…K version to 10.9

Satisfies the Apple Notary.

Fixes #30526

Change-Id: I91cf2d706a3ebe79bafdb759a0d32266ed6b9096
Reviewed-on: https://go-review.googlesource.com/c/go/+/175918
Run-TryBot: Elias Naur <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Keith Randall <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/175919
Reviewed-by: Brad Fitzpatrick <[email protected]>

…ntries of slices

If a slice's entries are sparse, we decide to initialize it dynamically
instead of statically. That's CL 151319.

But if we do initialize it dynamically, we still need to initialize
the static entries. Typically we do that, but the bug fixed here is
that we don't if the entry's value is itself an array or struct.

To fix, use initKindLocalCode to ensure that both static and
dynamic entries are initialized via code.

Fixes #32013

Change-Id: I1192ffdbfb5cd50445c1206c4a3d8253295201dd
Reviewed-on: https://go-review.googlesource.com/c/go/+/176904
Run-TryBot: Keith Randall <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Josh Bleecher Snyder <[email protected]>
(cherry picked from commit a9e107c)
Reviewed-on: https://go-review.googlesource.com/c/go/+/177040
Reviewed-by: Brad Fitzpatrick <[email protected]>

…ndows processes

This is CVE-2019-11888.

Previously, passing a nil environment but a non-nil token would result
in the new potentially unprivileged process inheriting the parent
potentially privileged environment, or would result in the new
potentially privileged process inheriting the parent potentially
unprivileged environment. Either way, it's bad. In the former case, it's
an infoleak. In the latter case, it's a possible EoP, since things like
PATH could be overwritten.

Not specifying an environment currently means, "use the existing
environment". This commit amends the behavior to be, "use the existing
environment of the token the process is being created for." The behavior
therefore stays the same when creating processes without specifying a
token. And it does the correct thing when creating processes when
specifying a token.

Updates #32000
Fixes #32081

Change-Id: Ib4a90cfffb6ba866c855f66f1313372fdd34ce41
Reviewed-on: https://go-review.googlesource.com/c/go/+/177538
Run-TryBot: Jason Donenfeld <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Ian Lance Taylor <[email protected]>

…cy on macOS

CFDictionaryGetValueIfPresent does not take ownership of the value, so
releasing the properties dictionary before passing the value to CFEqual
can crash. Not really clear why this works most of the time.

See https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFMemoryMgmt/Concepts/Ownership.html

Fixes #32282
Updates #28092
Updates #30763

Change-Id: I5ee7ca276b753a48abc3aedfb78b8af68b448dd4
Reviewed-on: https://go-review.googlesource.com/c/go/+/178537
Reviewed-by: Adam Langley <[email protected]>
(cherry picked from commit a3d4655)
Reviewed-on: https://go-review.googlesource.com/c/go/+/179339
Run-TryBot: Dmitri Shuralyov <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Dmitri Shuralyov <[email protected]>

…err on server 408 reply

HTTP 408 responses now exist and are seen in the wild (e.g. from
Google's GFE), so make Go's HTTP client not spam about them when seen.
They're normal (now).

Fixes #32367
Updates #32310

Change-Id: I558eb4654960c74cf20db1902ccaae13d03310f6
Reviewed-on: https://go-review.googlesource.com/c/go/+/179457
Run-TryBot: Brad Fitzpatrick <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Dmitri Shuralyov <[email protected]>
(cherry picked from commit ba66d89)
Reviewed-on: https://go-review.googlesource.com/c/go/+/181239
Run-TryBot: Dmitri Shuralyov <[email protected]>
Reviewed-by: Brad Fitzpatrick <[email protected]>

…uilt as libraries

This fixes TestScript/cover_pkgall_multiple_mains, which started
failing after CL 174657.

When compiling main packages with coverage instrumentation
(e.g., for -coverpkg all), we now pass -p with the full import path
instead of '-p main'. This avoids link errors
'duplicate symbol main.main (types 1 and 1)'.

Fixes #32295
Updates #31946
Updates #32150

Change-Id: Id147527b1dbdc14bb33ac133c30d50c250b4365c
Reviewed-on: https://go-review.googlesource.com/c/go/+/176558
Run-TryBot: Jay Conrod <[email protected]>
Reviewed-by: Cherry Zhang <[email protected]>
Reviewed-by: Bryan C. Mills <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
(cherry picked from commit 3b8c804)
Reviewed-on: https://go-review.googlesource.com/c/go/+/179677

This is a backport of CL 178397.

Updates #32167
Fixes #32168

Change-Id: Idb16a01d56814ea09ad277798787355dc6a3121f
Reviewed-on: https://go-review.googlesource.com/c/go/+/181437
Reviewed-by: Jason Donenfeld <[email protected]>
Reviewed-by: Emmanuel Odeke <[email protected]>
Run-TryBot: Jason Donenfeld <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>

The logic for detecting deferreturn calls is wrong.

We used to look for a relocation whose symbol is runtime.deferreturn
and has an offset of 0. But on some architectures, the relocation
offset is not zero. These include arm (the offset is 0xebfffffe) and
s390x (the offset is 6).

This ends up setting the deferreturn offset at 0, so we end up using
the entry point live map instead of the deferreturn live map in a
frame which defers and then segfaults.

Instead, use the IsDirectJump helper to find calls.

Fixes #32484

Change-Id: Iecb530a7cf6eabd7233be7d0731ffa78873f3a54
Reviewed-on: https://go-review.googlesource.com/c/go/+/181258
Run-TryBot: Keith Randall <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Cherry Zhang <[email protected]>
(cherry picked from commit 9eb4031)
Reviewed-on: https://go-review.googlesource.com/c/go/+/181262
Reviewed-by: Emmanuel Odeke <[email protected]>
Run-TryBot: Emmanuel Odeke <[email protected]>

Change-Id: I1c3e3305dfee4545a6caedd48243770ab3b28277
Reviewed-on: https://go-review.googlesource.com/c/go/+/181550
Reviewed-by: Filippo Valsorda <[email protected]>
(cherry picked from commit 5545301)
Reviewed-on: https://go-review.googlesource.com/c/go/+/181552

Change-Id: I8ae00d2392c20c627d58cf7e79015e982b971802
Reviewed-on: https://go-review.googlesource.com/c/go/+/181551
Reviewed-by: Filippo Valsorda <[email protected]>
(cherry picked from commit ef84fa0)
Reviewed-on: https://go-review.googlesource.com/c/go/+/181598

Change-Id: If156d9582ad5d76589e83ac00b4fa7f3b61f1502
Reviewed-on: https://go-review.googlesource.com/c/go/+/181658
Run-TryBot: Dmitri Shuralyov <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Katie Hockman <[email protected]>