go/types: type inferred for append([]byte(nil), y) causes NewSignatureType to panic

[seankhliao]

govulncheck version

Go: go1.25-devel_aca9f4e484 2025-05-23 17:06:24 -0700
Scanner: govulncheck@v1.1.5-0.20250506005559-e4f767ca7221
DB: https://vuln.go.dev
DB updated: 2025-05-23 15:18:56 +0000 UTC

No vulnerabilities found.

/home/user/.data/go/bin/govulncheck: go1.25-devel_aca9f4e484 2025-05-23 17:06:24 -0700 X:synctest,jsonv2
	path	golang.org/x/vuln/cmd/govulncheck
	mod	golang.org/x/vuln	v1.1.5-0.20250506005559-e4f767ca7221	h1:nrAR0+rPXSfh0mL8RdKN/0PQdSk5F3L/NehqOn/L57M=
	dep	golang.org/x/mod	v0.24.0	h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
	dep	golang.org/x/sync	v0.14.0	h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
	dep	golang.org/x/telemetry	v0.0.0-20240522233618-39ace7a40ae7	h1:FemxDzfMUcK2f3YY4H+05K9CDzbSVr2+q/JKN45pey0=
	dep	golang.org/x/tools	v0.33.0	h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
	build	-buildmode=exe
	build	-compiler=gc
	build	-trimpath=true
	build	DefaultGODEBUG=containermaxprocs=0,decoratemappings=0,gotestjsonbuildtext=1,gotypesalias=1,multipathtcp=0,randseednop=0,rsa1024min=0,tlsmlkem=0,tlssha1=1,updatemaxprocs=0,x509rsacrt=0,x509sha256skid=0,x509usepolicies=0
	build	CGO_ENABLED=0
	build	GOARCH=amd64
	build	GOEXPERIMENT=synctest,jsonv2
	build	GOOS=linux
	build	GOAMD64=v3

Does this issue reproduce at the latest version of golang.org/x/vuln?

yes

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='0'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v3'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/user/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/user/.config/go/env'
GOEXE=''
GOEXPERIMENT='synctest,jsonv2'
GOFIPS140='off'
GOFLAGS='-trimpath "-ldflags=-s -w" -vet=all'
GOGCCFLAGS='-fPIC -m64 -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2188113637=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/home/user/tmp/testrepo1190/go.mod'
GOMODCACHE='/home/user/.data/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/user/.data/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/user/sdk/gotip'
GOSUMDB='sum.golang.org'
GOTELEMETRY='on'
GOTELEMETRYDIR='/home/user/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='path'
GOTOOLDIR='/home/user/sdk/gotip/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.25-devel_aca9f4e484 2025-05-23 17:06:24 -0700'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

set GOEXPERIMENT='jsonv2'

Run govulncheck on a program using encoding/json

package main

import (
	"encoding/json"
)

func main() {
	json.Marshal("hello world")
}

What did you see happen?

panic: got encoding/json/jsontext.Value, want variadic parameter of unnamed slice or string type

panic: got encoding/json/jsontext.Value, want variadic parameter of unnamed slice or string type

goroutine 757 gp=0xc0001cfa40 m=10 mp=0xc000688008 [running]:
panic({0x9063e0?, 0xc00d4aedd0?})
               runtime/panic.go:802 +0x168 fp=0xc00a3628a0 sp=0xc00a3627f0 pc=0x4753c8
go/types.NewSignatureType(0x0, {0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xc00abff830, 0xc006ec7188, 0x1)
               go/types/signature.go:81 +0x354 fp=0xc00a362918 sp=0xc00a3628a0 pc=0x774614
golang.org/x/tools/go/ssa.(*subster).signature(0xc00ccf3500, 0xc0071832c0)
               golang.org/x/tools@v0.33.0/go/ssa/subst.go:566 +0xc5 fp=0xc00a362988 sp=0xc00a362918 pc=0x834ac5
golang.org/x/tools/go/ssa.(*subster).typ(0xc00ccf3500, {0xa972b8, 0xc0071832c0})
               golang.org/x/tools@v0.33.0/go/ssa/subst.go:139 +0x2db fp=0xc00a362a90 sp=0xc00a362988 pc=0x831cdb
golang.org/x/tools/go/ssa.(*Function).typ(...)
               golang.org/x/tools@v0.33.0/go/ssa/func.go:45
golang.org/x/tools/go/ssa.(*Function).typeOf(0xc00d42a000, {0xa97e10, 0xc006067d60})
               golang.org/x/tools@v0.33.0/go/ssa/func.go:37 +0x65 fp=0xc00a362b38 sp=0xc00a362a90 pc=0x81cb85
golang.org/x/tools/go/ssa.(*Function).instanceType(...)
               golang.org/x/tools@v0.33.0/go/ssa/func.go:54
golang.org/x/tools/go/ssa.(*builder).expr0(0xc009848db0, 0xc00d42a000, {0xa97e10?, 0xc006067d60}, {0x2, {0xa972b8, 0xc0071832c0}, {0x0, 0x0}})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:807 +0x1a65 fp=0xc00a362e78 sp=0xc00a362b38 pc=0x8014c5
golang.org/x/tools/go/ssa.(*builder).expr(0xc009848db0, 0xc00d42a000, {0xa97e10, 0xc006067d60})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:635 +0x17b fp=0xc00a362f30 sp=0xc00a362e78 pc=0x7ff95b
golang.org/x/tools/go/ssa.(*builder).setCallFunc(0x78?, 0x962240?, 0x2d?, 0xc00d4ad7c0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:1060 +0x2b6 fp=0xc00a362fb8 sp=0xc00a362f30 pc=0x802996
golang.org/x/tools/go/ssa.(*builder).setCall(0xc009848db0, 0xc00d42a000, 0xc006049680, 0xc00d4ad7c0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:1138 +0x2b fp=0xc00a363010 sp=0xc00a362fb8 pc=0x80354b
golang.org/x/tools/go/ssa.(*builder).expr0(0xc009848db0, 0xc00d42a000, {0xa98170?, 0xc006049680}, {0x7, {0xa97240, 0xc0066b0c90}, {0x0, 0x0}})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:718 +0x2105 fp=0xc00a363350 sp=0xc00a363010 pc=0x801b65
golang.org/x/tools/go/ssa.(*builder).expr(0xc009848db0, 0xc00d42a000, {0xa98170, 0xc006049680})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:635 +0x17b fp=0xc00a363408 sp=0xc00a363350 pc=0x7ff95b
golang.org/x/tools/go/ssa.(*builder).assign(0xc009848db0?, 0xc00d42a000, {0xa99138, 0xc00d4b8390}, {0xa98170?, 0xc006049680?}, 0x0?, 0xc00a363560)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:608 +0x3a5 fp=0xc00a3634c8 sp=0xc00a363408 pc=0x7ff585
golang.org/x/tools/go/ssa.(*builder).assignStmt(0xc009848db0, 0xc00d42a000, {0xc003dfd770, 0x1, 0xc006067c60?}, {0xc003dfd790, 0x1, 0xc00a363678?}, 0x0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:1223 +0x468 fp=0xc00a3635d0 sp=0xc00a3634c8 pc=0x804048
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009848db0, 0xc00d42a000, {0xa983b0?, 0xc0060496c0?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2714 +0x5b5 fp=0xc00a363700 sp=0xc00a3635d0 pc=0x810335
golang.org/x/tools/go/ssa.(*builder).stmtList(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:966
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009848db0, 0xc00d42a000, {0xa982c0?, 0xc006045980?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2747 +0x1109 fp=0xc00a363830 sp=0xc00a363700 pc=0x810e89
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009848db0, 0xc00d42a000, {0xa982f0?, 0xc006049700?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2761 +0xb8c fp=0xc00a363960 sp=0xc00a363830 pc=0x81090c
golang.org/x/tools/go/ssa.(*builder).stmtList(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:966
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009848db0, 0xc00d42a000, {0xa982c0?, 0xc0066823f0?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2747 +0x1109 fp=0xc00a363a90 sp=0xc00a363960 pc=0x810e89
golang.org/x/tools/go/ssa.(*builder).forStmt(0xc009848db0, 0xc00d42a000, 0xc00606b500, 0x0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:1854 +0x6d6 fp=0xc00a363b08 sp=0xc00a363a90 pc=0x8094f6
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009848db0, 0xc00d42a000, {0xa98410?, 0xc00606b500?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2782 +0x4b4 fp=0xc00a363c38 sp=0xc00a363b08 pc=0x810234
golang.org/x/tools/go/ssa.(*builder).stmtList(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:966
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009848db0, 0xc00d42a000, {0xa982c0?, 0xc006682420?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2747 +0x1109 fp=0xc00a363d68 sp=0xc00a363c38 pc=0x810e89
golang.org/x/tools/go/ssa.(*builder).buildFromSyntax(0xc009848db0, 0xc00d42a000)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2953 +0x25a fp=0xc00a363de0 sp=0xc00a363d68 pc=0x81287a
golang.org/x/tools/go/ssa.(*builder).buildFunction(0x974160?, 0xc00d42a000)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2906 +0x183 fp=0xc00a363ea0 sp=0xc00a363de0 pc=0x8124c3
golang.org/x/tools/go/ssa.(*builder).iterate(0xc009848db0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2891 +0x25 fp=0xc00a363ec0 sp=0xc00a363ea0 pc=0x8122e5
golang.org/x/tools/go/ssa.(*Package).build(0xc009139380)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3174 +0xce fp=0xc00a363f20 sp=0xc00a363ec0 pc=0x81404e
golang.org/x/tools/go/ssa.(*Package).build-fm()
               :1 +0x25 fp=0xc00a363f38 sp=0xc00a363f20 pc=0x83d385
sync.(*Once).doSlow(0xa98650?, 0xc00218d680?)
               sync/once.go:78 +0xac fp=0xc00a363f90 sp=0xc00a363f38 pc=0x4850cc
sync.(*Once).Do(...)
               sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3163
golang.org/x/tools/go/ssa.(*Program).Build.func1(0xc0010a1fa8?)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3142 +0x45 fp=0xc00a363fc8 sp=0xc00a363f90 pc=0x813f45
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3145 +0x24 fp=0xc00a363fe0 sp=0xc00a363fc8 pc=0x813ec4
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00a363fe8 sp=0xc00a363fe0 pc=0x47d081
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 213
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3141 +0x196

