Merge pull request #75565 from eeckstein/fix-keypath-folding

Optimizer: fix a crash in keypath folding

Author: eeckstein

lib/SILOptimizer/Utils/KeyPathProjector.cpp

@@ -136,16 +136,7 @@ class StoredPropertyProjector : public ComponentProjector {
         while (Ref->getType().getClassOrBoundGenericClass() !=
                storedProperty->getDeclContext()) {
           SILType superCl = Ref->getType().getSuperclass();
-          if (!superCl) {
-            // This should never happen, because the property should be in the
-            // decl or in a superclass of it. Just handle this to be on the safe
-            // side.
-            callback(SILValue());
-            if (Borrow) {
-              builder.createEndBorrow(loc, Borrow);
-            }
-            return;
-          }
+          ASSERT(superCl && "the property should be in the decl or in a superclass of it");
           Ref = builder.createUpcast(loc, Ref, superCl);
         }
 
@@ -701,15 +692,28 @@ KeyPathProjector::create(SILValue keyPath, SILValue root,
   // Check if the keypath only contains patterns which we support.
   auto components = kpInst->getPattern()->getComponents();
   for (const KeyPathPatternComponent &comp : components) {
-    if (comp.getKind() == KeyPathPatternComponent::Kind::GettableProperty ||
-        comp.getKind() == KeyPathPatternComponent::Kind::SettableProperty) {
-      if (!comp.getExternalSubstitutions().empty() ||
-          !comp.getSubscriptIndices().empty()) {
-        // TODO: right now we can't optimize computed properties that require
-        // additional context for subscript indices or generic environment
-        // See https://github.com/apple/swift/pull/28799#issuecomment-570299845
-        return nullptr;
+    switch (comp.getKind()) {
+      case KeyPathPatternComponent::Kind::GettableProperty:
+      case KeyPathPatternComponent::Kind::SettableProperty:
+        if (!comp.getExternalSubstitutions().empty() ||
+            !comp.getSubscriptIndices().empty()) {
+          // TODO: right now we can't optimize computed properties that require
+          // additional context for subscript indices or generic environment
+          // See https://github.com/apple/swift/pull/28799#issuecomment-570299845
+          return nullptr;
+        }
+        break;
+      case KeyPathPatternComponent::Kind::StoredProperty: {
+        auto *declCtxt = comp.getStoredPropertyDecl()->getDeclContext();
+        if (!isa<StructDecl>(declCtxt) && !isa<ClassDecl>(declCtxt)) {
+          // This can happen, e.g. for ObjectiveC class properties, which are
+          // defined in an extension.
+          return nullptr;
+        }
+        break;
       }
+      default:
+        break;
     }
   }
 

test/SILOptimizer/keypath-folding-crash.sil

@@ -0,0 +1,54 @@
+// RUN: %empty-directory(%t)
+// RUN: split-file %s %t
+// RUN: %target-sil-opt -I %t %t/test.sil -sil-combine | %FileCheck %s
+
+// REQUIRES: objc_interop
+
+//--- module.modulemap
+
+module CModule {
+  header "c-header.h"
+  export *
+}
+
+
+//--- c-header.h
+
+@import Foundation;
+
+@interface ObjClass : NSObject
+@property (nonatomic, strong, readwrite, nonnull) NSObject *o;
+@end
+
+
+//--- test.sil
+
+sil_stage canonical
+
+import Swift
+import SwiftShims
+import Builtin
+import CModule
+
+extension ObjClass {
+  @objc @_hasStorage dynamic var o: NSObject { get set }
+}
+
+sil @swift_getAtKeyPath : $@convention(thin) <τ_0_0, τ_0_1> (@in_guaranteed τ_0_0, @guaranteed KeyPath<τ_0_0, τ_0_1>) -> @out τ_0_1
+
+// Check that we don't crash
+
+// CHECK-LABEL: sil @testObjcKeypath :
+// CHECK:         keypath
+// CHECK:         apply
+// CHECK:       } // end sil function 'testObjcKeypath'
+sil @testObjcKeypath : $@convention(thin) (@in_guaranteed ObjClass) -> @out NSObject {
+bb0(%0 : $*NSObject, %1 : $*ObjClass):
+  %2 = keypath $KeyPath<ObjClass, NSObject>, (root $ObjClass; stored_property #ObjClass.o : $NSObject)
+  %3 = function_ref @swift_getAtKeyPath : $@convention(thin) <τ_0_0, τ_0_1> (@in_guaranteed τ_0_0, @guaranteed KeyPath<τ_0_0, τ_0_1>) -> @out τ_0_1
+  %4 = apply %3<ObjClass, NSObject>(%0, %1, %2) : $@convention(thin) <τ_0_0, τ_0_1> (@in_guaranteed τ_0_0, @guaranteed KeyPath<τ_0_0, τ_0_1>) -> @out τ_0_1
+  strong_release %2 : $KeyPath<ObjClass, NSObject>
+  %6 = tuple ()
+  return %6 : $()
+}
+