encoding/xml: embedded reference to substruct causes XML marshaller to panic on encoding

[Nightwulf]

What version of Go are you using (go version)?

$ go version
go version go1.17.5 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

linux/amd64

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/tevers/.cache/go-build"
GOENV="/home/tevers/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/tevers/go/pkg/mod"
GONOPROXY="ms-dev-gitlab.tui-interactive.com/tui/*"
GONOSUMDB="ms-dev-gitlab.tui-interactive.com/tui/*"
GOOS="linux"
GOPATH="/home/tevers/go"
GOPRIVATE="ms-dev-gitlab.tui-interactive.com/tui/*"
GOPROXY="direct"
GOROOT="/home/tevers/bin/go"
GOSUMDB="off"
GOTMPDIR=""
GOTOOLDIR="/home/tevers/bin/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.5"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/tevers/tmp/Coding/testbox/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build444646503=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Encountered a panic while encoding a complex /generated) struct using the xml encoder from xml package. I then narrowed it down to a simple case to reproduce the panic with. Have a look at this code:
https://go.dev/play/p/laLC5qg3x3E

It first unmarshalls an example XML to ensure, the struct definition is working. Then it assembles a struct with example data and encodes it using a new XML encoder which then shows the panic in question.
If you then change the refrence "LayerTwo" to a value by removing the asterisk, the panic is gone. So it happens only if the embedded struct is a reference and it contains an optional attribute.

Looking at the code of the marshaller in xml/marshall.go, it seems around line 511 and following, testing on the processed value beeing an attribute and not nil and the parent element not beeing empty does not cover this case.

What did you expect to see?

I expect no panic to occur and proper XML to be rendered.

What did you see instead?

A panic as shown in the above example in playground.

[cherrymui]

cc @rsc

[gopherbot]

Change https://go.dev/cl/385514 mentions this issue: encoding/xml: embedded reference to substruct causes XML marshaller to