goroutine 1 gp=0xc000002380 m=nil [chan receive]:
runtime.gopark(0x10?, 0xdef980?, 0xb0?, 0x21?, 0xc000141e60?)
               runtime/proc.go:460 +0xce fp=0xc00020fe18 sp=0xc00020fdf8 pc=0x4758ee
runtime.chanrecv(0xc0001f8000, 0x0, 0x1)
               runtime/chan.go:667 +0x44e fp=0xc00020fe90 sp=0xc00020fe18 pc=0x4105ae
runtime.chanrecv1(0xc000196090?, 0x0?)
               runtime/chan.go:509 +0x12 fp=0xc00020feb8 sp=0xc00020fe90 pc=0x410132
golang.org/x/vuln/scan.(*Cmd).Wait(...)
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/scan/scan.go:97
main.main()
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/cmd/govulncheck/main.go:24 +0xfa fp=0xc00020ff50 sp=0xc00020feb8 pc=0x86d59a
runtime.main()
               runtime/proc.go:285 +0x29d fp=0xc00020ffe0 sp=0xc00020ff50 pc=0x4428dd
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00020ffe8 sp=0xc00020ffe0 pc=0x47d081

goroutine 2 gp=0xc0000028c0 m=nil [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc000072fa8 sp=0xc000072f88 pc=0x4758ee
runtime.goparkunlock(...)
               runtime/proc.go:466
runtime.forcegchelper()
               runtime/proc.go:373 +0xb3 fp=0xc000072fe0 sp=0xc000072fa8 pc=0x442c13
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc000072fe8 sp=0xc000072fe0 pc=0x47d081
created by runtime.init.7 in goroutine 1
               runtime/proc.go:361 +0x1a

goroutine 3 gp=0xc000002e00 m=nil [GC sweep wait]:
runtime.gopark(0x1?, 0x0?, 0x0?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc000073780 sp=0xc000073760 pc=0x4758ee
runtime.goparkunlock(...)
               runtime/proc.go:466
runtime.bgsweep(0xc00007a000)
               runtime/mgcsweep.go:323 +0xdf fp=0xc0000737c8 sp=0xc000073780 pc=0x42d09f
runtime.gcenable.gowrap1()
               runtime/mgc.go:211 +0x25 fp=0xc0000737e0 sp=0xc0000737c8 pc=0x420f25
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0000737e8 sp=0xc0000737e0 pc=0x47d081
created by runtime.gcenable in goroutine 1
               runtime/mgc.go:211 +0x66

goroutine 4 gp=0xc000002fc0 m=nil [GC scavenge wait]:
runtime.gopark(0xdee220?, 0x3b9aca00?, 0x0?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc000073f78 sp=0xc000073f58 pc=0x4758ee
runtime.goparkunlock(...)
               runtime/proc.go:466
runtime.(*scavengerState).park(0xdee220)
               runtime/mgcscavenge.go:425 +0x49 fp=0xc000073fa8 sp=0xc000073f78 pc=0x42abc9
runtime.bgscavenge(0xc00007a000)
               runtime/mgcscavenge.go:658 +0x59 fp=0xc000073fc8 sp=0xc000073fa8 pc=0x42b159
runtime.gcenable.gowrap2()
               runtime/mgc.go:212 +0x25 fp=0xc000073fe0 sp=0xc000073fc8 pc=0x420ec5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc000073fe8 sp=0xc000073fe0 pc=0x47d081
created by runtime.gcenable in goroutine 1
               runtime/mgc.go:212 +0xa5

goroutine 17 gp=0xc0000a2380 m=nil [GOMAXPROCS updater (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc00006e788 sp=0xc00006e768 pc=0x4758ee
runtime.goparkunlock(...)
               runtime/proc.go:466
runtime.updateGOMAXPROCSHelper()
               runtime/proc.go:6580 +0xcd fp=0xc00006e7e0 sp=0xc00006e788 pc=0x45098d
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00006e7e8 sp=0xc00006e7e0 pc=0x47d081
created by runtime.defaultGOMAXPROCSUpdateEnable in goroutine 1
               runtime/proc.go:6568 +0x1a

goroutine 18 gp=0xc0000a2540 m=nil [cleanup wait]:
runtime.gopark(0x0?, 0x101000000000000?, 0x76?, 0x0?, 0x2?)
               runtime/proc.go:460 +0xce fp=0xc000072768 sp=0xc000072748 pc=0x4758ee
runtime.goparkunlock(...)
               runtime/proc.go:466
runtime.(*cleanupQueue).dequeue(0xdee5a0)
               runtime/mcleanup.go:439 +0xc5 fp=0xc0000727a0 sp=0xc000072768 pc=0x41d045
runtime.runCleanups()
               runtime/mcleanup.go:628 +0x45 fp=0xc0000727e0 sp=0xc0000727a0 pc=0x41d705
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0000727e8 sp=0xc0000727e0 pc=0x47d081
created by runtime.(*cleanupQueue).createGs in goroutine 1
               runtime/mcleanup.go:582 +0xa5

goroutine 33 gp=0xc0001d8000 m=nil [finalizer wait]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001de620 sp=0xc0001de600 pc=0x4758ee
runtime.runFinalizers()
               runtime/mfinal.go:210 +0x107 fp=0xc0001de7e0 sp=0xc0001de620 pc=0x41fe27
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001de7e8 sp=0xc0001de7e0 pc=0x47d081
created by runtime.createfing in goroutine 1
               runtime/mfinal.go:172 +0x3d

goroutine 34 gp=0xc0001d81c0 m=3 mp=0xc000079008 [syscall]:
syscall.Syscall6(0xf7, 0x3, 0xd, 0xc0001dee60, 0x4, 0xc000200000, 0x0)
               syscall/syscall_linux.go:96 +0x39 fp=0xc0001dedd8 sp=0xc0001ded78 pc=0x494f19
internal/syscall/unix.Waitid(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
               internal/syscall/unix/waitid_linux.go:18 +0x39 fp=0xc0001dee30 sp=0xc0001dedd8 pc=0x4dbcf9
os.(*Process).pidfdWait.func1(...)
               os/pidfd_linux.go:109
os.ignoringEINTR(...)
               os/file_posix.go:256
os.(*Process).pidfdWait(0xc0001982c0)
               os/pidfd_linux.go:108 +0x1a9 fp=0xc0001def40 sp=0xc0001dee30 pc=0x4e78e9
os.(*Process).wait(0x0?)
               os/exec_unix.go:25 +0x1a fp=0xc0001def58 sp=0xc0001def40 pc=0x4e357a
os.(*Process).Wait(...)
               os/exec.go:340
os/exec.(*Cmd).Wait(0xc0001e4000)
               os/exec/exec.go:922 +0x45 fp=0xc0001defb8 sp=0xc0001def58 pc=0x52fcc5
golang.org/x/telemetry.parent.func1()
               golang.org/x/telemetry@v0.0.0-20240522233618-39ace7a40ae7/start.go:224 +0x25 fp=0xc0001defe0 sp=0xc0001defb8 pc=0x6e69a5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001defe8 sp=0xc0001defe0 pc=0x47d081
created by golang.org/x/telemetry.parent in goroutine 1
               golang.org/x/telemetry@v0.0.0-20240522233618-39ace7a40ae7/start.go:223 +0x5b8

