go/constant, math/big: panic while constructing constant "1i/1E-612198397"

[josharian]

Found by go-fuzz.

https://play.golang.org/p/YaALingKEW

package main

var e = 1i / 1E-612198397

func main() {
	print(e)
}

cmd/compile panics:

panic: division of zero by zero or infinity by infinity

goroutine 1 [running]:
math/big.(*Float).Quo(0xc42030bf90, 0xc42030bf90, 0xc420316720, 0xc42030bf90)
	/usr/local/go/src/math/big/float.go:1625 +0x129
cmd/compile/internal/gc.(*Mpflt).Quo(0xc42030bf90, 0xc420316720)
	/usr/local/go/src/cmd/compile/internal/gc/mpfloat.go:108 +0x3e
cmd/compile/internal/gc.cmplxdiv(0xc42030bf90, 0xc420322000)
	/usr/local/go/src/cmd/compile/internal/gc/const.go:1570 +0x262
cmd/compile/internal/gc.evconst(0xc420318cf0)
	/usr/local/go/src/cmd/compile/internal/gc/const.go:982 +0x2eeb
cmd/compile/internal/gc.typecheck1(0xc420318cf0, 0x2, 0xc420318f30)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:2127 +0x31b
cmd/compile/internal/gc.typecheck(0xc420318cf0, 0x2, 0xc420303260)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.typecheckas(0xc420318d80)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:3259 +0xab
cmd/compile/internal/gc.typecheck1(0xc420318d80, 0x1, 0x454003)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:1966 +0x3c92
cmd/compile/internal/gc.typecheck(0xc420318d80, 0x1, 0x3)
	/usr/local/go/src/cmd/compile/internal/gc/typecheck.go:188 +0x608
cmd/compile/internal/gc.Main()
	/usr/local/go/src/cmd/compile/internal/gc/main.go:360 +0x17d0
main.main()
	/usr/local/go/src/cmd/compile/main.go:50 +0xfe

go/types panics:

--- FAIL: TestBadComplexConstant (0.00s)
panic: division of zero by zero or infinity by infinity [recovered]
	panic: division of zero by zero or infinity by infinity [recovered]
	panic: division of zero by zero or infinity by infinity

goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
	/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b7d40, 0xc42004c980)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073db8)
	/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b7d40, 0xc42004c980)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Quo(0xc42007aff0, 0xc42007a270, 0xc42007a270, 0xc42007a270)
	/Users/josh/go/tip/src/math/big/float.go:1626 +0x11e
go/constant.BinaryOp(0x146a7a0, 0xc42007a270, 0xf, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
	/Users/josh/go/tip/src/go/constant/value.go:1058 +0x338
go/constant.quo(0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270, 0x146a7a0, 0xc42007a270)
	/Users/josh/go/tip/src/go/constant/value.go:1117 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a400, 0xf, 0x146a7a0, 0xc42007ad50, 0x1c, 0x0)
	/Users/josh/go/tip/src/go/constant/value.go:1096 +0x1541
go/types.(*Checker).binary(0xc4200e0000, 0xc420056c00, 0xc42007abd0, 0x1469520, 0xc42000a360, 0x1469520, 0xc42000a380, 0xf)
	/Users/josh/go/tip/src/go/types/expr.go:821 +0x662
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0xc42004c940)
	/Users/josh/go/tip/src/go/types/expr.go:1413 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0, 0x0, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/expr.go:949 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/expr.go:1485 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420056c00, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/expr.go:1479 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc4200857c0, 0xc42000c0a8, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42007abd0)
	/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc4200857c0, 0x0, 0xc420048d00, 0x0, 0x8)
	/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42004c950, 0x1, 0x1)
	/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420048ee0, 0x1, 0x1, 0xc42007ac90, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420056bc0, 0x12f58ff, 0x1, 0xc420056b40, 0xc420048ee0, 0x1, 0x1, 0xc420085680, 0x0, 0xc420048f98, ...)
	/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestJosh(0xc4200de0f0)
	/Users/josh/go/tip/src/go/types/sizes_test.go:130 +0x31f
testing.tRunner(0xc4200de0f0, 0x130c2f8)
	/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
	/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
FAIL	go/types	0.010s

The real issues appear to be in go/constant and math/big.

Here's a standalone test case for go/constant:

func TestBadComplexConstant(t *testing.T) {
	i := MakeImag(MakeInt64(1))
	d := MakeFromLiteral("1E-612198397", token.FLOAT, 0)
	_ = BinaryOp(i, token.QUO, d) // should not panic
}

I haven't made a standalone test case for math/big yet.

cc @griesemer

[josharian]

