test: make issue8606b test more robust

Use actual unmapped memory instead of small integers to make
pointers that will fault when accessed.

Fixes #49562

Change-Id: I2c60c97cf80494dd962a07d10cfeaff6a00f4f8e
Reviewed-on: https://go-review.googlesource.com/c/go/+/364914
Trust: Keith Randall <khr@golang.org>
Run-TryBot: Keith Randall <khr@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>

test/fixedbugs/issue8606b.go

@@ -1,4 +1,5 @@
 // run
+// +build linux darwin
 
 // Copyright 2020 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
@@ -20,20 +21,10 @@ package main
 import (
 	"fmt"
 	"reflect"
+	"syscall"
 	"unsafe"
 )
 
-func bad1() string {
-	s := "foo"
-	(*reflect.StringHeader)(unsafe.Pointer(&s)).Data = 1 // write bad value to data ptr
-	return s
-}
-func bad2() string {
-	s := "foo"
-	(*reflect.StringHeader)(unsafe.Pointer(&s)).Data = 2 // write bad value to data ptr
-	return s
-}
-
 type SI struct {
 	s string
 	i int
@@ -45,15 +36,31 @@ type SS struct {
 }
 
 func main() {
+	bad1 := "foo"
+	bad2 := "foo"
+
+	p := syscall.Getpagesize()
+	b, err := syscall.Mmap(-1, 0, p, syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_ANON|syscall.MAP_PRIVATE)
+	if err != nil {
+		panic(err)
+	}
+	err = syscall.Mprotect(b, syscall.PROT_NONE)
+	if err != nil {
+		panic(err)
+	}
+	// write inaccessible pointers as the data fields of bad1 and bad2.
+	(*reflect.StringHeader)(unsafe.Pointer(&bad1)).Data = uintptr(unsafe.Pointer(&b[0]))
+	(*reflect.StringHeader)(unsafe.Pointer(&bad2)).Data = uintptr(unsafe.Pointer(&b[1]))
+
 	for _, test := range []struct {
 		a, b interface{}
 	}{
-		{SI{s: bad1(), i: 1}, SI{s: bad2(), i: 2}},
+		{SI{s: bad1, i: 1}, SI{s: bad2, i: 2}},
-		{SS{s: bad1(), t: "a"}, SS{s: bad2(), t: "aa"}},
+		{SS{s: bad1, t: "a"}, SS{s: bad2, t: "aa"}},
-		{SS{s: "a", t: bad1()}, SS{s: "b", t: bad2()}},
+		{SS{s: "a", t: bad1}, SS{s: "b", t: bad2}},
 		// This one would panic because the length of both strings match, and we check
 		// the body of the bad strings before the body of the good strings.
-		//{SS{s: bad1(), t: "a"}, SS{s: bad2(), t: "b"}},
+		//{SS{s: bad1, t: "a"}, SS{s: bad2, t: "b"}},
 	} {
 		if test.a == test.b {
 			panic(fmt.Sprintf("values %#v and %#v should not be equal", test.a, test.b))