goroutine 35 gp=0xc0001d8380 m=nil [select]:
runtime.gopark(0xc000142f90?, 0x4?, 0x6?, 0x0?, 0xc000142ea0?)
               runtime/proc.go:460 +0xce fp=0xc000142d00 sp=0xc000142ce0 pc=0x4758ee
runtime.selectgo(0xc000142f90, 0xc000142e98, 0x9c6afd?, 0x0, 0x1d5b90c8?, 0x1)
               runtime/select.go:351 +0x845 fp=0xc000142e40 sp=0xc000142d00 pc=0x455185
net/http.(*http2ClientConn).roundTrip(0xc0001d8c40, 0xc000124140, 0x0)
               net/http/h2_bundle.go:8680 +0x53f fp=0xc000143008 sp=0xc000142e40 pc=0x6afd1f
net/http.(*http2ClientConn).RoundTrip(...)
               net/http/h2_bundle.go:8595
net/http.(*http2Transport).RoundTripOpt(0xc0000cd4a0, 0xc000124140, {0xc0?, 0xb5?})
               net/http/h2_bundle.go:7921 +0x1ec fp=0xc000143150 sp=0xc000143008 pc=0x6ac7cc
net/http.(*http2Transport).RoundTrip(...)
               net/http/h2_bundle.go:7872
net/http.http2noDialH2RoundTripper.RoundTrip({0xde49e0?}, 0xc000124140?)
               net/http/h2_bundle.go:10475 +0x1c fp=0xc000143190 sp=0xc000143150 pc=0x6b9cdc
net/http.(*Transport).roundTrip(0xde49e0, 0xc000124140)
               net/http/transport.go:615 +0x473 fp=0xc000143370 sp=0xc000143190 pc=0x6c7413
net/http.(*Transport).RoundTrip(0xc000688008?, 0xa94260?)
               net/http/roundtrip.go:33 +0x18 fp=0xc000143390 sp=0xc000143370 pc=0x6d5158
net/http.send(0xc000124140, {0xa94260, 0xde49e0}, {0xc000143601?, 0x606630?, 0x0?})
               net/http/client.go:259 +0x5e2 fp=0xc000143580 sp=0xc000143390 pc=0x69aba2
net/http.(*Client).send(0xdedba0, 0xc000124140, {0x417f0e?, 0x16?, 0x0?})
               net/http/client.go:180 +0x91 fp=0xc0001435f8 sp=0xc000143580 pc=0x69a451
net/http.(*Client).do(0xdedba0, 0xc000124140)
               net/http/client.go:729 +0x9c9 fp=0xc0001437e8 sp=0xc0001435f8 pc=0x69c889
net/http.(*Client).Do(...)
               net/http/client.go:587
golang.org/x/vuln/internal/client.(*httpSource).get(0xc00018e060, {0xa98a70, 0xc008e4be00}, {0xc0000cb450, 0xd})
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/client/source.go:54 +0x1c5 fp=0xc000143930 sp=0xc0001437e8 pc=0x7f96e5
golang.org/x/vuln/internal/client.(*Client).moduleMetas(0xc00295c140?, {0xa98a70?, 0xc008e4be00?}, {0xc00295c140, 0x2, 0x7f8bab50ea00?})
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/client/client.go:207 +0x42 fp=0xc000143988 sp=0xc000143930 pc=0x7f7822
golang.org/x/vuln/internal/client.(*Client).ByModules(0xc0001921f0, {0xa98a70, 0xc008e4be00}, {0xc00295c140, 0x2, 0x2})
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/client/client.go:176 +0xda fp=0xc000143a40 sp=0xc000143988 pc=0x7f73ba
golang.org/x/vuln/internal/vulncheck.FetchVulnerabilities({0xa98a70, 0xc008e4be00}, 0xc0001921f0, {0xc000143c18, 0x2, 0x0?})
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/vulncheck/fetch.go:27 +0x148 fp=0xc000143b00 sp=0xc000143a40 pc=0x84d6c8
golang.org/x/vuln/internal/vulncheck.source({0xa98a00?, 0xe0f820?}, {0xa99fa0, 0xc00003c100}, 0xc0001e2120, 0xc0001921f0, 0xc000478990)
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/vulncheck/source.go:68 +0x4d1 fp=0xc000143cd8 sp=0xc000143b00 pc=0x84fc51
golang.org/x/vuln/internal/vulncheck.Source({0xa98a00?, 0xe0f820?}, {0xa99fa0, 0xc00003c100}, 0xc0001e2120, 0xc0000c60b0?, 0x7f8bf22bca78?)
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/vulncheck/source.go:21 +0x2c fp=0xc000143d20 sp=0xc000143cd8 pc=0x84f6cc
golang.org/x/vuln/internal/scan.runSource({0xa98a00, 0xe0f820}, {0xa99fa0, 0xc00003c100}, 0xc0001e2120, 0xc0001921f0, {0x0, 0x0})
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/scan/source.go:48 +0x2fb fp=0xc000143e70 sp=0xc000143d20 pc=0x86505b
golang.org/x/vuln/internal/scan.RunGovulncheck({0xa98a00, 0xe0f820}, {0xc0001e8e08, 0x6a, 0x6a}, {0xa93500, 0xc0000c4020}, {0xa93460, 0xc0000c4038}, {0xa93460, ...}, ...)
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/scan/run.go:63 +0x627 fp=0xc000143f18 sp=0xc000143e70 pc=0x863e27
golang.org/x/vuln/scan.(*Cmd).scan(0xc000196090)
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/scan/scan.go:105 +0x99 fp=0xc000143fa0 sp=0xc000143f18 pc=0x86c879
golang.org/x/vuln/scan.(*Cmd).Start.func1()
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/scan/scan.go:84 +0x50 fp=0xc000143fe0 sp=0xc000143fa0 pc=0x86c710
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc000143fe8 sp=0xc000143fe0 pc=0x47d081
created by golang.org/x/vuln/scan.(*Cmd).Start in goroutine 1
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/scan/scan.go:82 +0x16e

