ICE: `Size::sub: 0 - 1 would result in negative size`

[matthiaskrgr]

auto-reduced (treereduce-rust):

mod assert {
    use std::mem::{Assume, BikeshedIntrinsicFrom};

    pub fn is_transmutable<Src, Dst>()
    where
        Dst: BikeshedIntrinsicFrom<Src>,
    {
    }
}

#[repr(C)]
struct Zst;

#[repr(u8)]
enum V0 {
    V = 0,
}

enum V2 {
    V = 2,
}

enum Lopsided {
    Smol(Zst),
    Lorg(V0),
}

#[repr(C)]
#[repr(C)]
struct Dst(Lopsided, V2);

fn should_pad_variants() {
    assert::is_transmutable::<Src, Dst>();
}

original code

original:

//! The variants of an enum must be padded with uninit bytes such that they have
//! the same length (in bytes).

#![crate_type = "lib"]
#![feature(transmutability)]
#![allow(dead_code)]

mod assert {
    use std::mem::{Assume, BikeshedIntrinsicFrom};

    pub fn is_transmutable<Src, Dst>()
    where
        Dst: BikeshedIntrinsicFrom<Src, {
            Assume::ALIGNMENT
                .and(Assume::LIFETIMES)
                .and(Assume::SAFETY)
                .and(Assume::LIFETIMES)
                .and(Assume::SAFETY)
                .and(Assume::SAFETY)
                .and(Assume::ALIGNMENT)
        }>
    {}
}

#[derive(Clone, Copy)]
#[repr(C)] struct Zst;

#[derive(Clone, Copy)]
#[repr(u8)] enum V0 { V = 0 }

#[derive(Clone, Copy)]
#[repr(u8)] enum V2 { V = 2 }

#[repr(transmutability)]
enum Lopsided {
    Smol(Zst),
    Lorg(V0),
}

#[repr(C)] struct Src(V0, Zst V2);
#[repr(C)] struct Dst(Lopsided, V2);

fn should_pad_variants() {
    // If the implementation (incorrectly) fails to pad `Lopsided::Smol` with
    // an uninitialized byte, this transmutation might be (wrongly) accepted:
    assert::is_transmutable::<Src, Dst>(); //~ ERROR cannot be safely transmuted
}

Version information

rustc 1.79.0-nightly (033becf83 2024-04-09)
binary: rustc
commit-hash: 033becf83c62814357f4810db149471db46ab816
commit-date: 2024-04-09
host: x86_64-unknown-linux-gnu
release: 1.79.0-nightly
LLVM version: 18.1.3

Command:
/home/matthias/.rustup/toolchains/master/bin/rustc

Program output

error[E0412]: cannot find type `Src` in this scope
  --> /tmp/icemaker_global_tempdir.7GMaangOEeD3/rustc_testrunner_tmpdir_reporting.sKS3rJHCTOdj/mvce.rs:33:31
   |
33 |     assert::is_transmutable::<Src, Dst>();
   |                               ^^^ not found in this scope
   |
help: you might be missing a type parameter
   |
32 | fn should_pad_variants<Src>() {
   |                       +++++

warning: unused import: `Assume`
 --> /tmp/icemaker_global_tempdir.7GMaangOEeD3/rustc_testrunner_tmpdir_reporting.sKS3rJHCTOdj/mvce.rs:2:20
  |
2 |     use std::mem::{Assume, BikeshedIntrinsicFrom};
  |                    ^^^^^^
  |
  = note: `#[warn(unused_imports)]` on by default

error[E0601]: `main` function not found in crate `mvce`
  --> /tmp/icemaker_global_tempdir.7GMaangOEeD3/rustc_testrunner_tmpdir_reporting.sKS3rJHCTOdj/mvce.rs:34:2
   |
34 | }
   |  ^ consider adding a `main` function to `/tmp/icemaker_global_tempdir.7GMaangOEeD3/rustc_testrunner_tmpdir_reporting.sKS3rJHCTOdj/mvce.rs`

error[E0658]: use of unstable library feature 'transmutability'
 --> /tmp/icemaker_global_tempdir.7GMaangOEeD3/rustc_testrunner_tmpdir_reporting.sKS3rJHCTOdj/mvce.rs:2:20
  |
2 |     use std::mem::{Assume, BikeshedIntrinsicFrom};
  |                    ^^^^^^
  |
  = note: see issue #99571 <https://github.com/rust-lang/rust/issues/99571> for more information
  = help: add `#![feature(transmutability)]` to the crate attributes to enable
  = note: this compiler was built on 2024-04-09; consider upgrading it if it is out of date

error[E0658]: use of unstable library feature 'transmutability'
 --> /tmp/icemaker_global_tempdir.7GMaangOEeD3/rustc_testrunner_tmpdir_reporting.sKS3rJHCTOdj/mvce.rs:2:28
  |
2 |     use std::mem::{Assume, BikeshedIntrinsicFrom};
  |                            ^^^^^^^^^^^^^^^^^^^^^
  |
  = note: see issue #99571 <https://github.com/rust-lang/rust/issues/99571> for more information
  = help: add `#![feature(transmutability)]` to the crate attributes to enable
  = note: this compiler was built on 2024-04-09; consider upgrading it if it is out of date

error[E0658]: use of unstable library feature 'transmutability'
 --> /tmp/icemaker_global_tempdir.7GMaangOEeD3/rustc_testrunner_tmpdir_reporting.sKS3rJHCTOdj/mvce.rs:6:14
  |
6 |         Dst: BikeshedIntrinsicFrom<Src>,
  |              ^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: see issue #99571 <https://github.com/rust-lang/rust/issues/99571> for more information
  = help: add `#![feature(transmutability)]` to the crate attributes to enable
  = note: this compiler was built on 2024-04-09; consider upgrading it if it is out of date

