runtime: arm64 `found pointer to free object` with safe code

[chriso]

Go version

go version go1.26.4 darwin/arm64

Output of go env in your module/workspace:

AR='ar'
CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/Users/chris/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/chris/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/n7/k57v4pyn0kn40_z8n5wm9ygr0000gn/T/go-build315717947=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/chris/.go/pkg/mod'
GONOPROXY='github.com/chriso/*'
GONOSUMDB='github.com/chriso/*'
GOOS='darwin'
GOPATH='/Users/chris/.go'
GOPRIVATE='github.com/chriso/*'
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/chris/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.26.4'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Ran the following script:

repro.go

package main

import (
        "bytes"
        "encoding/binary"
        "fmt"
)

const (
        b0 = iota
        b1
        b2
        b3
        b4
        b5
        b6
        b7
        b8
        b9
        b10
        nblk
)

var blockLen = [nblk]int{96327, 2940, 233688, 47502, 89024, 72472, 72472, 72472, 719405, 165150, 570703}

const rSz = 21
const aSz = 9
const hdr = 4 * (nblk + 1)

func packU32s(s []uint32) []byte {
        b := make([]byte, len(s)*4)
        for i, v := range s {
                binary.LittleEndian.PutUint32(b[i*4:], v)
        }
        return b
}

func parse(b []byte) [][]byte {
        blk := make([][]byte, nblk)
        off := hdr
        for i := 0; i < nblk; i++ {
                blk[i] = b[off : off+blockLen[i] : off+blockLen[i]]
                off += blockLen[i]
        }
        return blk
}

func grow(blk [][]byte) {
        n0 := uint32(len(blk[b0]) / rSz)
        n1 := uint32(len(blk[b1]) / rSz)
        n2 := uint32(len(blk[b2]) / rSz)
        n3 := uint32(len(blk[b3]) / rSz)
        nd := n0 + n1 + n2 + n3
        c0, c1, c2 := n0, n0+n1, n0+n1+n2

        k0 := bytes.Clone(blk[b0])
        k1 := bytes.Clone(blk[b1])
        k2 := bytes.Clone(blk[b2])
        k3 := bytes.Clone(blk[b3])
        k4 := bytes.Clone(blk[b4])
        k8 := bytes.Clone(blk[b8])
        t5 := make([]uint32, len(blk[b5])/4)
        for i := range t5 {
                t5[i] = uint32(i)
        }
        t6 := make([]uint32, len(blk[b6])/4)
        t7 := make([]uint32, len(blk[b7])/4)
        naux := len(blk[b9]) / aSz
        ndata := len(blk[b10])
        ndefs := int(nd)
        for g := 0; g <= ndefs; g++ {
                t6[g] = uint32(g * naux / ndefs)
                t7[g] = uint32(g * ndata / ndefs)
        }
        aux := blk[b9]

        segs := make([][]byte, nd)
        for g := range nd {
                segs[g] = bytes.Clone(blk[b10][t7[g]:t7[g+1]])
        }

        for g := range nd {
                var rec []byte
                switch {
                case g < c0:
                        rec = k0[g*rSz:]
                case g < c1:
                        rec = k1[(g-c0)*rSz:]
                case g < c2:
                        rec = k2[(g-c1)*rSz:]
                default:
                        rec = k3[(g-c2)*rSz:]
                }
                if rec[10] != 1 {
                        continue
                }
                for a := t6[g]; a < t6[g+1]; a++ {
                        ab := aux[a*aSz:]
                        _ = ab[1:]
                        _ = ab[5:]
                }
        }

        var data []byte
        idx := make([]uint32, nd+1)
        for g := range nd {
                idx[g] = uint32(len(data))
                data = append(data, segs[g]...)
        }
        idx[nd] = uint32(len(data))

        blk[b0], blk[b1], blk[b2], blk[b3] = k0, k1, k2, k3
        blk[b4], blk[b8] = k4, k8
        blk[b5], blk[b7], blk[b10] = packU32s(t5), packU32s(idx), data
}