goroutine 6 gp=0xc0001d8540 m=nil [IO wait]:
runtime.gopark(0xc00040c465?, 0x12?, 0x1a?, 0x0?, 0xb?)
               runtime/proc.go:460 +0xce fp=0xc0001736e0 sp=0xc0001736c0 pc=0x4758ee
runtime.netpollblock(0x493818?, 0x40e566?, 0x0?)
               runtime/netpoll.go:575 +0xf7 fp=0xc000173718 sp=0xc0001736e0 pc=0x43b2b7
internal/poll.runtime_pollWait(0x7f8bab780a00, 0x72)
               runtime/netpoll.go:351 +0x85 fp=0xc000173738 sp=0xc000173718 pc=0x474ac5
internal/poll.(*pollDesc).wait(0xc00010ca80?, 0xc00034c000?, 0x0)
               internal/poll/fd_poll_runtime.go:84 +0x27 fp=0xc000173760 sp=0xc000173738 pc=0x4dcee7
internal/poll.(*pollDesc).waitRead(...)
               internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc00010ca80, {0xc00034c000, 0x1500, 0x1500})
               internal/poll/fd_unix.go:165 +0x279 fp=0xc0001737f8 sp=0xc000173760 pc=0x4dd9d9
net.(*netFD).Read(0xc00010ca80, {0xc00034c000?, 0xc00010ca80?, 0xc000173940?})
               net/fd_posix.go:68 +0x25 fp=0xc000173840 sp=0xc0001737f8 pc=0x5ee965
net.(*conn).Read(0xc000308000, {0xc00034c000?, 0x7f8bf22c6d90?, 0x7f8bf22bc5c0?})
               net/net.go:196 +0x45 fp=0xc000173888 sp=0xc000173840 pc=0x5f7a05
crypto/tls.(*atLeastReader).Read(0xc000406180, {0xc00034c000?, 0x6?, 0x0?})
               crypto/tls/conn.go:815 +0x3b fp=0xc0001738d0 sp=0xc000173888 pc=0x6407db
bytes.(*Buffer).ReadFrom(0xc00030c2a0, {0xa94880, 0xc000406180})
               bytes/buffer.go:217 +0x98 fp=0xc000173928 sp=0xc0001738d0 pc=0x51d6b8
crypto/tls.(*Conn).readFromUntil(0xc00030c008, {0xa94a00, 0xc000308000}, 0x43e654?)
               crypto/tls/conn.go:837 +0xde fp=0xc000173960 sp=0xc000173928 pc=0x6409be
crypto/tls.(*Conn).readRecordOrCCS(0xc00030c008, 0x0)
               crypto/tls/conn.go:626 +0x3db fp=0xc000173bd8 sp=0xc000173960 pc=0x63da3b
crypto/tls.(*Conn).readRecord(...)
               crypto/tls/conn.go:588
crypto/tls.(*Conn).Read(0xc00030c008, {0xc0000bc000, 0x1000, 0x100000047b232?})
               crypto/tls/conn.go:1391 +0x145 fp=0xc000173c40 sp=0xc000173bd8 pc=0x6442e5
bufio.(*Reader).Read(0xc0002eac00, {0xc000392820, 0x9, 0x45604e?})
               bufio/bufio.go:245 +0x197 fp=0xc000173c78 sp=0xc000173c40 pc=0x6753f7
io.ReadAtLeast({0xa94080, 0xc0002eac00}, {0xc000392820, 0x9, 0x9}, 0x9)
               io/io.go:335 +0x8e fp=0xc000173cc0 sp=0xc000173c78 pc=0x4d4d4e
io.ReadFull(...)
               io/io.go:354
net/http.http2readFrameHeader({0xc000392820, 0x9, 0xc00030c008?}, {0xa94080?, 0xc0002eac00?})
               net/http/h2_bundle.go:1811 +0x65 fp=0xc000173d10 sp=0xc000173cc0 pc=0x6a3ea5
net/http.(*http2Framer).ReadFrame(0xc0003927e0)
               net/http/h2_bundle.go:2078 +0x7d fp=0xc000173e10 sp=0xc000173d10 pc=0x6a44bd
net/http.(*http2clientConnReadLoop).run(0xc000173fa8)
               net/http/h2_bundle.go:9539 +0xda fp=0xc000173f60 sp=0xc000173e10 pc=0x6b4c3a
net/http.(*http2ClientConn).readLoop(0xc0001d8c40)
               net/http/h2_bundle.go:9408 +0x79 fp=0xc000173fc8 sp=0xc000173f60 pc=0x6b3fb9
net/http.(*http2Transport).newClientConn.gowrap1()
               net/http/h2_bundle.go:8192 +0x25 fp=0xc000173fe0 sp=0xc000173fc8 pc=0x6ae5a5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc000173fe8 sp=0xc000173fe0 pc=0x47d081
created by net/http.(*http2Transport).newClientConn in goroutine 5
               net/http/h2_bundle.go:8192 +0xde5

goroutine 51 gp=0xc0003656c0 m=nil [GC worker (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001da738 sp=0xc0001da718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0001da7c8 sp=0xc0001da738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0001da7e0 sp=0xc0001da7c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001da7e8 sp=0xc0001da7e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 52 gp=0xc000365880 m=nil [GC worker (idle)]:
runtime.gopark(0x3da18e1056b1?, 0x1?, 0x92?, 0x3?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0010a1f38 sp=0xc0010a1f18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0010a1fc8 sp=0xc0010a1f38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0010a1fe0 sp=0xc0010a1fc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0010a1fe8 sp=0xc0010a1fe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 53 gp=0xc000365a40 m=nil [GC worker (idle)]:
runtime.gopark(0x3da18e103028?, 0x1?, 0xea?, 0x2e?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001db738 sp=0xc0001db718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0001db7c8 sp=0xc0001db738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0001db7e0 sp=0xc0001db7c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001db7e8 sp=0xc0001db7e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 54 gp=0xc000365c00 m=nil [GC worker (idle)]:
runtime.gopark(0x3da188d2e58e?, 0x1?, 0x77?, 0xec?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc00109ef38 sp=0xc00109ef18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc00109efc8 sp=0xc00109ef38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc00109efe0 sp=0xc00109efc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00109efe8 sp=0xc00109efe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 55 gp=0xc000365dc0 m=nil [GC worker (idle)]:
runtime.gopark(0xe10c60?, 0x1?, 0xd8?, 0x2f?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001dc738 sp=0xc0001dc718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0001dc7c8 sp=0xc0001dc738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0001dc7e0 sp=0xc0001dc7c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001dc7e8 sp=0xc0001dc7e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 56 gp=0xc000536000 m=nil [GC worker (idle)]:
runtime.gopark(0xe10c60?, 0x1?, 0x63?, 0xc6?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001dcf38 sp=0xc0001dcf18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0001dcfc8 sp=0xc0001dcf38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0001dcfe0 sp=0xc0001dcfc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001dcfe8 sp=0xc0001dcfe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 57 gp=0xc0005361c0 m=nil [GC worker (idle)]:
runtime.gopark(0x3da183f1ec6d?, 0x1?, 0xc3?, 0x15?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001dd738 sp=0xc0001dd718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0001dd7c8 sp=0xc0001dd738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0001dd7e0 sp=0xc0001dd7c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001dd7e8 sp=0xc0001dd7e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 58 gp=0xc000536380 m=nil [GC worker (idle)]:
runtime.gopark(0x3da18e1030c7?, 0x1?, 0x98?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001ddf38 sp=0xc0001ddf18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0001ddfc8 sp=0xc0001ddf38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0001ddfe0 sp=0xc0001ddfc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001ddfe8 sp=0xc0001ddfe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 59 gp=0xc000536540 m=nil [GC worker (idle)]:
runtime.gopark(0xe10c60?, 0x1?, 0x1?, 0x47?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0001dbf38 sp=0xc0001dbf18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0001dbfc8 sp=0xc0001dbf38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0001dbfe0 sp=0xc0001dbfc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0001dbfe8 sp=0xc0001dbfe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 60 gp=0xc000536700 m=nil [GC worker (idle)]:
runtime.gopark(0x3da188d2cb23?, 0x1?, 0xf4?, 0x82?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc0010a2f38 sp=0xc0010a2f18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0010a2fc8 sp=0xc0010a2f38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0010a2fe0 sp=0xc0010a2fc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0010a2fe8 sp=0xc0010a2fe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 61 gp=0xc0005368c0 m=nil [GC worker (idle)]:
runtime.gopark(0xe10c60?, 0x1?, 0xec?, 0x3f?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc00053d738 sp=0xc00053d718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc00053d7c8 sp=0xc00053d738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc00053d7e0 sp=0xc00053d7c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00053d7e8 sp=0xc00053d7e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 62 gp=0xc000536a80 m=nil [GC worker (idle)]:
runtime.gopark(0x3da188d2622c?, 0x3?, 0x1?, 0x38?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc00053df38 sp=0xc00053df18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc00053dfc8 sp=0xc00053df38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc00053dfe0 sp=0xc00053dfc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00053dfe8 sp=0xc00053dfe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 63 gp=0xc000536c40 m=nil [GC worker (idle)]:
runtime.gopark(0x3da188d393c3?, 0x1?, 0xc?, 0x39?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc007b45738 sp=0xc007b45718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc007b457c8 sp=0xc007b45738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc007b457e0 sp=0xc007b457c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc007b457e8 sp=0xc007b457e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 64 gp=0xc000536e00 m=nil [GC worker (idle)]:
runtime.gopark(0xe10c60?, 0x3?, 0xe4?, 0x4d?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc000538f38 sp=0xc000538f18 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc000538fc8 sp=0xc000538f38 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc000538fe0 sp=0xc000538fc8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc000538fe8 sp=0xc000538fe0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 65 gp=0xc000536fc0 m=nil [GC worker (idle)]:
runtime.gopark(0x3da188d0e28a?, 0x1?, 0x52?, 0x5b?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc00053f738 sp=0xc00053f718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc00053f7c8 sp=0xc00053f738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc00053f7e0 sp=0xc00053f7c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00053f7e8 sp=0xc00053f7e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 66 gp=0xc000537180 m=nil [GC worker (idle)]:
runtime.gopark(0x3da188d2ee6f?, 0x1?, 0xdc?, 0xce?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc001326738 sp=0xc001326718 pc=0x4758ee
runtime.gcBgMarkWorker(0xc000319c70)
               runtime/mgc.go:1500 +0xeb fp=0xc0013267c8 sp=0xc001326738 pc=0x4237eb
runtime.gcBgMarkStartWorkers.gowrap1()
               runtime/mgc.go:1410 +0x25 fp=0xc0013267e0 sp=0xc0013267c8 pc=0x4236c5
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc0013267e8 sp=0xc0013267e0 pc=0x47d081
created by runtime.gcBgMarkStartWorkers in goroutine 49
               runtime/mgc.go:1410 +0x105