thread 'rustc' panicked at /rustc/033becf83c62814357f4810db149471db46ab816/compiler/rustc_abi/src/lib.rs:581:13:
Size::sub: 0 - 1 would result in negative size
stack backtrace:
   0:     0x79db92be6885 - std::backtrace_rs::backtrace::libunwind::trace::he2880c2699337794
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/../../backtrace/src/backtrace/libunwind.rs:105:5
   1:     0x79db92be6885 - std::backtrace_rs::backtrace::trace_unsynchronized::h460ebc9cd0eb6331
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x79db92be6885 - std::sys_common::backtrace::_print_fmt::h47b746c0604572c3
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/sys_common/backtrace.rs:68:5
   3:     0x79db92be6885 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::ha907b996746f56a0
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x79db92c35abb - core::fmt::rt::Argument::fmt::hfe22b646b1687193
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/core/src/fmt/rt.rs:142:9
   5:     0x79db92c35abb - core::fmt::write::h6b4a267d08f3d00d
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/core/src/fmt/mod.rs:1153:17
   6:     0x79db92bdb3ff - std::io::Write::write_fmt::h0abdd14d11c1702a
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/io/mod.rs:1843:15
   7:     0x79db92be665e - std::sys_common::backtrace::_print::hbeb8c9c7793a4a1e
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/sys_common/backtrace.rs:47:5
   8:     0x79db92be665e - std::sys_common::backtrace::print::h6ca4866d684d9b00
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/sys_common/backtrace.rs:34:9
   9:     0x79db92be9159 - std::panicking::default_hook::{{closure}}::h33647e3098e0b657
  10:     0x79db92be8e75 - std::panicking::default_hook::ha6320bcd5d0e9cc8
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/panicking.rs:291:9
  11:     0x79db8f46649f - std[5013708940097fa8]::panicking::update_hook::<alloc[d2bd3d5c53f6cb06]::boxed::Box<rustc_driver_impl[83e8eb7d3795c9f9]::install_ice_hook::{closure#0}>>::{closure#0}
  12:     0x79db92be985c - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::hf428354f3713bf5b
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/alloc/src/boxed.rs:2032:9
  13:     0x79db92be985c - std::panicking::rust_panic_with_hook::h0014da0b7030d171
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/panicking.rs:792:13
  14:     0x79db92be9606 - std::panicking::begin_panic_handler::{{closure}}::h639e3e9de7a3e2e4
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/panicking.rs:657:13
  15:     0x79db92be6d49 - std::sys_common::backtrace::__rust_end_short_backtrace::h66ed5715b81f24d6
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/sys_common/backtrace.rs:171:18
  16:     0x79db92be9337 - rust_begin_unwind
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/panicking.rs:645:5
  17:     0x79db92c31f56 - core::panicking::panic_fmt::h2fea69f54f6dc828
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/core/src/panicking.rs:72:14
  18:     0x79db8fffc247 - <rustc_abi[ad9a244720a52d55]::Size as core[b815557cbe89e06]::ops::arith::Sub>::sub::{closure#0}
  19:     0x79db9000cb17 - <rustc_transmute[b6741d03a3d4c86]::layout::tree::Tree<rustc_transmute[b6741d03a3d4c86]::layout::rustc::Def, rustc_transmute[b6741d03a3d4c86]::layout::rustc::Ref>>::from_variant
  20:     0x79db9000bffa - <rustc_transmute[b6741d03a3d4c86]::layout::tree::Tree<rustc_transmute[b6741d03a3d4c86]::layout::rustc::Def, rustc_transmute[b6741d03a3d4c86]::layout::rustc::Ref>>::from_enum
  21:     0x79db9000c756 - <rustc_transmute[b6741d03a3d4c86]::layout::tree::Tree<rustc_transmute[b6741d03a3d4c86]::layout::rustc::Def, rustc_transmute[b6741d03a3d4c86]::layout::rustc::Ref>>::from_variant
  22:     0x79db9000b43f - <rustc_transmute[b6741d03a3d4c86]::layout::tree::Tree<rustc_transmute[b6741d03a3d4c86]::layout::rustc::Def, rustc_transmute[b6741d03a3d4c86]::layout::rustc::Ref>>::from_struct
  23:     0x79db9000f833 - <rustc_transmute[b6741d03a3d4c86]::rustc::TransmuteTypeEnv>::is_transmutable
  24:     0x79db910150a5 - <rustc_trait_selection[f840d4be03886ec6]::traits::select::SelectionContext>::confirm_candidate
  25:     0x79db8d4ba166 - <rustc_trait_selection[f840d4be03886ec6]::traits::select::SelectionContext>::evaluate_candidate
  26:     0x79db9115a88c - <rustc_trait_selection[f840d4be03886ec6]::traits::select::SelectionContext>::evaluate_trait_predicate_recursively
  27:     0x79db90f0f668 - <rustc_trait_selection[f840d4be03886ec6]::traits::select::SelectionContext>::evaluation_probe::<<rustc_trait_selection[f840d4be03886ec6]::traits::select::SelectionContext>::evaluate_root_obligation::{closure#0}>
  28:     0x79db90f0dc9a - rustc_traits[ccae72c98d3fa03e]::evaluate_obligation::evaluate_obligation
  29:     0x79db90f0d62b - rustc_query_impl[a13915abec574cc4]::plumbing::__rust_begin_short_backtrace::<rustc_query_impl[a13915abec574cc4]::query_impl::evaluate_obligation::dynamic_query::{closure#2}::{closure#0}, rustc_middle[867c8a7f7f3067fc]::query::erase::Erased<[u8; 2usize]>>
  30:     0x79db90f0cb92 - rustc_query_system[37cb0ad7182a86b8]::query::plumbing::try_execute_query::<rustc_query_impl[a13915abec574cc4]::DynamicConfig<rustc_query_system[37cb0ad7182a86b8]::query::caches::DefaultCache<rustc_type_ir[f07d295899310239]::canonical::Canonical<rustc_middle[867c8a7f7f3067fc]::ty::context::TyCtxt, rustc_middle[867c8a7f7f3067fc]::ty::ParamEnvAnd<rustc_middle[867c8a7f7f3067fc]::ty::predicate::Predicate>>, rustc_middle[867c8a7f7f3067fc]::query::erase::Erased<[u8; 2usize]>>, false, false, false>, rustc_query_impl[a13915abec574cc4]::plumbing::QueryCtxt, false>
