1// Copyright 2010 The Go Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style
3// license that can be found in the LICENSE file.
4
5// Represents JSON data structure using native Go types: booleans, floats,
6// strings, arrays, and maps.
7
8package json
9
10import (
11	"encoding"
12	"encoding/base64"
13	"fmt"
14	"reflect"
15	"strconv"
16	"strings"
17	"unicode"
18	"unicode/utf16"
19	"unicode/utf8"
20	_ "unsafe" // for linkname
21)
22
23// Unmarshal parses the JSON-encoded data and stores the result
24// in the value pointed to by v. If v is nil or not a pointer,
25// Unmarshal returns an [InvalidUnmarshalError].
26//
27// Unmarshal uses the inverse of the encodings that
28// [Marshal] uses, allocating maps, slices, and pointers as necessary,
29// with the following additional rules:
30//
31// To unmarshal JSON into a pointer, Unmarshal first handles the case of
32// the JSON being the JSON literal null. In that case, Unmarshal sets
33// the pointer to nil. Otherwise, Unmarshal unmarshals the JSON into
34// the value pointed at by the pointer. If the pointer is nil, Unmarshal
35// allocates a new value for it to point to.
36//
37// To unmarshal JSON into a value implementing [Unmarshaler],
38// Unmarshal calls that value's [Unmarshaler.UnmarshalJSON] method, including
39// when the input is a JSON null.
40// Otherwise, if the value implements [encoding.TextUnmarshaler]
41// and the input is a JSON quoted string, Unmarshal calls
42// [encoding.TextUnmarshaler.UnmarshalText] with the unquoted form of the string.
43//
44// To unmarshal JSON into a struct, Unmarshal matches incoming object
45// keys to the keys used by [Marshal] (either the struct field name or its tag),
46// preferring an exact match but also accepting a case-insensitive match. By
47// default, object keys which don't have a corresponding struct field are
48// ignored (see [Decoder.DisallowUnknownFields] for an alternative).
49//
50// To unmarshal JSON into an interface value,
51// Unmarshal stores one of these in the interface value:
52//
53//   - bool, for JSON booleans
54//   - float64, for JSON numbers
55//   - string, for JSON strings
56//   - []interface{}, for JSON arrays
57//   - map[string]interface{}, for JSON objects
58//   - nil for JSON null
59//
60// To unmarshal a JSON array into a slice, Unmarshal resets the slice length
61// to zero and then appends each element to the slice.
62// As a special case, to unmarshal an empty JSON array into a slice,
63// Unmarshal replaces the slice with a new empty slice.
64//
65// To unmarshal a JSON array into a Go array, Unmarshal decodes
66// JSON array elements into corresponding Go array elements.
67// If the Go array is smaller than the JSON array,
68// the additional JSON array elements are discarded.
69// If the JSON array is smaller than the Go array,
70// the additional Go array elements are set to zero values.
71//
72// To unmarshal a JSON object into a map, Unmarshal first establishes a map to
73// use. If the map is nil, Unmarshal allocates a new map. Otherwise Unmarshal
74// reuses the existing map, keeping existing entries. Unmarshal then stores
75// key-value pairs from the JSON object into the map. The map's key type must
76// either be any string type, an integer, or implement [encoding.TextUnmarshaler].
77//
78// If the JSON-encoded data contain a syntax error, Unmarshal returns a [SyntaxError].
79//
80// If a JSON value is not appropriate for a given target type,
81// or if a JSON number overflows the target type, Unmarshal
82// skips that field and completes the unmarshaling as best it can.
83// If no more serious errors are encountered, Unmarshal returns
84// an [UnmarshalTypeError] describing the earliest such error. In any
85// case, it's not guaranteed that all the remaining fields following
86// the problematic one will be unmarshaled into the target object.
87//
88// The JSON null value unmarshals into an interface, map, pointer, or slice
89// by setting that Go value to nil. Because null is often used in JSON to mean
90// “not present,” unmarshaling a JSON null into any other Go type has no effect
91// on the value and produces no error.
92//
93// When unmarshaling quoted strings, invalid UTF-8 or
94// invalid UTF-16 surrogate pairs are not treated as an error.
95// Instead, they are replaced by the Unicode replacement
96// character U+FFFD.
97func Unmarshal(data []byte, v any) error {
98	// Check for well-formedness.
99	// Avoids filling out half a data structure
100	// before discovering a JSON syntax error.
101	var d decodeState
102	err := checkValid(data, &d.scan)
103	if err != nil {
104		return err
105	}
106
107	d.init(data)
108	return d.unmarshal(v)
109}
110
111// Unmarshaler is the interface implemented by types
112// that can unmarshal a JSON description of themselves.
113// The input can be assumed to be a valid encoding of
114// a JSON value. UnmarshalJSON must copy the JSON data
115// if it wishes to retain the data after returning.
116//
117// By convention, to approximate the behavior of [Unmarshal] itself,
118// Unmarshalers implement UnmarshalJSON([]byte("null")) as a no-op.
119type Unmarshaler interface {
120	UnmarshalJSON([]byte) error
121}
122
123// An UnmarshalTypeError describes a JSON value that was
124// not appropriate for a value of a specific Go type.
