all: remove non-fatal UTF-8 validation errors (and non-fatal in general)

Immediately abort (un)marshal operations when encountering invalid UTF-8
data in proto3 strings. No other proto implementation supports non-UTF-8
data in proto3 strings (and many reject it in proto2 strings as well).
Producing invalid output is an interoperability threat (other
implementations won't be able to read it).

The case where existing string data is found to contain non-UTF8 data is
better handled by changing the field to the `bytes` type, which (aside
from UTF-8 validation) is wire-compatible with `string`.

Remove the errors.NonFatal type, since there are no remaining cases
where it is needed. "Non-fatal" errors which produce results and a
non-nil error are problematic because they compose poorly; the better
approach is to take an option like AllowPartial indicating which
conditions to check for.

Change-Id: I9d189ec6ffda7b5d96d094aa1b290af2e3f23736
Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/183098
Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>
diff --git a/encoding/protojson/decode.go b/encoding/protojson/decode.go
index 29bf114..8dad1d5 100644
--- a/encoding/protojson/decode.go
+++ b/encoding/protojson/decode.go
@@ -62,8 +62,7 @@
 	}
 	o.decoder = json.NewDecoder(b)
 
-	var nerr errors.NonFatal
-	if err := o.unmarshalMessage(m.ProtoReflect(), false); !nerr.Merge(err) {
+	if err := o.unmarshalMessage(m.ProtoReflect(), false); err != nil {
 		return err
 	}
 
@@ -76,10 +75,10 @@
 		return unexpectedJSONError{val}
 	}
 
-	if !o.AllowPartial {
-		nerr.Merge(proto.IsInitialized(m))
+	if o.AllowPartial {
+		return nil
 	}
-	return nerr.E
+	return proto.IsInitialized(m)
 }
 
 // unexpectedJSONError is an error that contains the unexpected json.Value. This
@@ -116,30 +115,27 @@
 
 // unmarshalMessage unmarshals a message into the given protoreflect.Message.
 func (o UnmarshalOptions) unmarshalMessage(m pref.Message, skipTypeURL bool) error {
-	var nerr errors.NonFatal
-
 	if isCustomType(m.Descriptor().FullName()) {
 		return o.unmarshalCustomType(m)
 	}
 
 	jval, err := o.decoder.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	if jval.Type() != json.StartObject {
 		return unexpectedJSONError{jval}
 	}
 
-	if err := o.unmarshalFields(m, skipTypeURL); !nerr.Merge(err) {
+	if err := o.unmarshalFields(m, skipTypeURL); err != nil {
 		return err
 	}
 
-	return nerr.E
+	return nil
 }
 
 // unmarshalFields unmarshals the fields into the given protoreflect.Message.
 func (o UnmarshalOptions) unmarshalFields(m pref.Message, skipTypeURL bool) error {
-	var nerr errors.NonFatal
 	var seenNums set.Ints
 	var seenOneofs set.Ints
 
@@ -150,7 +146,7 @@
 	for {
 		// Read field name.
 		jval, err := o.decoder.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 		switch jval.Type() {
@@ -163,7 +159,7 @@
 		}
 
 		name, err := jval.Name()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 		// Unmarshaling a non-custom embedded message in Any will contain the
@@ -195,7 +191,7 @@
 		if fd == nil {
 			// Field is unknown.
 			if o.DiscardUnknown {
-				if err := skipJSONValue(o.decoder); !nerr.Merge(err) {
+				if err := skipJSONValue(o.decoder); err != nil {
 					return err
 				}
 				continue
@@ -220,12 +216,12 @@
 		switch {
 		case fd.IsList():
 			list := m.Mutable(fd).List()
-			if err := o.unmarshalList(list, fd); !nerr.Merge(err) {
+			if err := o.unmarshalList(list, fd); err != nil {
 				return errors.New("%v|%q: %v", fd.FullName(), name, err)
 			}
 		case fd.IsMap():
 			mmap := m.Mutable(fd).Map()
-			if err := o.unmarshalMap(mmap, fd); !nerr.Merge(err) {
+			if err := o.unmarshalMap(mmap, fd); err != nil {
 				return errors.New("%v|%q: %v", fd.FullName(), name, err)
 			}
 		default:
@@ -239,13 +235,13 @@
 			}
 
 			// Required or optional fields.
-			if err := o.unmarshalSingular(m, fd); !nerr.Merge(err) {
+			if err := o.unmarshalSingular(m, fd); err != nil {
 				return errors.New("%v|%q: %v", fd.FullName(), name, err)
 			}
 		}
 	}
 
-	return nerr.E
+	return nil
 }
 
 // findExtension returns protoreflect.ExtensionType from the resolver if found.
@@ -287,12 +283,11 @@
 		val, err = o.unmarshalScalar(fd)
 	}
 
-	var nerr errors.NonFatal
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	m.Set(fd, val)
-	return nerr.E
+	return nil
 }
 
