229 +0x41e fp=0x7f2bb6ffcd90 sp=0x7f2bb6ffcce0 pc=0x43d4be
runtime.gcDrain(0x205e01c69260, 0x3)
	/home/workspace/go/src/runtime/mgcmark.go:1275 +0x4a7 fp=0x7f2bb6ffce00 sp=0x7f2bb6ffcd90 pc=0x43f747
runtime.gcDrainMarkWorkerDedicated(...)
	/home/workspace/go/src/runtime/mgcmark.go:1178
runtime.gcBgMarkWorker.func2()
	/home/workspace/go/src/runtime/mgc.go:1862 +0x9a fp=0x7f2bb6ffce50 sp=0x7f2bb6ffce00 pc=0x43b4ba
runtime.systemstack(0x800000)
	/home/workspace/go/src/runtime/asm_amd64.s:562 +0x4a fp=0x7f2bb6ffce60 sp=0x7f2bb6ffce50 pc=0x49b0aa

goroutine 90 gp=0x205e0209f0e0 m=22 mp=0x205e020ff808 [GC worker (active)]:
runtime.systemstack_switch()
	/home/workspace/go/src/runtime/asm_amd64.s:516 +0x8 fp=0x205e02097f40 sp=0x205e02097f30 pc=0x49b048
runtime.gcBgMarkWorker(0x205e01d92460)
	/home/workspace/go/src/runtime/mgc.go:1847 +0x1df fp=0x205e02097fc8 sp=0x205e02097f40 pc=0x43b2bf
runtime.gcBgMarkStartWorkers.gowrap1()
	/home/workspace/go/src/runtime/mgc.go:1695 +0x17 fp=0x205e02097fe0 sp=0x205e02097fc8 pc=0x43b0b7
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e02097fe8 sp=0x205e02097fe0 pc=0x49cc81
created by runtime.gcBgMarkStartWorkers in goroutine 26
	/home/workspace/go/src/runtime/mgc.go:1695 +0x105

goroutine 1 gp=0x205e01c001e0 m=nil [chan receive]:
runtime.gopark(0x23637d8?, 0x0?, 0x44?, 0x0?, 0x432e25?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e023637f8 sp=0x205e023637d8 pc=0x49576e
runtime.chanrecv(0x205e01c16070, 0x0, 0x1)
	/home/workspace/go/src/runtime/chan.go:667 +0x4ae fp=0x205e02363870 sp=0x205e023637f8 pc=0x417fae
runtime.chanrecv1(0x10?, 0x5c2280?)
	/home/workspace/go/src/runtime/chan.go:509 +0x12 fp=0x205e02363898 sp=0x205e02363870 pc=0x417ad2
testing.(*B).run1(0x205e022cc008)
	/home/workspace/go/src/testing/benchmark.go:247 +0xb1 fp=0x205e02363988 sp=0x205e02363898 pc=0x5072d1
testing.(*B).Run(0x205e022cc608, {0x5f3048?, 0x4c0c33?}, 0x6012e8)
	/home/workspace/go/src/testing/benchmark.go:867 +0x4f4 fp=0x205e02363a88 sp=0x205e02363988 pc=0x50a274
testing.runBenchmarks.func1(0x205e022cc608)
	/home/workspace/go/src/testing/benchmark.go:726 +0x37 fp=0x205e02363ac8 sp=0x205e02363a88 pc=0x5092f7
testing.(*B).runN(0x205e022cc608, 0x1)
	/home/workspace/go/src/testing/benchmark.go:219 +0x190 fp=0x205e02363b58 sp=0x205e02363ac8 pc=0x5070d0
testing.runBenchmarks({0x5efca7, 0x7}, 0x0?, {0x783b20, 0x1, 0x5efca7?})
	/home/workspace/go/src/testing/benchmark.go:735 +0x625 fp=0x205e02363c58 sp=0x205e02363b58 pc=0x509245
testing.(*M).Run(0x205e01d9e280)
	/home/workspace/go/src/testing/testing.go:2459 +0xa2e fp=0x205e02363e98 sp=0x205e02363c58 pc=0x517aee
syscall_test.TestMain(0x205e01d9e280)
	/home/workspace/go/src/syscall/syscall_linux_test.go:130 +0x88 fp=0x205e02363eb8 sp=0x205e02363e98 pc=0x57c1e8
main.main()
	_testmain.go:156 +0xa5 fp=0x205e02363f48 sp=0x205e02363eb8 pc=0x585045
runtime.main()
	/home/workspace/go/src/runtime/proc.go:290 +0x2d5 fp=0x205e02363fe0 sp=0x205e02363f48 pc=0x45f5d5
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e02363fe8 sp=0x205e02363fe0 pc=0x49cc81