125type UnmarshalTypeError struct {
126	Value  string       // description of JSON value - "bool", "array", "number -5"
127	Type   reflect.Type // type of Go value it could not be assigned to
128	Offset int64        // error occurred after reading Offset bytes
129	Struct string       // name of the struct type containing the field
130	Field  string       // the full path from root node to the field
131}
132
133func (e *UnmarshalTypeError) Error() string {
134	if e.Struct != "" || e.Field != "" {
135		return "json: cannot unmarshal " + e.Value + " into Go struct field " + e.Struct + "." + e.Field + " of type " + e.Type.String()
136	}
137	return "json: cannot unmarshal " + e.Value + " into Go value of type " + e.Type.String()
138}
139
140// An UnmarshalFieldError describes a JSON object key that
141// led to an unexported (and therefore unwritable) struct field.
142//
143// Deprecated: No longer used; kept for compatibility.
144type UnmarshalFieldError struct {
145	Key   string
146	Type  reflect.Type
147	Field reflect.StructField
148}
149
150func (e *UnmarshalFieldError) Error() string {
151	return "json: cannot unmarshal object key " + strconv.Quote(e.Key) + " into unexported field " + e.Field.Name + " of type " + e.Type.String()
152}
153
154// An InvalidUnmarshalError describes an invalid argument passed to [Unmarshal].
155// (The argument to [Unmarshal] must be a non-nil pointer.)
156type InvalidUnmarshalError struct {
157	Type reflect.Type
158}
159
160func (e *InvalidUnmarshalError) Error() string {
161	if e.Type == nil {
162		return "json: Unmarshal(nil)"
163	}
164
165	if e.Type.Kind() != reflect.Pointer {
166		return "json: Unmarshal(non-pointer " + e.Type.String() + ")"
167	}
168	return "json: Unmarshal(nil " + e.Type.String() + ")"
169}
170
171func (d *decodeState) unmarshal(v any) error {
172	rv := reflect.ValueOf(v)
173	if rv.Kind() != reflect.Pointer || rv.IsNil() {
174		return &InvalidUnmarshalError{reflect.TypeOf(v)}
175	}
176
177	d.scan.reset()
178	d.scanWhile(scanSkipSpace)
179	// We decode rv not rv.Elem because the Unmarshaler interface
180	// test must be applied at the top level of the value.
181	err := d.value(rv)
182	if err != nil {
183		return d.addErrorContext(err)
184	}
185	return d.savedError
186}
187
188// A Number represents a JSON number literal.
189type Number string
190
191// String returns the literal text of the number.
192func (n Number) String() string { return string(n) }
193
194// Float64 returns the number as a float64.
195func (n Number) Float64() (float64, error) {
196	return strconv.ParseFloat(string(n), 64)
197}
198
199// Int64 returns the number as an int64.
200func (n Number) Int64() (int64, error) {
201	return strconv.ParseInt(string(n), 10, 64)
202}
203
204// An errorContext provides context for type errors during decoding.
205type errorContext struct {
206	Struct     reflect.Type
207	FieldStack []string
208}
209
210// decodeState represents the state while decoding a JSON value.
211type decodeState struct {
212	data                  []byte
213	off                   int // next read offset in data
214	opcode                int // last read result
215	scan                  scanner
216	errorContext          *errorContext
217	savedError            error
218	useNumber             bool
219	disallowUnknownFields bool
220}
221
222// readIndex returns the position of the last byte read.
223func (d *decodeState) readIndex() int {
224	return d.off - 1
225}
226
227// phasePanicMsg is used as a panic message when we end up with something that
228// shouldn't happen. It can indicate a bug in the JSON decoder, or that
229// something is editing the data slice while the decoder executes.
230const phasePanicMsg = "JSON decoder out of sync - data changing underfoot?"
231
232func (d *decodeState) init(data []byte) *decodeState {
233	d.data = data
234	d.off = 0
235	d.savedError = nil
236	if d.errorContext != nil {
237		d.errorContext.Struct = nil
238		// Reuse the allocated space for the FieldStack slice.
239		d.errorContext.FieldStack = d.errorContext.FieldStack[:0]
240	}
241	return d
242}
243
244// saveError saves the first err it is called with,
245// for reporting at the end of the unmarshal.
246func (d *decodeState) saveError(err error) {
247	if d.savedError == nil {
248		d.savedError = d.addErrorContext(err)
249	}
250}
251
252// addErrorContext returns a new error enhanced with information from d.errorContext
253func (d *decodeState) addErrorContext(err error) error {
254	if d.errorContext != nil && (d.errorContext.Struct != nil || len(d.errorContext.FieldStack) > 0) {
255		switch err := err.(type) {
256		case *UnmarshalTypeError:
257			err.Struct = d.errorContext.Struct.Name()
258			err.Field = strings.Join(d.errorContext.FieldStack, ".")
259		}
260	}
261	return err
262}
263
264// skip scans to the end of what was started.
265func (d *decodeState) skip() {
266	s, data, i := &d.scan, d.data, d.off
267	depth := len(s.parseState)
268	for {
269		op := s.step(s, data[i])
270		i++
271		if len(s.parseState) < depth {
272			d.off = i
273			d.opcode = op
274			return
275		}
276	}
277}
278
279// scanNext processes the byte at d.data[d.off].
280func (d *decodeState) scanNext() {
281	if d.off < len(d.data) {
282		d.opcode = d.scan.step(&d.scan, d.data[d.off])
283		d.off++
284	} else {
285		d.opcode = d.scan.eof()
286		d.off = len(d.data) + 1 // mark processed EOF with len+1
287	}
288}
289
290// scanWhile processes bytes in d.data[d.off:] until it
291// receives a scan code not equal to op.
292func (d *decodeState) scanWhile(op int) {
293	s, data, i := &d.scan, d.data, d.off
294	for i < len(data) {
295		newOp := s.step(s, data[i])
296		i++
297		if newOp != op {
298			d.opcode = newOp
299			d.off = i
300			return
301		}
302	}
303
304	d.off = len(data) + 1 // mark processed EOF with len+1
305	d.opcode = d.scan.eof()
306}
307
308// rescanLiteral is similar to scanWhile(scanContinue), but it specialises the
309// common case where we're decoding a literal. The decoder scans the input
310// twice, once for syntax errors and to check the length of the value, and the
311// second to perform the decoding.
312//
313// Only in the second step do we use decodeState to tokenize literals, so we
314// know there aren't any syntax errors. We can take advantage of that knowledge,
315// and scan a literal's bytes much more quickly.
316func (d *decodeState) rescanLiteral() {
317	data, i := d.data, d.off
318Switch:
319	switch data[i-1] {
320	case '"': // string
321		for ; i < len(data); i++ {
322			switch data[i] {
323			case '\\':
324				i++ // escaped char
325			case '"':
326				i++ // tokenize the closing quote too
327				break Switch
328			}
329		}
330	case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-': // number
331		for ; i < len(data); i++ {
332			switch data[i] {
333			case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
334				'.', 'e', 'E', '+', '-':
335			default:
336				break Switch
337			}
338		}
339	case 't': // true
340		i += len("rue")
341	case 'f': // false
342		i += len("alse")
343	case 'n': // null
344		i += len("ull")
345	}
346	if i < len(data) {
347		d.opcode = stateEndValue(&d.scan, data[i])
348	} else {
349		d.opcode = scanEnd
350	}
351	d.off = i + 1
352}
353
354// value consumes a JSON value from d.data[d.off-1:], decoding into v, and
355// reads the following byte ahead. If v is invalid, the value is discarded.
356// The first byte of the value has been read already.
357func (d *decodeState) value(v reflect.Value) error {
358	switch d.opcode {
359	default:
360		panic(phasePanicMsg)
361
362	case scanBeginArray:
363		if v.IsValid() {
364			if err := d.array(v); err != nil {
365				return err
366			}
367		} else {
368			d.skip()
369		}
370		d.scanNext()
371
372	case scanBeginObject:
373		if v.IsValid() {
374			if err := d.object(v); err != nil {
375				return err
376			}
377		} else {
378			d.skip()
379		}
380		d.scanNext()
381
382	case scanBeginLiteral:
383		// All bytes inside literal return scanContinue op code.
384		start := d.readIndex()
385		d.rescanLiteral()
386
387		if v.IsValid() {
388			if err := d.literalStore(d.data[start:d.readIndex()], v, false); err != nil {
389				return err
390			}
391		}
392	}
393	return nil
394}
395
396type unquotedValue struct{}
397
398// valueQuoted is like value but decodes a
399// quoted string literal or literal null into an interface value.
400// If it finds anything other than a quoted string literal or null,
401// valueQuoted returns unquotedValue{}.
402func (d *decodeState) valueQuoted() any {
403	switch d.opcode {
404	default:
405		panic(phasePanicMsg)
406
407	case scanBeginArray, scanBeginObject:
408		d.skip()
409		d.scanNext()
410
411	case scanBeginLiteral:
412		v := d.literalInterface()
413		switch v.(type) {
414		case nil, string:
415			return v
416		}
417	}
418	return unquotedValue{}
419}
420
421// indirect walks down v allocating pointers as needed,
422// until it gets to a non-pointer.
423// If it encounters an Unmarshaler, indirect stops and returns that.
424// If decodingNull is true, indirect stops at the first settable pointer so it
425// can be set to nil.
426func indirect(v reflect.Value, decodingNull bool) (Unmarshaler, encoding.TextUnmarshaler, reflect.Value) {
427	// Issue #24153 indicates that it is generally not a guaranteed property
428	// that you may round-trip a reflect.Value by calling Value.Addr().Elem()
429	// and expect the value to still be settable for values derived from
430	// unexported embedded struct fields.
431	//
432	// The logic below effectively does this when it first addresses the value
433	// (to satisfy possible pointer methods) and continues to dereference
434	// subsequent pointers as necessary.
435	//
436	// After the first round-trip, we set v back to the original value to
437	// preserve the original RW flags contained in reflect.Value.
438	v0 := v
439	haveAddr := false
440
441	// If v is a named type and is addressable,
442	// start with its address, so that if the type has pointer methods,
443	// we find them.
444	if v.Kind() != reflect.Pointer && v.Type().Name() != "" && v.CanAddr() {
445		haveAddr = true
446		v = v.Addr()
447	}
448	for {
449		// Load value from interface, but only if the result will be
450		// usefully addressable.
