go/test/escape_param.go
Cherry Zhang 0349f29a55 cmd/compile: flow interface data to heap if CONVIFACE of a non-direct interface escapes
Consider the following code:

func f(x []*T) interface{} {
	return x
}

It returns an interface that holds a heap copy of x (by calling
convT2I or friend), therefore x escape to heap. The current
escape analysis only recognizes that x flows to the result. This
is not sufficient, since if the result does not escape, x's
content may be stack allocated and this will result a
heap-to-stack pointer, which is bad.

Fix this by realizing that if a CONVIFACE escapes and we're
converting from a non-direct interface type, the data needs to
escape to heap.

Running "toolstash -cmp" on std & cmd, the generated machine code
are identical for all packages. However, the export data (escape
tags) differ in the following packages. It looks to me that all
are similar to the "f" above, where the parameter should escape
to heap.

io/ioutil/ioutil.go:118
	old: leaking param: r to result ~r1 level=0
	new: leaking param: r

image/image.go:943
	old: leaking param: p to result ~r0 level=1
	new: leaking param content: p

net/url/url.go:200
	old: leaking param: s to result ~r2 level=0
	new: leaking param: s

(as a consequence)
net/url/url.go:183
	old: leaking param: s to result ~r1 level=0
	new: leaking param: s

net/url/url.go:194
	old: leaking param: s to result ~r1 level=0
	new: leaking param: s

net/url/url.go:699
	old: leaking param: u to result ~r0 level=1
	new: leaking param: u

net/url/url.go:775
	old: (*URL).String u does not escape
	new: leaking param content: u

net/url/url.go:1038
	old: leaking param: u to result ~r0 level=1
	new: leaking param: u

net/url/url.go:1099
	old: (*URL).MarshalBinary u does not escape
	new: leaking param content: u

flag/flag.go:235
	old: leaking param: s to result ~r0 level=1
	new: leaking param content: s

go/scanner/errors.go:105
	old: leaking param: p to result ~r0 level=0
	new: leaking param: p

database/sql/sql.go:204
	old: leaking param: ns to result ~r0 level=0
	new: leaking param: ns

go/constant/value.go:303
	old: leaking param: re to result ~r2 level=0, leaking param: im to result ~r2 level=0
	new: leaking param: re, leaking param: im

go/constant/value.go:846
	old: leaking param: x to result ~r1 level=0
	new: leaking param: x

encoding/xml/xml.go:518
	old: leaking param: d to result ~r1 level=2
	new: leaking param content: d

encoding/xml/xml.go:122
	old: leaking param: leaking param: t to result ~r1 level=0
	new: leaking param: t

crypto/x509/verify.go:506
	old: leaking param: c to result ~r8 level=0
	new: leaking param: c

crypto/x509/verify.go:563
	old: leaking param: c to result ~r3 level=0, leaking param content: c
	new: leaking param: c

crypto/x509/verify.go:615
	old: (nothing)
	new: leaking closure reference c

crypto/x509/verify.go:996
	old: leaking param: c to result ~r1 level=0, leaking param content: c
	new: leaking param: c

net/http/filetransport.go:30
	old: leaking param: fs to result ~r1 level=0
	new: leaking param: fs

net/http/h2_bundle.go:2684
	old: leaking param: mh to result ~r0 level=2
	new: leaking param content: mh

net/http/h2_bundle.go:7352
	old: http2checkConnHeaders req does not escape
	new: leaking param content: req

net/http/pprof/pprof.go:221
	old: leaking param: name to result ~r1 level=0
	new: leaking param: name

cmd/internal/bio/must.go:21
	old: leaking param: w to result ~r1 level=0
	new: leaking param: w

Fixes #29353.

Change-Id: I7e7798ae773728028b0dcae5bccb3ada51189c68
Reviewed-on: https://go-review.googlesource.com/c/162829
Run-TryBot: Cherry Zhang <cherryyz@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>
Reviewed-by: David Chase <drchase@google.com>
2019-02-21 15:14:45 +00:00