func serialize(raw []byte, blk [][]byte) []byte {
        total := hdr
        for i := 0; i < nblk; i++ {
                total += len(blk[i])
        }
        out := make([]byte, 0, total)
        out = append(out, raw[:hdr]...)
        for i := 0; i < nblk; i++ {
                out = append(out, blk[i]...)
        }
        return out
}

func main() {
        // Build one template buffer: a header of block offsets followed by the blocks.
        n0 := blockLen[b0] / rSz
        n1 := blockLen[b1] / rSz
        n2 := blockLen[b2] / rSz
        n3 := blockLen[b3] / rSz
        ndefs := n0 + n1 + n2 + n3

        off := hdr
        starts := make([]int, nblk+1)
        for i := 0; i < nblk; i++ {
                starts[i] = off
                off += blockLen[i]
        }
        starts[nblk] = off
        tmpl := make([]byte, off)
        for k := 0; k < 939; k++ {
                g := int(int64(k) * int64(ndefs) / 939)
                switch {
                case g < n0:
                        tmpl[starts[b0]+g*rSz+10] = 1
                case g < n0+n1:
                        tmpl[starts[b1]+(g-n0)*rSz+10] = 1
                case g < n0+n1+n2:
                        tmpl[starts[b2]+(g-n0-n1)*rSz+10] = 1
                default:
                        tmpl[starts[b3]+(g-n0-n1-n2)*rSz+10] = 1
                }
        }

        var sink int
        for iter := 0; iter < 40000; iter++ {
                b := make([]byte, len(tmpl))
                copy(b, tmpl)
                blk := parse(b)
                grow(blk)
                sink += len(serialize(b, blk))
                if iter%4000 == 0 {
                        fmt.Println("iter", iter)
                }
        }
        fmt.Println("DONE no corruption", sink)
}

What did you see happen?

Intermittent runtime-detected heap corruption (not a panic from my code).

Example:

