ICE: enum value has invalid tag, no-core-2.rs -Zmir-opt-level=3 --emit=mir -Zdump-mir=all

[matthiaskrgr]

Code

./src/test/ui/no-core-2.rs

// run-pass

#![allow(dead_code, unused_imports)]
#![feature(no_core)]
#![no_core]
// edition:2018

extern crate std;
extern crate core;
use core::{prelude::v1::*, *};

fn foo() {
    for _ in &[()] {}
}

fn bar() -> Option<()> {
    None?
}

fn main() {}

Meta

rustc --version --verbose:

rustc 1.60.0-nightly (71226d717 2022-02-04)
binary: rustc
commit-hash: 71226d717a1fb57122e47e63b97295e703319cb0
commit-date: 2022-02-04
host: x86_64-unknown-linux-gnu
release: 1.60.0-nightly
LLVM version: 13.0.0

Error output

rustc ./src/test/ui/no-core-2.rs -Zmir-opt-level=3 --emit=mir -Zdump-mir=all --edition 2018

thread 'rustc' panicked at 'called `Result::unwrap()` on an `Err` value: InterpErrorInfo(InterpErrorInfoInner { kind: enum value has invalid tag: 0x02, backtrace: None })', compiler/rustc_const_eval/src/const_eval/mod.rs:155:54

