Miscompile in DestinationPropagation?

@cjgillot

Reduced example from rustlantis, which is accepted by Miri using Tree Borrows without optimizations enabled:

#![feature(custom_mir, core_intrinsics)]
#![allow(internal_features)]

use std::intrinsics::mir::*;

fn dump_var<T>(_: T) {}

#[custom_mir(dialect = "runtime")]
fn main() {
    mir!{
        let _1: (u8,);
        let _2: (u8,);
        let _3: (u8,);
        let _4: (u8,);
        let _5: ();
        {
            _3.0 = 0;
            _1 = _3;
            _4 = (_1.0, );
            _1 = _4;
            Call(_5 = dump_var(_1), ReturnTo(bb1), UnwindUnreachable())
        }
        bb1 = {
            Return()
        }
    }
}

I'm sure this is caused by DestinationPropagation, because

cargo +nightly miri run

accepts this code, but

MIRIFLAGS=-Zmir-enable-passes=+DestinationPropagation cargo +nightly miri run

reports UB (ignore the span, it's confusing because the source code that's displayed is the pre-optimization MIR):

error: Undefined Behavior: reading memory at alloc125[0x0..0x1], but memory is uninitialized at [0x0..0x1], and this operation requires initialized memory
  --> src/main.rs:19:13
   |
19 |             _4 = (_1.0, );
   |             ^^^^^^^^^^^^^ Undefined Behavior occurred here
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
   = note: BACKTRACE:
   = note: inside `main` at src/main.rs:19:13: 19:26

The errant transformation rewrite the entire body:

-// MIR for `main` before DestinationPropagation
+// MIR for `main` after DestinationPropagation
 
 fn main() -> () {
     let mut _0: ();
     let mut _1: (u8,);
     let mut _2: (u8,);
     let mut _3: (u8,);
     let mut _4: (u8,);
     let mut _5: ();
 
     bb0: {
-        (_3.0: u8) = const 0_u8;
-        _1 = copy _3;
-        _4 = (copy (_1.0: u8),);
-        _1 = copy _4;
-        _5 = dump_var::<(u8,)>(copy _1) -> [return: bb1, unwind unreachable];
+        (_4.0: u8) = const 0_u8;
+        nop;
+        _4 = (copy (_4.0: u8),);
+        nop;
+        _5 = dump_var::<(u8,)>(copy _4) -> [return: bb1, unwind unreachable];
     }
 
     bb1: {
         return;
     }
 }

This is probably #145541 cc @cjgillot @Amanieu

@RalfJung

Actually, I'm confused. This program executes UB?

#![feature(custom_mir, core_intrinsics)]
#![allow(internal_features)]

use std::intrinsics::mir::*;

#[custom_mir(dialect = "runtime")]
fn main() {
    mir!{
        let _1: (u8,);
        {
            _1.0 = 0_u8;
            _1 = (_1.0, );
            Return()
        }
    }
}

Miri says:

error: Undefined Behavior: reading memory at alloc153[0x0..0x1], but memory is uninitialized at [0x0..0x1], and this operation requires initialized memory
  --> src/main.rs:12:13
   |
12 |             _1 = (_1.0, );
   |             ^^^^^^^^^^^^^ Undefined Behavior occurred here
   |

@RalfJung does this UB report make sense to you?

The UB report occurs because of this:

rust/compiler/rustc_const_eval/src/interpret/step.rs

Lines 307 to 313 in 7ad23f4

    
           fn write_aggregate( 
        
               &mut self, 
        
               kind: &mir::AggregateKind<'tcx>, 
        
               operands: &IndexSlice<FieldIdx, mir::Operand<'tcx>>, 
        
               dest: &PlaceTy<'tcx, M::Provenance>, 
        
           ) -> InterpResult<'tcx> { 
        
               self.write_uninit(dest)?; // make sure all the padding ends up as uninit

Miri accepts this code without that write_uninit call. But I'm not sure if this self-assignment is supposed to be disallowed because it's an overlapping copy_nonoverlapping.

I would expect an aggregate assignment with an overlapping memory to have undefined behavior analogously to an assignment. If anything, this looks like a situation where Miri undefined behavior detection is incomplete.

Regardless, this is definitely an issue in destination propagation:

$ cat c.rs
#![feature(custom_mir, core_intrinsics)]
#![allow(internal_features)]

use std::intrinsics::mir::*;
use std::mem::MaybeUninit;

#[custom_mir(dialect = "runtime")]
fn f() -> (MaybeUninit<[u8; 10]>, MaybeUninit<[u8; 10]>) {
    mir!{
        let _1: (MaybeUninit<[u8; 10]>, MaybeUninit<[u8; 10]>);
        let _2: (MaybeUninit<[u8; 10]>, MaybeUninit<[u8; 10]>);
        let _3: ();
        {
            _1 = const { (MaybeUninit::new([0; 10]), MaybeUninit::new([1; 10])) };
            _2 = _1;
            _1 = (_2.1, _2.0);
            RET = _1;
            Return()
        }
    }
}

fn main() {
    unsafe {
        let a = f();
        assert_eq!(1, a.0.assume_init()[0]);
        assert_eq!(0, a.1.assume_init()[1]);
    }
}

$ rustc c.rs && ./c
$ rustc c.rs -Zmir-enable-passes=+DestinationPropagation && ./c

thread 'main' (9115) panicked at c.rs:27:9:
assertion `left == right` failed
  left: 0
 right: 1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Rollup merge of rust-lang#146402 - RalfJung:aggregate-init, r=saethlin

Auto merge of #146402 - RalfJung:aggregate-init, r=saethlin

Unrolled build for #146402

Auto merge of #146516 - cjgillot:dest-prop-aggregate, r=Amanieu

Rollup merge of rust-lang#146566 - cjgillot:mir-overlap-lint, r=saethlin

Rollup merge of #146402 - RalfJung:aggregate-init, r=saethlin

Auto merge of #146516 - cjgillot:dest-prop-aggregate, r=Amanieu

Rollup merge of rust-lang#146566 - cjgillot:mir-overlap-lint, r=saethlin

Unrolled build for #146566

Auto merge of #146516 - cjgillot:dest-prop-aggregate, r=Amanieu

Auto merge of rust-lang#146516 - cjgillot:dest-prop-aggregate, r=Amanieu

Auto merge of #146516 - cjgillot:dest-prop-aggregate, r=Amanieu

Navigation Menu

Repository navigation

Miscompile in DestinationPropagation? #146383

11 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	fn write_aggregate(
	&mut self,
	kind: &mir::AggregateKind<'tcx>,
	operands: &IndexSlice<FieldIdx, mir::Operand<'tcx>>,
	dest: &PlaceTy<'tcx, M::Provenance>,
	) -> InterpResult<'tcx> {
	self.write_uninit(dest)?; // make sure all the padding ends up as uninit

Miscompile in DestinationPropagation? #146383

Description

Activity

saethlin commented on Sep 10, 2025

saethlin commented on Sep 10, 2025

tmiasko commented on Sep 10, 2025

11 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions