Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

go/constant, math/big: panic while constructing constant "1i/1E-612198397" #20227

Closed
josharian opened this issue May 3, 2017 · 6 comments
Closed
Milestone

Comments

@josharian
Copy link
Contributor

Found by go-fuzz.

https://play.golang.org/p/YaALingKEW

package main

var e = 1i / 1E-612198397

func main() {
	print(e)
}

cmd/compile panics:

panic: division of zero by zero or infinity by infinity

goroutine 1 [running]:
math/big.(*Float).Quo(0xc42030bf90, 0xc42030bf90, 0xc420316720, 0xc42030bf90)
	/usr/local/go/src/math/big/float.go:1625 +0x129
cmd/compile/internal/gc.(*Mpflt).Quo(0xc42030bf90, 0xc420316720)
	/usr/local/go/src/cmd/compile/internal/gc/mpfloat.go:108 +0x3e
cmd/compile/internal/gc.cmplxdiv(0xc42030bf90, 0xc420322000)
	/usr/local/go/src/cmd/compile/internal/gc/const.go:1570 +0x262
cmd/compile/internal/gc.evconst(0xc420318cf0)
	/usr/local/go/src/cmd/compile/internal/gc/const.go:982 +0x2eeb
cmd/compile/internal/gc.typecheck1(0xc420318cf0, 0x2, 0xc420318f30)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:2127 +0x31b
cmd/compile/internal/gc.typecheck(0xc420318cf0, 0x2, 0xc420303260)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.typecheckas(0xc420318d80)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:3259 +0xab
cmd/compile/internal/gc.typecheck1(0xc420318d80, 0x1, 0x454003)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:1966 +0x3c92
cmd/compile/internal/gc.typecheck(0xc420318d80, 0x1, 0x3)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.Main()
	/usr/local/go/src/cmd/compile/internal/gc/main.go:360 +0x17d0
main.main()
	/usr/local/go/src/cmd/compile/main.go:50 +0xfe

go/types panics:

--- FAIL: TestBadComplexConstant (0.00s)
panic: division of zero by zero or infinity by infinity [recovered]
	panic: division of zero by zero or infinity by infinity [recovered]
	panic: division of zero by zero or infinity by infinity

goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
	/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b7d40, 0xc42004c980)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073db8)
	/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b7d40, 0xc42004c980)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Quo(0xc42007aff0, 0xc42007a270, 0xc42007a270, 0xc42007a270)
	/Users/josh/go/tip/src/math/big/float.go:1626 +0x11e
go/constant.BinaryOp(0x146a7a0, 0xc42007a270, 0xf, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
	/Users/josh/go/tip/src/go/constant/value.go:1058 +0x338
go/constant.quo(0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
	/Users/josh/go/tip/src/go/constant/value.go:1117 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a400, 0xf, 0x146a7a0, 0xc42007ad50, 0x1c, 0x0)
	/Users/josh/go/tip/src/go/constant/value.go:1096 +0x1541
go/types.(*Checker).binary(0xc4200e0000, 0xc420056c00, 0xc42007abd0, 0x1469520, 0xc42000a360, 0x1469520, 0xc42000a380, 0xf)
	/Users/josh/go/tip/src/go/types/expr.go:821 +0x662
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0xc42004c940)
	/Users/josh/go/tip/src/go/types/expr.go:1413 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/expr.go:949 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/expr.go:1485 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/expr.go:1479 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc4200857c0, 0xc42000c0a8, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc4200857c0, 0x0, 0xc420048d00, 0x0, 0x8)
	/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42004c950, 0x1, 0x1)
	/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0xc42007ac90, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420056bc0, 0x12f58ff, 0x1, 0xc420056b40, 0xc420048ee0, 0x1, 0x1, 0xc420085680, 0x0, 0xc420048f98, ...)
	/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestJosh(0xc4200de0f0)
	/Users/josh/go/tip/src/go/types/sizes_test.go:130 +0x31f
testing.tRunner(0xc4200de0f0, 0x130c2f8)
	/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
	/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
FAIL	go/types	0.010s

The real issues appear to be in go/constant and math/big.

