Open
Description
auto-reduced (treereduce-rust):
struct SliceWithHead(u8, [u8]);
fn main() {
let buf = [0u32; 1];
let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
}
original:
// should find the bug even without retagging
//@compile-flags: -Zmiri-disable-stacked-borrows
struct SliceWithHead(#[allow(dead_code)] u8, #[allow(dead_code)] [u8]);
fn main() {
let buf = [0u32; 1];
// We craft a wide pointer `*const SliceWithHead` such that the unsized tail is only partially allocated.
// That should lead to UB, as the reference is not fully dereferenceable.
let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
// Re-borrow that. This should be UB.
let _ptr = unsafe { &*ptr }; //~ ERROR: encountered a dangling reference (going beyond the bounds of its allocation)
}
Version information
rustc 1.77.0-nightly (af08c64e3 2024-01-29)
binary: rustc
commit-hash: af08c64e3800fd15f0afdb8651de8fa7dacc0026
commit-date: 2024-01-29
host: x86_64-unknown-linux-gnu
release: 1.77.0-nightly
LLVM version: 17.0.6
Command:
/home/matthias/.rustup/toolchains/master/bin/rustc -Zmir-opt-level=5 -Zcodegen-backend=cranelift
Program output
warning: unused variable: `ptr`
--> /tmp/icemaker_global_tempdir.yBSNmWzLXX3J/rustc_testrunner_tmpdir_reporting.O3jHPEVlFwXz/mvce.rs:6:9
|
6 | let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
| ^^^ help: if this is intentional, prefix it with an underscore: `_ptr`
|
= note: `#[warn(unused_variables)]` on by default
warning: fields `0` and `1` are never read
--> /tmp/icemaker_global_tempdir.yBSNmWzLXX3J/rustc_testrunner_tmpdir_reporting.O3jHPEVlFwXz/mvce.rs:1:22
|
1 | struct SliceWithHead(u8, [u8]);
| ------------- ^^ ^^^^
| |
| fields in this struct
|
= note: `#[warn(dead_code)]` on by default
help: consider changing the fields to be of unit type to suppress this warning while preserving the field numbering, or remove the fields
|
1 | struct SliceWithHead((), ());
| ~~ ~~
thread 'rustc' panicked at src/value_and_place.rs:555:13:
assertion `left == right` failed: write_cvalue_transmute: types::I32 -> types::I64
left: 4
right: 8
stack backtrace:
0: 0x7faae7dba766 - std::backtrace_rs::backtrace::libunwind::trace::h7c7ac43538ebe472
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/../../backtrace/src/backtrace/libunwind.rs:104:5
1: 0x7faae7dba766 - std::backtrace_rs::backtrace::trace_unsynchronized::h5508b242c4c12984
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
2: 0x7faae7dba766 - std::sys_common::backtrace::_print_fmt::hd639972598c59b74
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:68:5
3: 0x7faae7dba766 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h698d6e1355cc5d61
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:44:22
4: 0x7faae7e0d100 - core::fmt::rt::Argument::fmt::ha3fb3ddb557a8c28
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/fmt/rt.rs:142:9
5: 0x7faae7e0d100 - core::fmt::write::hae04493f24c53294
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/fmt/mod.rs:1120:17
6: 0x7faae7dae12f - std::io::Write::write_fmt::hf8f7af67b8ad7e8c
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/io/mod.rs:1810:15
7: 0x7faae7dba544 - std::sys_common::backtrace::_print::h06c79c4f31ffa6a6
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:47:5
8: 0x7faae7dba544 - std::sys_common::backtrace::print::h0f43e94a08a21e5b
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:34:9
9: 0x7faae7dbd2d7 - std::panicking::default_hook::{{closure}}::ha3f3b1b60e2c5df1
10: 0x7faae7dbd039 - std::panicking::default_hook::h4c22a752655f027b
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:292:9
11: 0x7faae4b3664c - std[527f01a8ca63601b]::panicking::update_hook::<alloc[9fa6c6532c562875]::boxed::Box<rustc_driver_impl[8792044a82a8625e]::install_ice_hook::{closure#0}>>::{closure#0}
12: 0x7faae7dbda26 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::hd677dcfc0977411a
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2029:9
13: 0x7faae7dbda26 - std::panicking::rust_panic_with_hook::h30a4485d7c627d00
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:785:13
14: 0x7faae7dbd772 - std::panicking::begin_panic_handler::{{closure}}::h5cee7380081e0bc7
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:659:13
15: 0x7faae7dbac66 - std::sys_common::backtrace::__rust_end_short_backtrace::h5ce5b16fec0dd4af
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:171:18
16: 0x7faae7dbd4c4 - rust_begin_unwind
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:647:5
17: 0x7faae7e09805 - core::panicking::panic_fmt::h0ecda8cbe1cd9e47
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/panicking.rs:72:14
18: 0x7faae7e09e7f - core::panicking::assert_failed_inner::hefd49e818054cbff
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/panicking.rs:337:23
19: 0x7faad85c205f - core[9bbc21a9b33808e2]::panicking::assert_failed::<u32, u32>
20: 0x7faad86595b0 - <rustc_codegen_cranelift[ec19655ba85fdac8]::value_and_place::CPlace>::write_cvalue_maybe_transmute::transmute_scalar
21: 0x7faad865905f - <rustc_codegen_cranelift[ec19655ba85fdac8]::value_and_place::CPlace>::write_cvalue_maybe_transmute
22: 0x7faad860b26e - rustc_codegen_cranelift[ec19655ba85fdac8]::base::codegen_fn_body
23: 0x7faad8622e6c - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::module_codegen::{closure#0}
24: 0x7faad861ff52 - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::module_codegen
25: 0x7faad862cabf - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::run_aot
26: 0x7faad865bdbc - <rustc_codegen_cranelift[ec19655ba85fdac8]::CraneliftCodegenBackend as rustc_codegen_ssa[6a3d55d079e415ff]::traits::backend::CodegenBackend>::codegen_crate
27: 0x7faae6861430 - rustc_interface[d556da9ff3a1cc86]::passes::start_codegen
28: 0x7faae6860b70 - <rustc_interface[d556da9ff3a1cc86]::queries::Queries>::codegen_and_build_linker
29: 0x7faae6b104cc - rustc_interface[d556da9ff3a1cc86]::interface::run_compiler::<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}
30: 0x7faae67abe46 - std[527f01a8ca63601b]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_with_globals<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_pool_with_globals<rustc_interface[d556da9ff3a1cc86]::interface::run_compiler<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>
31: 0x7faae67abc73 - <<std[527f01a8ca63601b]::thread::Builder>::spawn_unchecked_<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_with_globals<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_pool_with_globals<rustc_interface[d556da9ff3a1cc86]::interface::run_compiler<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#1} as core[9bbc21a9b33808e2]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
32: 0x7faae7dc7015 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h2bd4aab73c5ae314
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2015:9
33: 0x7faae7dc7015 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::ha809079e7c8fd129
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2015:9
34: 0x7faae7dc7015 - std::sys::pal::unix::thread::Thread::new::thread_start::he1a55fca7da552da
at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys/pal/unix/thread.rs:108:17
35: 0x7faae1caa9eb - <unknown>
36: 0x7faae1d2e7cc - <unknown>
37: 0x0 - <unknown>
error: the compiler unexpectedly panicked. this is a bug.
note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md
note: rustc 1.77.0-nightly (af08c64e3 2024-01-29) running on x86_64-unknown-linux-gnu
note: compiler flags: -Z mir-opt-level=5 -Z codegen-backend=cranelift -Z dump-mir-dir=dir
query stack during panic:
end of query stack
warning: 2 warnings emitted