math/big: TestAliasing/Exp-XZ panic in math/big.(*stack).nat

[prattmic]

#!watchflakes
default <- pkg == "math/big" && test ~ `^TestAliasing/Exp-`

https://ci.chromium.org/ui/p/golang/builders/ci/gotip-linux-amd64-clang15/b8721652960305067041/overview

panic: runtime error: slice bounds out of range [::-1] [recovered, reraised]

goroutine 247 gp=0xc00010a540 m=6 mp=0xc0001fe808 [running]:
panic({0x6c4360?, 0xc00015a0a8?})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/runtime/panic.go:802 +0x168 fp=0xc00026cdf0 sp=0xc00026cd40 pc=0x473988
testing.tRunner.func1.2({0x6c4360, 0xc00015a0a8})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/testing/testing.go:1740 +0x21c fp=0xc00026cea0 sp=0xc00026cdf0 pc=0x50d77c
testing.tRunner.func1()
	/home/swarming/.swarming/w/ir/x/w/goroot/src/testing/testing.go:1743 +0x363 fp=0xc00026d030 sp=0xc00026cea0 pc=0x50d183
panic({0x6c4360?, 0xc00015a0a8?})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/runtime/panic.go:783 +0x132 fp=0xc00026d0e0 sp=0xc00026d030 pc=0x473952
runtime.goPanicSlice3Acap(0xffffffffffffffff, 0x8)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/runtime/panic.go:175 +0x74 fp=0xc00026d120 sp=0xc00026d0e0 pc=0x43acb4
math/big.(*stack).nat(0xc0003b05d0?, 0x6aa0c0?)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/nat.go:324 +0x16d fp=0xc00026d180 sp=0xc00026d120 pc=0x5f424d
math/big.nat.rem({0xc0003b05f8?, 0x6?, 0x0?}, 0xc0002a2000, {0xc0003b0608, 0x1, 0x1}, {0xc0003b6680, 0x3, 0x7})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/natdiv.go:510 +0xf3 fp=0xc00026d250 sp=0xc00026d180 pc=0x5fbad3
math/big.nat.expNN({0xc0003b05f8?, 0x79f18232a0a0?, 0xc0003874e0?}, 0x475be9?, {0xc0003b0608, 0x1, 0x1}, {0xc0003b0618, 0x1, 0x1}, ...)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/nat.go:656 +0x40d fp=0xc00026d478 sp=0xc00026d250 pc=0x5f5fed
math/big.(*Int).exp(0xc0003ba000, 0xc0003ba020, 0x8?, 0xc0003ba060, 0x0)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/int.go:596 +0x4ab fp=0xc00026d5b0 sp=0xc00026d478 pc=0x5ed2cb
math/big.(*Int).Exp(...)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/int.go:565
math/big_test.TestAliasing.func7.1(0xc0003abee0?, 0x654d25?, 0xc0003abc00?)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/alias_test.go:205 +0x1f fp=0xc00026d5e8 sp=0xc00026d5b0 pc=0x65765f
math/big_test.checkAliasingTwoArgs(0xc00010b6c0, 0xc00026d800, 0xc0003ba000, 0xc0003ba020, 0xc0003ba060)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/alias_test.go:133 +0x58e fp=0xc00026d7d8 sp=0xc00026d5e8 pc=0x654b6e
math/big_test.TestAliasing.func7({0x0?}, {0x1?}, {0x0?}, {0x0?})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/alias_test.go:204 +0x39 fp=0xc00026d820 sp=0xc00026d7d8 pc=0x6575f9
runtime.call32(0xc0001ea810, 0xc000117160, 0x0, 0x0, 0x0, 0x20, 0xc00026da88)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/runtime/asm_amd64.s:774 +0x43 fp=0xc00026d850 sp=0xc00026d820 pc=0x479cc3
runtime.reflectcall(0x6d9de0?, 0xc0003ba060?, 0x4?, 0x6e4cd2?, 0x0?, 0x12?, 0x6d9de0?)
	<autogenerated>:1 +0x36 fp=0xc00026d890 sp=0xc00026d850 pc=0x47ddb6
reflect.Value.call({0x699b80?, 0xc000117160?, 0x75b1d8?}, {0x6dd8b8, 0x4}, {0xc000012060, 0x4, 0x3?})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/reflect/value.go:584 +0xcc6 fp=0xc00026ddd8 sp=0xc00026d890 pc=0x4cdac6
reflect.Value.Call({0x699b80?, 0xc000117160?, 0x8f12c0?}, {0xc000012060?, 0x699b80?, 0x8b1ca8?})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/reflect/value.go:368 +0xb9 fp=0xc00026de50 sp=0xc00026ddd8 pc=0x4ccd39
testing/quick.Check({0x699b80?, 0xc000117160?}, 0x8f12c0?)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/testing/quick/quick.go:290 +0x213 fp=0xc00026df10 sp=0xc00026de50 pc=0x5cd1d3
math/big_test.TestAliasing.func29(0xc000370380)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/math/big/alias_test.go:305 +0x151 fp=0xc00026df70 sp=0xc00026df10 pc=0x6568f1
testing.tRunner(0xc000370380, 0xc000366120)
	/home/swarming/.swarming/w/ir/x/w/goroot/src/testing/testing.go:1798 +0xea fp=0xc00026dfc0 sp=0xc00026df70 pc=0x50cd6a
testing.(*T).Run.gowrap1()
	/home/swarming/.swarming/w/ir/x/w/goroot/src/testing/testing.go:1857 +0x25 fp=0xc00026dfe0 sp=0xc00026dfc0 pc=0x50de25
runtime.goexit({})
	/home/swarming/.swarming/w/ir/x/w/goroot/src/runtime/asm_amd64.s:1692 +0x1 fp=0xc00026dfe8 sp=0xc00026dfe0 pc=0x47b541
created by testing.(*T).Run in goroutine 267
	/home/swarming/.swarming/w/ir/x/w/goroot/src/testing/testing.go:1857 +0x413

