Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too #129392

compiler-errors · 2024-08-22T03:30:32Z

This PR implements a heuristic which disables two things that are currently being performed on the HIR when we have expressions that involve place-like expressions that point to !. Specifically, it will (in certain cases explained below):

(1.) Disable the `NeverToAny` coercion we implicitly insert for `!`.

Which fixes this inadvertent, sneaky unsoundness:

unsafe {
    let x: *const ! = &0 as *const u8 as *const !;
    let _: () = *x;
}

which is UB because currently rust emits an implicit NeverToAny coercion even though we really shouldn't be, since there's no read of the value pointed by x.

(2.) Disable the logic which considers expression which evaluate to `!` to diverge, which affects the type returned by the containing block.

Which fixes this unsoundness:

fn make_up_a_value<T>() -> T {
    unsafe {
        let x: *const ! = &0 as *const u8 as *const !;
        let _ = *x;
    }
}

We disable these two operations if the expression is a place-like expression (locals, statics, field projections, index operations, and deref operations), and if the parent expression is either:
(1.) the LHS of an assignment
(2.) AddrOf
(3.) A match or let unless all of the patterns consitute a read, which is explained below:

And finally, a pattern currently is considered to constitute a read unless it is a wildcard, or an OR pattern. An OR pattern is considered to constitute a read if all of its subpatterns constitute a read, to remain as conservative as possible in cases like _ | subpat or subpat | _.

All other patterns are considered currently to constitute a read. Specifically, because NeverToAny is a coercion performed on a value and not a place, Struct { .. } on a ! type must be a coercion currently, and we currently rely on this behavior to allow us to perform coercions like let _: i32 = x; where x: !.

This is already considered UB by miri, but also means it does not affect the preexisting UB in this case:

let Struct { .. } = *never_ptr;

Even though it's likely up for debate since we're not actually reading any data out of the struct, it almost certainly causes inference changes which I do NOT want to fix in this PR.

compiler-errors · 2024-08-22T03:30:36Z

@bors try

…verge-but-more, r=<try> [EXPERIMENT] Do not consider match/let/raw-ref of deref that evalautes to ! to diverge This is the more involved version of rust-lang#129371. It doesn't fully fix rust-lang#117288, since we still need to fix the fact that never type fallback can cause an unintended load via the `NeverToAny` coercion. But I did want to probe crater to see if anyone relies on this behavior currently, since that's almost certainly UB. r? `@ghost`

bors · 2024-08-22T03:31:47Z

⌛ Trying commit 5250e5d with merge 4096397...

bors · 2024-08-22T05:24:59Z

☀️ Try build successful - checks-actions
Build commit: 4096397 (4096397122f3daf755d7a75d9716317f02ae7690)

compiler-errors · 2024-08-22T15:35:24Z

@bors try

bors · 2024-08-22T15:36:35Z

⌛ Trying commit 1ee0400 with merge 3254088...

…verge-but-more, r=<try> [EXPERIMENT] Do not consider match/let/raw-ref of deref that evalautes to ! to diverge This is the more involved version of rust-lang#129371. It's pretty ugly rn. r? `@ghost`

compiler-errors · 2024-08-22T15:43:28Z

@bors try

…verge-but-more, r=<try> [EXPERIMENT] Do not consider match/let/raw-ref of deref that evalautes to ! to diverge This is the more involved version of rust-lang#129371. It's pretty ugly rn. r? `@ghost`

bors · 2024-08-22T15:44:38Z

⌛ Trying commit 9bb136b with merge de0e806...

bors · 2024-08-22T17:40:38Z

☀️ Try build successful - checks-actions
Build commit: de0e806 (de0e80659cee4f27282e60d63bbb8c5271a0d147)

compiler-errors · 2024-08-22T17:50:07Z

@craterbot check

craterbot · 2024-08-22T17:50:22Z

👌 Experiment pr-129392 created and queued.
🤖 Automatically detected try build de0e806
🔍 You can check out the queue and this experiment's details.

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

[CRATER] Crater Rollup This is a " crater rollup" of: * rust-lang#126452 * rust-lang#128784 * rust-lang#129392 * rust-lang#129422 * rust-lang#129543 **What is a crater rollup?** It's simply a crater job that is run on all of the containing PRs *together*, and then we can set the crates list for each of these jobs to just the failures after it's done. It should cut out on the bulk of "normal" crates that do nothing and simply just take time to build. r? `@ghost`

[CRATER] Crater Rollup This is a " crater rollup" of: * rust-lang#126452 * rust-lang#128784 * rust-lang#129392 * rust-lang#129422 * rust-lang#129543 * rust-lang#129604 **What is a crater rollup?** It's simply a crater job that is run on all of the containing PRs *together*, and then we can set the crates list for each of these jobs to just the failures after it's done. It should cut out on the bulk of "normal" crates that do nothing and simply just take time to build. r? `@ghost`

compiler-errors · 2024-08-31T12:23:04Z

@craterbot crates=https://gist.githubusercontent.com/compiler-errors/4a09d64cd15dc3dca50edeea26cc9938/raw/b4181c225709e120a11d91cce69d0d4da3e652d0/regressed.txt

craterbot · 2024-08-31T12:23:16Z

📝 Configuration of the pr-129392 experiment changed.

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

traviscross · 2024-08-31T20:35:43Z

@craterbot p=1

(Bump priority is this will run quickly.)

craterbot · 2024-08-31T20:35:45Z

📝 Configuration of the pr-129392 experiment changed.

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

craterbot · 2024-08-31T22:54:26Z

🚧 Experiment pr-129392 is now running

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

craterbot · 2024-09-01T03:26:28Z

🎉 Experiment pr-129392 is completed!
📊 0 regressed and 1 fixed (98236 total)
📰 Open the full report.

⚠️ If you notice any spurious failure please add them to the blacklist!
ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

…eck_expr_has_type_or_error

compiler-errors · 2024-10-05T23:12:14Z

Rebased to add a match arm for new node type.

@bors r=lcnr

bors · 2024-10-05T23:12:17Z

📌 Commit e8d5eb2 has been approved by lcnr

It is now in the queue for this repository.

…verge-but-more, r=lcnr Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too Fixes rust-lang#117288. This PR implements a heuristic which disables two things that are currently being performed on the HIR when we have **expressions that involve place-like expressions that point to `!`**. Specifically, it will (in certain cases explained below): ### (1.) Disable the `NeverToAny` coercion we implicitly insert for `!`. Which fixes this inadvertent, sneaky unsoundness: ``` unsafe { let x: *const ! = &0 as *const u8 as *const !; let _: () = *x; } ``` which is UB because currently rust emits an *implicit* NeverToAny coercion even though we really shouldn't be, since there's no read of the value pointed by `x`. ### (2.) Disable the logic which considers expression which evaluate to `!` to diverge, which affects the type returned by the containing block. Which fixes this unsoundness: ``` fn make_up_a_value<T>() -> T { unsafe { let x: *const ! = &0 as *const u8 as *const !; let _ = *x; } } ``` We disable these two operations **if** the expression is a place-like expression (locals, statics, field projections, index operations, and deref operations), and if the parent expression is either: (1.) the LHS of an assignment (2.) AddrOf (3.) A match or let **unless** all of the *patterns consitute a read*, which is explained below: And finally, a pattern currently is considered to constitute a read **unless** it is a wildcard, or an OR pattern. An OR pattern is considered to constitute a read if all of its subpatterns constitute a read, to remain as conservative as possible in cases like `_ | subpat` or `subpat | _`. All other patterns are considered currently to constitute a read. Specifically, because `NeverToAny` is a coercion performed on a *value* and not a *place*, `Struct { .. }` on a `!` type must be a coercion currently, and we currently rely on this behavior to allow us to perform coercions like `let _: i32 = x;` where `x: !`. This is already considered UB by [miri](https://play.rust-lang.org/?version=nightly&mode=debug&edition=2021&gist=daf3a2246433fe43fdc07d1389c276c9), but also means it does not affect the preexisting UB in this case: ``` let Struct { .. } = *never_ptr; ``` Even though it's likely up for debate since we're not actually reading any data out of the struct, it almost certainly causes inference changes which I do *NOT* want to fix in this PR.

bors · 2024-10-06T01:49:38Z

⌛ Testing commit e8d5eb2 with merge a3e3233...

rust-log-analyzer · 2024-10-06T01:55:05Z

A job failed! Check out the build log: (web) (plain)

Click to see the possible cause of the failure (guessed by this bot)

bors · 2024-10-06T01:55:32Z

💔 Test failed - checks-actions

compiler-errors · 2024-10-06T08:46:22Z

@bors retry

…iaskrgr Rollup of 5 pull requests Successful merges: - rust-lang#129392 (Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too) - rust-lang#131279 (update "build/host" symlink comment) - rust-lang#131312 (On function and method calls in patterns, link to the book) - rust-lang#131315 (bootstrap: add `std_features` config) - rust-lang#131316 (Fix typo in primitive_docs.rs) r? `@ghost` `@rustbot` modify labels: rollup

…verge-but-more, r=lcnr Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too Fixes rust-lang#117288. This PR implements a heuristic which disables two things that are currently being performed on the HIR when we have **expressions that involve place-like expressions that point to `!`**. Specifically, it will (in certain cases explained below): ### (1.) Disable the `NeverToAny` coercion we implicitly insert for `!`. Which fixes this inadvertent, sneaky unsoundness: ``` unsafe { let x: *const ! = &0 as *const u8 as *const !; let _: () = *x; } ``` which is UB because currently rust emits an *implicit* NeverToAny coercion even though we really shouldn't be, since there's no read of the value pointed by `x`. ### (2.) Disable the logic which considers expression which evaluate to `!` to diverge, which affects the type returned by the containing block. Which fixes this unsoundness: ``` fn make_up_a_value<T>() -> T { unsafe { let x: *const ! = &0 as *const u8 as *const !; let _ = *x; } } ``` We disable these two operations **if** the expression is a place-like expression (locals, statics, field projections, index operations, and deref operations), and if the parent expression is either: (1.) the LHS of an assignment (2.) AddrOf (3.) A match or let **unless** all of the *patterns consitute a read*, which is explained below: And finally, a pattern currently is considered to constitute a read **unless** it is a wildcard, or an OR pattern. An OR pattern is considered to constitute a read if all of its subpatterns constitute a read, to remain as conservative as possible in cases like `_ | subpat` or `subpat | _`. All other patterns are considered currently to constitute a read. Specifically, because `NeverToAny` is a coercion performed on a *value* and not a *place*, `Struct { .. }` on a `!` type must be a coercion currently, and we currently rely on this behavior to allow us to perform coercions like `let _: i32 = x;` where `x: !`. This is already considered UB by [miri](https://play.rust-lang.org/?version=nightly&mode=debug&edition=2021&gist=daf3a2246433fe43fdc07d1389c276c9), but also means it does not affect the preexisting UB in this case: ``` let Struct { .. } = *never_ptr; ``` Even though it's likely up for debate since we're not actually reading any data out of the struct, it almost certainly causes inference changes which I do *NOT* want to fix in this PR.

bors · 2024-10-06T11:28:35Z

⌛ Testing commit e8d5eb2 with merge c2c0e52...

matthiaskrgr · 2024-10-06T11:41:59Z

@bors retry
yielding to #131320

…iaskrgr Rollup of 5 pull requests Successful merges: - rust-lang#129392 (Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too) - rust-lang#131279 (update "build/host" symlink comment) - rust-lang#131312 (On function and method calls in patterns, link to the book) - rust-lang#131315 (bootstrap: add `std_features` config) - rust-lang#131316 (Fix typo in primitive_docs.rs) r? `@ghost` `@rustbot` modify labels: rollup

Rollup merge of rust-lang#129392 - compiler-errors:raw-ref-op-doesnt-diverge-but-more, r=lcnr Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too Fixes rust-lang#117288. This PR implements a heuristic which disables two things that are currently being performed on the HIR when we have **expressions that involve place-like expressions that point to `!`**. Specifically, it will (in certain cases explained below): ### (1.) Disable the `NeverToAny` coercion we implicitly insert for `!`. Which fixes this inadvertent, sneaky unsoundness: ``` unsafe { let x: *const ! = &0 as *const u8 as *const !; let _: () = *x; } ``` which is UB because currently rust emits an *implicit* NeverToAny coercion even though we really shouldn't be, since there's no read of the value pointed by `x`. ### (2.) Disable the logic which considers expression which evaluate to `!` to diverge, which affects the type returned by the containing block. Which fixes this unsoundness: ``` fn make_up_a_value<T>() -> T { unsafe { let x: *const ! = &0 as *const u8 as *const !; let _ = *x; } } ``` We disable these two operations **if** the expression is a place-like expression (locals, statics, field projections, index operations, and deref operations), and if the parent expression is either: (1.) the LHS of an assignment (2.) AddrOf (3.) A match or let **unless** all of the *patterns consitute a read*, which is explained below: And finally, a pattern currently is considered to constitute a read **unless** it is a wildcard, or an OR pattern. An OR pattern is considered to constitute a read if all of its subpatterns constitute a read, to remain as conservative as possible in cases like `_ | subpat` or `subpat | _`. All other patterns are considered currently to constitute a read. Specifically, because `NeverToAny` is a coercion performed on a *value* and not a *place*, `Struct { .. }` on a `!` type must be a coercion currently, and we currently rely on this behavior to allow us to perform coercions like `let _: i32 = x;` where `x: !`. This is already considered UB by [miri](https://play.rust-lang.org/?version=nightly&mode=debug&edition=2021&gist=daf3a2246433fe43fdc07d1389c276c9), but also means it does not affect the preexisting UB in this case: ``` let Struct { .. } = *never_ptr; ``` Even though it's likely up for debate since we're not actually reading any data out of the struct, it almost certainly causes inference changes which I do *NOT* want to fix in this PR.