 // unmarshalScalar unmarshals to a scalar/enum protoreflect.Value specified by
@@ -301,9 +296,8 @@
 	const b32 int = 32
 	const b64 int = 64
 
-	var nerr errors.NonFatal
 	jval, err := o.decoder.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return pref.Value{}, err
 	}
 
@@ -332,10 +326,10 @@
 
 	case pref.StringKind:
 		pval, err := unmarshalString(jval)
-		if !nerr.Merge(err) {
+		if err != nil {
 			return pval, err
 		}
-		return pval, nerr.E
+		return pval, nil
 
 	case pref.BytesKind:
 		return unmarshalBytes(jval)
@@ -367,9 +361,8 @@
 			return pref.Value{}, errors.New("invalid number %v", jval.Raw())
 		}
 		dec := json.NewDecoder([]byte(s))
-		var nerr errors.NonFatal
 		jval, err := dec.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return pref.Value{}, err
 		}
 		return getInt(jval, bitSize)
@@ -400,9 +393,8 @@
 			return pref.Value{}, errors.New("invalid number %v", jval.Raw())
 		}
 		dec := json.NewDecoder([]byte(s))
-		var nerr errors.NonFatal
 		jval, err := dec.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return pref.Value{}, err
 		}
 		return getUint(jval, bitSize)
@@ -450,9 +442,8 @@
 			return pref.Value{}, errors.New("invalid number %v", jval.Raw())
 		}
 		dec := json.NewDecoder([]byte(s))
-		var nerr errors.NonFatal
 		jval, err := dec.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return pref.Value{}, err
 		}
 		return getFloat(jval, bitSize)
@@ -526,9 +517,8 @@
 }
 
 func (o UnmarshalOptions) unmarshalList(list pref.List, fd pref.FieldDescriptor) error {
-	var nerr errors.NonFatal
 	jval, err := o.decoder.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	if jval.Type() != json.StartArray {
@@ -540,11 +530,11 @@
 		for {
 			m := list.NewMessage()
 			err := o.unmarshalMessage(m, false)
-			if !nerr.Merge(err) {
+			if err != nil {
 				if e, ok := err.(unexpectedJSONError); ok {
 					if e.value.Type() == json.EndArray {
 						// Done with list.
-						return nerr.E
+						return nil
 					}
 				}
 				return err
@@ -554,11 +544,11 @@
 	default:
 		for {
 			val, err := o.unmarshalScalar(fd)
-			if !nerr.Merge(err) {
+			if err != nil {
 				if e, ok := err.(unexpectedJSONError); ok {
 					if e.value.Type() == json.EndArray {
 						// Done with list.
-						return nerr.E
+						return nil
 					}
 				}
 				return err
@@ -566,13 +556,12 @@
 			list.Append(val)
 		}
 	}
-	return nerr.E
+	return nil
 }
 
 func (o UnmarshalOptions) unmarshalMap(mmap pref.Map, fd pref.FieldDescriptor) error {
-	var nerr errors.NonFatal
 	jval, err := o.decoder.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	if jval.Type() != json.StartObject {
@@ -586,12 +575,11 @@
 	switch fd.MapValue().Kind() {
 	case pref.MessageKind, pref.GroupKind:
 		unmarshalMapValue = func() (pref.Value, error) {
-			var nerr errors.NonFatal
 			m := mmap.NewMessage()
-			if err := o.unmarshalMessage(m, false); !nerr.Merge(err) {
+			if err := o.unmarshalMessage(m, false); err != nil {
 				return pref.Value{}, err
 			}
-			return pref.ValueOf(m), nerr.E
+			return pref.ValueOf(m), nil
 		}
 	default:
 		unmarshalMapValue = func() (pref.Value, error) {
@@ -603,7 +591,7 @@
 	for {
 		// Read field name.
 		jval, err := o.decoder.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 		switch jval.Type() {
@@ -616,13 +604,13 @@
 		}
 
 		name, err := jval.Name()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 
 		// Unmarshal field name.
 		pkey, err := unmarshalMapKey(name, fd.MapKey())
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 
@@ -633,14 +621,14 @@
 
 		// Read and unmarshal field value.
 		pval, err := unmarshalMapValue()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 
 		mmap.Set(pkey, pval)
 	}
 
-	return nerr.E
+	return nil
 }
 
 // unmarshalMapKey converts given string into a protoreflect.MapKey. A map key type is any
diff --git a/encoding/protojson/decode_test.go b/encoding/protojson/decode_test.go
index c680c8a..0de7d7f 100644
--- a/encoding/protojson/decode_test.go
+++ b/encoding/protojson/decode_test.go
@@ -5,7 +5,6 @@
 package protojson_test
 
 import (
-	"bytes"
 	"math"
 	"testing"
 