Backtrace

thread 'rustc' panicked at 'called `Result::unwrap()` on an `Err` value: InterpErrorInfo(InterpErrorInfoInner { kind: enum value has invalid tag: 0x02, backtrace: None })', compiler/rustc_const_eval/src/const_eval/mod.rs:155:54
stack backtrace:
   0:     0x7f86a79f9ebc - std::backtrace_rs::backtrace::libunwind::trace::h60472dd5ee9dd225
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:     0x7f86a79f9ebc - std::backtrace_rs::backtrace::trace_unsynchronized::he4ac0301f3080e76
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7f86a79f9ebc - std::sys_common::backtrace::_print_fmt::h1398c1d985ced523
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/sys_common/backtrace.rs:66:5
   3:     0x7f86a79f9ebc - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h00ca55b8ac8a62a1
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/sys_common/backtrace.rs:45:22
   4:     0x7f86a7a5b2dc - core::fmt::write::h85dce8ff0150bc19
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1190:17
   5:     0x7f86a79e9483 - std::io::Write::write_fmt::hbd12fe6a1a094ebf
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/io/mod.rs:1653:15
   6:     0x7f86a79fe181 - std::sys_common::backtrace::_print::h40c8d66f0eb6b278
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/sys_common/backtrace.rs:48:5
   7:     0x7f86a79fe181 - std::sys_common::backtrace::print::h1bf177868975e2cb
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/sys_common/backtrace.rs:35:9
   8:     0x7f86a79fe181 - std::panicking::default_hook::{{closure}}::hc5d0facd08e7283d
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/panicking.rs:295:22
   9:     0x7f86a79fde3f - std::panicking::default_hook::hab3e1d9294fce4a2
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/panicking.rs:314:9
  10:     0x7f86a81db321 - rustc_driver[cc5d0d7323b4ba94]::DEFAULT_HOOK::{closure#0}::{closure#0}
  11:     0x7f86a79fea5b - std::panicking::rust_panic_with_hook::h4f1584cdf414bef4
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/panicking.rs:702:17
  12:     0x7f86a79fe717 - std::panicking::begin_panic_handler::{{closure}}::hf8a489d32bbc2c2c
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/panicking.rs:588:13
  13:     0x7f86a79fa364 - std::sys_common::backtrace::__rust_end_short_backtrace::hf832a13e7e21db56
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/sys_common/backtrace.rs:138:18
  14:     0x7f86a79fe429 - rust_begin_unwind
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/panicking.rs:584:5
  15:     0x7f86a79c5993 - core::panicking::panic_fmt::hbf161452a7c9acb2
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/panicking.rs:135:14
  16:     0x7f86a79c5a83 - core::result::unwrap_failed::h64cbeef77ebf6b11
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/result.rs:1737:5
  17:     0x7f86aa4985cf - rustc_const_eval[1b8eadeed9db6969]::const_eval::destructure_const
  18:     0x7f86aa484019 - <rustc_const_eval[1b8eadeed9db6969]::provide::{closure#0} as core[b0d7404293a3fd87]::ops::function::FnOnce<(rustc_middle[45c88b609e8f8e33]::ty::context::TyCtxt, rustc_middle[45c88b609e8f8e33]::ty::ParamEnvAnd<&rustc_middle[45c88b609e8f8e33]::ty::consts::Const>)>>::call_once
  19:     0x7f86aa53b79e - rustc_query_system[3d8b70cec00fd81b]::query::plumbing::get_query::<rustc_query_impl[91764b70dfd0fcf4]::queries::destructure_const, rustc_query_impl[91764b70dfd0fcf4]::plumbing::QueryCtxt>
  20:     0x7f86aa569d6a - <rustc_query_impl[91764b70dfd0fcf4]::Queries as rustc_middle[45c88b609e8f8e33]::ty::query::QueryEngine>::destructure_const
  21:     0x7f86a911a6ae - <rustc_middle[45c88b609e8f8e33]::ty::print::pretty::FmtPrinter<&mut core[b0d7404293a3fd87]::fmt::Formatter> as rustc_middle[45c88b609e8f8e33]::ty::print::pretty::PrettyPrinter>::pretty_print_const_value
  22:     0x7f86a9119203 - <rustc_middle[45c88b609e8f8e33]::ty::print::pretty::FmtPrinter<&mut core[b0d7404293a3fd87]::fmt::Formatter> as rustc_middle[45c88b609e8f8e33]::ty::print::pretty::PrettyPrinter>::pretty_print_const
  23:     0x7f86a9134c4e - rustc_middle[45c88b609e8f8e33]::mir::pretty_print_const
  24:     0x7f86a7a5b2dc - core::fmt::write::h85dce8ff0150bc19
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1190:17
  25:     0x7f86a7a5c204 - core::fmt::Formatter::write_fmt::h62886f51e364a7fc
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1644:9
  26:     0x7f86a9134a11 - <rustc_middle[45c88b609e8f8e33]::mir::Constant as core[b0d7404293a3fd87]::fmt::Debug>::fmt
  27:     0x7f86a7a5b2dc - core::fmt::write::h85dce8ff0150bc19
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1190:17
  28:     0x7f86a7a5c204 - core::fmt::Formatter::write_fmt::h62886f51e364a7fc
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1644:9
  29:     0x7f86a9133b6b - <rustc_middle[45c88b609e8f8e33]::mir::Operand as core[b0d7404293a3fd87]::fmt::Debug>::fmt
  30:     0x7f86a7a5b2dc - core::fmt::write::h85dce8ff0150bc19
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1190:17
  31:     0x7f86a7a5c204 - core::fmt::Formatter::write_fmt::h62886f51e364a7fc
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1644:9
  32:     0x7f86a9134339 - <rustc_middle[45c88b609e8f8e33]::mir::Rvalue as core[b0d7404293a3fd87]::fmt::Debug>::fmt
  33:     0x7f86a7a5b2dc - core::fmt::write::h85dce8ff0150bc19
