Crash from _appendingKeyPaths -- Fatal error: UnsafeMutableRawBufferPointer with negative count

[clackary]

Description

Compiler crashes when appending two keypaths.

Starting from a keypath like \Foo.dict, and appending an additional keypath like \OrderedDictionary.elements.values to produce \Foo.dict.elements.values used to work, but is currently causing a compiler crash.

Reproduction

Linux docker env setup

1. docker run -it -v ~/.ssh:/root/.ssh swift:noble
2. Install curl
3. Install swiftly
4. Install a recent main-snapshot, anything from 2025-10-02 has reproduced -- swiftly install --use main-snapshot-2025-10-02 (or newer)

Package setup

1. Create swift package with type executable -- swift package init --type executable
2. Update Package.swift with the following definition. Import swift-collections (we need OrderedDictionary).

// swift-tools-version: 6.2

import PackageDescription

let package = Package(
    name: "keypath-appending-crash",
    dependencies: [.package(url: "https://github.com/apple/swift-collections.git", "1.0.0" ..< "2.0.0")],
    targets: [
        .executableTarget(
            name: "keypath-appending-crash",
            dependencies: [.product(name: "OrderedCollections", package: "swift-collections")],
        ),
    ]
)

3. Add the code to Sources

import struct OrderedCollections.OrderedDictionary

struct Foo {
    var dict: OrderedDictionary<Int, Int> = [1: 1]
}

@main
struct Appendage {
    static func main() {
        let dictPath = \Foo.dict
        let valuesPath = \OrderedDictionary<Int, Int>.elements.values

        let combinedPath = dictPath.appending(path: valuesPath) // Crash
    }
}

Stack dump

Swift/UnsafeRawBufferPointer.swift:116: Fatal error: UnsafeMutableRawBufferPointer with negative count

💣 Program crashed: System trap at 0x0000ffffa51e55dc

Platform: arm64 Linux (Ubuntu 24.04.3 LTS)

Thread 0 "keypath-appendi" crashed:

  0 0x0000ffffa51e55dc closure #1 in closure #1 in _assertionFailure(_:_:file:line:flags:) + 468 in libswiftCore.so
  1 0x0000ffffa5330a24 _assertionFailure(_:_:file:line:flags:) + 235 in libswiftCore.so
  2 0x0000ffffa5330cc4 _fatalErrorMessage(_:_:file:line:flags:) + 39 in libswiftCore.so
  3 0x0000ffffa523db20 KeyPathBuffer.Builder.pushRaw(size:alignment:) + 187 in libswiftCore.so
  4 0x0000ffffa53a8bbc _appendingKeyPaths<A, B, C, D>(root:leaf:) + 1207 in libswiftCore.so
  5 static Appendage.main() + 107 in keypath-appending-crash at /project/keypath-appending-crash/Sources/keypath-appending-crash/keypath_appending_crash.swift:13:37

    11│         let valuesPath = \OrderedDictionary<Int, Int>.elements.values
    12│ 
    13│         let combinedPath = dictPath.appending(path: valuesPath)                                                                   
      │                                     ▲
    14│     }
    15│ }

  6 0x0000ffffa4c484c4 <unknown> in libc.so.6
  7 0x0000ffffa4c48598 <unknown> in libc.so.6
...

Expected behavior

Appends a keypath without crashing.

Environment

We can reproduce the bug consistently starting from a basic swift:noble container.

$ uname -a
Linux 1bbdaadfcdfd 5.15.0-157-generic #167-Ubuntu SMP Wed Sep 17 21:40:17 UTC 2025 aarch64 aarch64 aarch64 GNU/Linux

Swift version 6.3-dev (LLVM 3a427639f2a06cf, Swift 5417f00a58578de)
Target: aarch64-unknown-linux-gnu
Build config: +assertions

Additional information

This regression appears to have started with main-snapshot-2025-10-02. The latest known-good toolchain is main-snapshot-2025-09-29.

[clackary]

Thanks to @fibrechannelscsi for the help with a reproducer

[Azoy]

Resolved here: #85071