cmd/compile: internal compiler error: panic during lower (part 2)

[ALTree]

$ gotip version
go version devel +65c2069a9f Fri Feb 15 17:32:07 2019 +0000 linux/amd64

The following program:

package p

func f() {
	var i int
	var s string

	if true {
		s = "a"
	}

	if f := 0.0; -f < 0 {
		i = len(s[:4])
	}

	_ = s[i-1:0] != "bb" && true
}

Crashes the tip and the 1.12rc1 compilers, when built for GOARCH=arm64, as follows:

$ GOARCH=arm64 gotip tool compile crash.go 

crash.go:11:20: internal compiler error: 'f': panic during lower while compiling f:

runtime error: index out of range

goroutine 1 [running]:
cmd/compile/internal/ssa.Compile.func1(0xc0003c0908, 0xc0000ca580)
	/home/alberto/go/src/cmd/compile/internal/ssa/compile.go:45 +0xa5
panic(0xd64720, 0x1568110)
	/home/alberto/go/src/runtime/panic.go:522 +0x1b5
cmd/compile/internal/ssa.read8(...)

[...]

The crash appears to be the related to the one previously reported as #29215.

[ALTree]

cc @randall77 for triaging and decision regarding the ReleaseBlocker label.

[cherrymui]

Go 1.11 compiles it fine. So it is a regression. I think we should fix this in Go 1.12.

It panics in cmd/compile/internal/ssa.read8, which already guards off>=len:

// read8 reads one byte from the read-only global sym at offset off.
func read8(sym interface{}, off int64) uint8 {
        lsym := sym.(*obj.LSym)
        if off >= int64(len(lsym.P)) {
                // Invalid index into the global sym.
                // This can happen in dead code, so we don't want to panic.
                // Just return any value, it will eventually get ignored.
                // See issue 29215.
                return 0
        }
        return lsym.P[off]
}

So how can this happen? off is negative?

[cherrymui]

Ok, it is loading s[-1] for s[i-1:0] != "bb", where i is constant 0. So off is indeed negative. So read8, etc. should guard against negative offset, too.

Thanks for finding this.

[gopherbot]

Change https://golang.org/cl/162819 mentions this issue: cmd/compile: guard against loads with negative offset from readonly constants

[gopherbot]

Change https://golang.org/cl/162827 mentions this issue: [release-branch.go1.12] cmd/compile: guard against loads with negative offset from readonly constants