Sema: Fix soundness hole with variable initializers and opaque return types

Just because the type of the initializer expression is an opaque return type,
does not mean it is the opaque return type *for the variable being initialized*.

It looks like there is a bit of duplicated logic and layering violations going
on so I only fixed one caller of openOpaqueType(). This addresses the test case
in the issue. For the remaining calls I added FIXMEs to investigate what is
going on.

Fixes #73245.
Fixes rdar://127180656.

Author: slavapestov

include/swift/AST/Decl.h

@@ -3492,7 +3492,7 @@ class OpaqueTypeDecl final :
   ///
   /// This is more complex than just checking `getNamingDecl` because the
   /// function could also be the getter of a storage declaration.
-  bool isOpaqueReturnTypeOfFunction(const AbstractFunctionDecl *func) const;
+  bool isOpaqueReturnTypeOf(const Decl *owner) const;
 
   /// Get the ordinal of the anonymous opaque parameter of this decl with type
   /// repr `repr`, as introduce implicitly by an occurrence of "some" in return

include/swift/Sema/ConstraintSystem.h

@@ -4223,6 +4223,11 @@ class ConstraintSystem {
   Type openOpaqueType(OpaqueTypeArchetypeType *type,
                       ConstraintLocatorBuilder locator);
 
+  /// Recurse over the given type and open any opaque archetype types.
+  Type openOpaqueType(Type type, ContextualTypePurpose context,
+                      ConstraintLocatorBuilder locator,
+                      Decl *ownerDecl);
+
   /// "Open" a pack expansion type by replacing it with a type variable,
   /// opening its pattern and shape types and connecting them to the
   /// aforementioned variable via special constraints.
@@ -4240,10 +4245,6 @@ class ConstraintSystem {
     ASSERT(erased);
   }
 
-  /// Recurse over the given type and open any opaque archetype types.
-  Type openOpaqueType(Type type, ContextualTypePurpose context,
-                      ConstraintLocatorBuilder locator);
-
   /// "Open" the given function type.
   ///
   /// If the function type is non-generic, this is equivalent to calling

lib/AST/Decl.cpp

@@ -9990,18 +9990,19 @@ OpaqueTypeDecl *OpaqueTypeDecl::get(
       OpaqueReturnTypeReprs);
 }
 
-bool OpaqueTypeDecl::isOpaqueReturnTypeOfFunction(
-                                       const AbstractFunctionDecl *func) const {
-  // Either the function is declared with its own opaque return type...
-  if (getNamingDecl() == func)
+bool OpaqueTypeDecl::isOpaqueReturnTypeOf(const Decl *ownerDecl) const {
+  if (getNamingDecl() == ownerDecl)
     return true;
 
-  // ...or the function is a getter for a property or subscript with an
-  // opaque return type.
-  if (auto accessor = dyn_cast<AccessorDecl>(func)) {
+  if (auto accessor = dyn_cast<AccessorDecl>(ownerDecl)) {
     return accessor->isGetter() && getNamingDecl() == accessor->getStorage();
   }
 
+  if (auto patternBinding = dyn_cast<PatternBindingDecl>(ownerDecl)) {
+    if (auto *varDecl = dyn_cast<VarDecl>(getNamingDecl()))
+      return varDecl->getParentPatternBinding() == patternBinding;
+  }
+
   return false;
 }
 

lib/Sema/BuilderTransform.cpp

@@ -956,7 +956,7 @@ TypeChecker::applyResultBuilderBodyTransform(FuncDecl *func, Type builderType) {
   // result type of this function.
   ConstraintKind resultConstraintKind = ConstraintKind::Conversion;
   if (auto opaque = resultContextType->getAs<OpaqueTypeArchetypeType>()) {
-    if (opaque->getDecl()->isOpaqueReturnTypeOfFunction(func)) {
+    if (opaque->getDecl()->isOpaqueReturnTypeOf(func)) {
       resultConstraintKind = ConstraintKind::Equal;
     }
   }

