[SR-10463] Crash in swift_getAssociatedTypeWitnessSlowImpl

[swift-ci]

Previous ID	SR-10463
Radar	None
Original Reporter	joplunien (JIRA User)
Type	Bug
Status	Closed
Resolution	Done

Environment

• Xcode 10.2 (Build version 10E125)

• macOS 10.14.4 (18E226)

• Simulator: iPhone 5s, 12.1

• Apple Swift version 5.0 (swiftlang-1001.0.69.5 clang-1001.0.46.3)

• Target: x86_64-apple-darwin18.5.0

Additional Detail from JIRA

Votes	0
Component/s	Compiler
Labels	Bug, 5.0Regression, RunTimeCrash
Assignee	@mikeash
Priority	Medium

md5: 8c1fdadfcc710ecee2c77cc83a4c0016

Issue Description:

Description

When updating to Xcode 10.2 we have noticed a new crash at runtime. I was able to reduce it to a minimal example. The same example project works just fine in Xcode 10.1.

The full example project can be found here: https://github.com/plu/SR-10463

Code

import GoogleMobileAds
import UIKit

extension DFPBannerView: SomeProtocol {
    typealias Request = GADRequest
}

protocol SomeProtocol: class {
    associatedtype Request
    func load(_ request: Request?)
}

class SomeImplementation<T: SomeProtocol> {
    static func crash(request: T.Request) {}
}

@UIApplicationMain
class AppDelegate: UIResponder, UIApplicationDelegate {

    let window = UIWindow(frame: UIScreen.main.bounds)

    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
        window.rootViewController = UIViewController()
        window.makeKeyAndVisible()
        SomeImplementation<DFPBannerView>.crash(request: DFPRequest())
        return true
    }

}

Crash

(lldb) bt
* thread #​1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
    frame #&#8203;0: 0x0000000114738b88 libswiftCore.dylib`swift_getAssociatedTypeWitnessSlowImpl(swift::MetadataRequest, swift::TargetWitnessTable<swift::InProcess>*, swift::TargetMetadata<swift::InProcess> const*, swift::TargetProtocolRequirement<swift::InProcess> const*, swift::TargetProtocolRequirement<swift::InProcess> const*) + 200
    frame #&#8203;1: 0x0000000114737128 libswiftCore.dylib`swift_getAssociatedTypeWitness + 152
    frame #&#8203;2: 0x000000010dc7986a Crash`static SomeImplementation.crash(request=<unavailable>, self=Crash.SomeImplementation<τ_0_0>) at <compiler-generated>:0
  * frame #&#8203;3: 0x000000010dc79c55 Crash`AppDelegate.application(application=0x00007fafd0e01550, launchOptions=nil, self=0x00006000031befa0) at AppDelegate.swift:33:43
    frame #&#8203;4: 0x000000010dc79f14 Crash`@objc AppDelegate.application(_:didFinishLaunchingWithOptions:) at <compiler-generated>:0
    frame #&#8203;5: 0x000000011ccbabde UIKitCore`-[UIApplication _handleDelegateCallbacksWithOptions:isSuspended:restoreState:] + 280
    frame #&#8203;6: 0x000000011ccbc5cb UIKitCore`-[UIApplication _callInitializationDelegatesForMainScene:transitionContext:] + 3979
    frame #&#8203;7: 0x000000011ccc1c2f UIKitCore`-[UIApplication _runWithMainScene:transitionContext:completion:] + 1623
    frame #&#8203;8: 0x000000011c4e04e9 UIKitCore`__111-[__UICanvasLifecycleMonitor_Compatability _scheduleFirstCommitForScene:transition:firstActivation:completion:]_block_invoke + 866
    frame #&#8203;9: 0x000000011c4e929c UIKitCore`+[_UICanvas _enqueuePostSettingUpdateTransactionBlock:] + 153
    frame #&#8203;10: 0x000000011c4e0126 UIKitCore`-[__UICanvasLifecycleMonitor_Compatability _scheduleFirstCommitForScene:transition:firstActivation:completion:] + 233
    frame #&#8203;11: 0x000000011c4e0ae0 UIKitCore`-[__UICanvasLifecycleMonitor_Compatability activateEventsOnly:withContext:completion:] + 1085
    frame #&#8203;12: 0x000000011c4decb5 UIKitCore`__82-[_UIApplicationCanvas _transitionLifecycleStateWithTransitionContext:completion:]_block_invoke + 795
    frame #&#8203;13: 0x000000011c4de95f UIKitCore`-[_UIApplicationCanvas _transitionLifecycleStateWithTransitionContext:completion:] + 435
    frame #&#8203;14: 0x000000011c4e3a90 UIKitCore`__125-[_UICanvasLifecycleSettingsDiffAction performActionsForCanvas:withUpdatedScene:settingsDiff:fromSettings:transitionContext:]_block_invoke + 584
    frame #&#8203;15: 0x000000011c4e480e UIKitCore`_performActionsWithDelayForTransitionContext + 100
    frame #&#8203;16: 0x000000011c4e37ef UIKitCore`-[_UICanvasLifecycleSettingsDiffAction performActionsForCanvas:withUpdatedScene:settingsDiff:fromSettings:transitionContext:] + 221
    frame #&#8203;17: 0x000000011c4e893a UIKitCore`-[_UICanvas scene:didUpdateWithDiff:transitionContext:completion:] + 392
    frame #&#8203;18: 0x000000011ccc044e UIKitCore`-[UIApplication workspace:didCreateScene:withTransitionContext:completion:] + 515
    frame #&#8203;19: 0x000000011c864d09 UIKitCore`-[UIApplicationSceneClientAgent scene:didInitializeWithEvent:completion:] + 357
    frame #&#8203;20: 0x000000011b66e2da FrontBoardServices`-[FBSSceneImpl _didCreateWithTransitionContext:completion:] + 448
    frame #&#8203;21: 0x000000011b679443 FrontBoardServices`__56-[FBSWorkspace client:handleCreateScene:withCompletion:]_block_invoke_2 + 271
    frame #&#8203;22: 0x000000011b678b3a FrontBoardServices`__40-[FBSWorkspace _performDelegateCallOut:]_block_invoke + 53
    frame #&#8203;23: 0x0000000114fc1602 libdispatch.dylib`_dispatch_client_callout + 8
    frame #&#8203;24: 0x0000000114fc4b78 libdispatch.dylib`_dispatch_block_invoke_direct + 301
    frame #&#8203;25: 0x000000011b6adba8 FrontBoardServices`__FBSSERIALQUEUE_IS_CALLING_OUT_TO_A_BLOCK__ + 30
    frame #&#8203;26: 0x000000011b6ad860 FrontBoardServices`-[FBSSerialQueue _performNext] + 457
    frame #&#8203;27: 0x000000011b6ade40 FrontBoardServices`-[FBSSerialQueue _performNextFromRunLoopSource] + 45
    frame #&#8203;28: 0x0000000113f7d721 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
    frame #&#8203;29: 0x0000000113f7cf93 CoreFoundation`__CFRunLoopDoSources0 + 243
    frame #&#8203;30: 0x0000000113f7763f CoreFoundation`__CFRunLoopRun + 1263
    frame #&#8203;31: 0x0000000113f76e11 CoreFoundation`CFRunLoopRunSpecific + 625
    frame #&#8203;32: 0x0000000116c061dd GraphicsServices`GSEventRunModal + 62
    frame #&#8203;33: 0x000000011ccc381d UIKitCore`UIApplicationMain + 140
    frame #&#8203;34: 0x000000010dc7a31b Crash`main at AppDelegate.swift:26:7
    frame #&#8203;35: 0x0000000115037575 libdyld.dylib`start + 1 

