@@ -214,12 +214,77 @@ impl<'a, 'tcx> Builder<'a, 'tcx> {
214
214
///
215
215
/// ## False edges
216
216
///
217
- /// We don't want to have the exact structure of the decision tree be
218
- /// visible through borrow checking. False edges ensure that the CFG as
219
- /// seen by borrow checking doesn't encode this. False edges are added:
217
+ /// We don't want to have the exact structure of the decision tree be visible through borrow
218
+ /// checking. Specifically we want borrowck to think that:
219
+ /// - at any point, any or none of the patterns and guards seen so far may have been tested;
220
+ /// - after the match, any of the patterns may have matched.
220
221
///
221
- /// * From each pre-binding block to the next pre-binding block.
222
- /// * From each otherwise block to the next pre-binding block.
222
+ /// For example, all of these would fail to error if borrowck could see the real CFG (examples
223
+ /// taken from `tests/ui/nll/match-cfg-fake-edges.rs`):
224
+ /// ```ignore (too many errors, this is already in the test suite)
225
+ /// let x = String::new();
226
+ /// let _ = match true {
227
+ /// _ => {},
228
+ /// _ => drop(x),
229
+ /// };
230
+ /// // Borrowck must not know the second arm is never run.
231
+ /// drop(x); //~ ERROR use of moved value
232
+ ///
233
+ /// let x;
234
+ /// # let y = true;
235
+ /// match y {
236
+ /// _ if { x = 2; true } => {},
237
+ /// // Borrowck must not know the guard is always run.
238
+ /// _ => drop(x), //~ ERROR used binding `x` is possibly-uninitialized
239
+ /// };
240
+ ///
241
+ /// let x = String::new();
242
+ /// # let y = true;
243
+ /// match y {
244
+ /// false if { drop(x); true } => {},
245
+ /// // Borrowck must not know the guard is not run in the `true` case.
246
+ /// true => drop(x), //~ ERROR use of moved value: `x`
247
+ /// false => {},
248
+ /// };
249
+ ///
250
+ /// # let mut y = (true, true);
251
+ /// let r = &mut y.1;
252
+ /// match y {
253
+ /// //~^ ERROR cannot use `y.1` because it was mutably borrowed
254
+ /// (false, true) => {}
255
+ /// // Borrowck must not know we don't test `y.1` when `y.0` is `true`.
256
+ /// (true, _) => drop(r),
257
+ /// (false, _) => {}
258
+ /// };
259
+ /// ```
260
+ ///
261
+ /// We add false edges to act as if we were naively matching each arm in order. What we need is
262
+ /// a (fake) path from each candidate to the next, specifically from candidate C's pre-binding
263
+ /// block to next candidate D's pre-binding block. For maximum precision (needed for deref
264
+ /// patterns), we choose the earliest node on D's success path that doesn't also lead to C (to
265
+ /// avoid loops).
266
+ ///
267
+ /// This turns out to be easy to compute: that block is the `start_block` of the first call to
268
+ /// `match_candidates` where D is the first candidate in the list.
269
+ ///
270
+ /// For example:
271
+ /// ```rust
272
+ /// # let (x, y) = (true, true);
273
+ /// match (x, y) {
274
+ /// (true, true) => 1,
275
+ /// (false, true) => 2,
276
+ /// (true, false) => 3,
277
+ /// _ => 4,
278
+ /// }
279
+ /// # ;
280
+ /// ```
281
+ /// In this example, the pre-binding block of arm 1 has a false edge to the block for result
282
+ /// `false` of the first test on `x`. The other arms have false edges to the pre-binding blocks
283
+ /// of the next arm.
284
+ ///
285
+ /// On top of this, we also add a false edge from the otherwise_block of each guard to the
286
+ /// aforementioned start block of the next candidate, to ensure borrock doesn't rely on which
287
+ /// guards may have run.
223
288
#[ instrument( level = "debug" , skip( self , arms) ) ]
224
289
pub ( crate ) fn match_expr (
225
290
& mut self ,
@@ -365,7 +430,8 @@ impl<'a, 'tcx> Builder<'a, 'tcx> {
365
430
for candidate in candidates {
366
431
candidate. visit_leaves ( |leaf_candidate| {
367
432
if let Some ( ref mut prev) = previous_candidate {
368
- prev. next_candidate_pre_binding_block = leaf_candidate. pre_binding_block ;
433
+ assert ! ( leaf_candidate. false_edge_start_block. is_some( ) ) ;
434
+ prev. next_candidate_start_block = leaf_candidate. false_edge_start_block ;
369
435
}
370
436
previous_candidate = Some ( leaf_candidate) ;
371
437
} ) ;
@@ -1010,8 +1076,12 @@ struct Candidate<'pat, 'tcx> {
1010
1076
1011
1077
/// The block before the `bindings` have been established.