@@ -391,10 +390,7 @@
 		desc:         "string with invalid UTF-8",
 		inputMessage: &pb3.Scalars{},
 		inputText:    "{\"sString\": \"\xff\"}",
-		wantMessage: &pb3.Scalars{
-			SString: "\xff",
-		},
-		wantErr: true,
+		wantErr:      true,
 	}, {
 		desc:         "not string",
 		inputMessage: &pb2.Scalars{},
@@ -814,18 +810,12 @@
 		desc:         "repeated string contains invalid UTF8",
 		inputMessage: &pb2.Repeats{},
 		inputText:    `{"rptString": ["` + "abc\xff" + `"]}`,
-		wantMessage: &pb2.Repeats{
-			RptString: []string{"abc\xff"},
-		},
-		wantErr: true,
+		wantErr:      true,
 	}, {
 		desc:         "repeated messages contain invalid UTF8",
 		inputMessage: &pb2.Nests{},
 		inputText:    `{"rptNested": [{"optString": "` + "abc\xff" + `"}]}`,
-		wantMessage: &pb2.Nests{
-			RptNested: []*pb2.Nested{{OptString: scalar.String("abc\xff")}},
-		},
-		wantErr: true,
+		wantErr:      true,
 	}, {
 		desc:         "repeated scalars contain invalid type",
 		inputMessage: &pb2.Repeats{},
@@ -1020,11 +1010,6 @@
 	}
   }
 }`,
-		wantMessage: &pb3.Maps{
-			StrToNested: map[string]*pb3.Nested{
-				"hello": {SString: "abc\xff"},
-			},
-		},
 		wantErr: true,
 	}, {
 		desc:         "map key contains invalid UTF8",
@@ -1034,11 +1019,6 @@
     "` + "abc\xff" + `": {}
   }
 }`,
-		wantMessage: &pb3.Maps{
-			StrToNested: map[string]*pb3.Nested{
-				"abc\xff": {},
-			},
-		},
 		wantErr: true,
 	}, {
 		desc:         "required fields not set",
@@ -1509,16 +1489,12 @@
 		desc:         "StringValue with invalid UTF8 error",
 		inputMessage: &wrapperspb.StringValue{},
 		inputText:    "\"abc\xff\"",
-		wantMessage:  &wrapperspb.StringValue{Value: "abc\xff"},
 		wantErr:      true,
 	}, {
 		desc:         "StringValue field with invalid UTF8 error",
 		inputMessage: &pb2.KnownTypes{},
 		inputText:    "{\n  \"optString\": \"abc\xff\"\n}",
-		wantMessage: &pb2.KnownTypes{
-			OptString: &wrapperspb.StringValue{Value: "abc\xff"},
-		},
-		wantErr: true,
+		wantErr:      true,
 	}, {
 		desc:         "NullValue field with JSON null",
 		inputMessage: &pb2.KnownTypes{},
@@ -1589,7 +1565,6 @@
 		desc:         "Value string with invalid UTF8",
 		inputMessage: &structpb.Value{},
 		inputText:    "\"\xff\"",
-		wantMessage:  &structpb.Value{Kind: &structpb.Value_StringValue{"\xff"}},
 		wantErr:      true,
 	}, {
 		desc:         "Value field string",
@@ -1606,9 +1581,6 @@
 		inputText: `{
   "optValue": "` + "\xff" + `"
 }`,
-		wantMessage: &pb2.KnownTypes{
-			OptValue: &structpb.Value{Kind: &structpb.Value_StringValue{"\xff"}},
-		},
 		wantErr: true,
 	}, {
 		desc:         "Value empty struct",
@@ -1660,16 +1632,7 @@
 		desc:         "Value struct with invalid UTF8 string",
 		inputMessage: &structpb.Value{},
 		inputText:    "{\"string\": \"abc\xff\"}",
-		wantMessage: &structpb.Value{
-			Kind: &structpb.Value_StructValue{
-				&structpb.Struct{
-					Fields: map[string]*structpb.Value{
-						"string": {Kind: &structpb.Value_StringValue{"abc\xff"}},
-					},
-				},
-			},
-		},
-		wantErr: true,
+		wantErr:      true,
 	}, {
 		desc:         "Value field struct",
 		inputMessage: &pb2.KnownTypes{},
@@ -1743,33 +1706,13 @@
 		desc:         "Value list with invalid UTF8 string",
 		inputMessage: &structpb.Value{},
 		inputText:    "[\"abc\xff\"]",
-		wantMessage: &structpb.Value{
-			Kind: &structpb.Value_ListValue{
-				&structpb.ListValue{
-					Values: []*structpb.Value{
-						{Kind: &structpb.Value_StringValue{"abc\xff"}},
-					},
-				},
-			},
-		},
-		wantErr: true,
+		wantErr:      true,
 	}, {
 		desc:         "Value field list with invalid UTF8 string",
 		inputMessage: &pb2.KnownTypes{},
 		inputText: `{
   "optValue": [ "` + "abc\xff" + `"]
 }`,
-		wantMessage: &pb2.KnownTypes{
-			OptValue: &structpb.Value{
-				Kind: &structpb.Value_ListValue{
-					&structpb.ListValue{
-						Values: []*structpb.Value{
-							{Kind: &structpb.Value_StringValue{"abc\xff"}},
-						},
-					},
-				},
-			},
-		},
 		wantErr: true,
 	}, {
 		desc:         "Duration empty string",
@@ -2073,19 +2016,6 @@
   "optString": "` + "abc\xff" + `",
   "@type": "foo/pb2.Nested"
 }`,
-		wantMessage: func() proto.Message {
-			m := &pb2.Nested{
-				OptString: scalar.String("abc\xff"),
-			}
-			b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
-			if err != nil {
-				t.Fatalf("error in binary marshaling message for Any.value: %v", err)
-			}
-			return &anypb.Any{
-				TypeUrl: "foo/pb2.Nested",
-				Value:   b,
-			}
-		}(),
 		wantErr: true,
 	}, {
 		desc: "Any with BoolValue",
@@ -2141,17 +2071,6 @@
   "@type": "google.protobuf.StringValue",
   "value": "` + "abc\xff" + `"
 }`,
-		wantMessage: func() proto.Message {
-			m := &wrapperspb.StringValue{Value: "abcd"}
-			b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
-			if err != nil {
-				t.Fatalf("error in binary marshaling message for Any.value: %v", err)
-			}
-			return &anypb.Any{
-				TypeUrl: "google.protobuf.StringValue",
-				Value:   bytes.Replace(b, []byte("abcd"), []byte("abc\xff"), -1),
-			}
-		}(),
 		wantErr: true,
 	}, {
 		desc: "Any with Int64Value",
@@ -2227,17 +2146,6 @@
   "@type": "google.protobuf.Value",
   "value": "` + "abc\xff" + `"
 }`,
-		wantMessage: func() proto.Message {
-			m := &structpb.Value{Kind: &structpb.Value_StringValue{"abcd"}}
-			b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
-			if err != nil {
-				t.Fatalf("error in binary marshaling message for Any.value: %v", err)
-			}
-			return &anypb.Any{
-				TypeUrl: "google.protobuf.Value",
-				Value:   bytes.Replace(b, []byte("abcd"), []byte("abc\xff"), -1),
-			}
-		}(),
 		wantErr: true,
 	}, {
 		desc: "Any with Value of NullValue",
@@ -2380,26 +2288,6 @@
 	"value": "` + "abc\xff" + `"
   }
 }`,
-		wantMessage: func() proto.Message {
-			m1 := &wrapperspb.StringValue{Value: "abcd"}
-			b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m1)
-			if err != nil {
-				t.Fatalf("error in binary marshaling message for Any.value: %v", err)
-			}
-			m2 := &anypb.Any{
-				TypeUrl: "google.protobuf.StringValue",
-				Value:   b,
-			}
-			m3 := &pb2.KnownTypes{OptAny: m2}
-			b, err = proto.MarshalOptions{Deterministic: true}.Marshal(m3)
-			if err != nil {
-				t.Fatalf("error in binary marshaling message for Any.value: %v", err)
-			}
-			return &anypb.Any{
-				TypeUrl: "pb2.KnownTypes",
-				Value:   bytes.Replace(b, []byte("abcd"), []byte("abc\xff"), -1),
-			}
-		}(),
 		wantErr: true,
 	}, {
 		desc: "well known types as field values",
diff --git a/encoding/protojson/encode.go b/encoding/protojson/encode.go
index fa28897..f17d3bb 100644
--- a/encoding/protojson/encode.go
+++ b/encoding/protojson/encode.go
@@ -10,7 +10,6 @@
 	"sort"
 
