[SR-13439] Swift is memory unsafe when escaping a fully initialised `self` in a fallible initialiser that returns nil.

[weissi]

Previous ID	SR-13439
Radar	rdar://problem/67746791
Original Reporter	@weissi
Type	Bug
Status	Resolved
Resolution	Done

Attachment: Download

Additional Detail from JIRA

Votes	0
Component/s	Compiler
Labels	Bug, RunTimeCrash
Assignee	@slavapestov
Priority	Medium

md5: bd71160abded35bdcd864e042d815a3a

Issue Description:

Consider this program

import Dispatch

class Foo: CustomStringConvertible {
    var x: Optional<Int>

    init?(_ x: Int) {
        print("Foo init   \(x)")
        if x == 0 {
            return nil
        }
        self.x = x
        if x == 1 {
            DispatchQueue(label: "Foo").async {
                print(self)
            }
            return nil
        }
    }

    var description: String {
        return "I exist!"
    }

    deinit {
        print("Foo deinit \(self.x.debugDescription)")
    }
}

print(Foo(1).debugDescription)
sleep(1)

it prints for me

$ swiftc test.swift && ./test
Foo init   1
nil
Segmentation fault: 11
-SEGV-

in

$ swift -version
Apple Swift version 5.2.4 (swiftlang-1103.0.32.9 clang-1103.0.32.53)
Target: x86_64-apple-darwin19.6.0

[jckarter]

This ought to be safe; returning nil from the initializer after self has been escaped should cause the initializer to return nil, and let the escaped object live its life normally.

[slavapestov]

Here is a reduced test case that crashes on my machine without using Dispatch:

var escaped: Foo? = nil

func escape(_ foo: Foo) {
  escaped = foo
}

class Foo {
    var x: Optional<Int>

    init?(_ x: Int) {
        if x == 0 {
            return nil
        }
        self.x = x
        if x == 1 {
            escape(self)
            return nil
        }
    }
}

_ = Foo(1)
print(escaped)

[slavapestov]

One interesting thing is that if you remove the 'if x == 0' block, the crash goes away.

[slavapestov]

Here is the failure exit block in the constructor:

bb7:                                              // Preds: bb4 bb1
  destroy_value %4 : $Foo                         // id: %42
  %43 = enum $Optional<Foo>, #Optional.none!enumelt // user: %44
  br bb8(%43 : $Optional<Foo>)    

DI lowers this to:

bb7:                                              // Preds: bb6
  %25 = metatype $@thick Foo.Type                 // user: %26
  dealloc_partial_ref %1 : $Foo, %25 : $@thick Foo.Type // id: %26
  %27 = enum $Optional<Foo>, #Optional.none!enumelt // user: %28
  br bb8(%27 : $Optional<Foo>)                    // id: %28

[typesanitizer]

@swift-ci create

[jckarter]

Interesting. It sounds like maybe DI is failing to notice that the `if x == 0` case always exits, and so we still treat the initialization of `x` as conditional.

[slavapestov]

#33743