[SILGen]: ban forward captures of let temporary allocations

This addresses the same problem as #37935
but handles address-only lets rather than vars.

Author: jamieQ

lib/SILGen/SILGenDecl.cpp

@@ -827,14 +827,15 @@ class LetValueInitialization : public Initialization {
       if (isUninitialized)
         address = SGF.B.createMarkUninitializedVar(vd, address);
       DestroyCleanup = SGF.enterDormantTemporaryCleanup(address, *lowering);
-      SGF.VarLocs[vd] = SILGenFunction::VarLoc(address,
-                                               SILAccessEnforcement::Unknown);
+
+      // N.B. We do not register the address in VarLocs yet so that the capture-
+      // before-definition machinery will diagnose such cases.
     }
     // Push a cleanup to destroy the let declaration.  This has to be
-    // inactive until the variable is initialized: if control flow exits the
+    // inactive until the variable is initialized: if control flow exits
     // before the value is bound, we don't want to destroy the value.
     //
-    // Cleanups are required for all lexically scoped variables to delimite
+    // Cleanups are required for all lexically scoped variables to delimit
     // the variable scope, even if the cleanup does nothing.
     SGF.Cleanups.pushCleanupInState<DestroyLocalVariable>(
       CleanupState::Dormant, vd);
@@ -1006,7 +1007,17 @@ class LetValueInitialization : public Initialization {
   void finishInitialization(SILGenFunction &SGF) override {
     assert(!DidFinish &&
            "called LetValueInit::finishInitialization twice!");
-    assert(SGF.VarLocs.count(vd) && "Didn't bind a value to this let!");
+
+    if (address) {
+      // We should have delayed registration to detect forward-declared
+      // captures.
+      assert(!SGF.VarLocs.count(vd) && "Should not have bound the let yet!");
+      SGF.VarLocs[vd] =
+          SILGenFunction::VarLoc(address, SILAccessEnforcement::Unknown);
+    } else {
+      // We should have already registered the variable in the non-address case.
+      assert(SGF.VarLocs.count(vd) && "Didn't bind a value to this let!");
+    }
 
     // Deactivate any cleanups we made when splitting the tuple.
     for (auto cleanup : SplitCleanups)

test/SILGen/capture_order.swift

@@ -192,3 +192,140 @@ func func77933460() {
   // expected-note@-3 {{captured value declared here}}
   // expected-warning@-4 {{variable 'obj' was never mutated; consider changing to 'let' constant}}
 }
+
+// MARK: - Forward Declared Lets
+
+// https://github.com/swiftlang/swift/issues/84909
+// Make sure we can't capture an uninitialized 'let' temporary allocation either.
+
+protocol P {}
+
+enum E {
+  static func static_gen_fwd<T>(_ g: () -> T) -> T { g() }
+}
+
+func global_fwd(_ a: () -> Any) -> Any { a() }
+func global_gen_fwd<T>(_ g: () -> T) -> T { g() }
+func global_fwd_p(_ p: () -> any P) -> any P { p() }
+
+func forward_declared_let_captures() {
+  do {
+    let bad: Any = { bad }()
+    // expected-error@-1 {{closure captures 'bad' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    func fwd(_ i: () -> Any) -> Any { i() }
+    let bad = fwd { bad }
+    // expected-error@-1 {{closure captures 'bad' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    func bad_local_f() -> Any { bad }
+    // expected-error@-1 {{closure captures 'bad' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    let bad = bad_local_f()
+    // expected-note@-1 {{captured value declared here}}
+  }
+
+  do {
+    let bad = global_fwd { bad }
+    // expected-error@-1 {{closure captures 'bad' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let bad: Any = global_gen_fwd { bad }
+    // expected-error@-1 {{closure captures 'bad' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let bad: Any = E.static_gen_fwd { bad }
+    // expected-error@-1 {{closure captures 'bad' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let badNested: Any = global_fwd { { [badNested] in badNested }() }
+    // expected-error@-1 {{closure captures 'badNested' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let badOpt: Any? = { () -> Any? in badOpt }()
+    // expected-error@-1 {{closure captures 'badOpt' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let badTup: (Any, Any) = { (badTup.0, badTup.1) }()
+    // expected-error@-1 {{closure captures 'badTup' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let badTup: (Int, Any) = { (badTup.0, badTup.1) }()
+    // expected-error@-1 {{closure captures 'badTup' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let (badTup3, badTup4): (Any, Any) = { (badTup4, badTup3) }()
+    // expected-error@-1 {{closure captures 'badTup4' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+    // expected-error@-4 {{closure captures 'badTup3' before it is declared}}
+    // expected-note@-5 {{captured here}}
+    // expected-note@-6 {{captured value declared here}}
+  }
+
+  do {
+    struct S { var p: Any }
+    let badStruct: S = { S(p: badStruct.p) }()
+    // expected-error@-1 {{closure captures 'badStruct' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    enum EE {
+      case boring
+      case weird(Any)
+      case strange(Any)
+    }
+
+    let badEnum: EE = { .weird(EE.strange(badEnum)) }()
+    // expected-error@-1 {{closure captures 'badEnum' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+
+  do {
+    let badproto: any P = global_fwd_p { badproto }
+    // expected-error@-1 {{closure captures 'badproto' before it is declared}}
+    // expected-note@-2 {{captured here}}
+    // expected-note@-3 {{captured value declared here}}
+  }
+}
+
+// FIXME: should/could these be diagnosed instead of accepted?
+func forward_declared_local_lazy_captures() {
+  // runtime stack overflow, maybe UB?
+  lazy var infiniteRecurse: Any = { infiniteRecurse }()
+
+  // ??? not entirely sure what's going on here...
+  // this can be called and doesn't seem to trip the sanitizers...
+  lazy var hmm: () -> Any = { hmm }
+}