goroutine 2 gp=0x205e01c00d20 m=nil [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d36fa8 sp=0x205e01d36f88 pc=0x49576e
runtime.goparkunlock(...)
	/home/workspace/go/src/runtime/proc.go:468
runtime.forcegchelper()
	/home/workspace/go/src/runtime/proc.go:375 +0xb3 fp=0x205e01d36fe0 sp=0x205e01d36fa8 pc=0x45f8f3
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d36fe8 sp=0x205e01d36fe0 pc=0x49cc81
created by runtime.init.7 in goroutine 1
	/home/workspace/go/src/runtime/proc.go:363 +0x1a

goroutine 3 gp=0x205e01c012c0 m=nil [GC sweep wait]:
runtime.gopark(0x1?, 0x0?, 0x0?, 0x0?, 0x0?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d37788 sp=0x205e01d37768 pc=0x49576e
runtime.goparkunlock(...)
	/home/workspace/go/src/runtime/proc.go:468
runtime.bgsweep(0x205e01d30080)
	/home/workspace/go/src/runtime/mgcsweep.go:324 +0x151 fp=0x205e01d377c8 sp=0x205e01d37788 pc=0x447351
runtime.gcenable.gowrap1()
	/home/workspace/go/src/runtime/mgc.go:214 +0x17 fp=0x205e01d377e0 sp=0x205e01d377c8 pc=0x4386f7
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d377e8 sp=0x205e01d377e0 pc=0x49cc81
created by runtime.gcenable in goroutine 1
	/home/workspace/go/src/runtime/mgc.go:214 +0x66

goroutine 4 gp=0x205e01c014a0 m=nil [GC scavenge wait]:
runtime.gopark(0x10000?, 0x6020c8?, 0x0?, 0x0?, 0x0?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d37f78 sp=0x205e01d37f58 pc=0x49576e
runtime.goparkunlock(...)
	/home/workspace/go/src/runtime/proc.go:468
runtime.(*scavengerState).park(0x790f00)
	/home/workspace/go/src/runtime/mgcscavenge.go:425 +0x49 fp=0x205e01d37fa8 sp=0x205e01d37f78 pc=0x444dc9
runtime.bgscavenge(0x205e01d30080)
	/home/workspace/go/src/runtime/mgcscavenge.go:658 +0x59 fp=0x205e01d37fc8 sp=0x205e01d37fa8 pc=0x445359
runtime.gcenable.gowrap2()
	/home/workspace/go/src/runtime/mgc.go:215 +0x17 fp=0x205e01d37fe0 sp=0x205e01d37fc8 pc=0x4386b7
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d37fe8 sp=0x205e01d37fe0 pc=0x49cc81
created by runtime.gcenable in goroutine 1
	/home/workspace/go/src/runtime/mgc.go:215 +0xa5

