ICE: "dyn call index points at something that is not a method"

[matthiaskrgr]

code from rustc ./src/test/ui/issues/issue-50781.rs

#![deny(where_clauses_object_safety)]

trait Trait {}

trait X {
    fn foo(&self) where Self: Trait; //~ ERROR the trait `X` cannot be made into an object
    //~^ WARN this was previously accepted by the compiler but is being phased out
}

impl X for () {
    fn foo(&self) {}
}

impl Trait for dyn X {}

pub fn main() {
    // Check that this does not segfault.
    <dyn X as X>::foo(&());
}

cargo miri run

WARNING: Ignoring `RUSTC_WRAPPER` environment variable, Miri does not support wrapping.
    Finished dev [unoptimized + debuginfo] target(s) in 0.02s
     Running `/home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/cargo-miri target/miri/x86_64-unknown-linux-gnu/debug/m`
error: the trait `X` cannot be made into an object
 --> src/main.rs:6:8
  |
6 |     fn foo(&self) where Self: Trait; //~ ERROR the trait `X` cannot be made into an object
  |        ^^^
  |
note: the lint level is defined here
 --> src/main.rs:1:9
  |
1 | #![deny(where_clauses_object_safety)]
  |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  = warning: this was previously accepted by the compiler but is being phased out; it will become a hard error in a future release!
  = note: for more information, see issue #51443 <https://github.com/rust-lang/rust/issues/51443>
note: for a trait to be "object safe" it needs to allow building a vtable to allow the call to be resolvable dynamically; for more information visit <https://doc.rust-lang.org/reference/items/traits.html#object-safety>
 --> src/main.rs:6:8
  |
5 | trait X {
  |       - this trait cannot be made into an object...
6 |     fn foo(&self) where Self: Trait; //~ ERROR the trait `X` cannot be made into an object
  |        ^^^ ...because method `foo` references the `Self` type in its `where` clause
  = help: consider moving `foo` to another trait

error: internal compiler error: /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/compiler/rustc_const_eval/src/interpret/terminator.rs:575:21: dyn call index points at something that is not a method
  --> src/main.rs:18:5
   |
18 |     <dyn X as X>::foo(&());
   |     ^^^^^^^^^^^^^^^^^^^^^^

