x/tools/gopls: Implementation: OOB index panic in unify

[adonovan]

#!stacks
"goPanicIndex" && "fingerprint.unify.func3:+8"

Issue created by stacks.

func unify(x, y sexpr) bool {

	// maxTypeParam returns the maximum type parameter index in x.
	var maxTypeParam func(x sexpr) int
	maxTypeParam = func(x sexpr) int {...}
...
	yBindings := make([]*sexpr, maxTypeParam(y)+1)
	for i := range len(yBindings) {
		yBindings[i] = new(sexpr)
	}

	// bind sets binding b to s from bindings if it does not occur in s.
	bind := func(b *sexpr, s sexpr, bindings []*sexpr) bool {
...
	var uni func(x, y sexpr) bool
	uni = func(x, y sexpr) bool {
		var bx, by *sexpr
		ix := typeParamIndex(x)
		if ix >= 0 {
			bx = xBindings[ix]
		}
		iy := typeParamIndex(y)
		if iy >= 0 {
			by = yBindings[iy] // OOB index panic

This stack FSaUqg was reported by telemetry:

• crash/crash
• runtime.gopanic:+69,+0x167
• runtime.goPanicIndex:+2,+0x73
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+8,+0x79a
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+45,+0x649
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+54,+0x687
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+33,+0x4c1
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+45,+0x649
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+54,+0x687
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+54,+0x687
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+45,+0x649
• golang.org/x/tools/gopls/internal/util/fingerprint.unify.func3:+54,+0x687
• golang.org/x/tools/gopls/internal/util/fingerprint.unify:+108,+0x235
• golang.org/x/tools/gopls/internal/util/fingerprint.Matches:=64,+0x10d
• golang.org/x/tools/gopls/internal/cache/methodsets.implements.func1:=228,+0xe0
• slices.IndexFunc[...]:=109,+0x73
• slices.ContainsFunc[...]:=124,+0x4e
• golang.org/x/tools/gopls/internal/cache/methodsets.implements:+40,+0x3c
• golang.org/x/tools/gopls/internal/cache/methodsets.(*Index).Search:+10,+0xac
• golang.org/x/tools/gopls/internal/golang.implementationsMsets.func2:+1,+0x6f
• golang.org/x/sync/errgroup.(*Group).Go.func1:+15,+0x4f

golang.org/x/tools/gopls@v0.20.0 go1.24.6 linux/amd64 vscode (1)

[gabyhelp]

Related Issues

• x/tools/gopls: ChangeSignature: OOB panic in inlineCall (FuncType.Params inconsistent with Signature) #73912 (closed)
• x/tools/gopls: ChangeSignature: OOB panic in inline.updateCalleeParams (mismatched syntactic/semantic params) #73913 (closed)
• x/tools/gopls: nil *types.Package panic in testKind #73096 (closed)
• x/tools/gopls: Implementation (by signatures): nil panic in dynamicFuncCallType #74305 (closed)
• x/tools/gopls: sigpanic in methods of persistent.Map (corrupt g) #74870
• x/tools/gopls: Inline call: panic in reflect.Value.Set #74653
• x/tools/gopls: Inline: panic in falcon analysis (unexpected core type) #74393 (closed)
• x/tools/gopls/internal/golang: inline variable: nil panic in inlineVariableOne #74347
• x/tools/gopls/internal/cache: nil deref in modindex.Index.Lookup #74055 (closed)
• x/tools/gopls: ChangeSignature: crash in in inliner (likely due to ill-formed variadic call) #73187

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jba]

This is provably impossible (though obviously not).

yBindings has length maxTypeParam(y) + 1 (https://go.googlesource.com/tools/+/refs/tags/v0.37.0/gopls/internal/util/fingerprint/fingerprint.go#365)

maxTypeParam walks its argument completely to compute the max (https://go.googlesource.com/tools/+/refs/tags/v0.37.0/gopls/internal/util/fingerprint/fingerprint.go#348)

uni is always called with its y argument equal to the outer y or a part thereof (https://go.googlesource.com/tools/+/refs/tags/v0.37.0/gopls/internal/util/fingerprint/fingerprint.go#392 plus call sites)

yBindings is never changed.

[jba]

Can I see the panic message?

[adonovan]

This is provably impossible (though obviously not).

I expected that would be the case. I think this is just another case of the the memory corruption issue.

Can I see the panic message?

No. Telemetry doesn't include it, since it may application data, and thus PII.