goroutine 18 gp=0x205e01d843c0 m=nil [GOMAXPROCS updater (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d32788 sp=0x205e01d32768 pc=0x49576e
runtime.goparkunlock(...)
	/home/workspace/go/src/runtime/proc.go:468
runtime.updateMaxProcsGoroutine()
	/home/workspace/go/src/runtime/proc.go:7087 +0xe7 fp=0x205e01d327e0 sp=0x205e01d32788 pc=0x46df47
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d327e8 sp=0x205e01d327e0 pc=0x49cc81
created by runtime.defaultGOMAXPROCSUpdateEnable in goroutine 1
	/home/workspace/go/src/runtime/proc.go:7075 +0x37

goroutine 19 gp=0x205e01d84960 m=nil [finalizer wait]:
runtime.gopark(0x46ef95?, 0x5ac9e0?, 0x1?, 0x1?, 0x205e01d36680?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d36620 sp=0x205e01d36600 pc=0x49576e
runtime.runFinalizers()
	/home/workspace/go/src/runtime/mfinal.go:210 +0x107 fp=0x205e01d367e0 sp=0x205e01d36620 pc=0x437667
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d367e8 sp=0x205e01d367e0 pc=0x49cc81
created by runtime.createfing in goroutine 1
	/home/workspace/go/src/runtime/mfinal.go:172 +0x3d

goroutine 20 gp=0x205e01d84b40 m=nil [cleanup wait]:
runtime.gopark(0x7f2bf0711400?, 0x205e01d32f90?, 0x35?, 0xdd?, 0x7f2bf0711400?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d32f68 sp=0x205e01d32f48 pc=0x49576e
runtime.goparkunlock(...)
	/home/workspace/go/src/runtime/proc.go:468
runtime.(*cleanupQueue).dequeue(0x7911e0)
	/home/workspace/go/src/runtime/mcleanup.go:522 +0xd4 fp=0x205e01d32fa0 sp=0x205e01d32f68 pc=0x4344b4
runtime.runCleanups()
	/home/workspace/go/src/runtime/mcleanup.go:718 +0x45 fp=0x205e01d32fe0 sp=0x205e01d32fa0 pc=0x434b25
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d32fe8 sp=0x205e01d32fe0 pc=0x49cc81
created by runtime.(*cleanupQueue).createGs in goroutine 1
	/home/workspace/go/src/runtime/mcleanup.go:672 +0xa5

goroutine 21 gp=0x205e01d84d20 m=5 mp=0x205e01d3b808 [syscall]:
runtime.notetsleepg(0x205e01de0080, 0xffffffffffffffff)
	/home/workspace/go/src/runtime/lock_futex.go:123 +0x29 fp=0x205e01d49eb0 sp=0x205e01d49e88 pc=0x41e469
runtime.(*profBuf).read(0x205e01de0000, 0x0)
	/home/workspace/go/src/runtime/profbuf.go:523 +0xa5 fp=0x205e01d49ef8 sp=0x205e01d49eb0 pc=0x46fe45
runtime/pprof.readProfile()
	/home/workspace/go/src/runtime/cpuprof.go:251 +0x4a fp=0x205e01d49f58 sp=0x205e01d49ef8 pc=0x49310a
runtime/pprof.profileWriter({0x604778?, 0x205e01d82078?})
	/data00/home/workspace/go/src/runtime/pprof/pprof.go:931 +0x45 fp=0x205e01d49fc0 sp=0x205e01d49f58 pc=0x54bf45
runtime/pprof.StartCPUProfile.gowrap2()
	/data00/home/workspace/go/src/runtime/pprof/pprof.go:912 +0x1b fp=0x205e01d49fe0 sp=0x205e01d49fc0 pc=0x54be9b
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d49fe8 sp=0x205e01d49fe0 pc=0x49cc81
created by runtime/pprof.StartCPUProfile in goroutine 1
	/data00/home/workspace/go/src/runtime/pprof/pprof.go:912 +0x1b6

