Runtime crash in very basic program causing `SIGBUS: illegal alignment` on Linux

[weissi]

Description

This very basic program (found in https://forums.swift.org/t/segmentation-fault-core-dumped-if-localizeddescription-not-implemented-with-error-protocol/80228) crashes with SIGBUS

import Foundation

public class BotError: Error {}

print(BotError().localizedDescription)

root@e819f73c1f31:/tmp# cat t.swift 
import Foundation

public class BotError: Error {}

print(BotError().localizedDescription)

root@e819f73c1f31:/tmp# swiftc t.swift && SWIFT_BACKTRACE=interactive=no ./t

💣 Program crashed: Bus error at 0x0000aaaaab671656

Thread 0 "t" crashed:

0      0x0000aaaaab671656 _fini + 214 in t   <<<<<< NOTE [@weissi]: This is wrong (it's in allocating init)
1 [ra] 0x0000aaaaab671464 main + 91 in t
2 [ra] 0x0000ffff9a6784c4 <unknown> in libc.so.6
3 [ra] 0x0000ffff9a678598 <unknown> in libc.so.6


Registers:

 x0 0x0000aaaad6cbbe20  c8 00 69 ab aa aa 00 00 03 00 00 00 06 00 00 00  È·i«ªª··········
 x1 0x0000000600000003  25769803779
 x2 0x0000aaaad6cbbe28  03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00  ················
 x3 0x0000fffffa15f628  34 b5 29 9b ff ff 00 00 40 be cb d6 aa aa 00 00  4µ)·ÿÿ··@¾ËÖªª··
 x4 0x0000fffffa15f624  ff ff 00 00 34 b5 29 9b ff ff 00 00 40 be cb d6  ÿÿ··4µ)·ÿÿ··@¾ËÖ
 x5 0x0000000000000001  1
 x6 0x0000000000000001  1
 x7 0x000000000000fbf0  64496
 x8 0x0000aaaaab671656  00 00 b0 fd ff ff 00 00 00 00 f0 88 f5 d7 15 5a  ··°ýÿÿ····ð·õ×·Z
 x9 0x0000000000000001  1
x10 0x0000000000000000  0
x11 0x0000000000000000  0
x12 0x0000ffff9c234570  00 00 00 9b ff ff 00 00 40 45 23 9c ff ff 00 00  ····ÿÿ··@E#·ÿÿ··
x13 0x000000000000002d  45
x14 0x0000000002c6717c  46559612
x15 0x0000aaaaab6713e8  fd 7b bf a9 fd 03 00 91 cc fe ff 97 fd 7b c1 a8  ý{¿©ý···Ìþÿ·ý{Á¨
x16 0x0000000000000001  1
x17 0x0000ffff9b4f1690  b4 95 dd 9b ff ff 00 00 30 6a 1e 9b ff ff 00 00  ´·Ý·ÿÿ··0j··ÿÿ··
x18 0x0000000000000014  20
x19 0x0000aaaaab6900c8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ················
x20 0x0000aaaad6cbbe20  c8 00 69 ab aa aa 00 00 03 00 00 00 06 00 00 00  È·i«ªª··········
x21 0x0000aaaad6cbbe40  d0 d0 f4 9b ff ff 00 00 03 00 00 00 00 00 00 00  ÐÐô·ÿÿ··········
x22 0x0000aaaaab671408  ff 03 02 d1 fd 7b 06 a9 f4 3b 00 f9 fd 83 01 91  ÿ··Ñý{·©ô;·ùý···
x23 0x0000fffffa15f988  37 07 16 fa ff ff 00 00 56 07 16 fa ff ff 00 00  7··úÿÿ··V··úÿÿ··
x24 0x0000ffff9c23bb58  00 00 00 00 00 00 00 00 78 fb 15 fa ff ff 00 00  ········xû·úÿÿ··
x25 0x0000000000000000  0
x26 0x0000ffff9c23c000  50 d3 23 9c ff ff 00 00 15 00 00 00 00 00 00 00  PÓ#·ÿÿ··········
x27 0x0000aaaaab68fcb0  14 4f f7 9b ff ff 00 00 2c 4f f7 9b ff ff 00 00  ·O÷·ÿÿ··,O÷·ÿÿ··
x28 0x0000000000000000  0
 fp 0x0000fffffa15f750  e0 f7 15 fa ff ff 00 00 64 14 67 ab aa aa 00 00  à÷·úÿÿ··d·g«ªª··
 lr 0x0000ffff9b29cdd0  f3 03 00 aa e0 03 15 aa f6 03 01 aa 49 27 fd 97  󷷪෷ªö··ªI'ý·
 sp 0x0000fffffa15f750  e0 f7 15 fa ff ff 00 00 64 14 67 ab aa aa 00 00  à÷·úÿÿ··d·g«ªª··
 pc 0x0000aaaaab671656  00 00 b0 fd ff ff 00 00 00 00 f0 88 f5 d7 15 5a  ··°ýÿÿ····ð·õ×·Z


Images (18 omitted):

0x0000aaaaab670000–0x0000aaaaab671948 70aa1e5da11d575518fcf05937927a943174d1d6 t         /tmp/t
0x0000ffff9a650000–0x0000ffff9a7e9d89 1d7249a4f207d07166ff4be43acdc68a01faaa04 libc.so.6 /usr/lib/aarch64-linux-gnu/libc.so.6

