### Terraform Version ``` Terraform v1.17.0-rc1 on darwin_arm64 + provider registry.terraform.io/hashicorp/aws v6.68.0 ``` Also reproduced with v1.16.2 and v1.16.5 (latest stable). ### Terraform Configuration Files `main.tf`: ```hcl terraform { required_providers { aws = { source = "hashicorp/aws" version = "6.68.0" } } } data "aws_iam_policy_document" "this" { statement { actions = ["s3:GetObject"] resources = ["arn:aws:s3:::example-bucket/*"] } } ``` `tests/repro.tftest.hcl`: ```hcl mock_provider "aws" {} run "failing_assertion" { assert { condition = [data.aws_iam_policy_document.this][0].id == "never-matches" error_message = "expected to read this message" } } ``` ### Debug Output Panic output (the full `TF_LOG=trace` log is available on request): ``` panic: unexpected error marshalling value: value has marks, so it cannot be serialized as JSON goroutine 72 [running]: runtime/debug.Stack() runtime/debug/stack.go:26 +0x64 github.com/hashicorp/terraform/internal/logging.PanicHandler() github.com/hashicorp/terraform/internal/logging/panic.go:84 +0x164 panic({0x10723d600?, 0x31d7ca76a620?}) runtime/panic.go:860 +0x12c github.com/hashicorp/terraform/internal/moduletest/graph.Walk.func1.1() github.com/hashicorp/terraform/internal/moduletest/graph/test_graph_builder.go:117 +0x120 panic({0x10723d600?, 0x31d7ca76a620?}) runtime/panic.go:860 +0x12c github.com/hashicorp/terraform/internal/command/views/json.NewDiagnostic({0x107cd9a00, 0x31d7ca691b00}, 0x31d7ca76e300) github.com/hashicorp/terraform/internal/command/views/json/diagnostic.go:278 +0x13a4 github.com/hashicorp/terraform/internal/command/format.DiagnosticPlain({0x107cd9a00?, 0x31d7ca691b00?}, 0x0?, 0x4e) github.com/hashicorp/terraform/internal/command/format/diagnostic.go:132 +0x28 github.com/hashicorp/terraform/internal/command/views.(*View).formatDiagnostic(0x31d7c151be40, {0x107cd9a00, 0x31d7ca691b00}) github.com/hashicorp/terraform/internal/command/views/view.go:241 +0x84 github.com/hashicorp/terraform/internal/command/views.(*View).Diagnostics(0x31d7c151be40, {0x31d7ca76a120, 0x1, 0x1}) github.com/hashicorp/terraform/internal/command/views/view.go:119 +0xe0 github.com/hashicorp/terraform/internal/command/views.(*TestHuman).Diagnostics(...) github.com/hashicorp/terraform/internal/command/views/test.go:311 github.com/hashicorp/terraform/internal/command/views.(*TestHuman).Run(0x31d7c15bb280, 0x31d7c17fec00, 0x31d7c111d740, 0x101d9282c?, 0x20?) github.com/hashicorp/terraform/internal/command/views/test.go:248 +0x680 github.com/hashicorp/terraform/internal/moduletest/graph.(*NodeTestRun).Execute.func1() github.com/hashicorp/terraform/internal/moduletest/graph/node_test_run.go:98 +0x40 github.com/hashicorp/terraform/internal/moduletest/graph.(*NodeTestRun).Execute(0x31d7c1766810, 0x31d7c1620000) github.com/hashicorp/terraform/internal/moduletest/graph/node_test_run.go:148 +0x378 github.com/hashicorp/terraform/internal/moduletest/graph.Walk.func1({0x107c62380, 0x31d7c1766810}) github.com/hashicorp/terraform/internal/moduletest/graph/test_graph_builder.go:130 +0x1e0 github.com/hashicorp/terraform/internal/dag.(*Walker).walkVertex(0x31d7c6430550, {0x107c62380, 0x31d7c1766810}, 0x31d7ca70aa50) github.com/hashicorp/terraform/internal/dag/walk.go:258 +0x124 created by github.com/hashicorp/terraform/internal/dag.(*Walker).Walk in goroutine 50 github.com/hashicorp/terraform/internal/dag/walk.go:192 +0x5b0 ``` ### Expected Behavior The run fails and prints the assertion's diagnostic, `expected to read this message`, with the values of the expression's references, and `terraform test` exits 1. ### Actual Behavior The run is reported as `fail`, then Terraform panics while building that diagnostic (`views/json/diagnostic.go:278`) and exits 11. The assertion's message is never printed. ### Steps to Reproduce 1. Save the two files above. 2. `terraform init` 3. `terraform test` No AWS credentials are needed (`mock_provider`). ### Additional Context The trigger seems to be a reference to the **whole object** of a resource or data source whose schema has deprecated attributes. `aws_iam_policy_document` has two (`override_json`, `source_json`), and I assume their deprecation marks are what can't be serialized. All against v1.17.0-rc1: | Failing condition | Result | |---|---| | `data.aws_iam_policy_document.this.id == "never-matches"` | clean failure, exit 1 | | `length(data.aws_iam_policy_document.this.statement) == 2` | clean failure, exit 1 | | `[data.aws_iam_policy_document.this][0].id == "never-matches"` | panic, exit 11 | | `length([for k, v in data.aws_iam_policy_document.this : k]) == 0` | panic, exit 11 | | The same shapes over a `for_each` instance map (`for k, d in data.aws_iam_policy_document.this : ...`) | panic, exit 11 | | `for_each` instance maps of `terraform_data`, `data.local_file` (hashicorp/local 2.5.3) or a mocked `aws_sns_topic` | clean failure, exit 1 | It also panics with the real AWS provider configured with dummy credentials instead of `mock_provider`, so mocking isn't required. Because the panic exits non-zero, CI still fails, but the developer gets a stack trace instead of the assertion's message. The common pattern that hits it is collecting a `for_each` data source's instances to assert on their statements. ### References - #39239: the same panic on a whole deprecated resource (`azurerm_static_site`). It was closed as not planned so the reporter could re-check it on a current provider. This reproduces it on a current provider and on v1.17.0-rc1. ### Generative AI / LLM assisted development? Yes. Claude Code (Claude Opus 5.5) helped narrow down the reproduction. Every result above was run and checked on v1.16.2, v1.16.5 and v1.17.0-rc1.