Panic when marshaling horrible pointer

[ericklaus-wf]

Go sometimes panics with a fatal error: checkptr: converted pointer straddles multiple allocations when trying to marshal a certain horrible pointer. (When it doesn't panic, it just hangs forever.)

I'm using Go 1.17.8, just in case that's relevant.

Repro'ing test code is below. Each component of this test seems to be necessary to trigger this bug. Assigning the horrible otherInterface2 to the wrapper's val field causes at least my debugger to lose track of the innermost int type. Perhaps that lost type is somehow to blame for this issue?

import (
	"encoding/json"
	"reflect"
	"testing"

	gojson "github.com/goccy/go-json"
	"github.com/stretchr/testify/assert"
)

func TestPointerCrasher(t *testing.T) {
	j := 1
	interfaceJ := reflect.ValueOf(j).Interface()
	interfaceJPtr := &interfaceJ
	var otherInterface interface{}
	otherInterfacePtr := &otherInterface
	*otherInterfacePtr = &interfaceJ
	var otherInterface2 interface{}
	otherInterface2Ptr := &otherInterface2
	*otherInterface2Ptr = &otherInterface

	wrapper := struct {
		val interface{}
	}{val: otherInterface2}

	jsonBytes, err := json.Marshal(wrapper.val)
	if err != nil {
		t.Fatalf("error in json.Marshal: %v", err)
	}

        // the test will hang in gojson.Marshal()
	goJsonBytes, err := gojson.Marshal(wrapper.val)
	if err != nil {
		t.Fatalf("error in gojson.Marshal: %v", err)
	}

	// this is not generally safe, but we expect these to cast to "1"
	if string(jsonBytes) != string(goJsonBytes) {
		t.Fatalf("expected jsonBytes == goJsonBytes, but %q != %q", jsonBytes, goJsonBytes)
	}
}

Stack:

fatal error: checkptr: converted pointer straddles multiple allocations
runtime.throw({0x7d69e8, 0xc000276e45})
/usr/local/go/src/runtime/panic.go:1198 +0x71 fp=0xc00028f570 sp=0xc00028f540 pc=0x468a31
runtime.checkptrAlignment(0x783460, 0xc0001d1c00, 0x0)
/usr/local/go/src/runtime/checkptr.go:26 +0x6c fp=0xc00028f590 sp=0xc00028f570 pc=0x43984c
github.com/goccy/go-json/internal/encoder/vm.Run(0xc0002604e0, {0xc0001d1c00, 0x0, 0x400}, 0xc0002740e0)
go/src/module/vendor/github.com/goccy/go-json/internal/encoder/vm/vm.go:245 +0x1f25 fp=0xc000297720 sp=0xc00028f590 pc=0x6474a5
github.com/goccy/go-json.encodeRunCode(0xc0002604e0, {0xc0001d1c00, 0x0, 0x400}, 0x47a7f5)
go/src/module/vendor/github.com/goccy/go-json/encode.go:308 +0x272 fp=0xc0002977a0 sp=0xc000297720 pc=0x6a3552
github.com/goccy/go-json.encode(0xc0002604e0, {0x77bc40, 0xc000286070})
go/src/module/vendor/github.com/goccy/go-json/encode.go:233 +0x4be fp=0xc000297878 sp=0xc0002977a0 pc=0x6a319e
github.com/goccy/go-json.marshal({0x77bc40, 0xc000286070}, {0x0, 0x0, 0xc000286060})
go/src/module/vendor/github.com/goccy/go-json/encode.go:148 +0x177 fp=0xc000297908 sp=0xc000297878 pc=0x6a2b97
github.com/goccy/go-json.MarshalWithOption(...)
go/src/module/vendor/github.com/goccy/go-json/json.go:186
github.com/goccy/go-json.Marshal({0x77bc40, 0xc000286070})
go/src/module/vendor/github.com/goccy/go-json/json.go:171 +0x3e fp=0xc000297968 sp=0xc000297908 pc=0x6a361e
[... remaining lines are in my code]