Skip to content

ICE assertion left == right failed: write_cvalue_transmute: types::I32 -> types::I64 #1452

Open
@matthiaskrgr

Description

@matthiaskrgr

auto-reduced (treereduce-rust):

struct SliceWithHead(u8, [u8]);

fn main() {
    let buf = [0u32; 1];

    let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
}

original:

// should find the bug even without retagging
//@compile-flags: -Zmiri-disable-stacked-borrows

struct SliceWithHead(#[allow(dead_code)] u8, #[allow(dead_code)] [u8]);

fn main() {
    let buf = [0u32; 1];
    // We craft a wide pointer `*const SliceWithHead` such that the unsized tail is only partially allocated.
    // That should lead to UB, as the reference is not fully dereferenceable.
    let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
    // Re-borrow that. This should be UB.
    let _ptr = unsafe { &*ptr }; //~ ERROR: encountered a dangling reference (going beyond the bounds of its allocation)
}

Version information

rustc 1.77.0-nightly (af08c64e3 2024-01-29)
binary: rustc
commit-hash: af08c64e3800fd15f0afdb8651de8fa7dacc0026
commit-date: 2024-01-29
host: x86_64-unknown-linux-gnu
release: 1.77.0-nightly
LLVM version: 17.0.6

Command:
/home/matthias/.rustup/toolchains/master/bin/rustc -Zmir-opt-level=5 -Zcodegen-backend=cranelift

Program output

warning: unused variable: `ptr`
 --> /tmp/icemaker_global_tempdir.yBSNmWzLXX3J/rustc_testrunner_tmpdir_reporting.O3jHPEVlFwXz/mvce.rs:6:9
  |
6 |     let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
  |         ^^^ help: if this is intentional, prefix it with an underscore: `_ptr`
  |
  = note: `#[warn(unused_variables)]` on by default

warning: fields `0` and `1` are never read
 --> /tmp/icemaker_global_tempdir.yBSNmWzLXX3J/rustc_testrunner_tmpdir_reporting.O3jHPEVlFwXz/mvce.rs:1:22
  |
1 | struct SliceWithHead(u8, [u8]);
  |        ------------- ^^  ^^^^
  |        |
  |        fields in this struct
  |
  = note: `#[warn(dead_code)]` on by default
help: consider changing the fields to be of unit type to suppress this warning while preserving the field numbering, or remove the fields
  |
1 | struct SliceWithHead((), ());
  |                      ~~  ~~