A variant, which only affects go/types (go/constant):

var g = 6e886451608i/2 

cmd/compile:

tmp/sandbox861754843/main.go:3: constant too large: 6e886451608

go/types:

panic: multiplication of zero with infinity [recovered]
	panic: multiplication of zero with infinity [recovered]
	panic: multiplication of zero with infinity

goroutine 5 [running]:
testing.tRunner.func1(0xc4200de0f0)
	/Users/josh/go/tip/src/testing/testing.go:712 +0x256
panic(0x12b77e0, 0xc42004e9b0)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
go/types.(*Checker).handleBailout(0xc4200e0000, 0xc420073d08)
	/Users/josh/go/tip/src/go/types/check.go:225 +0xa4
panic(0x12b77e0, 0xc42004e9b0)
	/Users/josh/go/tip/src/runtime/panic.go:489 +0x259
math/big.(*Float).Mul(0xc42000eed0, 0xc42000ee40, 0xc42000eea0, 0x13336f8)
	/Users/josh/go/tip/src/math/big/float.go:1581 +0x11b
go/constant.BinaryOp(0x146a7a0, 0xc42000ee40, 0xe, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
	/Users/josh/go/tip/src/go/constant/value.go:1056 +0x360
go/constant.mul(0x146a7a0, 0xc42000ee40, 0x146a7e0, 0x13336f8, 0x146a7e0, 0x14a5e20)
	/Users/josh/go/tip/src/go/constant/value.go:1116 +0x52
go/constant.BinaryOp(0x146a760, 0xc42000a4a0, 0xf, 0x146a7e0, 0xc420014478, 0x1170100, 0x1469a20)
	/Users/josh/go/tip/src/go/constant/value.go:1089 +0x1363
go/types.(*Checker).binary(0xc4200e0000, 0xc420058c40, 0xc42000ec30, 0x1469520, 0xc42000a320, 0x1469520, 0xc42000a340, 0xf)
	/Users/josh/go/tip/src/go/types/expr.go:817 +0x510
go/types.(*Checker).exprInternal(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0xc42000a420)
	/Users/josh/go/tip/src/go/types/expr.go:1409 +0x1d64
go/types.(*Checker).rawExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30, 0x0, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/expr.go:945 +0x81
go/types.(*Checker).multiExpr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/expr.go:1481 +0x62
go/types.(*Checker).expr(0xc4200e0000, 0xc420058c40, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/expr.go:1475 +0x49
go/types.(*Checker).varDecl(0xc4200e0000, 0xc420085810, 0xc42000c0b0, 0x1, 0x1, 0x0, 0x0, 0x1469560, 0xc42000ec30)
	/Users/josh/go/tip/src/go/types/decl.go:166 +0x27c
go/types.(*Checker).objDecl(0xc4200e0000, 0x146c2c0, 0xc420085810, 0x0, 0xc420073c50, 0x0, 0x8)
	/Users/josh/go/tip/src/go/types/decl.go:81 +0x223
go/types.(*Checker).packageObjects(0xc4200e0000, 0xc42000a460, 0x2, 0x2)
	/Users/josh/go/tip/src/go/types/resolver.go:457 +0x105
go/types.(*Checker).checkFiles(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0x0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:239 +0xdb
go/types.(*Checker).Files(0xc4200e0000, 0xc420073e30, 0x1, 0x1, 0xc42000ede0, 0x0)
	/Users/josh/go/tip/src/go/types/check.go:230 +0x49
go/types.(*Config).Check(0xc420058c00, 0x12f539e, 0x1, 0xc420058b40, 0xc420073e30, 0x1, 0x1, 0xc4200856d0, 0x0, 0x2, ...)
	/Users/josh/go/tip/src/go/types/api.go:351 +0x1b3
go/types_test.TestIssue16902(0xc4200de0f0)
	/Users/josh/go/tip/src/go/types/sizes_test.go:106 +0x31f
testing.tRunner(0xc4200de0f0, 0x130bd20)
	/Users/josh/go/tip/src/testing/testing.go:747 +0xd0
created by testing.(*T).Run
	/Users/josh/go/tip/src/testing/testing.go:789 +0x2de
exit status 2
FAIL	go/types	0.011s

[ALTree]

The problem is that we do complex div like this:

(a, b) / (c, d) = ((a*c + b*d), (b*c - a*d))/(c*c + d*d)

We check c != 0 or d != 0 before calling Quo, but we don't check that c*c is still nonzero before dividing. So when c = 1e-600000000, c is still in the accepted range but c*c is not, Mul underflows to 0 when computing c*c and since d is also zero we end up calling Quo with c*c + d*d == 0.

Precondition to cmplxdiv is that c and d are not both zero and cmplxdiv assumes that c² + d² > 0 follows, but that's not true because for very small c and zero d, c² + d² can be zero.

We can probably fix this by making cmplxdiv not trust Mul to return a nonzero value only because we called it with a nonzero value.

[ALTree]

Or maybe we can change cmplxdiv to guarantee that it never underflows, for example see

Douglas M. Priest. 2004. Efficient scaling for complex division. ACM Trans. Math. Softw. 30, 4 (December 2004), 389-401. DOI=http://dx.doi.org/10.1145/1039813.1039814

[gopherbot]

CL https://golang.org/cl/42650 mentions this issue.

[ALTree]

CL 42650 (merged) turned the panic into an error message in the compiler.

The problem is still there for go/types. It can be solved but it's a little more awkward to do because zero divisors are caught in go/types while the actual division in performed in go/constant.

[gopherbot]

CL https://golang.org/cl/44590 mentions this issue.