v1.15.0: concurrent Unmarshal can crash with "found pointer to free object" in jitdec.decodeTypedPointer

[thrasher-]

Describe the bug

Initially spotted here: https://github.com/thrasher-/gocryptotrader/actions/runs/22474422306/job/65098292110#step:11:101

github.com/bytedance/sonic v1.15.0 crashes under concurrent Unmarshal with runtime memory corruption.
The crash reproduces in a pure standalone Go repro that uses only Sonic + stdlib + local JSON fixtures.

Test repo can be found here: sonic-standalone.tar.gz

To Reproduce

Steps to reproduce the behavior:

1. Download/clone the standalone repro and cd into it.
2. Run:
   go run ./main.go -workers 64 -iters 800
3. Wait a few seconds while concurrent decode runs.
4. See error (fatal error: found pointer to free object, sometimes other runtime corruption errors).

Expected behavior

Concurrent decode should complete without runtime corruption, panic, or segfault.

Screenshots

N/A (terminal crash output only)

Sonic version:

github.com/bytedance/sonic v1.15.0

Environment:

The output of go env.

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/thrasher/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/thrasher/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4114862870=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/home/thrasher/dev/gocryptotrader/go.mod'
GOMODCACHE='/home/thrasher/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/thrasher/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/thrasher/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

Additional context

Crash signatures include:

• fatal error: found pointer to free object
• runtime: marked free object in span ...
• stack frames repeatedly through:
  • github.com/bytedance/sonic/internal/decoder/jitdec.decodeTypedPointer
  • github.com/bytedance/sonic.frozenConfig.UnmarshalFromString (sonic.go:118)

This reproduces frequently in the standalone repro and does not depend on any external API calls during the failing decode stage.

[liuq19]

i reproduced it, wil fix

[thrasher-]

sonic v1.15.0 + Go 1.24+ (swiss maps): GoMapType struct layout mismatch causes wrong IndirectElem() results

Two bugs in internal/rt/fastvalue.go:

Bug 1 - Struct layout mismatch: GoMapType still has the old bucket-map field layout after Hasher:

• sonic: KeySize uint8 + ElemSize uint8 + BucketSize uint16 + Flags uint32 = 8 bytes
• Go 1.24+ swiss maps: GroupSize uintptr + SlotSize uintptr + ElemOff uintptr + Flags uint32 = 28 bytes
• Total struct: sonic = 88 bytes, actual = 112 bytes (24 byte difference)
• Flags at offset 84 in sonic vs 104 in reality (20 bytes off)

Bug 2 - IndirectElem bit mask: IndirectElem() checks Flags & 2 which was correct for old maps but wrong for swiss maps where MapIndirectElem = 1 << 3 = 8.

Concrete impact:

For maps with values > 128 bytes (MapMaxElemBytes), IndirectElem() returns false when it should return true. The JIT decoder (assembler_regabi_amd64.go:1020) uses this to decide whether to
follow a pointer - getting it wrong means treating a pointer as inline data or vice versa.

This bug has existed since Go 1.24 when swiss maps became the default. The Go 1.26 support PR (#898) fixed GoMapIterator and TFlagDirectIface but missed GoMapType.

CI symptoms (intermittent, with -race):

• fatal error: unexpected signal during runtime execution [SIGSEGV in runtime.(*timers).cleanHead]
• fatal error: found pointer to free object [during GC sweep]

Reproduction:

go test -v -run TestGoMapTypeLayoutMismatch ./...

package main

import (
	"reflect"
	"testing"
	"unsafe"
)

// GoType mirrors sonic v1.15.0's internal/rt.GoType (== Go's internal/abi.Type).
// This base type layout is the same in both sonic and Go 1.24+.
type GoType struct {
	Size       uintptr
	PtrData    uintptr
	Hash       uint32
	Flags      uint8
	Align      uint8
	FieldAlign uint8
	KindFlags  uint8
	Traits     unsafe.Pointer
	GCData     *byte
	Str        int32
	PtrToSelf  int32
}

// SonicGoMapType is sonic v1.15.0's GoMapType (internal/rt/fastvalue.go:102-112).
// Uses the pre-swiss-map (bucket) layout for fields after Hasher.
type SonicGoMapType struct {
	GoType
	Key        *GoType
	Elem       *GoType
	Bucket     *GoType
	Hasher     func(unsafe.Pointer, uintptr) uintptr
	KeySize    uint8
	ElemSize   uint8
	BucketSize uint16
	Flags      uint32
}