451		if v.Kind() == reflect.Interface && !v.IsNil() {
452			e := v.Elem()
453			if e.Kind() == reflect.Pointer && !e.IsNil() && (!decodingNull || e.Elem().Kind() == reflect.Pointer) {
454				haveAddr = false
455				v = e
456				continue
457			}
458		}
459
460		if v.Kind() != reflect.Pointer {
461			break
462		}
463
464		if decodingNull && v.CanSet() {
465			break
466		}
467
468		// Prevent infinite loop if v is an interface pointing to its own address:
469		//     var v interface{}
470		//     v = &v
471		if v.Elem().Kind() == reflect.Interface && v.Elem().Elem() == v {
472			v = v.Elem()
473			break
474		}
475		if v.IsNil() {
476			v.Set(reflect.New(v.Type().Elem()))
477		}
478		if v.Type().NumMethod() > 0 && v.CanInterface() {
479			if u, ok := v.Interface().(Unmarshaler); ok {
480				return u, nil, reflect.Value{}
481			}
482			if !decodingNull {
483				if u, ok := v.Interface().(encoding.TextUnmarshaler); ok {
484					return nil, u, reflect.Value{}
485				}
486			}
487		}
488
489		if haveAddr {
490			v = v0 // restore original value after round-trip Value.Addr().Elem()
491			haveAddr = false
492		} else {
493			v = v.Elem()
494		}
495	}
496	return nil, nil, v
497}
498
499// array consumes an array from d.data[d.off-1:], decoding into v.
500// The first byte of the array ('[') has been read already.
501func (d *decodeState) array(v reflect.Value) error {
502	// Check for unmarshaler.
503	u, ut, pv := indirect(v, false)
504	if u != nil {
505		start := d.readIndex()
506		d.skip()
507		return u.UnmarshalJSON(d.data[start:d.off])
508	}
509	if ut != nil {
510		d.saveError(&UnmarshalTypeError{Value: "array", Type: v.Type(), Offset: int64(d.off)})
511		d.skip()
512		return nil
513	}
514	v = pv
515
516	// Check type of target.
517	switch v.Kind() {
518	case reflect.Interface:
519		if v.NumMethod() == 0 {
520			// Decoding into nil interface? Switch to non-reflect code.
521			ai := d.arrayInterface()
522			v.Set(reflect.ValueOf(ai))
523			return nil
524		}
525		// Otherwise it's invalid.
526		fallthrough
527	default:
528		d.saveError(&UnmarshalTypeError{Value: "array", Type: v.Type(), Offset: int64(d.off)})
529		d.skip()
530		return nil
531	case reflect.Array, reflect.Slice:
532		break
533	}
534
535	i := 0
536	for {
537		// Look ahead for ] - can only happen on first iteration.
538		d.scanWhile(scanSkipSpace)
539		if d.opcode == scanEndArray {
540			break
541		}
542
543		// Expand slice length, growing the slice if necessary.
544		if v.Kind() == reflect.Slice {
545			if i >= v.Cap() {
546				v.Grow(1)
547			}
548			if i >= v.Len() {
549				v.SetLen(i + 1)
550			}
551		}
552
553		if i < v.Len() {
554			// Decode into element.
555			if err := d.value(v.Index(i)); err != nil {
556				return err
557			}
558		} else {
559			// Ran out of fixed array: skip.
560			if err := d.value(reflect.Value{}); err != nil {
561				return err
562			}
563		}
564		i++
565
566		// Next token must be , or ].
567		if d.opcode == scanSkipSpace {
568			d.scanWhile(scanSkipSpace)
569		}
570		if d.opcode == scanEndArray {
571			break
572		}
573		if d.opcode != scanArrayValue {
574			panic(phasePanicMsg)
575		}
576	}
577
578	if i < v.Len() {
579		if v.Kind() == reflect.Array {
580			for ; i < v.Len(); i++ {
581				v.Index(i).SetZero() // zero remainder of array
582			}
583		} else {
584			v.SetLen(i) // truncate the slice
585		}
586	}
587	if i == 0 && v.Kind() == reflect.Slice {
588		v.Set(reflect.MakeSlice(v.Type(), 0, 0))
589	}
590	return nil
591}
592
593var nullLiteral = []byte("null")
594var textUnmarshalerType = reflect.TypeFor[encoding.TextUnmarshaler]()
595
596// object consumes an object from d.data[d.off-1:], decoding into v.
597// The first byte ('{') of the object has been read already.
598func (d *decodeState) object(v reflect.Value) error {
599	// Check for unmarshaler.
600	u, ut, pv := indirect(v, false)
601	if u != nil {
602		start := d.readIndex()
603		d.skip()
604		return u.UnmarshalJSON(d.data[start:d.off])
605	}
606	if ut != nil {
607		d.saveError(&UnmarshalTypeError{Value: "object", Type: v.Type(), Offset: int64(d.off)})
608		d.skip()
609		return nil
610	}
611	v = pv
612	t := v.Type()
613
614	// Decoding into nil interface? Switch to non-reflect code.
615	if v.Kind() == reflect.Interface && v.NumMethod() == 0 {
616		oi := d.objectInterface()
617		v.Set(reflect.ValueOf(oi))
618		return nil
619	}
620
621	var fields structFields
622
623	// Check type of target:
624	//   struct or
625	//   map[T1]T2 where T1 is string, an integer type,
626	//             or an encoding.TextUnmarshaler
627	switch v.Kind() {
628	case reflect.Map:
629		// Map key must either have string kind, have an integer kind,
630		// or be an encoding.TextUnmarshaler.