  31:     0x79db90f0c7da - rustc_query_impl[a13915abec574cc4]::query_impl::evaluate_obligation::get_query_non_incr::__rust_end_short_backtrace
  32:     0x79db8d404081 - <rustc_trait_selection[f840d4be03886ec6]::traits::fulfill::FulfillProcessor as rustc_data_structures[529620daf813c2f]::obligation_forest::ObligationProcessor>::process_obligation
  33:     0x79db9080d663 - <rustc_data_structures[529620daf813c2f]::obligation_forest::ObligationForest<rustc_trait_selection[f840d4be03886ec6]::traits::fulfill::PendingPredicateObligation>>::process_obligations::<rustc_trait_selection[f840d4be03886ec6]::traits::fulfill::FulfillProcessor>
  34:     0x79db90fe11bf - <rustc_hir_typeck[90aadd5cc69e56e5]::fn_ctxt::FnCtxt>::check_argument_types
  35:     0x79db90fd71eb - <rustc_hir_typeck[90aadd5cc69e56e5]::fn_ctxt::FnCtxt>::check_call
  36:     0x79db9128d159 - <rustc_hir_typeck[90aadd5cc69e56e5]::fn_ctxt::FnCtxt>::check_expr_with_expectation_and_args
  37:     0x79db91287a26 - <rustc_hir_typeck[90aadd5cc69e56e5]::fn_ctxt::FnCtxt>::check_block_with_expected
  38:     0x79db9128d63d - <rustc_hir_typeck[90aadd5cc69e56e5]::fn_ctxt::FnCtxt>::check_expr_with_expectation_and_args
  39:     0x79db909ee20e - rustc_hir_typeck[90aadd5cc69e56e5]::check::check_fn
  40:     0x79db909e4749 - rustc_hir_typeck[90aadd5cc69e56e5]::typeck
  41:     0x79db909e4109 - rustc_query_impl[a13915abec574cc4]::plumbing::__rust_begin_short_backtrace::<rustc_query_impl[a13915abec574cc4]::query_impl::typeck::dynamic_query::{closure#2}::{closure#0}, rustc_middle[867c8a7f7f3067fc]::query::erase::Erased<[u8; 8usize]>>
  42:     0x79db909d0871 - rustc_query_system[37cb0ad7182a86b8]::query::plumbing::try_execute_query::<rustc_query_impl[a13915abec574cc4]::DynamicConfig<rustc_query_system[37cb0ad7182a86b8]::query::caches::VecCache<rustc_span[ef049dfdad08a076]::def_id::LocalDefId, rustc_middle[867c8a7f7f3067fc]::query::erase::Erased<[u8; 8usize]>>, false, false, false>, rustc_query_impl[a13915abec574cc4]::plumbing::QueryCtxt, false>
  43:     0x79db909cf18c - rustc_query_impl[a13915abec574cc4]::query_impl::typeck::get_query_non_incr::__rust_end_short_backtrace
  44:     0x79db909ced54 - <rustc_middle[867c8a7f7f3067fc]::hir::map::Map>::par_body_owners::<rustc_hir_analysis[341fcfcfa163e951]::check_crate::{closure#4}>::{closure#0}
  45:     0x79db909cda1f - rustc_hir_analysis[341fcfcfa163e951]::check_crate
  46:     0x79db910ee93a - rustc_interface[791da96d69a7cf4c]::passes::analysis
  47:     0x79db910ee495 - rustc_query_impl[a13915abec574cc4]::plumbing::__rust_begin_short_backtrace::<rustc_query_impl[a13915abec574cc4]::query_impl::analysis::dynamic_query::{closure#2}::{closure#0}, rustc_middle[867c8a7f7f3067fc]::query::erase::Erased<[u8; 1usize]>>
  48:     0x79db915fa6a5 - rustc_query_system[37cb0ad7182a86b8]::query::plumbing::try_execute_query::<rustc_query_impl[a13915abec574cc4]::DynamicConfig<rustc_query_system[37cb0ad7182a86b8]::query::caches::SingleCache<rustc_middle[867c8a7f7f3067fc]::query::erase::Erased<[u8; 1usize]>>, false, false, false>, rustc_query_impl[a13915abec574cc4]::plumbing::QueryCtxt, false>
  49:     0x79db915fa409 - rustc_query_impl[a13915abec574cc4]::query_impl::analysis::get_query_non_incr::__rust_end_short_backtrace
  50:     0x79db91480cd4 - rustc_interface[791da96d69a7cf4c]::interface::run_compiler::<core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>, rustc_driver_impl[83e8eb7d3795c9f9]::run_compiler::{closure#0}>::{closure#0}
  51:     0x79db9154deff - std[5013708940097fa8]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[791da96d69a7cf4c]::util::run_in_thread_with_globals<rustc_interface[791da96d69a7cf4c]::util::run_in_thread_pool_with_globals<rustc_interface[791da96d69a7cf4c]::interface::run_compiler<core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>, rustc_driver_impl[83e8eb7d3795c9f9]::run_compiler::{closure#0}>::{closure#0}, core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>>::{closure#0}, core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>>
  52:     0x79db9154dcee - <<std[5013708940097fa8]::thread::Builder>::spawn_unchecked_<rustc_interface[791da96d69a7cf4c]::util::run_in_thread_with_globals<rustc_interface[791da96d69a7cf4c]::util::run_in_thread_pool_with_globals<rustc_interface[791da96d69a7cf4c]::interface::run_compiler<core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>, rustc_driver_impl[83e8eb7d3795c9f9]::run_compiler::{closure#0}>::{closure#0}, core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>>::{closure#0}, core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[b815557cbe89e06]::result::Result<(), rustc_span[ef049dfdad08a076]::ErrorGuaranteed>>::{closure#1} as core[b815557cbe89e06]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  53:     0x79db92bf328b - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h53814b1241345312
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/alloc/src/boxed.rs:2018:9
  54:     0x79db92bf328b - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h68f33d2823fce7a0
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/alloc/src/boxed.rs:2018:9
  55:     0x79db92bf328b - std::sys::pal::unix::thread::Thread::new::thread_start::h5c5183b404e56855
                               at /rustc/033becf83c62814357f4810db149471db46ab816/library/std/src/sys/pal/unix/thread.rs:108:17
  56:     0x79db9299155a - <unknown>
  57:     0x79db92a0ea3c - <unknown>
  58:                0x0 - <unknown>

