go/constant, math/big: panic while constructing constant "1i/1E-612198397"
josharian opened this issue · 6 comments
Found by go-fuzz.
https://play.golang.org/p/YaALingKEW
package main
var e = 1i / 1E-612198397
func main() {
print(e)
}
cmd/compile panics:
panic: division of zero by zero or infinity by infinity
goroutine 1 [running]:
math/big.(*Float).Quo(0xc42030bf90, 0xc42030bf90, 0xc420316720, 0xc42030bf90)
/usr/local/go/src/math/big/float.go:1625 +0x129
cmd/compile/internal/gc.(*Mpflt).Quo(0xc42030bf90, 0xc420316720)
/usr/local/go/src/cmd/compile/internal/gc/mpfloat.go:108 +0x3e
cmd/compile/internal/gc.cmplxdiv(0xc42030bf90, 0xc420322000)
/usr/local/go/src/cmd/compile/internal/gc/const.go:1570 +0x262
cmd/compile/internal/gc.evconst(0xc420318cf0)
/usr/local/go/src/cmd/compile/internal/gc/const.go:982 +0x2eeb
cmd/compile/internal/gc.typecheck1(0xc420318cf0, 0x2, 0xc420318f30)
/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:2127 +0x31b
cmd/compile/internal/gc.typecheck(0xc420318cf0, 0x2, 0xc420303260)
/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.typecheckas(0xc420318d80)
/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:3259 +0xab
cmd/compile/internal/gc.typecheck1(0xc420318d80, 0x1, 0x454003)
/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:1966 +0x3c92
cmd/compile/internal/gc.typecheck(0xc420318d80, 0x1, 0x3)
/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.Main()
/usr/local/go/src/cmd/compile/internal/gc/main.go:360 +0x17d0
main.main()
/usr/local/go/src/cmd/compile/main.go:50 +0xfe
go/types panics:
--- FAIL: TestBadComplexConstant (0.00s)
panic: division of zero by zero or infinity by infinity [recovered]
panic: division of zero by zero or infinity by infinity [recovered]
panic: division of zero by zero or infinity by infinity
goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b7d40, 0xc42004c980)
/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073db8)
/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b7d40, 0xc42004c980)
/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Quo(0xc42007aff0, 0xc42007a270, 0xc42007a270, 0xc42007a270)
/Users/josh/go/tip/src/math/big/float.go:1626 +0x11e
go/constant.BinaryOp(0x146a7a0, 0xc42007a270, 0xf, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
/Users/josh/go/tip/src/go/constant/value.go:1058 +0x338
go/constant.quo(0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
/Users/josh/go/tip/src/go/constant/value.go:1117 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a400, 0xf, 0x146a7a0, 0xc42007ad50, 0x1c, 0x0)
/Users/josh/go/tip/src/go/constant/value.go:1096 +0x1541
go/types.(*Checker).binary(0xc4200e0000, 0xc420056c00, 0xc42007abd0, 0x1469520, 0xc42000a360, 0x1469520, 0xc42000a380, 0xf)
/Users/josh/go/tip/src/go/types/expr.go:821 +0x662
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0xc42004c940)
/Users/josh/go/tip/src/go/types/expr.go:1413 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0x0)
/Users/josh/go/tip/src/go/types/expr.go:949 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
/Users/josh/go/tip/src/go/types/expr.go:1485 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
/Users/josh/go/tip/src/go/types/expr.go:1479 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc4200857c0, 0xc42000c0a8, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42007abd0)
/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc4200857c0, 0x0, 0xc420048d00, 0x0, 0x8)
/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42004c950, 0x1, 0x1)
/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0x0, 0x0)
/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0xc42007ac90, 0x0)
/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420056bc0, 0x12f58ff, 0x1, 0xc420056b40, 0xc420048ee0, 0x1, 0x1, 0xc420085680, 0x0, 0xc420048f98, ...)
/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestJosh(0xc4200de0f0)
/Users/josh/go/tip/src/go/types/sizes_test.go:130 +0x31f
testing.tRunner(0xc4200de0f0, 0x130c2f8)
/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
FAIL go/types 0.010s
The real issues appear to be in go/constant and math/big.
