Description
What version of Go are you using (go version)?
My local go version used for the fuzzing:
$ go version
go version devel +4ba19b0188 Wed Jun 17 00:44:16 2020 +0000 linux/amd64
Does this issue reproduce with the latest release?
Yes with a recent git checkout dev.go2go
What operating system and processor architecture are you using (go env)?
linux/amd64
What did you do?
I tried fuzzing the type checker from the dev.go2go branch for a short period of time (roughly around 45 minutes) and was able to generate a variety of crashes. Here are six samples.
I realize this is still early days, and I suspect it is much more useful to have crashes or panics from code that actual humans wrote, but posting these examples of crashes in case there is interest in hardending against more corner cases, or perhaps using some as test cases in the future.
I was running fzgo, which is a prototype of making fuzzing a first class citizen in the go command (#19109).
The engine underneath fzgo is @dvyukov's go-fuzz. I can post the fuzz function later if interested, but it was a cut down and slightly tweaked fuzz function adapted from https://github.com/dvyukov/go-fuzz-corpus/tree/master/gotypes.
These all crash on the current go2goplay.golang.org:
Crash 1: invalid memory address or nil pointer dereference
go/types.(*Checker).instantiate
package main
type nt(type )interface{g}
type ph(type e nt,g(d))s
func(*ph(e,e))h(d)
http://go2goplay.golang.org/p/7Jk4PT9GX3k
Crash 2: invalid memory address or nil pointer dereference
go/types.optype
package main
type Numeric interface{t}
func t(type T Numeric)(s[]T){0(){s[0][0]}}
https://go2goplay.golang.org/p/46EZOUKBLLu
Crash 3: invalid memory address or nil pointer dereference
go/types.IsInterface
package main
type d*interface{d.p}
https://go2goplay.golang.org/p/HChlkK2A_Di
Crash 4: invalid memory address or nil pointer dereference
go/types.(*Interface).Complete
package main
type Numeric interface{t}
func t(type T Numeric)(s[]T){if(0){*s[0]}}
https://go2goplay.golang.org/p/TwoY4k9kR1w
Crash 5: panic: multiplication of zero with infinity
math/big.(*Float).Mul
package main
func X(){7E700000000*0}
https://go2goplay.golang.org/p/avwOXp4HJrC
Crash 6: panic: assertion failed
go/types.(*Checker).shift
package main
func X(){0<<7E6000000000}
https://go2goplay.golang.org/p/pv_BlSJ9v5W
(Side note: it would be nice to be able to issue commands like go test -fuzz=. ./... (#19109) on the stdlib and elsewhere ;-)