error: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.79.0-nightly (033becf83 2024-04-09) running on x86_64-unknown-linux-gnu

query stack during panic:
#0 [evaluate_obligation] evaluating trait selection obligation `Dst: core::mem::transmutability::BikeshedIntrinsicFrom<{type error}, core::mem::transmutability::Assume { alignment: false, lifetimes: false, safety: false, validity: false }>`
#1 [typeck] type-checking `should_pad_variants`
#2 [analysis] running analysis passes on this crate
end of query stack
error: aborting due to 5 previous errors; 1 warning emitted

Some errors have detailed explanations: E0412, E0601, E0658.
For more information about an error, try `rustc --explain E0412`.

[compiler-errors]

cc @jswrenn

[jswrenn]

On it! Thanks for the report.

[jswrenn]

Further minimized:

#![feature(transmutability)]

mod assert {
    use std::mem::{Assume, BikeshedIntrinsicFrom};

    pub fn is_transmutable<Src, Dst>()
    where
        Dst: BikeshedIntrinsicFrom<Src, { Assume::NOTHING }>,
    {
    }
}

enum Lopsided {
    Smol(()),
    Lorg(bool),
}

fn should_pad_variants() {
    assert::is_transmutable::<Lopsided, ()>();
}

[jswrenn]

The cause here is neat. Lopsided here is niche optimizable, with its second variant being subject to niche optimization. Typically, a niche-optimized enum has one tagless variant, and zero or more tagged variants laid out in the usual manner: the tag is placed, and then the rest of the fields follow. But #[rustc_layout(debug)] reveals that's not what happens here. Because () is a ZST, () is placed at offset 0, rather than 1 (following the tag). In other words: the tag is co-located with the field. This produces an ICE, because our assumption that fields follow tag is violated (a checked sub panics).

[jswrenn]

@rustbot claim