// ActualMapType is Go 1.24+'s abi.MapType (internal/abi/map.go:32-43).
// Swiss maps (default since Go 1.24) use uintptr-sized fields after Hasher.
type ActualMapType struct {
	GoType
	Key       *GoType
	Elem      *GoType
	Group     *GoType
	Hasher    func(unsafe.Pointer, uintptr) uintptr
	GroupSize uintptr
	SlotSize  uintptr
	ElemOff   uintptr
	Flags     uint32
}

// Swiss map flag constants (from Go 1.24+ internal/abi/map.go)
const (
	MapNeedKeyUpdate = 1 << iota // 1
	MapHashMightPanic            // 2
	MapIndirectKey               // 4
	MapIndirectElem              // 8
)

type GoIface struct {
	Itab  unsafe.Pointer
	Value unsafe.Pointer
}

func unpackType(t reflect.Type) unsafe.Pointer {
	return (*GoIface)(unsafe.Pointer(&t)).Value
}

// TestGoMapTypeLayoutMismatch demonstrates that sonic v1.15.0's GoMapType does not
// match Go 1.24+'s abi.MapType layout (swiss maps, default since Go 1.24).
//
// Two bugs:
//
// BUG 1 - Struct field sizes after Hasher:
//    sonic:   KeySize(1B) + ElemSize(1B) + BucketSize(2B) + Flags(4B) = 8 bytes total
//    Go 1.24: GroupSize(8B) + SlotSize(8B) + ElemOff(8B) + Flags(4B)  = 28 bytes total
//    → GoMapType is 88 bytes but the actual type is 112 bytes (24B short)
//    → Flags field is at offset 84 in sonic vs offset 104 in reality (20B off)
//
// BUG 2 - IndirectElem bit mask:
//    sonic:   Flags & 2 (correct for old bucket maps)
//    Go 1.24: Flags & 8 (MapIndirectElem = 1 << 3 for swiss maps)
//
// Impact: For map types with values > 128 bytes (MapMaxElemBytes), IndirectElem()
// returns false when it should return true. This causes sonic's JIT decoder
// (assembler_regabi_amd64.go:1020) to skip pointer dereference for indirect map
// values, treating a pointer as inline data → memory corruption.
//
// Observed in CI (Go 1.25 and 1.26, -race, -tags=sonic_on):
//   fatal error: unexpected signal during runtime execution [SIGSEGV]
//   fatal error: found pointer to free object
func TestGoMapTypeLayoutMismatch(t *testing.T) {
	sonicSize := unsafe.Sizeof(SonicGoMapType{})
	actualSize := unsafe.Sizeof(ActualMapType{})
	sonicFlagsOff := unsafe.Offsetof(SonicGoMapType{}.Flags)
	actualFlagsOff := unsafe.Offsetof(ActualMapType{}.Flags)

	t.Logf("sizeof sonic GoMapType:  %d bytes", sonicSize)
	t.Logf("sizeof actual MapType:   %d bytes", actualSize)
	t.Logf("size difference:         %d bytes", int(actualSize)-int(sonicSize))
	t.Log("")
	t.Logf("sonic GoMapType.Flags offset:  %d", sonicFlagsOff)
	t.Logf("actual MapType.Flags offset:   %d", actualFlagsOff)
	t.Logf("Flags offset difference:       %d bytes", int(actualFlagsOff)-int(sonicFlagsOff))

	if sonicSize != actualSize {
		t.Errorf("BUG 1: struct size mismatch: sonic=%d bytes, actual=%d bytes", sonicSize, actualSize)
	}
	if sonicFlagsOff != actualFlagsOff {
		t.Errorf("BUG 1: Flags offset mismatch: sonic reads at offset %d, actual is at offset %d",
			sonicFlagsOff, actualFlagsOff)
	}

	t.Log("")
	t.Logf("sonic IndirectElem bit mask:  Flags & 2")
	t.Logf("actual IndirectElem bit mask: Flags & %d (MapIndirectElem)", MapIndirectElem)
	if 2 != MapIndirectElem {
		t.Errorf("BUG 2: IndirectElem bit: sonic uses 2, actual is %d", MapIndirectElem)
	}

