build(deps): bump golang.org/x/tools to v0.49.0 and github.com/goplus/mod to v0.22.0

[cpunion]

Note

#2376 is now merged. This branch is rebased onto current main; the static-initializer and zero-sized-global fixes from #2376 are required by the x/tools v0.49 upgrade.

Summary

• Bump github.com/goplus/mod from v0.21.2 to v0.22.0.
• Bump golang.org/x/tools from v0.38.0 to v0.49.0, with the corresponding x/mod, x/sync, and x/sys versions.
• Update exact LLVM fixtures for the new composite-literal SSA form.
• Add end-to-end regressions for composite-assignment evaluation order, including assignment through a nil pointer.

Why the #2376 fixes are required

x/tools v0.49 includes go/ssa: avoid in-place initialization of CompositeLit (golang/tools@59ef372), which fixes golang/go#79414. Composite values are now built in a temporary aggregate and copied to their destination only after every right-hand-side expression has been evaluated.

That shape bypasses LLGo's old direct-global static initializer path. Without #2376, a real fmt.Printf workload on v0.49 also fails LLVM verification when a zero-sized global aliases the shared sentinel. #2376 fixes that correctness issue and folds only side-effect-free constant global aggregates; dynamic and local assignments retain the new x/tools ordering.

Validation

• Go 1.25.0 and Go 1.26.5 builds pass.
• Updated IR fixtures and their runtime counterparts pass on both toolchains.
• Separate regressions require all calls to occur before the aggregate store and before a nil-dereference panic.
• The non-panicking regression remains in both ESP32 emulator suites; only the panic/recover case is excluded because those bare-metal runtimes terminate on that known unsupported path.
• go mod tidy, go mod verify, repository-wide gofmt, baseline unit tests, inherited static-init tests, and the full ssa suite pass locally.

[fennoai]

Review summary

Reviewed the fixed diff 0314fae...63ede18 across code quality, performance, security, and documentation.

Dependency bumps (go.mod/go.sum): golang.org/x/tools v0.38.0 -> v0.49.0, plus golang.org/x/mod, x/sys, x/sync (indirect), and goplus/mod v0.22.0. All checksums verify against the Go checksum database; direct/indirect classification is correct.

ssa/decl.go — the moduleZeroName sentinel guard in Init/InitNil is correct: a Go identifier can't contain $, so no source-level global can collide with __llgo.moduleZeroSizedAlloc$. No miscompilation path.

cl/static_init.go — the new alloc-tracing logic is careful: referrer counts are validated, recursion is cycle-guarded via visited, and appendStaticInitPath allocates fresh slices to avoid aliasing. No correctness-blocking issues found. Two maintainability notes inline.

benchmark/baseline/main.go — buildArgs is built from a fresh literal per iteration, so no append-aliasing bug; README matches the six workloads. Good.

Performance — appendStaticInitPath is O(depth^2) over an address chain, but this mirrors the pre-existing staticInitStorePath and runs only over init-function stores on shallow chains at compile time. Negligible; not blocking.

Additional note (no reliable inline anchor)

• .github/workflows/benchmark.yml (merge-base step): github.event.pull_request.* values are interpolated directly into a run: shell block (base.repo.full_name, base.ref, head.sha). This is the classic Actions script-injection shape. Exploitability is low here — the trigger is pull_request (not pull_request_target), permissions are contents: read, forked runs get no secrets, and head.sha is a validated hex SHA. As defense-in-depth, consider moving those expressions into a step-level env: block and referencing quoted shell vars ("$BASE_REPO", "$BASE_REF", "$HEAD_SHA"), so the pattern stays safe if the trigger/permissions ever change.

Overall: solid change, no blocking issues.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

