为什么指向局部变量的指针会转义到堆？

Question

这是我的环境:

[lorneli@localhost GoTest]$ go version
go version go1.9 linux/amd64

这是我的计划:

package main

type request struct {
    ID string
    size uint32
    off uint64
}

func main() {
    r := request{}
    iter := interface{}(&r) // &r escapes to heap
    iters := make([]interface{}, 0)
    iters = append(iters, iter)
}

我分配一个request实例并将其指针转换为interface{}.但是在使用flag进行分析时-gcflags "-m",我发现转换时实例会转义为堆.为什么会这样？

这是分析结果:

[lorneli@localhost GoTest]$ go build -gcflags "-m"
# _/mnt/hgfs/vmfolder/workspace/GoTest
./main.go:9:6: can inline main
./main.go:11:21: (interface {})(&r) escapes to heap
./main.go:11:22: &r escapes to heap
./main.go:10:15: moved to heap: r
./main.go:12:15: main make([]interface {}, 0) does not escape

我认为这个案例与"逃避分析缺陷"中列出的任何案例都不匹配.

Answer 1

简化您的示例。用进行分析-gcflags='-m -m'。

范例1：

package main

func main() {
    var v int
    s := make([]*int, 0)
    s = append(s, &v) // &v escapes to heap
}

输出：

$ go version
go version devel +df8c2b905b Tue Mar 6 06:13:17 2018 +0000 linux/amd64
$ go run -gcflags='-m -m' esc.go
# command-line-arguments
./esc.go:3:6: can inline main as: func() { var v int; v = <N>; s := make([]*int, 0); s = append(s, &v) }
./esc.go:6:16: &v escapes to heap
./esc.go:6:16:  from append(s, &v) (appended to slice) at ./esc.go:6:12
./esc.go:4:6: moved to heap: v
./esc.go:5:11: main make([]*int, 0) does not escape
$ 

转义分析确定是否对值的任何引用都转义了声明该值的函数。v在函数中声明的对变量的引用main作为函数的参数进行转义append：&v escapes to heap from append(s, &v)，moved to heap: v。

范例2：

package main

func main() {
    var v int
    lc := 1
    s := make([]*int, lc)
    s[0] = &v
}

$ go run -gcflags='-m -m' esc2.go
./esc2.go:3:6: can inline main as: func() { var v int; v = <N>; lc := 1; s := make([]*int, lc); s[0] = &v }
./esc2.go:6:11: make([]*int, lc) escapes to heap
./esc2.go:6:11:     from make([]*int, lc) (too large for stack) at ./esc2.go:6:11
./esc2.go:7:9: &v escapes to heap
./esc2.go:7:9:  from s[0] (slice-element-equals) at ./esc2.go:7:7
./esc2.go:4:6: moved to heap: v
$ 

type slice struct {
    array unsafe.Pointer
    len   int
    cap   int
}

make切片返回切片描述符struct（指向基础数组，长度和容量的指针）并分配基础切片元素数组。底层数组通常在堆上分配：make([]*int, lc) escapes to heap from make([]*int, lc)。

s[0] = &v存储对变量的引用v（&v）在堆上底层阵列中：&v escapes to heap from s[0] (slice-element-equals)，moved to heap: v。函数结束并回收其堆栈之后，引用将保留在堆上，直到对基础数组进行垃圾回收为止。

如果make切片容量是一个小的（编译时）常数，则make([]*int, 1)在您的示例中，基础数组可能会分配在堆栈上。但是，转义分析没有考虑到这一点。