	// Test against real runtime type metadata
	type LargeValue struct {
		Data [256]byte // > MapMaxElemBytes (128), triggers IndirectElem
	}

	mapTypes := []struct {
		typ  reflect.Type
		desc string
	}{
		{reflect.TypeOf(map[string]string(nil)), "small value (string header = 16B)"},
		{reflect.TypeOf(map[string]any(nil)), "interface value (16B)"},
		{reflect.TypeOf(map[string]int(nil)), "int value (8B)"},
		{reflect.TypeOf(map[string]LargeValue(nil)), "LARGE value (256B > 128B limit)"},
		{reflect.TypeOf(map[string][200]byte(nil)), "LARGE array (200B > 128B limit)"},
	}

	t.Log("")
	for _, mt := range mapTypes {
		ptr := unpackType(mt.typ)

		sonicFlags := *(*uint32)(unsafe.Add(ptr, sonicFlagsOff))
		sonicIE := sonicFlags&2 != 0

		actualFlags := *(*uint32)(unsafe.Add(ptr, actualFlagsOff))
		actualIE := actualFlags&MapIndirectElem != 0

		status := "same (by luck)"
		if sonicIE != actualIE {
			status = "MISMATCH → memory corruption"
		}
		t.Logf("%-40s sonic_IE=%-5v  actual_IE=%-5v  %s", mt.desc, sonicIE, actualIE, status)
	}
}

[thrasher-]

Additional findings: two separate bugs

After further investigation, I believe this issue actually contains two independent bugs:

Bug A — jitdec memory corruption with [N]any{&field} pattern (this issue's crash)

Workaround: SONIC_USE_OPTDEC=1 eliminates the crash entirely, confirming the bug is in the JIT decoder specifically, not the opt decoder.

The crash is triggered by custom UnmarshalJSON methods that decode into interface arrays containing pointer targets:

func (o *OrderbookItem) UnmarshalJSON(data []byte) error {
    return sonic.ConfigStd.Unmarshal(data, &[4]any{&o.Price, &o.Amount, &o.LiqOrders, &o.NumOrders})
}

Under concurrent load with GC pressure, the JIT decoder appears to mishandle pointer writes through interface slots — likely missing GC write barriers or producing incorrect stack maps for the [N]any{&ptr} decode shape.

Stress test (intermittent, depends on GC timing):

go test -race -count=10 -timeout=300s -run TestJitDecInterfacePointers

Bug B — GoMapType struct layout mismatch (separate, deterministic)

(Detailed in my previous comment.) GoMapType in internal/rt/fastvalue.go still has the old bucket-map layout. On Go 1.24+ with swiss maps, it reads the wrong Flags offset and uses the wrong IndirectElem bit mask. This causes incorrect behavior for maps with values > 128 bytes.

This is deterministic and reproducible but does NOT cause the OKX crashes since those code paths don't use maps with large values. It could however cause memory corruption in other sonic users who do.

Summary

Bug	Trigger	Deterministic?	Workaround
A (jitdec)	[N]any{&field} unmarshal pattern + concurrent GC	Intermittent	SONIC_USE_OPTDEC=1
B (GoMapType)	Maps with values > 128 bytes on Go 1.24+	Yes	None known

[thrasher-]

sonic v1.15.0 + Go 1.24+ (swiss maps): GoMapType struct layout mismatch causes wrong IndirectElem() results

Two bugs in internal/rt/fastvalue.go:

Bug 1 - Struct layout mismatch: GoMapType still has the old bucket-map field layout after Hasher:

• sonic: KeySize uint8 + ElemSize uint8 + BucketSize uint16 + Flags uint32 = 8 bytes
• Go 1.24+ swiss maps: GroupSize uintptr + SlotSize uintptr + ElemOff uintptr + Flags uint32 = 28 bytes
• Total struct: sonic = 88 bytes, actual = 112 bytes (24 byte difference)
• Flags at offset 84 in sonic vs 104 in reality (20 bytes off)

Bug 2 - IndirectElem bit mask: IndirectElem() checks Flags & 2 which was correct for old maps but wrong for swiss maps where MapIndirectElem = 1 << 3 = 8.

