[Reflection] Prevent symbolic reference mangling induced crashes

include/swift/Reflection/TypeRefBuilder.h

@@ -630,7 +630,7 @@ class TypeRefBuilder {
 private:
   std::vector<ReflectionInfo> ReflectionInfos;
 
-  std::string normalizeReflectionName(RemoteRef<char> name);
+  llvm::Optional<std::string> normalizeReflectionName(RemoteRef<char> name);
   bool reflectionNameMatches(RemoteRef<char> reflectionName,
                              StringRef searchName);
 
@@ -654,7 +654,7 @@ class TypeRefBuilder {
   // TypeRefBuilder struct, to isolate its template-ness from the rest of
   // TypeRefBuilder.
   unsigned PointerSize;
-  std::function<Demangle::Node * (RemoteRef<char>)>
+  std::function<Demangle::Node * (RemoteRef<char>, bool)>
     TypeRefDemangler;
   std::function<const TypeRef* (uint64_t, unsigned)>
     OpaqueUnderlyingTypeReader;
@@ -665,10 +665,10 @@ class TypeRefBuilder {
     : TC(*this),
       PointerSize(sizeof(typename Runtime::StoredPointer)),
       TypeRefDemangler(
-      [this, &reader](RemoteRef<char> string) -> Demangle::Node * {
+      [this, &reader](RemoteRef<char> string, bool useOpaqueTypeSymbolicReferences) -> Demangle::Node * {
         return reader.demangle(string,
                                remote::MangledNameKind::Type,
-                               Dem, /*useOpaqueTypeSymbolicReferences*/ true);
+                               Dem, useOpaqueTypeSymbolicReferences);
       }),
       OpaqueUnderlyingTypeReader(
       [&reader](uint64_t descriptorAddr, unsigned ordinal) -> const TypeRef* {
@@ -677,8 +677,9 @@ class TypeRefBuilder {
       })
   {}
 
-  Demangle::Node *demangleTypeRef(RemoteRef<char> string) {
-    return TypeRefDemangler(string);
+  Demangle::Node *demangleTypeRef(RemoteRef<char> string,
+                                  bool useOpaqueTypeSymbolicReferences = true) {
+    return TypeRefDemangler(string, useOpaqueTypeSymbolicReferences);
   }
 
   TypeConverter &getTypeConverter() { return TC; }

stdlib/public/Reflection/TypeRefBuilder.cpp

@@ -84,13 +84,22 @@ RemoteRef<char> TypeRefBuilder::readTypeRef(uint64_t remoteAddr) {
 }
 
 /// Load and normalize a mangled name so it can be matched with string equality.
-std::string
+llvm::Optional<std::string>
 TypeRefBuilder::normalizeReflectionName(RemoteRef<char> reflectionName) {
   // Remangle the reflection name to resolve symbolic references.
-  if (auto node = demangleTypeRef(reflectionName)) {
-    auto result = mangleNode(node);
-    clearNodeFactory();
-    return result;
+  if (auto node = demangleTypeRef(reflectionName,
+                                  /*useOpaqueTypeSymbolicReferences*/ false)) {
+    switch (node->getKind()) {
+    case Node::Kind::TypeSymbolicReference:
+    case Node::Kind::ProtocolSymbolicReference:
+    case Node::Kind::OpaqueTypeDescriptorSymbolicReference:
+      // Symbolic references cannot be mangled, return a failure.
+      return {};
+    default:
+      auto result = mangleNode(node);
+      clearNodeFactory();
+      return result;
+    }
   }
 
   // Fall back to the raw string.
@@ -102,7 +111,9 @@ bool
 TypeRefBuilder::reflectionNameMatches(RemoteRef<char> reflectionName,
                                       StringRef searchName) {
   auto normalized = normalizeReflectionName(reflectionName);
-  return searchName.equals(normalized);
+  if (!normalized)
+    return false;
+  return searchName.equals(*normalized);
 }
 
 const TypeRef * TypeRefBuilder::
@@ -194,8 +205,8 @@ TypeRefBuilder::getFieldTypeInfo(const TypeRef *TR) {
       if (!FD->hasMangledTypeName())
         continue;
       auto CandidateMangledName = readTypeRef(FD, FD->MangledTypeName);
-      auto NormalizedName = normalizeReflectionName(CandidateMangledName);
-      FieldTypeInfoCache[NormalizedName] = FD;
+      if (auto NormalizedName = normalizeReflectionName(CandidateMangledName))
+        FieldTypeInfoCache[*NormalizedName] = FD;
     }
   }