[SR-7608] Pipe() crashes when the underlying system call fails.

[swift-ci]

Previous ID	SR-7608
Radar	https://bugreport.apple.com/web/?problemID=39998419
Original Reporter	iosdevzone (JIRA User)
Type	Bug
Status	Resolved
Resolution	Done

Attachment: Download

Environment

Linux fido 3.13.0-46-generic #75-Ubuntu SMP Tue Feb 10 15:24:04 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

Swift version 4.1.1 (swift-4.1.1-RELEASE)

Target: x86_64-unknown-linux-gnu

Additional Detail from JIRA

Votes	0
Component/s	Foundation
Labels	Bug
Assignee	@spevans
Priority	Medium

md5: 0d4ecd3a68dec42245053d252ead6b83

relates to:

• SR-8917 FileHandle warning: 'let' properties are implicitly 'final'; use 'public' instead of 'open'

Issue Description:

When the underlying system call – pipe(2) – fails, Pipe() crashes on Ubuntu calling fatalError. It is my understanding that `fatalError` should only be called in response to programmer error and not because of a resource allocation failure.

The offending code is in FileHandle.swift, line 380

This is also reported as Radar 39998419, as the behavior on macOS is different.

The attached (very simple) program demonstrates the problem.

[belkadan]

cc @millenomi

[nevil]

NSPipe's init is documented to return nil on failure:
https://developer.apple.com/documentation/foundation/nspipe/1807207-init?language=objc

An initialized NSPipe object. Returns nil if the method encounters errors while attempting to create the pipe or the NSFileHandle objects that serve as endpoints of the pipe.

Same for NSPipe's pipe class property:
https://developer.apple.com/documentation/foundation/nspipe/1580418-pipe?language=objc

An initialized NSPipe object. Returns nil if the method encounters errors while attempting to create the pipe or the NSFileHandle objects that serve as endpoints of the pipe.

But there are no nullable annotations in the NSFileHandle.h header file for pipe...

[spevans]

Ive opened a PR #1697 that sets the .fileDescriptor to -1 rather than calling fatalError. Its probably the only thing than can be done given that the initialiser is not failable.