diff --git a/gopls/internal/cache/port.go b/gopls/internal/cache/port.go
index e62ebe29903..40005bcf6d4 100644
--- a/gopls/internal/cache/port.go
+++ b/gopls/internal/cache/port.go
@@ -141,6 +141,11 @@ var (
 func (p port) matches(path string, content []byte) bool {
 	ctxt := build.Default // make a copy
 	ctxt.UseAllFiles = false
+	path = filepath.Clean(path)
+	if !filepath.IsAbs(path) {
+		bug.Reportf("non-abs file path %q", path)
+		return false // fail closed
+	}
 	dir, name := filepath.Split(path)
 
 	// The only virtualized operation called by MatchFile is OpenFile.