[runtime] Fortify the swift_demangle API.

Remove the reference to String, which leaks internal implementation details,
check for invalid inputs, and make the API more flexible. Remove the similar
Swift API, since it provides no additional value.

Author: AnnaZaks

stdlib/public/core/Misc.swift

@@ -121,30 +121,6 @@ func _typeByName(_ name: String) -> Any.Type? {
     return type
   }
 }
- 
-@warn_unused_result
-@_silgen_name("swift_stdlib_demangleName")
-func _stdlib_demangleNameImpl(
-  _ mangledName: UnsafePointer<UInt8>,
-  _ mangledNameLength: UInt,
-  _ demangledName: UnsafeMutablePointer<String>)
-
-// NB: This function is not used directly in the Swift codebase, but is
-// exported for Xcode support. Please coordinate before changing.
-@warn_unused_result
-public // @testable
-func _stdlib_demangleName(_ mangledName: String) -> String {
-  let mangledNameUTF8 = Array(mangledName.utf8)
-  return mangledNameUTF8.withUnsafeBufferPointer {
-    (mangledNameUTF8) in
-    let (_, demangledName) = _withUninitializedString {
-      _stdlib_demangleNameImpl(
-        mangledNameUTF8.baseAddress!, UInt(mangledNameUTF8.endIndex),
-        $0)
-    }
-    return demangledName
-  }
-}
 
 /// Returns `floor(log(x))`.  This equals to the position of the most
 /// significant non-zero bit, or 63 - number-of-zeros before it.

stdlib/public/runtime/Reflection.mm

@@ -1190,16 +1190,63 @@ static Mirror ObjC_getMirrorForSuperclass(Class sup,
 }
 
 // NB: This function is not used directly in the Swift codebase, but is
-// exported for Xcode support. Please coordinate before changing.
+// exported for Xcode support and is used by the sanitizers. Please coordinate
+// before changing.
+//
+/// Demangles a Swift symbol name.
+///
+/// \param mangledName is the symbol name that needs to be demangled.
+/// \param mangledNameLength is the length of the string that should be
+/// demangled.
+/// \param outputBuffer is the user provided buffer where the demangled name
+/// will be placed. If nullptr, a new buffer will be malloced. In that case,
+/// the user of this API is responsible for freeing the returned buffer.
+/// \param outputBufferSize is the size of the output buffer. If the demangled
+/// name does not fit into the outputBuffer, the output will be truncated and
+/// the size will be updated, indicating how large the buffer should be.
+/// \param flags can be used to select the demangling style. TODO: We should
+//// define what these will be.
+/// \returns the demangled name. Returns nullptr if the input String is not a
+/// Swift mangled name.
 SWIFT_RUNTIME_EXPORT
-extern "C" void swift_stdlib_demangleName(const char *mangledName,
-                                          size_t mangledNameLength,
-                                          String *demangledName) {
+extern "C" char *swift_demangle(const char *mangledName,
+                                size_t mangledNameLength,
+                                char *outputBuffer,
+                                size_t *outputBufferSize,
+                                uint32_t flags) {
+  if (flags != 0) {
+    swift::fatalError(0, "Only 'flags' value of '0' is currently supported.");
+  }
+  if (outputBuffer != nullptr && outputBufferSize == nullptr) {
+    swift::fatalError(0, "'outputBuffer' is passed but the size is 'nullptr'.");
+  }
+
+  // Check if we are dealing with Swift mangled name, otherwise, don't try
+  // to demangle and send indication to the user.
+  if (mangledName[0] != '_' || mangledName[1] != 'T') {
+    return nullptr;
+  }
+
+  // Demangle the name.
   auto options = Demangle::DemangleOptions();
   options.DisplayDebuggerGeneratedModule = false;
   auto result =
       Demangle::demangleSymbolAsString(mangledName,
                                        mangledNameLength,
                                        options);
-  new (demangledName) String(result.data(), result.size());
+
+  // If the output buffer is not provided, malloc memory ourselves.
+  if (outputBuffer == nullptr || *outputBufferSize == 0) {
+    return strdup(result.c_str());
+  }
+
+  // Indicate a failure if the result does not fit and will be truncated
+  // and set the required outputBufferSize.
+  if (*outputBufferSize < result.length() + 1) {
+    *outputBufferSize = result.length() + 1;
+  }
+
+  // Copy into the provided buffer.
+  strlcpy(outputBuffer, result.c_str(), *outputBufferSize);
+  return outputBuffer;
 }

test/1_stdlib/Runtime.swift

@@ -9,6 +9,37 @@ import StdlibUnittest
 import SwiftShims
 
 
+@warn_unused_result
+@_silgen_name("swift_demangle")
+public
+func _stdlib_demangleImpl(
+  mangledName: UnsafePointer<UInt8>?,
+  mangledNameLength: UInt,
+  outputBuffer: UnsafeMutablePointer<UInt8>?,
+  outputBufferSize: UnsafeMutablePointer<UInt>?,
+  flags: UInt32
+) -> UnsafeMutablePointer<CChar>?
+
+@warn_unused_result
+func _stdlib_demangleName(_ mangledName: String) -> String {
+  return mangledName.nulTerminatedUTF8.withUnsafeBufferPointer {
+    (mangledNameUTF8) in
+
+    let demangledNamePtr = _stdlib_demangleImpl(
+      mangledName: mangledNameUTF8.baseAddress,
+      mangledNameLength: UInt(mangledNameUTF8.count - 1),
+      outputBuffer: nil,
+      outputBufferSize: nil,
+      flags: 0)
+
+    if let demangledNamePtr = demangledNamePtr {
+      let demangledName = String(cString: demangledNamePtr)
+      _swift_stdlib_free(demangledNamePtr)
+      return demangledName
+    }
+    return mangledName
+  }
+}
 
 var swiftObjectCanaryCount = 0
 class SwiftObjectCanary {