Here's a standalone test case for go/constant:

func TestBadComplexConstant(t *testing.T) {
	i := MakeImag(MakeInt64(1))
	d := MakeFromLiteral("1E-612198397", token.FLOAT, 0)
	_ = BinaryOp(i, token.QUO, d) // should not panic
}

I haven't made a standalone test case for math/big yet.

cc @griesemer

@josharian josharian added this to the Go1.9 milestone May 3, 2017
@josharian
Copy link
Contributor Author

A variant, which only affects go/types (go/constant):

var g = 6e886451608i/2 

cmd/compile:

tmp/sandbox861754843/main.go:3: constant too large: 6e886451608

go/types:

panic: multiplication of zero with infinity [recovered]
	panic: multiplication of zero with infinity [recovered]
	panic: multiplication of zero with infinity

goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
	/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b77e0, 0xc42004e9b0)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073d08)
	/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b77e0, 0xc42004e9b0)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Mul(0xc42000eed0, 0xc42000ee40, 0xc42000eea0, 0x13336f8)
	/Users/josh/go/tip/src/math/big/float.go:1581 +0x11b
go/constant.BinaryOp(0x146a7a0, 0xc42000ee40, 0xe, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
	/Users/josh/go/tip/src/go/constant/value.go:1056 +0x360
go/constant.mul(0x146a7a0, 0xc42000ee40, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
	/Users/josh/go/tip/src/go/constant/value.go:1116 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a4a0, 0xf, 0x146a7e0, 0xc420014478, 0x1170100, 0x1469a20)
	/Users/josh/go/tip/src/go/constant/value.go:1089 +0x1363
go/types.(*Checker).binary(0xc4200e0000, 0xc420058c40, 0xc42000ec30, 0x1469520, 0xc42000a320, 0x1469520, 0xc42000a340, 0xf)
	/Users/josh/go/tip/src/go/types/expr.go:817 +0x510
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0xc42000a420)
	/Users/josh/go/tip/src/go/types/expr.go:1409 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/expr.go:945 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/expr.go:1481 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/expr.go:1475 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc420085810, 0xc42000c0b0, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc420085810, 0x0, 0xc420073c50, 0x0, 0x8)
	/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42000a460, 0x2, 0x2)
	/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0xc42000ede0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420058c00, 0x12f539e, 0x1, 0xc420058b40, 0xc420073e30, 0x1, 0x1, 0xc4200856d0, 0x0, 0x2, ...)
	/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestIssue16902(0xc4200de0f0)
	/Users/josh/go/tip/src/go/types/sizes_test.go:106 +0x31f
testing.tRunner(0xc4200de0f0, 0x130bd20)
	/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
	/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
exit status 2
FAIL	go/types	0.011s

@ALTree
Copy link
Member

ALTree commented May 4, 2017

The problem is that we do complex div like this:

(a, b) / (c, d) = ((a*c + b*d), (b*c - a*d))/(c*c + d*d)

We check c != 0 or d != 0 before calling Quo, but we don't check that c*c is still nonzero before dividing. So when c = 1e-600000000, c is still in the accepted range but c*c is not, Mul underflows to 0 when computing c*c and since d is also zero we end up calling Quo with c*c + d*d == 0.

Precondition to cmplxdiv is that c and d are not both zero and cmplxdiv assumes that c² + d² > 0 follows, but that's not true because for very small c and zero d, c² + d² can be zero.

We can probably fix this by making cmplxdiv not trust Mul to return a nonzero value only because we called it with a nonzero value.

@ALTree
Copy link
Member

ALTree commented May 4, 2017

Or maybe we can change cmplxdiv to guarantee that it never underflows, for example see

Douglas M. Priest. 2004. Efficient scaling for complex division. ACM Trans. Math. Softw. 30, 4 (December 2004), 389-401. DOI=http://dx.doi.org/10.1145/1039813.1039814

@gopherbot
Copy link

CL https://golang.org/cl/42650 mentions this issue.

gopherbot pushed a commit that referenced this issue May 18, 2017
Updates #20227

Change-Id: Idadc3137490181a5d380367660cee21e8313cf3b
Reviewed-on: https://go-review.googlesource.com/42650
Run-TryBot: Alberto Donizetti <alb.donizetti@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Robert Griesemer <gri@golang.org>
@ALTree
Copy link
Member

ALTree commented May 18, 2017

CL 42650 (merged) turned the panic into an error message in the compiler.

The problem is still there for go/types. It can be solved but it's a little more awkward to do because zero divisors are caught in go/types while the actual division in performed in go/constant.

@gopherbot
Copy link

CL https://golang.org/cl/44590 mentions this issue.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants