code review 4634073: gc: Escape analysis.

src/cmd/gc/esc.c

 // Copyright 2011 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 //
 // The base version before this file existed, active with debug['s']
 // == 0, assumes any node that has a reference to it created at some
 // point, may flow to the global scope except
 //   - if its address is dereferenced immediately with only CONVNOPs in
 //     between the * and the &
 //   - if it is for a closure variable and the closure executed at the
 //     place it's defined
 //
 // Flag -s disables the old codepaths and switches on the code here:
 //
 // First escfunc, escstmt and escexpr recurse over the ast of each
 // function to dig out flow(dst,src) edges between any
-// pointer-containing nodes and store them in dst->flowsrc.  For
+// pointer-containing nodes and store them in dst->escflowsrc.  For
 // variables assigned to a variable in an outer scope or used as a
 // return value, they store a flow(theSink, src) edge to a fake node
 // 'the Sink'.  For variables referenced in closures, an edge
-// flow(closure, var) is recorded and the flow of a closure itself to
+// flow(closure, &var) is recorded and the flow of a closure itself to
 // an outer scope is tracked the same way as other variables.
 //
-// The link between variables and the function that declares it is
-// already in the n->dcl list.  Then escflood walks the graph starting
-// at theSink and tags all variables of it can reach an & node as
-// escaping and all function parameters it can reach as leaking.
+// Then escflood walks the graph starting at theSink and tags all
+// variables of it can reach an & node as escaping and all function
+// parameters it can reach as leaking.
 //
 // Watch the variables moved to the heap and parameters tagged as
 // unsafe with -m, more detailed analysis output with -mm
 //
 
 #include "go.h"
 
 static void escfunc(Node *func);
 static void escstmtlist(NodeList *stmts);
 static void escstmt(Node *stmt);
 static void escexpr(Node *dst, Node *expr);
 static void escexprcall(Node *dst, Node *callexpr);
 static void escflows(Node* dst, Node* src);
 static void escflood(Node *dst);
 static void escwalk(int level, Node *dst, Node *src);
 static void esctag(Node *func);
 
 // Fake node that all
 //   - return values and output variables
 //   - parameters on imported functions not marked 'safe'
 //   - assignments to global variables
 // flow to.
 static Node     theSink;
 
 static NodeList* dsts;          // all dst nodes
-static int      dstcount;       // diagnostic
-static int      edgecount;      // diagnostic
 static int      loopdepth;      // for detecting nested loop scopes
 static int      pdepth;         // for debug printing in recursions.
 static int      floodgen;       // loop prevention in flood/walk
 static Strlit*  safetag;        // gets slapped on safe parameters' field types for export
+static int      dstcount, edgecount;    // diagnostic
 
 void
 escapes(void)
 {
         NodeList *l;
 
         theSink.op = ONAME;
         theSink.class = PEXTERN;
         theSink.sym = lookup(".sink");
-        theSink.loopdepth = -1;
-
-        safetag = strlit("noflow");
+        theSink.escloopdepth = -1;
+
+        safetag = strlit("noescape");
 
         // flow-analyze top level functions
         for(l=xtop; l; l=l->next)
                 if(l->n->op == ODCLFUNC || l->n->op == OCLOSURE)
                         escfunc(l->n);
 
         // print("escapes: %d dsts, %d edges\n", dstcount, edgecount);
 
         // visit the updstream of each dst, mark address nodes with
         // addrescapes, mark parameters unsafe
         for (l = dsts; l; l=l->next)
                 escflood(l->n);
 
