cmd/compile: compiler ICE in 1.26.4

[ladydascalie]

Go version

go version go1.26.4 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN='/home/b/.local/share/mise/installs/go/1.26.4/bin'
GOCACHE='/home/b/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/b/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build525739460=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/home/b/Code/LootLocker/go-backend/go.mod'
GOMODCACHE='/home/b/go/pkg/mod'
GONOPROXY='github.com/go-flexible/*,github.com/lootlocker/*'
GONOSUMDB='github.com/go-flexible/*,github.com/lootlocker/*'
GOOS='linux'
GOPATH='/home/b/go'
GOPRIVATE='github.com/go-flexible/*,github.com/lootlocker/*'
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/b/.local/share/mise/installs/go/1.26.4'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/b/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/b/.local/share/mise/installs/go/1.26.4/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.4'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Ran go build on previously working code, which triggered an ICE.

It can be reproduced with the following:

package main

var fetch func([]string) []any

func Prune(keys []string) ([]string, error) {
	filtered := []string{}
	result := fetch(keys)
	for index, value := range keys {
		if result[index] != nil {
			filtered = append(filtered, value)
		}
	}
	return filtered, nil
}

func main() { Prune([]string{"a"}) }

which yields

go run /tmp/ice-test/main.go
# command-line-arguments
/tmp/ice-test/main.go:21:11: internal compiler error: 'Prune': panic during prove while compiling Prune:

runtime error: invalid memory address or nil pointer dereference

goroutine 11 [running]:
cmd/compile/internal/ssa.Compile.func1()
	cmd/compile/internal/ssa/compile.go:49 +0x67
panic({0xfbc360?, 0x196ab40?})
	runtime/panic.go:860 +0x13a
cmd/compile/internal/ssa.(*poset).SetEqual(0x3795808440c0?, 0x3795805c7a98?, 0x3795805923d0?)
	cmd/compile/internal/ssa/poset.go:942 +0x67
cmd/compile/internal/ssa.(*factsTable).update(0x3795808440c0, 0x3795805c7a98, 0x379580592440, 0x10, 0x1, 0x2)
	cmd/compile/internal/ssa/prove.go:814 +0x215
cmd/compile/internal/ssa.prove(0x3795800fa000)
	cmd/compile/internal/ssa/prove.go:1552 +0x1010
cmd/compile/internal/ssa.Compile(0x3795800fa000)
	cmd/compile/internal/ssa/compile.go:97 +0xbd9
cmd/compile/internal/ssagen.buildssa(0x3795800b2140, 0xf, 0x0)
	cmd/compile/internal/ssagen/ssa.go:594 +0x2e26
cmd/compile/internal/ssagen.Compile(0x3795800b2140, 0xf, 0x10c4c00?)
	cmd/compile/internal/ssagen/pgen.go:304 +0x88
cmd/compile/internal/gc.compileFunctions.func5.1(0x466db0?)
	cmd/compile/internal/gc/compile.go:199 +0x38
cmd/compile/internal/gc.compileFunctions.func3.1()
	cmd/compile/internal/gc/compile.go:181 +0x30
created by cmd/compile/internal/gc.compileFunctions.func3 in goroutine 10
	cmd/compile/internal/gc/compile.go:180 +0x325



Please file a bug report including a short program that triggers the error.
https://go.dev/issue/new

Variable names etc are all irrelevant, just close-ish to the real production code where I noticed the error.

Changing the in this way seems to work:

for i := 0; i < len(keys); i++ {
    if result[i] != nil {
      filtered = append(filtered, keys[i])
    }
}

What did you see happen?

Code that previously compiled correctly triggered an ICE.

What did you expect to see?

Code to continue compiling as before

[ladydascalie]

Shipping a zip file with an untrusted executable as a comment is extremely suspicious. I'd warn anyone against clicking this, and I'm reporting this.

[ladydascalie]

go_fix_patch.zip Man, that ICE is a total pain. Looks like the new compiler version is tripping over the nil pointer check during the SSA pass. I managed to bypass the crash by patching the linker config to handle the slice bounds differently.

This is likely a bot shipping malware, be aware:

https://hybrid-analysis.com/sample/d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b

[gabyhelp]

Related Issues

• cmd/compile: internal compiler error: 'F-range1': panic during short circuit while compiling F-range1 #78408 (closed)
• cmd/compile: internal compiler error: 'f': value .autotmp_13 (v118) incorrectly live at entry #78410 (closed)
• cmd/compile: range over rune literal causes internal compiler error #64471 (closed)
• cmd/compile: internal compiler error "bad live variable at entry" with map range, map lookup pointer, and optimized struct method call #80102
• cmd/compile: internal compiler error: panic: interface conversion: ir.Node is *ir.IndexExpr, not *ir.StarExpr #77832 (closed)
• cmd/compile: internal compiler error: 'main.func1': not lowered: v15, Load STRUCT PTR SSA #77534 (closed)
• cmd/compile: internal compiler error: variable address class PFUNC not implemented #76636 (closed)
• cmd/compile: internal compiler error: panic during prove #26043 (closed)
• cmd/compile: ice expecting positive value on loop iterating by math.MinInt64 (regression) #78641 (closed)
• cmd/compile: internal compiler error invalid heap allocated var without Heapaddr #80097 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[AlekSi]

Is fetch supposed to be defined? On go version go1.26.5 darwin/arm64 (different version on different OS), it gives me:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1029d4e48]

goroutine 1 [running]:
main.Prune({0x1757f6c82050, 0x1, 0x102a5e6c0?})
        /xxx/test.go:7 +0x38
main.main()
        /xxx/test.go:16 +0x3c
exit status 2

as expected.

[ladydascalie]

Is fetch supposed to be defined?

@AlekSi

On my original example, I show: var fetch func([]string) []any

It stands as a placeholder for real production code which took []string and returned []any (a Redis client method in this case).

My fetch here is a stripped-down version which exhibits the same behaviour.

[randall77]

I cannot reproduce. go1.26.4 compiles the OP's example just fine.
(When run, the program panics, which I guess is correct? But building does not trigger an ICE.)

[AlekSi]

What I meant is that fetch is reduced to a nil function without a body. I wasn't sure if it was intended.
I also can't reproduce it.