Here's a standalone test case for go/constant:
func TestBadComplexConstant(t *testing.T) {
i := MakeImag(MakeInt64(1))
d := MakeFromLiteral("1E-612198397", token.FLOAT, 0)
_ = BinaryOp(i, token.QUO, d) // should not panic
}
I haven't made a standalone test case for math/big yet.
cc @griesemer
A variant, which only affects go/types (go/constant):
var g = 6e886451608i/2
cmd/compile:
tmp/sandbox861754843/main.go:3: constant too large: 6e886451608
go/types:
panic: multiplication of zero with infinity [recovered]
panic: multiplication of zero with infinity [recovered]
panic: multiplication of zero with infinity
goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b77e0, 0xc42004e9b0)
/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073d08)
/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b77e0, 0xc42004e9b0)
/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Mul(0xc42000eed0, 0xc42000ee40, 0xc42000eea0, 0x13336f8)
/Users/josh/go/tip/src/math/big/float.go:1581 +0x11b
go/constant.BinaryOp(0x146a7a0, 0xc42000ee40, 0xe, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
/Users/josh/go/tip/src/go/constant/value.go:1056 +0x360
go/constant.mul(0x146a7a0, 0xc42000ee40, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
/Users/josh/go/tip/src/go/constant/value.go:1116 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a4a0, 0xf, 0x146a7e0, 0xc420014478, 0x1170100, 0x1469a20)
/Users/josh/go/tip/src/go/constant/value.go:1089 +0x1363
go/types.(*Checker).binary(0xc4200e0000, 0xc420058c40, 0xc42000ec30, 0x1469520, 0xc42000a320, 0x1469520, 0xc42000a340, 0xf)
/Users/josh/go/tip/src/go/types/expr.go:817 +0x510
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0xc42000a420)
/Users/josh/go/tip/src/go/types/expr.go:1409 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0x0)
/Users/josh/go/tip/src/go/types/expr.go:945 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
/Users/josh/go/tip/src/go/types/expr.go:1481 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
/Users/josh/go/tip/src/go/types/expr.go:1475 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc420085810, 0xc42000c0b0, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42000ec30)
/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc420085810, 0x0, 0xc420073c50, 0x0, 0x8)
/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42000a460, 0x2, 0x2)
/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0x0, 0x0)
/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0xc42000ede0, 0x0)
/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420058c00, 0x12f539e, 0x1, 0xc420058b40, 0xc420073e30, 0x1, 0x1, 0xc4200856d0, 0x0, 0x2, ...)
/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestIssue16902(0xc4200de0f0)
/Users/josh/go/tip/src/go/types/sizes_test.go:106 +0x31f
testing.tRunner(0xc4200de0f0, 0x130bd20)
/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
exit status 2
FAIL go/types 0.011s
The problem is that we do complex div like this:
(a, b) / (c, d) = ((a*c + b*d), (b*c - a*d))/(c*c + d*d)
We check c != 0 or d != 0
before calling Quo
, but we don't check that c*c
is still nonzero before dividing. So when c = 1e-600000000
, c
is still in the accepted range but c*c
is not, Mul
underflows to 0
when computing c*c
and since d
is also zero we end up calling Quo
with c*c + d*d == 0
.
Precondition to cmplxdiv
is that c
and d
are not both zero and cmplxdiv
assumes that c² + d² > 0
follows, but that's not true because for very small c
and zero d
, c² + d²
can be zero.
We can probably fix this by making cmplxdiv
not trust Mul
to return a nonzero value only because we called it with a nonzero value.
Or maybe we can change cmplxdiv
to guarantee that it never underflows, for example see
Douglas M. Priest. 2004. Efficient scaling for complex division. ACM Trans. Math. Softw. 30, 4 (December 2004), 389-401. DOI=http://dx.doi.org/10.1145/1039813.1039814
CL https://golang.org/cl/42650 mentions this issue.
CL 42650 (merged) turned the panic into an error message in the compiler.
The problem is still there for go/types
. It can be solved but it's a little more awkward to do because zero divisors are caught in go/types
while the actual division in performed in go/constant
.
CL https://golang.org/cl/44590 mentions this issue.