rust-lang / rust-lang/rustc_codegen_cranelift

ICE `assertion `left == right` failed: write_cvalue_transmute: types::I32 -> types::I64`

Open
#1,452 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

C-bug
Dominant language
Rust
Stars
2.1k
Forks
157
Avg merge
1d 19h
Merged PRs (30d)
3

Description

auto-reduced (treereduce-rust):

struct SliceWithHead(u8, [u8]);

fn main() {
    let buf = [0u32; 1];

    let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
}

original:

// should find the bug even without retagging
//@compile-flags: -Zmiri-disable-stacked-borrows

struct SliceWithHead(#[allow(dead_code)] u8, #[allow(dead_code)] [u8]);

fn main() {
    let buf = [0u32; 1];
    // We craft a wide pointer `*const SliceWithHead` such that the unsized tail is only partially allocated.
    // That should lead to UB, as the reference is not fully dereferenceable.
    let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
    // Re-borrow that. This should be UB.
    let _ptr = unsafe { &*ptr }; //~ ERROR: encountered a dangling reference (going beyond the bounds of its allocation)
}

Version information

rustc 1.77.0-nightly (af08c64e3 2024-01-29)
binary: rustc
commit-hash: af08c64e3800fd15f0afdb8651de8fa7dacc0026
commit-date: 2024-01-29
host: x86_64-unknown-linux-gnu
release: 1.77.0-nightly
LLVM version: 17.0.6

Command:
/home/matthias/.rustup/toolchains/master/bin/rustc -Zmir-opt-level=5 -Zcodegen-backend=cranelift

Program output 

warning: unused variable: `ptr`
 --> /tmp/icemaker_global_tempdir.yBSNmWzLXX3J/rustc_testrunner_tmpdir_reporting.O3jHPEVlFwXz/mvce.rs:6:9
  |
6 |     let ptr: *const SliceWithHead = unsafe { std::mem::transmute((&buf, 1)) };
  |         ^^^ help: if this is intentional, prefix it with an underscore: `_ptr`
  |
  = note: `#[warn(unused_variables)]` on by default

warning: fields `0` and `1` are never read
 --> /tmp/icemaker_global_tempdir.yBSNmWzLXX3J/rustc_testrunner_tmpdir_reporting.O3jHPEVlFwXz/mvce.rs:1:22
  |
1 | struct SliceWithHead(u8, [u8]);
  |        ------------- ^^  ^^^^
  |        |
  |        fields in this struct
  |
  = note: `#[warn(dead_code)]` on by default
help: consider changing the fields to be of unit type to suppress this warning while preserving the field numbering, or remove the fields
  |
1 | struct SliceWithHead((), ());
  |                      ~~  ~~

thread 'rustc' panicked at src/value_and_place.rs:555:13:
assertion `left == right` failed: write_cvalue_transmute: types::I32 -> types::I64
  left: 4
 right: 8
stack backtrace:
   0:     0x7faae7dba766 - std::backtrace_rs::backtrace::libunwind::trace::h7c7ac43538ebe472
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/../../backtrace/src/backtrace/libunwind.rs:104:5
   1:     0x7faae7dba766 - std::backtrace_rs::backtrace::trace_unsynchronized::h5508b242c4c12984
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7faae7dba766 - std::sys_common::backtrace::_print_fmt::hd639972598c59b74
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:68:5
   3:     0x7faae7dba766 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h698d6e1355cc5d61
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x7faae7e0d100 - core::fmt::rt::Argument::fmt::ha3fb3ddb557a8c28
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/fmt/rt.rs:142:9
   5:     0x7faae7e0d100 - core::fmt::write::hae04493f24c53294
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/fmt/mod.rs:1120:17
   6:     0x7faae7dae12f - std::io::Write::write_fmt::hf8f7af67b8ad7e8c
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/io/mod.rs:1810:15
   7:     0x7faae7dba544 - std::sys_common::backtrace::_print::h06c79c4f31ffa6a6
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:47:5
   8:     0x7faae7dba544 - std::sys_common::backtrace::print::h0f43e94a08a21e5b
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:34:9
   9:     0x7faae7dbd2d7 - std::panicking::default_hook::{{closure}}::ha3f3b1b60e2c5df1
  10:     0x7faae7dbd039 - std::panicking::default_hook::h4c22a752655f027b
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:292:9
  11:     0x7faae4b3664c - std[527f01a8ca63601b]::panicking::update_hook::<alloc[9fa6c6532c562875]::boxed::Box<rustc_driver_impl[8792044a82a8625e]::install_ice_hook::{closure#0}>>::{closure#0}
  12:     0x7faae7dbda26 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::hd677dcfc0977411a
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2029:9
  13:     0x7faae7dbda26 - std::panicking::rust_panic_with_hook::h30a4485d7c627d00
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:785:13
  14:     0x7faae7dbd772 - std::panicking::begin_panic_handler::{{closure}}::h5cee7380081e0bc7
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:659:13
  15:     0x7faae7dbac66 - std::sys_common::backtrace::__rust_end_short_backtrace::h5ce5b16fec0dd4af
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys_common/backtrace.rs:171:18
  16:     0x7faae7dbd4c4 - rust_begin_unwind
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/panicking.rs:647:5
  17:     0x7faae7e09805 - core::panicking::panic_fmt::h0ecda8cbe1cd9e47
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/panicking.rs:72:14
  18:     0x7faae7e09e7f - core::panicking::assert_failed_inner::hefd49e818054cbff
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/core/src/panicking.rs:337:23
  19:     0x7faad85c205f - core[9bbc21a9b33808e2]::panicking::assert_failed::<u32, u32>
  20:     0x7faad86595b0 - <rustc_codegen_cranelift[ec19655ba85fdac8]::value_and_place::CPlace>::write_cvalue_maybe_transmute::transmute_scalar
  21:     0x7faad865905f - <rustc_codegen_cranelift[ec19655ba85fdac8]::value_and_place::CPlace>::write_cvalue_maybe_transmute
  22:     0x7faad860b26e - rustc_codegen_cranelift[ec19655ba85fdac8]::base::codegen_fn_body
  23:     0x7faad8622e6c - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::module_codegen::{closure#0}
  24:     0x7faad861ff52 - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::module_codegen
  25:     0x7faad862cabf - rustc_codegen_cranelift[ec19655ba85fdac8]::driver::aot::run_aot
  26:     0x7faad865bdbc - <rustc_codegen_cranelift[ec19655ba85fdac8]::CraneliftCodegenBackend as rustc_codegen_ssa[6a3d55d079e415ff]::traits::backend::CodegenBackend>::codegen_crate
  27:     0x7faae6861430 - rustc_interface[d556da9ff3a1cc86]::passes::start_codegen
  28:     0x7faae6860b70 - <rustc_interface[d556da9ff3a1cc86]::queries::Queries>::codegen_and_build_linker
  29:     0x7faae6b104cc - rustc_interface[d556da9ff3a1cc86]::interface::run_compiler::<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}
  30:     0x7faae67abe46 - std[527f01a8ca63601b]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_with_globals<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_pool_with_globals<rustc_interface[d556da9ff3a1cc86]::interface::run_compiler<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>
  31:     0x7faae67abc73 - <<std[527f01a8ca63601b]::thread::Builder>::spawn_unchecked_<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_with_globals<rustc_interface[d556da9ff3a1cc86]::util::run_in_thread_pool_with_globals<rustc_interface[d556da9ff3a1cc86]::interface::run_compiler<core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>, rustc_driver_impl[8792044a82a8625e]::run_compiler::{closure#0}>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[9bbc21a9b33808e2]::result::Result<(), rustc_span[db02a72bff8b29a5]::ErrorGuaranteed>>::{closure#1} as core[9bbc21a9b33808e2]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  32:     0x7faae7dc7015 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h2bd4aab73c5ae314
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2015:9
  33:     0x7faae7dc7015 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::ha809079e7c8fd129
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/alloc/src/boxed.rs:2015:9
  34:     0x7faae7dc7015 - std::sys::pal::unix::thread::Thread::new::thread_start::he1a55fca7da552da
                               at /rustc/af08c64e3800fd15f0afdb8651de8fa7dacc0026/library/std/src/sys/pal/unix/thread.rs:108:17
  35:     0x7faae1caa9eb - <unknown>
  36:     0x7faae1d2e7cc - <unknown>
  37:                0x0 - <unknown>

error: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.77.0-nightly (af08c64e3 2024-01-29) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z mir-opt-level=5 -Z codegen-backend=cranelift -Z dump-mir-dir=dir

query stack during panic:
end of query stack
warning: 2 warnings emitted

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with src/value_and_place.rs at CPlace::write_cvalue_maybe_transmute, then run the reduced Rust program with -Zmir-opt-level=5 and -Zcodegen-backend=cranelift. Investigate the I32-to-I64 assertion in the transmute path and add coverage for the reduced case; done means the compiler no longer panics on this input.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.