IRGen: Fix miscompile when a generic parameter is fixed to a tuple containing a pack

If you had something like:

    struct G<T> {
      func f<each U>(_: repeat each U) where T == (repeat each U) {}
    }

We would fulfill 'each U' from the metadata for 'G<(repeat each U)>',
by taking apart the tuple metadata for `(repeat each U)` and forming
a pack.

However this code path was only intended to kick in for a tuple
conformance witness thunk. In the general case, this optimization
is not correct, because if 'each U' is substituted with a
one-element pack, the generic argument of `G<(repeat each U)>` is
just that one element's metadata, and not a tuple. In fact, we
cannot distinguish the one-element tuple case, because the wrapped
element may itself be a tuple.

The fix is to just split off FulfillmentMap::searchTupleTypeMetadata()
from searchTypeMetadata(), and only call the former when we're in
the specific situation that requires it.

- Fixes https://github.com/swiftlang/swift/issues/78191.
- Fixes rdar://problem/135325886.

lib/IRGen/Fulfillment.cpp

@@ -178,39 +178,48 @@ bool FulfillmentMap::searchTypeMetadata(IRGenModule &IGM, CanType type,
                                      source, std::move(path), keys);
   }
 
-  if (auto tupleType = dyn_cast<TupleType>(type)) {
-    if (tupleType->getNumElements() == 1 &&
-        isa<PackExpansionType>(tupleType.getElementType(0))) {
-
-      bool hadFulfillment = false;
-      auto packType = tupleType.getInducedPackType();
-
-      {
-        auto argPath = path;
-        argPath.addTuplePackComponent();
-        hadFulfillment |= searchTypeMetadataPack(IGM, packType,
-                                                 isExact, metadataState, source,
-                                                 std::move(argPath), keys);
-      }
-
-      {
-        auto argPath = path;
-        argPath.addTupleShapeComponent();
-        hadFulfillment |= searchShapeRequirement(IGM, packType, source,
-                                                 std::move(argPath));
-
-      }
-
-      return hadFulfillment;
-    }
-  }
-
   // TODO: functions
   // TODO: metatypes
 
   return false;
 }
 
+/// Metadata fulfillment in a tuple conformance witness thunks.
+///
+/// \return true if any fulfillments were added by this search.
+bool FulfillmentMap::searchTupleTypeMetadata(IRGenModule &IGM, CanTupleType tupleType,
+                                             IsExact_t isExact,
+                                             MetadataState metadataState,
+                                             unsigned source, MetadataPath &&path,
+                                             const InterestingKeysCallback &keys) {
+  if (tupleType->getNumElements() == 1 &&
+      isa<PackExpansionType>(tupleType.getElementType(0))) {
+
+    bool hadFulfillment = false;
+    auto packType = tupleType.getInducedPackType();
+
+    {
+      auto argPath = path;
+      argPath.addTuplePackComponent();
+      hadFulfillment |= searchTypeMetadataPack(IGM, packType,
+                                               isExact, metadataState, source,
+                                               std::move(argPath), keys);
+    }
+
+    {
+      auto argPath = path;
+      argPath.addTupleShapeComponent();
+      hadFulfillment |= searchShapeRequirement(IGM, packType, source,
+                                               std::move(argPath));
+
+    }
+
+    return hadFulfillment;
+  }
+
+  return false;
+}
+
 static CanType getSingletonPackExpansionParameter(
     CanPackType packType, const FulfillmentMap::InterestingKeysCallback &keys,
     std::optional<unsigned> &packExpansionComponent) {

lib/IRGen/Fulfillment.h

@@ -102,6 +102,14 @@ public:
                           unsigned sourceIndex, MetadataPath &&path,
                           const InterestingKeysCallback &interestingKeys);
 
+  /// Metadata fulfillment in tuple conformance witness thunks.
+  ///
+  /// \return true if any fulfillments were added by this search.
+  bool searchTupleTypeMetadata(IRGenModule &IGM, CanTupleType type, IsExact_t isExact,
+                               MetadataState metadataState,
+                               unsigned sourceIndex, MetadataPath &&path,
+                               const InterestingKeysCallback &interestingKeys);
+
   /// Search the given type metadata pack for useful fulfillments.
   ///
   /// \return true if any fulfillments were added by this search.

lib/IRGen/GenProto.cpp

@@ -163,6 +163,8 @@ private:
                              CanType type, Args... args);
   bool considerType(CanType type, IsExact_t isExact,
                     unsigned sourceIndex, MetadataPath &&path);
+  bool considerTupleType(CanTupleType type, IsExact_t isExact,
+                         unsigned sourceIndex, MetadataPath &&path);
 
   /// Testify to generic parameters in the Self type of a protocol
   /// witness method.
@@ -354,6 +356,15 @@ bool PolymorphicConvention::considerType(CanType type, IsExact_t isExact,
                                          std::move(path), callbacks);
 }
 