441 lines
12 KiB
Go

// errorcheck -0 -m -l
// Copyright 2015 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// Test escape analysis for function parameters.
// In this test almost everything is BAD except the simplest cases
// where input directly flows to output.
package escape
func zero() int { return 0 }
var sink interface{}
// in -> out
func param0(p *int) *int { // ERROR "leaking param: p to result ~r1"
return p
}
func caller0a() {
i := 0
_ = param0(&i) // ERROR "caller0a &i does not escape$"
}
func caller0b() {
i := 0 // ERROR "moved to heap: i$"
sink = param0(&i) // ERROR "&i escapes to heap$" "param0\(&i\) escapes to heap"
}
// in, in -> out, out
func param1(p1, p2 *int) (*int, *int) { // ERROR "leaking param: p1 to result ~r2" "leaking param: p2 to result ~r3"
return p1, p2
}
func caller1() {
i := 0 // ERROR "moved to heap: i$"
j := 0
sink, _ = param1(&i, &j) // ERROR "&i escapes to heap$" "caller1 &j does not escape$"
}
// in -> other in
func param2(p1 *int, p2 **int) { // ERROR "leaking param: p1$" "param2 p2 does not escape$"
*p2 = p1
}
func caller2a() {
i := 0 // ERROR "moved to heap: i$"
var p *int
param2(&i, &p) // ERROR "&i escapes to heap$" "caller2a &p does not escape$"
_ = p
}
func caller2b() {
i := 0 // ERROR "moved to heap: i$"
var p *int
param2(&i, &p) // ERROR "&i escapes to heap$" "caller2b &p does not escape$"
sink = p // ERROR "p escapes to heap$"
}
func paramArraySelfAssign(p *PairOfPairs) { // ERROR "p does not escape"
p.pairs[0] = p.pairs[1] // ERROR "ignoring self-assignment in p.pairs\[0\] = p.pairs\[1\]"
}
func paramArraySelfAssignUnsafeIndex(p *PairOfPairs) { // ERROR "leaking param content: p"
// Function call inside index disables self-assignment case to trigger.
p.pairs[zero()] = p.pairs[1]
p.pairs[zero()+1] = p.pairs[1]
}
type PairOfPairs struct {
pairs [2]*Pair
}
type BoxedPair struct {
pair *Pair
}
type WrappedPair struct {
pair Pair
}
func leakParam(x interface{}) { // ERROR "leaking param: x"
sink = x
}
func sinkAfterSelfAssignment1(box *BoxedPair) { // ERROR "leaking param content: box"
box.pair.p1 = box.pair.p2 // ERROR "ignoring self-assignment in box.pair.p1 = box.pair.p2"
sink = box.pair.p2 // ERROR "box.pair.p2 escapes to heap"
}
func sinkAfterSelfAssignment2(box *BoxedPair) { // ERROR "leaking param content: box"
box.pair.p1 = box.pair.p2 // ERROR "ignoring self-assignment in box.pair.p1 = box.pair.p2"
sink = box.pair // ERROR "box.pair escapes to heap"
}
func sinkAfterSelfAssignment3(box *BoxedPair) { // ERROR "leaking param content: box"
box.pair.p1 = box.pair.p2 // ERROR "ignoring self-assignment in box.pair.p1 = box.pair.p2"
leakParam(box.pair.p2) // ERROR "box.pair.p2 escapes to heap"
}
func sinkAfterSelfAssignment4(box *BoxedPair) { // ERROR "leaking param content: box"
box.pair.p1 = box.pair.p2 // ERROR "ignoring self-assignment in box.pair.p1 = box.pair.p2"
leakParam(box.pair) // ERROR "box.pair escapes to heap"
}
func selfAssignmentAndUnrelated(box1, box2 *BoxedPair) { // ERROR "leaking param content: box2" "box1 does not escape"
box1.pair.p1 = box1.pair.p2 // ERROR "ignoring self-assignment in box1.pair.p1 = box1.pair.p2"
leakParam(box2.pair.p2) // ERROR "box2.pair.p2 escapes to heap"
}
func notSelfAssignment1(box1, box2 *BoxedPair) { // ERROR "leaking param content: box2" "box1 does not escape"
box1.pair.p1 = box2.pair.p1
}
func notSelfAssignment2(p1, p2 *PairOfPairs) { // ERROR "leaking param content: p2" "p1 does not escape"
p1.pairs[0] = p2.pairs[1]
}
func notSelfAssignment3(p1, p2 *PairOfPairs) { // ERROR "leaking param content: p2" "p1 does not escape"
p1.pairs[0].p1 = p2.pairs[1].p1
}
func boxedPairSelfAssign(box *BoxedPair) { // ERROR "box does not escape"
box.pair.p1 = box.pair.p2 // ERROR "ignoring self-assignment in box.pair.p1 = box.pair.p2"
}
func wrappedPairSelfAssign(w *WrappedPair) { // ERROR "w does not escape"
w.pair.p1 = w.pair.p2 // ERROR "ignoring self-assignment in w.pair.p1 = w.pair.p2"