Concrete impact:

For maps with values > 128 bytes (MapMaxElemBytes), IndirectElem() returns false when it should return true. The JIT decoder (assembler_regabi_amd64.go:1020) uses this to decide whether to follow a pointer - getting it wrong means treating a pointer as inline data or vice versa.

This bug has existed since Go 1.24 when swiss maps became the default. The Go 1.26 support PR (#898) fixed GoMapIterator and TFlagDirectIface but missed GoMapType.

CI symptoms (intermittent, with -race):

• fatal error: unexpected signal during runtime execution [SIGSEGV in runtime.(*timers).cleanHead]
• fatal error: found pointer to free object [during GC sweep]

Reproduction:

go test -v -run TestGoMapTypeLayoutMismatch ./...

package main

import (
"reflect"
"testing"
"unsafe"
)

// GoType mirrors sonic v1.15.0's internal/rt.GoType (== Go's internal/abi.Type).
// This base type layout is the same in both sonic and Go 1.24+.
type GoType struct {
Size uintptr
PtrData uintptr
Hash uint32
Flags uint8
Align uint8
FieldAlign uint8
KindFlags uint8
Traits unsafe.Pointer
GCData *byte
Str int32
PtrToSelf int32
}

// SonicGoMapType is sonic v1.15.0's GoMapType (internal/rt/fastvalue.go:102-112).
// Uses the pre-swiss-map (bucket) layout for fields after Hasher.
type SonicGoMapType struct {
GoType
Key *GoType
Elem *GoType
Bucket *GoType
Hasher func(unsafe.Pointer, uintptr) uintptr
KeySize uint8
ElemSize uint8
BucketSize uint16
Flags uint32
}

// ActualMapType is Go 1.24+'s abi.MapType (internal/abi/map.go:32-43).
// Swiss maps (default since Go 1.24) use uintptr-sized fields after Hasher.
type ActualMapType struct {
GoType
Key *GoType
Elem *GoType
Group *GoType
Hasher func(unsafe.Pointer, uintptr) uintptr
GroupSize uintptr
SlotSize uintptr
ElemOff uintptr
Flags uint32
}

// Swiss map flag constants (from Go 1.24+ internal/abi/map.go)
const (
MapNeedKeyUpdate = 1 << iota // 1
MapHashMightPanic // 2
MapIndirectKey // 4
MapIndirectElem // 8
)

type GoIface struct {
Itab unsafe.Pointer
Value unsafe.Pointer
}

func unpackType(t reflect.Type) unsafe.Pointer {
return (*GoIface)(unsafe.Pointer(&t)).Value
}

// TestGoMapTypeLayoutMismatch demonstrates that sonic v1.15.0's GoMapType does not
// match Go 1.24+'s abi.MapType layout (swiss maps, default since Go 1.24).
//
// Two bugs:
//
// BUG 1 - Struct field sizes after Hasher:
// sonic: KeySize(1B) + ElemSize(1B) + BucketSize(2B) + Flags(4B) = 8 bytes total
// Go 1.24: GroupSize(8B) + SlotSize(8B) + ElemOff(8B) + Flags(4B) = 28 bytes total
// → GoMapType is 88 bytes but the actual type is 112 bytes (24B short)
// → Flags field is at offset 84 in sonic vs offset 104 in reality (20B off)
//
// BUG 2 - IndirectElem bit mask:
// sonic: Flags & 2 (correct for old bucket maps)
// Go 1.24: Flags & 8 (MapIndirectElem = 1 << 3 for swiss maps)
//
// Impact: For map types with values > 128 bytes (MapMaxElemBytes), IndirectElem()
// returns false when it should return true. This causes sonic's JIT decoder
// (assembler_regabi_amd64.go:1020) to skip pointer dereference for indirect map
// values, treating a pointer as inline data → memory corruption.
//
// Observed in CI (Go 1.25 and 1.26, -race, -tags=sonic_on):
// fatal error: unexpected signal during runtime execution [SIGSEGV]
// fatal error: found pointer to free object
func TestGoMapTypeLayoutMismatch(t *testing.T) {
sonicSize := unsafe.Sizeof(SonicGoMapType{})
actualSize := unsafe.Sizeof(ActualMapType{})
sonicFlagsOff := unsafe.Offsetof(SonicGoMapType{}.Flags)
actualFlagsOff := unsafe.Offsetof(ActualMapType{}.Flags)

