From 326ea438bb579a2010e38e00f515a04344ff96b0 Mon Sep 17 00:00:00 2001
From: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Date: Sun, 13 Jun 2021 22:28:44 +0700
Subject: [PATCH] cmd/compile: rewrite a, b = f() to use temporaries when type
 not identical

If any of the LHS expressions of an OAS2FUNC are not identical to the
respective function call results, escape analysis mishandles the
implicit conversion, causes memory corruption.

Instead, we should insert autotmps like we already do for f(g()) calls
and return g() statements.

Fixes #46725

Change-Id: I71a08da0bf1a03d09a023da5b6f78fb37a4a4690
Reviewed-on: https://go-review.googlesource.com/c/go/+/327651
Trust: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Run-TryBot: Cuong Manh Le <cuong.manhle.vn@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>
---
 src/cmd/compile/internal/typecheck/stmt.go    | 14 +++++-
 .../compile/internal/typecheck/typecheck.go   | 10 ++++
 test/declbad.go                               |  4 +-
 test/fixedbugs/issue46725.go                  | 48 +++++++++++++++++++
 4 files changed, 73 insertions(+), 3 deletions(-)
 create mode 100644 test/fixedbugs/issue46725.go

diff --git a/src/cmd/compile/internal/typecheck/stmt.go b/src/cmd/compile/internal/typecheck/stmt.go
index 175216f279..922a01bfbe 100644
--- a/src/cmd/compile/internal/typecheck/stmt.go
+++ b/src/cmd/compile/internal/typecheck/stmt.go
@@ -204,8 +204,20 @@ assignOK:
 		r.Use = ir.CallUseList
 		rtyp := r.Type()
 
+		mismatched := false
+		failed := false
 		for i := range lhs {
-			assignType(i, rtyp.Field(i).Type)
+			result := rtyp.Field(i).Type
+			assignType(i, result)
+
+			if lhs[i].Type() == nil || result == nil {
+				failed = true
+			} else if lhs[i] != ir.BlankNode && !types.Identical(lhs[i].Type(), result) {
+				mismatched = true
+			}
+		}
+		if mismatched && !failed {
+			rewriteMultiValueCall(stmt, r)
 		}
 		return
 	}
diff --git a/src/cmd/compile/internal/typecheck/typecheck.go b/src/cmd/compile/internal/typecheck/typecheck.go
index 391e18bd0a..bf52941b2c 100644
--- a/src/cmd/compile/internal/typecheck/typecheck.go
+++ b/src/cmd/compile/internal/typecheck/typecheck.go
@@ -989,6 +989,16 @@ func rewriteMultiValueCall(n ir.InitNode, call ir.Node) {
 		n.Args = list
 	case *ir.ReturnStmt:
 		n.Results = list
+	case *ir.AssignListStmt:
+		if n.Op() != ir.OAS2FUNC {
+			base.Fatalf("rewriteMultiValueCall: invalid op %v", n.Op())
+		}
+		as.SetOp(ir.OAS2FUNC)
+		n.SetOp(ir.OAS2)
+		n.Rhs = make([]ir.Node, len(list))
+		for i, tmp := range list {
+			n.Rhs[i] = AssignConv(tmp, n.Lhs[i].Type(), "assignment")
+		}
 	}
 }
 
diff --git a/test/declbad.go b/test/declbad.go
index 728eceb7f1..b978652a2b 100644
--- a/test/declbad.go
+++ b/test/declbad.go
@@ -23,13 +23,13 @@ func main() {
 	{
 		// change of type for f
 		i, f, s := f3()
-		f, g, t := f3() // ERROR "redeclared|cannot assign|incompatible"
+		f, g, t := f3() // ERROR "redeclared|cannot assign|incompatible|cannot use"
 		_, _, _, _, _ = i, f, s, g, t
 	}
 	{
 		// change of type for i
 		i, f, s := f3()
-		j, i, t := f3() // ERROR "redeclared|cannot assign|incompatible"
+		j, i, t := f3() // ERROR "redeclared|cannot assign|incompatible|cannot use"
 		_, _, _, _, _ = i, f, s, j, t
 	}
 	{
diff --git a/test/fixedbugs/issue46725.go b/test/fixedbugs/issue46725.go
new file mode 100644
index 0000000000..29799c7d7e
--- /dev/null
+++ b/test/fixedbugs/issue46725.go
@@ -0,0 +1,48 @@
+// run
+
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import "runtime"
+
+type T [4]int
+
+//go:noinline
+func g(x []*T) ([]*T, []*T) { return x, x }
+
+func main() {
+	const Jenny = 8675309
+	s := [10]*T{{Jenny}}
+
+	done := make(chan struct{})
+	runtime.SetFinalizer(s[0], func(p *T) { close(done) })
+
+	var h, _ interface{} = g(s[:])
+
+	if wait(done) {
+		panic("GC'd early")
+	}
+
+	if h.([]*T)[0][0] != Jenny {
+		panic("lost Jenny's number")
+	}
+
+	if !wait(done) {
+		panic("never GC'd")
+	}
+}
+
+func wait(done <-chan struct{}) bool {
+	for i := 0; i < 10; i++ {
+		runtime.GC()
+		select {
+		case <-done:
+			return true
+		default:
+		}
+	}
+	return false
+}