}
// in -> in
type Pair struct {
p1 *int
p2 *int
}
func param3(p *Pair) { // ERROR "param3 p does not escape"
p.p1 = p.p2 // ERROR "param3 ignoring self-assignment in p.p1 = p.p2"
}
func caller3a() {
i := 0
j := 0
p := Pair{&i, &j} // ERROR "caller3a &i does not escape" "caller3a &j does not escape"
param3(&p) // ERROR "caller3a &p does not escape"
_ = p
}
func caller3b() {
i := 0 // ERROR "moved to heap: i$"
j := 0 // ERROR "moved to heap: j$"
p := Pair{&i, &j} // ERROR "&i escapes to heap$" "&j escapes to heap$"
param3(&p) // ERROR "caller3b &p does not escape"
sink = p // ERROR "p escapes to heap$"
}
// in -> rcvr
func (p *Pair) param4(i *int) { // ERROR "\(\*Pair\).param4 p does not escape$" "leaking param: i$"
p.p1 = i
}
func caller4a() {
i := 0 // ERROR "moved to heap: i$"
p := Pair{}
p.param4(&i) // ERROR "&i escapes to heap$" "caller4a p does not escape$"
_ = p
}
func caller4b() {
i := 0 // ERROR "moved to heap: i$"
p := Pair{}
p.param4(&i) // ERROR "&i escapes to heap$" "caller4b p does not escape$"
sink = p // ERROR "p escapes to heap$"
}
// in -> heap
func param5(i *int) { // ERROR "leaking param: i$"
sink = i // ERROR "i escapes to heap$"
}
func caller5() {
i := 0 // ERROR "moved to heap: i$"
param5(&i) // ERROR "&i escapes to heap$"
}
// *in -> heap
func param6(i ***int) { // ERROR "leaking param content: i$"
sink = *i // ERROR "\*i escapes to heap$"
}
func caller6a() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
p2 := &p // ERROR "&p escapes to heap$"
param6(&p2) // ERROR "caller6a &p2 does not escape"
}
// **in -> heap
func param7(i ***int) { // ERROR "leaking param content: i$"
sink = **i // ERROR "\* \(\*i\) escapes to heap"
}
func caller7() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
p2 := &p // ERROR "&p escapes to heap$"
param7(&p2) // ERROR "caller7 &p2 does not escape"
}
// **in -> heap
func param8(i **int) { // ERROR "param8 i does not escape$"
sink = **i // ERROR "\* \(\*i\) escapes to heap"
}
func caller8() {
i := 0
p := &i // ERROR "caller8 &i does not escape$"
param8(&p) // ERROR "caller8 &p does not escape$"
}
// *in -> out
func param9(p ***int) **int { // ERROR "leaking param: p to result ~r1 level=1"
return *p
}
func caller9a() {
i := 0
p := &i // ERROR "caller9a &i does not escape"
p2 := &p // ERROR "caller9a &p does not escape"
_ = param9(&p2) // ERROR "caller9a &p2 does not escape$"
}
func caller9b() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
p2 := &p // ERROR "&p escapes to heap$"
sink = param9(&p2) // ERROR "caller9b &p2 does not escape$" "param9\(&p2\) escapes to heap"
}
// **in -> out
func param10(p ***int) *int { // ERROR "leaking param: p to result ~r1 level=2"
return **p
}
func caller10a() {
i := 0
p := &i // ERROR "caller10a &i does not escape"
p2 := &p // ERROR "caller10a &p does not escape"
_ = param10(&p2) // ERROR "caller10a &p2 does not escape$"
}
func caller10b() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$"
p2 := &p // ERROR "caller10b &p does not escape$"
sink = param10(&p2) // ERROR "caller10b &p2 does not escape$" "param10\(&p2\) escapes to heap"
}
// in escapes to heap (address of param taken and returned)
func param11(i **int) ***int { // ERROR "moved to heap: i$"
return &i // ERROR "&i escapes to heap$"
}
func caller11a() {
i := 0 // ERROR "moved to heap: i"
p := &i // ERROR "moved to heap: p" "&i escapes to heap"
_ = param11(&p) // ERROR "&p escapes to heap"
}
func caller11b() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
sink = param11(&p) // ERROR "&p escapes to heap$" "param11\(&p\) escapes to heap"
}
func caller11c() { // GOOD
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "moved to heap: p" "&i escapes to heap"
sink = *param11(&p) // ERROR "&p escapes to heap" "\*param11\(&p\) escapes to heap"
}
func caller11d() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap" "moved to heap: p"