         // for all top level functions, tag the typenodes corresponding to the param nodes
         for(l=xtop; l; l=l->next)
                 if(l->n->op == ODCLFUNC)
                         esctag(l->n);
 }
 
 static void
 escfunc(Node *func)
 {
-        Node *savefn;
+        Node *savefn, *n;
         NodeList *ll;
         int saveld;
 
         saveld = loopdepth;
         loopdepth = 1;
         savefn = curfn;
         curfn = func;
 
         for(ll=curfn->dcl; ll; ll=ll->next) {
                 if(ll->n->op != ONAME)
                         continue;
                 switch (ll->n->class) {
                 case PPARAMOUT:
                         // output parameters flow to the sink
                         escflows(&theSink, ll->n);
-                        ll->n->loopdepth = loopdepth;
+                        ll->n->escloopdepth = loopdepth;
                         break;
                 case PPARAM:
                         ll->n->esc = EscNone;   // prime for escflood later
-                        ll->n->loopdepth = loopdepth;
+                        ll->n->escloopdepth = loopdepth;
                         break;
                 }
+        }
+
+        // walk will take the address of cvar->closure later and assign it to cvar.
+        // handle that here by linking a fake oaddr node directly to the closure.
+        for (ll=curfn->cvars; ll; ll=ll->next) {
+                if(ll->n->op == OXXX)  // see dcl.c:398
+                        continue;
+
+                n = nod(OADDR, ll->n->closure, N);
+                n->lineno = ll->n->lineno;
+                typecheck(&n, Erv);
+                escexpr(curfn, n);
         }
 
         escstmtlist(curfn->nbody);
         curfn = savefn;
         loopdepth = saveld;
 }
 
 static void
 escstmtlist(NodeList* stmts)
 {
@@ skipping 15 matching lines @@
 
         if(stmt->typecheck == 0 && stmt->op != ODCL) {   // TODO something with OAS2
                 dump("escstmt missing typecheck", stmt);
                 fatal("missing typecheck.");
         }
 
         // Common to almost all statements, and nil if n/a.
         escstmtlist(stmt->ninit);
 
         if(debug['m'] > 1)
-                print("%L:[%d] %#S statement: %#N\n", lineno, loopdepth, (curfn && curfn->nname) ? curfn->nname->sym : S, stmt);
+                print("%L:[%d] %#S statement: %#N\n", lineno, loopdepth,
+                      (curfn && curfn->nname) ? curfn->nname->sym : S, stmt);
 
         switch(stmt->op) {
-        default:
-                // Can get here with typecheck errors and will emit
-                // spurious errors, so comment out before committing
-                dump("escstmt", stmt);
-                fatal("escstmt %O", stmt->op);
-                break;
-
         case ODCL:
         case ODCLFIELD:
                 // a declaration ties the node to the current
                 // function, but we already have that edge in
                 // curfn->dcl and will follow it explicitly in
                 // escflood to avoid storing redundant information
                 // What does have to happen here is note if the name
                 // is declared inside a looping scope.
-                stmt->left->loopdepth = loopdepth;
-                break;
-
-        case ODCLCONST:
-        case ODCLTYPE:
-        case OBREAK:
-        case OCONTINUE:
-        case OXFALL:
-        case OGOTO:
-        case OEMPTY:
-        case ORECOVER:
-                // all harmless
+                stmt->left->escloopdepth = loopdepth;
                 break;
 
         case OLABEL:  // TODO: new loop/scope only if there are backjumps to it.
                 loopdepth++;
                 break;
 
         case OBLOCK:
                 escstmtlist(stmt->list);
                 break;
 
@@ skipping 161 matching lines @@
 
         case OPANIC:
                 // Argument could leak through recover.
                 escexpr(&theSink, stmt->left);
                 break;
         }
 
