runtime: make fatal failures unrecoverable

Match the Go runtime by terminating for deadlocks, stack overflows,
runtime and GC invariants, invalid lock operations, and platform
initialization failures instead of routing them through panic/recover.

Keep language-level runtime errors and unsupported user operations
recoverable. Add crash coverage that verifies fatal errors bypass deferred
recover calls.

Author: jakebailey

main_test.go

@@ -988,15 +988,15 @@ func TestGoexitCrash(t *testing.T) {
 		name string
 		want string
 	}{
-		{"main", "all goroutines are asleep - deadlock!"},
-		{"deadlock", "all goroutines are asleep - deadlock!"},
-		{"exit", "all goroutines are asleep - deadlock!"},
-		{"main-other", "all goroutines are asleep - deadlock!"},
-		{"in-panic", "all goroutines are asleep - deadlock!"},
+		{"main", "fatal error: all goroutines are asleep - deadlock!"},
+		{"deadlock", "fatal error: all goroutines are asleep - deadlock!"},
+		{"exit", "fatal error: all goroutines are asleep - deadlock!"},
+		{"main-other", "fatal error: all goroutines are asleep - deadlock!"},
+		{"in-panic", "fatal error: all goroutines are asleep - deadlock!"},
 		{"panic", "panic: panic after Goexit"},
-		{"recovered-panic", "all goroutines are asleep - deadlock!"},
-		{"recover-before-panic", "all goroutines are asleep - deadlock!"},
-		{"recover-before-panic-loop", "all goroutines are asleep - deadlock!"},
+		{"recovered-panic", "fatal error: all goroutines are asleep - deadlock!"},
+		{"recover-before-panic", "fatal error: all goroutines are asleep - deadlock!"},
+		{"recover-before-panic-loop", "fatal error: all goroutines are asleep - deadlock!"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			output := &bytes.Buffer{}
@@ -1017,6 +1017,34 @@ func TestGoexitCrash(t *testing.T) {
 	}
 }
 
+func TestRuntimeFatal(t *testing.T) {
+	t.Parallel()
+
+	options := optionsFromTarget("", sema)
+	config, err := builder.NewConfig(&options)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	output := &bytes.Buffer{}
+	_, err = buildAndRun("testdata/runtimefatal.go", config, output, nil, nil, time.Minute, func(cmd *exec.Cmd, result builder.BuildResult) error {
+		cmd.Stdout = nil
+		cmd.Stderr = nil
+		data, err := cmd.CombinedOutput()
+		output.Write(data)
+		return err
+	})
+	if err == nil {
+		t.Fatal("program unexpectedly exited successfully")
+	}
+	if want := "fatal error: sync: unlock of unlocked Mutex"; !strings.Contains(output.String(), want) {
+		t.Fatalf("output does not contain %q:\n%s", want, output.String())
+	}
+	if strings.Contains(output.String(), "recovered:") {
+		t.Fatalf("fatal runtime error was recovered:\n%s", output.String())
+	}
+}
+
 func TestTest(t *testing.T) {
 	t.Parallel()
 

src/internal/task/fatal.go

@@ -0,0 +1,6 @@
+package task
+
+import _ "unsafe"
+
+//go:linkname runtimeFatal runtime.runtimeFatal
+func runtimeFatal(msg string)

src/internal/task/mutex-cooperative.go

@@ -20,7 +20,7 @@ func (m *Mutex) Lock() {
 
 func (m *Mutex) Unlock() {
 	if !m.locked {
-		panic("sync: unlock of unlocked Mutex")
+		runtimeFatal("sync: unlock of unlocked Mutex")
 	}
 
 	// Wake up a blocked task, if applicable.

src/internal/task/mutex-preemptive.go

@@ -49,7 +49,7 @@ func (m *Mutex) Lock() {
 func (m *Mutex) Unlock() {
 	if old := m.futex.Swap(0); old == 0 {
 		// Mutex wasn't locked before.
-		panic("sync: unlock of unlocked Mutex")
+		runtimeFatal("sync: unlock of unlocked Mutex")
 	} else if old == 2 {
 		// Mutex was a contended lock, so we need to wake the next waiter.
 		m.futex.Wake()

