x/tools/gopls: SEGV loading m.used field from non-nil map pointer (in types.Scope.elems map)

[adonovan]

#!stacks
"sigpanic" && "maps.(*Map).Used"

Issue created by stacks.

The crash indicates that the types.Scope's elems map is nonzero but an invalid pointer, since the load instruction is dominated by a nil check:

TEXT runtime.mapaccess1_faststr(SB) internal/runtime/maps/runtime_faststr_swiss.go
...
  runtime_faststr_swiss.go:110  0x40f920                4885db                  TESTQ BX, BX       m == nil?
  runtime_faststr_swiss.go:110  0x40f923                0f84ef000000            JE 0x40fa18                                                        
  map.go:394                    0x40f929                48833b00                CMPQ 0(BX), $0x0        load m.used, SEGV                                            
  runtime_faststr_swiss.go:110  0x40f92d                0f84e5000000            JE 0x40fa18                                                     

More memory corruption. Perhaps the types.Scope's elems field has been clobbered.

This stack aoCxtQ was reported by telemetry:

• crash/crash
• runtime.throw:+9,+0x47
• runtime.sigpanic:+33,+0x26b
• internal/runtime/maps.(*Map).Used:=394,+0x29
• runtime.mapaccess1_faststr:+7,+0x20
• go/types.(*Scope).Lookup:+1,+0x34
• go/types.(*environment).lookupScope:+2,+0x51
• go/types.(*environment).lookup:=111,+0xb3
• go/types.(*Checker).selector:+14,+0x8e
• go/types.(*Checker).typInternal:+43,+0x2e4
• go/types.(*Checker).definedType:+1,+0x2e
• go/types.(*Checker).varType:+1,+0x24
• go/types.(*Checker).varDecl:+5,+0x84
• go/types.(*Checker).declStmt.func1:+56,+0xac8
• go/types.(*Checker).walkDecl:+27,+0x3dd
• go/types.(*Checker).declStmt:+3,+0x3b
• go/types.(*Checker).stmt:+23,+0x5a4
• go/types.(*Checker).stmtList:+9,+0x84
• go/types.(*Checker).funcBody:+24,+0x310

golang.org/x/tools/gopls@v0.20.0 go1.25.2 linux/amd64 gopls.client=other,vscode (1)

Use this command to reproduce the executable:
(HOME=$(mktemp -d); GOOS=linux GOARCH=amd64 GOTOOLCHAIN=go1.25.2 go install golang.org/x/tools/gopls@v0.20.0 && find $HOME/go/bin -type f)
To disassemble: go tool objdump exe | less

[gabyhelp]

Related Issues

• x/tools/gopls: impossible panic reading rtype.hash in type assertion #76328
• x/tools/gopls: impossible panic in BlockStmt.End (type checking IfStmt with nil Body) #76327
• x/tools/gopls: impossible crash in (*types.Checker).basicLit #76329
• x/tools/gopls: nil (or invalid) *ExprStmt pointer in AST #76747
• x/tools/gopls: SEGV in string comparison in mapaccess #76159
• x/tools/gopls: SEGV in go/types due to invalid pointer in BinaryExpr.Y #76238
• go/types: SEGV while loading types.Var.name field (lookupScope returns invalid *types.Var) #73261
• x/tools/gopls: SEGV accessing g in function prolog (R28 is nil or invalid) #76158
• x/tools/gopls: bug in Codec[...].Encode #76978
• runtime: SEGV in mapaccess2 (go1.23.2 darwin/amd64) #71123

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}