631		switch t.Key().Kind() {
632		case reflect.String,
633			reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
634			reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
635		default:
636			if !reflect.PointerTo(t.Key()).Implements(textUnmarshalerType) {
637				d.saveError(&UnmarshalTypeError{Value: "object", Type: t, Offset: int64(d.off)})
638				d.skip()
639				return nil
640			}
641		}
642		if v.IsNil() {
643			v.Set(reflect.MakeMap(t))
644		}
645	case reflect.Struct:
646		fields = cachedTypeFields(t)
647		// ok
648	default:
649		d.saveError(&UnmarshalTypeError{Value: "object", Type: t, Offset: int64(d.off)})
650		d.skip()
651		return nil
652	}
653
654	var mapElem reflect.Value
655	var origErrorContext errorContext
656	if d.errorContext != nil {
657		origErrorContext = *d.errorContext
658	}
659
660	for {
661		// Read opening " of string key or closing }.
662		d.scanWhile(scanSkipSpace)
663		if d.opcode == scanEndObject {
664			// closing } - can only happen on first iteration.
665			break
666		}
667		if d.opcode != scanBeginLiteral {
668			panic(phasePanicMsg)
669		}
670
671		// Read key.
672		start := d.readIndex()
673		d.rescanLiteral()
674		item := d.data[start:d.readIndex()]
675		key, ok := unquoteBytes(item)
676		if !ok {
677			panic(phasePanicMsg)
678		}
679
680		// Figure out field corresponding to key.
681		var subv reflect.Value
682		destring := false // whether the value is wrapped in a string to be decoded first
683
684		if v.Kind() == reflect.Map {
685			elemType := t.Elem()
686			if !mapElem.IsValid() {
687				mapElem = reflect.New(elemType).Elem()
688			} else {
689				mapElem.SetZero()
690			}
691			subv = mapElem
692		} else {
693			f := fields.byExactName[string(key)]
694			if f == nil {
695				f = fields.byFoldedName[string(foldName(key))]
696			}
697			if f != nil {
698				subv = v
699				destring = f.quoted
700				for _, i := range f.index {
701					if subv.Kind() == reflect.Pointer {
702						if subv.IsNil() {
703							// If a struct embeds a pointer to an unexported type,
704							// it is not possible to set a newly allocated value
705							// since the field is unexported.
706							//
707							// See https://golang.org/issue/21357
708							if !subv.CanSet() {
709								d.saveError(fmt.Errorf("json: cannot set embedded pointer to unexported struct: %v", subv.Type().Elem()))
710								// Invalidate subv to ensure d.value(subv) skips over
711								// the JSON value without assigning it to subv.
712								subv = reflect.Value{}
713								destring = false
714								break
715							}
716							subv.Set(reflect.New(subv.Type().Elem()))
717						}
718						subv = subv.Elem()
719					}
720					subv = subv.Field(i)
721				}
722				if d.errorContext == nil {
723					d.errorContext = new(errorContext)
724				}
725				d.errorContext.FieldStack = append(d.errorContext.FieldStack, f.name)
726				d.errorContext.Struct = t
727			} else if d.disallowUnknownFields {
728				d.saveError(fmt.Errorf("json: unknown field %q", key))
729			}
730		}
731
732		// Read : before value.
733		if d.opcode == scanSkipSpace {
734			d.scanWhile(scanSkipSpace)
735		}
736		if d.opcode != scanObjectKey {
737			panic(phasePanicMsg)
738		}
739		d.scanWhile(scanSkipSpace)
740
741		if destring {
742			switch qv := d.valueQuoted().(type) {
743			case nil:
744				if err := d.literalStore(nullLiteral, subv, false); err != nil {
745					return err
746				}
747			case string:
748				if err := d.literalStore([]byte(qv), subv, true); err != nil {
749					return err
750				}
751			default:
752				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal unquoted value into %v", subv.Type()))
753			}
754		} else {
755			if err := d.value(subv); err != nil {
756				return err
757			}
758		}
759
760		// Write value back to map;
761		// if using struct, subv points into struct already.
762		if v.Kind() == reflect.Map {
763			kt := t.Key()
764			var kv reflect.Value
765			if reflect.PointerTo(kt).Implements(textUnmarshalerType) {
766				kv = reflect.New(kt)
767				if err := d.literalStore(item, kv, true); err != nil {
768					return err
769				}
770				kv = kv.Elem()
771			} else {
772				switch kt.Kind() {
773				case reflect.String:
774					kv = reflect.New(kt).Elem()
775					kv.SetString(string(key))
776				case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
777					s := string(key)
778					n, err := strconv.ParseInt(s, 10, 64)
779					if err != nil || kt.OverflowInt(n) {
780						d.saveError(&UnmarshalTypeError{Value: "number " + s, Type: kt, Offset: int64(start + 1)})
781						break
782					}
783					kv = reflect.New(kt).Elem()
784					kv.SetInt(n)
785				case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
786					s := string(key)
787					n, err := strconv.ParseUint(s, 10, 64)
788					if err != nil || kt.OverflowUint(n) {
789						d.saveError(&UnmarshalTypeError{Value: "number " + s, Type: kt, Offset: int64(start + 1)})
790						break
791					}
792					kv = reflect.New(kt).Elem()
793					kv.SetUint(n)
794				default:
795					panic("json: Unexpected key type") // should never occur
796				}
797			}
798			if kv.IsValid() {
799				v.SetMapIndex(kv, subv)
800			}
801		}
802
803		// Next token must be , or }.
804		if d.opcode == scanSkipSpace {
805			d.scanWhile(scanSkipSpace)
806		}
807		if d.errorContext != nil {
808			// Reset errorContext to its original state.
809			// Keep the same underlying array for FieldStack, to reuse the
810			// space and avoid unnecessary allocs.
811			d.errorContext.FieldStack = d.errorContext.FieldStack[:len(origErrorContext.FieldStack)]
812			d.errorContext.Struct = origErrorContext.Struct
813		}
814		if d.opcode == scanEndObject {
815			break
816		}
817		if d.opcode != scanObjectValue {
818			panic(phasePanicMsg)
819		}
820	}
821	return nil
822}
823
824// convertNumber converts the number literal s to a float64 or a Number
825// depending on the setting of d.useNumber.
826func (d *decodeState) convertNumber(s string) (any, error) {
827	if d.useNumber {
828		return Number(s), nil
829	}
830	f, err := strconv.ParseFloat(s, 64)
831	if err != nil {
832		return nil, &UnmarshalTypeError{Value: "number " + s, Type: reflect.TypeFor[float64](), Offset: int64(d.off)}
833	}
834	return f, nil
835}
836
837var numberType = reflect.TypeFor[Number]()
838
839// literalStore decodes a literal stored in item into v.
840//
841// fromQuoted indicates whether this literal came from unwrapping a
842// string from the ",string" struct tag option. this is used only to
843// produce more helpful error messages.
844func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool) error {
845	// Check for unmarshaler.
846	if len(item) == 0 {
847		// Empty string given.
848		d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
849		return nil
850	}
851	isNull := item[0] == 'n' // null
852	u, ut, pv := indirect(v, isNull)
853	if u != nil {
854		return u.UnmarshalJSON(item)
855	}
856	if ut != nil {
857		if item[0] != '"' {
858			if fromQuoted {
859				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
860				return nil
861			}
862			val := "number"
863			switch item[0] {
864			case 'n':
865				val = "null"
866			case 't', 'f':
867				val = "bool"
868			}
869			d.saveError(&UnmarshalTypeError{Value: val, Type: v.Type(), Offset: int64(d.readIndex())})
870			return nil
871		}
872		s, ok := unquoteBytes(item)
873		if !ok {
874			if fromQuoted {
875				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
876			}
877			panic(phasePanicMsg)
878		}
879		return ut.UnmarshalText(s)
880	}
881
882	v = pv
883
884	switch c := item[0]; c {
885	case 'n': // null
886		// The main parser checks that only true and false can reach here,
887		// but if this was a quoted string input, it could be anything.
888		if fromQuoted && string(item) != "null" {
889			d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
890			break
891		}
892		switch v.Kind() {
893		case reflect.Interface, reflect.Pointer, reflect.Map, reflect.Slice:
894			v.SetZero()
895			// otherwise, ignore null for primitives/string
896		}
897	case 't', 'f': // true, false
898		value := item[0] == 't'
899		// The main parser checks that only true and false can reach here,
900		// but if this was a quoted string input, it could be anything.
901		if fromQuoted && string(item) != "true" && string(item) != "false" {
902			d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
903			break
904		}
905		switch v.Kind() {
906		default:
907			if fromQuoted {
908				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
909			} else {
910				d.saveError(&UnmarshalTypeError{Value: "bool", Type: v.Type(), Offset: int64(d.readIndex())})
911			}
912		case reflect.Bool:
913			v.SetBool(value)
914		case reflect.Interface:
915			if v.NumMethod() == 0 {
916				v.Set(reflect.ValueOf(value))
917			} else {
918				d.saveError(&UnmarshalTypeError{Value: "bool", Type: v.Type(), Offset: int64(d.readIndex())})
919			}
920		}
921
922	case '"': // string
923		s, ok := unquoteBytes(item)
924		if !ok {
925			if fromQuoted {
926				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
927			}
928			panic(phasePanicMsg)
929		}
930		switch v.Kind() {
931		default:
932			d.saveError(&UnmarshalTypeError{Value: "string", Type: v.Type(), Offset: int64(d.readIndex())})
933		case reflect.Slice:
934			if v.Type().Elem().Kind() != reflect.Uint8 {
935				d.saveError(&UnmarshalTypeError{Value: "string", Type: v.Type(), Offset: int64(d.readIndex())})
936				break
937			}
938			b := make([]byte, base64.StdEncoding.DecodedLen(len(s)))
939			n, err := base64.StdEncoding.Decode(b, s)
940			if err != nil {
941				d.saveError(err)
942				break
943			}
944			v.SetBytes(b[:n])
945		case reflect.String:
946			t := string(s)
947			if v.Type() == numberType && !isValidNumber(t) {
948				return fmt.Errorf("json: invalid number literal, trying to unmarshal %q into Number", item)
949			}
950			v.SetString(t)
951		case reflect.Interface:
952			if v.NumMethod() == 0 {
953				v.Set(reflect.ValueOf(string(s)))
954			} else {
955				d.saveError(&UnmarshalTypeError{Value: "string", Type: v.Type(), Offset: int64(d.readIndex())})
956			}
957		}
958
959	default: // number
960		if c != '-' && (c < '0' || c > '9') {
961			if fromQuoted {
962				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
963			}
964			panic(phasePanicMsg)
965		}
966		switch v.Kind() {
967		default:
968			if v.Kind() == reflect.String && v.Type() == numberType {
969				// s must be a valid number, because it's
970				// already been tokenized.