thread 'rustc' panicked at src/value_and_place.rs:555:13:
assertion `left == right` failed: write_cvalue_transmute: types::I32 -> types::I64
  left: 4
 right: 8
stack backtrace:
   0:     0x7faae7dba766 - std::backtrace_rs::backtrace::libunwind::trace::h7c7ac43538ebe472
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/../../backtrace/src/backtrace/libunwind.rs:104:5
   1:     0x7faae7dba766 - std::backtrace_rs::backtrace::trace_unsynchronized::h5508b242c4c12984
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7faae7dba766 - std::sys_common::backtrace::_print_fmt::hd639972598c59b74
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:68:5
   3:     0x7faae7dba766 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h698d6e1355cc5d61
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x7faae7e0d100 - core::fmt::rt::Argument::fmt::ha3fb3ddb557a8c28
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/fmt/rt.rs:142:9
   5:     0x7faae7e0d100 - core::fmt::write::hae04493f24c53294
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/fmt/mod.rs:1120:17
   6:     0x7faae7dae12f - std::io::Write::write_fmt::hf8f7af67b8ad7e8c
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/io/mod.rs:1810:15
   7:     0x7faae7dba544 - std::sys_common::backtrace::_print::h06c79c4f31ffa6a6
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:47:5
   8:     0x7faae7dba544 - std::sys_common::backtrace::print::h0f43e94a08a21e5b
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:34:9
   9:     0x7faae7dbd2d7 - std::panicking::default_hook::{{closure}}::ha3f3b1b60e2c5df1
  10:     0x7faae7dbd039 - std::panicking::default_hook::h4c22a752655f027b
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:292:9
  11:     0x7faae4b3664c - std[527f01a8ca63601b]::panicking::update_hook::<alloc[9fa6c6532c562875]::boxed::Box<rustc_driver_impl[8792044a82a8625e]::install_ice_hook::{closure#0}>>::{closure#0}
  12:     0x7faae7dbda26 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::hd677dcfc0977411a
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2029:9
  13:     0x7faae7dbda26 - std::panicking::rust_panic_with_hook::h30a4485d7c627d00
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:785:13
  14:     0x7faae7dbd772 - std::panicking::begin_panic_handler::{{closure}}::h5cee7380081e0bc7
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:659:13
  15:     0x7faae7dbac66 - std::sys_common::backtrace::__rust_end_short_backtrace::h5ce5b16fec0dd4af
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:171:18
  16:     0x7faae7dbd4c4 - rust_begin_unwind
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:647:5
  17:     0x7faae7e09805 - core::panicking::panic_fmt::h0ecda8cbe1cd9e47
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/panicking.rs:72:14
  18:     0x7faae7e09e7f - core::panicking::assert_failed_inner::hefd49e818054cbff
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/panicking.rs:337:23
  19:     0x7faad85c205f - core[9bbc21a9b33808e2]::panicking::assert_failed::<u32, u32>
  20:     0x7faad86595b0 - <rustc_codegen_cranelift[ec19655ba85fdac8]::value_and_place::CPlace>::write_cvalue_maybe_transmute::transmute_scalar
  21:     0x7faad865905f - <rustc_codegen_cranelift[ec19655ba85fdac8]::value_and_place::CPlace>::write_cvalue_maybe_transmute
  22:     0x7faad860b26e - rustc_codegen_cranelift[ec19655ba85fdac8]::base::codegen_fn_body
  23:     0x7faad8622e6c - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::module_codegen::{closure#0}
  24:     0x7faad861ff52 - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::module_codegen
  25:     0x7faad862cabf - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::run_aot
  26:     0x7faad865bdbc - <rustc_codegen_cranelift[ec19655ba85fdac8]::CraneliftCodegenBackend as rustc_codegen_ssa[6a3d55d079e415ff]::traits::backend::CodegenBackend>::codegen_crate
  27:     0x7faae6861430 - rustc_interface[d556da9ff3a1cc86]::passes::start_codegen
  28:     0x7faae6860b70 - <rustc_interface[d556da9ff3a1cc86]::queries::Queries>::codegen_and_build_linker
  29:     0x7faae6b104cc - rustc_interface[d556da9ff3a1cc86]::interface::run_compiler::<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}
  30:     0x7faae67abe46 - std[527f01a8ca63601b]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_with_globals<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_pool_with_globals<rustc_interface[d556da9ff3a1cc86]::interface::run_compiler<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>
  31:     0x7faae67abc73 - <<std[527f01a8ca63601b]::thread::Builder>::spawn_unchecked_<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_with_globals<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_pool_with_globals<rustc_interface[d556da9ff3a1cc86]::interface::run_compiler<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#1} as core[9bbc21a9b33808e2]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  32:     0x7faae7dc7015 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h2bd4aab73c5ae314
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2015:9
  33:     0x7faae7dc7015 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::ha809079e7c8fd129
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2015:9
  34:     0x7faae7dc7015 - std::sys::pal::unix::thread::Thread::new::thread_start::he1a55fca7da552da
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys/pal/unix/thread.rs:108:17
  35:     0x7faae1caa9eb - <unknown>
  36:     0x7faae1d2e7cc - <unknown>
  37:                0x0 - <unknown>

error: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.77.0-nightly (af08c64e3 2024-01-29) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z mir-opt-level=5 -Z codegen-backend=cranelift -Z dump-mir-dir=dir

query stack during panic:
end of query stack
warning: 2 warnings emitted


Metadata

Metadata

Assignees

No one assigned

    Labels

    C-bugCategory: This is a bug.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions