Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

go/constant, math/big: panic while constructing constant "1i/1E-612198397" #20227

Closed
josharian opened this issue May 3, 2017 · 6 comments
Closed

go/constant, math/big: panic while constructing constant "1i/1E-612198397" #20227

josharian opened this issue May 3, 2017 · 6 comments
Labels
FrozenDueToAge
Milestone
Go1.9

Comments

@josharian
Copy link
Contributor

Found by go-fuzz.

https://play.golang.org/p/YaALingKEW

package main

var e = 1i / 1E-612198397

func main() {
	print(e)
}

cmd/compile panics:

panic: division of zero by zero or infinity by infinity

goroutine 1 [running]:
math/big.(*Float).Quo(0xc42030bf90, 0xc42030bf90, 0xc420316720, 0xc42030bf90)
	/usr/local/go/src/math/big/float.go:1625 +0x129
cmd/compile/internal/gc.(*Mpflt).Quo(0xc42030bf90, 0xc420316720)
	/usr/local/go/src/cmd/compile/internal/gc/mpfloat.go:108 +0x3e
cmd/compile/internal/gc.cmplxdiv(0xc42030bf90, 0xc420322000)
	/usr/local/go/src/cmd/compile/internal/gc/const.go:1570 +0x262
cmd/compile/internal/gc.evconst(0xc420318cf0)
	/usr/local/go/src/cmd/compile/internal/gc/const.go:982 +0x2eeb
cmd/compile/internal/gc.typecheck1(0xc420318cf0, 0x2, 0xc420318f30)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:2127 +0x31b
cmd/compile/internal/gc.typecheck(0xc420318cf0, 0x2, 0xc420303260)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.typecheckas(0xc420318d80)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:3259 +0xab
cmd/compile/internal/gc.typecheck1(0xc420318d80, 0x1, 0x454003)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:1966 +0x3c92
cmd/compile/internal/gc.typecheck(0xc420318d80, 0x1, 0x3)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.Main()
	/usr/local/go/src/cmd/compile/internal/gc/main.go:360 +0x17d0
main.main()
	/usr/local/go/src/cmd/compile/main.go:50 +0xfe

go/types panics:

--- FAIL: TestBadComplexConstant (0.00s)
panic: division of zero by zero or infinity by infinity [recovered]
	panic: division of zero by zero or infinity by infinity [recovered]
	panic: division of zero by zero or infinity by infinity

goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
	/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b7d40, 0xc42004c980)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073db8)
	/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b7d40, 0xc42004c980)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Quo(0xc42007aff0, 0xc42007a270, 0xc42007a270, 0xc42007a270)
	/Users/josh/go/tip/src/math/big/float.go:1626 +0x11e
go/constant.BinaryOp(0x146a7a0, 0xc42007a270, 0xf, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
	/Users/josh/go/tip/src/go/constant/value.go:1058 +0x338
go/constant.quo(0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
	/Users/josh/go/tip/src/go/constant/value.go:1117 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a400, 0xf, 0x146a7a0, 0xc42007ad50, 0x1c, 0x0)
	/Users/josh/go/tip/src/go/constant/value.go:1096 +0x1541
go/types.(*Checker).binary(0xc4200e0000, 0xc420056c00, 0xc42007abd0, 0x1469520, 0xc42000a360, 0x1469520, 0xc42000a380, 0xf)
	/Users/josh/go/tip/src/go/types/expr.go:821 +0x662
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0xc42004c940)
	/Users/josh/go/tip/src/go/types/expr.go:1413 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/expr.go:949 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/expr.go:1485 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/expr.go:1479 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc4200857c0, 0xc42000c0a8, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc4200857c0, 0x0, 0xc420048d00, 0x0, 0x8)
	/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42004c950, 0x1, 0x1)
	/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0xc42007ac90, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420056bc0, 0x12f58ff, 0x1, 0xc420056b40, 0xc420048ee0, 0x1, 0x1, 0xc420085680, 0x0, 0xc420048f98, ...)
	/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestJosh(0xc4200de0f0)
	/Users/josh/go/tip/src/go/types/sizes_test.go:130 +0x31f
testing.tRunner(0xc4200de0f0, 0x130c2f8)
	/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
	/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
FAIL	go/types	0.010s

The real issues appear to be in go/constant and math/big.