thread 'rustc' panicked at 'Box<dyn Any>', /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/compiler/rustc_errors/src/lib.rs:1332:9
stack backtrace:
   0:     0x7ff5ae0a37a0 - std::backtrace_rs::backtrace::libunwind::trace::h763ecd2b1c94eb47
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   1:     0x7ff5ae0a37a0 - std::backtrace_rs::backtrace::trace_unsynchronized::h7346e33da5e91dc9
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7ff5ae0a37a0 - std::sys_common::backtrace::_print_fmt::h8ca9befc16375e7f
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/sys_common/backtrace.rs:66:5
   3:     0x7ff5ae0a37a0 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h35a76e8acc949815
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/sys_common/backtrace.rs:45:22
   4:     0x7ff5ae0fda2c - core::fmt::write::h1966177bbb3b1b76
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/core/src/fmt/mod.rs:1198:17
   5:     0x7ff5ae094f85 - std::io::Write::write_fmt::he17142a652adbfaa
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/io/mod.rs:1672:15
   6:     0x7ff5ae0a6471 - std::sys_common::backtrace::_print::h58fd682547bc6ff7
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/sys_common/backtrace.rs:48:5
   7:     0x7ff5ae0a6471 - std::sys_common::backtrace::print::hb71ddfedfd79ba3f
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/sys_common/backtrace.rs:35:9
   8:     0x7ff5ae0a6471 - std::panicking::default_hook::{{closure}}::h866ffdcbb9391663
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/panicking.rs:295:22
   9:     0x7ff5ae0a6143 - std::panicking::default_hook::hc53d610bee87e7b5
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/panicking.rs:314:9
  10:     0x7ff5ae953731 - rustc_driver[ee492072531d29b9]::DEFAULT_HOOK::{closure#0}::{closure#0}
  11:     0x7ff5ae0a6c46 - std::panicking::rust_panic_with_hook::h1f2457f8494b1ce0
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/panicking.rs:702:17
  12:     0x56324ed3c183 - std[af12de6c3337c1b7]::panicking::begin_panic::<rustc_errors[30e8870fe27fb8ba]::ExplicitBug>::{closure#0}
  13:     0x56324ed3b7e6 - std[af12de6c3337c1b7]::sys_common::backtrace::__rust_end_short_backtrace::<std[af12de6c3337c1b7]::panicking::begin_panic<rustc_errors[30e8870fe27fb8ba]::ExplicitBug>::{closure#0}, !>
  14:     0x56324ec601b6 - std[af12de6c3337c1b7]::panicking::begin_panic::<rustc_errors[30e8870fe27fb8ba]::ExplicitBug>
  15:     0x56324ecfa3d6 - std[af12de6c3337c1b7]::panic::panic_any::<rustc_errors[30e8870fe27fb8ba]::ExplicitBug>
  16:     0x56324ecf68f3 - <rustc_errors[30e8870fe27fb8ba]::HandlerInner>::span_bug::<rustc_span[e8a062c38fd06fcf]::span_encoding::Span, &alloc[327c298d5f7f3986]::string::String>
  17:     0x56324ecf64f0 - <rustc_errors[30e8870fe27fb8ba]::Handler>::span_bug::<rustc_span[e8a062c38fd06fcf]::span_encoding::Span, &alloc[327c298d5f7f3986]::string::String>
  18:     0x56324ecfa60e - rustc_middle[ba567b0c63397382]::ty::context::tls::with_context_opt::<rustc_middle[ba567b0c63397382]::ty::context::tls::with_opt<rustc_middle[ba567b0c63397382]::util::bug::opt_span_bug_fmt<rustc_span[e8a062c38fd06fcf]::span_encoding::Span>::{closure#0}, ()>::{closure#0}, ()>
  19:     0x56324ecfa449 - rustc_middle[ba567b0c63397382]::util::bug::opt_span_bug_fmt::<rustc_span[e8a062c38fd06fcf]::span_encoding::Span>
  20:     0x56324ec5eae7 - rustc_middle[ba567b0c63397382]::util::bug::span_bug_fmt::<rustc_span[e8a062c38fd06fcf]::span_encoding::Span>
  21:     0x56324ed585db - <rustc_const_eval[fabfa6a4d198841f]::interpret::eval_context::InterpCx<miri[ab945d3d15ab0ad0]::machine::Evaluator>>::eval_fn_call
  22:     0x56324ed5e77a - <rustc_const_eval[fabfa6a4d198841f]::interpret::eval_context::InterpCx<miri[ab945d3d15ab0ad0]::machine::Evaluator>>::terminator
  23:     0x56324ed33c3d - <core[7b47b893e00d8dca]::panic::unwind_safe::AssertUnwindSafe<miri[ab945d3d15ab0ad0]::eval::eval_entry::{closure#0}> as core[7b47b893e00d8dca]::ops::function::FnOnce<()>>::call_once
  24:     0x56324ed12e6c - miri[ab945d3d15ab0ad0]::eval::eval_entry
  25:     0x56324ec67c89 - <rustc_interface[c2045ebdcb88575c]::passes::QueryContext>::enter::<<miri[a2bdd18a035b3443]::MiriCompilerCalls as rustc_driver[ee492072531d29b9]::Callbacks>::after_analysis::{closure#0}, ()>
  26:     0x56324ec6c653 - <miri[a2bdd18a035b3443]::MiriCompilerCalls as rustc_driver[ee492072531d29b9]::Callbacks>::after_analysis
  27:     0x7ff5b0b06c8b - <rustc_interface[c2045ebdcb88575c]::interface::Compiler>::enter::<rustc_driver[ee492072531d29b9]::run_compiler::{closure#1}::{closure#2}, core[7b47b893e00d8dca]::result::Result<core[7b47b893e00d8dca]::option::Option<rustc_interface[c2045ebdcb88575c]::queries::Linker>, rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>>
  28:     0x7ff5b0b02f3a - rustc_span[e8a062c38fd06fcf]::with_source_map::<core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>, rustc_interface[c2045ebdcb88575c]::interface::create_compiler_and_run<core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>, rustc_driver[ee492072531d29b9]::run_compiler::{closure#1}>::{closure#1}>
  29:     0x7ff5b0b1f360 - rustc_interface[c2045ebdcb88575c]::interface::create_compiler_and_run::<core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>, rustc_driver[ee492072531d29b9]::run_compiler::{closure#1}>
  30:     0x7ff5b0b33362 - <scoped_tls[7afe57960397b723]::ScopedKey<rustc_span[e8a062c38fd06fcf]::SessionGlobals>>::set::<rustc_interface[c2045ebdcb88575c]::interface::run_compiler<core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>, rustc_driver[ee492072531d29b9]::run_compiler::{closure#1}>::{closure#0}, core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>>
  31:     0x7ff5b0b0532f - std[af12de6c3337c1b7]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[c2045ebdcb88575c]::util::run_in_thread_pool_with_globals<rustc_interface[c2045ebdcb88575c]::interface::run_compiler<core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>, rustc_driver[ee492072531d29b9]::run_compiler::{closure#1}>::{closure#0}, core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>>::{closure#0}, core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>>
  32:     0x7ff5b0b1f7b9 - <<std[af12de6c3337c1b7]::thread::Builder>::spawn_unchecked_<rustc_interface[c2045ebdcb88575c]::util::run_in_thread_pool_with_globals<rustc_interface[c2045ebdcb88575c]::interface::run_compiler<core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>, rustc_driver[ee492072531d29b9]::run_compiler::{closure#1}>::{closure#0}, core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>>::{closure#0}, core[7b47b893e00d8dca]::result::Result<(), rustc_errors[30e8870fe27fb8ba]::ErrorGuaranteed>>::{closure#1} as core[7b47b893e00d8dca]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  33:     0x7ff5ae0b0693 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h2535c4f17d1ae00a
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/alloc/src/boxed.rs:1935:9
  34:     0x7ff5ae0b0693 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h9555fa64d2fdcc1f
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/alloc/src/boxed.rs:1935:9
  35:     0x7ff5ae0b0693 - std::sys::unix::thread::Thread::new::thread_start::hcd4b7b87c76163e2
                               at /rustc/93ffde6f04d3d24327a4e17a2a2bf4f63c246235/library/std/src/sys/unix/thread.rs:108:17
  36:     0x7ff5ade8054d - <unknown>
  37:     0x7ff5adf05874 - clone
  38:                0x0 - <unknown>