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1190:17
  34:     0x7f86a7a5c204 - core::fmt::Formatter::write_fmt::h62886f51e364a7fc
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1644:9
  35:     0x7f86a91332ae - <rustc_middle[45c88b609e8f8e33]::mir::Statement as core[b0d7404293a3fd87]::fmt::Debug>::fmt
  36:     0x7f86a7a5b257 - core::fmt::run::h9653f5dd76333b06
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1238:5
  37:     0x7f86a7a5b257 - core::fmt::write::h85dce8ff0150bc19
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:1206:26
  38:     0x7f86a7a4e9aa - core::fmt::Write::write_fmt::h63f6e41b1530b23b
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/core/src/fmt/mod.rs:186:9
  39:     0x7f86a7a4e9aa - alloc::fmt::format::hcd5d39968de00b37
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/alloc/src/fmt.rs:597:5
  40:     0x7f86a840c4de - rustc_middle[45c88b609e8f8e33]::mir::pretty::write_mir_fn::<rustc_mir_transform[803bc2b6f12831cd]::mir_const::{closure#0}>
  41:     0x7f86a840a12c - rustc_middle[45c88b609e8f8e33]::mir::pretty::dump_matched_mir_node::<rustc_mir_transform[803bc2b6f12831cd]::pass_manager::dump_mir::{closure#0}>
  42:     0x7f86a9528806 - rustc_mir_transform[803bc2b6f12831cd]::pass_manager::run_passes
  43:     0x7f86a94e3811 - rustc_mir_transform[803bc2b6f12831cd]::optimized_mir
  44:     0x7f86a9ab6872 - rustc_query_system[3d8b70cec00fd81b]::query::plumbing::try_execute_query::<rustc_query_impl[91764b70dfd0fcf4]::plumbing::QueryCtxt, rustc_query_system[3d8b70cec00fd81b]::query::caches::DefaultCache<rustc_span[b5bdd5e1a52b7dc2]::def_id::DefId, &rustc_middle[45c88b609e8f8e33]::mir::Body>>
  45:     0x7f86a9b02097 - <rustc_query_impl[91764b70dfd0fcf4]::Queries as rustc_middle[45c88b609e8f8e33]::ty::query::QueryEngine>::optimized_mir
  46:     0x7f86a9f2ba36 - <rustc_middle[45c88b609e8f8e33]::ty::context::TyCtxt>::instance_mir
  47:     0x7f86a91a1ca1 - rustc_middle[45c88b609e8f8e33]::mir::pretty::write_mir_pretty
  48:     0x7f86a83ef945 - rustc_mir_transform[803bc2b6f12831cd]::dump_mir::emit_mir
  49:     0x7f86aa074de4 - <rustc_interface[89f48262e5023f53]::passes::QueryContext>::enter::<<rustc_interface[89f48262e5023f53]::queries::Queries>::ongoing_codegen::{closure#0}::{closure#0}, core[b0d7404293a3fd87]::result::Result<alloc[132f7870440f24d0]::boxed::Box<dyn core[b0d7404293a3fd87]::any::Any>, rustc_errors[df71701b1e438db7]::ErrorReported>>
  50:     0x7f86aa06a6bf - <rustc_interface[89f48262e5023f53]::queries::Queries>::ongoing_codegen
  51:     0x7f86aa04a26d - <rustc_interface[89f48262e5023f53]::interface::Compiler>::enter::<rustc_driver[cc5d0d7323b4ba94]::run_compiler::{closure#1}::{closure#2}, core[b0d7404293a3fd87]::result::Result<core[b0d7404293a3fd87]::option::Option<rustc_interface[89f48262e5023f53]::queries::Linker>, rustc_errors[df71701b1e438db7]::ErrorReported>>
  52:     0x7f86aa04d296 - rustc_span[b5bdd5e1a52b7dc2]::with_source_map::<core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>, rustc_interface[89f48262e5023f53]::interface::create_compiler_and_run<core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>, rustc_driver[cc5d0d7323b4ba94]::run_compiler::{closure#1}>::{closure#1}>
  53:     0x7f86aa049c1e - rustc_interface[89f48262e5023f53]::interface::create_compiler_and_run::<core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>, rustc_driver[cc5d0d7323b4ba94]::run_compiler::{closure#1}>
  54:     0x7f86aa02fd02 - std[e67c2dc5e94f3edb]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[89f48262e5023f53]::util::setup_callbacks_and_run_in_thread_pool_with_globals<rustc_interface[89f48262e5023f53]::interface::run_compiler<core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>, rustc_driver[cc5d0d7323b4ba94]::run_compiler::{closure#1}>::{closure#0}, core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>>::{closure#0}, core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>>
  55:     0x7f86aa02d419 - <<std[e67c2dc5e94f3edb]::thread::Builder>::spawn_unchecked_<rustc_interface[89f48262e5023f53]::util::setup_callbacks_and_run_in_thread_pool_with_globals<rustc_interface[89f48262e5023f53]::interface::run_compiler<core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>, rustc_driver[cc5d0d7323b4ba94]::run_compiler::{closure#1}>::{closure#0}, core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>>::{closure#0}, core[b0d7404293a3fd87]::result::Result<(), rustc_errors[df71701b1e438db7]::ErrorReported>>::{closure#1} as core[b0d7404293a3fd87]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  56:     0x7f86a7a0a803 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::hcb607540dc5215cf
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/alloc/src/boxed.rs:1854:9
  57:     0x7f86a7a0a803 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::hbe50481c34124364
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/alloc/src/boxed.rs:1854:9
  58:     0x7f86a7a0a803 - std::sys::unix::thread::Thread::new::thread_start::hdee11c2200bcb8c0
                               at /rustc/71226d717a1fb57122e47e63b97295e703319cb0/library/std/src/sys/unix/thread.rs:108:17
  59:     0x7f86a790f259 - start_thread
  60:     0x7f86a782b5e3 - __GI___clone
  61:                0x0 - <unknown>

