x/tools/gopls: CodeAction: unexpected JSON unmarshalling error in BundledLazyFixes (via telemetry)

[adonovan]

This stack pA-Ukg was reported by telemetry:

gopls/bug
golang.org/x/tools/gopls/internal/util/bug.report:+35
golang.org/x/tools/gopls/internal/util/bug.Reportf:+1
golang.org/x/tools/gopls/internal/cache.BundledLazyFixes:+5
golang.org/x/tools/gopls/internal/server.(*server).codeActionsMatchingDiagnostics:+4
golang.org/x/tools/gopls/internal/server.(*server).CodeAction:+96
golang.org/x/tools/gopls/internal/protocol.serverDispatch:+160
golang.org/x/tools/gopls/internal/lsprpc.(*streamServer).ServeStream.ServerHandler.func3:+5
golang.org/x/tools/gopls/internal/lsprpc.(*streamServer).ServeStream.handshaker.func4:+52
golang.org/x/tools/gopls/internal/protocol.Handlers.MustReplyHandler.func1:+2
golang.org/x/tools/gopls/internal/protocol.Handlers.AsyncHandler.func2.2:+3
runtime.goexit:+0

golang.org/x/tools/gopls@v0.16.1 go1.22.4 darwin/arm64 other (2)

Issue created by golang.org/x/tools/gopls/internal/telemetry/cmd/stacks.

[gabyhelp]

Related Issues and Documentation

• x/tools/gopls: BundledQuickFixes bug reported by telemetry #64503 (closed)
• x/tools/gopls: Dispatch bug reported by telemetry [1J758g] #64240 (closed)
• x/tools/gopls: bug reported by telemetry [qoVPwQ] #64243 (closed)
• x/tools/gopls: toGobDiagnostic bug reported by telemetry #65695 (closed)
• x/tools/gopls: SignatureHelp bug reported by telemetry [_mSPWg] #64234 (closed)
• x/tools/gopls: Definition bug reported by telemetry [kkvfqw] #64242 (closed)
• x/tools/gopls: Hover bug reported by telemetry [PE4R3g] #64244 (closed)
• x/tools/gopls: Hover bug reported by telemetry #64237 (closed)
• x/tools/gopls: "go/packages failed to return non-test standalone package" bug (reported by telemetry) #66204
• x/tools/gopls: SignatureHelp bug reported by telemetry #64245 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[adonovan]

Given the analysis in #64503 (comment), and the fact the hypothesis (3) is no longer possible due to https://go.dev/cl/549575, hypothesis (1) seems likely: "a curious user or misbehaving client is sending home-made or invalid BundledFixes messages, or modifying the value before returning it to the server". The fact that the the LSP client string is "other" adds a small amount of evidentiary weight.

We should probably downgrade the bug.Report to silently discard the message on the grounds that the client has meddled with it, or, better, report an ordinary error to be handled by the caller.

[gopherbot]

Change https://go.dev/cl/628237 mentions this issue: gopls/internal/cache: failure to extract diagnostic fixes is an error