p2 := &p // ERROR "&p escapes to heap"
sink = param11(p2) // ERROR "param11\(p2\) escapes to heap"
}
// &in -> rcvr
type Indir struct {
p ***int
}
func (r *Indir) param12(i **int) { // ERROR "\(\*Indir\).param12 r does not escape$" "moved to heap: i$"
r.p = &i // ERROR "&i escapes to heap$"
}
func caller12a() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
var r Indir
r.param12(&p) // ERROR "&p escapes to heap$" "caller12a r does not escape$"
_ = r
}
func caller12b() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
r := &Indir{} // ERROR "caller12b &Indir literal does not escape$"
r.param12(&p) // ERROR "&p escapes to heap$"
_ = r
}
func caller12c() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
r := Indir{}
r.param12(&p) // ERROR "&p escapes to heap$" "caller12c r does not escape$"
sink = r // ERROR "r escapes to heap$"
}
func caller12d() {
i := 0 // ERROR "moved to heap: i$"
p := &i // ERROR "&i escapes to heap$" "moved to heap: p$"
r := Indir{}
r.param12(&p) // ERROR "&p escapes to heap$" "caller12d r does not escape$"
sink = **r.p // ERROR "\* \(\*r\.p\) escapes to heap"
}
// in -> value rcvr
type Val struct {
p **int
}
func (v Val) param13(i *int) { // ERROR "Val.param13 v does not escape$" "leaking param: i$"
*v.p = i
}
func caller13a() {
i := 0 // ERROR "moved to heap: i$"
var p *int
var v Val
v.p = &p // ERROR "caller13a &p does not escape$"
v.param13(&i) // ERROR "&i escapes to heap$"
_ = v
}
func caller13b() {
i := 0 // ERROR "moved to heap: i$"
var p *int
v := Val{&p} // ERROR "caller13b &p does not escape$"
v.param13(&i) // ERROR "&i escapes to heap$"
_ = v
}
func caller13c() {
i := 0 // ERROR "moved to heap: i$"
var p *int
v := &Val{&p} // ERROR "caller13c &Val literal does not escape$" "caller13c &p does not escape$"
v.param13(&i) // ERROR "&i escapes to heap$"
_ = v
}
func caller13d() {
i := 0 // ERROR "moved to heap: i$"
var p *int // ERROR "moved to heap: p$"
var v Val
v.p = &p // ERROR "&p escapes to heap$"
v.param13(&i) // ERROR "&i escapes to heap$"
sink = v // ERROR "v escapes to heap$"
}
func caller13e() {
i := 0 // ERROR "moved to heap: i$"
var p *int // ERROR "moved to heap: p$"
v := Val{&p} // ERROR "&p escapes to heap$"
v.param13(&i) // ERROR "&i escapes to heap$"
sink = v // ERROR "v escapes to heap$"
}
func caller13f() {
i := 0 // ERROR "moved to heap: i$"
var p *int // ERROR "moved to heap: p$"
v := &Val{&p} // ERROR "&Val literal escapes to heap$" "&p escapes to heap$"
v.param13(&i) // ERROR "&i escapes to heap$"
sink = v // ERROR "v escapes to heap$"
}
func caller13g() {
i := 0 // ERROR "moved to heap: i$"
var p *int
v := Val{&p} // ERROR "caller13g &p does not escape$"
v.param13(&i) // ERROR "&i escapes to heap$"
sink = *v.p // ERROR "\*v\.p escapes to heap"
}
func caller13h() {
i := 0 // ERROR "moved to heap: i$"
var p *int
v := &Val{&p} // ERROR "caller13h &Val literal does not escape$" "caller13h &p does not escape$"
v.param13(&i) // ERROR "&i escapes to heap$"
sink = **v.p // ERROR "\* \(\*v\.p\) escapes to heap"
}
type Node struct {
p *Node
}
var Sink *Node
func f(x *Node) { // ERROR "leaking param content: x"
Sink = &Node{x.p} // ERROR "&Node literal escapes to heap"
}
func g(x *Node) *Node { // ERROR "leaking param: x to result ~r1 level=0"
return &Node{x.p} // ERROR "&Node literal escapes to heap"
}
func h(x *Node) { // ERROR "leaking param: x"
y := &Node{x} // ERROR "h &Node literal does not escape"
Sink = g(y)
f(y)
}
// interface(in) -> out
// See also issue 29353.
// Convert to a non-direct interface, require an allocation and
// copy x to heap (not to result).
func param14a(x [4]*int) interface{} { // ERROR "leaking param: x$"
return x // ERROR "x escapes to heap"
}
// Convert to a direct interface, does not need an allocation.
// So x only leaks to result.
func param14b(x *int) interface{} { // ERROR "leaking param: x to result ~r1 level=0"
return x // ERROR "x escapes to heap"
}