t.Logf("sizeof sonic GoMapType: %d bytes", sonicSize)
t.Logf("sizeof actual MapType: %d bytes", actualSize)
t.Logf("size difference: %d bytes", int(actualSize)-int(sonicSize))
t.Log("")
t.Logf("sonic GoMapType.Flags offset: %d", sonicFlagsOff)
t.Logf("actual MapType.Flags offset: %d", actualFlagsOff)
t.Logf("Flags offset difference: %d bytes", int(actualFlagsOff)-int(sonicFlagsOff))

if sonicSize != actualSize {
t.Errorf("BUG 1: struct size mismatch: sonic=%d bytes, actual=%d bytes", sonicSize, actualSize)
}
if sonicFlagsOff != actualFlagsOff {
t.Errorf("BUG 1: Flags offset mismatch: sonic reads at offset %d, actual is at offset %d",
sonicFlagsOff, actualFlagsOff)
}

t.Log("")
t.Logf("sonic IndirectElem bit mask: Flags & 2")
t.Logf("actual IndirectElem bit mask: Flags & %d (MapIndirectElem)", MapIndirectElem)
if 2 != MapIndirectElem {
t.Errorf("BUG 2: IndirectElem bit: sonic uses 2, actual is %d", MapIndirectElem)
}

// Test against real runtime type metadata
type LargeValue struct {
Data [256]byte // > MapMaxElemBytes (128), triggers IndirectElem
}

mapTypes := []struct {
typ reflect.Type
desc string
}{
{reflect.TypeOf(map[string]string(nil)), "small value (string header = 16B)"},
{reflect.TypeOf(map[string]any(nil)), "interface value (16B)"},
{reflect.TypeOf(map[string]int(nil)), "int value (8B)"},
{reflect.TypeOf(map[string]LargeValue(nil)), "LARGE value (256B > 128B limit)"},
{reflect.TypeOf(map[string][200]byte(nil)), "LARGE array (200B > 128B limit)"},
}

t.Log("")
for _, mt := range mapTypes {
ptr := unpackType(mt.typ)

  sonicFlags := *(*uint32)(unsafe.Add(ptr, sonicFlagsOff))
  sonicIE := sonicFlags&2 != 0

  actualFlags := *(*uint32)(unsafe.Add(ptr, actualFlagsOff))
  actualIE := actualFlags&MapIndirectElem != 0

  status := "same (by luck)"
  if sonicIE != actualIE {
  	status = "MISMATCH → memory corruption"
  }
  t.Logf("%-40s sonic_IE=%-5v  actual_IE=%-5v  %s", mt.desc, sonicIE, actualIE, status)

}
}

@liuq19 thanks for resolving the first issue. Would you like me to me to create a new issue for this?

[lxcxjxhx]

I've analyzed the GoMapType layout mismatch issue. The root cause is clear: sonic's GoMapType struct still uses the pre-Go 1.24 bucket-map layout, but Go 1.24+ switched to swiss maps with different field sizes and offsets.

Key findings:

1. Size mismatch: sonic's GoMapType is 88 bytes, actual is 112 bytes (24 bytes short)
2. Flags offset: sonic reads at offset 84, actual is at offset 104 (20 bytes off)
3. IndirectElem bit: sonic uses Flags & 2, but swiss maps use Flags & 8 (MapIndirectElem)

Impact: For maps with values > 128 bytes, IndirectElem() returns wrong results, causing the JIT decoder to mishandle pointer dereferencing → memory corruption.

Fix approach: Update internal/rt/fastvalue.go to match Go 1.24+ �bi.MapType layout:

• Replace KeySize/ElemSize/BucketSize/Flags with GroupSize/SlotSize/ElemOff/Flags (all uintptr except Flags)
• Update IndirectElem() to check bit 3 instead of bit 1
• Add build tags for Go version compatibility (pre-1.24 vs 1.24+)

This is a critical bug for anyone using sonic with Go 1.24+ and maps containing large values. I can submit a PR if the maintainers confirm the approach.

CC: @liuq19 @AsterDY

[liuq19]

fixed in #951