cmd/cgo: panic while checking **unsafe.Pointer in cgo call

[xlab]

What version of Go are you using (go version)?

$ go version
go version go1.6beta1 darwin/amd64

What operating system and processor architecture are you using?

$ uname -a
Darwin xlab-dev.local 15.2.0 Darwin Kernel Version 15.2.0: Fri Nov 13 19:56:56 PST 2015; root:xnu-3248.20.55~2/RELEASE_X86_64 x86_64

What did you do?

I'm trying to pass a pointer into a cgo call. The program below is a full demo.

package main

import "unsafe"

// typedef void Bar;
// void Foo(Bar** ptr) {};
import "C"

type Bar [0]byte

func Foo(arg **Bar) {
    ptr := (**C.Bar)(unsafe.Pointer(arg))
    C.Foo(ptr)
}

func main() {
    var ptr *Bar
    Foo(&ptr)
}

What did you expect to see?

The pointer successfully passed or a failure because of Go 1.6 restrictions against passing a pointer to Go allocated memory that has pointers to Go allocated memory.

What did you see instead?

$ go run main.go
panic: interface conversion: interface {} is **main._Ctype_Bar, not *unsafe.Pointer

goroutine 1 [running]:
main._cgoCheckPointer0(0x40552e0, 0xc82002a008, 0x0, 0x0, 0x0, 0x4056420)
    command-line-arguments/_obj/_cgo_gotypes.go:40 +0x91
main.Foo(0xc82002a008)
    cgofail/main.go:13 +0x48
main.main()
    cgofail/main.go:18 +0x31
exit status 2

The helper has been generated as:

func _cgoCheckPointer0(p interface{}, args ...interface{}) *unsafe.Pointer {
    return _cgoCheckPointer(p, args...).(*unsafe.Pointer)
}

[xlab]

Surprisingly enough, I'm getting a compilation error instead with Go 1.5.2:

$ go version
go version go1.5.2 darwin/amd64

$ go run main.go
# command-line-arguments
./main.go:13: cannot use ptr (type **C.Bar) as type *unsafe.Pointer in argument to _Cfunc_Foo

The wrapper has been generated as:

func _Cfunc_Foo(p0 *unsafe.Pointer) (r1 _Ctype_void)

[xlab]

The workaround is to pass it as ptr := (*unsafe.Pointer)(unsafe.Pointer(arg)) which looks strange but works. In either 1.5.2 or 1.6beta1.

[ianlancetaylor]

cgo treats this as a type error because a pointer to void is handled as unsafe.Pointer. Since you have typedef void Bar, the C type Bar* is the Go type unsafe.Pointer, and the C type Bar** is the Go type *unsafe.Pointer.

The fix for Go 1.6 is to report an error at compile time rather than at run time, as Go 1.5 does.

[ianlancetaylor]

Turns out to be hard to check at compile time, for exactly the reason that helper cgoCheckPointer functions were introduced, so postponing to 1.7.

[rsc]

@ianlancetaylor, should this be postponed to Go 1.8?

[ianlancetaylor]

Dropping to unplanned. I would like to have better compile time checking but I'm not sure how to do it.

[bcmills]

This doesn't appear to even require a double-pointer. A plain old void* - as for C.free - suffices. I think this implies that every program that calls C.free on a typed parameter ends up triggering the panic.

For example, this program panics:

package main

/*
#include <stdlib.h>
*/
import "C"
import "unsafe"

func main() {
    var dt *C.div_t
    dt = (*C.div_t)(C.malloc(C.size_t(unsafe.Sizeof(*dt))))
    defer C.free(dt)
}

whereas this one does not:

package main

/*
#include <stdlib.h>
*/
import "C"
import "unsafe"

func main() {
    var dt *C.div_t
    dt = (*C.div_t)(C.malloc(C.size_t(unsafe.Sizeof(*dt))))
    defer C.free(unsafe.Pointer(dt))
}

[ianlancetaylor]

Yes. The first program is invalid, the second is not. The way to fix this bug is to catch the invalid case at compile time rather than execution time. In Go 1.5 and earlier we caught the invalid case at compile time, but unfortunately the cgo checks broke that. And, even more unfortunately, it's hard to fix. At least, I don't see how to fix it.