Skip to content

unchecked region constraints for opaque types in dead code #112417

Open
@lcnr

Description

@lcnr

edit: while this tests currently results in an error, the underying issue still exists #112417 (comment)

trait CallMeMaybe<'a, 'b> {
    fn mk() -> Self;
    fn subtype<T>(self, x: &'b T) -> &'a T;
}

struct Foo<'a, 'b: 'a>(&'a (), &'b ());
impl<'a, 'b> CallMeMaybe<'a, 'b> for Foo<'a, 'b> {
    fn mk() -> Self {
        Foo(&(), &())
    }

    fn subtype<T>(self, x: &'b T) -> &'a T {
        x
    }
}

// `foo` must not compile but does.
fn foo<'a, 'b>() -> impl CallMeMaybe<'a, 'b> {
    panic!();
    Foo(&(), &())
}

// The rest is only to exploit that unsoundness.
trait Func {
    type RetTy;
}
impl<F: FnOnce() -> R, R> Func for F {
    type RetTy = R;
}

fn subtype<'a, 'b, F: FnOnce() -> R, R: CallMeMaybe<'a, 'b>, T>(_: F, x: &'b T) -> &'a T {
    let proof = R::mk();
    proof.subtype(x)
}

fn main() {
    let y = subtype(foo, &String::from("Hello World"));
    println!("{y}"); // use after free
}

With the current implementation foo only defines the opaque type during HIR typeck and not in MIR typeck as the defining use is in dead code. HIR typeck does not check regions so we use erased regions instead. This hidden type with erased regions is then used as the actual hidden type of the RPIT because there is no hidden type defined by MIR typeck.

We then never check that the RPIT is well-formed outside of HIR typeck itself, so we never check that the region constraints hold for the opaque type.

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-impl-traitArea: `impl Trait`. Universally / existentially quantified anonymous types with static dispatch.C-bugCategory: This is a bug.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-mediumMedium priorityS-needs-reproStatus: This issue has no reproduction and needs a reproduction to make progress.T-typesRelevant to the types team, which will review and decide on the PR/issue.

    Type

    No type

    Projects

    Status

    unblocked

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions