[Concurrency runtime] Don't read from the actor after transitioning state

[DougGregor]

Once we have transitioned the actor into a new state, we report the state change as a trace event so it can be noted by tools (e.g., Instruments). However, the act of transitioning to a new state can mean that there is an opportunity for another thread to deallocate the actor. This means that the tracing call cannot depend on dereferencing the actor pointer.

A refactoring a few months ago to move the bit that indicates when a distributed actor is remote from inside the atomic actor state out to a separate field (because it's constant for a given actor instance), which introduced a dereference of the actor instance in forming the tracing call. This introduced a narrow window in which a race condition could occur: the actor transitions to an idle state, and is then deallocate before the trace event for the actor transition occurs, leading to a use-after-free.

Fetch this bit of information earlier in the process, before any state changes and when we know the actor is still allocated, and pass it through to the tracing code.

Fixes rdar://108497870.

[DougGregor]

@swift-ci please smoke test

[ktoso]

Thanks for the analysis, that makes a lot of sense. Fix looks good and we can consider doing a follow up by passing false when we “know” it must be false.

I’ll re read the code in the morning and see if we’re confident in the false passing change. Thanks again