[SR-12081] Runtime error on iOS 13.x: EXC_BAD_ACCESS when type metadata accessor for XXX

[swift-ci]

Previous ID	SR-12081
Radar	rdar://problem/58997187
Original Reporter	marty-suzuki (JIRA User)
Type	Bug

Attachment: Download

Additional Detail from JIRA

Votes	1
Component/s	Compiler
Labels	Bug, RunTimeCrash
Assignee	None
Priority	Medium

md5: eae3b6d5f569d9b12c12f66e5069e77d

Issue Description:

A runtime error happens on greater than iOS 13.x.

protocol Generatable {
    associatedtype Object
    static func generate() -> Object
}

class Base<T: Generatable> {
    let object = T.generate()
}

final class Object1: Base<Object1>, Generatable {
    static func generate() -> Int { 1 }
}

...

final class Object1000: Base<Object1000>, Generatable {
    static func generate() -> Int { 1000 }
}

class ViewController: UIViewController {

    override func viewDidLoad() {
        super.viewDidLoad()

        print(Object1().object) // Thread 1: EXC_BAD_ACCESS
    }
}

Running this will cause a Thread 1: EXC_BAD_ACCESS.

type metadata accessor for Object1:
->  0x1009ae758 <+56>: movq   %rax, -0x10(%rbp)

libswiftCore.dylib`swift_getTypeByMangledNameImpl:
->  0x7fff50b5c24f <+47>:  callq  0x7fff50b615d0            ; DemanglerForRuntimeTypeResolution<swift::Demangle::StackAllocatedDemangler<2048ul> >::DemanglerForRuntimeTypeResolution()

It seems to happen, if defining too many subclasses that adopt the protocol inherited by it as the generic argument of superclass.

Reference URLs:

• https://gist.github.com/marty-suzuki/22969715bfa01196f2a47349bf45b4c4

• https://github.com/funzin/VerificationProject

Note:

• It works fine on less than iOS 12.

• It happens even if i built it with Xcode 11.0, 11.2.1 and 11.3.1.

• It happens on both of the iOS simulator and the iOS device.

• If defining not so many subclasses, it works fine even if greater than iOS 13.x.

• If build with Release configuration, it works fine even if greater than iOS 13.x.

[beccadax]

@swift-ci create

[omochi]

I have been reproduced it.
When crash happens, I saw strange stacktrace.

type metadata accessor for Object(N) calls
type metadata accessor for Object(N + 1).

Calling from Object1 through Object724 are chained.
So stacktrace is much deep.
I attached Sceeenshot of Xcode.


[mikeash]

As we resolve one of these metadatas, we do a protocol conformance check which iterates over the conformances, which tries to resolve the next metadata, etc. This is not endless recursion, but it gets deep enough to overflow the stack.