Backtrace took 0.00s

Bus error

this is the official swift:6.1-noble docker container

Reproduction

import Foundation

public class BotError: Error {}

print(BotError().localizedDescription)

Expected behavior

does not crash

Environment

root@e819f73c1f31:/tmp# cat /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.2 LTS"
root@e819f73c1f31:/tmp# swift -version
Swift version 6.1 (swift-6.1-RELEASE)
Target: aarch64-unknown-linux-gnu

Additional information

No response

[weissi]

CC @parkera (because Foundation use) & @mikeash / @al45tair for runtime

[weissi]

Uhh, illegal alignment:

(lldb) run
Process 97 launched: '/tmp/t' (aarch64)
Process 97 stopped
* thread swiftlang/swift#1, name = 't', stop reason = signal SIGBUS: illegal alignment
    frame #0: 0x0000aaaaaaaa1656 t`method descriptor for t.BotError.__allocating_init() -> t.BotError + 54
t`__stop_swift5_typeref:
    0xaaaaaaaa1656 <+0>:                                  ; unknown opcode

t`l_entry_point:
    0xaaaaaaaa165a <+2>: udf    #0xffff
    0xaaaaaaaa165e <+6>:                                  ; unknown opcode
    0xaaaaaaaa1662:      ands   x22, x23, x9, ror swiftlang/swift#61
Target 0: (t) stopped.
(lldb) bt
* thread swiftlang/swift#1, name = 't', stop reason = signal SIGBUS: illegal alignment
  * frame #0: 0x0000aaaaaaaa1656 t`method descriptor for t.BotError.__allocating_init() -> t.BotError + 54
    frame swiftlang/swift#1: 0x0000fffff709cdd0 libFoundation.so`Swift.Error.localizedDescription.getter : Swift.String + 84
    frame swiftlang/swift#2: 0x0000aaaaaaaa1464 t`main + 92
    frame swiftlang/swift#3: 0x0000fffff64784c4 libc.so.6`___lldb_unnamed_symbol3097 + 116
    frame swiftlang/swift#4: 0x0000fffff6478598 libc.so.6`__libc_start_main + 152
    frame swiftlang/swift#5: 0x0000aaaaaaaa0ff0 t`_start + 48

@al45tair it also appears that the backtracer shows the wrong stack? Are we missing some frame pointers in some binary?

[nerzh]

@weissi Thank you for your help in making this bug report, in the future, I will report them here 🤝

[al45tair]

Running on x86_64 I see something different again:

(lldb) bt
* thread swiftlang/swift#1, name = 't', stop reason = signal SIGSEGV: invalid address (fault address: 0x0)
  * frame #0: 0x0000555555555534 t`nominal type descriptor for t.BotError + 8
    frame swiftlang/swift#1: 0x00005555555553ce t`main at t.swift:5:18
    frame swiftlang/swift#2: 0x00007ffff6029d90 libc.so.6`__libc_start_call_main(main=(t`main at t.swift), argc=1, argv=0x00007fffffffe3d8) at libc_start_call_main.h:58:16
    frame swiftlang/swift#3: 0x00007ffff6029e40 libc.so.6`__libc_start_main_impl(main=(t`main at t.swift), argc=1, argv=<unavailable>, init=<unavailable>, fini=<unavailable>, rtld_fini=<unavailable>, stack_end=0x00007fffffffe3c8) at libc-start.c:392:3
    frame swiftlang/swift#4: 0x0000555555554f35 t`_start + 37

The reason for the discrepancy between the backtracer and LLDB is that the backtracer deliberately only loads symbols that correspond to functions — and the nearest function is indeed _fini. I think the problem here is that we're jumping to an invalid address.

[al45tair]

The crash is happening following an indirect jump in Swift.Error.localizedDescription.getter : Swift.String:

    0x7ffff7096b5d <+45>: callq  0x7ffff7094f00 ; Foundation._convertErrorToNSError(Swift.Error) -> Foundation.NSError
    0x7ffff7096b62 <+50>: movq   %rax, %r13
    0x7ffff7096b65 <+53>: movq   (%rax), %rax
    0x7ffff7096b68 <+56>: callq  *0x130(%rax) <--- Here

[al45tair]

It looks like the _convertErrorToNSError() function is returning something that is not an NSError.

[al45tair]

OK, the problem is that _convertErrorToNSError() does this:

func _convertErrorToNSError(_ error: Error) -> NSError {
    if let object = _extractDynamicValue(error as Any) {
        return unsafeDowncast(object, to: NSError.self)
    } else {

and on Linux, the _extractDynamicValue() call succeeds, which then means we do unsafeDowncast(), which (if we had debugging enabled) would assert, but because we don't, it's equivalent to bit casting to NSError, which (on Linux at least) is not what we have, and the upshot is we end up jumping to into random data.

Seems to me that this is a Foundation bug and it should probably be doing

  if let object = _extractDynamicValue(error as Any),
     let err = object as? NSError {
    return err
  }

That said, this code has been there a long time, so maybe there's something I don't appreciate here about how it's supposed to work?

[weissi]

CC @parkera