goroutine 867 gp=0xc00089e540 m=nil [chan receive]:
runtime.gopark(0x20?, 0x9571e0?, 0x0?, 0x0?, 0x0?)
               runtime/proc.go:460 +0xce fp=0xc006383c08 sp=0xc006383be8 pc=0x4758ee
runtime.chanrecv(0xc0000b9110, 0x0, 0x1)
               runtime/chan.go:667 +0x44e fp=0xc006383c80 sp=0xc006383c08 pc=0x4105ae
runtime.chanrecv1(0xc00857e320?, 0xc006383df8?)
               runtime/chan.go:509 +0x12 fp=0xc006383ca8 sp=0xc006383c80 pc=0x410132
golang.org/x/tools/go/ssa.(*task).wait(0xc00753eff0)
               golang.org/x/tools@v0.33.0/go/ssa/task.go:85 +0x185 fp=0xc006383ea0 sp=0xc006383ca8 pc=0x834ca5
golang.org/x/tools/go/ssa.(*builder).iterate(0xc0077a4de0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2895 +0x5e fp=0xc006383ec0 sp=0xc006383ea0 pc=0x81231e
golang.org/x/tools/go/ssa.(*Package).build(0xc00939a680)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3174 +0xce fp=0xc006383f20 sp=0xc006383ec0 pc=0x81404e
golang.org/x/tools/go/ssa.(*Package).build-fm()
               :1 +0x25 fp=0xc006383f38 sp=0xc006383f20 pc=0x83d385
sync.(*Once).doSlow(0x0?, 0x0?)
               sync/once.go:78 +0xac fp=0xc006383f90 sp=0xc006383f38 pc=0x4850cc
sync.(*Once).Do(...)
               sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3163
golang.org/x/tools/go/ssa.(*Program).Build.func1(0x0?)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3142 +0x45 fp=0xc006383fc8 sp=0xc006383f90 pc=0x813f45
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3145 +0x24 fp=0xc006383fe0 sp=0xc006383fc8 pc=0x813ec4
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc006383fe8 sp=0xc006383fe0 pc=0x47d081
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 213
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3141 +0x196

goroutine 214 gp=0xc0001d96c0 m=nil [select]:
runtime.gopark(0xc00262ef00?, 0x6?, 0x0?, 0x2b?, 0xc00262eda4?)
               runtime/proc.go:460 +0xce fp=0xc00262ebf8 sp=0xc00262ebd8 pc=0x4758ee
runtime.selectgo(0xc00262ef00, 0xc00262ed98, 0x9c703c?, 0x0, 0x58?, 0x1)
               runtime/select.go:351 +0x845 fp=0xc00262ed38 sp=0xc00262ebf8 pc=0x455185
net/http.(*http2clientStream).writeRequest(0xc008d8c300, 0xc000124140, 0x0)
               net/http/h2_bundle.go:8850 +0xc65 fp=0xc00262ef90 sp=0xc00262ed38 pc=0x6b1145
net/http.(*http2clientStream).doRequest(0xc008d8c300, 0xc00262ef78?, 0xc00262efa8?)
               net/http/h2_bundle.go:8711 +0x56 fp=0xc00262efb8 sp=0xc00262ef90 pc=0x6b0496
net/http.(*http2ClientConn).roundTrip.gowrap1()
               net/http/h2_bundle.go:8616 +0x28 fp=0xc00262efe0 sp=0xc00262efb8 pc=0x6b0408
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00262efe8 sp=0xc00262efe0 pc=0x47d081
created by net/http.(*http2ClientConn).roundTrip in goroutine 35
               net/http/h2_bundle.go:8616 +0x485

goroutine 869 gp=0xc0004f7dc0 m=nil [runnable]:
runtime.newobject(0x995be0?)
               runtime/malloc.go:1746 +0x35 fp=0xc00d3b3028 sp=0xc00d3b3020 pc=0x418955
golang.org/x/tools/go/ssa.toSelection(0xc0041ebd60)
               golang.org/x/tools@v0.33.0/go/ssa/wrappers.go:278 +0x86 fp=0xc00d3b30a0 sp=0xc00d3b3028 pc=0x838a86
golang.org/x/tools/go/ssa.(*Function).selection(0xc008f3a400, 0xc00d3b31b0?)
               golang.org/x/tools@v0.33.0/go/ssa/func.go:88 +0xb1 fp=0xc00d3b3178 sp=0xc00d3b30a0 pc=0x81cd91
golang.org/x/tools/go/ssa.(*builder).addr(0xc009133b90, 0xc008f3a400, {0xa98050?, 0xc0018022e8}, 0x0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:463 +0x2e7 fp=0xc00d3b3318 sp=0xc00d3b3178 pc=0x7fe4e7
golang.org/x/tools/go/ssa.(*builder).expr(0xc009133b90, 0xc008f3a400, {0xa98050, 0xc0018022e8})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:633 +0x11b fp=0xc00d3b33d0 sp=0xc00d3b3318 pc=0x7ff8fb
golang.org/x/tools/go/ssa.(*builder).emitCallArgs(0xc009133b90, 0xc008f3a400, 0xc000d4c000, 0xc0008f4f40, {0x0?, 0x0, 0x78?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:1084 +0x105 fp=0xc00d3b3518 sp=0xc00d3b33d0 pc=0x802b45
golang.org/x/tools/go/ssa.(*builder).setCall(0xc009133b90, 0xc008f3a400, 0xc0008f4f40, 0xc00d461ec0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:1145 +0x85 fp=0xc00d3b3570 sp=0xc00d3b3518 pc=0x8035a5
golang.org/x/tools/go/ssa.(*builder).expr0(0xc009133b90, 0xc008f3a400, {0xa98170?, 0xc0008f4f40}, {0x7, {0xa97150, 0xddce20}, {0x0, 0x0}})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:718 +0x2105 fp=0xc00d3b38b0 sp=0xc00d3b3570 pc=0x801b65
golang.org/x/tools/go/ssa.(*builder).expr(0xc009133b90, 0xc008f3a400, {0xa98170, 0xc0008f4f40})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:635 +0x17b fp=0xc00d3b3968 sp=0xc00d3b38b0 pc=0x7ff95b
golang.org/x/tools/go/ssa.(*builder).cond(0xc00d3b3a00?, 0xc008f3a400, {0xa98170?, 0xc0008f4f40?}, 0xc00d469760, 0xc00d469810)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:215 +0x430 fp=0xc00d3b39d0 sp=0xc00d3b3968 pc=0x7fc990
golang.org/x/tools/go/ssa.(*builder).cond(0xc00d3b3a68?, 0xc008f3a400, {0xa98110?, 0xc000899ac0?}, 0xc00d469810, 0xc00d469760)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:204 +0x3fc fp=0xc00d3b3a38 sp=0xc00d3b39d0 pc=0x7fc95c
golang.org/x/tools/go/ssa.(*builder).cond(0xc009133b90, 0xc008f3a400, {0xa98140?, 0xc0005d9410}, 0xc00d469810, 0xc00d469760)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:191 +0x3c5 fp=0xc00d3b3aa0 sp=0xc00d3b3a38 pc=0x7fc925
golang.org/x/tools/go/ssa.(*builder).cond(0xc009133b90, 0xc008f3a400, {0xa98140?, 0xc0005d94a0}, 0xc00d4696b0, 0xc00d469760)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:189 +0x35f fp=0xc00d3b3b08 sp=0xc00d3b3aa0 pc=0x7fc8bf
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009133b90, 0xc008f3a400, {0xa982f0?, 0xc0008f5000?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2759 +0xb25 fp=0xc00d3b3c38 sp=0xc00d3b3b08 pc=0x8108a5
golang.org/x/tools/go/ssa.(*builder).stmtList(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:966
golang.org/x/tools/go/ssa.(*builder).stmt(0xc009133b90, 0xc008f3a400, {0xa982c0?, 0xc000554330?})
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2747 +0x1109 fp=0xc00d3b3d68 sp=0xc00d3b3c38 pc=0x810e89
golang.org/x/tools/go/ssa.(*builder).buildFromSyntax(0xc009133b90, 0xc008f3a400)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2953 +0x25a fp=0xc00d3b3de0 sp=0xc00d3b3d68 pc=0x81287a
golang.org/x/tools/go/ssa.(*builder).buildFunction(0x974160?, 0xc008f3a400)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2906 +0x183 fp=0xc00d3b3ea0 sp=0xc00d3b3de0 pc=0x8124c3
golang.org/x/tools/go/ssa.(*builder).iterate(0xc009133b90)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2891 +0x25 fp=0xc00d3b3ec0 sp=0xc00d3b3ea0 pc=0x8122e5
golang.org/x/tools/go/ssa.(*Package).build(0xc0075b1300)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3174 +0xce fp=0xc00d3b3f20 sp=0xc00d3b3ec0 pc=0x81404e
golang.org/x/tools/go/ssa.(*Package).build-fm()
               :1 +0x25 fp=0xc00d3b3f38 sp=0xc00d3b3f20 pc=0x83d385
sync.(*Once).doSlow(0x0?, 0x0?)
               sync/once.go:78 +0xac fp=0xc00d3b3f90 sp=0xc00d3b3f38 pc=0x4850cc
sync.(*Once).Do(...)
               sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3163
golang.org/x/tools/go/ssa.(*Program).Build.func1(0x0?)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3142 +0x45 fp=0xc00d3b3fc8 sp=0xc00d3b3f90 pc=0x813f45
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3145 +0x24 fp=0xc00d3b3fe0 sp=0xc00d3b3fc8 pc=0x813ec4
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00d3b3fe8 sp=0xc00d3b3fe0 pc=0x47d081
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 213
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3141 +0x196