cc @rsc, given https://go.dev/cl/650638 just touched this area

[prattmic]

Marking as a release blocker just to make sure we take a look to see if this looks like a regression.

[gabyhelp]

Related Issues

• math/big: panic in big.Rat.SetString (`panic: impossible`) #42532 (closed)
• math/big: panic in big.Rat.SetString (`panic:impossible`) #42533 (closed)
• runtime: unexpected fault address in math/big #14591 (closed)
• runtime: TestStackOverflow panics on linux #11049 (closed)
• math/bits: TestDiv32PanicOverflow, fatal error: unexpected signal during runtime execution #37065 (closed)
• runtime: slice bounds out of range: panic during panic #44075 (closed)
• runtime: panic (slice bounds out of range) in runtime.gcInstallStackBarrier #11080 (closed)
• go/constant, math/big: panic while constructing constant "1i/1E-612198397" #20227 (closed)
• runtime: fatal error: unexpected signal during runtime execution #13046 (closed)
• go/types: SIGSEGV in (*Checker).exprInternal #37602

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Found new dashboard test flakes for:

#!watchflakes
default <- pkg == "math/big" && test == "TestAliasing/Exp-XZ"

2025-02-28 22:09 gotip-linux-amd64-clang15 go@68949049 math/big.TestAliasing/Exp-XZ (log)

=== RUN   TestAliasing/Exp-XZ
--- FAIL: TestAliasing/Exp-XZ (0.00s)

— watchflakes

[egonelbre]

Reproducers:

func TestRepro(t *testing.T) {
	t.Run("XY", func(t *testing.T) {
		v := new(big.Int).SetBytes([]byte{0x4b, 0xd2, 0x7a, 0x6c, 0xb3, 0x16, 0x5a, 0xf3, 0xa0, 0x45, 0x2b, 0xbe, 0x38, 0xba, 0x18, 0xb8, 0x70, 0xbb, 0xde, 0xd2, 0x20, 0xe9, 0xb9, 0x9d, 0x1d, 0xc6, 0x3e, 0xa, 0xa5, 0x60, 0x11, 0xcc, 0xb8, 0xff, 0x8e, 0x62})
		x := new(big.Int).SetBytes([]byte{0xb, 0x40, 0x70, 0x8b, 0x64, 0x78, 0x29, 0x9e, 0xd0})
		y := new(big.Int).SetBytes([]byte{0x1})
		z := new(big.Int).SetBytes([]byte{0xe, 0x91, 0x4d, 0xaa, 0x69, 0x60, 0x51, 0x42, 0x9, 0xa1, 0xf6, 0xfa, 0x5, 0x97, 0x1c, 0x5e, 0x18, 0xaa, 0x91, 0x87, 0x1f, 0xe4, 0x70, 0x84, 0x54, 0x97, 0x3a, 0xc9, 0xe1, 0x92, 0xd4, 0xf3, 0xdf, 0x79, 0x90, 0x18, 0xdd, 0xdf, 0x19, 0x44, 0xf3, 0xf, 0x9d, 0xa6, 0xf, 0xd9})
		v.Exp(x, y, z)
	})

