[SR-9350] String. _copyUTF16CodeUnits crashes when a surrogate pair is cut in half

[lorentey]

Previous ID	SR-9350
Radar	rdar://problem/52193392
Original Reporter	@lorentey
Type	Bug
Status	Resolved
Resolution	Done

Environment

master as of 2018-11-26

Additional Detail from JIRA

Votes	0
Component/s	Standard Library
Labels	Bug
Assignee	None
Priority	Medium

md5: d9b8314535066e6041766d7ac82d5177

Issue Description:

Try this:

let mixedBase = "\u{1F44E}" // THUMBS DOWN

let c = mixedBase.utf16.count
var buffer = Array<UInt16>(repeating: 0, count: c)

@inline(never)
func ignore<T>(_ value: T) {
}

print(c)
for i in 0 ..< c {
    for j in i ..< c {
        let range = i ..< j
        buffer.withUnsafeMutableBufferPointer { b in
            let slice = b[range]
            let b2 = UnsafeMutableBufferPointer(rebasing: slice)
            print(range, b2, range.count, b2.count)
            ignore(mixedBase._copyUTF16CodeUnits(
                    into: b2,
                    range: range))
        }
    }
}

Output:

2
0..<0 UnsafeMutableBufferPointer(start: 0x00007fe809c0bbb0, count: 0) 0 0
0..<1 UnsafeMutableBufferPointer(start: 0x00007fe809c0bbb0, count: 1) 1 1
1..<1 UnsafeMutableBufferPointer(start: 0x00007fe809c0bbb2, count: 0) 0 0
Fatal error: file /Users/lorentey/Swift/build/Ninja-RelWithDebInfoAssert/swift-macosx-x86_64/stdlib/public/core/8/UnsafeBufferPointer.swift, line 228
Current stack trace:
0    libswiftCore.dylib                 0x00000001085c4f30 _swift_stdlib_reportFatalErrorInFile + 116
1    libswiftCore.dylib                 0x00000001084ea930 specialized closure #&#8203;1 in closure #&#8203;1 in closure #&#8203;1 in _fatalErrorMessage(_:_:file:line:flags:) + 306
2    libswiftCore.dylib                 0x0000000108496ee0 specialized closure #&#8203;1 in closure #&#8203;1 in _fatalErrorMessage(_:_:file:line:flags:) + 113
3    libswiftCore.dylib                 0x00000001084972a0 specialized closure #&#8203;1 in _fatalErrorMessage(_:_:file:line:flags:) + 99
4    libswiftCore.dylib                 0x0000000108497640 specialized _fatalErrorMessage(_:_:file:line:flags:) + 555
5    libswiftCore.dylib                 0x0000000108329bc0 specialized UnsafeMutableBufferPointer.subscript.modify + 208
6    libswiftCore.dylib                 0x000000010851de20 specialized String._nativeCopyUTF16CodeUnits(into:range:) + 1036
7    libswiftCore.dylib                 0x00000001084414b0 String._copyUTF16CodeUnits(into:range:) + 76
8    test                               0x000000010825c740 closure #&#8203;1 in  + 542
9    test                               0x000000010825c9b0 partial apply for closure #&#8203;1 in  + 17
10   test                               0x000000010825c9d0 thunk for @callee_guaranteed (@inout UnsafeMutableBufferPointer<UInt16>) -> (@error @owned Error) + 22
11   test                               0x000000010825ca60 partial apply for thunk for @callee_guaranteed (@inout UnsafeMutableBufferPointer<UInt16>) -> (@error @owned Error) + 27
12   libswiftCore.dylib                 0x0000000108289f60 Array.withUnsafeMutableBufferPointer<A>(_:) + 427
13   test                               0x000000010825bfe0 main + 1648
14   libdyld.dylib                      0x00007fff63e293f0 start + 1
Illegal instruction: 4

[lorentey]

Cc @milseman

[lorentey]

@swift-ci create

[milseman]

This should be tested in https://github.com/apple/swift/blob/master/validation-test/stdlib/StringBreadcrumbs.swift#L39. I wonder what's different here.

edit: Ah, `i` and `j` are never equal, meaning we never have empty ranges. Let me see

[milseman]

#20768