runtime,cl: Go-style panic tracebacks and exact log/slog/testing locations, with gc-verified acceptance suite by cpunion · Pull Request #2023 · xgo-dev/llgo

cpunion · 2026-07-03T23:51:44Z

End-user acceptance for the Stage 5 unwinder (#2019): make the caller info an application developer actually sees correct — panic tracebacks, log/slog locations, testing failure lines — and lock it in with a gc-verified acceptance suite.

What the acceptance run exposed (before this PR)

Scenario	gc	llgo before	llgo after
unrecovered panic	goroutine trace with file:line per frame	`[0x… main+0x4, SP = 0x24]` (dladdr, one frame, no file:line)	Go-style traceback
`log.Lshortfile`	`main.go:11:`	`???:1:`	`main.go:11:`
slog `AddSource`	`source=…/main.go:12`	`source=:0`	`source=…/main.go:12`
`t.Errorf` under `llgo test`	`x_test.go:6:`	`???:1:`	`x_test.go:6:`

Fixes

Go-style panic tracebacks: unrecovered panics print goroutine 1 [running]: plus function(...) / indented file:line per physical frame, via a PanicTraceback hook the public runtime registers with the runtime core; the clite dladdr dump remains the fallback when the FP walk or tables are unavailable. Runtime-internal plumbing frames are filtered by package path (gc hides runtime frames the same way).
Uniform caller-frame tracking — no package whitelist: the blanket stdlib exclusion is gone. The existing per-package "transitively reaches runtime.Caller" analysis now applies to stdlib exactly as it always did to third-party code, so log.Output, slog's Logger.log and testing's decorate chains keep physical frames and fixed Caller depths count correctly. Packages that never read caller pcs still track nothing and pay nothing.
Cross-package call-site anchors: a call into a caller-pc-consuming function of another package (the frame a fixed depth attributes) gets a statement anchor, so log.Println("x") reports the exact line even though the calling function itself never reads caller pcs. Decided by the same analysis (memoized per package), not by name.
Collector: directly-called methods: a type used only concretely never enters RuntimeTypes, so its methods escaped tracking — exactly how slog.(*Logger).Info lost its frame. Methods are now collected from the package's own type declarations (both receiver forms).
gc-conformant naming and format: the main package's display name is normalized to main regardless of the module name (frame filters in the wild match on the main. prefix; linker symbols keep the package path), closures display as gc's .funcN instead of $N, and traceback lines carry gc's +0x<pc-entry> offset (value is codegen-specific, format matches).
Program-unique frames pinned: main.main and package init run once, so noinline is free — they are the bottom frames of nearly every panic traceback and now report exact statement lines. //go:noinline functions already keep their frames and get statement anchors too.

Conformance bar (agreed): format and user-code file:line match gc exactly; runtime-internal, patched-stdlib and startup frames may differ (different runtime, accepted).

Cost: hello-world grows 368 bytes (the traceback printer); no IR golden changed; plain.* code paths are untouched.

Acceptance suite (`test/go/caller_acceptance_test.go`)

Four probes, every expectation verified against gc: panic traceback contents; log.Lshortfile + slog AddSource (text and JSON handlers, package functions and logger methods); a failing t.Errorf under llgo test; and an introspection grab-bag — goroutine/init/defer callers, FuncForPC names for value/pointer methods, closures and generic instantiations, and the errors-with-stack capture idiom (zap/sentry style).

Documented divergences observed while writing the suite:

Closure display names are normalized to gc's .funcN form (linker symbols keep $N); the suite accepts both forms for robustness.
Linker ICF folds identical function bodies to one address, so FuncForPC reports the surviving symbol (gc does not fold); probes use distinct bodies.
Cross-package wrapper chains (zap→zapcore style) are outside the per-package analysis; their wrappers may still inline. The P4 inline tree subsumes this.
Plain (non-noinline, non-pc-consuming) user functions appearing mid-traceback in a panic still show declaration-adjacent lines: statement anchors structurally require the containing function to survive (the ELF pcline section is link-ordered to its symbol), so full coverage without noinline needs the P4 metadata mechanisms. Bottom frames (main.main, init), //go:noinline functions, and every attributed frame in the log/slog/testing/Caller scenarios are exact.

Manual playground (`test/_manualtest/`, committed)

Five directories runnable with both go and llgo for side-by-side comparison: panic/ (traceback shape), logging/ (log/slog locations), callers/ (Caller ladder, frames, FuncForPC names, errors-with-stack), testfail/ (llgo test failure lines), cexcept/ (hardware faults in C called from Go — segv recovery verified on darwin/arm64 + linux/arm64/amd64; known gaps recorded in its README: fault-site stack needs the panic-snapshot follow-up, SIGFPE/SIGBUS handlers and sigaltstack not installed yet). Every scenario also has a test/go regression: the acceptance tests above plus TestCallerAcceptanceModuleMainNaming (module-named main package must still report main.*) and TestCallerAcceptanceCFaultRecover (C NULL-store converts to a recoverable Go panic).

