runtime: zero a few more dead pointers.

In channels, zeroing of gp.waiting is missed on a closed channel panic.
m.morebuf.g is not zeroed.

I don't expect the latter causes any problems, but just in case.

LGTM=iant
R=golang-codereviews, iant
CC=golang-codereviews
https://golang.org/cl/151610043

src/runtime/chan.go

@@ -174,6 +174,10 @@ func chansend(t *chantype, c *hchan, ep unsafe.Pointer, block bool, callerpc uin
 		goparkunlock(&c.lock, "chan send")
 
 		// someone woke us up.
+		if mysg != gp.waiting {
+			gothrow("G waiting list is corrupted!")
+		}
+		gp.waiting = nil
 		if gp.param == nil {
 			if c.closed == 0 {
 				gothrow("chansend: spurious wakeup")
@@ -184,10 +188,6 @@ func chansend(t *chantype, c *hchan, ep unsafe.Pointer, block bool, callerpc uin
 		if mysg.releasetime > 0 {
 			blockevent(int64(mysg.releasetime)-t0, 2)
 		}
-		if mysg != gp.waiting {
-			gothrow("G waiting list is corrupted!")
-		}
-		gp.waiting = nil
 		releaseSudog(mysg)
 		return true
 	}
@@ -410,6 +410,9 @@ func chanrecv(t *chantype, c *hchan, ep unsafe.Pointer, block bool) (selected, r
 		goparkunlock(&c.lock, "chan receive")
 
 		// someone woke us up
+		if mysg != gp.waiting {
+			gothrow("G waiting list is corrupted!")
+		}
 		gp.waiting = nil
 		if mysg.releasetime > 0 {
 			blockevent(mysg.releasetime-t0, 2)

src/runtime/stack.c

@@ -725,6 +725,7 @@ runtime·newstack(void)
 	g->m->morebuf.pc = (uintptr)nil;
 	g->m->morebuf.lr = (uintptr)nil;
 	g->m->morebuf.sp = (uintptr)nil;
+	g->m->morebuf.g = (G*)nil;
 
 	runtime·casgstatus(gp, Grunning, Gwaiting);
 	gp->waitreason = runtime·gostringnocopy((byte*)"stack growth");