Skip to content

Conversation

rjmccall
Copy link
Contributor

@rjmccall rjmccall commented Sep 11, 2025

Type metadata can be initialized to varying levels of completeness. Most uses of type metadata in the language require "complete" metadata, which ensures that the type's layout is fully initialized. At the opposite end of the spectrum is "abstract" metadata, which basically just allocates the metadata and then fills in the identity of the type. Using abstract metadata when complete metadata is required can easily lead to memory corruption and crashes. Nonetheless, incomplete metadata is important because it allows self-referential types to be built, like a struct S that contains a (resilient) Producer<S> stored property, or a class C whose superclass is Super<C>.

The code for the builtins behind async let, task groups, and Task.runInline was incorrectly requesting abstract type metadata for the result type of the task, which could lead to crashes in the runtime if the type metadata happened to not already have been completed. Task.runInline is a non-standard operation that doesn't appear to be inlinable, and I couldn't convince the compiler to directly emit the task group builtin in user code; this means that those two bugs have probably skated by because the use in the runtime is always passing a value it received as a generic argument, and type metadata passed as generic arguments are required to already be complete. The async let case is definitely possible in user code, unfortunately.

Because the metadata runtime is generally rather eager about completing type metadata, and because it doesn't matter what level of initialization you request if the metadata is already complete, it can be rather hard to encounter this bug; the most likely scenario is a race between threads to request the metadata for the first time.

Fixes rdar://146155888.
6.2 version of #84242.

Scope: affects IR generation for async let, leading to possible memory corruption and crashes
Risk: low; fix is small and obviously correct
Reviewed by: @ktoso, @mikeash
Testing: new regression tests

@rjmccall rjmccall requested a review from a team as a code owner September 11, 2025 23:32
@rjmccall
Copy link
Contributor Author

@swift-ci Please test

@rjmccall rjmccall merged commit 94fd952 into swiftlang:release/6.2 Sep 12, 2025
5 checks passed
@rjmccall rjmccall deleted the complete-metadata-for-concurrency-builtins-6.2 branch September 12, 2025 14:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants