[SR-10441] Demangler crash: Assertion failed: (false && "cannot add child")

[theblixguy]

Previous ID	SR-10441
Radar	None
Original Reporter	@theblixguy
Type	Bug

Environment

Swift 5.1 (near master), macOS 10.14.4

Additional Detail from JIRA

Votes	0
Component/s	Compiler
Labels	Bug, CompilerCrash
Assignee	None
Priority	Medium

md5: fe28a105cf1569245add499d28117e10

Issue Description:

This code causes a crash in the demangler:

protocol Foo {
  associatedtype ErrorType: Error
}

extension Array: Error where Element: Error {}

class Bar<A: Foo> {
  func doSomething(with result: Result<Any, [A.ErrorType]>) {}
}

Assertion failed: (false && "cannot add child"), function addChild, file /Users/suyashsrijan/Documents/swift-src/swift/lib/Demangling/Demangler.cpp, line 355

Removing the where clause on the Array extension fixes the crash. The following code also leads to a crash, however it happens in the ASTMangler when calling `swift::Mangle::ASTMangler::getSpecialManglingContext()`:

extension Array: Error where Element: Error {}

class Bar {
  func doSomething(with result: Result<Any, [Error]>) {}
}

Assertion failed: (is<T>() && "Invalid accessor called"), function get, file /Users/suyashsrijan/Documents/swift-src/llvm/include/llvm/ADT/PointerUnion.h, line 136.

I think this has to do with passing an Array<Error> to the Result type and adding the constrained extension on Array.

[theblixguy]

cc @slavapestov do you know why this is happening?

[theblixguy]

I dumped the Child and it's

kind=Type
  kind=Protocol
    kind=Module, text="test_file"
    kind=Identifier, text="Foo"

The `PayloadKind` happens to be `Index` here, so it hits the default case of the switch and hits the assertion. Without assertions, this crashes in SIL.

[theblixguy]

I wonder if the index has something to do with the generic parameter(s) on Bar...

[slavapestov]

@DougGregor might have some ideas

[theblixguy]

Thanks I'll wait for @DougGregor to respond. In the meantime, here's something I noticed - I extracted the mangled name in both scenarios and when I pass it to swift-demangle, it demangles just fine. However, when you expand the mangling for the case where the Array's element is constrained to Error, there's some extra nodes inside AnyProtocolConformanceList:

kind=DependentProtocolConformanceRoot, index=1
                              kind=DependentProtocolConformanceRoot, index=1
                                kind=Type
                                  kind=Protocol
                                    kind=Module, text="test_file"
                                    kind=Identifier, text="Foo"
                                kind=Type
                                  kind=DependentGenericParamType, text="A"
                                    kind=Index, index=0
                                    kind=Index, index=0
                              kind=DependentAssociatedConformance
                                kind=Type
                                  kind=DependentMemberType
                                    kind=Type
                                      kind=DependentGenericParamType, text="A"
                                        kind=Index, index=0
                                        kind=Index, index=0
                                    kind=DependentAssociatedTypeRef, text="ErrorType"
                                kind=Type
                                  kind=Protocol
                                    kind=Module, text="Swift"
                                    kind=Identifier, text="Error"

Mangling for doSomething() when the Element is constrained to Error using the where clause:

s9test_file3BarC11doSomething4withys6ResultOyypSay9ErrorTypeQzGAJs0H0AAxAA3FooHD1_AIsAKHA1__HCg_G_tF

Mangling for doSomething() when the Element not is constrained to Error using the where clause:

s9test_file3BarC11doSomething4withys6ResultOyypSay9ErrorTypeQzGAJs0H0AAyHCg_G_tF

Not quite sure why this is failing to demangle, but I'll wait for Doug to provide any ideas so I can fix this bug!