runtime: writebarrier inheap check is racy

[dvyukov]

In heap does the following:

func inheap(b uintptr) bool {
    if b == 0 || b < mheap_.arena_start || b >= mheap_.arena_used {
        return false
    }
    ...
    s := h_spans[x]
    ...
}

while mHeap_SysAlloc does the following:

func mHeap_SysAlloc(h *mheap, n uintptr) unsafe.Pointer {
                h.arena_used = p + (-uintptr(p) & (_PageSize - 1))
...
        mHeap_MapSpans(h, p+n)
}

Now consider that there is a non-Go-heap mmap in the heap area. It is possible that mHeap_SysAlloc updates h.arena_used to include the non-Go-heap region, however h_spans are not yet mapped for that region. Now another goroutine invokes writebarrier for a pointer in non-Go-heap region. The writebarrier invokes inheap, inheap checks that the pointer value is within [arena_start, mheap_.arena_used) and accesses h_spans for the pointer. However, h_spans is not yet mapped for the region. Bang!

I believe that's what happens on the windows builders:
http://build.golang.org/log/85ba224f0fe7b0d2d4c5e63ca6f7643131b0dba3
http://build.golang.org/log/6242a4b521f0e5bcce48db07a8eb51d3b874b7c7
http://build.golang.org/log/20d249a8596c79b11043f704fda3aa404e1808b3
http://build.golang.org/log/16e89685e920d8af90b39a1f55e692650b07c121
http://build.golang.org/log/0b17582865258804b41b8157bb5dd09a245f2bc9

/cc @aclements @rsc

[aclements]

Thanks. I thought Russ had gotten all of these. I'll check for more arena_used updates without preceding MapSpans and send a CL. I suspect this is also what's crashing FreeBSD 386.

[aclements]

No thanks to GitHub's issue search, I finally found the corresponding FreeBSD issue: #10212.

I went through all of the updates to arena_used (there aren't many) and it looks like only this one slipped through the cracks.

[aclements]

I meant to close this from the commit, but apparently didn't get the syntax quite right.