+bool PolymorphicConvention::considerTupleType(CanTupleType type, IsExact_t isExact,
+                                              unsigned sourceIndex,
+                                              MetadataPath &&path) {
+  FulfillmentMapCallback callbacks(*this);
+  return Fulfillments.searchTupleTypeMetadata(IGM, type, isExact,
+                                              MetadataState::Complete, sourceIndex,
+                                              std::move(path), callbacks);
+}
+
 void PolymorphicConvention::considerWitnessSelf(CanSILFunctionType fnType) {
   CanType selfTy = fnType->getSelfInstanceType(
       IGM.getSILModule(), IGM.getMaximalTypeExpansionContext());
@@ -362,13 +373,17 @@ void PolymorphicConvention::considerWitnessSelf(CanSILFunctionType fnType) {
   // First, bind type metadata for Self.
   Sources.emplace_back(MetadataSource::Kind::SelfMetadata, selfTy);
 
-  if (selfTy->is<GenericTypeParamType>()) {
+  if (auto tupleTy = dyn_cast<TupleType>(selfTy)) {
-    // The Self type is abstract, so we can fulfill its metadata from
+    considerTupleType(tupleTy, IsInexact, Sources.size() - 1, MetadataPath());
-    // the Self metadata parameter.
+  } else {
-    addSelfMetadataFulfillment(selfTy);
+    if (isa<GenericTypeParamType>(selfTy)) {
-  }
+      // The Self type is abstract, so we can fulfill its metadata from
+      // the Self metadata parameter.
+      addSelfMetadataFulfillment(selfTy);
+    }
 
-  considerType(selfTy, IsInexact, Sources.size() - 1, MetadataPath());
+    considerType(selfTy, IsInexact, Sources.size() - 1, MetadataPath());
+  }
 
   // The witness table for the Self : P conformance can be
   // fulfilled from the Self witness table parameter.

lib/IRGen/LocalTypeData.cpp

@@ -735,11 +735,20 @@ void LocalTypeDataCache::addAbstractForTypeMetadata(IRGenFunction &IGF,
   // Look for anything at all that's fulfilled by this.  If we don't find
   // anything, stop.
   FulfillmentMap fulfillments;
-  if (!fulfillments.searchTypeMetadata(IGF.IGM, type, isExact,
+  if (auto tupleType = dyn_cast<TupleType>(type)) {
-                                       metadata.getStaticLowerBoundOnState(),
+    if (!fulfillments.searchTupleTypeMetadata(IGF.IGM, tupleType, isExact,
-                                       /*source*/ 0, MetadataPath(),
+                                              metadata.getStaticLowerBoundOnState(),
-                                       callbacks)) {
+                                              /*source*/ 0, MetadataPath(),
-    return;
+                                              callbacks)) {
+      return;
+    }
+  } else {
+    if (!fulfillments.searchTypeMetadata(IGF.IGM, type, isExact,
+                                         metadata.getStaticLowerBoundOnState(),
+                                         /*source*/ 0, MetadataPath(),
+                                         callbacks)) {
+      return;
+    }
   }
 
   addAbstractForFulfillments(IGF, std::move(fulfillments),

test/IRGen/variadic_generic_fulfillment_tuple.swift

@@ -0,0 +1,13 @@
+// RUN: %target-swift-frontend -emit-ir %s -target %target-swift-5.9-abi-triple | %FileCheck %s
+
+struct G<T> {
+  var t: T
+
+  // Make sure we *don't* try to fulfill the pack from the tuple, because we cannot
+  // distinguish the one-element case that way.
+
+  // CHECK-LABEL: define {{.*}} void @"$s34variadic_generic_fulfillment_tuple1GV20fixOuterGenericParamyACyqd__qd__Qp_tGqd__qd__Qp_t_tRvd__qd__qd__Qp_tRszlF"(ptr noalias sret(%swift.opaque) %0, ptr noalias %1, {{i32|i64}} %2, ptr %"each U", ptr noalias swiftself %3)
+  func fixOuterGenericParam<each U>(_ t: T) -> G<T> where T == (repeat each U) {
+    return G<T>(t: t)
+  }
+}

test/Interpreter/variadic_generic_tuples.swift

@@ -85,5 +85,19 @@ tuples.test("labels") {
   expectEqual("(label: Swift.Int, Swift.String)", _typeName(oneElementLabeledTuple(t: String.self)))
 }
 
+// https://github.com/swiftlang/swift/issues/78191
+tuples.test("fulfillment") {
+  struct S<T> {
+    let t: T
+
+    func f<each A, each B>(_ b: S<(repeat each B)>) -> S<(repeat each A, repeat each B)>
+        where T == (repeat each A) {
+      return S<(repeat each A, repeat each B)>(t: (repeat each t, repeat each b.t))
+    }
+  }
+
+  let s = S(t: "hello")
+  expectEqual("S<(String, Int, Int)>(t: (\"hello\", 1, 2))", String(describing: s.f(S(t: (1, 2)))))
+}
 
 runAllTests()