[mikeash]

It turns out that this is because DFPBannerView is playing some fun games by overriding +class to return other classes. Those other classes make their way into Swift by way of a call to the +class method in swift_getInitializedObjCClass:

https://github.com/apple/swift/blob/master/stdlib/public/runtime/SwiftObject.mm#L1273

That code should probably not use the return value of the method. I'm still thinking about the proper solution but it'll be something like that.

[mikeash]

I have PRs up for this fix now:

master: #24618
5.1: #24637

[swift-ci]

Comment by Johannes Plunien (JIRA)

That's great news, thank you for fixing that issue so quickly Mike!

[AnnaZaks]

joplunien (JIRA User), Could you verify if the problem is fixed and if so move the JIRA to "Closed"?

Thanks!
Anna

[swift-ci]

Comment by Prashant Rane (JIRA)

I was getting similar crash on Xcode10.2.1 so I updated to `XCode 10.3 (10G8)` and `Apple Swift version 5.0.1 (swiftlang-1001.0.82.4 clang-1001.0.46.5)`. But still getting the same crash, here is top trace

# OS Version: 12.3.1 (16F203)
# Device: iPhone 7
# RAM Free: 4.4%
# Disk Free: 23.7%

#​0. Crashed: com.apple.main-thread
0 libswiftCore.dylib 0x1e3fa7c64 swift_getAssociatedTypeWitnessSlowImpl(swift::MetadataRequest, swift::TargetWitnessTable<swift::InProcess>*, swift::TargetMetadata<swift::InProcess> const*, swift::TargetProtocolRequirement<swift::InProcess> const*, swift::TargetProtocolRequirement<swift::InProcess> const*) + 212
1 libswiftCore.dylib 0x1e3fa7c64 swift_getAssociatedTypeWitnessSlowImpl(swift::MetadataRequest, swift::TargetWitnessTable<swift::InProcess>*, swift::TargetMetadata<swift::InProcess> const*, swift::TargetProtocolRequirement<swift::InProcess> const*, swift::TargetProtocolRequirement<swift::InProcess> const*) + 212
2 libswiftCore.dylib 0x1e3fa6340 swift_getAssociatedTypeWitness + 176
3 libswiftCore.dylib 0x1e3e38dbc static _SwiftNewtypeWrapper<>._conditionallyBridgeFromObjectiveC(_:result:) + 76
4 Gojek 0x103461734 protocol witness for static _ObjectiveCBridgeable._conditionallyBridgeFromObjectiveC(_:result:) in conformance UIActivityType (<compiler-generated>)
5 libswiftCore.dylib 0x1e3f924a4 _bridgeNonVerbatimFromObjectiveCConditional<A>(_:_:_:) + 236
6 libswiftCore.dylib 0x1e3d3e968 _conditionallyBridgeFromObjectiveC<A>(_:_:) + 268
7 libswiftCore.dylib 0x1e3d92b68 _SwiftDeferredNSDictionary.object(forKey:) + 196
8 libswiftCore.dylib 0x1e3e64c30 @objc _SwiftDeferredNSDictionary.object(forKey:) + 44
9 UIFoundation 0x1c02f88b4 _NSReadAttributedStringFromURLOrData + 100
10 UIFoundation 0x1c02adb38 -[NSAttributedString(NSAttributedStringUIFoundationAdditions) initWithData:options:documentAttributes:error:] + 136

[swift-ci]

Comment by Prashant Rane (JIRA)

11 XYZApp 0x101cb4704 specialized @nonobjc NSMutableAttributedString.init(data:options:documentAttributes:) + 260
12 XYZApp 0x101cb3124 String.convertHTML() + 772

[swift-ci]

Comment by Prashant Rane (JIRA)

my bad 🙁 I had to update to Swift 5.1, I would revert back on this