         lineno = lno;
 }
 
-// This is a bit messier than fortunate, pulled out of escexpr's big
-// switch for clarity.  We either have the paramnodes, which may be
-// connected to other things throug flows or we have the parameter type
-// nodes, which may be marked 'noflow'. Navigating the ast is slightly
-// different for methods vs plain functions and for imported vs
-// this-package
-static void
-escexprcall(Node *dst, Node *expr)
-{
-        NodeList *ll, *lr;
-        Node *fn;
-        Type *t, *fntype, *thisarg, *inargs;
-
-        fn = nil;
-        fntype = nil;
-
-        switch(expr->op) {
-        case OCALLFUNC:
-                fn = expr->left;
-                escexpr(N, fn);
-                fntype = fn->type;
-                break;
-
-        case OCALLMETH:
-                fn = expr->left->right;  // ODOTxx name
-                fn = fn->sym->def;       // resolve to definition if we have it
-                if(fn)
-                        fntype = fn->type;
-                else
-                        fntype = expr->left->type;
-                break;
-
-        case OCALLINTER:
-                break;
-
-        default:
-                fatal("escexprcall called with non-call expression");
-        }
-
-        if(fn && fn->ntype) {
-                if(debug['m'] > 2)
-                        print("escexprcall: have param nodes: %N\n", fn->ntype);
-
-                if(expr->op == OCALLMETH) {
-                        if(debug['m'] > 2)
-                                print("escexprcall: this: %N\n",fn->ntype->left->left);
-                        escexpr(fn->ntype->left->left, expr->left->left);
-                }
-
-                // lr->n is the dclfield, ->left is the ONAME param node
-                for(ll=expr->list, lr=fn->ntype->list; ll && lr; ll=ll->next) {
-                        if(debug['m'] > 2)
-                                print("escexprcall: field param: %N\n", lr->n->left);
-                        if (lr->n->left)
-                                escexpr(lr->n->left, ll->n);
-                        else
-                                escexpr(&theSink, ll->n);
-                        if(lr->n->left && !lr->n->left->isddd)
-                                lr=lr->next;
-                }
-                return;
-        }
-
-        if(fntype) {
-                if(debug['m'] > 2)
-                        print("escexprcall: have param types: %T\n", fntype);
-
-                if(expr->op == OCALLMETH) {
-                        thisarg = getthisx(fntype);
-                        t = thisarg->type;
-                        if(debug['m'] > 2)
-                                print("escexprcall: this: %T\n", t);
-                        if(!t->note || strcmp(t->note->s, "noflow") != 0)
-                                escexpr(&theSink, expr->left->left);
-                        else
-                                escexpr(N, expr->left->left);
-                }
-
-                inargs = getinargx(fntype);
-                for(ll=expr->list, t=inargs->type; ll; ll=ll->next) {
-                        if(debug['m'] > 2)
-                                print("escexprcall: field type: %T\n", t);
-                        if(!t->note || strcmp(t->note->s, "noflow"))
-                                escexpr(&theSink, ll->n);
-                        else
-                                escexpr(N, ll->n);
-                        if(t->down)
-                                t=t->down;
-                }
-
-                return;
-        }
-
-        // fallthrough if we don't have enough information:
-        // can only assume all parameters are unsafe
-        // OCALLINTER always ends up here
-
-        if(debug['m']>1 && expr->op != OCALLINTER) {
-                // dump("escexprcall", expr);
-                print("escexprcall: %O, no nodes, no types: %N\n", expr->op, fn);
-        }
-
-        escexpr(&theSink,  expr->left->left);  // the this argument
-        for(ll=expr->list; ll; ll=ll->next)
-                escexpr(&theSink, ll->n);
-}
-
 // Assert that expr somehow gets assigned to dst, if non nil.  for
 // dst==nil, any name node expr still must be marked as being
 // evaluated in curfn.  For expr==nil, dst must still be examined for
 // evaluations inside it (e.g *f(x) = y)
 static void
 escexpr(Node *dst, Node *expr)
 {
         int lno;
         NodeList *ll;
 
@@ skipping 24 matching lines @@
                         escexpr(&theSink, dst->right);  // map key is put in map
                         // fallthrough
                 case OIND:
                 case ODOTPTR:
                 case OSLICEARR:  // ->left  is the OADDR of the array
                 doref:
                         escexpr(N, dst->left);
                         // assignment to dereferences: for now we lose track
                         escexpr(&theSink, expr);
                         return;
-
-                case ONAME:
-                case OARRAYLIT:
-                case OSTRUCTLIT:
-                case OMAPLIT:
-                        break;
-
-                        // these can happen in the OIND recursion
-                case OADDR:
-                case OCONVNOP:
-                        break;
-                }
-
-        }
-
-        if(expr == N || expr->op == ONONAME || expr->op == OXXX) {
+                }
+
+        }
+
+        if(expr == N || expr->op == ONONAME || expr->op == OXXX)
                 return;
-        }
+
         if(expr->typecheck == 0 && expr->op != OKEY) {
                 dump("escexpr missing typecheck", expr);
                 fatal("Missing typecheck.");
         }
 
         lno = setlineno(expr);
         pdepth++;
 
         if(debug['m'] > 1)
-                print("%L:[%d] %#S \t%hN %.*s<= %hN\n", lineno, loopdepth, (curfn && curfn->nname) ? curfn->nname->sym : S, dst, 2*pdepth, ".\t.\t.\t.\t.\t", expr);
+                print("%L:[%d] %#S \t%hN %.*s<= %hN\n", lineno, loopdepth,
+                      (curfn && curfn->nname) ? curfn->nname->sym : S, dst,
+                      2*pdepth, ".\t.\t.\t.\t.\t", expr);
 
 
         switch(expr->op) {
-        case OADDR:       // dst = &x
-                escflows(dst, expr);
-                escexpr(expr->left, expr->left);  // figure out where x came from
-                break;
-
+        case OADDR:     // dst = &x
         case OIND:      // dst = *x
         case ODOTPTR:   // dst = (*x).f
-                escflows(dst, expr);
-                escexpr(expr->left, expr->left); // figure out where x came from
-                break;
-
+                // restart the recursion at x to figure out where it came from
+                escexpr(expr->left, expr->left);
+                // fallthrough
         case ONAME:
         case OPARAM:
                 // loopdepth was set in the defining statement or function header
                 escflows(dst, expr);
                 break;
 
         case OARRAYLIT:
         case OSTRUCTLIT:
-                expr->loopdepth = loopdepth;
-                escflows(dst, expr);
-                // ll->n is key, left is fieldname or constant index
-                for(ll=expr->list; ll; ll=ll->next)
-                        escexpr(expr, ll->n->right);
-                break;
-
         case OMAPLIT:
-                expr->loopdepth = loopdepth;
+                expr->escloopdepth = loopdepth;
                 escflows(dst, expr);
                 for(ll=expr->list; ll; ll=ll->next) {
                         escexpr(expr, ll->n->left);
                         escexpr(expr, ll->n->right);
                 }
                 break;
 
         case OMAKECHAN:
         case OMAKEMAP:
         case OMAKESLICE:
         case ONEW:
                 expr->curfn = curfn;  // should have been done in parse, but patch it up here.
-                expr->loopdepth = loopdepth;
+                expr->escloopdepth = loopdepth;
                 escflows(dst, expr);
                 // first arg is type, all others need checking
                 for(ll=expr->list->next; ll; ll=ll->next)
                         escexpr(N, ll->n);
                 break;
 
         case OCLOSURE:
                 expr->curfn = curfn;  // should have been done in parse, but patch it up here.
-                expr->loopdepth = loopdepth;
+                expr->escloopdepth = loopdepth;
                 escflows(dst, expr);
                 escfunc(expr);
                 break;
 
         // end of the leaf cases. no calls to escflows() in the cases below.
 