note: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.64.0-nightly (93ffde6f0 2022-07-23) running on x86_64-unknown-linux-gnu

note: compiler flags: --crate-type bin -C embed-bitcode=no -C debuginfo=2 -C incremental -C target-cpu=native

note: some of the compiler flags provided by cargo are hidden

query stack during panic:
end of query stack

Miri caused an ICE during evaluation. Here's the interpreter backtrace at the time of the panic:
note: the place in the program where the ICE was triggered
  --> src/main.rs:18:5
   |
18 |     <dyn X as X>::foo(&());
   |     ^^^^^^^^^^^^^^^^^^^^^^
   |
   = note: inside `main` at src/main.rs:18:5
   = note: inside `<fn() as std::ops::FnOnce<()>>::call_once - shim(fn())` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:248:5
   = note: inside `std::sys_common::backtrace::__rust_begin_short_backtrace::<fn(), ()>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:122:18
   = note: inside closure at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:145:18
   = note: inside `std::ops::function::impls::<impl std::ops::FnOnce<()> for &dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe>::call_once` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:280:13
   = note: inside `std::panicking::r#try::do_call::<&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe, i32>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:492:40
   = note: inside `std::panicking::r#try::<i32, &dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:456:19
   = note: inside `std::panic::catch_unwind::<&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe, i32>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:137:14
   = note: inside closure at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:128:48
   = note: inside `std::panicking::r#try::do_call::<[closure@std::rt::lang_start_internal::{closure#2}], isize>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:492:40
   = note: inside `std::panicking::r#try::<isize, [closure@std::rt::lang_start_internal::{closure#2}]>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:456:19
   = note: inside `std::panic::catch_unwind::<[closure@std::rt::lang_start_internal::{closure#2}], isize>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:137:14
   = note: inside `std::rt::lang_start_internal` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:128:20
   = note: inside `std::rt::lang_start::<()>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:144:17

error: aborting due to 2 previous errors

miri 0.1.0 (963f08b 2022-07-22)

[bjorn3]

There is a future compat lint being emitted for the exact pattern on which miri crashes.

[matthiaskrgr]

Yes, I saw this show up earlier as UB (what rust says), but I think the crash might be new, otherwise I would have probably reported it already :D

[RalfJung]

This is a consequence of rust-lang/rust#99420 doing stricter checking. So yes the crash is new. Looks like the compiler is generating invalid MIR here, and finally we actually catch it doing that. I don't think this is a Miri bug.

What is rustc doing to ensure that this "does not segfault"? Looks like the vtable is bogus!

[RalfJung]

Even stranger is the fact that this test shouldn't even run, it triggers a deny lint after all!

[RalfJung]

We could fix the ICE by raising a UB error instead. rust-lang/rust#50781 is the soundness bug tracking that UB can be caused in safe code.