unreachable!() with `custom_mir`

[matthiaskrgr]

feel free to close if miri is never intended to work with custom mir :)
from src/test/mir-opt/building/custom/references.rs

#![feature(custom_mir, core_intrinsics)]

extern crate core;
use core::intrinsics::mir::*;
use core::ptr::{addr_of, addr_of_mut};

// EMIT_MIR references.mut_ref.built.after.mir
#[custom_mir(dialect = "runtime", phase = "optimized")]
pub fn mut_ref(x: &mut i32) -> &mut i32 {
    mir!(
        let t: *mut i32;

        {
            t = addr_of_mut!(*x);
            RetagRaw(t);
            RET = &mut *t;
            Retag(RET);
            Return()
        }
    )
}


fn main() {
    let mut x = 5;
    assert_eq!(*mut_ref(&mut x), 5);
}

warning: unused import: `addr_of`
 --> src/main.rs:5:17
  |
5 | use core::ptr::{addr_of, addr_of_mut};
  |                 ^^^^^^^
  |
  = note: `#[warn(unused_imports)]` on by default

warning: crate `F` should have a snake case name
  |
  = help: convert the identifier to snake case: `f`
  = note: `#[warn(non_snake_case)]` on by default

thread 'rustc' panicked at 'internal error: entered unreachable code', src/tools/miri/src/borrow_tracker/stacked_borrows/mod.rs:878:60
stack backtrace:
   0:     0x7ffb0f165a7a - std::backtrace_rs::backtrace::libunwind::trace::h06c3ddb908575635
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:     0x7ffb0f165a7a - std::backtrace_rs::backtrace::trace_unsynchronized::h8bfc3753e1cc3345
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7ffb0f165a7a - std::sys_common::backtrace::_print_fmt::h3c304feda98d6679
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/sys_common/backtrace.rs:65:5
   3:     0x7ffb0f165a7a - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h98af9289a7a29dc2
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x7ffb0f1c87ae - core::fmt::write::h02538848739b7e2a
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/core/src/fmt/mod.rs:1208:17
   5:     0x7ffb0f155f45 - std::io::Write::write_fmt::h4aac2f2c3f0128af
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/io/mod.rs:1682:15
   6:     0x7ffb0f165845 - std::sys_common::backtrace::_print::h2e2acfe71f2fdb67
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/sys_common/backtrace.rs:47:5
   7:     0x7ffb0f165845 - std::sys_common::backtrace::print::h5bf077c253fab052
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/sys_common/backtrace.rs:34:9
   8:     0x7ffb0f16858f - std::panicking::default_hook::{{closure}}::h0ceeeedebdf177d0
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/panicking.rs:267:22
   9:     0x7ffb0f1682cb - std::panicking::default_hook::h7d6f04e84940bd1d
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/panicking.rs:286:9
  10:     0x7ffb12440511 - rustc_driver[3622bb61b1ebe64a]::DEFAULT_HOOK::{closure#0}::{closure#0}
  11:     0x7ffb0f168dcd - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::hc60f5ae29562b326
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/alloc/src/boxed.rs:2032:9
  12:     0x7ffb0f168dcd - std::panicking::rust_panic_with_hook::hce0f8648dbfb386b
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/panicking.rs:692:13
  13:     0x7ffb0f168b02 - std::panicking::begin_panic_handler::{{closure}}::h6ffcdb3a218d0ebe
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/panicking.rs:577:13
  14:     0x7ffb0f165f2c - std::sys_common::backtrace::__rust_end_short_backtrace::hc576a427f61fdaa5
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/sys_common/backtrace.rs:137:18
  15:     0x7ffb0f168852 - rust_begin_unwind
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/panicking.rs:575:5
  16:     0x7ffb0f1c5193 - core::panicking::panic_fmt::habc1ee4a9702013e
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/core/src/panicking.rs:64:14
  17:     0x7ffb0f1c526d - core::panicking::panic::h73f802489c27713b
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/core/src/panicking.rs:111:5
  18:     0x558ef60bb107 - <rustc_const_eval[60209f501fc07249]::interpret::eval_context::InterpCx<miri[df45d2962384a2a4]::machine::MiriMachine> as miri[df45d2962384a2a4]::concurrency::thread::EvalContextExt>::run_threads
  19:     0x558ef6165e1d - miri[df45d2962384a2a4]::eval::eval_entry
  20:     0x558ef5fc10e4 - <rustc_interface[299971c75fff0058]::passes::QueryContext>::enter::<<miri[2cc0a1151e659598]::MiriCompilerCalls as rustc_driver[3622bb61b1ebe64a]::Callbacks>::after_analysis::{closure#0}, ()>
  21:     0x558ef5fc6263 - <miri[2cc0a1151e659598]::MiriCompilerCalls as rustc_driver[3622bb61b1ebe64a]::Callbacks>::after_analysis
  22:     0x7ffb116d1661 - <rustc_interface[299971c75fff0058]::interface::Compiler>::enter::<rustc_driver[3622bb61b1ebe64a]::run_compiler::{closure#1}::{closure#2}, core[62c015fcd585be4a]::result::Result<core[62c015fcd585be4a]::option::Option<rustc_interface[299971c75fff0058]::queries::Linker>, rustc_errors[19d12f94925af316]::ErrorGuaranteed>>
  23:     0x7ffb116cc658 - rustc_span[ea560f4838c45ec0]::with_source_map::<core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>, rustc_interface[299971c75fff0058]::interface::run_compiler<core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>, rustc_driver[3622bb61b1ebe64a]::run_compiler::{closure#1}>::{closure#0}::{closure#0}>
  24:     0x7ffb116cc145 - <scoped_tls[6f6de2f0677d8068]::ScopedKey<rustc_span[ea560f4838c45ec0]::SessionGlobals>>::set::<rustc_interface[299971c75fff0058]::interface::run_compiler<core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>, rustc_driver[3622bb61b1ebe64a]::run_compiler::{closure#1}>::{closure#0}, core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>>
  25:     0x7ffb116cb732 - std[688abfdbcfe52504]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[299971c75fff0058]::util::run_in_thread_pool_with_globals<rustc_interface[299971c75fff0058]::interface::run_compiler<core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>, rustc_driver[3622bb61b1ebe64a]::run_compiler::{closure#1}>::{closure#0}, core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>>
  26:     0x7ffb11d03aba - <<std[688abfdbcfe52504]::thread::Builder>::spawn_unchecked_<rustc_interface[299971c75fff0058]::util::run_in_thread_pool_with_globals<rustc_interface[299971c75fff0058]::interface::run_compiler<core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>, rustc_driver[3622bb61b1ebe64a]::run_compiler::{closure#1}>::{closure#0}, core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[62c015fcd585be4a]::result::Result<(), rustc_errors[19d12f94925af316]::ErrorGuaranteed>>::{closure#1} as core[62c015fcd585be4a]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  27:     0x7ffb0f172dc3 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h16c8b1a5112fc07f
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/alloc/src/boxed.rs:2000:9
  28:     0x7ffb0f172dc3 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h0cc5ff4fc4b4dcff
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/alloc/src/boxed.rs:2000:9
  29:     0x7ffb0f172dc3 - std::sys::unix::thread::Thread::new::thread_start::ha7c6dff74603472f
                               at /rustc/935dc07218b4bf6e20231e44eb9263b612fd649b/library/std/src/sys/unix/thread.rs:108:17
  30:     0x7ffb0ee1d8fd - <unknown>
  31:     0x7ffb0ee9fa60 - <unknown>
  32:                0x0 - <unknown>