goroutine 192 gp=0xc0001d7a40 m=nil [chan receive]:
runtime.gopark(0xc0026461e0?, 0x9571e0?, 0xf?, 0x0?, 0xc000064a18?)
               runtime/proc.go:460 +0xce fp=0xc00ab33c08 sp=0xc00ab33be8 pc=0x4758ee
runtime.chanrecv(0xc0000b9110, 0x0, 0x1)
               runtime/chan.go:667 +0x44e fp=0xc00ab33c80 sp=0xc00ab33c08 pc=0x4105ae
runtime.chanrecv1(0x937b00?, 0xc00ab33df8?)
               runtime/chan.go:509 +0x12 fp=0xc00ab33ca8 sp=0xc00ab33c80 pc=0x410132
golang.org/x/tools/go/ssa.(*task).wait(0xc007192930)
               golang.org/x/tools@v0.33.0/go/ssa/task.go:85 +0x185 fp=0xc00ab33ea0 sp=0xc00ab33ca8 pc=0x834ca5
golang.org/x/tools/go/ssa.(*builder).iterate(0xc007314150)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2895 +0x5e fp=0xc00ab33ec0 sp=0xc00ab33ea0 pc=0x81231e
golang.org/x/tools/go/ssa.(*Package).build(0xc009138f00)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3174 +0xce fp=0xc00ab33f20 sp=0xc00ab33ec0 pc=0x81404e
golang.org/x/tools/go/ssa.(*Package).build-fm()
               :1 +0x25 fp=0xc00ab33f38 sp=0xc00ab33f20 pc=0x83d385
sync.(*Once).doSlow(0xc004051da0?, 0x77a705?)
               sync/once.go:78 +0xac fp=0xc00ab33f90 sp=0xc00ab33f38 pc=0x4850cc
sync.(*Once).Do(...)
               sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3163
golang.org/x/tools/go/ssa.(*Program).Build.func1(0xc004051fa8?)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3142 +0x45 fp=0xc00ab33fc8 sp=0xc00ab33f90 pc=0x813f45
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3145 +0x24 fp=0xc00ab33fe0 sp=0xc00ab33fc8 pc=0x813ec4
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00ab33fe8 sp=0xc00ab33fe0 pc=0x47d081
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 213
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3141 +0x196

goroutine 839 gp=0xc0002d0700 m=nil [chan receive]:
runtime.gopark(0x40?, 0x9571e0?, 0x40?, 0xdc?, 0x476250?)
               runtime/proc.go:460 +0xce fp=0xc00ac3dc08 sp=0xc00ac3dbe8 pc=0x4758ee
runtime.chanrecv(0xc0000b9110, 0x0, 0x1)
               runtime/chan.go:667 +0x44e fp=0xc00ac3dc80 sp=0xc00ac3dc08 pc=0x4105ae
runtime.chanrecv1(0xc00ca4bd60?, 0xc00ac3ddf8?)
               runtime/chan.go:509 +0x12 fp=0xc00ac3dca8 sp=0xc00ac3dc80 pc=0x410132
golang.org/x/tools/go/ssa.(*task).wait(0xc009ddc588)
               golang.org/x/tools@v0.33.0/go/ssa/task.go:85 +0x185 fp=0xc00ac3dea0 sp=0xc00ac3dca8 pc=0x834ca5
golang.org/x/tools/go/ssa.(*builder).iterate(0xc00a403620)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2895 +0x5e fp=0xc00ac3dec0 sp=0xc00ac3dea0 pc=0x81231e
golang.org/x/tools/go/ssa.(*Package).build(0xc009139800)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3174 +0xce fp=0xc00ac3df20 sp=0xc00ac3dec0 pc=0x81404e
golang.org/x/tools/go/ssa.(*Package).build-fm()
               :1 +0x25 fp=0xc00ac3df38 sp=0xc00ac3df20 pc=0x83d385
sync.(*Once).doSlow(0x0?, 0x0?)
               sync/once.go:78 +0xac fp=0xc00ac3df90 sp=0xc00ac3df38 pc=0x4850cc
sync.(*Once).Do(...)
               sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3163
golang.org/x/tools/go/ssa.(*Program).Build.func1(0xc002811fa8?)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3142 +0x45 fp=0xc00ac3dfc8 sp=0xc00ac3df90 pc=0x813f45
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3145 +0x24 fp=0xc00ac3dfe0 sp=0xc00ac3dfc8 pc=0x813ec4
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00ac3dfe8 sp=0xc00ac3dfe0 pc=0x47d081
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 213
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3141 +0x196

goroutine 218 gp=0xc0007e6c40 m=nil [chan receive]:
runtime.gopark(0xc004129e28?, 0x9571e0?, 0xf?, 0x0?, 0xc00006a478?)
               runtime/proc.go:460 +0xce fp=0xc004129c08 sp=0xc004129be8 pc=0x4758ee
runtime.chanrecv(0xc0000b9110, 0x0, 0x1)
               runtime/chan.go:667 +0x44e fp=0xc004129c80 sp=0xc004129c08 pc=0x4105ae
runtime.chanrecv1(0xc004129e28?, 0xc004129df8?)
               runtime/chan.go:509 +0x12 fp=0xc004129ca8 sp=0xc004129c80 pc=0x410132
golang.org/x/tools/go/ssa.(*task).wait(0xc00af08c60)
               golang.org/x/tools@v0.33.0/go/ssa/task.go:85 +0x185 fp=0xc004129ea0 sp=0xc004129ca8 pc=0x834ca5
golang.org/x/tools/go/ssa.(*builder).iterate(0xc00af706f0)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2895 +0x5e fp=0xc004129ec0 sp=0xc004129ea0 pc=0x81231e
golang.org/x/tools/go/ssa.(*Package).build(0xc0075b0080)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3174 +0xce fp=0xc004129f20 sp=0xc004129ec0 pc=0x81404e
golang.org/x/tools/go/ssa.(*Package).build-fm()
               :1 +0x25 fp=0xc004129f38 sp=0xc004129f20 pc=0x83d385
sync.(*Once).doSlow(0xc006f0c0e0?, 0xc006f0c100?)
               sync/once.go:78 +0xac fp=0xc004129f90 sp=0xc004129f38 pc=0x4850cc
sync.(*Once).Do(...)
               sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3163
golang.org/x/tools/go/ssa.(*Program).Build.func1(0xc006ce8fa8?)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3142 +0x45 fp=0xc004129fc8 sp=0xc004129f90 pc=0x813f45
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3145 +0x24 fp=0xc004129fe0 sp=0xc004129fc8 pc=0x813ec4
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc004129fe8 sp=0xc004129fe0 pc=0x47d081
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 213
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3141 +0x196