1012
1078
pre_binding_block : Option < BasicBlock > ,
1013
- /// The pre-binding block of the next candidate.
1014
- next_candidate_pre_binding_block : Option < BasicBlock > ,
1079
+
1080
+ /// The earliest block that has only candidates >= this one as descendents. Used for false
1081
+ /// edges, see the doc for [`Builder::match_expr`].
1082
+ false_edge_start_block : Option < BasicBlock > ,
1083
+ /// The `false_edge_start_block` of the next candidate.
1084
+ next_candidate_start_block : Option < BasicBlock > ,
1015
1085
}
1016
1086
1017
1087
impl < ' tcx , ' pat > Candidate < ' pat , ' tcx > {
@@ -1033,7 +1103,8 @@ impl<'tcx, 'pat> Candidate<'pat, 'tcx> {
1033
1103
or_span : None ,
1034
1104
otherwise_block : None ,
1035
1105
pre_binding_block : None ,
1036
- next_candidate_pre_binding_block : None ,
1106
+ false_edge_start_block : None ,
1107
+ next_candidate_start_block : None ,
1037
1108
}
1038
1109
}
1039
1110
@@ -1325,6 +1396,12 @@ impl<'a, 'tcx> Builder<'a, 'tcx> {
1325
1396
otherwise_block : BasicBlock ,
1326
1397
candidates : & mut [ & mut Candidate < ' _ , ' tcx > ] ,
1327
1398
) {
1399
+ if let [ first, ..] = candidates {
1400
+ if first. false_edge_start_block . is_none ( ) {
1401
+ first. false_edge_start_block = Some ( start_block) ;
1402
+ }
1403
+ }
1404
+
1328
1405
match candidates {
1329
1406
[ ] => {
1330
1407
// If there are no candidates that still need testing, we're done. Since all matches are
@@ -1545,6 +1622,7 @@ impl<'a, 'tcx> Builder<'a, 'tcx> {
1545
1622
. into_iter ( )
1546
1623
. map ( |flat_pat| Candidate :: from_flat_pat ( flat_pat, candidate. has_guard ) )
1547
1624
. collect ( ) ;
1625
+ candidate. subcandidates [ 0 ] . false_edge_start_block = candidate. false_edge_start_block ;
1548
1626
}
1549
1627
1550
1628
/// Try to merge all of the subcandidates of the given candidate into one. This avoids
@@ -1564,6 +1642,10 @@ impl<'a, 'tcx> Builder<'a, 'tcx> {
1564
1642
let any_matches = self . cfg . start_new_block ( ) ;
1565
1643
let or_span = candidate. or_span . take ( ) . unwrap ( ) ;
1566
1644
let source_info = self . source_info ( or_span) ;
1645
+ if candidate. false_edge_start_block . is_none ( ) {
1646
+ candidate. false_edge_start_block =
1647
+ candidate. subcandidates [ 0 ] . false_edge_start_block ;
1648
+ }
1567
1649
for subcandidate in mem:: take ( & mut candidate. subcandidates ) {
1568
1650
let or_block = subcandidate. pre_binding_block . unwrap ( ) ;
1569
1651
self . cfg . goto ( or_block, source_info, any_matches) ;
@@ -1979,12 +2061,12 @@ impl<'a, 'tcx> Builder<'a, 'tcx> {
1979
2061
1980
2062
let mut block = candidate. pre_binding_block . unwrap ( ) ;
1981
2063
1982
- if candidate. next_candidate_pre_binding_block . is_some ( ) {
2064
+ if candidate. next_candidate_start_block . is_some ( ) {
1983
2065
let fresh_block = self . cfg . start_new_block ( ) ;
1984
2066
self . false_edges (
1985
2067
block,
1986
2068
fresh_block,
1987
- candidate. next_candidate_pre_binding_block ,
2069
+ candidate. next_candidate_start_block ,
1988
2070
candidate_source_info,
1989
2071
) ;
1990
2072
block = fresh_block;
@@ -2132,7 +2214,7 @@ impl<'a, 'tcx> Builder<'a, 'tcx> {
2132
2214
self . false_edges (
2133
2215
otherwise_post_guard_block,
2134
2216
otherwise_block,
2135
- candidate. next_candidate_pre_binding_block ,
2217
+ candidate. next_candidate_start_block ,
2136
2218
source_info,
2137
2219
) ;
2138
2220
0 commit comments