iter 0
iter 4000
runtime: marked free object in span 0x10b1f00e0, elemsize=9472 freeindex=1 (bad use of unsafe.Pointer or having race conditions? try -d=checkptr or -race)
0x45b2e8c6c000 alloc unmarked
0x45b2e8c6e500 free  unmarked
0x45b2e8c70a00 free  marked   zombie
                   7 6 5 4  3 2 1 0   f e d c  b a 9 8  0123456789abcdef
000045b2e8c70a00: 00004281 00004280  00004283 00004282  .B...B...B...B..
000045b2e8c70a10: 00004285 00004284  00004287 00004286  .B...B...B...B..
000045b2e8c70a20: 00004289 00004288  0000428b 0000428a  .B...B...B...B..
000045b2e8c70a30: 0000428d 0000428c  0000428f 0000428e  .B...B...B...B..
000045b2e8c70a40: 00004291 00004290  00004293 00004292  .B...B...B...B..
000045b2e8c70a50: 00004295 00004294  00004297 00004296  .B...B...B...B..
000045b2e8c70a60: 00004299 00004298  0000429b 0000429a  .B...B...B...B..
000045b2e8c70a70: 0000429d 0000429c  0000429f 0000429e  .B...B...B...B..
000045b2e8c70a80: 000042a1 000042a0  000042a3 000042a2  .B...B...B...B..
000045b2e8c70a90: 000042a5 000042a4  000042a7 000042a6  .B...B...B...B..
000045b2e8c70aa0: 000042a9 000042a8  000042ab 000042aa  .B...B...B...B..
000045b2e8c70ab0: 000042ad 000042ac  000042af 000042ae  .B...B...B...B..
000045b2e8c70ac0: 000042b1 000042b0  000042b3 000042b2  .B...B...B...B..
000045b2e8c70ad0: 000042b5 000042b4  000042b7 000042b6  .B...B...B...B..
000045b2e8c70ae0: 000042b9 000042b8  000042bb 000042ba  .B...B...B...B..
000045b2e8c70af0: 000042bd 000042bc  000042bf 000042be  .B...B...B...B..
000045b2e8c70b00: 000042c1 000042c0  000042c3 000042c2  .B...B...B...B..
000045b2e8c70b10: 000042c5 000042c4  000042c7 000042c6  .B...B...B...B..
000045b2e8c70b20: 000042c9 000042c8  000042cb 000042ca  .B...B...B...B..
000045b2e8c70b30: 000042cd 000042cc  000042cf 000042ce  .B...B...B...B..
000045b2e8c70b40: 000042d1 000042d0  000042d3 000042d2  .B...B...B...B..
000045b2e8c70b50: 000042d5 000042d4  000042d7 000042d6  .B...B...B...B..
000045b2e8c70b60: 000042d9 000042d8  000042db 000042da  .B...B...B...B..
000045b2e8c70b70: 000042dd 000042dc  000042df 000042de  .B...B...B...B..
000045b2e8c70b80: 000042e1 000042e0  000042e3 000042e2  .B...B...B...B..
000045b2e8c70b90: 000042e5 000042e4  000042e7 000042e6  .B...B...B...B..
000045b2e8c70ba0: 000042e9 000042e8  000042eb 000042ea  .B...B...B...B..
000045b2e8c70bb0: 000042ed 000042ec  000042ef 000042ee  .B...B...B...B..
000045b2e8c70bc0: 000042f1 000042f0  000042f3 000042f2  .B...B...B...B..
000045b2e8c70bd0: 000042f5 000042f4  000042f7 000042f6  .B...B...B...B..
000045b2e8c70be0: 000042f9 000042f8  000042fb 000042fa  .B...B...B...B..
000045b2e8c70bf0: 000042fd 000042fc  000042ff 000042fe  .B...B...B...B..
000045b2e8c70c00: 00004301 00004300  00004303 00004302  .C...C...C...C..
000045b2e8c70c10: 00004305 00004304  00004307 00004306  .C...C...C...C..
000045b2e8c70c20: 00004309 00004308  0000430b 0000430a  .C...C...C...C..
000045b2e8c70c30: 0000430d 0000430c  0000430f 0000430e  .C...C...C...C..
000045b2e8c70c40: 00004311 00004310  00004313 00004312  .C...C...C...C..
000045b2e8c70c50: 00004315 00004314  00004317 00004316  .C...C...C...C..
000045b2e8c70c60: 00004319 00004318  0000431b 0000431a  .C...C...C...C..
000045b2e8c70c70: 0000431d 0000431c  0000431f 0000431e  .C...C...C...C..
000045b2e8c70c80: 00004321 00004320  00004323 00004322   C..!C.."C..#C..
000045b2e8c70c90: 00004325 00004324  00004327 00004326  $C..%C..&C..'C..
000045b2e8c70ca0: 00004329 00004328  0000432b 0000432a  (C..)C..*C..+C..
000045b2e8c70cb0: 0000432d 0000432c  0000432f 0000432e  ,C..-C...C../C..
000045b2e8c70cc0: 00004331 00004330  00004333 00004332  0C..1C..2C..3C..
000045b2e8c70cd0: 00004335 00004334  00004337 00004336  4C..5C..6C..7C..
000045b2e8c70ce0: 00004339 00004338  0000433b 0000433a  8C..9C..:C..;C..
000045b2e8c70cf0: 0000433d 0000433c  0000433f 0000433e  <C..=C..>C..?C..
000045b2e8c70d00: 00004341 00004340  00004343 00004342  @C..AC..BC..CC..
000045b2e8c70d10: 00004345 00004344  00004347 00004346  DC..EC..FC..GC..
000045b2e8c70d20: 00004349 00004348  0000434b 0000434a  HC..IC..JC..KC..
000045b2e8c70d30: 0000434d 0000434c  0000434f 0000434e  LC..MC..NC..OC..
000045b2e8c70d40: 00004351 00004350  00004353 00004352  PC..QC..RC..SC..
000045b2e8c70d50: 00004355 00004354  00004357 00004356  TC..UC..VC..WC..
000045b2e8c70d60: 00004359 00004358  0000435b 0000435a  XC..YC..ZC..[C..
000045b2e8c70d70: 0000435d 0000435c  0000435f 0000435e  \C..]C..^C.._C..
000045b2e8c70d80: 00004361 00004360  00004363 00004362  `C..aC..bC..cC..
000045b2e8c70d90: 00004365 00004364  00004367 00004366  dC..eC..fC..gC..
000045b2e8c70da0: 00004369 00004368  0000436b 0000436a  hC..iC..jC..kC..
000045b2e8c70db0: 0000436d 0000436c  0000436f 0000436e  lC..mC..nC..oC..
000045b2e8c70dc0: 00004371 00004370  00004373 00004372  pC..qC..rC..sC..
000045b2e8c70dd0: 00004375 00004374  00004377 00004376  tC..uC..vC..wC..
000045b2e8c70de0: 00004379 00004378  0000437b 0000437a  xC..yC..zC..{C..
000045b2e8c70df0: 0000437d 0000437c  0000437f 0000437e  |C..}C..~C...C..
0x45b2e8c72f00 free  unmarked
0x45b2e8c75400 free  unmarked
0x45b2e8c77900 free  unmarked
fatal error: found pointer to free object