goroutine 213 gp=0xc004a15500 m=nil [sync.WaitGroup.Wait]:
runtime.gopark(0xc00020cc98?, 0x417f0e?, 0xa0?, 0x45?, 0xc00020ccc0?)
               runtime/proc.go:460 +0xce fp=0xc00020cc38 sp=0xc00020cc18 pc=0x4758ee
runtime.goparkunlock(...)
               runtime/proc.go:466
runtime.semacquire1(0xc007752e48, 0x0, 0x1, 0x0, 0x19)
               runtime/sema.go:188 +0x21d fp=0xc00020cca0 sp=0xc00020cc38 pc=0x4562dd
sync.runtime_SemacquireWaitGroup(0xc00020ccf0?)
               runtime/sema.go:110 +0x25 fp=0xc00020ccd8 sp=0xc00020cca0 pc=0x476f85
sync.(*WaitGroup).Wait(0xc003403d30?)
               sync/waitgroup.go:150 +0x48 fp=0xc00020cd00 sp=0xc00020ccd8 pc=0x486288
golang.org/x/tools/go/ssa.(*Program).Build(0xc003f4b440)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3148 +0x1a8 fp=0xc00020cdb0 sp=0xc00020cd00 pc=0x813e68
golang.org/x/vuln/internal/vulncheck.buildSSA({0xc008e43018, 0x1, 0x808080803a441276?}, 0xc0004f5b00)
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/vulncheck/utils.go:58 +0x3fe fp=0xc00020cf50 sp=0xc00020cdb0 pc=0x85273e
golang.org/x/vuln/internal/vulncheck.source.func1()
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/vulncheck/source.go:54 +0x8c fp=0xc00020cfe0 sp=0xc00020cf50 pc=0x85038c
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00020cfe8 sp=0xc00020cfe0 pc=0x47d081
created by golang.org/x/vuln/internal/vulncheck.source in goroutine 35
               golang.org/x/vuln@v1.1.5-0.20250506005559-e4f767ca7221/internal/vulncheck/source.go:52 +0x245

goroutine 183 gp=0xc004ac0380 m=nil [runnable]:
golang.org/x/tools/go/ssa.(*IndexAddr).Operands(0xc00818c420?, {0xc00a1fbe80?, 0x0?, 0x4?})
               golang.org/x/tools@v0.33.0/go/ssa/ssa.go:1768 +0xb4 fp=0xc00016db70 sp=0xc00016db68 pc=0x8305f4
golang.org/x/tools/go/ssa.buildReferrers(0xc0091c8200?)
               golang.org/x/tools@v0.33.0/go/ssa/func.go:335 +0xc2 fp=0xc00016dc20 sp=0xc00016db70 pc=0x81dfc2
golang.org/x/tools/go/ssa.(*Function).finishBody(0xc0091c8200)
               golang.org/x/tools@v0.33.0/go/ssa/func.go:374 +0x185 fp=0xc00016dc40 sp=0xc00016dc20 pc=0x81e285
golang.org/x/tools/go/ssa.(*builder).buildPackageInit(0xc0062fb890, 0xc0091c8200)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3281 +0xa8b fp=0xc00016dde0 sp=0xc00016dc40 pc=0x814bab
golang.org/x/tools/go/ssa.(*builder).buildFunction(0x974160?, 0xc0091c8200)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2906 +0x183 fp=0xc00016dea0 sp=0xc00016dde0 pc=0x8124c3
golang.org/x/tools/go/ssa.(*builder).iterate(0xc0062fb890)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:2891 +0x25 fp=0xc00016dec0 sp=0xc00016dea0 pc=0x8122e5
golang.org/x/tools/go/ssa.(*Package).build(0xc009138980)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3174 +0xce fp=0xc00016df20 sp=0xc00016dec0 pc=0x81404e
golang.org/x/tools/go/ssa.(*Package).build-fm()
               :1 +0x25 fp=0xc00016df38 sp=0xc00016df20 pc=0x83d385
sync.(*Once).doSlow(0x0?, 0x0?)
               sync/once.go:78 +0xac fp=0xc00016df90 sp=0xc00016df38 pc=0x4850cc
sync.(*Once).Do(...)
               sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3163
golang.org/x/tools/go/ssa.(*Program).Build.func1(0xc00020cfa8?)
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3142 +0x45 fp=0xc00016dfc8 sp=0xc00016df90 pc=0x813f45
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3145 +0x24 fp=0xc00016dfe0 sp=0xc00016dfc8 pc=0x813ec4
runtime.goexit({})
               runtime/asm_amd64.s:1693 +0x1 fp=0xc00016dfe8 sp=0xc00016dfe0 pc=0x47d081
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 213
               golang.org/x/tools@v0.33.0/go/ssa/builder.go:3141 +0x196

What did you expect to see?

A working govulncheck

[gabyhelp]

Related Issues

• x/vuln: panic: in main.fn: cannot convert *t0 (any) to I #62089 (closed)
• x/vuln: Panics regularly #54995 (closed)
• x/vuln: Panic "cannot range over: func(yield func(K, V) bool) using golang 1.23.0 #68978 (closed)
• x/vuln: govulncheck: panic on a nil types.Object #66130 (closed)
• x/vuln: govulncheck panic: interface conversion: types.Type is *types.Interface, not *types.Array #57174 (closed)
• x/vuln: vulnerability scan crashes #63146 (closed)
• x/vuln: json output always exits 0 #61704 (closed)
• x/vuln: "panic: interface conversion: types.Type is *types.Interface, not *types.Array" #59754 (closed)
• encoding/json: encode panic #55829 (closed)
• x/vuln: panic: interface conversion: types.Type is *types.Interface, not *types.Tuple #64112 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jakebailey]

This same error also happens for deadcode and github.com/go-json-experiment/json/jsontext.Value. On https://github.com/microsoft/typescript-go, running deadcode -test ./...:

panic: got github.com/go-json-experiment/json/jsontext.Value, want variadic parameter of unnamed slice or string type