-        case OCOMPLIT:
-        case OLITERAL:
-        case ORECOVER:
-                break;
-
-                // harmless unary
-        case ONOT:
-        case OCOM:
-        case OCAP:
-        case OLEN:
-        case OREAL:
-        case OIMAG:
-                // array/string conversions make copies
-        case OARRAYBYTESTR:
-        case OARRAYRUNESTR:
-        case OSTRARRAYBYTE:
-        case OSTRARRAYRUNE:
-        case ORUNESTR:
-                escexpr(N, expr->left);
-                break;
-
-                // harmless binary
-        case OADD:
-        case OAND:
-        case OANDAND:
-        case OANDNOT:
-        case ODIV:
-        case OEQ:
-        case OGE:
-        case OGT:
-        case OLE:
-        case OLT:
-        case OLSH:
-        case ORSH:
-        case OMOD:
-        case OMUL:
-        case ONE:
-        case OOR:
-        case OOROR:
-        case OSUB:
-        case OXOR:
-        case OADDSTR:
-        case OASOP:
-        case OCMPIFACE:
-        case OCMPSTR:
-        case OCOMPLEX:
-        case OPLUS:
-        case OMINUS:
-                escexpr(N, expr->left);
-                escexpr(N, expr->right);
-                break;
-
-                // unaries that pass the value through
-        case OCONV:
+
+        case OCONV:     // unaries that pass the value through
         case OCONVIFACE:
         case OCONVNOP:
         case ODOTTYPE:
         case ODOTTYPE2:
-        case ORECV:    // leaks the whole channel
+        case ORECV:     // leaks the whole channel
+        case ODOTMETH:  // expr->right is just the field or method name
+        case ODOTINTER:
+        case ODOT:
                 escexpr(dst, expr->left);
                 break;
 
         case OCOPY:
                 // left leaks to right, but the return value is harmless
                 // TODO: treat as *dst = *src, rather than as dst = src
                 escexpr(expr->left, expr->right);
                 break;
 
         case OAPPEND:
                 // See TODO for OCOPY
                 escexpr(dst, expr->list->n);
                 for(ll=expr->list->next; ll; ll=ll->next)
                         escexpr(expr->list->n, ll->n);
                 break;
 
         case OCALLMETH:
         case OCALLFUNC:
         case OCALLINTER:
                 // Moved to separate function to isolate the hair.
                 escexprcall(dst, expr);
                 break;
 
-        case ODOTMETH:
-        case ODOTINTER:
-        case ODOT:
-                // expr->right is just the field or method name
-                escexpr(dst, expr->left);
-                break;
-
         case OSLICEARR:  // like an implicit OIND to the underlying buffer, but typecheck has inserted an OADDR
         case OSLICESTR:
         case OSLICE:
+        case OINDEX:
+        case OINDEXMAP:
                 // the big thing flows, the keys just need checking
                 escexpr(dst, expr->left);
                 escexpr(N, expr->right);  // expr->right is the OKEY
                 break;
 
-        case OKEY:
+        default: // all other harmless leaf, unary or binary cases end up here
                 escexpr(N, expr->left);
                 escexpr(N, expr->right);
                 break;
-
-        case OINDEX:
-        case OINDEXMAP:
-                escexpr(dst, expr->left);
-                escexpr(N, expr->right);
-                break;
-
-        default:
-                // if we get here, typecheck has probably already complained
-                fatal("escexpr ... <- %O", expr->op);
-                break;
         }
 
