Fix use-after-free on substituting function type involving conditional ~Escapable with Escapable type

Author: meg-gupta

include/swift/AST/TypeTransform.h

@@ -357,8 +357,9 @@ case TypeKind::Id:
               return transInterfaceParams[targetIndex].getInterfaceType();
             }
           });
-        if (didRemoveLifetimeDependencies) {
-          extInfo = extInfo.withLifetimeDependencies(substDependenceInfos);
+        if (didRemoveLifetimeDependencies && !substDependenceInfos.empty()) {
+          extInfo = extInfo.withLifetimeDependencies(
+              ctx.AllocateCopy(substDependenceInfos));
         }
       }
 
@@ -938,8 +939,9 @@ case TypeKind::Id:
             return params[targetIndex].getParameterType();
           });
 
-        if (didRemoveLifetimeDependencies) {
-          extInfo = extInfo->withLifetimeDependencies(substDependenceInfos);
+        if (didRemoveLifetimeDependencies && !substDependenceInfos.empty()) {
+          extInfo = extInfo->withLifetimeDependencies(
+              ctx.AllocateCopy(substDependenceInfos));
         }
       }
 

test/Serialization/Inputs/ne_types.swift

@@ -0,0 +1,98 @@
+@_addressableForDependencies
+public struct Something {
+  public struct View<T: BitwiseCopyable> : ~Copyable, ~Escapable {
+    var ptr: UnsafeBufferPointer<T>
+    
+    @lifetime(borrow ptr)
+    public init(ptr: borrowing UnsafeBufferPointer<T>) {
+      self.ptr = copy ptr
+    }
+    
+    public var span: Span<T> {
+      @lifetime(borrow self)
+      borrowing get {
+        Span(_unsafeElements: ptr)
+      }
+    }
+  }
+  
+  public struct MutableView<T: BitwiseCopyable> : ~Copyable, ~Escapable {
+    var ptr: UnsafeMutableBufferPointer<T>
+    
+    @lifetime(borrow ptr)
+    public init(ptr: borrowing UnsafeMutableBufferPointer<T>) {
+      self.ptr = copy ptr
+    }
+    
+    public var mutableSpan: MutableSpan<T> {
+      @lifetime(&self)
+      mutating get {
+        MutableSpan(_unsafeElements: ptr)
+      }
+    }
+  }
+  
+  var ptr: UnsafeMutableRawBufferPointer
+  public init(ptr: UnsafeMutableRawBufferPointer) {
+    self.ptr = ptr
+  }
+  
+  @lifetime(borrow self)
+  public func view<T>(of type: T.Type = T.self) -> View<T> {
+    let tp = ptr.assumingMemoryBound(to: T.self)
+    return __overrideLifetime(View(ptr: .init(tp)), borrowing: self)
+  }
+  
+  @lifetime(&self)
+  public mutating func mutableView<T>(of type: T.Type = T.self) -> MutableView<T> {
+    let tp = ptr.assumingMemoryBound(to: T.self)
+    return __overrideLifetime(MutableView(ptr: tp), mutating: &self)
+  }
+}
+
+@unsafe
+@_unsafeNonescapableResult
+@_alwaysEmitIntoClient
+@_transparent
+@lifetime(borrow source)
+public func __overrideLifetime<
+  T: ~Copyable & ~Escapable, U: ~Copyable & ~Escapable
+>(
+  _ dependent: consuming T, borrowing source: borrowing U
+) -> T {
+  dependent
+}
+
+/// Unsafely discard any lifetime dependency on the `dependent` argument. Return
+/// a value identical to `dependent` that inherits all lifetime dependencies from
+/// the `source` argument.
+@unsafe
+@_unsafeNonescapableResult
+@_alwaysEmitIntoClient
+@_transparent
+@lifetime(copy source)
+public func __overrideLifetime<
+  T: ~Copyable & ~Escapable, U: ~Copyable & ~Escapable
+>(
+  _ dependent: consuming T, copying source: borrowing U
+) -> T {
+  dependent
+}
+
+/// Unsafely discard any lifetime dependency on the `dependent` argument.
+/// Return a value identical to `dependent` with a lifetime dependency
+/// on the caller's exclusive borrow scope of the `source` argument.
+@unsafe
+@_unsafeNonescapableResult
+@_alwaysEmitIntoClient
+@_transparent
+@lifetime(&source)
+public func __overrideLifetime<
+  T: ~Copyable & ~Escapable, U: ~Copyable & ~Escapable
+>(
+  _ dependent: consuming T,
+  mutating source: inout U
+) -> T {
+  dependent
+}
+

test/Serialization/non_escapable_subst_test.swift

@@ -0,0 +1,26 @@
+// RUN: %empty-directory(%t)
+// RUN: %target-swift-frontend -emit-module -o %t  %S/Inputs/ne_types.swift \
+// RUN: -enable-experimental-feature LifetimeDependence \
+// RUN: -enable-experimental-feature AddressableTypes \
+// RUN: -enable-library-evolution \
+// RUN: -emit-module-path %t/ne_types.swiftmodule 
+
+// RUN: %target-swift-frontend -emit-silgen -I %t %s \
+// RUN: -enable-experimental-feature LifetimeDependence
+
+// REQUIRES: swift_feature_LifetimeDependence
+// REQUIRES: swift_feature_AddressableTypes
+
+import ne_types
+
+// Ensure no memory crashes during SILGen
+
+struct NonEscapableFrameworkThingTests {
+  func example() async throws {
+    let ptr = UnsafeMutableRawBufferPointer.allocate(byteCount: 40, alignment: 1)
+    defer { ptr.deallocate() }
+    var something = Something(ptr: ptr)
+    var mutableView = something.mutableView(of: Float32.self)
+    var mutableSpan = mutableView.mutableSpan
+  }
+}