command/jsonstate: remove redundant remarking of resource instance (#29049)

* command/jsonstate: remove redundant remarking of resource instance

ResourceInstanceObjectSrc.Decode already handles marking values with any marks stored in ri.Current.AttrSensitivePaths, so re-applying those marks is not necessary.

We've gotten reports of panics coming from this line of code, though I have yet to reproduce the panic in a test.

* Implement test to reproduce panic on #29042

Co-authored-by: David Alger <davidmalger@gmail.com>

internal/command/jsonstate/state.go

@@ -330,9 +330,7 @@ func marshalResources(resources map[string]*states.Resource, module addrs.Module
 
 				current.AttributeValues = marshalAttributeValues(riObj.Value)
 
-				// Mark the resource instance value with any marks stored in AttrSensitivePaths so we can build the SensitiveValues object
-				markedVal := riObj.Value.MarkWithPaths(ri.Current.AttrSensitivePaths)
-				s := SensitiveAsBool(markedVal)
+				s := SensitiveAsBool(riObj.Value)
 				v, err := ctyjson.Marshal(s, s.Type())
 				if err != nil {
 					return nil, err
@@ -371,9 +369,7 @@ func marshalResources(resources map[string]*states.Resource, module addrs.Module
 
 				deposed.AttributeValues = marshalAttributeValues(riObj.Value)
 
-				// Mark the resource instance value with any marks stored in AttrSensitivePaths so we can build the SensitiveValues object
-				markedVal := riObj.Value.MarkWithPaths(rios.AttrSensitivePaths)
-				s := SensitiveAsBool(markedVal)
+				s := SensitiveAsBool(riObj.Value)
 				v, err := ctyjson.Marshal(s, s.Type())
 				if err != nil {
 					return nil, err

internal/command/jsonstate/state_test.go

@@ -198,6 +198,52 @@ func TestMarshalResources(t *testing.T) {
 			},
 			false,
 		},
+		"resource with marks": {
+			map[string]*states.Resource{
+				"test_thing.bar": {
+					Addr: addrs.AbsResource{
+						Resource: addrs.Resource{
+							Mode: addrs.ManagedResourceMode,
+							Type: "test_thing",
+							Name: "bar",
+						},
+					},
+					Instances: map[addrs.InstanceKey]*states.ResourceInstance{
+						addrs.NoKey: {
+							Current: &states.ResourceInstanceObjectSrc{
+								Status:    states.ObjectReady,
+								AttrsJSON: []byte(`{"foozles":"confuzles"}`),
+								AttrSensitivePaths: []cty.PathValueMarks{{
+									Path:  cty.Path{cty.GetAttrStep{Name: "foozles"}},
+									Marks: cty.NewValueMarks(marks.Sensitive)},
+								},
+							},
+						},
+					},
+					ProviderConfig: addrs.AbsProviderConfig{
+						Provider: addrs.NewDefaultProvider("test"),
+						Module:   addrs.RootModule,
+					},
+				},
+			},
+			testSchemas(),
+			[]resource{
+				{
+					Address:      "test_thing.bar",
+					Mode:         "managed",
+					Type:         "test_thing",
+					Name:         "bar",
+					Index:        addrs.InstanceKey(nil),
+					ProviderName: "registry.terraform.io/hashicorp/test",
+					AttributeValues: attributeValues{
+						"foozles": json.RawMessage(`"confuzles"`),
+						"woozles": json.RawMessage(`null`),
+					},
+					SensitiveValues: json.RawMessage(`{"foozles":true}`),
+				},
+			},
+			false,
+		},
 		"single resource wrong schema": {
 			map[string]*states.Resource{
 				"test_thing.baz": {
@@ -418,6 +464,51 @@ func TestMarshalResources(t *testing.T) {
 			},
 			false,
 		},
+		"resource with marked map attr": {
+			map[string]*states.Resource{
+				"test_map_attr.bar": {
+					Addr: addrs.AbsResource{
+						Resource: addrs.Resource{
+							Mode: addrs.ManagedResourceMode,
+							Type: "test_map_attr",
+							Name: "bar",
+						},
+					},
+					Instances: map[addrs.InstanceKey]*states.ResourceInstance{
+						addrs.NoKey: {
+							Current: &states.ResourceInstanceObjectSrc{
+								Status:    states.ObjectReady,
+								AttrsJSON: []byte(`{"data":{"woozles":"confuzles"}}`),
+								AttrSensitivePaths: []cty.PathValueMarks{{
+									Path:  cty.Path{cty.GetAttrStep{Name: "data"}},
+									Marks: cty.NewValueMarks(marks.Sensitive)},
+								},
+							},
+						},
+					},
+					ProviderConfig: addrs.AbsProviderConfig{
+						Provider: addrs.NewDefaultProvider("test"),
+						Module:   addrs.RootModule,
+					},
+				},
+			},
+			testSchemas(),
+			[]resource{
+				{
+					Address:      "test_map_attr.bar",
+					Mode:         "managed",
+					Type:         "test_map_attr",
+					Name:         "bar",
+					Index:        addrs.InstanceKey(nil),
+					ProviderName: "registry.terraform.io/hashicorp/test",
+					AttributeValues: attributeValues{
+						"data": json.RawMessage(`{"woozles":"confuzles"}`),
+					},
+					SensitiveValues: json.RawMessage(`{"data":true}`),
+				},
+			},
+			false,
+		},
 	}
 
 	for name, test := range tests {
@@ -654,6 +745,11 @@ func testSchemas() *terraform.Schemas {
 							"bar": {Type: cty.String, Optional: true},
 						},
 					},
+					"test_map_attr": {
+						Attributes: map[string]*configschema.Attribute{
+							"data": {Type: cty.Map(cty.String), Optional: true, Computed: true, Sensitive: true},
+						},
+					},
 				},
 			},
 		},