[Runtime] Fatal error if self escapes from deinit.

When deallocating a class instance, we check the retain count of the instance and error if it's greater than 1.

Self is allowed to be temporarily passed to other code from deinit, but there's no way to extend the lifetime of the object. Retaining it no longer extensd the lifetime. If self escapes from deinit, the result is a dangling pointer and eventual crash.

Instead of crashing randomly due to a dangling pointer, crash deliberately when destroying an object that has escaped.

rdar://93848484

Author: mikeash

stdlib/public/runtime/HeapObject.cpp

@@ -705,6 +705,10 @@ void swift::swift_rootObjCDealloc(HeapObject *self) {
 void swift::swift_deallocClassInstance(HeapObject *object,
                                        size_t allocatedSize,
                                        size_t allocatedAlignMask) {
+  size_t retainCount = swift_retainCount(object);
+  if (SWIFT_UNLIKELY(retainCount > 1))
+    swift::fatalError(0, "Object %p deallocated with retain count %zd, reference may have escaped from deinit.", object, retainCount);
+
 #if SWIFT_OBJC_INTEROP
   // We need to let the ObjC runtime clean up any associated objects or weak
   // references associated with this object.
@@ -713,6 +717,7 @@ void swift::swift_deallocClassInstance(HeapObject *object,
 #else
   const bool fastDeallocSupported = true;
 #endif
+
   if (!fastDeallocSupported || !object->refCounts.getPureSwiftDeallocation()) {
     objc_destructInstance((id)object);
   }

test/Runtime/deinit_escape.swift

@@ -0,0 +1,26 @@
+// RUN: %target-run-simple-swift
+
+// REQUIRES: executable_test
+// UNSUPPORTED: use_os_stdlib
+// UNSUPPORTED: back_deployment_runtime
+
+import StdlibUnittest
+
+var DeinitEscapeTestSuite = TestSuite("DeinitEscape")
+
+var globalObjects: [AnyObject] = []
+
+DeinitEscapeTestSuite.test("deinit escapes self") {
+  expectCrashLater()
+
+  class C {
+    deinit {
+      globalObjects.append(self)
+    }
+  }
+  _ = C()
+
+  expectUnreachable()
+}
+
+runAllTests()