runtime: marked free object in span

[happened]

What version of Go are you using (go version)?

go version go1.16.6 linux/amd64

$ go version
1.16.6

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/root/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/root/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16.6"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3540926736=/tmp/go-build -gno-record-gcc-switches"

What did you do?

this reports "runtime: marked free object in span" .

this panic occurs sooner or later，
when we set GOGC=500 , it occurs slowly . 3 hour
when we add runtime.GC() for every request (our program is a rpc server ,use grpc) , it occurs quickly. 1 hour
and then we set GODEBUG=cgocheck=2,invalidptr=1 ，those does not work,the error msg is same.

What did you expect to see?

we use cgo , is there any way to get more useful information ? especially which pointer cause this panic

thanks :)

What did you see instead?

runtime: marked free object in span 0x7fd8bb25d328, elemsize=480 freeindex=0 (bad use of unsafe.Pointer? try -d=checkptr)
0xc00000e000 alloc marked  
0xc00000e1e0 free  unmarked
0xc00000e3c0 free  marked   zombie
000000c00000e3c0:  0000000000000000  0000000000000000 
000000c00000e3d0:  0000000000000000  0000000000000000 
000000c00000e3e0:  0000000000000000  0000000000000000 
000000c00000e3f0:  0000000000000000  0000000000000000 
000000c00000e400:  0000000000000000  0000000000000000 
000000c00000e410:  0000000000000000  0000000000000000 
000000c00000e420:  0000000000000000  0000000000000000 
000000c00000e430:  0000000000000000  0000000000000000 
000000c00000e440:  0000000000000000  0000000000000000 
000000c00000e450:  0000000000000000  0000000000000000 
000000c00000e460:  0000000000000000  0000000000000000 
000000c00000e470:  0000000000000000  0000000000000000 
000000c00000e480:  0000000000000000  0000000000000000 
000000c00000e490:  0000000000000000  0000000000000000 
000000c00000e4a0:  0000000000000000  0000000000000000 
000000c00000e4b0:  0000000000000000  0000000000000000 
000000c00000e4c0:  0000000000000000  0000000000000000 
000000c00000e4d0:  0000000000000000  0000000000000000 
000000c00000e4e0:  0000000000000000  0000000000000000 
000000c00000e4f0:  0000000000000000  0000000000000000 
000000c00000e500:  0000000000000000  0000000000000000 
000000c00000e510:  0000000000000000  0000000000000000 
000000c00000e520:  0000000000000000  0000000000000000 
000000c00000e530:  0000000000000000  0000000000000000 
000000c00000e540:  0000000000000000  0000000000000000 
000000c00000e550:  0000000000000000  0000000000000000 
000000c00000e560:  0000000000000000  0000000000000000 
000000c00000e570:  0000000000000000  0000000000000000 
000000c00000e580:  0000000000000000  0000000000000000 
000000c00000e590:  0000000000000000  0000000000000000 
0xc00000e5a0 free  unmarked
0xc00000e780 free  unmarked
0xc00000e960 free  unmarked
0xc00000eb40 free  unmarked
0xc00000ed20 free  unmarked
0xc00000ef00 free  unmarked
0xc00000f0e0 free  unmarked
0xc00000f2c0 free  unmarked
0xc00000f4a0 free  unmarked
0xc00000f680 free  unmarked
0xc00000f860 free  unmarked
0xc00000fa40 free  unmarked
0xc00000fc20 free  unmarked
0xc00000fe00 free  unmarked
fatal error: found pointer to free object

[ianlancetaylor]

CC @aclements @mknyszek @prattmic

Have you run your program under the race detector?

Is there a way that we can reproduce the problem ourselves?

Thanks.

[happened]

ok , i will try it.
Thanks.

[mknyszek]

Any updates here?

[gopherbot]

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)