Validation (both platforms, before every push)

Acceptance suite 4/4 on macOS arm64 and linux arm64 (container); statement-line and line-info suites still green.
cl (725s), ssa, internal/build, test/go all ok; gentests produced no golden diffs.
Linux container: every _demo/go demo passes plain and an LTO (-lto=full -globaldce) subset — including the reflect demos whose ELF pcline sections dangled in the first CI round (anchors in inlinable functions; fixed by making frame-keeping a tracking criterion rather than a per-call exception).
Panic traceback offset verified against disassembly (+0x30 = return address − function entry for the probe).

Based on #2019 (contains #2012 and #2016); rebases as those merge.

🤖 Generated with Claude Code

codecov · 2026-07-04T00:25:03Z

Codecov Report

❌ Patch coverage is 89.63388% with 235 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/build/funcinfo_table.go	88.19%	47 Missing and 29 partials ⚠️
internal/pclnpost/write.go	80.23%	21 Missing and 12 partials ⚠️
internal/build/funcinfo/funcinfo.go	87.60%	15 Missing and 14 partials ⚠️
internal/pclnpost/binary.go	86.79%	17 Missing and 11 partials ⚠️
internal/pclnpost/fixups.go	78.40%	18 Missing and 9 partials ⚠️
cl/instr.go	95.77%	14 Missing and 9 partials ⚠️
internal/build/build.go	78.57%	5 Missing and 4 partials ⚠️
internal/pclntab/pclntab.go	92.98%	2 Missing and 2 partials ⚠️
cl/compile.go	98.48%	1 Missing and 1 partial ⚠️
internal/pclnpost/pclnpost.go	91.30%	1 Missing and 1 partial ⚠️
... and 1 more

📢 Thoughts on this report? Let us know!

…l, 75m job) The macos coverage job's test step already ran at ~44-45m on the xgo-dev#2023 base (job wall 50:56); the recover-ownership tests push it past the 45m internal go-test alarm — killed at 45m with ~10 minutes of suites left. Not a performance regression: local full ssa+cl on the same tree run in ~10 minutes; the mac CI runner is ~5x slower on llgo-building tests.

A fabricated Mach-O (segments, sections, symtab, chained-fixup imports and an empty page chain) drives load, bind-target resolution, record decoding and both Rewrite outcomes (in-place and stub-section spill) end to end. codesign now runs only when the input carries LC_CODE_SIGNATURE: real lld executables always do, unsigned inputs need no signature and codesign rejects them. Also cover asmQuoteELFSymbol, the empty-table initializers and the Rewrite error paths. Package coverage: pclnpost 69% -> 86%. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Every Go function on supported targets keeps the frame-pointer chain ("frame-pointer"="non-leaf", gated by Program.NeedsFramePointer to linux/darwin — on embedded targets the unwinder does not exist and the layout change perturbed the conservative GC on ESP32-C3). runtime.Caller, Callers, CallersFrames, Stack and the unrecovered-panic dump walk [fp]/[fp+w] directly and symbolize through the prebuilt ftab and pcline tables: - Return addresses resolve at pc-1 (Go's convention); statement labels can land exactly on a return address, so raw-pc nearest-below reported the following line. The convention holds with or without the prebuilt table (text bounds fall back to the first-use frame table — link-phase overflow layouts otherwise silently disabled it, the root cause of the amd64 CI failures). - The walk is bounded to the program's own text: libc frames without FP discipline decode as wild pcs that nearest-below would attribute to arbitrary functions. - Methods and anonymous functions are now trackable (methods had no pcline labels; closures lost their innermost frame to tail-call optimization), and mid-function aligned pcs merge statement records instead of returning declaration lines. - frameSymbol results are memoized per pc (deep re-walks paid a dladdr per frame: 32-frame walks 8µs -> 180ns) and the pcline table is built during the startup pre-warm (lazily building it inside the first Caller cost ~200µs at scale). - Shadow-stack instrumentation is no longer emitted; LLGO_SHADOW_STACK=1 keeps the legacy emitters for one release. Tracked functions retain noinline, no-tail-call and the data-only pcline records. - libunwind is gone: the clite stacktrace fallback walks the FP chain with dladdr names (same output format), and linux binaries no longer link -lunwind. Semantics are gc ground truth, verified against go: physical stacks show every real frame; interface-chain Caller marks land at skip 3 and closure chains at skip 4 (the old expectations encoded shadow-stack frame loss). Perf (best-of, mac/linux): hot.Caller0 17/37ns (Go 155/241), deep.Direct512 2.8µs (Go 9.7µs; was 87-95µs), bigfunc.Work 18µs (Go 30µs; was 433µs), binary size unchanged or smaller. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