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. labels Aug 22, 2024

RalfJung mentioned this pull request Aug 22, 2024

Special-case raw ref op for diverging check in HIR typeck #129371

Closed

compiler-errors force-pushed the raw-ref-op-doesnt-diverge-but-more branch from 5250e5d to 1ee0400 Compare August 22, 2024 15:35

This comment has been minimized.

Sign in to view

craterbot added S-waiting-on-crater Status: Waiting on a crater run to be completed. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Aug 22, 2024

compiler-errors mentioned this pull request Aug 27, 2024

[CRATER] Crater Rollup #129660

Closed

This comment has been minimized.

Sign in to view

compiler-errors added 6 commits October 5, 2024 18:36

Evaluating place expr that is never read from does not diverge

6371ef6

Do not coerce places if they do not constitute reads

5193c21

Fix up tests

73d49f8

Document things a bit more carefully, also account for coercion in ch…

515b932

…eck_expr_has_type_or_error

Be more thorough in expr_constitutes_read

d2bd018

Be far more strict about what we consider to be a read of never

e8d5eb2

compiler-errors force-pushed the raw-ref-op-doesnt-diverge-but-more branch from 8e0621e to e8d5eb2 Compare October 5, 2024 23:10

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Oct 5, 2024

bors added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. labels Oct 6, 2024

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Oct 6, 2024

matthiaskrgr mentioned this pull request Oct 6, 2024

Rollup of 5 pull requests #131320

Merged

bors merged commit 9aaebd4 into rust-lang:master Oct 6, 2024
6 of 7 checks passed

rustbot added this to the 1.83.0 milestone Oct 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too #129392

Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too #129392

compiler-errors commented Aug 22, 2024 •

edited

Loading

compiler-errors commented Aug 22, 2024

bors commented Aug 22, 2024

bors commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

bors commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

bors commented Aug 22, 2024

This comment has been minimized.

bors commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

craterbot commented Aug 22, 2024

compiler-errors commented Aug 31, 2024

craterbot commented Aug 31, 2024

traviscross commented Aug 31, 2024

craterbot commented Aug 31, 2024

craterbot commented Aug 31, 2024

craterbot commented Sep 1, 2024

This comment has been minimized.

compiler-errors commented Oct 5, 2024

bors commented Oct 5, 2024

bors commented Oct 6, 2024

rust-log-analyzer commented Oct 6, 2024

bors commented Oct 6, 2024

compiler-errors commented Oct 6, 2024

bors commented Oct 6, 2024

matthiaskrgr commented Oct 6, 2024

Do not consider match/let/ref of place that evaluates to ! to diverge, disallow coercions from them too #129392

Do not consider match/let/ref of place that evaluates to ! to diverge, disallow coercions from them too #129392

Conversation

compiler-errors commented Aug 22, 2024 • edited Loading

(1.) Disable the NeverToAny coercion we implicitly insert for !.

(2.) Disable the logic which considers expression which evaluate to ! to diverge, which affects the type returned by the containing block.

compiler-errors commented Aug 22, 2024

bors commented Aug 22, 2024

bors commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

bors commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

bors commented Aug 22, 2024

This comment has been minimized.

bors commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

craterbot commented Aug 22, 2024

compiler-errors commented Aug 31, 2024

craterbot commented Aug 31, 2024

traviscross commented Aug 31, 2024

craterbot commented Aug 31, 2024

craterbot commented Aug 31, 2024

craterbot commented Sep 1, 2024

This comment has been minimized.

compiler-errors commented Oct 5, 2024

bors commented Oct 5, 2024

bors commented Oct 6, 2024

rust-log-analyzer commented Oct 6, 2024

bors commented Oct 6, 2024

compiler-errors commented Oct 6, 2024

bors commented Oct 6, 2024

matthiaskrgr commented Oct 6, 2024

Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too #129392

Do not consider match/let/ref of place that evaluates to `!` to diverge, disallow coercions from them too #129392

compiler-errors commented Aug 22, 2024 •

edited

Loading

(1.) Disable the `NeverToAny` coercion we implicitly insert for `!`.

(2.) Disable the logic which considers expression which evaluate to `!` to diverge, which affects the type returned by the containing block.