[SR-9404] KeyPath.appending crashes when appending to an objc variable

[swift-ci]

Previous ID	SR-9404
Radar	rdar://problem/46457346
Original Reporter	benpious (JIRA User)
Type	Bug
Status	Resolved
Resolution	Done

Attachment: Download

Environment

Swift 4.2 or 4.0 in Xcode 10.0.0.10A255

Additional Detail from JIRA

Votes	0
Component/s	Standard Library
Labels	Bug, RunTimeCrash, Runtime
Assignee	@mikeash
Priority	Medium

md5: 8bd28f6fa907ba484f6bdae411fe2915

Issue Description:

The code snippet below crashes if you run it a few times on the iPhone XS simulator. I've also attached a sample project demonstrating the issue.

Changing the name of the var with the ``s in it can cause the crash to occur more or less often. I'm not actually sure if the `` is directly responsible, but since it seems to have a special significance in name mangling, I assume that the objc selector is name-mangled, and the code for `appending` seems to be doing some kind of manipulation of the selector name I'm guessing it's related.

The crash is usually similar to what's reproduced below:

KeyPathTest(97433,0x700004484000) malloc: Heap corruption detected, free list is damaged at 0x60000006eb50
*** Incorrect guard value: 34080200846080
KeyPathTest(97433,0x700004484000) malloc: *** set a breakpoint in malloc_error_break to debug

import UIKit

func test() {
    // In my real app, it usually breaks immediately on the first run,
    // but in the sample app I had to run the code several times before it would crash.
    for _ in 0..<1000 {
        print((\Theme.snek_lll_ll).appending(path: \ColorSplash.camelCaseVar))
        
    }
}

@objc
public protocol Theme: AnyObject {
    
    var snek_lll_ll: ColorSplash { get }
    
}

public class ColorSplash: NSObject {
    
    @objc
    public var camelCaseVar: UIColor {
        return .white
    }
    
}

[belkadan]

@jckarter, @DougGregor?

[jckarter]

The "_" seems like a red herring to me. It might be some faulty pointer manipulation when we concatenate the KVC strings that coincidentally only occurs for certain string lengths or something. All the operation does is paste the KVC strings together with a "." in between.

[mikeash]

PR: #21008

Turns out it was the classic mistake of not accounting for the terminating NUL when allocating space for a C string.

[mikeash]

All good now. Thanks a bunch for the excellent bug report.