Skip to content

Commit

Permalink
compiler, runtime: allow slice to array pointer conversion
Browse files Browse the repository at this point in the history
Panic if the slice is too short.

For golang/go#395

Change-Id: I184f87d0207dcee4be6b36ae446b84e9583b356d
Reviewed-on: https://go-review.googlesource.com/c/gofrontend/+/338630
Trust: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
  • Loading branch information
ianlancetaylor committed Aug 2, 2021
1 parent ad667e7 commit 0a4d612
Show file tree
Hide file tree
Showing 5 changed files with 72 additions and 2 deletions.
53 changes: 51 additions & 2 deletions go/expressions.cc
Expand Up @@ -3866,11 +3866,12 @@ Type_conversion_expression::do_traverse(Traverse* traverse)
return TRAVERSE_CONTINUE;
}

// Convert to a constant at lowering time.
// Convert to a constant at lowering time. Also lower conversions
// from slice to pointer-to-array, as they can panic.

Expression*
Type_conversion_expression::do_lower(Gogo*, Named_object*,
Statement_inserter*, int)
Statement_inserter* inserter, int)
{
Type* type = this->type_;
Expression* val = this->expr_;
Expand Down Expand Up @@ -3958,6 +3959,54 @@ Type_conversion_expression::do_lower(Gogo*, Named_object*,
}
}

if (type->points_to() != NULL
&& type->points_to()->array_type() != NULL
&& !type->points_to()->is_slice_type()
&& val->type()->is_slice_type())
{
Temporary_statement* val_temp = NULL;
if (!val->is_multi_eval_safe())
{
val_temp = Statement::make_temporary(val->type(), NULL, location);
inserter->insert(val_temp);
val = Expression::make_set_and_use_temporary(val_temp, val,
location);
}

Type* int_type = Type::lookup_integer_type("int");
Temporary_statement* vallen_temp =
Statement::make_temporary(int_type, NULL, location);
inserter->insert(vallen_temp);

Expression* arrlen = type->points_to()->array_type()->length();
Expression* vallen =
Expression::make_slice_info(val, Expression::SLICE_INFO_LENGTH,
location);
vallen = Expression::make_set_and_use_temporary(vallen_temp, vallen,
location);
Expression* cond = Expression::make_binary(OPERATOR_GT, arrlen, vallen,
location);

vallen = Expression::make_temporary_reference(vallen_temp, location);
Expression* panic = Runtime::make_call(Runtime::PANIC_SLICE_CONVERT,
location, 2, arrlen, vallen);

Expression* nil = Expression::make_nil(location);
Expression* check = Expression::make_conditional(cond, panic, nil,
location);

if (val_temp == NULL)
val = val->copy();
else
val = Expression::make_temporary_reference(val_temp, location);
Expression* ptr =
Expression::make_slice_info(val, Expression::SLICE_INFO_VALUE_POINTER,
location);
ptr = Expression::make_unsafe_cast(type, ptr, location);

return Expression::make_compound(check, ptr, location);
}

return this;
}

Expand Down
5 changes: 5 additions & 0 deletions go/runtime.def
Expand Up @@ -582,6 +582,11 @@ DEF_GO_RUNTIME(PANIC_EXTEND_SLICE3_C, "runtime.goPanicExtendSlice3C",
DEF_GO_RUNTIME(PANIC_EXTEND_SLICE3_C_U, "runtime.goPanicExtendSlice3CU",
P2(UINT64, INT), R0())

// Panic for conversion of slice to pointer-to-array if the slice is
// too short.
DEF_GO_RUNTIME(PANIC_SLICE_CONVERT, "runtime.goPanicSliceConvert",
P2(INT, INT), R0())

// Remove helper macros.
#undef ABFT6
#undef ABFT2
Expand Down
7 changes: 7 additions & 0 deletions go/types.cc
Expand Up @@ -842,6 +842,13 @@ Type::are_convertible(const Type* lhs, const Type* rhs, std::string* reason)
return true;
}

// A slice may be converted to a pointer-to-array.
if (rhs->is_slice_type()
&& lhs->points_to() != NULL
&& lhs->points_to()->array_type() != NULL
&& !lhs->points_to()->is_slice_type())
return true;

// An unsafe.Pointer type may be converted to any pointer type or to
// a type whose underlying type is uintptr, and vice-versa.
if (lhs->is_unsafe_pointer_type()
Expand Down
2 changes: 2 additions & 0 deletions libgo/go/runtime/error.go
Expand Up @@ -175,6 +175,7 @@ const (
boundsSlice3B // s[?:x:y], 0 <= x <= y failed (but boundsSlice3A didn't happen)
boundsSlice3C // s[x:y:?], 0 <= x <= y failed (but boundsSlice3A/B didn't happen)

boundsConvert // (*[x]T)(s), 0 <= x <= len(s) failed
// Note: in the above, len(s) and cap(s) are stored in y
)

Expand All @@ -190,6 +191,7 @@ var boundsErrorFmts = [...]string{
boundsSlice3Acap: "slice bounds out of range [::%x] with capacity %y",
boundsSlice3B: "slice bounds out of range [:%x:%y]",
boundsSlice3C: "slice bounds out of range [%x:%y:]",
boundsConvert: "cannot convert slice with length %y to pointer to array with length %x",
}

// boundsNegErrorFmts are overriding formats if x is negative. In this case there's no need to report y.
Expand Down
7 changes: 7 additions & 0 deletions libgo/go/runtime/panic.go
Expand Up @@ -38,6 +38,7 @@ import (
//go:linkname goPanicSlice3BU
//go:linkname goPanicSlice3C
//go:linkname goPanicSlice3CU
//go:linkname goPanicSliceConvert
//go:linkname panicshift
//go:linkname panicdivide
//go:linkname panicmem
Expand Down Expand Up @@ -175,6 +176,12 @@ func goPanicSlice3CU(x uint, y int) {
panic(boundsError{x: int64(x), signed: false, y: y, code: boundsSlice3C})
}

// failures in the conversion (*[x]T)s, 0 <= x <= y, x == cap(s)
func goPanicSliceConvert(x int, y int) {
panicCheck1(getcallerpc(), "slice length too short to convert to pointer to array")
panic(boundsError{x: int64(x), signed: true, y: y, code: boundsConvert})
}

var shiftError = error(errorString("negative shift amount"))

func panicshift() {
Expand Down

0 comments on commit 0a4d612

Please sign in to comment.