Here's a standalone test case for go/constant:

func TestBadComplexConstant(t *testing.T) {
	i := MakeImag(MakeInt64(1))
	d := MakeFromLiteral("1E-612198397", token.FLOAT, 0)
	_ = BinaryOp(i, token.QUO, d) // should not panic
}

I haven't made a standalone test case for math/big yet.

cc @griesemer
@josharian josharian added this to the Go1.9 milestone May 3, 2017
@josharian
Copy link
Contributor Author

A variant, which only affects go/types (go/constant):

var g = 6e886451608i/2

cmd/compile:

tmp/sandbox861754843/main.go:3: constant too large: 6e886451608

go/types:

panic: multiplication of zero with infinity [recovered]
	panic: multiplication of zero with infinity [recovered]
	panic: multiplication of zero with infinity

goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
	/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b77e0, 0xc42004e9b0)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073d08)
	/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b77e0, 0xc42004e9b0)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Mul(0xc42000eed0, 0xc42000ee40, 0xc42000eea0, 0x13336f8)
	/Users/josh/go/tip/src/math/big/float.go:1581 +0x11b
go/constant.BinaryOp(0x146a7a0, 0xc42000ee40, 0xe, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
	/Users/josh/go/tip/src/go/constant/value.go:1056 +0x360
go/constant.mul(0x146a7a0, 0xc42000ee40, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
	/Users/josh/go/tip/src/go/constant/value.go:1116 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a4a0, 0xf, 0x146a7e0, 0xc420014478, 0x1170100, 0x1469a20)
	/Users/josh/go/tip/src/go/constant/value.go:1089 +0x1363
go/types.(*Checker).binary(0xc4200e0000, 0xc420058c40, 0xc42000ec30, 0x1469520, 0xc42000a320, 0x1469520, 0xc42000a340, 0xf)
	/Users/josh/go/tip/src/go/types/expr.go:817 +0x510
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0xc42000a420)
	/Users/josh/go/tip/src/go/types/expr.go:1409 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/expr.go:945 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/expr.go:1481 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/expr.go:1475 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc420085810, 0xc42000c0b0, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc420085810, 0x0, 0xc420073c50, 0x0, 0x8)
	/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42000a460, 0x2, 0x2)
	/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0xc42000ede0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420058c00, 0x12f539e, 0x1, 0xc420058b40, 0xc420073e30, 0x1, 0x1, 0xc4200856d0, 0x0, 0x2, ...)
	/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestIssue16902(0xc4200de0f0)
	/Users/josh/go/tip/src/go/types/sizes_test.go:106 +0x31f
testing.tRunner(0xc4200de0f0, 0x130bd20)
	/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
	/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
exit status 2
FAIL	go/types	0.011s

@josharian josharian mentioned this issue May 4, 2017
Open
@ALTree
Copy link
Member

ALTree commented May 4, 2017 •
edited
Loading

The problem is that we do complex div like this:

(a, b) / (c, d) = ((a*c + b*d), (b*c - a*d))/(c*c + d*d)

We check c != 0 or d != 0 before calling Quo, but we don't check that c*c is still nonzero before dividing. So when c = 1e-600000000, c is still in the accepted range but c*c is not, Mul underflows to 0 when computing c*c and since d is also zero we end up calling Quo with c*c + d*d == 0.

Precondition to cmplxdiv is that c and d are not both zero and cmplxdiv assumes that c² + d² > 0 follows, but that's not true because for very small c and zero d, c² + d² can be zero.

We can probably fix this by making cmplxdiv not trust Mul to return a nonzero value only because we called it with a nonzero value.

@ALTree
Copy link
Member

ALTree commented May 4, 2017

Or maybe we can change cmplxdiv to guarantee that it never underflows, for example see

Douglas M. Priest. 2004. Efficient scaling for complex division. ACM Trans. Math. Softw. 30, 4 (December 2004), 389-401. DOI=http://dx.doi.org/10.1145/1039813.1039814

@gopherbot
Copy link
Contributor

CL https://golang.org/cl/42650 mentions this issue.

gopherbot pushed a commit that referenced this issue May 18, 2017
@ALTree
cmd/compile: don't panic in complex division
2d1829b 
Updates #20227

Change-Id: Idadc3137490181a5d380367660cee21e8313cf3b
Reviewed-on: https://go-review.googlesource.com/42650
Run-TryBot: Alberto Donizetti <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Robert Griesemer <[email protected]>
@ALTree
Copy link
Member

ALTree commented May 18, 2017

CL 42650 (merged) turned the panic into an error message in the compiler.

The problem is still there for go/types. It can be solved but it's a little more awkward to do because zero divisors are caught in go/types while the actual division in performed in go/constant.

@gopherbot
Copy link
Contributor

CL https://golang.org/cl/44590 mentions this issue.

@ALTree ALTree mentioned this issue Jun 5, 2017
Closed
@golang golang locked and limited conversation to collaborators Jun 5, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
Go1.9
Development

No branches or pull requests
4 participants
@josharian @ALTree @griesemer @gopherbot