Miscompilation of mutable reference to const temporary

[jethrogb]

trait XLen {
    fn xlen(&mut self) -> usize;
}

impl<'a> XLen for &'a [u8] {
    fn xlen(&mut self) -> usize {
        self.len()
    }
}

fn main() {
    const A: &'static [u8] = b"x";
    println!("{} {}",A.len(),A.xlen());
}

This code compiles, but yields:

1 2097865012304223517

The second number may vary.

This used to lead to segfaults (in 1.5.0 and earlier) in code such as:

use std::io::Read;
fn main() {
    const A: &'static [u8] = b"x";
    let mut a=[0u8;32];
    A.read(&mut a);
}

This doesn't segfault in 1.6.0 anymore, but that is due to an unrelated change.

[eddyb]

@nikomatsakis I wish there was an easy way to dump the const qualifications as annotations on expressions.

My guess is that we're missing the borrow somehow, or if const qualification is correct, then maybe the const handling code in trans::expr isn't.

[jethrogb]

Using {A} instead of A yields the correct results in both examples.

[eddyb]

Using &'static usize instead of a slice, I've found this IR (simplified for presentation):

@ref = constant i64 0
@const = constant i64* @ref
...
  %1 = load i64**, i64*** bitcast (i64** @const to i64***)
  %2 = call i64 @method(i64** %1)

Which is roughly the same as:

@ref = constant i64 0
...
  %2 = call i64 @method(i64** bitcast (i64* @ref to i64**))

So trans::expr is taking an A: &T constant and casting it to &mut &T without actually performing the autoref (which involves taking a &mut to a stack temporary containing the &T).

cc @dotdash

[nikomatsakis]

Just to be clear: the problem is in trans, right? That is, I expect this example to compile, but it seems like the temporary stack slot is being dropped too early?

[eddyb]

@nikomatsakis Yes, it's supposed to compile, and no, there is no temporary stack slot, &'static T is effectively transmuted to &mut &T by some incorrect adjustment handling.

[nikomatsakis]

@eddyb

no, there is no temporary stack slot,

But there ought to be one, right? The second call requires an autoref (it is an &self method defined on a &[T]) -- this creates a temporary (which contains an &'static value).

[eddyb]

@nikomatsakis There should be, but there isn't. That's the bug.

[jethrogb]

Ping. Can someone at least assign some labels to this issue?

[nikomatsakis]

In theory this is probably fixed with -Z orbit, we should test.

[nikomatsakis]

Given that this works with -Z orbit, assigning low priority. Will be fixed in MIR transition.