 	"google.golang.org/protobuf/internal/encoding/json"
-	"google.golang.org/protobuf/internal/errors"
 	"google.golang.org/protobuf/internal/pragma"
 	"google.golang.org/protobuf/proto"
 	pref "google.golang.org/protobuf/reflect/protoreflect"
@@ -58,38 +57,33 @@
 		o.Resolver = protoregistry.GlobalTypes
 	}
 
-	var nerr errors.NonFatal
 	err = o.marshalMessage(m.ProtoReflect())
-	if !nerr.Merge(err) {
+	if err != nil {
 		return nil, err
 	}
-	if !o.AllowPartial {
-		nerr.Merge(proto.IsInitialized(m))
+	if o.AllowPartial {
+		return o.encoder.Bytes(), nil
 	}
-	return o.encoder.Bytes(), nerr.E
+	return o.encoder.Bytes(), proto.IsInitialized(m)
 }
 
 // marshalMessage marshals the given protoreflect.Message.
 func (o MarshalOptions) marshalMessage(m pref.Message) error {
-	var nerr errors.NonFatal
-
 	if isCustomType(m.Descriptor().FullName()) {
 		return o.marshalCustomType(m)
 	}
 
 	o.encoder.StartObject()
 	defer o.encoder.EndObject()
-	if err := o.marshalFields(m); !nerr.Merge(err) {
+	if err := o.marshalFields(m); err != nil {
 		return err
 	}
 
