go, branch go1.10.1

[release-branch.go1.10] go1.10.1

2018-03-29T06:09:52Z

Change-Id: I0636f60e705f8182d6fba4ce6199c67f94c04e36 Reviewed-on: https://go-review.googlesource.com/103168 Reviewed-by: Ian Lance Taylor Run-TryBot: Andrew Bonventre TryBot-Result: Gobot Gobot

[release-branch.go1.10] runtime: identify special functions by flag instead of address

2018-03-29T06:09:45Z

When there are plugins, there may not be a unique copy of runtime functions like goexit, mcall, etc. So identifying them by entry address is problematic. Instead, keep track of each special function using a field in the symbol table. That way, multiple copies of the same runtime function will be treated identically. Fixes #24351 Fixes #23133 Change-Id: Iea3232df8a6af68509769d9ca618f530cc0f84fd Reviewed-on: https://go-review.googlesource.com/100739 Run-TryBot: Keith Randall TryBot-Result: Gobot Gobot Reviewed-by: Ian Lance Taylor Reviewed-on: https://go-review.googlesource.com/102793 Run-TryBot: Andrew Bonventre Reviewed-by: Keith Randall

[release-branch.go1.10] doc: update 1.9.5 release notes to include net/http/pprof

2018-03-29T06:09:39Z

Change-Id: I7c0716711a2cadd347fdf242c792b109539f7355 Reviewed-on: https://go-review.googlesource.com/103163 Reviewed-by: Andrew Bonventre Reviewed-on: https://go-review.googlesource.com/103166 Reviewed-by: Ian Lance Taylor Run-TryBot: Andrew Bonventre TryBot-Result: Gobot Gobot

[release-branch.go1.10] doc: update release notes for Go 1.9.5

2018-03-29T06:09:31Z

Change-Id: Idf88d289bac9603d852a9d19eb4b764f8589f8d9 Reviewed-on: https://go-review.googlesource.com/103159 Reviewed-by: Andrew Bonventre Reviewed-on: https://go-review.googlesource.com/103162 Run-TryBot: Andrew Bonventre Reviewed-by: Ian Lance Taylor TryBot-Result: Gobot Gobot

[release-branch.go1.10] doc: document Go 1.10.1

2018-03-29T06:09:24Z

Change-Id: Ibba5d4fd8124db9b1e4e50b8f37366f8dd23f47e Reviewed-on: https://go-review.googlesource.com/103217 Reviewed-by: Ian Lance Taylor Reviewed-on: https://go-review.googlesource.com/103222 Run-TryBot: Andrew Bonventre Reviewed-by: Andrew Bonventre TryBot-Result: Gobot Gobot

[release-branch.go1.10] doc: document Go 1.9.5

2018-03-29T06:09:18Z

Change-Id: I8f12b188d2e13555e1d7634b9cc0319fc737cb1d Reviewed-on: https://go-review.googlesource.com/103216 Reviewed-by: Ian Lance Taylor Reviewed-on: https://go-review.googlesource.com/103221 Reviewed-by: Andrew Bonventre Run-TryBot: Andrew Bonventre TryBot-Result: Gobot Gobot

[release-branch.go1.10] net/http/pprof: harden handler responses

2018-03-29T06:09:08Z

A very small number of old browsers consider content as HTML even when it is explicitly stated in the Content-Type header that it is not. If content served is based on user-supplied input, then an XSS is possible. Introduce three mitigations: + Don't reflect user input in error strings + Set a Content-Disposition header when requesting a resource that should never be displayed in a browser window + Set X-Content-Type-Options: nosniff on all responses Change-Id: I81c9d6736e0439ebd1db99cd7fb701cc56d24805 Reviewed-on: https://go-review.googlesource.com/102318 Run-TryBot: Andrew Bonventre Reviewed-by: Filippo Valsorda TryBot-Result: Gobot Gobot Reviewed-on: https://go-review.googlesource.com/103218 Reviewed-by: Ian Lance Taylor

[release-branch.go1.10] cmd/go: add more C compiler/linker options to whitelist

2018-03-29T06:09:03Z

Fixes #23937 Change-Id: Ie63d91355d1a724d0012d99d457d939deeeb8d3e Reviewed-on: https://go-review.googlesource.com/102818 Run-TryBot: Ian Lance Taylor TryBot-Result: Gobot Gobot Reviewed-by: Andrew Bonventre Reviewed-on: https://go-review.googlesource.com/103015 Run-TryBot: Andrew Bonventre Reviewed-by: Ian Lance Taylor

[release-branch.go1.10] cmd/go: if -race, don't run coverage on runtime packages

2018-03-29T06:08:56Z

Don't compile the runtime packages with coverage when using the race detector. The user can, perhaps accidentally, request coverage for the runtime by using -coverpkg=all. If using the race detector, the runtime package coverage will call into the race detector before it has been initialized. This will cause the program to crash mysteriously on startup. Fixes #23882 Change-Id: I9a63867a9138797d8b8afb0856ae21079accdb27 Reviewed-on: https://go-review.googlesource.com/94898 Run-TryBot: Ian Lance Taylor TryBot-Result: Gobot Gobot Reviewed-by: Andrew Bonventre Reviewed-on: https://go-review.googlesource.com/103095 Run-TryBot: Andrew Bonventre Reviewed-by: Ian Lance Taylor

[release-branch.go1.10] crypto/x509: matching any requested EKU should be sufficient.

2018-03-29T06:08:46Z

The documentation was unclear here and I misremembered the behaviour and changed it in 1.10: it used to be that matching any EKU was enough but 1.10 requires that all EKUs match. Restore 1.9 behaviour and clarify the documentation to make it official. Fixes #24162. Change-Id: Ic9466cd0799cb27ec3a3a7e6c96f10c2aacc7020 Reviewed-on: https://go-review.googlesource.com/97720 Run-TryBot: Adam Langley TryBot-Result: Gobot Gobot Reviewed-by: Filippo Valsorda Reviewed-on: https://go-review.googlesource.com/102790 Run-TryBot: Andrew Bonventre