IR goldens gain the frame-pointer attribute (out.ll files carry no attribute groups and needed no regeneration); the legacy shadow-stack emitter assertions opt into LLGO_SHADOW_STACK; statement-line probes move to gc ground-truth skip counts; NeedsFramePointer target matrix and pclnpost symbolAddr/decodePtr edges covered. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ct log/slog/testing locations An unrecovered panic now prints a Go-style traceback (function names plus file:line per physical frame) through a PanicTraceback hook the public runtime registers; the clite dladdr dump remains the fallback when the FP walk or the tables are unavailable. Caller-frame tracking now applies uniformly: the blanket stdlib exclusion is gone, so the same per-package reaches-runtime.Caller analysis that already covered third-party code tracks log.Output, slog's Logger.log and testing's decorate chains (their thin wrappers were inlined, making fixed Caller depths count past them — log.Lshortfile printed "???:1"). Call sites into caller-pc-consuming functions of other packages get a statement anchor so the attributed frame reports the exact line. The collector also picks up named-type methods declared by the package itself — a type used only concretely never enters RuntimeTypes, which is exactly how slog.(*Logger).Info escaped tracking. hello-world size cost: +368 bytes (the traceback printer). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Four scenarios, every expectation verified against gc: unrecovered panic tracebacks; log.Lshortfile and slog AddSource (text+JSON, package funcs and logger methods); a failing t.Errorf under llgo test; and an introspection grab-bag (goroutine/init/defer callers, FuncForPC names for methods, closures and generics, the errors-with-stack capture idiom). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…upport Re-expresses the surviving value of xgo-dev#1892 on the xgo-dev#2023 base (its other ~10k lines were an earlier draft of the funcinfo/pclntab machinery, since superseded by xgo-dev#2012/xgo-dev#2016/xgo-dev#2019): - //go:nointerface methods no longer satisfy interfaces: the pragma is recorded at import (cl/import.go -> Program.SetNoInterfaceMethod) and filtered out of abi uncommon method tables; GlobalDCE metadata takes the filtered selection list. Retires the typeparam/mdempsky/15 goroot xfails (validated go1.26 darwin, ci directive mode). - Type-assertion failure between same-named types from different scopes appends '(types from different scopes)' (gc wording). - MatchesClosure unwraps closure types on both sides, fixing assertions between closure and plain function types. - reflect.(*rtype).Method builds the method func value with the closure layout allocation (fixes reflect method-value identity). - xfail: retire fixedbugs/issue16130, fixedbugs/issue29735 (validated go1.24 + go1.26 darwin), and reword typeparam/mdempsky/16 - the panic value now implements runtime.Error; the message still lacks the source interface type and prints the command-line-arguments package path.

Re-expresses xgo-dev#1918 on the xgo-dev#2023 base (its remaining ~11k diff lines were the pre-xgo-dev#2012 funcinfo draft, superseded by the stage-5 chain): - recover() only succeeds when called directly by a deferred function (gc semantics): the panic node records the owning Defer frame at rethrow (panicKey/panicNode + GoDeferData), and Recover checks the caller is that frame's direct deferred call. Closure wraps carry StartRecoverFrameAlias/EndRecoverFrame so method-value and closure adapters stay transparent to the ownership check. - Rethrow keeps the xgo-dev#2023 PanicTraceback hook on the unrecovered path. - xfail: retire fixedbugs/issue4066 (2m-timeout entries; now runs in ~2.7s), fixedbugs/issue73916 and issue73916b (go1.26 recover semantics), validated on darwin/arm64 go1.26. Supersedes xgo-dev#1918.

Re-expresses xgo-dev#1906 on the xgo-dev#2023 base (its remaining ~11k diff lines were the pre-xgo-dev#2012 funcinfo draft, superseded by the stage-5 chain): - cl gains a liveness analysis for stack-allocated objects: allocas whose last use has passed are cleared so bdwgc's conservative stack scan stops keeping dead stack objects (and what they point to) alive; pointer registers are clobbered around the trigger points (llgo_clobber_pointer_regs) and dead stack slots holding the target are zeroed (llgo_clear_stack_ptr, pthread stack-bounds walk). - runtime.SetFinalizer paths (mfinal, runtime_gc, bdwgc binding) hook the cleared-slot machinery so finalizers for dead stack objects run. - xfail: retire deferfin.go, stackobj.go, stackobj3.go, validated on darwin/arm64 go1.24 + go1.26 (stackobj2 already passed). Carries the xgo-dev#2035 shared-GOCACHE commit temporarily (same patch-id, auto-dedups when the chain rebases after xgo-dev#2035 merges). Supersedes xgo-dev#1906.

cpunion · 2026-07-08T07:00:36Z

Folding into #2024 (contains this PR's commits rebased onto current main; see #2012 for the chain note).