runtime: tighten recover to direct deferred calls by cpunion · Pull Request #1918 · xgo-dev/llgo

cpunion · 2026-05-24T12:27:48Z

Summary

Fix recover/defer ownership during panic unwinding.

recover now only succeeds from the deferred function that is actually being run, while panics rethrown through nested defer and range-over-func frames remain recoverable by the correct outer defer.

Examples covered by this PR:

// A directly deferred function value can recover the panic.
defer func() {
	if recover() == nil {
		panic("not recovered")
	}
}()
panic("boom")

// A nested defer inside a deferred function must not recover the outer panic.
defer func() {
	defer func() {
		if recover() != nil {
			panic("nested recover should be nil")
		}
	}()
	if recover() != "outer" {
		panic("outer recover failed")
	}
}()
panic("outer")

// A panic crossing range-over-func/defer frames remains recoverable by the
// correct deferred function, instead of being claimed by an inner frame.
defer func() {
	if recover() != "loop panic" {
		panic("recover owner mismatch")
	}
}()
for range func(yield func(int) bool) {
	defer func() { _ = recover() }()
	yield(1)
} {
	panic("loop panic")
}

Main verification

After #1950 was merged, latest xgo-dev/llgo main still fails the nested defer/recover case above. The temporary LLGo test failed with:

outer recover = <nil>, want outer

The same case passes with go test, so this PR still covers a remaining LLGo recover/defer ownership bug.

codecov-commenter · 2026-05-24T18:53:42Z

Codecov Report

❌ Patch coverage is 42.60953% with 1192 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
benchmark/runtime_funcinfo/main.go	0.00%	672 Missing ⚠️
internal/pclnpost/binary.go	12.91%	181 Missing and 1 partial ⚠️
internal/pclnpost/write.go	0.00%	150 Missing ⚠️
internal/pclnpost/fixups.go	0.00%	125 Missing ⚠️
internal/pclnpost/pclnpost.go	0.00%	22 Missing ⚠️
internal/pclntab/pclntab.go	61.40%	11 Missing and 11 partials ⚠️
cl/instr.go	96.77%	11 Missing and 6 partials ⚠️
cl/compile.go	98.83%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

cpunion · 2026-06-06T04:37:43Z

Added patch-coverage tests for the recover/direct-deferred-call helpers:

ssa/ssa_test.go: covers recover defer token classification for marked function decls, function pointers, non-function values, nil expressions, and the recover builtin helper.
cl/cgo_test.go: covers functionUsesRecover nil/direct-recover cases and callMayRecover conservative closure/default paths.

Local verification:

go test ./ssa -coverprofile=/tmp/llgo-recover-ssa-full-after.out (passes; ssa/eh.go recover helper functions now report 100% for callRecoverScopedDefer, recoverDeferToken, deferMayRecover, and isRecoverBuiltin)
go test ./cl -run 'Test(RecoverCallClassificationHelpers|EmitDo|CompileRangeFuncDeferModule|DeferStackOwner|RangeFuncDefer|NestedRangeFunc|Cgo)' -coverprofile=/tmp/llgo-recover-cl-after2.out (passes; functionUsesRecover and callMayRecover report 100%)
go test ./test/go -run TestRecoverFixedbug -count=1 (passes)
go run ./cmd/llgo test -run TestRecoverFixedbug -count=1 ./test/go/recover_defer_fixedbugs_test.go (passes)
git diff --check (passes)

Note: go run ./cmd/llgo test -run TestRecoverFixedbug -count=1 ./test/go still links the whole test/go package and failed before reaching the recover tests due unrelated generic-local-type undefined symbols, so I used the single recover test file for the focused LLGo runtime/codegen check.

Pure-compute probes (recursive fib, JSON round-trip, sort.Ints, map churn) with no runtime introspection, so one harness run covers both the introspection extremes and what the funcinfo machinery costs code that never asks for it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Go's pclntab pages are touched by its own runtime (traceback, GC) long before user code queries it, so its first FuncForPC never pays page-in. Mirror that: when the prebuilt table is present, init adopts it (zero-copy, sub-µs), touches the pages the lookup path reads (blob, funcinfo records, string offsets, strings), runs one synthetic lookup to warm the code paths, and write-warms the FuncForPC cache pages. First-in-process FuncForPC: darwin ~17µs -> ~2.8µs, linux ~6.6µs -> ~1.0µs. Startup cost is page-count-bound (tens of µs on stdlib-sized tables, invisible next to ~3ms process startup; hello-world medians unchanged). Non-prebuilt binaries stay fully lazy: first-use construction allocates, which has no place in init, and programs that never introspect pay nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

-depths generates deep_<N> scenarios at configurable call depths; -bigsizes generates bigfunc scenarios (funcs x statements) whose large bodies stress statement-level pcline density, mid-function pc symbolization, and ordinary performance of big method bodies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cpunion · 2026-07-02T15:03:39Z

Rebased onto #2016 (codex/pclntab-linkphase-p1, which includes #2012) per the review-order plan: #2012 → #2016 → this line of semantics fixes. Conflicts resolved were additive (context fields, the noinline condition set, and runtime.Panic now calls SavePanicCallerFrames() before the panic-node bookkeeping). Note the PR base is still main, so the diff shows #2012/#2016 commits until those merge.

cpunion · 2026-07-06T06:04:37Z

Superseded by #2033, which re-expresses the Defer-node recover-ownership model on the stage-5 base (#2023); the funcinfo draft carried here was superseded by #2012/#2016/#2019. #1882's recover-error-value work re-expresses on top of #2033 next.

