[SR-10264] EXC_BAD_ACCESS when assigning to a field in a testable class with a key-path

[swift-ci]

Previous ID	SR-10264
Radar	rdar://problem/50255258
Original Reporter	Pakaste (JIRA User)
Type	Bug

Environment

• Xcode 10.2 (10E125)

• Apple Swift version 5.0 (swiftlang-1001.0.69.5 clang-1001.0.46.3)

• macOS 10.14.4 (18E226)

• iOS simulator with iOS 12.2 (16E226)

Additional Detail from JIRA

Votes	2
Component/s	Compiler
Labels	Bug, 5.0Regression, KeyPaths, RunTimeCrash
Assignee	Pakaste (JIRA)
Priority	Medium

md5: fcc8044a8caab7fcf236a31574835eff

is duplicated by:

• SR-10306 Runtime Error while using key paths with internal attributes exposed via @testable import

Issue Description:

I have the following in an iOS framework target called KeyPathCrash:

class Foo {
    var title: String = ""
}

And the following file in the test target:

import XCTest
@testable import KeyPathCrash


class KeyPathCrashTests: XCTestCase {
    func test() {
        let f = Foo()
        f[keyPath: \.title] = "bar"
    }
}

The test crashes with "Thread 1: EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff8)". If I have the key-path assignment inside the framework target, it works fine.

This is a new problem with Xcode 10.2/Swift 5. It worked with Xcode 10.1/Swift 4.2.

[belkadan]

@jckarter, I think you had one of these already, right?

[jckarter]

The other cases I'm aware of involved protocol extensions, but this only involves a class. It may be different.

[swift-ci]

Comment by Felix Scheinost (JIRA)

I also have this exact same crash but instead of Foo being a class it is a struct and the property has an empty didSet.

It doesn't crash if I remove the didSet.

struct Foo {
  var test: Int {
    didSet {
    }
  }
}

final class CrashTest: XCTestCase {
  func testCrash() {
    var b1 = Foo(test: 0)
    b1.test = 1
    b1[keyPath: \.test] = 2
  }
}

I'm on Xcode 10.2.1 (10E1001)

[jckarter]

I wasn't able to reproduce this in the master branch. Would you be able to try a recent snapshot from https://swift.org/download/ and see whether you still have the problem?

[swift-ci]

Comment by Juri Pakaste (JIRA)

I tested this with Xcode 10.2.1 (10E1001), using the built-in toolchain, Swift 5.1 Snapshot 2019-05-09 (a) and Swift Development Snapshot 2019-05-20 (a), and still got crashes using all the toolchains. The backtraces using the snapshot toolchains were slightly different from the release one, but maybe that's just an artifact of having debug info included or something?

Here's the most relevant frames from the backtrace with the Swift Development Snapshot 2019-05-20 (a):

* thread #​1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff8)
    frame #&#8203;0: 0x000000011a189e48 libswiftCore.dylib`__swift_allocate_boxed_opaque_existential_0 at <compiler-generated>:0 [opt]
  * frame #&#8203;1: 0x0000000119fe9f5d libswiftCore.dylib`ReferenceWritableKeyPath._projectMutableAddress(from:) at KeyPath.swift:363:23 [opt]
    frame #&#8203;2: 0x0000000119fe9f2f libswiftCore.dylib`ReferenceWritableKeyPath._projectMutableAddress(from:) [inlined] reabstraction thunk helper <A, B> from @callee_guaranteed (@unowned Swift.KeyPathBuffer) -> (@unowned Swift.UnsafeMutablePointer<B>, @error @owned Swift.Error) to @escaping @callee_guaranteed (@unowned Swift.KeyPathBuffer) -> (@out Swift.UnsafeMutablePointer<B>, @error @owned Swift.Error) at <compiler-generated>:0 [opt]
    frame #&#8203;3: 0x0000000119fe9f2f libswiftCore.dylib`ReferenceWritableKeyPath._projectMutableAddress(from:) at KeyPath.swift:162 [opt]
    frame #&#8203;4: 0x0000000119fe9eee libswiftCore.dylib`ReferenceWritableKeyPath._projectMutableAddress(origBase=0x00007ff04e9f52b0 -> 0x0000000119f121a0 type metadata for KeyPathCrash.Foo, self=<unavailable>) at KeyPath.swift:360 [opt]
    frame #&#8203;5: 0x0000000119feb269 libswiftCore.dylib`swift_setAtReferenceWritableKeyPath(root=<unavailable>, keyPath=<unavailable>, value=0x0000000000726162) at KeyPath.swift:1823:31 [opt]
    frame #&#8203;6: 0x0000000119f065be KeyPathCrashTests`KeyPathCrashTests.test(self=0x00007ff04c6003d0) at KeyPathCrashTests.swift:15:29
    frame #&#8203;7: 0x0000000119f06794 KeyPathCrashTests`@objc KeyPathCrashTests.test() at <compiler-generated>:0
    frame #&#8203;8: 0x00000001028ff4cc CoreFoundation`__invoking___ + 140
    frame #&#8203;9: 0x00000001028fca45 CoreFoundation`-[NSInvocation invoke] + 325

[jckarter]

Thanks for following up! I gave the master snapshot from 05-20 a try in Xcode, and I couldn't reproduce. (I verified that it does repro in stock Xcode 10.2 and with the 5.1 05-09 snapshot.) So either this was fixed recently, or the fix is not in the 5.1 branch. Let me try building a more recent 5.1 compiler to see whether I can repro.

[jckarter]

A compiler I just built off of the tip of the 5.1 branch also didn't crash.

[jckarter]

Adding a regression test:

#24994
#24995