-	return nerr.E
+	return nil
 }
 
 // marshalFields marshals the fields in the given protoreflect.Message.
 func (o MarshalOptions) marshalFields(m pref.Message) error {
-	var nerr errors.NonFatal
-
 	// Marshal out known fields.
 	fieldDescs := m.Descriptor().Fields()
 	for i := 0; i < fieldDescs.Len(); i++ {
@@ -100,19 +94,19 @@
 
 		name := fd.JSONName()
 		val := m.Get(fd)
-		if err := o.encoder.WriteName(name); !nerr.Merge(err) {
+		if err := o.encoder.WriteName(name); err != nil {
 			return err
 		}
-		if err := o.marshalValue(val, fd); !nerr.Merge(err) {
+		if err := o.marshalValue(val, fd); err != nil {
 			return err
 		}
 	}
 
 	// Marshal out extensions.
-	if err := o.marshalExtensions(m); !nerr.Merge(err) {
+	if err := o.marshalExtensions(m); err != nil {
 		return err
 	}
-	return nerr.E
+	return nil
 }
 
 // marshalValue marshals the given protoreflect.Value.
@@ -130,13 +124,12 @@
 // marshalSingular marshals the given non-repeated field value. This includes
 // all scalar types, enums, messages, and groups.
 func (o MarshalOptions) marshalSingular(val pref.Value, fd pref.FieldDescriptor) error {
-	var nerr errors.NonFatal
 	switch kind := fd.Kind(); kind {
 	case pref.BoolKind:
 		o.encoder.WriteBool(val.Bool())
 
 	case pref.StringKind:
-		if err := o.encoder.WriteString(val.String()); !nerr.Merge(err) {
+		if err := o.encoder.WriteString(val.String()); err != nil {
 			return err
 		}
 
@@ -161,7 +154,7 @@
 
 	case pref.BytesKind:
 		err := o.encoder.WriteString(base64.StdEncoding.EncodeToString(val.Bytes()))
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 
@@ -170,7 +163,7 @@
 			o.encoder.WriteNull()
 		} else if desc := fd.Enum().Values().ByNumber(val.Enum()); desc != nil {
 			err := o.encoder.WriteString(string(desc.Name()))
-			if !nerr.Merge(err) {
+			if err != nil {
 				return err
 			}
 		} else {
@@ -179,14 +172,14 @@
 		}
 
 	case pref.MessageKind, pref.GroupKind:
-		if err := o.marshalMessage(val.Message()); !nerr.Merge(err) {
+		if err := o.marshalMessage(val.Message()); err != nil {
 			return err
 		}
 
 	default:
 		panic(fmt.Sprintf("%v has unknown kind: %v", fd.FullName(), kind))
 	}
-	return nerr.E
+	return nil
 }
 
 // marshalList marshals the given protoreflect.List.
@@ -194,14 +187,13 @@
 	o.encoder.StartArray()
 	defer o.encoder.EndArray()
 
-	var nerr errors.NonFatal
 	for i := 0; i < list.Len(); i++ {
 		item := list.Get(i)
-		if err := o.marshalSingular(item, fd); !nerr.Merge(err) {
+		if err := o.marshalSingular(item, fd); err != nil {
 			return err
 		}
 	}
-	return nerr.E
+	return nil
 }
 
 type mapEntry struct {
@@ -223,16 +215,15 @@
 	sortMap(fd.MapKey().Kind(), entries)
 
 	// Write out sorted list.
-	var nerr errors.NonFatal
 	for _, entry := range entries {
-		if err := o.encoder.WriteName(entry.key.String()); !nerr.Merge(err) {
+		if err := o.encoder.WriteName(entry.key.String()); err != nil {
 			return err
 		}
-		if err := o.marshalSingular(entry.value, fd.MapValue()); !nerr.Merge(err) {
+		if err := o.marshalSingular(entry.value, fd.MapValue()); err != nil {
 			return err
 		}
 	}
-	return nerr.E
+	return nil
 }
 
 // sortMap orders list based on value of key field for deterministic ordering.
@@ -288,19 +279,18 @@
 	})
 
 	// Write out sorted list.
-	var nerr errors.NonFatal
 	for _, entry := range entries {
 		// JSON field name is the proto field name enclosed in [], similar to
 		// textproto. This is consistent with Go v1 lib. C++ lib v3.7.0 does not
 		// marshal out extension fields.
-		if err := o.encoder.WriteName("[" + entry.key + "]"); !nerr.Merge(err) {
+		if err := o.encoder.WriteName("[" + entry.key + "]"); err != nil {
 			return err
 		}
-		if err := o.marshalValue(entry.value, entry.desc); !nerr.Merge(err) {
+		if err := o.marshalValue(entry.value, entry.desc); err != nil {
 			return err
 		}
 	}
-	return nerr.E
+	return nil
 }
 
