"panic: runtime error: index out of range" when dealing with git repo without HEAD

[Minnozz]

What version of Go (go version) and dep (git describe --tags) are you using?

$ go version
go version go1.8.3 darwin/amd64

$ git describe --tags
v0.3.0-151-g1f6d6bb

What dep command did you run?

$ dep ensure -v
Root project is "<acme>/source/<foo>.git"
 3 transitively valid internal packages
 7 external packages imported from 7 projects
(0)   ✓ select (root)
(1)	? attempt github.com/go-sql-driver/mysql with 1 pkgs; at least 1 versions to try
(1)	    try github.com/go-sql-driver/mysql@v1.3
(1)	✓ select github.com/go-sql-driver/mysql@v1.3 w/1 pkgs
(2)	? attempt github.com/kr/beanstalk with 1 pkgs; at least 1 versions to try
(2)	    try github.com/kr/beanstalk@master
(2)	✓ select github.com/kr/beanstalk@master w/1 pkgs
(3)	? attempt github.com/spf13/viper with 1 pkgs; at least 1 versions to try
(3)	    try github.com/spf13/viper@v1.0.0
panic: runtime error: index out of range

goroutine 35 [running]:
github.com/golang/dep/internal/gps.(*gitSource).listVersions(0xc420289270, 0x16d7bc0, 0xc42028c2d0, 0x1010f98, 0x10, 0x1470d80, 0xc420049801, 0xc420289280)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/vcs_source.go:231 +0xd48
github.com/golang/dep/internal/gps.maybeGitSource.try.func1(0x16d7bc0, 0xc42028c2d0, 0x16d78c0, 0xc420266700)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/maybe_source.go:106 +0x71
github.com/golang/dep/internal/gps.(*supervisor).do(0xc420287b90, 0x16d7900, 0xc4200146d8, 0x14d8826, 0xc, 0x1, 0xc420049938, 0xc42000e1c8, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:618 +0xd5
github.com/golang/dep/internal/gps.maybeGitSource.try(0xc42021cf00, 0x16d7900, 0xc4200146d8, 0xc42028a180, 0x16, 0x16daa20, 0xc420266780, 0xc420287b90, 0x0, 0x0, ...)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/maybe_source.go:110 +0x212
github.com/golang/dep/internal/gps.maybeSources.try(0xc4201d3e80, 0x4, 0x4, 0x16d7900, 0xc4200146d8, 0xc42028a180, 0x16, 0x16daa20, 0xc420266780, 0xc420287b90, ...)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/maybe_source.go:35 +0xf1
github.com/golang/dep/internal/gps.(*maybeSources).try(0xc4202c65a0, 0x16d7900, 0xc4200146d8, 0xc42028a180, 0x16, 0x16daa20, 0xc420266780, 0xc420287b90, 0x100eb93, 0xc42003abd0, ...)
	<autogenerated>:216 +0xc7
github.com/golang/dep/internal/gps.(*sourceGateway).require(0xc42001bb00, 0x16d7900, 0xc4200146d8, 0x1, 0x40, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source.go:489 +0x243
github.com/golang/dep/internal/gps.(*sourceGateway).sourceURL(0xc42001bb00, 0x16d7900, 0xc4200146d8, 0x0, 0x0, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source.go:457 +0xbc
github.com/golang/dep/internal/gps.(*sourceCoordinator).getSourceGatewayFor(0xc42001b800, 0x16d7900, 0xc4200146d8, 0xc4201d3101, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source.go:156 +0xcc3
github.com/golang/dep/internal/gps.(*SourceMgr).SyncSourceFor(0xc42001b8c0, 0xc4201d3101, 0x31, 0x0, 0x0, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:462 +0x8b
github.com/golang/dep/internal/gps.(*bridge).SyncSourceFor(0xc4202a8780, 0xc4201d3101, 0x31, 0x0, 0x0, 0xc4202c0d80, 0x7)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/bridge.go:219 +0x5b
created by github.com/golang/dep/internal/gps.(*solver).selectRoot
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/solver.go:557 +0x87f

$ dep hash-inputs
-CONSTRAINTS-
github.com/go-sql-driver/mysql
svc-^1.3.0
github.com/kr/beanstalk
b-master
github.com/spf13/pflag
svc-^1.0.0
github.com/spf13/viper
svc-^1.0.0
<acme>/source/<bar>.git
b-develop
<acme>/source/<baz>.git
b-develop
-IMPORTS/REQS-
github.com/go-sql-driver/mysql
github.com/kr/beanstalk
github.com/spf13/pflag
github.com/spf13/viper
<acme>/source/<bar>.git
<acme>/source/<qux>.git
<acme>/source/<baz>.git
-IGNORES-
-OVERRIDES-
-ANALYZER-
dep
1

What did you expect to see?

