Use _boundsCheckPrecondition for unsafe buffer pointer index manipulation

Author: DougGregor

stdlib/public/core/UnsafeBufferPointer.swift.gyb

@@ -201,28 +201,17 @@ extension Unsafe${Mutable}BufferPointer: ${Mutable}Collection, RandomAccessColle
     // NOTE: this is a manual specialization of index movement for a Strideable
     // index that is required for UnsafeBufferPointer performance. The
     // optimizer is not capable of creating partial specializations yet.
-    // NOTE: Range checks are not performed here, because it is done later by
-    // the subscript function.
-    // NOTE: Wrapping math because we allow unsafe buffer pointers not to verify
-    // index preconditions in release builds. Our (optimistic) assumption is
-    // that the caller is already ensuring that indices are valid, so we can
-    // elide the usual checks to help the optimizer generate better code.
-    // However, we still check for overflow in debug mode.
     let result = i.addingReportingOverflow(1)
-    _debugPrecondition(!result.overflow)
+    _boundsCheckPrecondition(!result.overflow)
     return result.partialValue
   }
 
   @inlinable // unsafe-performance
   public func formIndex(after i: inout Int) {
     // NOTE: this is a manual specialization of index movement for a Strideable
     // index that is required for UnsafeBufferPointer performance. The
-    // optimizer is not capable of creating partial specializations yet.
-    // NOTE: Range checks are not performed here, because it is done later by
-    // the subscript function.
-    // See note on wrapping arithmetic in `index(after:)` above.
     let result = i.addingReportingOverflow(1)
-    _debugPrecondition(!result.overflow)
+    _boundsCheckPrecondition(!result.overflow)
     i = result.partialValue
   }
 
@@ -231,11 +220,8 @@ extension Unsafe${Mutable}BufferPointer: ${Mutable}Collection, RandomAccessColle
     // NOTE: this is a manual specialization of index movement for a Strideable
     // index that is required for UnsafeBufferPointer performance. The
     // optimizer is not capable of creating partial specializations yet.
-    // NOTE: Range checks are not performed here, because it is done later by
-    // the subscript function.
-    // See note on wrapping arithmetic in `index(after:)` above.
     let result = i.subtractingReportingOverflow(1)
-    _debugPrecondition(!result.overflow)
+    _boundsCheckPrecondition(!result.overflow)
     return result.partialValue
   }
 
@@ -244,11 +230,8 @@ extension Unsafe${Mutable}BufferPointer: ${Mutable}Collection, RandomAccessColle
     // NOTE: this is a manual specialization of index movement for a Strideable
     // index that is required for UnsafeBufferPointer performance. The
     // optimizer is not capable of creating partial specializations yet.
-    // NOTE: Range checks are not performed here, because it is done later by
-    // the subscript function.
-    // See note on wrapping arithmetic in `index(after:)` above.
     let result = i.subtractingReportingOverflow(1)
-    _debugPrecondition(!result.overflow)
+    _boundsCheckPrecondition(!result.overflow)
     i = result.partialValue
   }
 
@@ -257,11 +240,8 @@ extension Unsafe${Mutable}BufferPointer: ${Mutable}Collection, RandomAccessColle
     // NOTE: this is a manual specialization of index movement for a Strideable
     // index that is required for UnsafeBufferPointer performance. The
     // optimizer is not capable of creating partial specializations yet.
-    // NOTE: Range checks are not performed here, because it is done later by
-    // the subscript function.
-    // See note on wrapping arithmetic in `index(after:)` above.
     let result = i.addingReportingOverflow(n)
-    _debugPrecondition(!result.overflow)
+    _boundsCheckPrecondition(!result.overflow)
     return result.partialValue
   }
 
@@ -270,19 +250,16 @@ extension Unsafe${Mutable}BufferPointer: ${Mutable}Collection, RandomAccessColle
     // NOTE: this is a manual specialization of index movement for a Strideable
     // index that is required for UnsafeBufferPointer performance. The
     // optimizer is not capable of creating partial specializations yet.
-    // NOTE: Range checks are not performed here, because it is done later by
-    // the subscript function.
-    // See note on wrapping arithmetic in `index(after:)` above.
     let maxOffset = limit.subtractingReportingOverflow(i)
-    _debugPrecondition(!maxOffset.overflow)
+    _boundsCheckPrecondition(!maxOffset.overflow)
     let l = maxOffset.partialValue
 
     if n > 0 ? l >= 0 && l < n : l <= 0 && n < l {
       return nil
     }
 
     let result = i.addingReportingOverflow(n)
-    _debugPrecondition(!result.overflow)
+    _boundsCheckPrecondition(!result.overflow)
     return result.partialValue
   }
 
@@ -291,15 +268,13 @@ extension Unsafe${Mutable}BufferPointer: ${Mutable}Collection, RandomAccessColle
     // NOTE: this is a manual specialization of index movement for a Strideable
     // index that is required for UnsafeBufferPointer performance. The
     // optimizer is not capable of creating partial specializations yet.
-    // NOTE: Range checks are not performed here, because it is done later by
-    // the subscript function.
     // NOTE: We allow the subtraction to silently overflow in release builds
     // to eliminate a superfluous check when `start` and `end` are both valid
     // indices. (The operation can only overflow if `start` is negative, which
     // implies it's an invalid index.) `Collection` does not specify what
     // `distance` should return when given an invalid index pair.
     let result = end.subtractingReportingOverflow(start)
-    _debugPrecondition(!result.overflow)
+    _boundsCheckPrecondition(!result.overflow)
     return result.partialValue
   }
 

test/stdlib/BoundsCheckTraps.swift

@@ -36,6 +36,20 @@ BoundsCheckTraps.test("UnsafeMutableBufferPointer")
   _blackHole(array)
 }
 
+BoundsCheckTraps.test("UnsafeMutableBufferPointerIndexes")
+  .skip(.custom(
+    { _isFastAssertConfiguration() || _isReleaseAssertConfiguration() },
+    reason: "this trap is not guaranteed to happen"))
+  .code {
+  expectCrashLater()
+  var array = [1, 2, 3]
+  array.withUnsafeBufferPointer { buffer in
+    let i = buffer.index(after: Int.max)
+    _blackHole(i)
+  }
+  _blackHole(array)
+}
+
 BoundsCheckTraps.test("UnsafeRawBufferPointer")
   .skip(.custom(
     { _isFastAssertConfiguration() || _isReleaseAssertConfiguration() },