error: internal compiler error: unexpected panic

note: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.60.0-nightly (71226d717 2022-02-04) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z mir-opt-level=3 -Z dump-mir=all

query stack during panic:
#0 [destructure_const] destructure constant
#1 [optimized_mir] optimizing MIR for `bar`
end of query stack

[compiler-errors]

For the record, it is due to fn bar and doesn't require #![no_core] (but does require that mir_opt flag, and only happens during dump_mir=all)

fn bar() -> Option<()> {
    None?
}

I've tracked this down (possibly) to rustc_mir_transform::const_prop::ConstPropagator::propagate_operand which is only enabled when opt-level >= 3. I might take a look at this..

[compiler-errors]

So actually this doesn't even depend on Try. I'm not sure which mir pass is causing this actually, but only happens when we match Option::<Option<()>>::None which is inlined in a match block (not in a separate let statement). The variable binding for the Some case is also important, and the issue seems to be a discriminant value of 2 being produced somewhere...

minimized (ICEs with -Z mir-opt-level=3 and -Zdump-mir=all):

fn bar() {
    match Option::<Option<()>>::None {
        Some(v) => {}
        None => {}
    }
}

[compiler-errors]

Yeah so it just seems like we're creating invalid scalar values as intermediates in optimization passes (e.g. after const propagation), and then panicking when we pretty-print those invalid values when dumping MIR.

I can give a more detailed explanation why we're creating an invalid scalar, but that scalar is being optimized out anyways in subsequent optimization passes, so I don't think this would ever affect codegen... So not sure how scary this ICE is in practice.

I would claim this issue, but I don't know what the best fix for this would be. Perhaps making query destructure_const return a Result instead of a value...?

Not sure who to ask -- @RalfJung or @oli-obk, perhaps either of y'all have an opinion on this?

reason why we're creating an invalid scalar

1. the value Option::<Option<()>>::None is const-evaluated into the scalar value 2.
2. When we generate the MIR branch for Some(v) => ..., we emit the MIR expression ((_1 as Some).0: std::option::Option<()>) where _1 is that scalar value above.
3. During const-propagation, we try to inline _1 (that is, scalar value 2) into all places that reference it, even those that are invalid, such as the unreachable branch.
4. Therefore, we end up basically calculating (None as Some).0. This ends up creating an Option<()> with an invalid scalar value of 2 (we only expect the values 0 and 1).
5. We then try to pretty print that value by getting its discriminant and values, but we are unable to tell what the discriminant of an Option<()> with an invalid scalar value is. So we ICE.

[RalfJung]

Yeah so it just seems like we're creating invalid scalar values as intermediates in optimization passes (e.g. after const propagation), and then panicking when we pretty-print those invalid values when dumping MIR.

I can give a more detailed explanation why we're creating an invalid scalar, but that scalar is being optimized out anyways in subsequent optimization passes, so I don't think this would ever affect codegen... So not sure how scary this ICE is in practice.

An optimization pass that introduces invalid scalars literally introduces UB into well-defined code (unless this is in dead code), so -- I would say this is rather scary, on the level of "I-unsound".

[oli-obk]

Fairly certain this only happens in unreachable branches (default branches of exhaustive switches), but i'll dig into it.

[compiler-errors]

Sorry, yes, it only seems to happen (as far as I know) in dead branches. The issue here only seems to be printing MIR with these dead branches still in the code.

[RalfJung]

Okay that is less critical then. Arguably printing should work even for invalid code.

It still seems interesting to figure out why this happens. I would understand if this was an uninhabited variant, but seeing an entirely non-existing discriminant is surprising.

[compiler-errors]

I left an explanation above in an collapsible block as to why we're creating this invalid value.

I believe the root cause is that we perform operations in const propagation infallibly. It would probably be desirable to prevent this by making const propagation fallible if the const is incompatible with the layout of the result of the operation being applied to it.

Then when we apply something like (_1 as Some).0 when _1 = None to access the field of the Option::Some variant on a dead branch, we don't create an invalid value.

[RalfJung]

Okay so it looks like possibly we should adjust the "downcast" projection(s) to verify that the place has the right variant, and throw_ub! otherwise? Then evaluating None as Some would fail and ConstProp would not touch that code, I think.

[compiler-errors]

@RalfJung yup that sounds correct. do you want me to make that change?

[RalfJung]

One thing I am wondering about is if this will work correctly for generators -- the have more complicated variants than enums do, and maybe there are situations there where projections to the "wrong" variant are actually okay? Cc @tmandry

[tmiasko]

@RalfJung are you proposing to declare downcast to an inactive variant to be undefined behaviour? This is probably larger change, in a sense that it would be incompatible with how downcast is currently used:

• In generators each field is accessed through a single representative variant, regardless of the current variant.
• Aggregate enum assignments are lowered to a field-wise assignments (using downcast) with a discriminant set last.