Normal dep ensure function

What did you see instead?

A panic

[Minnozz]

This panic seems to be triggered by adding a new import in one of the source files (another internal package, like the <acme> packages above) and then running dep ensure (without editing Gopkg.toml first).

[Minnozz]

Removing the new import from the source file and running dep ensure -add first results in dep hanging indefinitely:

$ dep ensure -v -add <acme>/source/<quux>.git 
^\SIGQUIT: quit
PC=0x105716b m=0 sigcode=0

goroutine 0 [idle]:
runtime.mach_semaphore_wait(0xf03, 0x7fff5fbff848, 0x1040ffa, 0x800, 0x0, 0x17073a0, 0x7fff5fbff858, 0x1051583, 0xffffffffffffffff, 0x0, ...)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/sys_darwin_amd64.s:415 +0xb
runtime.semasleep1(0xffffffffffffffff, 0x0)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/os_darwin.go:413 +0x4b
runtime.semasleep.func1()
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/os_darwin.go:432 +0x33
runtime.systemstack(0x7fff5fbff880)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/asm_amd64.s:343 +0xab
runtime.semasleep(0xffffffffffffffff, 0x1052415)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/os_darwin.go:433 +0x4d
runtime.notesleep(0x1707a30)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/lock_sema.go:166 +0xb2
runtime.stopm()
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/proc.go:1650 +0xad
runtime.findrunnable(0xc42001e600, 0x0)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/proc.go:2102 +0x2e4
runtime.schedule()
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/proc.go:2222 +0x14c
runtime.goexit0(0xc420204ea0)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/proc.go:2359 +0x238
runtime.mcall(0x7fff5fbffa50)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/asm_amd64.s:269 +0x5b

goroutine 1 [semacquire]:
sync.runtime_notifyListWait(0xc42028b530, 0xc400000000)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/sema.go:298 +0x10b
sync.(*Cond).Wait(0xc42028b520)
	/usr/local/Cellar/go/1.8.3/libexec/src/sync/cond.go:57 +0x89
github.com/golang/dep/internal/gps.(*supervisor).wait(0xc42028b500)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:690 +0x57
github.com/golang/dep/internal/gps.(*SourceMgr).doRelease(0xc4201ae7e0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:350 +0x41
github.com/golang/dep/internal/gps.(*SourceMgr).Release.func1()
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:340 +0x2a
sync.(*Once).Do(0xc4201ae828, 0xc42011a010)
	/usr/local/Cellar/go/1.8.3/libexec/src/sync/once.go:44 +0xbe
github.com/golang/dep/internal/gps.(*SourceMgr).Release(0xc4201ae7e0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:340 +0x64
panic(0x145cb80, 0x16fc9a0)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/panic.go:489 +0x2cf
github.com/golang/dep/internal/gps.(*gitSource).listVersions(0xc42028cd10, 0x16d7bc0, 0xc4202dc1e0, 0x1010f98, 0x10, 0x1470d80, 0xc42011a401, 0xc42028cd20)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/vcs_source.go:231 +0xd48
github.com/golang/dep/internal/gps.maybeGitSource.try.func1(0x16d7bc0, 0xc4202dc1e0, 0x16d78c0, 0xc4201930c0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/maybe_source.go:106 +0x71
github.com/golang/dep/internal/gps.(*supervisor).do(0xc42028b500, 0x16d7900, 0xc4200146d8, 0x14d8826, 0xc, 0x1, 0xc42011a608, 0xc4201b01b8, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:618 +0xd5
github.com/golang/dep/internal/gps.maybeGitSource.try(0xc4202d0780, 0x16d7900, 0xc4200146d8, 0xc420289740, 0x16, 0x16daa20, 0xc4202ced40, 0xc42028b500, 0x0, 0x0, ...)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/maybe_source.go:110 +0x212
github.com/golang/dep/internal/gps.maybeSources.try(0xc4202ced00, 0x4, 0x4, 0x16d7900, 0xc4200146d8, 0xc420289740, 0x16, 0x16daa20, 0xc4202ced40, 0xc42028b500, ...)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/maybe_source.go:35 +0xf1
github.com/golang/dep/internal/gps.(*maybeSources).try(0xc4202ab4e0, 0x16d7900, 0xc4200146d8, 0xc420289740, 0x16, 0x16daa20, 0xc4202ced40, 0xc42028b500, 0x100eb93, 0xc42011a8a0, ...)
	<autogenerated>:216 +0xc7
github.com/golang/dep/internal/gps.(*sourceGateway).require(0xc4201afb60, 0x16d7900, 0xc4200146d8, 0x1, 0x40, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source.go:489 +0x243
github.com/golang/dep/internal/gps.(*sourceGateway).sourceURL(0xc4201afb60, 0x16d7900, 0xc4200146d8, 0x0, 0x0, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source.go:457 +0xbc
github.com/golang/dep/internal/gps.(*sourceCoordinator).getSourceGatewayFor(0xc4201ae720, 0x16d7900, 0xc4200146d8, 0x7fff5fbffbeb, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source.go:156 +0xcc3
github.com/golang/dep/internal/gps.(*SourceMgr).SyncSourceFor(0xc4201ae7e0, 0x7fff5fbffbeb, 0x31, 0x0, 0x0, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:462 +0x8b
main.(*ensureCommand).runAdd(0xc420139880, 0xc4200118b0, 0xc420010220, 0x1, 0x1, 0xc420135a40, 0x16da520, 0xc4201ae7e0, 0xc420010144, 0x3e, ...)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/cmd/dep/ensure.go:467 +0x7a7
main.(*ensureCommand).Run(0xc420139880, 0xc4200118b0, 0xc420010220, 0x1, 0x1, 0x0, 0x0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/cmd/dep/ensure.go:175 +0x4db
main.(*Config).Run(0xc420019020, 0xc420019020)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/cmd/dep/main.go:158 +0x855
main.main()
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/cmd/dep/main.go:45 +0x253