Re-expresses xgo-dev#1918 on the xgo-dev#2023 base (its remaining ~11k diff lines were the pre-xgo-dev#2012 funcinfo draft, superseded by the stage-5 chain): - recover() only succeeds when called directly by a deferred function (gc semantics): the panic node records the owning Defer frame at rethrow (panicKey/panicNode + GoDeferData), and Recover checks the caller is that frame's direct deferred call. Closure wraps carry StartRecoverFrameAlias/EndRecoverFrame so method-value and closure adapters stay transparent to the ownership check. - Rethrow keeps the xgo-dev#2023 PanicTraceback hook on the unrecovered path. - xfail: retire fixedbugs/issue4066 (2m-timeout entries; now runs in ~2.7s), fixedbugs/issue73916 and issue73916b (go1.26 recover semantics), validated on darwin/arm64 go1.26. Supersedes xgo-dev#1918.

cpunion force-pushed the codex/goroot-fixedbugs-recover-coverage branch from 6de90d9 to ad13f0e Compare May 24, 2026 12:52

cpunion marked this pull request as ready for review June 1, 2026 02:30

cpunion force-pushed the codex/goroot-fixedbugs-recover-coverage branch 2 times, most recently from 747e47b to a16d798 Compare June 10, 2026 11:30

cpunion force-pushed the codex/goroot-fixedbugs-recover-coverage branch 2 times, most recently from 071f268 to 41dfd44 Compare June 19, 2026 14:44

cpunion force-pushed the codex/goroot-fixedbugs-recover-coverage branch 2 times, most recently from 7156fc2 to 80e2e83 Compare June 29, 2026 02:26

zhouguangyuan0718 approved these changes Jun 29, 2026

View reviewed changes

cpunion added 19 commits July 2, 2026 03:27

build: add Go-style pclntab findfunc index

2870ba8

ssa: emit DCE-safe function metadata

f365b73

runtime: add line info for stack frames

e81a007

runtime: add statement line caller frames

1e15db2

runtime: compress funcinfo table

407e0dd

test: cover indirect runtime caller paths

a3115cd

cl: narrow runtime caller tracking

c6c128a

runtime: add compact pc-line funcinfo table

4692e15

runtime: optimize FuncForPC metadata lookup

b29906c

runtime: slim FuncForPC cache hot path

734368f

cl: make pc-line labels clone-safe

85b1c13

runtime: guard funcinfo table initialization

b33a774

runtime: fix funcinfo entry pc line metadata

8e6f33c

runtime: publish funcinfo records for live stubs

8eec8e0

runtime: skip ELF stub-site records during LTO

01913f4

runtime: reduce funcinfo lookup initialization cost

6fa875b

test: cover runtime caller metadata edges

34b274c

runtime: speed up funcinfo entry lookup

3b87c90

test: cover pcline metadata in dev lto coverage

012095b

cpunion and others added 11 commits July 2, 2026 22:01

doc: record P3 findings in pclntab-linkphase design

cd8506d

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

benchmark: keep full LTO from constant-folding the plain fib probe

a3e679c

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

runtime: tighten recover to direct deferred calls

748bbeb

test: cover recover defer helpers

b9f2472

cl: preserve zero-size deref guards with recover slots

c5d22a2

runtime: fix recover frame ownership

fdf3c7d

runtime: preserve panic owner during rethrow

527f24d

ssa: cover nil recover marker

8fe0ad3

cpunion force-pushed the codex/goroot-fixedbugs-recover-coverage branch from f867d84 to 8fe0ad3 Compare July 2, 2026 15:03

This was referenced Jul 2, 2026

Proposal: runtime funcinfo metadata and fast FuncForPC lookup #2004

Closed

[Based on #2090] ssa,runtime: tighten recover to direct deferred calls #2033

Open

cpunion closed this Jul 6, 2026

cpunion mentioned this pull request Jul 8, 2026

runtime,cl,build: Go-style caller info — funcinfo tables, link-phase pcln, FP unwinder, gc-verified conformance (stage-5 backbone) #2024

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

runtime: tighten recover to direct deferred calls#1918

runtime: tighten recover to direct deferred calls#1918
cpunion wants to merge 50 commits into
xgo-dev:mainfrom
cpunion:codex/goroot-fixedbugs-recover-coverage

cpunion commented May 24, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented May 24, 2026 •

edited by codecov Bot

Loading

Uh oh!

cpunion commented Jun 6, 2026

Uh oh!

cpunion commented Jul 2, 2026

Uh oh!

cpunion commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

cpunion commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Main verification

Uh oh!

codecov-commenter commented May 24, 2026 • edited by codecov Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cpunion commented Jun 6, 2026

Uh oh!

cpunion commented Jul 2, 2026

Uh oh!

cpunion commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cpunion commented May 24, 2026 •

edited

Loading

codecov-commenter commented May 24, 2026 •

edited by codecov Bot

Loading