x/tools/gopls: SEGV in mapassign

[adonovan]

#!stacks
"sigpanic" && "runtime.mapassign:+63" && "debug.(*traces).ProcessEvent"

Issue created by stacks.

More memory corruption.

  group.go:325          0x410be2                4c8b5b50                MOVQ 0x50(BX), R11                                      
  group.go:325          0x410be6                4c0fafd8                IMULQ AX, R11                                           
  group.go:328          0x410bea                4c035e10                ADDQ 0x10(SI), R11                                      
  map.go:191            0x410bee                4d89c4                  MOVQ R8, R12                                            
  map.go:191            0x410bf1                4183e07f                ANDL $0x7f, R8                                          
  map.go:191            0x410bf5                4c89442420              MOVQ R8, 0x20(SP)                                       
  group.go:154          0x410bfa                66490f6ec0              MOVQ R8, X0                                             
  group.go:154          0x410bff                660f60c0                PUNPCKLBW X0, X0                                        
  group.go:154          0x410c03                f20f70c000              PSHUFLW $0x0, X0, X0                                    
  runtime_swiss.go:250  0x410c08                4c899c2490000000        MOVQ R11, 0x90(SP)                                      
  runtime_swiss.go:251  0x410c10                4d8b1b                  MOVQ 0(R11), R11        <--- SEGV       
  group.go:154          0x410c13                66490f6ecb              MOVQ R11, X1                                            
  group.go:154          0x410c18                660f74c1                PCMPEQB X1, X0                                          
  group.go:154          0x410c1c                66440fd7d8              PMOVMSKB X0, R11                                        
  group.go:154          0x410c21                450fb6db                MOVZX R11, R11                                          
  runtime_swiss.go:254  0x410c25                e9ab000000              JMP 0x410cd5                                     

This stack ieIdiQ was reported by telemetry:

• crash/crash
• runtime.throw:+9,+0x47
• runtime.sigpanic:+33,+0x26b
• runtime.mapassign:+63,+0x250
• golang.org/x/tools/gopls/internal/debug.(*traces).ProcessEvent:+28,+0x752
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.func1:+8,+0x16e
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.StdTrace.func2:+30,+0x448
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.(*Config).Exporter.func3:+2,+0x175
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.Spans.func4:+30,+0x5c5
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.Labels.func5:+14,+0x2b1
• golang.org/x/tools/gopls/internal/debug.init.0.makeGlobalExporter.func1:+23,+0x28c
• golang.org/x/tools/internal/event/core.deliver:+4,+0xba
• golang.org/x/tools/internal/event/core.ExportPair:+6,+0x107
• golang.org/x/tools/internal/event.Start:+1,+0x357
• golang.org/x/tools/internal/jsonrpc2.(*conn).Notify:+5,+0x304
• golang.org/x/tools/gopls/internal/protocol.clientConn.Notify:=62,+0x45
• golang.org/x/tools/gopls/internal/protocol.(*clientDispatcher).LogMessage:+1,+0x3a

golang.org/x/tools/gopls@v0.20.0 go1.25.0 linux/amd64 other (1)

[prattmic]

This instruction is loading the group control word ahead of looking for a byte matching the expected key.

A few reasons I could imagine this faulting:

• The table structure is corrupted and t.groups array pointer is bad.
• The probe sequence is corrupted somehow and thus yields a group index that is out of bounds of the array. We don't do a bounds check unfortunately.

[adonovan]

This stack ieIdiQ was reported by telemetry:

• crash/crash
• runtime.throw:+9,+0x47
• runtime.sigpanic:+33,+0x26b
• runtime.mapassign:+63,+0x250
• golang.org/x/tools/gopls/internal/debug.(*traces).ProcessEvent:+28,+0x752
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.func1:+8,+0x16e
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.StdTrace.func2:+30,+0x448
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.(*Config).Exporter.func3:+2,+0x175
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.Spans.func4:+30,+0x5c5
• golang.org/x/tools/gopls/internal/debug.makeInstanceExporter.Labels.func5:+14,+0x2b1
• golang.org/x/tools/gopls/internal/debug.init.0.makeGlobalExporter.func1:+23,+0x28c
• golang.org/x/tools/internal/event/core.deliver:+4,+0xba
• golang.org/x/tools/internal/event/core.ExportPair:+6,+0x107
• golang.org/x/tools/internal/event.Start:+1,+0x357
• golang.org/x/tools/internal/jsonrpc2.(*conn).Notify:+5,+0x304
• golang.org/x/tools/gopls/internal/protocol.clientConn.Notify:=62,+0x45
• golang.org/x/tools/gopls/internal/protocol.(*clientDispatcher).LogMessage:+1,+0x3a

GOOS=linux GOARCH=amd64 GOTOOLCHAIN=go1.25.0 go install golang.org/x/tools/gopls@v0.20.0 gopls.client=other (1)

To reproducibly build: (HOME=$(mktemp -d); GOOS=...etc... go install module@version && find $HOME/go/bin -type f)
To disassemble: go tool objdump exe | less

[gabyhelp]

Related Issues

• x/tools/gopls: sigpanic in methods of persistent.Map (corrupt g) #74870
• x/tools/gopls: SEGV in HasSuffix (corrupt string) #74348
• x/tools/gopls: panic in aeshashbody on behalf of mapaccess2_faststr: string memory corrupted #71367
• x/tools/gopls: nil deref in x/telemetry/internal/counter.(*Counter).add #73890
• x/tools/gopls: impossible crash in persistent.Map decref #72931
• x/tools/gopls: nil deref in Exporter.ProcessEvent #71928
• x/tools/gopls: SIGBUS incrementing telemetry counter #74651
• runtime: SEGV in mapaccess2 (go1.23.2 darwin/amd64) #71123
• x/tools/gopls: sigpanic in persistent.(*mapNode).forEach (bad SP) #71115
• x/tools/internal/telemetry/export/metric: panic in (*HistogramFloat64Data).modify #38102 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}