runtime stack:
runtime.throw({0x10428d8eb?, 0x400?})
        /usr/local/go/src/runtime/panic.go:1229 +0x38 fp=0x16bfe6b80 sp=0x16bfe6b50 pc=0x104258d98
runtime.(*mspan).reportZombies(0x10b1f00e0)
        /usr/local/go/src/runtime/mgcsweep.go:893 +0x314 fp=0x16bfe6c00 sp=0x16bfe6b80 pc=0x104217884
runtime.(*sweepLocked).sweep(0x16bfe6d68?, 0x0)
        /usr/local/go/src/runtime/mgcsweep.go:668 +0x4f0 fp=0x16bfe6d20 sp=0x16bfe6c00 pc=0x104216930
runtime.(*mcentral).uncacheSpan(0x16bfe6db8?, 0x10425564c?)
        /usr/local/go/src/runtime/mcentral.go:237 +0xbc fp=0x16bfe6d50 sp=0x16bfe6d20 pc=0x10420282c
runtime.(*mcache).releaseAll(0x104401bf0)
        /usr/local/go/src/runtime/mcache.go:322 +0x188 fp=0x16bfe6dc0 sp=0x16bfe6d50 pc=0x1042020d8
runtime.(*mcache).prepareForSweep(0x104401bf0)
        /usr/local/go/src/runtime/mcache.go:366 +0x4c fp=0x16bfe6df0 sp=0x16bfe6dc0 pc=0x10420220c
runtime.gcMarkTermination.func4(0x45b2e8764808)
        /usr/local/go/src/runtime/mgc.go:1546 +0x24 fp=0x16bfe6e20 sp=0x16bfe6df0 pc=0x1042554d4
runtime.forEachPInternal(0x10435efe8)
        /usr/local/go/src/runtime/proc.go:2167 +0x178 fp=0x16bfe6eb0 sp=0x16bfe6e20 pc=0x10422d0b8
runtime.gcMarkTermination.forEachP.func7()
        /usr/local/go/src/runtime/proc.go:2126 +0x40 fp=0x16bfe6ee0 sp=0x16bfe6eb0 pc=0x104209900
runtime.systemstack(0x80000)
        /usr/local/go/src/runtime/asm_arm64.s:399 +0x68 fp=0x16bfe6ef0 sp=0x16bfe6ee0 pc=0x10425cd08

