go, branch go1.18.9

[release-branch.go1.18] go1.18.9

2022-12-06T19:30:49Z

Change-Id: Ida61e740fc342357f54e523c0044cf6d83e0baec Reviewed-on: https://go-review.googlesource.com/c/go/+/455597 TryBot-Result: Gopher Robot Reviewed-by: Michael Pratt Reviewed-by: Jenny Rakoczy Run-TryBot: Gopher Robot Auto-Submit: Gopher Robot

[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2

2022-12-06T19:00:28Z

Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. For #56350 For #57008 Fixes CVE-2022-41717 Change-Id: I31ebd2b9ae190ef6f7646187103ea1c8a713ff2e Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663833 Reviewed-by: Tatiana Bradley Reviewed-by: Julie Qiu Reviewed-on: https://go-review.googlesource.com/c/go/+/455361 Run-TryBot: Jenny Rakoczy Reviewed-by: Michael Pratt TryBot-Result: Gopher Robot

[release-branch.go1.18] os, net/http: avoid escapes from os.DirFS and http.Dir on Windows

2022-12-06T19:00:21Z

Do not permit access to Windows reserved device names (NUL, COM1, etc.) via os.DirFS and http.Dir filesystems. Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the the root to the relative path with a path separator, making os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is a UNC name. Not only does this not open the intended file, but permits reference to any file on the system rather than only files on the current drive. Make os.DirFS("") invalid, with all file access failing. Previously, a root of "" was interpreted as "/", which is surprising and probably unintentional. Fixes CVE-2022-41720. Fixes #56694. Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663832 Reviewed-by: Julie Qiu Reviewed-by: Tatiana Bradley Reviewed-on: https://go-review.googlesource.com/c/go/+/455360 Reviewed-by: Michael Pratt TryBot-Result: Gopher Robot Run-TryBot: Jenny Rakoczy

[release-branch.go1.18] cmd/cgo: recognize clang 14 DWARF type names

2022-12-01T15:59:04Z

Fixes #57028 Updates #53013 Change-Id: I169d4eb2420a6da52cc9abe17da98c3092a91be6 Reviewed-on: https://go-review.googlesource.com/c/go/+/407514 Auto-Submit: Ian Lance Taylor Reviewed-by: Cherry Mui Reviewed-by: Ian Lance Taylor Run-TryBot: Ian Lance Taylor TryBot-Result: Gopher Robot (cherry picked from commit 2cfbef438049fd4c3f73d1562773ad1f93900897) Reviewed-on: https://go-review.googlesource.com/c/go/+/454415 Reviewed-by: Dmitri Shuralyov Run-TryBot: Heschi Kreinick Reviewed-by: Dmitri Shuralyov

[release-branch.go1.18] runtime: make GC see object as allocated after it is initialized

2022-11-25T02:37:05Z

When the GC is scanning some memory (possibly conservatively), finding a pointer, while concurrently another goroutine is allocating an object at the same address as the found pointer, the GC may see the pointer before the object and/or the heap bits are initialized. This may cause the GC to see bad pointers and possibly crash. To prevent this, we make it that the scanner can only see the object as allocated after the object and the heap bits are initialized. Currently the allocator uses freeindex to find the next available slot, and that code is coupled with updating the free index to a new slot past it. The scanner also uses the freeindex to determine if an object is allocated. This is somewhat racy. This CL makes the scanner use a different field, which is only updated after the object initialization (and a memory barrier). Updates #54596. Fixes #56751. Change-Id: I2a57a226369926e7192c253dd0d21d3faf22297c Reviewed-on: https://go-review.googlesource.com/c/go/+/449017 Reviewed-by: Austin Clements Reviewed-by: Michael Knyszek Run-TryBot: Cherry Mui TryBot-Result: Gopher Robot (cherry picked from commit febe7b8e2a4dd7cce6ab8d02cf79a5430819cbe5) Reviewed-on: https://go-review.googlesource.com/c/go/+/453255

[release-branch.go1.18] net: disable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV

2022-11-11T21:32:34Z

These tests fail consistently due to a DNS change causing widespread trybot outages. For #56707. Fixes #56709. Change-Id: Iebdf91254a922a48880021198f0f12f6bc16b6e7 Reviewed-on: https://go-review.googlesource.com/c/go/+/449640 Reviewed-by: Carlos Amedee Reviewed-by: Bryan Mills Run-TryBot: Michael Knyszek TryBot-Result: Gopher Robot Reviewed-by: Damien Neil (cherry picked from commit 97765249082b6835c77517a4e63bb38cfd6db97b) Reviewed-on: https://go-review.googlesource.com/c/go/+/449505 Reviewed-by: Ian Lance Taylor