src/internal/task/queue.go

@@ -15,7 +15,7 @@ func (q *Queue) Push(t *Task) {
 	mask := lockAtomics()
 	if asserts && t.Next != nil {
 		unlockAtomics(mask)
-		panic("runtime: pushing a task to a queue with a non-nil Next pointer")
+		runtimeFatal("runtime: pushing a task to a queue with a non-nil Next pointer")
 	}
 	if q.tail != nil {
 		q.tail.Next = t
@@ -78,7 +78,7 @@ func (s *Stack) Push(t *Task) {
 	mask := lockAtomics()
 	if asserts && t.Next != nil {
 		unlockAtomics(mask)
-		panic("runtime: pushing a task to a stack with a non-nil Next pointer")
+		runtimeFatal("runtime: pushing a task to a stack with a non-nil Next pointer")
 	}
 	s.top, t.Next = t, s.top
 	unlockAtomics(mask)

src/internal/task/task_asyncify.go

@@ -11,9 +11,6 @@ import (
 // otherwise Go wouldn't allow the cast to a smaller integer size.
 const stackCanary = uintptr(uint64(0x670c1333b83bf575) & uint64(^uintptr(0)))
 
-//go:linkname runtimePanic runtime.runtimePanic
-func runtimePanic(str string)
-
 // state is a structure which holds a reference to the state of the task.
 // When the task is suspended, the stack pointers are saved here.
 type state struct {
@@ -95,7 +92,7 @@ func Current() *Task {
 // This function may only be called when running on a goroutine stack, not when running on the system stack.
 func Pause() {
 	if *currentTask.state.canaryPtr != stackCanary {
-		runtimePanic("stack overflow")
+		runtimeFatal("stack overflow")
 	}
 
 	currentTask.state.unwind()
@@ -124,7 +121,7 @@ func (t *Task) Resume() {
 	currentTask = prevTask
 	t.gcData.swap()
 	if uintptr(t.state.asyncifysp) > uintptr(t.state.csp) {
-		runtimePanic("stack overflow")
+		runtimeFatal("stack overflow")
 	}
 }
 

src/internal/task/task_exit.go

@@ -28,15 +28,15 @@ func exit(goexit bool) {
 	if t == mainTask {
 		if goexit {
 			if remaining == 0 {
-				runtimePanic("all goroutines are asleep - deadlock!")
+				runtimeFatal("all goroutines are asleep - deadlock!")
 			}
 			atomic.StoreUint32(&mainExitedByGoexit, 1)
 		}
 	} else if atomic.LoadUint32(&mainExitedByGoexit) != 0 && remaining == 0 {
-		runtimePanic("all goroutines are asleep - deadlock!")
+		runtimeFatal("all goroutines are asleep - deadlock!")
 	}
 
 	// TODO: explicitly free the stack after switching back to the scheduler.
 	Pause()
-	runtimePanic("unreachable")
+	runtimeFatal("unreachable")
 }

src/internal/task/task_stack.go

@@ -6,9 +6,6 @@ import (
 	"unsafe"
 )
 
-//go:linkname runtimePanic runtime.runtimePanic
-func runtimePanic(str string)
-
 // Stack canary, to detect a stack overflow. The number is a random number
 // generated by random.org. The bit fiddling dance is necessary because
 // otherwise Go wouldn't allow the cast to a smaller integer size.

src/internal/task/task_stack_multicore.go

@@ -23,10 +23,10 @@ func PauseLocked() {
 	// valid. If it is not, a stack overflow has occurred.
 	current := Current()
 	if *current.state.canaryPtr != stackCanary {
-		runtimePanic("goroutine stack overflow")
+		runtimeFatal("goroutine stack overflow")
 	}
 	if interrupt.In() {
-		runtimePanic("blocked inside interrupt")
+		runtimeFatal("blocked inside interrupt")
 	}
 	if current.RunState == RunStateResuming {
 		// Another core already marked this goroutine as ready to resume.

src/internal/task/task_stack_unicore.go

@@ -18,10 +18,10 @@ func Pause() {
 	// Check whether the canary (the lowest address of the stack) is still
 	// valid. If it is not, a stack overflow has occurred.
 	if *currentTask.state.canaryPtr != stackCanary {
-		runtimePanic("goroutine stack overflow")
+		runtimeFatal("goroutine stack overflow")
 	}
 	if interrupt.In() {
-		runtimePanic("blocked inside interrupt")
+		runtimeFatal("blocked inside interrupt")
 	}
 	currentTask.state.pause()
 }