971				v.SetString(string(item))
972				break
973			}
974			if fromQuoted {
975				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
976			}
977			d.saveError(&UnmarshalTypeError{Value: "number", Type: v.Type(), Offset: int64(d.readIndex())})
978		case reflect.Interface:
979			n, err := d.convertNumber(string(item))
980			if err != nil {
981				d.saveError(err)
982				break
983			}
984			if v.NumMethod() != 0 {
985				d.saveError(&UnmarshalTypeError{Value: "number", Type: v.Type(), Offset: int64(d.readIndex())})
986				break
987			}
988			v.Set(reflect.ValueOf(n))
989
990		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
991			n, err := strconv.ParseInt(string(item), 10, 64)
992			if err != nil || v.OverflowInt(n) {
993				d.saveError(&UnmarshalTypeError{Value: "number " + string(item), Type: v.Type(), Offset: int64(d.readIndex())})
994				break
995			}
996			v.SetInt(n)
997
998		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
999			n, err := strconv.ParseUint(string(item), 10, 64)
1000			if err != nil || v.OverflowUint(n) {
1001				d.saveError(&UnmarshalTypeError{Value: "number " + string(item), Type: v.Type(), Offset: int64(d.readIndex())})
1002				break
1003			}
1004			v.SetUint(n)
1005
1006		case reflect.Float32, reflect.Float64:
1007			n, err := strconv.ParseFloat(string(item), v.Type().Bits())
1008			if err != nil || v.OverflowFloat(n) {
1009				d.saveError(&UnmarshalTypeError{Value: "number " + string(item), Type: v.Type(), Offset: int64(d.readIndex())})
1010				break
1011			}
1012			v.SetFloat(n)
1013		}
1014	}
1015	return nil
1016}
1017
1018// The xxxInterface routines build up a value to be stored
1019// in an empty interface. They are not strictly necessary,
1020// but they avoid the weight of reflection in this common case.
1021
1022// valueInterface is like value but returns interface{}
1023func (d *decodeState) valueInterface() (val any) {
1024	switch d.opcode {
1025	default:
1026		panic(phasePanicMsg)
1027	case scanBeginArray:
1028		val = d.arrayInterface()
1029		d.scanNext()
1030	case scanBeginObject:
1031		val = d.objectInterface()
1032		d.scanNext()
1033	case scanBeginLiteral:
1034		val = d.literalInterface()
1035	}
1036	return
1037}
1038
1039// arrayInterface is like array but returns []interface{}.
1040func (d *decodeState) arrayInterface() []any {
1041	var v = make([]any, 0)
1042	for {
1043		// Look ahead for ] - can only happen on first iteration.
1044		d.scanWhile(scanSkipSpace)
1045		if d.opcode == scanEndArray {
1046			break
1047		}
1048
1049		v = append(v, d.valueInterface())
1050
1051		// Next token must be , or ].
1052		if d.opcode == scanSkipSpace {
1053			d.scanWhile(scanSkipSpace)
1054		}
1055		if d.opcode == scanEndArray {
1056			break
1057		}
1058		if d.opcode != scanArrayValue {
1059			panic(phasePanicMsg)
1060		}
1061	}
1062	return v
1063}
1064
1065// objectInterface is like object but returns map[string]interface{}.
1066func (d *decodeState) objectInterface() map[string]any {
1067	m := make(map[string]any)
1068	for {
1069		// Read opening " of string key or closing }.
1070		d.scanWhile(scanSkipSpace)
1071		if d.opcode == scanEndObject {
1072			// closing } - can only happen on first iteration.
1073			break
1074		}
1075		if d.opcode != scanBeginLiteral {
1076			panic(phasePanicMsg)
1077		}
1078
1079		// Read string key.
1080		start := d.readIndex()
1081		d.rescanLiteral()
1082		item := d.data[start:d.readIndex()]
1083		key, ok := unquote(item)
1084		if !ok {
1085			panic(phasePanicMsg)
1086		}
1087
1088		// Read : before value.
1089		if d.opcode == scanSkipSpace {
1090			d.scanWhile(scanSkipSpace)
1091		}
1092		if d.opcode != scanObjectKey {
1093			panic(phasePanicMsg)
1094		}
1095		d.scanWhile(scanSkipSpace)
1096
1097		// Read value.
1098		m[key] = d.valueInterface()
1099
1100		// Next token must be , or }.
1101		if d.opcode == scanSkipSpace {
1102			d.scanWhile(scanSkipSpace)
1103		}
1104		if d.opcode == scanEndObject {
1105			break
1106		}
1107		if d.opcode != scanObjectValue {
1108			panic(phasePanicMsg)
1109		}
1110	}
1111	return m
1112}
1113
1114// literalInterface consumes and returns a literal from d.data[d.off-1:] and
1115// it reads the following byte ahead. The first byte of the literal has been
1116// read already (that's how the caller knows it's a literal).
1117func (d *decodeState) literalInterface() any {
1118	// All bytes inside literal return scanContinue op code.
