cmd/vet,x/tools/go/analysis/passes/printf: broken with GODEBUG=gotypesalias=1

[findleyr]

Repro, originating from @adonovan's investigation of #68744:

> cat bad.go
package main

import "fmt"

func main() {
        fmt.Printf("%s", 123)
        wrapf("%s", 123)
}

func wrapf(format string, args ...any) {
        fmt.Printf(format, args...)
}
> go version
go version go1.23rc2 linux/amd64
> go vet bad.go 
# command-line-arguments
# [command-line-arguments]
./bad.go:6:2: fmt.Printf format %s has arg 123 of wrong type int
./bad.go:7:2: command-line-arguments.wrapf format %s has arg 123 of wrong type int
> GODEBUG=gotypesalias=0 go vet bad.go 
# command-line-arguments
# [command-line-arguments]
./bad.go:6:2: fmt.Printf format %s has arg 123 of wrong type int
./bad.go:7:2: command-line-arguments.wrapf format %s has arg 123 of wrong type int
> GODEBUG=gotypesalias=1 go vet bad.go 
# command-line-arguments
# [command-line-arguments]
./bad.go:6:2: fmt.Printf format %s has arg 123 of wrong type int

When GODEBUG=gotypesalias=1 (the default in 1.23), the printf analyzer fails to report a diagnostic for the wrapf printf wrapper, due to a missing call to types.Unalias.

Separately, it appears the default vet tool distributed with 1.23rc2 (or built on the release branch with make.bash) does not have GODEBUG=gotypesalias=1. Otherwise, this should have been caught by the vet integration tests. I will file a separate issue for that.

It may be the case that the two bugs mentioned in the previous two paragraphs effectively cancel themselves out for the Go distribution. However, I think we should at least block the release until we understand both better.

[gabyhelp]

Related Issues and Documentation

• cmd/vet: printf analyzer cannot analyze anonymous functions #44350
• cmd/vet: false positives and wrong types across files, needs automatic recursive checking #20514 (closed)
• cmd/vet: Printf format %.T has unrecognized flag #30363
• go/types, types2: audit type assertions for potential Alias bugs #67547 (closed)
• cmd/vet: report type and format specifier mismatch in Printf* #4404 (closed)
• go vet incorrectly recognizes format verb in string #38131 (closed)
• cmd/vet: false positive about wrong argument for verb #23552 (closed)
• cmd/vet: false positive in Printf recursive Stringer check with non-matching String() functions #30441 (closed)
• cmd/vet: false positive printf-like function detection #26486 (closed)
• cmd/vet: false positive about wrong number of arguments in printf #23564 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/603938 mentions this issue: go/analysis/passes/printf: add missing Unalias call

[findleyr]

Now that we understand it better, I don't think this needs to block the release. A missing vet diagnostic for printf wrappers (that use any, not interface{}) seems to be benign enough to fix in 1.23.1.