Skip to content

ReferencePropagation misunderstands aliasing, can add reads of uninitialized memory #141101

Open
@saethlin

Description

@saethlin

Reduced example from rustlantis, which is accepted by Miri without optimizations enabled:

#![feature(custom_mir, core_intrinsics)]
#![allow(internal_features)]

use std::intrinsics::mir::*;

#[custom_mir(dialect = "runtime")]
fn fn0() {
    mir!{
        let _1: (u8, u8);
        let _2: (u64, &u8);
        let _3: (u8, &&u64);
        let _4: u64;
        let _5: &u64;
        let _6: &u64;
        let _7: &u64;
        let _8: u64;
        let n: ();
        {
            _3.0 = 0;
            _1 = (0, _3.0);
            _4 = 0;
            _2.1 = &_1.0;
            _8 = 0;
            _5 = &_8;
            _5 = &_4;
            _6 = _5;
            _7 = _6;
            _3.1 = &_6;
            Call(n = fn1(_2.1, Move(_6)), ReturnTo(bb1), UnwindUnreachable())
        }
        bb1 = {
            _2.0 = *_7;
            Return()
        }
    }
}

#[custom_mir()]
fn fn1(_1: &u8, _2: &u64) {
    mir!{
        {
            Return()
        }
    }
}

fn main() {
    fn0();
}

If I run this under Miri with -Zmir-enable-passes=+ReferencePropagation, I see:

error: Undefined Behavior: using uninitialized data, but this operation requires initialized memory
  --> refprop-uninit.rs:32:13
   |
32 |             _2.0 = *_7;
   |             ^^^^^^^^^^ using uninitialized data, but this operation requires initialized memory
   |

The MIR diff for ReferencePropagation is:

-// MIR for `fn0` before ReferencePropagation
+// MIR for `fn0` after ReferencePropagation
 
 fn fn0() -> () {
     let mut _0: ();
@@ -21,13 +21,12 @@ fn fn0() -> () {
         _5 = &_8;
         _5 = &_4;
         _6 = copy _5;
-        _7 = copy _6;
         (_3.1: &&u64) = &_6;
         _9 = fn1(copy (_2.1: &u8), move _6) -> [return: bb1, unwind unreachable];
     }
 
     bb1: {
-        (_2.0: u64) = copy (*_7);
+        (_2.0: u64) = copy (*_6);
         return;
     }
 }

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-mir-optArea: MIR optimizationsA-rustlantisA miscompilation found by RustlantisC-bugCategory: This is a bug.I-miscompileIssue: Correct Rust code lowers to incorrect machine codeI-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-mediumMedium priorityT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions