fatal error: found pointer to free object

[ruyi789]

Go version

none

Output of go env in your module/workspace:

none

What did you do?

none

What did you see happen?

runtime: marked free object in span 0x247f56aa7a8, elemsize=16 freeindex=0 (bad use of unsafe.Pointer? try -d=checkptr)
0xc00031c000 alloc marked
0xc00031c010 alloc marked
0xc00031c020 alloc marked
...
0xc00031ca30 free marked zombie
0x000000c00031ca30: 0x000000c00031ca30 0x0000000000dea7c8
0xc00031ca40 alloc marked
0xc00031ca50 alloc marked
0xc00031ca60 alloc marked
0xc00031ca70 alloc marked
0xc00031ca80 alloc marked
0xc00031ca90 alloc marked
0xc00031caa0 alloc marked
0xc00031cab0 alloc marked
0xc00031cac0 alloc marked
0xc00031cad0 free unmarked
...
0xc00031dff0 free unmarked
fatal error: found pointer to free object

goroutine 3 [running]:
runtime.throw({0xdc1323?, 0xc00031ca40?})
D:/Go/go/src/runtime/panic.go:1077 +0x65 fp=0xc000045d88 sp=0xc000045d58 pc=0x8ef5a5
runtime.(*mspan).reportZombies(0x247f56aa7a8)
D:/Go/go/src/runtime/mgcsweep.go:861 +0x2f6 fp=0xc000045e08 sp=0xc000045d88 pc=0x8db6b6
runtime.(*sweepLocked).sweep(0x1008260?, 0x0)
D:/Go/go/src/runtime/mgcsweep.go:644 +0xa25 fp=0xc000045f28 sp=0xc000045e08 pc=0x8db045
runtime.sweepone()
D:/Go/go/src/runtime/mgcsweep.go:393 +0xd2 fp=0xc000045f80 sp=0xc000045f28 pc=0x8da392
runtime.bgsweep(0x0?)
D:/Go/go/src/runtime/mgcsweep.go:301 +0x105 fp=0xc000045fc8 sp=0xc000045f80 pc=0x8da185
runtime.gcenable.func1()
D:/Go/go/src/runtime/mgc.go:200 +0x25 fp=0xc000045fe0 sp=0xc000045fc8 pc=0x8ce405
runtime.goexit()
D:/Go/go/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000045fe8 sp=0xc000045fe0 pc=0x920661
created by runtime.gcenable in goroutine 1
D:/Go/go/src/runtime/mgc.go:200 +0x66

goroutine 1 [running]:
goroutine running on other thread; stack unavailable

goroutine 2 [force gc (idle), 2 minutes]:
runtime.gopark(0xdead48, 0xfeed60, 0x11, 0x14, 0x1)
D:/Go/go/src/runtime/proc.go:398 +0xfc fp=0xc000043f80 sp=0xc000043f50 pc=0x8f20dc
runtime.goparkunlock(0x0?, 0x0?, 0x0?, 0x0?)
D:/Go/go/src/runtime/proc.go:404 +0x25 fp=0xc000043fb0 sp=0xc000043f80 pc=0x8f2165
runtime.forcegchelper()
D:/Go/go/src/runtime/proc.go:322 +0xb5 fp=0xc000043fe0 sp=0xc000043fb0 pc=0x8f1ef5
runtime.goexit()
D:/Go/go/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000043fe8 sp=0xc000043fe0 pc=0x920661
created by runtime.init.6 in goroutine 1
D:/Go/go/src/runtime/proc.go:310 +0x1a
...

goroutine 1 [running]:It's my mian thread that executes Tasks() and is not exiting.

0x000000c00031ca30: 0x000000c00031ca30 0x0000000000dea7c8
elemsize=16
type Callback struct {
next *IONode
f unsafe.Pointer
}

This structure, the value of next is fine, it remains in the list chain and is not taken out. [goroutine 1] is executing another Callback. but it prints (goroutine running on other thread; stack unavailable)?
I suspect that the runtime of [goroutine 1] was not detected during GC, causing the list chain to be marked for release?

What did you expect to see?

none

[gabyhelp]

Similar Issues

• runtime: marked free object in span #47415
• runtime: panic marked free object in span[1.17] #54247
• cmd/compile: unsafe.{SliceData,StringData} possible memory corruption in escape analysis #57823
• runtime: fatal error: found pointer to free object #47513
• runtime: found bad pointer in Go heap #55040
• runtime: marked free object in span pointing to runtime.gopark variable #65309
• affected/package: found pointer to free object (go runtime) #52008
• runtime/pprof: `found bad pointer in Go heap` during TestGoroutineProfileConcurrency with TestMorestack #54605
• runtime: marked free object in span on Windows #45364
• runtime: invalid heap pointer during GC on windows/386 #9015

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

please fill out the bug report template, otherwise, this is not an actionable report.

[ruyi789]

Normal reportZombies, goroutine 1 is printable: https://go.dev/play/p/QQVDvgjATuW

[ianlancetaylor]

That code breaks the unsafe.Pointer rules. See https://pkg.go.dev/unsafe#Pointer. The statement

    *pr = unsafe.Add(nil, u[4]+size)

effectively converts a uintptr to an unsafe.Pointer, which is not permitted.

[ruyi789]

That code breaks the unsafe.Pointer rules. See https://pkg.go.dev/unsafe#Pointer. The statement

    *pr = unsafe.Add(nil, u[4]+size)

effectively converts a uintptr to an unsafe.Pointer, which is not permitted.

This is a test,not the issuse

[ianlancetaylor]

How can we reproduce the problem?

[ruyi789]

How can we reproduce the problem?

I can't recreate it.

[ianlancetaylor]

The normal cause of these kinds of problems is incorrect use of the unsafe package, or use of C code called via cgo or SWIG that does something unsafe, or a race condition.

If we can't recreate the problem there isn't much we can do.