goroutine 2698 gp=0xc0006968c0 m=24 mp=0xc000d00808 [running]:
panic({0x926f40?, 0xc02376a9e0?})
	/home/jabaile/sdk/gotip/src/runtime/panic.go:802 +0x168 fp=0xc030f488a0 sp=0xc030f487f0 pc=0x47dd08
go/types.NewSignatureType(0x0, {0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xc0211e8fa8, 0xc0079f6ff0, 0x1)
	/home/jabaile/sdk/gotip/src/go/types/signature.go:81 +0x354 fp=0xc030f48918 sp=0xc030f488a0 pc=0x60b534
golang.org/x/tools/go/ssa.(*subster).signature(0xc0191e59e0, 0xc008524040)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/subst.go:566 +0xc5 fp=0xc030f48988 sp=0xc030f48918 pc=0x84ccc5
golang.org/x/tools/go/ssa.(*subster).typ(0xc0191e59e0, {0xabbce8, 0xc008524040})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/subst.go:139 +0x2db fp=0xc030f48a90 sp=0xc030f48988 pc=0x849edb
golang.org/x/tools/go/ssa.(*Function).typ(...)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/func.go:45
golang.org/x/tools/go/ssa.(*Function).typeOf(0xc022467800, {0xabd260, 0xc004bb95c0})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/func.go:37 +0x65 fp=0xc030f48b38 sp=0xc030f48a90 pc=0x833b25
golang.org/x/tools/go/ssa.(*Function).instanceType(...)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/func.go:54
golang.org/x/tools/go/ssa.(*builder).expr0(0xc02d9cb7a0, 0xc022467800, {0xabd260?, 0xc004bb95c0}, {0x2, {0xabbce8, 0xc008524040}, {0x0, 0x0}})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:807 +0x1a65 fp=0xc030f48e78 sp=0xc030f48b38 pc=0x817cc5
golang.org/x/tools/go/ssa.(*builder).expr(0xc02d9cb7a0, 0xc022467800, {0xabd260, 0xc004bb95c0})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:635 +0x17b fp=0xc030f48f30 sp=0xc030f48e78 pc=0x81615b
golang.org/x/tools/go/ssa.(*builder).setCallFunc(0x78?, 0x9851a0?, 0x54?, 0xc025c4e240)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:1060 +0x2b6 fp=0xc030f48fb8 sp=0xc030f48f30 pc=0x819196
golang.org/x/tools/go/ssa.(*builder).setCall(0xc02d9cb7a0, 0xc022467800, 0xc004bbc040, 0xc025c4e240)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:1138 +0x2b fp=0xc030f49010 sp=0xc030f48fb8 pc=0x819d4b
golang.org/x/tools/go/ssa.(*builder).expr0(0xc02d9cb7a0, 0xc022467800, {0xabdad0?, 0xc004bbc040}, {0x7, {0xabbc48, 0xc004bdb620}, {0x0, 0x0}})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:718 +0x2105 fp=0xc030f49350 sp=0xc030f49010 pc=0x818365
golang.org/x/tools/go/ssa.(*builder).expr(0xc02d9cb7a0, 0xc022467800, {0xabdad0, 0xc004bbc040})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:635 +0x17b fp=0xc030f49408 sp=0xc030f49350 pc=0x81615b
golang.org/x/tools/go/ssa.(*builder).assign(0xc02d9cb7a0?, 0xc022467800, {0xabe380, 0xc01ca80db0}, {0xabdad0?, 0xc004bbc040?}, 0x0?, 0xc030f49560)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:608 +0x3a5 fp=0xc030f494c8 sp=0xc030f49408 pc=0x815d85
golang.org/x/tools/go/ssa.(*builder).assignStmt(0xc02d9cb7a0, 0xc022467800, {0xc004bba180, 0x1, 0xc004bb94c0?}, {0xc004bba1a0, 0x1, 0x5?}, 0x0)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:1223 +0x468 fp=0xc030f495d0 sp=0xc030f494c8 pc=0x81a848
golang.org/x/tools/go/ssa.(*builder).stmt(0xc02d9cb7a0, 0xc022467800, {0xabd740?, 0xc004bbc080?})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2714 +0x5b5 fp=0xc030f49700 sp=0xc030f495d0 pc=0x826b35
golang.org/x/tools/go/ssa.(*builder).stmtList(...)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:966
golang.org/x/tools/go/ssa.(*builder).stmt(0xc02d9cb7a0, 0xc022467800, {0xabd860?, 0xc004bb5590?})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2747 +0x1109 fp=0xc030f49830 sp=0xc030f49700 pc=0x827689
golang.org/x/tools/go/ssa.(*builder).stmt(0xc02d9cb7a0, 0xc022467800, {0xabd890?, 0xc004bbc0c0?})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2761 +0xb8c fp=0xc030f49960 sp=0xc030f49830 pc=0x82710c
golang.org/x/tools/go/ssa.(*builder).stmtList(...)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:966
golang.org/x/tools/go/ssa.(*builder).stmt(0xc02d9cb7a0, 0xc022467800, {0xabd860?, 0xc004bc6000?})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2747 +0x1109 fp=0xc030f49a90 sp=0xc030f49960 pc=0x827689
golang.org/x/tools/go/ssa.(*builder).forStmt(0xc02d9cb7a0, 0xc022467800, 0xc004bbde40, 0x0)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:1854 +0x6d6 fp=0xc030f49b08 sp=0xc030f49a90 pc=0x81fcf6
golang.org/x/tools/go/ssa.(*builder).stmt(0xc02d9cb7a0, 0xc022467800, {0xabd9b0?, 0xc004bbde40?})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2782 +0x4b4 fp=0xc030f49c38 sp=0xc030f49b08 pc=0x826a34
golang.org/x/tools/go/ssa.(*builder).stmtList(...)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:966
golang.org/x/tools/go/ssa.(*builder).stmt(0xc02d9cb7a0, 0xc022467800, {0xabd860?, 0xc004bc6030?})
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2747 +0x1109 fp=0xc030f49d68 sp=0xc030f49c38 pc=0x827689
golang.org/x/tools/go/ssa.(*builder).buildFromSyntax(0xc02d9cb7a0, 0xc022467800)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2956 +0x25a fp=0xc030f49de0 sp=0xc030f49d68 pc=0x82909a
golang.org/x/tools/go/ssa.(*builder).buildFunction(0x7f?, 0xc022467800)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2906 +0x183 fp=0xc030f49ea0 sp=0xc030f49de0 pc=0x828cc3
golang.org/x/tools/go/ssa.(*builder).iterate(0xc02d9cb7a0)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:2891 +0x25 fp=0xc030f49ec0 sp=0xc030f49ea0 pc=0x828ae5
golang.org/x/tools/go/ssa.(*Package).build(0xc01b97cb00)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:3177 +0xce fp=0xc030f49f20 sp=0xc030f49ec0 pc=0x82a8ce
golang.org/x/tools/go/ssa.(*Package).build-fm()
	<autogenerated>:1 +0x25 fp=0xc030f49f38 sp=0xc030f49f20 pc=0x856925
sync.(*Once).doSlow(0xc0189e16b0?, 0xffffffffffffffff?)
	/home/jabaile/sdk/gotip/src/sync/once.go:78 +0xac fp=0xc030f49f90 sp=0xc030f49f38 pc=0x48fbac
sync.(*Once).Do(...)
	/home/jabaile/sdk/gotip/src/sync/once.go:69
golang.org/x/tools/go/ssa.(*Package).Build(...)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:3166
golang.org/x/tools/go/ssa.(*Program).Build.func1(0xc017a07fa8?)
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:3145 +0x45 fp=0xc030f49fc8 sp=0xc030f49f90 pc=0x82a765
golang.org/x/tools/go/ssa.(*Program).Build.gowrap1()
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:3148 +0x24 fp=0xc030f49fe0 sp=0xc030f49fc8 pc=0x82a6e4
runtime.goexit({})
	/home/jabaile/sdk/gotip/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc030f49fe8 sp=0xc030f49fe0 pc=0x4860a1
created by golang.org/x/tools/go/ssa.(*Program).Build in goroutine 1
	/home/jabaile/go/pkg/mod/golang.org/x/tools@v0.34.0/go/ssa/builder.go:3144 +0x196

Isn't this actually a golang.org/x/tools/go/ssa bug?

[jcd2]

Here is a small example reproducing the problem with no imports:

package main

type B []byte

func Foo[T ~[]byte | ~string](x []byte, y T) []byte {
	return append(x, y...)
}

func main() {
	x := []byte{1}
	y := B{2}
	x = Foo(x, y)
	println(x)
}

and then go run golang.org/x/tools/cmd/ssadump -build FG foo.go yields the same panic.

It seems that when x/tools/go/ssa instantiates Foo, it needs to create a go/types.Signature for the call to append. But x/tools/go/ssa.subster.signature calls go/types.NewSignatureType with the last (variadic) argument as B instead of []byte, which go/types.NewSignatureType does not allow. Making go/types.NewSignatureType more permissive makes the problem go away, but I don't suppose that's the right solution:

--- a/src/go/types/signature.go
+++ b/src/go/types/signature.go
@@ -64,3 +64,3 @@ func NewSignatureType(recv *Var, recvTypeParams, typeParams []*TypeParam, params
                var S *Slice
-               typeset(last, func(t, _ Type) bool {
+               typeset(last, func(t, u Type) bool {
                        var s *Slice
@@ -69,3 +69,3 @@ func NewSignatureType(recv *Var, recvTypeParams, typeParams []*TypeParam, params
                        } else {
-                               s, _ = Unalias(t).(*Slice) // don't accept a named slice type
+                               s, _ = u.(*Slice)
                        }

Perhaps the solution is to have subster.signature always replace a variadic final argument type that is a named slice with an unnamed slice, but I'm not sure if that would allow some cases of invalid code through also.

[adonovan]

Sorry that this bug was neglected for so long; vulndb-labeled issues have been unattended recently, though that is about to change.

Thanks for the repro; I confirm that it crashes, which proves that this is a bug in x/tools/go/ssa. I'll prepare a fix.

Even more minimal case:

func f[T ~[]byte](y T) []byte { return append([]byte(nil), y...) }

type B []byte

var _ = f(B(nil))

I think the correct solution is to use the underlying (slice) type of y in the append call. It has no influence on the call's inferred result type, which depends only on the first (slice or named slice type) argument.

[adonovan]

After investigation, I think the problem here is actually in the API of go/types, and the interaction between the type inferred for the signature of the append call and the precondition of NewSignatureType. Crucially, this problem only arises for []byte slices but not for any others. That's because the special case logic for handling append(bytes, "string"...) calls is triggered, and it infers a type of func ([]byte, T), with the variadic bit set, which is not a valid type for NewSignatureType. I think it should infer a type of func([]byte, byte...).

[gopherbot]

Change https://go.dev/cl/688815 mentions this issue: go/types: infer correct type for y in append(bytes, y...)