	t.Run("XZ", func(t *testing.T) {
		v := new(big.Int).SetBytes([]byte{0x1, 0x6b, 0x8a, 0x26, 0x2, 0x1d, 0x3b, 0x4, 0x8d, 0x81, 0x85, 0xdb, 0x78, 0x4e, 0x81, 0xb7, 0xa7, 0xc0, 0x6e, 0xe7, 0xa0, 0xa, 0x54, 0x39, 0x3e, 0xa8, 0xb1, 0xe0, 0x0, 0xdb, 0x5a, 0x45, 0xde, 0xbf, 0xe2, 0xc8, 0x4d, 0x2b, 0x80, 0x65, 0x73, 0x5d, 0x6d, 0x65, 0x40, 0x50, 0xd4, 0x8})
		x := new(big.Int).SetBytes([]byte{0x7, 0xd6, 0x79, 0xc5, 0x30, 0xc2, 0x1f, 0x39, 0x5e, 0x3d, 0xd2, 0x52, 0xc6, 0xfb, 0xa7, 0xe2, 0x8a, 0x37, 0xdd})
		y := new(big.Int).SetBytes([]byte{0x1})
		z := new(big.Int).SetBytes([]byte{0x1c, 0x44, 0xba, 0x75, 0xfa, 0xe5, 0x3a, 0x56, 0xc0, 0x94, 0xa, 0x1e, 0x8f, 0xbd, 0xad, 0xdb, 0x17, 0xb8, 0x2b, 0x46, 0xf8, 0x69, 0xc1, 0x54, 0x25, 0x68, 0x53, 0xb5, 0xd5, 0x89, 0x6c, 0x16, 0xef, 0xf2, 0x83, 0x3e, 0x55, 0xa7, 0x54, 0x32, 0xbd, 0xa7, 0x70, 0x13, 0xa4, 0xfa})
		v.Exp(x, y, z)
	})

	t.Run("YZ", func(t *testing.T) {
		v := new(big.Int).SetBytes([]byte{0x2, 0x2a, 0xfc, 0x65, 0xc2, 0x66, 0xb1, 0x63, 0x56, 0xaf, 0x5c, 0x6, 0x4a, 0x19, 0x82, 0x6b, 0xaa, 0x90, 0x57, 0xd9, 0xd0, 0x3e, 0x83, 0xc8, 0x2a, 0x85, 0xe0})
		x := new(big.Int).SetBytes([]byte{0x8, 0x6f, 0xc5, 0x74, 0x83, 0x56, 0xa5, 0x6e, 0xfe, 0x7b, 0x32, 0xfb, 0x69, 0x4, 0x3, 0x51, 0xf5, 0x2c, 0x41, 0x7, 0xf7, 0xbb, 0x89, 0x8e})
		y := new(big.Int).SetBytes([]byte{0x1})
		z := new(big.Int).SetBytes([]byte{0x34, 0xe1, 0x5f, 0xd0, 0xa7, 0xf8, 0x34, 0x7c, 0x3c, 0x63, 0x82, 0x1e, 0xc3, 0x84, 0x9f, 0xa, 0x70, 0x22, 0xd3, 0xc8, 0x24, 0x64, 0x2b, 0xd7, 0x59, 0x20, 0xf2, 0xdd, 0xb5, 0xb2, 0xfa, 0x11, 0x2e, 0x98, 0x95})
		v.Exp(x, y, z)
	})
}

Can also be triggered via go test -run Aliasing -quickchecks 100000.

Related issues #72085 and #72093

[egonelbre]

Seems the panic was introduced in 872496d. CC @rsc

[gopherbot]

Change https://go.dev/cl/655156 mentions this issue: math/big: avoid negative slice size in nat.rem