1119	start := d.readIndex()
1120	d.rescanLiteral()
1121
1122	item := d.data[start:d.readIndex()]
1123
1124	switch c := item[0]; c {
1125	case 'n': // null
1126		return nil
1127
1128	case 't', 'f': // true, false
1129		return c == 't'
1130
1131	case '"': // string
1132		s, ok := unquote(item)
1133		if !ok {
1134			panic(phasePanicMsg)
1135		}
1136		return s
1137
1138	default: // number
1139		if c != '-' && (c < '0' || c > '9') {
1140			panic(phasePanicMsg)
1141		}
1142		n, err := d.convertNumber(string(item))
1143		if err != nil {
1144			d.saveError(err)
1145		}
1146		return n
1147	}
1148}
1149
1150// getu4 decodes \uXXXX from the beginning of s, returning the hex value,
1151// or it returns -1.
1152func getu4(s []byte) rune {
1153	if len(s) < 6 || s[0] != '\\' || s[1] != 'u' {
1154		return -1
1155	}
1156	var r rune
1157	for _, c := range s[2:6] {
1158		switch {
1159		case '0' <= c && c <= '9':
1160			c = c - '0'
1161		case 'a' <= c && c <= 'f':
1162			c = c - 'a' + 10
1163		case 'A' <= c && c <= 'F':
1164			c = c - 'A' + 10
1165		default:
1166			return -1
1167		}
1168		r = r*16 + rune(c)
1169	}
1170	return r
1171}
1172
1173// unquote converts a quoted JSON string literal s into an actual string t.
1174// The rules are different than for Go, so cannot use strconv.Unquote.
1175func unquote(s []byte) (t string, ok bool) {
1176	s, ok = unquoteBytes(s)
1177	t = string(s)
1178	return
1179}
1180
1181// unquoteBytes should be an internal detail,
1182// but widely used packages access it using linkname.
1183// Notable members of the hall of shame include:
1184//   - github.com/bytedance/sonic
1185//
1186// Do not remove or change the type signature.
1187// See go.dev/issue/67401.
1188//
1189//go:linkname unquoteBytes
1190func unquoteBytes(s []byte) (t []byte, ok bool) {
1191	if len(s) < 2 || s[0] != '"' || s[len(s)-1] != '"' {
1192		return
1193	}
1194	s = s[1 : len(s)-1]
1195
1196	// Check for unusual characters. If there are none,
1197	// then no unquoting is needed, so return a slice of the
1198	// original bytes.
1199	r := 0
1200	for r < len(s) {
1201		c := s[r]
1202		if c == '\\' || c == '"' || c < ' ' {
1203			break
1204		}
1205		if c < utf8.RuneSelf {
1206			r++
1207			continue
1208		}
1209		rr, size := utf8.DecodeRune(s[r:])
1210		if rr == utf8.RuneError && size == 1 {
1211			break
1212		}
1213		r += size
1214	}
1215	if r == len(s) {
1216		return s, true
1217	}
1218
1219	b := make([]byte, len(s)+2*utf8.UTFMax)
1220	w := copy(b, s[0:r])
1221	for r < len(s) {
1222		// Out of room? Can only happen if s is full of
1223		// malformed UTF-8 and we're replacing each
1224		// byte with RuneError.
1225		if w >= len(b)-2*utf8.UTFMax {
1226			nb := make([]byte, (len(b)+utf8.UTFMax)*2)
1227			copy(nb, b[0:w])
1228			b = nb
1229		}
1230		switch c := s[r]; {
1231		case c == '\\':
1232			r++
1233			if r >= len(s) {
1234				return
1235			}
1236			switch s[r] {
1237			default:
1238				return
1239			case '"', '\\', '/', '\'':
1240				b[w] = s[r]
1241				r++
1242				w++
1243			case 'b':
1244				b[w] = '\b'
1245				r++
1246				w++
1247			case 'f':
1248				b[w] = '\f'
1249				r++
1250				w++
1251			case 'n':
1252				b[w] = '\n'
1253				r++
1254				w++
1255			case 'r':
1256				b[w] = '\r'
1257				r++
1258				w++
1259			case 't':
1260				b[w] = '\t'
1261				r++
1262				w++
1263			case 'u':
1264				r--
1265				rr := getu4(s[r:])
1266				if rr < 0 {
1267					return
1268				}
1269				r += 6
1270				if utf16.IsSurrogate(rr) {
1271					rr1 := getu4(s[r:])
1272					if dec := utf16.DecodeRune(rr, rr1); dec != unicode.ReplacementChar {
1273						// A valid pair; consume.
1274						r += 6
1275						w += utf8.EncodeRune(b[w:], dec)
1276						break
1277					}
1278					// Invalid surrogate; fall back to replacement rune.
1279					rr = unicode.ReplacementChar
1280				}
1281				w += utf8.EncodeRune(b[w:], rr)
1282			}
1283
1284		// Quote, control characters are invalid.
1285		case c == '"', c < ' ':
1286			return
1287
1288		// ASCII
1289		case c < utf8.RuneSelf:
1290			b[w] = c
1291			r++
1292			w++
1293
1294		// Coerce to well-formed UTF-8.
1295		default:
1296			rr, size := utf8.DecodeRune(s[r:])
1297			r += size
1298			w += utf8.EncodeRune(b[w:], rr)
1299		}
1300	}
1301	return b[0:w], true
1302}
1303