goroutine 27 gp=0x205e01d852c0 m=nil [GC worker (idle)]:
runtime.gopark(0x205e01d34750?, 0x205e01d34760?, 0xf3?, 0x51?, 0x4c0c33?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d34740 sp=0x205e01d34720 pc=0x49576e
runtime.gcBgMarkWorker(0x205e01d92460)
	/home/workspace/go/src/runtime/mgc.go:1791 +0xeb fp=0x205e01d347c8 sp=0x205e01d34740 pc=0x43b1cb
runtime.gcBgMarkStartWorkers.gowrap1()
	/home/workspace/go/src/runtime/mgc.go:1695 +0x17 fp=0x205e01d347e0 sp=0x205e01d347c8 pc=0x43b0b7
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d347e8 sp=0x205e01d347e0 pc=0x49cc81
created by runtime.gcBgMarkStartWorkers in goroutine 26
	/home/workspace/go/src/runtime/mgc.go:1695 +0x105

goroutine 28 gp=0x205e01d854a0 m=nil [GC worker (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/home/workspace/go/src/runtime/proc.go:462 +0xce fp=0x205e01d34f40 sp=0x205e01d34f20 pc=0x49576e
runtime.gcBgMarkWorker(0x205e01d92460)
	/home/workspace/go/src/runtime/mgc.go:1791 +0xeb fp=0x205e01d34fc8 sp=0x205e01d34f40 pc=0x43b1cb
runtime.gcBgMarkStartWorkers.gowrap1()
	/home/workspace/go/src/runtime/mgc.go:1695 +0x17 fp=0x205e01d34fe0 sp=0x205e01d34fc8 pc=0x43b0b7
runtime.goexit({})
	/home/workspace/go/src/runtime/asm_amd64.s:1771 +0x1 fp=0x205e01d34fe8 sp=0x205e01d34fe0 pc=0x49cc81
created by runtime.gcBgMarkStartWorkers in goroutine 26
	/home/workspace/go/src/runtime/mgc.go:1695 +0x105

......

This crash doesn’t happen every time. Based on the stack trace, it only crashes when running the benchmark. The benchmark uses for b.Loop() {, so it seems quite likely that it’s related to compiler instrumenting.

cc @JunyangShao @randall77

What did you expect to see?

no crash

[cuonglm]

How did you run the benchmark?

I tried go test -run=NONE -bench=. syscall, but could not reproduce the problem.

[wdvxdr1123]

for ((i=1; i<=30; i++)); do
  go test -bench=. syscall
done

[JunyangShao]

I just reproduced it on the current tip, debugging...

[cuonglm]

Hmm, I think since CL 725180, we change the keep alive call to use:

runtime.KeepAlive(unsafe.Pointer(&x))

which ends up making x to be marked as address taken, causing liveness analysis confusing.

Since we are going to not escape these kept alive vars anyway, probably we should just always use temporary.

[JunyangShao]

Hmm, I think since CL 725180, we change the keep alive call to use:

runtime.KeepAlive(unsafe.Pointer(&x))

which ends up making x to be marked as address taken, causing liveness analysis confusing.

Since we are going to not escape these kept alive vars anyway, probably we should just always use temporary.

I tried reverting this CL but the reproducer still crashed.
AFAIK, if we don't do arithmetic on unsafe.Pointer, this looks ok? 🤔

There might be a bug in bloop pass or the liveness pass

[cuonglm]

After some more investigation, I think this is a runtime bug instead, since the panic still occur with old style benchmark:

func BenchmarkClearenv(b *testing.B) {
	setupEnvCleanup(b)
	b.ResetTimer()
	for _, size := range []int{100, 1000, 10000} {
		b.Run(strconv.Itoa(size), func(b *testing.B) {
			envList := genDummyEnv(b, size)
			for i := 0; i < b.N; i++ {
				// Ideally we would use b.StopTimer() for the setDummyEnv
				// portion, but this causes the benchmark time to get confused
				// and take forever. See <https://go.dev/issue/27217>.
				setDummyEnv(b, envList)
				syscall.Clearenv()
			}
		})
	}
}

[cuonglm]

@golang/runtime