i’ve gotten this down to a minimal reproducer, which i filed on GitHub.
opened 09:19PM - 30 Nov 23 UTC
bug
crash
triage needed
### Description
the following test program crashes with a segfault when compile… d with a 5.9.1 toolchain.
### Reproduction
```swift
class Class
{
init()
{
}
}
struct ClassList
{
var array:[Class]
init(_ x:consuming Class)
{
self.array = []
defer
{
self.array.append(x)
}
_ = copy x
}
}
func main()
{
let _:ClassList = .init(Class.init())
}
main()
```
```
$ swiftc Snippets/_Crashes/Refcounting.swift
$ ./Refcounting
```
### Stack dump
```text
💣 Program crashed: Bad pointer dereference at 0x00007fd15e861868
Thread 0 "Refcounting" crashed:
0 0x00007fd15e861868
1 0x00007fd15e60429b bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 122 in libswiftCore.so
2 0x00007fd15e5f789b swift_arrayDestroy + 58 in libswiftCore.so
3 0x00007fd15e3a53b7 _ContiguousArrayStorage.__deallocating_deinit + 38 in libswiftCore.so
4 0x00007fd15e6038e0 _swift_release_dealloc + 15 in libswiftCore.so
5 0x00007fd15e60429b bool swift::RefCounts<swift::RefCountBitsT<(swift::RefCountInlinedness)1> >::doDecrementSlow<(swift::PerformDeinit)1>(swift::RefCountBitsT<(swift::RefCountInlinedness)1>, unsigned int) + 122 in libswiftCore.so
6 0x000056073eea4f68 main() + 39 in Refcounting
7 0x000056073eea4d29 main + 8 in Refcounting
Segmentation fault (core dumped)
```
### Expected behavior
the defer statement should correctly increment the ref count of the captured binding.
### Environment
```
$ swift --version
Swift version 5.9.1 (swift-5.9.1-RELEASE)
Target: x86_64-unknown-linux-gnu
```
### Additional information
_No response_
it seems to affect defer statements that capture bindings that use the consuming ownership specifier. because the miscompile affects ref counting, the crashes can occur very far away from where the ref count actually diverged, which made it challenging to isolate the actual cause of the crash.
3 Likes