goroutine 29 gp=0x45b2e8805a40 m=7 mp=0x45b2e8d80008 [flushing proc caches]:
runtime.systemstack_switch()
        /usr/local/go/src/runtime/asm_arm64.s:347 +0x8 fp=0x45b2e8845c40 sp=0x45b2e8845c30 pc=0x10425cc88
runtime.forEachP(...)
        /usr/local/go/src/runtime/proc.go:2112
runtime.gcMarkTermination({0x40?, 0x14325f7c27011?, 0xa?, 0x0?})
        /usr/local/go/src/runtime/mgc.go:1545 +0x5f4 fp=0x45b2e8845e80 sp=0x45b2e8845c40 pc=0x104209094
runtime.gcMarkDone()
        /usr/local/go/src/runtime/mgc.go:1173 +0x364 fp=0x45b2e8845f20 sp=0x45b2e8845e80 pc=0x104208394
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1912 +0x29c fp=0x45b2e8845fb0 sp=0x45b2e8845f20 pc=0x104209efc
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e8845fd0 sp=0x45b2e8845fb0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8845fd0 sp=0x45b2e8845fd0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 1 gp=0x45b2e872c1e0 m=nil [runnable]:
runtime.asyncPreempt2()
        /usr/local/go/src/runtime/preempt.go:320 +0x18 fp=0x45b2e8824890 sp=0x45b2e8824870 pc=0x1042281e8
runtime.asyncPreempt()
        /usr/local/go/src/runtime/preempt_arm64.s:44 +0x88 fp=0x45b2e8824980 sp=0x45b2e8824890 pc=0x10425f528
main.packU32s(...)
        /Users/chris/Desktop/v2.go:32
main.grow({0x45b2e8824e10, 0xb, 0x0?})
        /Users/chris/Desktop/v2.go:114 +0xee8 fp=0x45b2e8824c60 sp=0x45b2e8824990 pc=0x1042884c8
main.main()
        /Users/chris/Desktop/v2.go:165 +0x368 fp=0x45b2e8824f30 sp=0x45b2e8824c60 pc=0x104288a38
runtime.main()
        /usr/local/go/src/runtime/proc.go:290 +0x2b4 fp=0x45b2e8824fd0 sp=0x45b2e8824f30 pc=0x104229834
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8824fd0 sp=0x45b2e8824fd0 pc=0x10425ed24

goroutine 2 gp=0x45b2e872c780 m=nil [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8788f90 sp=0x45b2e8788f70 pc=0x104258e6c
runtime.goparkunlock(...)
        /usr/local/go/src/runtime/proc.go:468
runtime.forcegchelper()
        /usr/local/go/src/runtime/proc.go:375 +0xb4 fp=0x45b2e8788fd0 sp=0x45b2e8788f90 pc=0x104229b54
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8788fd0 sp=0x45b2e8788fd0 pc=0x10425ed24
created by runtime.init.7 in goroutine 1
        /usr/local/go/src/runtime/proc.go:363 +0x24

goroutine 17 gp=0x45b2e88043c0 m=nil [runnable]:
runtime.gopark(0x1?, 0x0?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8784770 sp=0x45b2e8784750 pc=0x104258e6c
runtime.goparkunlock(...)
        /usr/local/go/src/runtime/proc.go:468
runtime.bgsweep(0x45b2e8810000)
        /usr/local/go/src/runtime/mgcsweep.go:324 +0x178 fp=0x45b2e87847b0 sp=0x45b2e8784770 pc=0x104215ea8
runtime.gcenable.gowrap1()
        /usr/local/go/src/runtime/mgc.go:214 +0x20 fp=0x45b2e87847d0 sp=0x45b2e87847b0 pc=0x104207560
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e87847d0 sp=0x45b2e87847d0 pc=0x10425ed24
created by runtime.gcenable in goroutine 1
        /usr/local/go/src/runtime/mgc.go:214 +0x6c

goroutine 18 gp=0x45b2e88045a0 m=nil [sleep]:
runtime.gopark(0x45b2e8818000?, 0x143265d163a2a?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8784f20 sp=0x45b2e8784f00 pc=0x104258e6c
runtime.goparkunlock(...)
        /usr/local/go/src/runtime/proc.go:468
runtime.(*scavengerState).sleep(0x10436eb40, 0x40cf690000000000)
        /usr/local/go/src/runtime/mgcscavenge.go:504 +0x108 fp=0x45b2e8784f90 sp=0x45b2e8784f20 pc=0x104213b98
runtime.bgscavenge(0x45b2e8810000)
        /usr/local/go/src/runtime/mgcscavenge.go:662 +0x9c fp=0x45b2e8784fb0 sp=0x45b2e8784f90 pc=0x104213f4c
runtime.gcenable.gowrap2()
        /usr/local/go/src/runtime/mgc.go:215 +0x20 fp=0x45b2e8784fd0 sp=0x45b2e8784fb0 pc=0x104207520
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8784fd0 sp=0x45b2e8784fd0 pc=0x10425ed24
created by runtime.gcenable in goroutine 1
        /usr/local/go/src/runtime/mgc.go:215 +0xac