LLGo baseline benchmarks

b085b5c502a4 | workflow run | long-term charts

Program measurements

Platform	Workload	File size	vs base	Build	vs base	Run	vs base
Linux	cprintf	19288 B	0 B / +0.0%	326.786 ms	+87.59 ms / +36.6% (worse)	862.129 us	+32.94 us / +4.0% (worse)
Linux	cprintf-lto	19120 B	0 B / +0.0%	248.976 ms	+5.146 ms / +2.1% (worse)	931.359 us	+85.28 us / +10.1% (worse)
Linux	fmtprintf	1866216 B	+27128 B / +1.5% (worse)	2.370 s	+211.6 ms / +9.8% (worse)	2.166 ms	+16.73 us / +0.8% (worse)
Linux	fmtprintf-lto	1779144 B	+19672 B / +1.1% (worse)	10.392 s	+178.3 ms / +1.7% (worse)	2.129 ms	+53.59 us / +2.6% (worse)
Linux	println	68776 B	0 B / +0.0%	305.546 ms	+61.76 ms / +25.3% (worse)	1.104 ms	+46.06 us / +4.4% (worse)
Linux	println-lto	62464 B	0 B / +0.0%	428.350 ms	+43.54 ms / +11.3% (worse)	1.083 ms	-28.59 us / -2.6% (better)
macOS	cprintf	84672 B	0 B / +0.0%	556.196 ms	+62.04 ms / +12.6% (worse)	3.570 ms	+391.3 us / +12.3% (worse)
macOS	cprintf-lto	100912 B	0 B / +0.0%	506.369 ms	+63.13 ms / +14.2% (worse)	3.453 ms	+296.4 us / +9.4% (worse)
macOS	fmtprintf	1909296 B	+32816 B / +1.7% (worse)	3.158 s	+133.8 ms / +4.4% (worse)	19.013 ms	+6.232 ms / +48.8% (worse)
macOS	fmtprintf-lto	1626224 B	+16512 B / +1.0% (worse)	16.936 s	-5.768 s / -25.4% (better)	6.974 ms	-3.14 ms / -31.0% (better)
macOS	println	121360 B	0 B / +0.0%	456.204 ms	+19.19 ms / +4.4% (worse)	4.713 ms	+628.8 us / +15.4% (worse)
macOS	println-lto	128528 B	0 B / +0.0%	660.379 ms	+69.31 ms / +11.7% (worse)	4.873 ms	+1.035 ms / +27.0% (worse)

Core language and compiler benchmarks

Platform	Benchmark	ns/op	vs base
Linux	BenchmarkLookupPCRandom	8.088 ns/op	-1.094 ns/op / -11.9% (better)
Linux	BenchmarkMergeCompilerFlags	99.770 ns/op	-0.07 ns/op / -0.1% (better)
Linux	BenchmarkMergeLinkerFlags	64.010 ns/op	-0.2 ns/op / -0.3% (better)
Linux	BenchmarkChannelBuffered	39.740 ns/op	+0.37 ns/op / +0.9% (worse)
Linux	BenchmarkChannelHandoff	22312 ns/op	-4151 ns/op / -15.7% (better)
Linux	BenchmarkDefer	40.570 ns/op	-1.38 ns/op / -3.3% (better)
Linux	BenchmarkDirectCall	0.280 ns/op	+0.0031 ns/op / +1.1% (worse)
Linux	BenchmarkGlobalRead	0.401 ns/op	+0.0102 ns/op / +2.6% (worse)
Linux	BenchmarkGlobalWrite	6.997 ns/op	-0.295 ns/op / -4.0% (better)
Linux	BenchmarkGoroutine	33900 ns/op	-11342 ns/op / -25.1% (better)
Linux	BenchmarkInterfaceCall	4.103 ns/op	+0.002 ns/op / +0.04877% (worse)
Linux	BenchmarkRuntimeGetG	0.724 ns/op	+0.0008 ns/op / +0.1% (worse)
macOS	BenchmarkLookupPCRandom	12.540 ns/op	-2.11 ns/op / -14.4% (better)
macOS	BenchmarkMergeCompilerFlags	110.400 ns/op	-57.1 ns/op / -34.1% (better)
macOS	BenchmarkMergeLinkerFlags	72.080 ns/op	-22.8 ns/op / -24.0% (better)
macOS	BenchmarkChannelBuffered	26.220 ns/op	-5.12 ns/op / -16.3% (better)
macOS	BenchmarkChannelHandoff	9182 ns/op	-3338 ns/op / -26.7% (better)
macOS	BenchmarkDefer	36.910 ns/op	-3.7 ns/op / -9.1% (better)
macOS	BenchmarkDirectCall	1.228 ns/op	-0.051 ns/op / -4.0% (better)
macOS	BenchmarkGlobalRead	1.253 ns/op	+0.094 ns/op / +8.1% (worse)
macOS	BenchmarkGlobalWrite	1.148 ns/op	-0.259 ns/op / -18.4% (better)
macOS	BenchmarkGoroutine	29940 ns/op	-16488 ns/op / -35.5% (better)
macOS	BenchmarkInterfaceCall	6.201 ns/op	+0.597 ns/op / +10.7% (worse)
macOS	BenchmarkRuntimeGetG	2.107 ns/op	-0.511 ns/op / -19.5% (better)

Compared with 2815db687312 measured in the same runner job.