 // isMessageSetExtension reports whether extension extends a message set.
diff --git a/encoding/protojson/encode_test.go b/encoding/protojson/encode_test.go
index 174a6ba..bc6650c 100644
--- a/encoding/protojson/encode_test.go
+++ b/encoding/protojson/encode_test.go
@@ -159,7 +159,6 @@
 		input: &pb3.Scalars{
 			SString: "abc\xff",
 		},
-		want:    "{\n  \"sString\": \"abc\xff\"\n}",
 		wantErr: true,
 	}, {
 		desc: "float nan",
@@ -1149,14 +1148,12 @@
 	}, {
 		desc:    "StringValue with invalid UTF8 error",
 		input:   &wrapperspb.StringValue{Value: "abc\xff"},
-		want:    "\"abc\xff\"",
 		wantErr: true,
 	}, {
 		desc: "StringValue field with invalid UTF8 error",
 		input: &pb2.KnownTypes{
 			OptString: &wrapperspb.StringValue{Value: "abc\xff"},
 		},
-		want:    "{\n  \"optString\": \"abc\xff\"\n}",
 		wantErr: true,
 	}, {
 		desc:  "BytesValue",
@@ -1201,7 +1198,6 @@
 	}, {
 		desc:    "Value contains StringValue with invalid UTF8",
 		input:   &structpb.Value{Kind: &structpb.Value_StringValue{"\xff"}},
-		want:    "\"\xff\"",
 		wantErr: true,
 	}, {
 		desc: "Value contains Struct",
@@ -1312,7 +1308,6 @@
 				"string": {Kind: &structpb.Value_StringValue{"\xff"}},
 			},
 		},
-		want:    "{\n  \"string\": \"\xff\"\n}",
 		wantErr: true,
 	}, {
 		desc:  "ListValue with nil values",
@@ -1375,7 +1370,6 @@
 				{Kind: &structpb.Value_StringValue{"\xff"}},
 			},
 		},
-		want:    "[\n  \"\xff\"\n]",
 		wantErr: true,
 	}, {
 		desc:  "Duration empty",
@@ -1631,10 +1625,6 @@
 				Value:   b,
 			}
 		}(),
-		want: `{
-  "@type": "foo/pb2.Nested",
-  "optString": "` + "abc\xff" + `"
-}`,
 		wantErr: true,
 	}, {
 		desc: "Any with invalid value",
@@ -1702,10 +1692,6 @@
 				Value:   bytes.Replace(b, []byte("abcd"), []byte("abc\xff"), -1),
 			}
 		}(),
-		want: `{
-  "@type": "google.protobuf.StringValue",
-  "value": "` + "abc\xff" + `"
-}`,
 		wantErr: true,
 	}, {
 		desc: "Any with Int64Value",
@@ -1780,10 +1766,6 @@
 				Value:   bytes.Replace(b, []byte("abcd"), []byte("abc\xff"), -1),
 			}
 		}(),
-		want: `{
-  "@type": "type.googleapis.com/google.protobuf.Value",
-  "value": "` + "abc\xff" + `"
-}`,
 		wantErr: true,
 	}, {
 		desc: "Any with Value of NullValue",
diff --git a/encoding/protojson/well_known_types.go b/encoding/protojson/well_known_types.go
index c42cd61..c0291b6 100644
--- a/encoding/protojson/well_known_types.go
+++ b/encoding/protojson/well_known_types.go
@@ -166,14 +166,13 @@
 	// Marshal out @type field.
 	typeURL := typeVal.String()
 	o.encoder.WriteName("@type")
-	var nerr errors.NonFatal
-	if err := o.encoder.WriteString(typeURL); !nerr.Merge(err) {
+	if err := o.encoder.WriteString(typeURL); err != nil {
 		return err
 	}
 
 	// Resolve the type in order to unmarshal value field.
 	emt, err := o.Resolver.FindMessageByURL(typeURL)
-	if !nerr.Merge(err) {
+	if err != nil {
 		return errors.New("%s: unable to resolve %q: %v", m.Descriptor().FullName(), typeURL, err)
 	}
 
@@ -182,7 +181,7 @@
 		AllowPartial: true, // never check required fields inside an Any
 		Resolver:     o.Resolver,
 	}.Unmarshal(valueVal.Bytes(), em.Interface())
-	if !nerr.Merge(err) {
+	if err != nil {
 		return errors.New("%s: unable to unmarshal %q: %v", m.Descriptor().FullName(), typeURL, err)
 	}
 
@@ -195,11 +194,11 @@
 	}
 
 	// Else, marshal out the embedded message's fields in this Any object.
-	if err := o.marshalFields(em); !nerr.Merge(err) {
+	if err := o.marshalFields(em); err != nil {
 		return err
 	}
 