error: internal compiler error: unexpected panic

note: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.68.0-nightly (935dc0721 2022-12-19) running on x86_64-unknown-linux-gnu

note: compiler flags: --crate-type bin -C embed-bitcode=no -C debuginfo=2 -C incremental=[REDACTED] -C target-cpu=native

note: some of the compiler flags provided by cargo are hidden

query stack during panic:
end of query stack

Miri caused an ICE during evaluation. Here's the interpreter backtrace at the time of the panic:
note: the place in the program where the ICE was triggered
  --> src/main.rs:15:13
   |
15 |             RetagRaw(t);
   |             ^^^^^^^^^^^
   |
   = note: inside `mut_ref` at src/main.rs:15:13: 15:24
note: inside `main`
  --> src/main.rs:26:17
   |
26 |     assert_eq!(*mut_ref(&mut x), 5);
   |                 ^^^^^^^^^^^^^^^
   = note: inside `<fn() as std::ops::FnOnce<()>>::call_once - shim(fn())` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:507:5: 507:71
   = note: inside `std::sys_common::backtrace::__rust_begin_short_backtrace::<fn(), ()>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:121:18: 121:21
   = note: inside closure at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:166:18: 166:82
   = note: inside `std::ops::function::impls::<impl std::ops::FnOnce<()> for &dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe>::call_once` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:606:13: 606:31
   = note: inside `std::panicking::r#try::do_call::<&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe, i32>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:483:40: 483:43
   = note: inside `std::panicking::r#try::<i32, &dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:447:19: 447:81
   = note: inside `std::panic::catch_unwind::<&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe, i32>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:137:14: 137:33
   = note: inside closure at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:148:48: 148:73
   = note: inside `std::panicking::r#try::do_call::<[closure@std::rt::lang_start_internal::{closure#2}], isize>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:483:40: 483:43
   = note: inside `std::panicking::r#try::<isize, [closure@std::rt::lang_start_internal::{closure#2}]>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:447:19: 447:81
   = note: inside `std::panic::catch_unwind::<[closure@std::rt::lang_start_internal::{closure#2}], isize>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:137:14: 137:33
   = note: inside `std::rt::lang_start_internal` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:148:20: 148:98
   = note: inside `std::rt::lang_start::<()>` at /home/matthias/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/rt.rs:165:17: 170:6

warning: 2 warnings emitted

[saethlin]

Hm, in principle Miri should work with custom MIR, but also using custom MIR it's possible to write MIR that it is impossible for rustc to otherwise emit, for example because it wouldn't pass borrowck. That said, until someone figures out how to write a proper fuzzer for MIR, it's probably better to have issues like this than not.

(I really want to have a fuzzer for MIR)

[RalfJung]

Would have to check what happens here, but yeah in principle we should be able to interpret all MIR that passes MIR validation. @JakobDegen is MIR validation being run on custom_mir? (Also makes me wonder whether it is run on shims.)

(I really want to have a fuzzer for MIR)

Stay tuned. ;)

[JakobDegen]

is MIR validation being run on custom_mir? (Also makes me wonder whether it is run on shims.)

Yes for custom mir. Shims also have validation run on them, except for drop shims for generators which don't for some reason? See the fixme here

[RalfJung]

Oh but looking at the ICE, this should be rejected by validation. We just don't validate retags currently.

There should be no Retag(Raw) anywhere any more. In fact it looks like custom-mir has dedicated syntax for that, RetagRaw? That should be removed. The retag now happens implicitly as part of the addr-of.

[RalfJung]

Shims also have validation run on them, except for drop shims for generators which don't for some reason? See the fixme here

I would have appreciated if you made a new comment for that. When just reading the notifications emails sent, edits are invisible. :D

Yeah that looks wrong... or at least suspicious. See rust-lang/rust#91576.

[RalfJung]

Fixed by rust-lang/rust#106012