cmd/compile: out of range integer in range loop crashes the compiler

[aykevl]

Go version

go version devel go1.22-8e658eee9c Wed Jan 17 03:56:30 2024 +0000 linux/arm64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='arm64'
GOBIN=''
GOCACHE='/home/ayke/.cache/go-build'
GOENV='/home/ayke/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='arm64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/ayke/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/ayke'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/ayke/src/tinygo/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/ayke/src/tinygo/go/pkg/tool/linux_arm64'
GOVCS=''
GOVERSION='devel go1.22-8e658eee9c Wed Jan 17 03:56:30 2024 +0000'
GCCGO='gccgo'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2139171962=/tmp/go-build -gno-record-gcc-switches'

What did you do?

I ran the following program in Go 1.22 (tip):

package main

func main() {
	for range 1 << 64 {
	}
}

On the Playground: https://go.dev/play/p/MCs2ntWII_I?v=gotip

What did you see happen?

The compiler crashes with the following stack trace:

# command-line-arguments
./test.go:4:6: internal compiler error: 18446744073709551616 out of range for uint

goroutine 21 [running]:
runtime/debug.Stack()
        ./src/runtime/debug/stack.go:24 +0x64
cmd/compile/internal/base.FatalfAt({0xabbaf8?, 0x0?}, {0x95b435, 0x16}, {0x40004ee6f8, 0x2, 0x2})
        ./src/cmd/compile/internal/base/print.go:225 +0x1fc
cmd/compile/internal/base.Fatalf(...)
        ./src/cmd/compile/internal/base/print.go:194
cmd/compile/internal/ir.IntVal(0x400047e480, {0xabbaf8?, 0x40000dea60?})
        ./src/cmd/compile/internal/ir/val.go:33 +0x1a0
cmd/compile/internal/ssagen.(*state).exprCheckPtr(0x4000210300, {0xac4818, 0x40004d0730}, 0x1)
        ./src/cmd/compile/internal/ssagen/ssa.go:2826 +0x9fc
cmd/compile/internal/ssagen.(*state).expr(...)
        ./src/cmd/compile/internal/ssagen/ssa.go:2756
cmd/compile/internal/ssagen.(*state).stmt(0x4000210300, {0xac4158, 0x40004d0d70})
        ./src/cmd/compile/internal/ssagen/ssa.go:1679 +0x5ce8
cmd/compile/internal/ssagen.(*state).stmtList(...)
        ./src/cmd/compile/internal/ssagen/ssa.go:1426
cmd/compile/internal/ssagen.(*state).stmt(0x4000210300, {0xac42d8, 0x40000d50a0})
        ./src/cmd/compile/internal/ssagen/ssa.go:1441 +0x210
cmd/compile/internal/ssagen.(*state).stmtList(...)
        ./src/cmd/compile/internal/ssagen/ssa.go:1426
cmd/compile/internal/ssagen.buildssa(0x40004c8fc0, 0x3)
        ./src/cmd/compile/internal/ssagen/ssa.go:555 +0x1f34
cmd/compile/internal/ssagen.Compile(0x40004c8fc0, 0x3)
        ./src/cmd/compile/internal/ssagen/pgen.go:216 +0x30
cmd/compile/internal/gc.compileFunctions.func5.1(0x40004d2080?)
        ./src/cmd/compile/internal/gc/compile.go:182 +0x3c
cmd/compile/internal/gc.compileFunctions.func3.1()
        ./src/cmd/compile/internal/gc/compile.go:164 +0x3c
created by cmd/compile/internal/gc.compileFunctions.func3 in goroutine 20
        ./src/cmd/compile/internal/gc/compile.go:163 +0x1e0

What did you expect to see?

This code should probably show a regular compiler error because the integer is out of range.

This is what the specification says:

For an integer value n, the iteration values 0 through n-1 are produced in increasing order, with the same type as n. If n <= 0, the loop does not run any iterations.

This doesn't explicitly say which type should be used for untyped integers. My assumption would be that it would be the same as this for example:

n := 5

...meaning that it would default to int (not uint as the stack trace suggests). uint would also seem reasonable to me for range loops, which would be a bit inconsistent but would make sense for range loops.

In fact, the following code does compile, but I'm not sure it should (it is out of range for int):

package main

func main() {
	for range 1 << 63 {
	}
}

[mauri870]

cc @golang/compiler

[cuonglm]

Related: #62466

types2 leaves 1 << 64 as untyped constant, then cmd/compile set idea type to uint. However, cmd/compile relies on types2 for reporting any overflow error mandated by the spec, causing this ICE.

cc @griesemer @mdempsky

[aykevl]

Just checked golang.org/x/tools/go/ssa and it just lets the integer silenty overflow, without error. Should I report that as a separate bug? (It does appear to use a signed integer though).

EDIT: looks more like a bug in go/types, because go vet also doesn't catch the error.

[gopherbot]

Change https://go.dev/cl/556295 mentions this issue: cmd/compile: check overflows in range over untyped integer

[griesemer]

Thanks for reporting. This is both a bug in the type checkers and an issue with the spec. In fact there are more issues here. See #65137.

[gopherbot]

Change https://go.dev/cl/556398 mentions this issue: types2: fix range clause checks for constant range expressions