lib/Sema/CSGen.cpp

@@ -2129,8 +2129,9 @@ namespace {
         // Now that we know we're actually going to use the type, get the
         // version for use in a constraint.
         contextualType = CS.getContextualType(expr, /*forConstraint=*/true);
+        // FIXME: This is the wrong place to be opening the opaque type.
         contextualType = CS.openOpaqueType(
-            contextualType, contextualPurpose, locator);
+            contextualType, contextualPurpose, locator, /*ownerDecl=*/nullptr);
         Type arrayElementType = contextualType->isArrayType();
         CS.addConstraint(ConstraintKind::LiteralConformsTo, contextualType,
                          arrayProto->getDeclaredInterfaceType(),
@@ -2242,8 +2243,10 @@ namespace {
         // Now that we know we're actually going to use the type, get the
         // version for use in a constraint.
         contextualType = CS.getContextualType(expr, /*forConstraint=*/true);
+        // FIXME: This is the wrong place to be opening the opaque type.
         auto openedType =
-            CS.openOpaqueType(contextualType, contextualPurpose, locator);
+            CS.openOpaqueType(contextualType, contextualPurpose, locator,
+                              /*ownerDecl=*/nullptr);
         auto dictionaryKeyValue =
             ConstraintSystem::isDictionaryType(openedType);
         Type contextualDictionaryKeyType;
@@ -2814,7 +2817,8 @@ namespace {
 
         Type replacedType = CS.replaceInferableTypesWithTypeVars(type, locator);
         Type openedType =
-            CS.openOpaqueType(replacedType, CTP_Initialization, locator);
+            CS.openOpaqueType(replacedType, CTP_Initialization, locator,
+                              patternBinding);
         assert(openedType);
 
         auto *subPattern = cast<TypedPattern>(pattern)->getSubPattern();

lib/Sema/CSSimplify.cpp

@@ -15927,7 +15927,9 @@ void ConstraintSystem::addContextualConversionConstraint(
   }
 
   // Add the constraint.
-  auto openedType = openOpaqueType(conversionType, purpose, locator);
+  // FIXME: This is the wrong place to be opening the opaque type.
+  auto openedType = openOpaqueType(conversionType, purpose, locator,
+                                   /*ownerDecl=*/nullptr);
   addConstraint(constraintKind, getType(expr), openedType, locator,
                 /*isFavored*/ true);
 }

lib/Sema/TypeOfReference.cpp

@@ -359,23 +359,31 @@ Type ConstraintSystem::openOpaqueType(OpaqueTypeArchetypeType *opaque,
 }
 
 Type ConstraintSystem::openOpaqueType(Type type, ContextualTypePurpose context,
-                                      ConstraintLocatorBuilder locator) {
+                                      ConstraintLocatorBuilder locator,
+                                      Decl *ownerDecl) {
+  // FIXME: Require non-null ownerDecl and fix remaining callers
+  // ASSERT(ownerDecl);
+
   // Early return if `type` is `NULL` or if there are no opaque archetypes (in
   // which case there is certainly nothing for us to do).
   if (!type || !type->hasOpaqueArchetype())
     return type;
 
-  if (!(context == CTP_Initialization || context == CTP_ReturnStmt))
+  if (context != CTP_Initialization && context != CTP_ReturnStmt)
     return type;
 
   auto shouldOpen = [&](OpaqueTypeArchetypeType *opaqueType) {
-    if (context != CTP_ReturnStmt)
-      return true;
+    if (context == CTP_Initialization) {
+      if (!ownerDecl)
+        return true;
 
-    if (auto *func = dyn_cast<AbstractFunctionDecl>(DC))
-      return opaqueType->getDecl()->isOpaqueReturnTypeOfFunction(func);
+      return opaqueType->getDecl()->isOpaqueReturnTypeOf(ownerDecl);
+    } else {
+      if (auto *func = dyn_cast<AbstractFunctionDecl>(DC))
+        return opaqueType->getDecl()->isOpaqueReturnTypeOf(func);
 
-    return true;
+      return true;
+    }
   };
 
   return type.transformRec([&](Type type) -> std::optional<Type> {

test/type/opaque_return_property.swift

@@ -0,0 +1,25 @@
+// RUN: %target-typecheck-verify-swift
+
+protocol P {
+  associatedtype A
+  func f() -> A
+}
+
+struct S: P {
+  func f() -> some Any { return 123 }
+}
+
+let x1: S.A = "hello world"
+// expected-error@-1 {{cannot convert value of type 'String' to specified type 'S.A' (aka 'some Any')}}
+
+let x2: S.A = { return "hello world" }()
+// expected-error@-1 {{cannot convert value of type 'String' to closure result type 'S.A' (aka 'some Any')}}
+let x3: () -> S.A = { return "hello world" }
+// expected-error@-1 {{cannot convert value of type 'String' to closure result type 'S.A' (aka 'some Any')}}
+
+let x4: some Any = 123
+let x5: some Any = { return 123 }()
+
+// FIXME: This should work
+let x6: () -> some Any = { return 123 }
+// expected-error@-1 {{cannot convert value of type 'Int' to closure result type 'some Any'}}