[Bug go/66016] New: Accessing nil Func's name results in crash

[Bug go/66016] New: Accessing nil Func's name results in crash

[jcajka at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66016

            Bug ID: 66016
           Summary: Accessing nil Func's name results in crash
           Product: gcc
           Version: 5.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: go
          Assignee: ian at airs dot com
          Reporter: jcajka at redhat dot com
                CC: cmang at google dot com
  Target Milestone: ---

Created attachment 35462
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35462&action=edit
patch

Follow up to bug 65798 and
https://bugzilla.redhat.com/show_bug.cgi?id=1212472#c2.


Comment #4 from RHBZ:

Hm..., it doesn't fix it. I have messed it up a bit..., problem might not be
the runtime.Caller...( as the rejected function name part was working around
the problem). I have prepare small program triggering the crash outside docker.

package main

import "runtime"
import "fmt"

func main() {
    for i := 1;i <= 5;i++ {
    pc, fname, line,ok := runtime.Caller(i)
    fmt.Printf("%x",pc)
    fmt.Print(" ",fname," ",line," ",ok,"\n")
    fn := runtime.FuncForPC(pc)
    fmt.Print(fn.Name(),"\n\n")
    }
}

Crashes with gcc-go:

7fefdc22b2c6 ../../../libgo/runtime/proc.c 550 true
runtime_main

7fefdc228f8b ../../../libgo/runtime/proc.c 235 true
kickoff

7fefdb20ffff  0 true
panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x0]

goroutine 16 [running]:
main.main
        /root/test.go:12

goroutine 18 [finalizer wait]:
created by runtime_createfing
        ../../../libgo/runtime/mgc0.c:2572

but works fine with golang(built with --ldflags "-linkmode external"):
./test

4125e3 /usr/lib/golang/src/runtime/proc.go 63 true
runtime.main

4377e1 /usr/lib/golang/src/runtime/asm_amd64.s 2232 true
runtime.goexit

0  0 false


0  0 false


0  0 false

There is difference(probably expected?, this confused me...), in number of
callers. But also libgo seems to behave differently than golang when accessing
nil Func's Name, as ommiting/replacing the fn.Name() with just fn yields with
gcc-go:

7feb8a48e2c6 ../../../libgo/runtime/proc.c 550 true
&{{}}

7feb8a48bf8b ../../../libgo/runtime/proc.c 235 true
&{{}}

7feb89472fff  0 true
<nil>

0  0 false
<nil>

0  0 false
<nil>

(Also tried just fn := runtime.FuncForPC(0)
                 fmt.Print(fn.Name(),"\n\n")
 which works with golang, but fails with gcc-go)

I have checked golang's code and indeed it does checking for nil.

(symtab.go)
func cfuncname(f *_func) *byte {
        if f == nil || f.nameoff == 0 {
                return nil
        }
        datap := findmoduledatap(f.entry) // inefficient
        return (*byte)(unsafe.Pointer(&datap.pclntable[f.nameoff]))
}

but libgo doesn't:
(caller.c)
String
        runtime_funcname_go (Func *f)
        {
          return f->name;
        }

changing it:

@@ -231,7 +231,13 @@ String runtime_funcname_go (Func *f)
 String
 runtime_funcname_go (Func *f)
 {
-  return f->name;
+  String str;
+  if (!f)
+  {
+    runtime_memclr (&str, sizeof str);
+    return str;
+  }
+  else return f->name;
 }

seems to fix the crash(tested on x86, will do ppc). Also it seems that Entry()
is not protected in both golang and libgo. I would expect same behavior as in
Name(). Will open golang ticket. I hope now it is finally correct fix(or at
least at right spot)... Patch in attachment.

[Bug go/66016] Accessing nil Func's name results in crash

[jcajka at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66016

--- Comment #1 from Jakub Čajka <jcajka at redhat dot com> ---
Golang upstream ticket:

https://github.com/golang/go/issues/10696
>From gcc-bugs-return-485505-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue May 05 10:50:27 2015
Return-Path: <gcc-bugs-return-485505-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 38176 invoked by alias); 5 May 2015 10:50:26 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 38109 invoked by uid 48); 5 May 2015 10:50:23 -0000
From: "tetra2005 at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/57271] ARM: gcc generates insufficient alignment for memory passed as extra argument for function return large composite type
Date: Tue, 05 May 2015 10:50:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 4.8.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: major
X-Bugzilla-Who: tetra2005 at gmail dot com
X-Bugzilla-Status: WAITING
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-57271-4-MaxI0sUZss@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-57271-4@http.gcc.gnu.org/bugzilla/>
References: <bug-57271-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-05/txt/msg00345.txt.bz2
Content-length: 570

https://gcc.gnu.org/bugzilla/show_bug.cgi?idW271

Yuri Gribov <tetra2005 at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tetra2005 at gmail dot com

--- Comment #8 from Yuri Gribov <tetra2005 at gmail dot com> ---
> So, I wonder, if it's a testcase problem and
> it should be disabled for CA8?

Perhaps add CA8 check in check_effective_target_arm_vect_no_misalign in
gcc/testsuite/lib/target-supports.exp?

[Bug go/66016] Accessing nil Func's name results in crash

[ian at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66016

--- Comment #2 from ian at gcc dot gnu.org <ian at gcc dot gnu.org> ---
Author: ian
Date: Tue May  5 16:38:45 2015
New Revision: 222815

URL: https://gcc.gnu.org/viewcvs?rev=222815&root=gcc&view=rev
Log:
        PR go/66016
runtime: Don't crash in Func.Name if the Func is nil.

Related to Go issue 10696

Modified:
    branches/gcc-4_9-branch/libgo/runtime/go-caller.c

[Bug go/66016] Accessing nil Func's name results in crash

[ian at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66016

--- Comment #3 from ian at gcc dot gnu.org <ian at gcc dot gnu.org> ---
Author: ian
Date: Tue May  5 16:38:57 2015
New Revision: 222816

URL: https://gcc.gnu.org/viewcvs?rev=222816&root=gcc&view=rev
Log:
        PR go/66016
runtime: Don't crash in Func.Name if the Func is nil.

Related to Go issue 10696

Modified:
    trunk/libgo/runtime/go-caller.c

[Bug go/66016] Accessing nil Func's name results in crash

[ian at airs dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66016

Ian Lance Taylor <ian at airs dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Ian Lance Taylor <ian at airs dot com> ---
Fixed.  Thanks for reporting it.