-	return nerr.E
+	return nil
 }
 
 func (o UnmarshalOptions) unmarshalAny(m pref.Message) error {
@@ -224,8 +223,7 @@
 		// Treat all fields as unknowns, similar to an empty object.
 		return skipJSONValue(o.decoder)
 	}
-	var nerr errors.NonFatal
-	if !nerr.Merge(err) {
+	if err != nil {
 		return errors.New("google.protobuf.Any: %v", err)
 	}
 
@@ -239,12 +237,12 @@
 	if isCustomType(emt.Descriptor().FullName()) {
 		// If embedded message is a custom type, unmarshal the JSON "value" field
 		// into it.
-		if err := o.unmarshalAnyValue(em); !nerr.Merge(err) {
+		if err := o.unmarshalAnyValue(em); err != nil {
 			return errors.New("google.protobuf.Any: %v", err)
 		}
 	} else {
 		// Else unmarshal the current JSON object into it.
-		if err := o.unmarshalMessage(em, true); !nerr.Merge(err) {
+		if err := o.unmarshalMessage(em, true); err != nil {
 			return errors.New("google.protobuf.Any: %v", err)
 		}
 	}
@@ -254,7 +252,7 @@
 		AllowPartial:  true, // never check required fields inside an Any
 		Deterministic: true,
 	}.Marshal(em.Interface())
-	if !nerr.Merge(err) {
+	if err != nil {
 		return errors.New("google.protobuf.Any: %v", err)
 	}
 
@@ -264,7 +262,7 @@
 
 	m.Set(fdType, pref.ValueOf(typeURL))
 	m.Set(fdValue, pref.ValueOf(b))
-	return nerr.E
+	return nil
 }
 
 var errEmptyObject = errors.New(`empty object`)
@@ -276,7 +274,6 @@
 // does not contain the field or other decoding problems.
 func findTypeURL(dec *json.Decoder) (string, error) {
 	var typeURL string
-	var nerr errors.NonFatal
 	numFields := 0
 	// Skip start object.
 	dec.Read()
@@ -284,7 +281,7 @@
 Loop:
 	for {
 		jval, err := dec.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return "", err
 		}
 
@@ -302,12 +299,12 @@
 		case json.Name:
 			numFields++
 			name, err := jval.Name()
-			if !nerr.Merge(err) {
+			if err != nil {
 				return "", err
 			}
 			if name != "@type" {
 				// Skip value.
-				if err := skipJSONValue(dec); !nerr.Merge(err) {
+				if err := skipJSONValue(dec); err != nil {
 					return "", err
 				}
 				continue
@@ -319,7 +316,7 @@
 			}
 			// Read field value.
 			jval, err := dec.Read()
-			if !nerr.Merge(err) {
+			if err != nil {
 				return "", err
 			}
 			if jval.Type() != json.String {
@@ -332,7 +329,7 @@
 		}
 	}
 
-	return typeURL, nerr.E
+	return typeURL, nil
 }
 
 // skipJSONValue makes the given decoder parse a JSON value (null, boolean,
@@ -340,9 +337,8 @@
 // JSON value. It relies on Decoder.Read returning an error if the types are
 // not in valid sequence.
 func skipJSONValue(dec *json.Decoder) error {
-	var nerr errors.NonFatal
 	jval, err := dec.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	// Only need to continue reading for objects and arrays.
@@ -350,7 +346,7 @@
 	case json.StartObject:
 		for {
 			jval, err := dec.Read()
-			if !nerr.Merge(err) {
+			if err != nil {
 				return err
 			}
 			switch jval.Type() {
@@ -358,7 +354,7 @@
 				return nil
 			case json.Name:
 				// Skip object field value.
-				if err := skipJSONValue(dec); !nerr.Merge(err) {
+				if err := skipJSONValue(dec); err != nil {
 					return err
 				}
 			}
@@ -375,26 +371,25 @@
 				return err
 			default:
 				// Skip array item.
-				if err := skipJSONValue(dec); !nerr.Merge(err) {
+				if err := skipJSONValue(dec); err != nil {
 					return err
 				}
 			}
 		}
 	}
-	return nerr.E
+	return nil
 }
 
 // unmarshalAnyValue unmarshals the given custom-type message from the JSON
 // object's "value" field.
 func (o UnmarshalOptions) unmarshalAnyValue(m pref.Message) error {
-	var nerr errors.NonFatal
 	// Skip StartObject, and start reading the fields.
 	o.decoder.Read()
 
 	var found bool // Used for detecting duplicate "value".
 	for {
 		jval, err := o.decoder.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 		switch jval.Type() {
@@ -402,17 +397,17 @@
 			if !found {
 				return errors.New(`missing "value" field`)
 			}
-			return nerr.E
+			return nil
 
