Crashing staticcheck

[felixhuettner]

Staticcheck is build from master (currently 0a683c9)

-debug.version is

Compiled with Go version: go1.22.2
Main module:
        @
Dependencies:
        github.com/BurntSushi/toml@v1.3.2 (sum: h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=)
        golang.org/x/exp/typeparams@v0.0.0-20231108232855-2478ac86f678 (sum: h1:1P7xPZEwZMoBoz0Yze5Nx2/4pxj6nw9ZqHWXqP0iRgQ=)
        golang.org/x/mod@v0.14.0 (sum: h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=)
        golang.org/x/sys@v0.14.0 (sum: h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=)
        golang.org/x/tools@v0.15.0 (sum: h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=)
        honnef.co/go/tools

go version is: go version go1.22.2 linux/amd64

go env (with obfuscated personal values):

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/myhome/.cache/go-build'
GOENV='/home/myhome/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/myhome/go/pkg/mod'
GONOPROXY='my.special.repo'
GONOSUMDB='my.special.repo'
GOOS='linux'
GOPATH='/home/myhome/go'
GOPRIVATE='my.special.repo'
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/lib/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/lib/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.2'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/myhome/mycurrentpath/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build71081133=/tmp/go-build -gno-record-gcc-switches'

command that was ran: ./staticcheck cmd/main.go
output:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x720fd3]

goroutine 179 [running]:
honnef.co/go/tools/go/ir.replaceAll({0xa3bfa8, 0xc0006a8300}, {0x0, 0x0})
        /home/myhome/dev/upstream/go-tools/go/ir/lift.go:1306 +0x53
honnef.co/go/tools/go/ir.simplifyPhisAndSigmas({0xc0004d5290, 0x6, 0x6?}, {0xc0004d5320, 0x6, 0x3?})
        /home/myhome/dev/upstream/go-tools/go/ir/lift.go:546 +0x871
honnef.co/go/tools/go/ir.lift(0xc000692280)
        /home/myhome/dev/upstream/go-tools/go/ir/lift.go:315 +0x119a
honnef.co/go/tools/go/ir.(*Function).finishBody(0xc000692280)
        /home/myhome/dev/upstream/go-tools/go/ir/func.go:536 +0x386
honnef.co/go/tools/go/ir.(*builder).buildFunction(0xc000613a60, 0xc000692280)
        /home/myhome/dev/upstream/go-tools/go/ir/builder.go:2525 +0x4b2
honnef.co/go/tools/go/ir.(*builder).buildExits(0xc000613a60, 0xc000692140)
        /home/myhome/dev/upstream/go-tools/go/ir/exits.go:214 +0x13a5
honnef.co/go/tools/go/ir.(*builder).buildFunction(0xc000613a60, 0xc000692140)
        /home/myhome/dev/upstream/go-tools/go/ir/builder.go:2523 +0x48e
honnef.co/go/tools/go/ir.(*builder).buildFuncDecl(0xc00033fa60, 0xc0004d50e0, 0xc0001cf770)
        /home/myhome/dev/upstream/go-tools/go/ir/builder.go:2545 +0x189
honnef.co/go/tools/go/ir.(*Package).build(0xc0004d50e0)
        /home/myhome/dev/upstream/go-tools/go/ir/builder.go:2649 +0xb46
sync.(*Once).doSlow(0xc00017e000?, 0xc0002f5860?)
        /usr/lib/go/src/sync/once.go:74 +0xc2
sync.(*Once).Do(...)
        /usr/lib/go/src/sync/once.go:65
honnef.co/go/tools/go/ir.(*Package).Build(...)
        /home/myhome/dev/upstream/go-tools/go/ir/builder.go:2567
honnef.co/go/tools/internal/passes/buildir.run(0xc0004eab60)
        /home/myhome/dev/upstream/go-tools/internal/passes/buildir/buildir.go:86 +0x1b1
honnef.co/go/tools/lintcmd/runner.(*analyzerRunner).do(0xc0004268a0, {0xa3a158?, 0xc00033ac80})
        /home/myhome/dev/upstream/go-tools/lintcmd/runner/runner.go:992 +0x71b
honnef.co/go/tools/lintcmd/runner.genericHandle({0xa3a158, 0xc00033ac80}, {0xa3a158?, 0xc00033a960?}, 0xc000308480, 0xc000350cf0, 0xc000456120)
        /home/myhome/dev/upstream/go-tools/lintcmd/runner/runner.go:817 +0x11f
created by honnef.co/go/tools/lintcmd/runner.(*subrunner).runAnalyzers in goroutine 174
        /home/myhome/dev/upstream/go-tools/lintcmd/runner/runner.go:1061 +0x6a6

i guess i can skip the "what's wrong" part :)

We build a minimal reproducer.
This code obviously no longer makes logical sense, but is syntactically valid and can actually be executed (even though it is blocking forever).

go.mod:

module thisisjustfortesting

go 1.22.0

toolchain go1.22.2

cmd/main.go:

package main

import (
	"time"
)

func main() {
	HandleState(
		nil,
	)
}

type IndirectionStruct struct {
	StructMember *string
}

func HandleState(
	valueChan chan *string,
) (err error) {
	var currentIterationValue *string
	indirectionStruct := IndirectionStruct{}

	select {
	case currentIterationValue = <-valueChan:
	case <-time.After(time.Second * 3):
	}

	indirectionStruct.StructMember = currentIterationValue

	for {
		currentIterationValue = <-valueChan

		err = nil
		if false {
			continue
		}
	}
}

Each single part of the code seems to be required to trigger the crash. Including the very strange ineffective assignments at the end of the for loop.

When applying the following patch the crash goes away.
However i am completely unsure about potential negative side-effects of this patch.

diff --git a/go/ir/func.go b/go/ir/func.go
index 4449b405..7c2fa23d 100644
--- a/go/ir/func.go
+++ b/go/ir/func.go
@@ -588,6 +588,9 @@ func isUselessPhi(phi *Phi) (Value, bool) {
                        return nil, false
                }
        }
+       if v0 == nil {
+               return nil, false
+       }
        return v0, true
 }

Thank you

[dominikh]

Simpler reproducer:

func foo() (err error) {
	if true {
		println()
	}

	println()

	for {
		err = nil
	}
}

[felixhuettner]

Thanks a lot