[release-branch.go1.18] runtime: don't jump stack if at entry of systemstack

2022-11-09T18:44:47Z

The traceback code has special "jump stack" logic, to trace back stack switches through systemstack. If we're at the entry of systemstack, the stack switch hasn't happened, so don't jump to user stack. The jump stack logic is only used if we're on the g0 stack. It can happen that we're at the entry of a recursive systemstack call on the g0 stack. In we jump stack here, there will be two problems: 1. There are frames between entering the g0 stack and this recursive systemstack call. Those frames will be lost. 2. Worse, we switched frame.sp but frame.fp calculation will use the entry SP delta (0), which will be wrong, which in turn leads wrong frame.lr and things will go off. For now, don't jump stack if we're at entry of systemstack (SP delta is 0). Using a per-PC SPWRITE marker may be a better fix. If we haven't written the SP, we haven't switched the stack so we can just unwind like a normal function. Updates #55851. Fixes #56635. Change-Id: I2b624c8c086b235b34d9c7d3cebd4a37264f00f8 Reviewed-on: https://go-review.googlesource.com/c/go/+/437299 TryBot-Result: Gopher Robot Run-TryBot: Cherry Mui Reviewed-by: Michael Pratt (cherry picked from commit 500bc6b8056ee2eaf7640610a48ffa00bdd896a5) Reviewed-on: https://go-review.googlesource.com/c/go/+/448517

[release-branch.go1.18] cmd/compile: allow ineffectual //go:linkname in -lang=go1.17 and older

2022-11-09T18:44:17Z

Prior to Go 1.18, ineffectual //go:linkname directives (i.e., directives referring to an undeclared name, or to a declared type or constant) were treated as noops. In Go 1.18, we changed this into a compiler error to mitigate accidental misuse. However, the x/sys repo contained ineffectual //go:linkname directives up until go.dev/cl/274573, which has caused a lot of user confusion. It seems a bit late to worry about now, but to at least prevent further user pain, this CL changes the error message to only apply to modules using "go 1.18" or newer. (The x/sys repo declared "go 1.12" at the time go.dev/cl/274573 was submitted.) For #55889. Fixes #56556. Change-Id: Id762fff96fd13ba0f1e696929a9e276dfcba2620 Reviewed-on: https://go-review.googlesource.com/c/go/+/447755 TryBot-Result: Gopher Robot Run-TryBot: Matthew Dempsky Reviewed-by: Bryan Mills Reviewed-on: https://go-review.googlesource.com/c/go/+/447815

[release-branch.go1.18] os/exec: allow NUL in environment variables on Plan 9

2022-11-09T18:43:54Z

Plan 9 uses NUL as os.PathListSeparator, so it's almost always going to appear in the environment variable list. Exempt GOOS=plan9 from the check for NUL in environment variables. For #56284. For #56544. Fixes #56550. Change-Id: I23df233cdf20c0a9a606fd9253e15a9b5482575a Reviewed-on: https://go-review.googlesource.com/c/go/+/447715 Reviewed-by: David du Colombier <0intro@gmail.com> Run-TryBot: Matthew Dempsky TryBot-Result: Gopher Robot Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/447875 Run-TryBot: David du Colombier <0intro@gmail.com>

[release-branch.go1.18] cmd/compile: copy blank parameter node when substituting function type

2022-11-08T18:44:13Z

When a function type is copied (e.g. for substituting type parameters), we make copies of its parameter ir.Name nodes, so they are not shared with the old function type. But currently a blank (_) identifier is not copied but shared. The parameter node's frame offset is assigned (in ABI analysis) and then used in the concurrent backend. Shared node can cause a data race. Make a new blank parameter node to avoid sharing. (Unified IR does already not have this problem. This fixes non-unified-IR mode.) Updates #55357. Fixes #56359. Change-Id: Ie27f08e5589ac7d5d3f0d0d5de1a21e4fd2765c9 Reviewed-on: https://go-review.googlesource.com/c/go/+/443158 Reviewed-by: Keith Randall Run-TryBot: Cherry Mui TryBot-Result: Gopher Robot Reviewed-by: Keith Randall (cherry picked from commit 4725c71b735143a138b24f2b0e055c717d8d69ca) Reviewed-on: https://go-review.googlesource.com/c/go/+/445177