goroutine 19 gp=0x45b2e8804780 m=nil [GOMAXPROCS updater (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8785770 sp=0x45b2e8785750 pc=0x104258e6c
runtime.goparkunlock(...)
        /usr/local/go/src/runtime/proc.go:468
runtime.updateMaxProcsGoroutine()
        /usr/local/go/src/runtime/proc.go:7095 +0xf4 fp=0x45b2e87857d0 sp=0x45b2e8785770 pc=0x1042381a4
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e87857d0 sp=0x45b2e87857d0 pc=0x10425ed24
created by runtime.defaultGOMAXPROCSUpdateEnable in goroutine 1
        /usr/local/go/src/runtime/proc.go:7083 +0x48

goroutine 20 gp=0x45b2e8804960 m=nil [finalizer wait]:
runtime.gopark(0x0?, 0x0?, 0xb8?, 0x85?, 0x104259974?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8788580 sp=0x45b2e8788560 pc=0x104258e6c
runtime.runFinalizers()
        /usr/local/go/src/runtime/mfinal.go:210 +0x100 fp=0x45b2e87887d0 sp=0x45b2e8788580 pc=0x104206630
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e87887d0 sp=0x45b2e87887d0 pc=0x10425ed24
created by runtime.createfing in goroutine 1
        /usr/local/go/src/runtime/mfinal.go:172 +0x78

goroutine 21 gp=0x45b2e8804b40 m=nil [GC worker (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8785f20 sp=0x45b2e8785f00 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e8785fb0 sp=0x45b2e8785f20 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e8785fd0 sp=0x45b2e8785fb0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8785fd0 sp=0x45b2e8785fd0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 22 gp=0x45b2e8804d20 m=nil [GC worker (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8786720 sp=0x45b2e8786700 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e87867b0 sp=0x45b2e8786720 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e87867d0 sp=0x45b2e87867b0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e87867d0 sp=0x45b2e87867d0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 23 gp=0x45b2e8804f00 m=nil [GC worker (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8786f20 sp=0x45b2e8786f00 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e8786fb0 sp=0x45b2e8786f20 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e8786fd0 sp=0x45b2e8786fb0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8786fd0 sp=0x45b2e8786fd0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 24 gp=0x45b2e88050e0 m=nil [GC worker (idle)]:
runtime.gopark(0x1432545d9ee83?, 0x0?, 0x0?, 0x0?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8787720 sp=0x45b2e8787700 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e87877b0 sp=0x45b2e8787720 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e87877d0 sp=0x45b2e87877b0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e87877d0 sp=0x45b2e87877d0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 25 gp=0x45b2e88052c0 m=nil [GC worker (idle)]:
runtime.gopark(0x14325f7c20a2d?, 0x1?, 0x92?, 0x3b?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8823f20 sp=0x45b2e8823f00 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e8823fb0 sp=0x45b2e8823f20 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e8823fd0 sp=0x45b2e8823fb0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8823fd0 sp=0x45b2e8823fd0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 26 gp=0x45b2e88054a0 m=nil [GC worker (idle)]:
runtime.gopark(0x14325f7baa064?, 0x3?, 0x6b?, 0x3?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8844720 sp=0x45b2e8844700 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e88447b0 sp=0x45b2e8844720 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e88447d0 sp=0x45b2e88447b0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e88447d0 sp=0x45b2e88447d0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 27 gp=0x45b2e8805680 m=nil [GC worker (idle)]:
runtime.gopark(0x14325e9a2ddf7?, 0x1?, 0x7d?, 0x7?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8844f20 sp=0x45b2e8844f00 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e8844fb0 sp=0x45b2e8844f20 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e8844fd0 sp=0x45b2e8844fb0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e8844fd0 sp=0x45b2e8844fd0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 28 gp=0x45b2e8805860 m=nil [GC worker (idle)]:
runtime.gopark(0x14325f7ba9a0b?, 0x3?, 0x6b?, 0x3?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8845720 sp=0x45b2e8845700 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e88457b0 sp=0x45b2e8845720 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e88457d0 sp=0x45b2e88457b0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e88457d0 sp=0x45b2e88457d0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134

