encoding/json: runtime error: index out of range [24] with length 24

[clarkmcc]

First of all, I apologize for the ambiguity in this issue. This was caught by an error reporting system in production, it's the first time we've seen this issue and our system has been running for years. This code path is called about ~100,000 times per day so whatever the issue is, it's obscure.

If you need more information, I'll do my best to collect it, but I'm hoping maybe the stack trace will point someone in the right direction on the out of bound error.

What version of Go are you using (go version)?

$ go version

1.21

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

go env Output

$ go env

What did you do?

d.CurrentFoobar is of type map[string]interface{} and we're trying to unmarshal it into another type. We do a lot of work with primitive.ObjectID so I suspect the issue is related to that.

out = &Foobar{}
b, err := json.Marshal(d.CurrentFoobar)
if err != nil {
	return nil, err
}
err = json.Unmarshal(b, out)
if err != nil {
	return nil, err
}

What did you expect to see?

I would have expected a marshaling error to be returned, not a panic.

What did you see instead?

runtime error: index out of range [24] with length 24

at encoding/json.(*encodeState).marshal.func1 ( /usr/local/go/src/encoding/json/encode.go:291 )
at .panic ( /usr/local/go/src/runtime/panic.go:914 )
at encoding/json.mapEncoder.encode ( /usr/local/go/src/encoding/json/encode.go:745 )
at encoding/json.(*encodeState).reflectValue ( /usr/local/go/src/encoding/json/encode.go:323 )
at encoding/json.interfaceEncoder ( /usr/local/go/src/encoding/json/encode.go:660 )
at encoding/json.mapEncoder.encode ( /usr/local/go/src/encoding/json/encode.go:759 )
at encoding/json.(*encodeState).reflectValue ( /usr/local/go/src/encoding/json/encode.go:323 )
at encoding/json.(*encodeState).marshal ( /usr/local/go/src/encoding/json/encode.go:295 )
at encoding/json.Marshal ( /usr/local/go/src/encoding/json/encode.go:162 )
...

[seankhliao]

That stacktrace references this piece of code, which doesn't look like something that can go wrong unless the map was modified during encoding. It sounds more likely to be a race condition within your code?

go/src/encoding/json/encode.go

Lines 742 to 746 in c19c4c5

	sv := make([]reflectWithString, v.Len())
	mi := v.MapRange()
	for i := 0; mi.Next(); i++ {
	sv[i].k = mi.Key()
	sv[i].v = mi.Value()

[thediveo]

maybe #63379, seems to be the same crash site in the trace if I'm reading correctly.

[seankhliao]

#63379 crashes at a subslice out of bounds, this is a slice index out of bounds.

[clarkmcc]

@seankhliao seems at least theoretically possible after a quick look through my code. Closing for now since I agree the crash site doesn't seem like it should be able to crash with a stable v.