goroutine 17 [syscall, locked to thread]:
runtime.goexit()
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/asm_amd64.s:2197 +0x1

goroutine 5 [syscall]:
os/signal.signal_recv(0x0)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/sigqueue.go:116 +0xff
os/signal.loop()
	/usr/local/Cellar/go/1.8.3/libexec/src/os/signal/signal_unix.go:22 +0x22
created by os/signal.init.1
	/usr/local/Cellar/go/1.8.3/libexec/src/os/signal/signal_unix.go:28 +0x41

goroutine 20 [select, locked to thread]:
runtime.gopark(0x14f18d0, 0x0, 0x14d5f24, 0x6, 0x18, 0x2)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/proc.go:271 +0x13a
runtime.selectgoImpl(0xc420028750, 0x0, 0x18)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/select.go:423 +0x1364
runtime.selectgo(0xc420028750)
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/select.go:238 +0x1c
runtime.ensureSigM.func1()
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/signal_unix.go:434 +0x265
runtime.goexit()
	/usr/local/Cellar/go/1.8.3/libexec/src/runtime/asm_amd64.s:2197 +0x1

goroutine 21 [select]:
github.com/golang/dep/internal/gps.(*SourceMgr).HandleSignals.func1(0xc4201ae7e0, 0xc4201ae840, 0xc4201ae9c0)
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:259 +0x26f
created by github.com/golang/dep/internal/gps.(*SourceMgr).HandleSignals
	/private/tmp/dep-20170804-6202-1xy28iy/dep-0.3.0/src/github.com/golang/dep/internal/gps/source_manager.go:295 +0xb1

rax    0xe
rbx    0x1707920
rcx    0x7fff5fbff7f8
rdx    0x7fff5fbff880
rdi    0xf03
rsi    0x1
rbp    0x7fff5fbff830
rsp    0x7fff5fbff7f8
r8     0x2
r9     0x20
r10    0xc42001e650
r11    0x286
r12    0x0
r13    0x8
r14    0x0
r15    0xf3
rip    0x105716b
rflags 0x286
cs     0x7
fs     0x0
gs     0x0

[Minnozz]

Sorry for the spam. After some digging, I discovered that the git repository for the new dependency I'm trying to add does not have a HEAD, and listVersions() in internal/gps/vcs_source.go is not equipped to handle that (it goes out-of-bounds on vlist[uniq] = v).

[ibrasho]

Faced the same issue yesterday when importing a new repository in Github without pushing any commits to it. 😁

I believe dep should fail in that case but show an appropriate message.

[Minnozz]

I gave it a shot. I think the hang in #1051 (comment) is a separate issue (deadlock while recovering from a panic?).