         pdepth--;
         lineno = lno;
 }
 
+
+// This is a bit messier than fortunate, pulled out of escexpr's big
+// switch for clarity.  We either have the paramnodes, which may be
+// connected to other things throug flows or we have the parameter type
+// nodes, which may be marked 'n(ofloworescape)'. Navigating the ast is slightly
+// different for methods vs plain functions and for imported vs
+// this-package
+static void
+escexprcall(Node *dst, Node *expr)
+{
+        NodeList *ll, *lr;
+        Node *fn;
+        Type *t, *fntype, *thisarg, *inargs;
+
+        fn = nil;
+        fntype = nil;
+
+        switch(expr->op) {
+        case OCALLFUNC:
+                fn = expr->left;
+                escexpr(N, fn);
+                fntype = fn->type;
+                break;
+
+        case OCALLMETH:
+                fn = expr->left->right;  // ODOTxx name
+                fn = fn->sym->def;       // resolve to definition if we have it
+                if(fn)
+                        fntype = fn->type;
+                else
+                        fntype = expr->left->type;
+                break;
+
+        case OCALLINTER:
+                break;
+
+        default:
+                fatal("escexprcall called with non-call expression");
+        }
+
+        if(fn && fn->ntype) {
+                if(debug['m'] > 2)
+                        print("escexprcall: have param nodes: %N\n", fn->ntype);
+
+                if(expr->op == OCALLMETH) {
+                        if(debug['m'] > 2)
+                                print("escexprcall: this: %N\n",fn->ntype->left->left);
+                        escexpr(fn->ntype->left->left, expr->left->left);
+                }
+
+                // lr->n is the dclfield, ->left is the ONAME param node
+                for(ll=expr->list, lr=fn->ntype->list; ll && lr; ll=ll->next) {
+                        if(debug['m'] > 2)
+                                print("escexprcall: field param: %N\n", lr->n->left);
+                        if (lr->n->left)
+                                escexpr(lr->n->left, ll->n);
+                        else
+                                escexpr(&theSink, ll->n);
+                        if(lr->n->left && !lr->n->left->isddd)
+                                lr=lr->next;
+                }
+                return;
+        }
+
+        if(fntype) {
+                if(debug['m'] > 2)
+                        print("escexprcall: have param types: %T\n", fntype);
+
+                if(expr->op == OCALLMETH) {
+                        thisarg = getthisx(fntype);
+                        t = thisarg->type;
+                        if(debug['m'] > 2)
+                                print("escexprcall: this: %T\n", t);
+                        if(!t->note || strcmp(t->note->s, safetag->s) != 0)
+                                escexpr(&theSink, expr->left->left);
+                        else
+                                escexpr(N, expr->left->left);
+                }
+
+                inargs = getinargx(fntype);
+                for(ll=expr->list, t=inargs->type; ll; ll=ll->next) {
+                        if(debug['m'] > 2)
+                                print("escexprcall: field type: %T\n", t);
+                        if(!t->note || strcmp(t->note->s, safetag->s))
+                                escexpr(&theSink, ll->n);
+                        else
+                                escexpr(N, ll->n);
+                        if(t->down)
+                                t=t->down;
+                }
+
+                return;
+        }
+
+        // fallthrough if we don't have enough information:
+        // can only assume all parameters are unsafe
+        // OCALLINTER always ends up here
+
+        if(debug['m']>1 && expr->op != OCALLINTER) {
+                // dump("escexprcall", expr);
+                print("escexprcall: %O, no nodes, no types: %N\n", expr->op, fn);
+        }
+
+        escexpr(&theSink,  expr->left->left);  // the this argument
+        for(ll=expr->list; ll; ll=ll->next)
+                escexpr(&theSink, ll->n);
+}
+
+// Store the link src->dst in dst, throwing out some quick wins.
 static void
 escflows(Node* dst, Node* src)
 {
         if(dst == nil || src == nil || dst == src)
                 return;
 
         // Don't bother building a graph for scalars.
         if (src->type && !haspointers(src->type))
                 return;
 
         if(debug['m']>2)
                 print("%L::flows:: %hN <- %hN\n", lineno, dst, src);
 
         // Assignments to global variables get lumped into theSink.
         if (dst->op == ONAME && dst->class == PEXTERN)
                 dst = &theSink;
 
-        if (dst->flowsrc == nil) {
+        if (dst->escflowsrc == nil) {
                 dsts = list(dsts, dst);
                 dstcount++;
         }
         edgecount++;
 
-        dst->flowsrc = list(dst->flowsrc, src);
+        dst->escflowsrc = list(dst->escflowsrc, src);
 }
 
 // Whenever we hit a reference node, the level goes up by one, and whenever
 // we hit an OADDR, the level goes down by one. as long as we're on a level > 0
 // finding an OADDR just means we're following the upstream of a dereference,
 // so this address doesn't leak (yet).
 // If level == 0, it means the /value/ of this node can reach the root of this flood.
 // so if this node is an OADDR, it's argument should be marked as escaping iff
 // it's currfn/loopdepth are different from the flood's root.
 // Once an object has been moved to the heap, all of it's upstream should be considered
 // escaping to the global scope.
 static void
 escflood(Node *dst)
 {
         NodeList *l;
 