 		case json.Name:
 			name, err := jval.Name()
-			if !nerr.Merge(err) {
+			if err != nil {
 				return err
 			}
 			switch name {
 			default:
 				if o.DiscardUnknown {
-					if err := skipJSONValue(o.decoder); !nerr.Merge(err) {
+					if err := skipJSONValue(o.decoder); err != nil {
 						return err
 					}
 					continue
@@ -428,7 +423,7 @@
 					return errors.New(`duplicate "value" field`)
 				}
 				// Unmarshal the field value into the given message.
-				if err := o.unmarshalCustomType(m); !nerr.Merge(err) {
+				if err := o.unmarshalCustomType(m); err != nil {
 					return err
 				}
 				found = true
@@ -451,12 +446,11 @@
 func (o UnmarshalOptions) unmarshalWrapperType(m pref.Message) error {
 	fd := m.Descriptor().Fields().ByNumber(wrapperFieldNumber)
 	val, err := o.unmarshalScalar(fd)
-	var nerr errors.NonFatal
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	m.Set(fd, val)
-	return nerr.E
+	return nil
 }
 
 // The JSON representation for Empty is an empty JSON object.
@@ -468,7 +462,6 @@
 }
 
 func (o UnmarshalOptions) unmarshalEmpty(pref.Message) error {
-	var nerr errors.NonFatal
 	jval, err := o.decoder.Read()
 	if err != nil {
 		return err
@@ -479,16 +472,16 @@
 
 	for {
 		jval, err := o.decoder.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 		switch jval.Type() {
 		case json.EndObject:
-			return nerr.E
+			return nil
 
 		case json.Name:
 			if o.DiscardUnknown {
-				if err := skipJSONValue(o.decoder); !nerr.Merge(err) {
+				if err := skipJSONValue(o.decoder); err != nil {
 					return err
 				}
 				continue
@@ -543,7 +536,6 @@
 }
 
 func (o UnmarshalOptions) unmarshalKnownValue(m pref.Message) error {
-	var nerr errors.NonFatal
 	switch o.decoder.Peek() {
 	case json.Null:
 		o.decoder.Read()
@@ -582,11 +574,11 @@
 		// always assigned to the string_value field, which means that certain
 		// encoding cannot be parsed back to the same field.
 		jval, err := o.decoder.Read()
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 		val, err := unmarshalString(jval)
-		if !nerr.Merge(err) {
+		if err != nil {
 			return err
 		}
 		fd := m.Descriptor().Fields().ByNumber(fieldnum.Value_StringValue)
@@ -595,7 +587,7 @@
 	case json.StartObject:
 		fd := m.Descriptor().Fields().ByNumber(fieldnum.Value_StructValue)
 		m2 := m.NewMessage(fd)
-		if err := o.unmarshalStruct(m2); !nerr.Merge(err) {
+		if err := o.unmarshalStruct(m2); err != nil {
 			return err
 		}
 		m.Set(fd, pref.ValueOf(m2))
@@ -603,7 +595,7 @@
 	case json.StartArray:
 		fd := m.Descriptor().Fields().ByNumber(fieldnum.Value_ListValue)
 		m2 := m.NewMessage(fd)
-		if err := o.unmarshalListValue(m2); !nerr.Merge(err) {
+		if err := o.unmarshalListValue(m2); err != nil {
 			return err
 		}
 		m.Set(fd, pref.ValueOf(m2))
@@ -615,7 +607,7 @@
 		}
 		return unexpectedJSONError{jval}
 	}
-	return nerr.E
+	return nil
 }
 
 // The JSON representation for a Duration is a JSON string that ends in the
@@ -671,9 +663,8 @@
 }
 
 func (o UnmarshalOptions) unmarshalDuration(m pref.Message) error {
-	var nerr errors.NonFatal
 	jval, err := o.decoder.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	if jval.Type() != json.String {
@@ -697,7 +688,7 @@
 
 	m.Set(fdSeconds, pref.ValueOf(secs))
 	m.Set(fdNanos, pref.ValueOf(nanos))
-	return nerr.E
+	return nil
 }
 
 // parseDuration parses the given input string for seconds and nanoseconds value
@@ -855,9 +846,8 @@
 }
 
 func (o UnmarshalOptions) unmarshalTimestamp(m pref.Message) error {
-	var nerr errors.NonFatal
 	jval, err := o.decoder.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	if jval.Type() != json.String {
@@ -882,7 +872,7 @@
 
 	m.Set(fdSeconds, pref.ValueOf(secs))
 	m.Set(fdNanos, pref.ValueOf(int32(t.Nanosecond())))
-	return nerr.E
+	return nil
 }
 
 // The JSON representation for a FieldMask is a JSON string where paths are
@@ -910,9 +900,8 @@
 }
 
 func (o UnmarshalOptions) unmarshalFieldMask(m pref.Message) error {
-	var nerr errors.NonFatal
 	jval, err := o.decoder.Read()
-	if !nerr.Merge(err) {
+	if err != nil {
 		return err
 	}
 	if jval.Type() != json.String {