cmd/go: go doc runaway memory usage in go1.26.2

[nicholashusin]

This issue originally came as a security report, but we've determined that this is not a vulnerability.
Therefore, filing this publicly.

---

A user reported that running go doc on certain packages will cause their memory usage to quickly climb up, eventually causing OOM. In the original report, this happens when running go doc github.com/nats-io/nats.go.ConnectedServerInfo on go1.26.2 on Linux, in a project that imports the package. However, running something like go doc net/http.Server does not cause memory to climb up.

I suspect this is a bit of a heisenbug. So far I was unable to reproduce it. However, @thatnealpatel was able to. According to his observations:

• At gotip, this issue is fixed.
• On darwin/arm64 @ go1.26.2, the memory runaway behavior reproduces, albeit slower.
• His reproduction case is the following:
  • Checked out go1.26.2 release and ran make.bash.
  • Created an empty module with no-op usage of github.com/nats-io/nats.go in main.go .
  • Ran go doc github.com/nats-io/nats.go.ConnectedServerInfo.
  • go doc hangs and memory starts climbing up.

Things I suspect but cannot confirm yet:

• github.com/nats-io/nats.go.ConnectedServerInfo is a non-existent symbol. Perhaps this bug is more prone to show up / only happens with non-existent symbols?
• @thatnealpatel being able to reproduce it but not me (despite me being on Linux, just like the original reporter) makes me suspect that this bug is affected by some "external factor". The first thing that came to my mind is that I recently cleaned up my go module cache, maybe that's a factor?

[nicholashusin]

CC @matloob

[gabyhelp]

Related Issues

• x/tools/godoc: memory grows exponentially if symlink loop exists in $GOPATH #21061 (closed)
• x/tools/cmd/godoc: memory increase even when no files are added to index #32692 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

using a binary download of 1.26.2 (from the proxy), I can reproduce it. if I explicitly set GOROOT=$(go env GOROOT) it no longer reproduces...

[dotwaffle]

(I'm the original submitter of the bug)

My assumption was that it may be something to do with the repo being "GitHub.com/nats-io/nats.go" (as in, containing a dot) but it works on other symbols...

[hyangah]

Looks like the problem is already fixed at tip. Can we close it or do we want to backport the changes that addressed this issue? (I don't think this bug is in the category that deserves backport)

CL 733200 "cmd/go/internal/doc: use internal go command logic to load packages" (cc @matloob) looks like the main change that addressed this issue, but it's possible other changes may be involved.

[matloob]

I don't think this merits a backport. I'm going to close.