-        if (dst->op != ONAME)
+        switch(dst->op) {
+        case ONAME:
+        case OCLOSURE:
+                break;
+        default:
                 return;
+        }
 
         if(debug['m']>1)
                 print("\nescflood:%d: dst %hN scope:%#S[%d]\n", floodgen, dst,
                       (dst->curfn && dst->curfn->nname) ? dst->curfn->nname->sym : S,
-                      dst->loopdepth);
-
-        for (l = dst->flowsrc; l; l=l->next) {
+                      dst->escloopdepth);
+
+        for (l = dst->escflowsrc; l; l=l->next) {
                 floodgen++;
                 escwalk(0, dst, l->n);
         }
 }
 
 static void
 escwalk(int level, Node *dst, Node *src)
 {
         NodeList* ll;
         int leaks;
 
-        if (src->floodgen == floodgen)
+        if (src->escfloodgen == floodgen)
                 return;
-        src->floodgen = floodgen;
+        src->escfloodgen = floodgen;
 
         if(debug['m']>1)
                 print("escwalk: level:%d depth:%d %.*s %hN scope:%#S[%d]\n",
                       level, pdepth, pdepth, "\t\t\t\t\t\t\t\t\t\t", src,
-                      (src->curfn && src->curfn->nname) ? src->curfn->nname->sym : S, src->loopdepth);
+                      (src->curfn && src->curfn->nname) ? src->curfn->nname->sym : S, src->escloopdepth);
 
         pdepth++;
 
-        leaks = (level <= 0) && (dst->loopdepth < src->loopdepth);
+        leaks = (level <= 0) && (dst->escloopdepth < src->escloopdepth);
 
         switch(src->op) {
         case ONAME:
-                switch(src->class) {
-                case PPARAMREF:
-                        // handle implicit OADDR that walk will insert later
-                        if (leaks)
-                                addrescapes(src->closure);
-                        escwalk(level-1, dst, src->closure);
-                        break;
-
-                case PPARAM:
-                        if (leaks && src->esc == EscNone) {
-                                src->esc = EscScope;
-                                if(debug['m'])
-                                        print("%L:leaking param: %hN\n", src->lineno, src);
-                        }
-                }
-
-                break;
-
-        case OCLOSURE:
-                // PPARAMOUT have been linked to the sink explicitly,
-                // handle closure vars, in-parameters and local variables here.
-                for(ll=src->dcl; ll; ll=ll->next)
-                        if(ll->n->class == PPARAM || ll->n->class == PAUTO)
-                                escwalk(0, dst, ll->n);
-
-                // the cvars will have their address taken later by walk.
-                for(ll=src->cvars; ll; ll=ll->next) {
-                        if(ll->n->op == OXXX)  // see dcl.c:398
-                                continue;
-                        if (leaks)
-                                addrescapes(ll->n);
-                        escwalk(0, dst, ll->n);
+                if (src->class == PPARAM && leaks && src->esc == EscNone) {
+                        src->esc = EscScope;
+                        if(debug['m'])
+                                print("%L:leaking param: %hN\n", src->lineno, src);
                 }
                 break;
 
         case OADDR:
                 if (leaks)
                         addrescapes(src->left);
                 escwalk(level-1, dst, src->left);
                 break;
 
         case OINDEX:
                 if(isfixedarray(src->type))
                         break;
         case OSLICE:
         case ODOTPTR:
         case OINDEXMAP:
         case OIND:
                 escwalk(level+1, dst, src->left);
         }
 
-        for (ll=src->flowsrc; ll; ll=ll->next)
+        for (ll=src->escflowsrc; ll; ll=ll->next)
                 escwalk(level, dst, ll->n);
 
         pdepth--;
 }
 
 static void
 esctag(Node *func)
 {
         Node *savefn;
         NodeList *ll;
@@ skipping 12 matching lines @@
                 case EscHeap:   // touched by escflood, moved to heap
                 case EscScope:  // touched by escflood, value leaves scope
                         break;
                 default:
                         fatal("messed up escape tagging: %N::%N", curfn, ll->n);
                 }
         }
 
         curfn = savefn;
 }