goroutine 30 gp=0x45b2e8805c20 m=nil [GC worker (idle)]:
runtime.gopark(0x14325f7c216b6?, 0x1?, 0xab?, 0x99?, 0x0?)
        /usr/local/go/src/runtime/proc.go:462 +0xbc fp=0x45b2e8846720 sp=0x45b2e8846700 pc=0x104258e6c
runtime.gcBgMarkWorker(0x45b2e881c070)
        /usr/local/go/src/runtime/mgc.go:1791 +0xe0 fp=0x45b2e88467b0 sp=0x45b2e8846720 pc=0x104209d40
runtime.gcBgMarkStartWorkers.gowrap1()
        /usr/local/go/src/runtime/mgc.go:1695 +0x20 fp=0x45b2e88467d0 sp=0x45b2e88467b0 pc=0x104209c40
runtime.goexit({})
        /usr/local/go/src/runtime/asm_arm64.s:1447 +0x4 fp=0x45b2e88467d0 sp=0x45b2e88467d0 pc=0x10425ed24
created by runtime.gcBgMarkStartWorkers in goroutine 1
        /usr/local/go/src/runtime/mgc.go:1695 +0x134
exit status 2

I also see variants of this, e.g. fatal error: found bad pointer in Go heap (incorrect use of unsafe or cgo?)

What did you expect to see?

No crash. Memory-safe Go cannot corrupt the heap; the only outcome should be the
program running to completion.

[chriso]

Notes:

• GOEXPERIMENT=nogreenteagc go run repro.go doesn't seem to make a difference here; it crashes with/without
• the problem disappears with either GOMAXPROCS=1 go run repro.go or GODEBUG=asyncpreemptoff=1 go run repro.go

[gabyhelp]

Related Issues

• runtime: possible bug in moveSliceNoCap #80004 (closed)
• cmd/compile: internal compiler error: 'New': can't find source #32681 (closed)
• cmd/compile: miscompile of global array initialization #77193 (closed)
• runtime: slice bounds out of range in mheap on darwin/arm64 (iOS 10) #18651 (closed)
• runtime: fatal error "s.allocCount != s.nelems && freeIndex == s.nelems #78043 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[Jorropo]

@chriso I wonder if this is a dup of #80147

cc @thepudds what do you think ?

[Jorropo]

I'm not sure, I've tried on linux/amd64 and I can't repro this issue.

[thepudds]

I was able to reproduce somewhat rarely / intermittently on darwin/arm64 after building from the go1.26.4 tag. (I was not able to reproduce at least in initial attempts on linux/amd64.)

I'll see if I can get it more repeatable, then try on tip (some chance it might be fixed).

If it still fails on tip, I'll see if a bisect is feasible.

[thepudds]

I can reproduce on tip (6565f55) on darwin/arm64.

I'll kick off a bisect in a bit, though probably won't look at results until tomorrow/Monday.

[JunyangShao]

@golang/runtime

[randall77]

I can reproduce on darwin/arm64, on 1.25, 1.26, and tip.
I cannot reproduce on 1.24.
Bisect points to https://go-review.googlesource.com/c/go/+/659956. Seems related, but I don't see an obvious reason why that CL would cause problems.
@mknyszek

[thepudds]

Hi @randall77, FWIW, from what I could tell when bisecting on darwin/arm64, the CL 659956 you just mentioned did seem to trigger a very notable change in behavior for the reported reproducer. The rate of reproduction dropped quite a bit at that commit (maybe by something like ~20x-50x less frequently).

But I was still able to reproduce on that commit, just at a much lower rate. (Also, reducing the degree to which it was oversubscribed while testing seemed to help reproducibility some, though that might not be particularly meaningful).

At this point, I've reproduced on on darwin/arm64 as far back as 2c35900, which is a little more than a month before CL 659956. (That 2c35900 is not any related commit, it's just the furthest back I've observed so far).

BAD: CL 659956 | df9888ea4e | 2025-05-20 08:39 | runtime: prevent unnecessary zeroing of large objects with pointers
BAD: CL 664075 | 2c35900fe4 | 2025-04-10 09:12 | net: deduplicate sendfile files

I'm still letting it run, but it's a bit slow and needed some tweaking as it went.