[SR-13439] Swift is memory unsafe when escaping a fully initialised `self` in a fallible initialiser that returns nil. #55880

weissi · 2020-08-24T17:00:12Z


Previous ID	SR-13439
Radar	rdar://problem/67746791
Original Reporter	@weissi
Type	Bug
Status	Resolved
Resolution	Done

Attachment: Download

Additional Detail from JIRA


Votes	0
Component/s	Compiler
Labels	Bug, RunTimeCrash
Assignee	@slavapestov
Priority	Medium

md5: bd71160abded35bdcd864e042d815a3a

Issue Description:

Consider this program

import Dispatch

class Foo: CustomStringConvertible {
    var x: Optional<Int>

    init?(_ x: Int) {
        print("Foo init   \(x)")
        if x == 0 {
            return nil
        }
        self.x = x
        if x == 1 {
            DispatchQueue(label: "Foo").async {
                print(self)
            }
            return nil
        }
    }

    var description: String {
        return "I exist!"
    }

    deinit {
        print("Foo deinit \(self.x.debugDescription)")
    }
}

print(Foo(1).debugDescription)
sleep(1)

it prints for me

$ swiftc test.swift && ./test
Foo init   1
nil
Segmentation fault: 11
-SEGV-

in

$ swift -version
Apple Swift version 5.2.4 (swiftlang-1103.0.32.9 clang-1103.0.32.53)
Target: x86_64-apple-darwin19.6.0

The text was updated successfully, but these errors were encountered:

jckarter · 2020-08-24T17:33:26Z

This ought to be safe; returning nil from the initializer after self has been escaped should cause the initializer to return nil, and let the escaped object live its life normally.

slavapestov · 2020-08-25T02:12:34Z

Here is a reduced test case that crashes on my machine without using Dispatch:

var escaped: Foo? = nil

func escape(_ foo: Foo) {
  escaped = foo
}

class Foo {
    var x: Optional<Int>

    init?(_ x: Int) {
        if x == 0 {
            return nil
        }
        self.x = x
        if x == 1 {
            escape(self)
            return nil
        }
    }
}

_ = Foo(1)
print(escaped)

slavapestov · 2020-08-25T02:12:50Z

One interesting thing is that if you remove the 'if x == 0' block, the crash goes away.

slavapestov · 2020-08-25T02:19:24Z

Here is the failure exit block in the constructor:

bb7:                                              // Preds: bb4 bb1
  destroy_value %4 : $Foo                         // id: %42
  %43 = enum $Optional<Foo>, #Optional.none!enumelt // user: %44
  br bb8(%43 : $Optional<Foo>)

DI lowers this to:

bb7:                                              // Preds: bb6
  %25 = metatype $@thick Foo.Type                 // user: %26
  dealloc_partial_ref %1 : $Foo, %25 : $@thick Foo.Type // id: %26
  %27 = enum $Optional<Foo>, #Optional.none!enumelt // user: %28
  br bb8(%27 : $Optional<Foo>)                    // id: %28

typesanitizer · 2020-08-25T18:46:10Z

@swift-ci create

jckarter · 2020-08-25T19:06:39Z

Interesting. It sounds like maybe DI is failing to notice that the `if x == 0` case always exits, and so we still treat the initialization of `x` as conditional.

slavapestov · 2020-09-01T19:51:50Z

#33743

swift-ci transferred this issue from apple/swift-issues Apr 25, 2022

AnthonyLatsis added the crash Bug: A crash, i.e., an abnormal termination of software label Dec 12, 2022

This issue was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SR-13439] Swift is memory unsafe when escaping a fully initialised `self` in a fallible initialiser that returns nil. #55880

[SR-13439] Swift is memory unsafe when escaping a fully initialised `self` in a fallible initialiser that returns nil. #55880

weissi commented Aug 24, 2020

jckarter commented Aug 24, 2020

slavapestov commented Aug 25, 2020

slavapestov commented Aug 25, 2020

slavapestov commented Aug 25, 2020

typesanitizer commented Aug 25, 2020

jckarter commented Aug 25, 2020

slavapestov commented Sep 1, 2020

[SR-13439] Swift is memory unsafe when escaping a fully initialised self in a fallible initialiser that returns nil. #55880

[SR-13439] Swift is memory unsafe when escaping a fully initialised self in a fallible initialiser that returns nil. #55880

Comments

weissi commented Aug 24, 2020

jckarter commented Aug 24, 2020

slavapestov commented Aug 25, 2020

slavapestov commented Aug 25, 2020

slavapestov commented Aug 25, 2020

typesanitizer commented Aug 25, 2020

jckarter commented Aug 25, 2020

slavapestov commented Sep 1, 2020

[SR-13439] Swift is memory unsafe when escaping a fully initialised `self` in a fallible initialiser that returns nil. #55880

[SR-13439] Swift is memory unsafe when escaping a fully initialised `self` in a fallible initialiser that returns nil. #55880