Unsoundness in borrowck around deref and mutable refs

[apasel422]

Stable and nightly happily compile the following:

fn main() {
    let x: &'static str = "x";

    {
        let y = "y".to_string();
        let ref mut x = &*x;
        *x = &*y;
    }

    println!("{:?}", x);
}

Running the program on my local Ubuntu machine yields:

thread '<main>' panicked at 'index 0 and/or 0 in `�` do not lie on character boundary', ../rust/src/libcore/str/mod.rs:1444

The playpen yields different results depending on whether debug or release mode is chosen.

Someone is welcome to retitle this issue more accurately.

[sfackler]

Nominating for P-high.

[eefriedman]

The code isn't semantically unsound. In let ref mut x = &*x;, x is supposed to be a pointer to an unnamed temporary containing an &str. For example:

fn main() {
    let ref mut y = "x";
    *y = "y";
}

The problem is just that trans is taking illegal shortcuts.

[apasel422]

@eefriedman Along those lines, in this example:

fn main() {
    let x: &'static str = "x";

    {
        let z = &mut &*x;
        *z = "z";
    }

    println!("{:?}", x);
}

the code compiles, runs, and prints "z".

[eefriedman]

@apasel422 Yes, same bug.

[woowe]

The same bug is coming up for me when I use html5ever.

[nikomatsakis]

triage: P-high

My preferred fix would be to go through MIR, but this may be worth fixing another way.

[pnkfelix]

cc me