Miri run fails with ICE since nightly-2022-10-07-x86_64-unknown-linux-gnu

[pdegler]

The ICE started to occur with bors merges from 6.10.2022. Or in other words the ICEs started to occur with nightly-2022-10-07-x86_64-unknown-linux-gnu. Might be related to this ?

Code

Unfortunately there is no simple example to reproduce the problem. Also the bug does not occur if I only execute the one failing test. I need to execute the whole suite to reproduce the issue. Miri runs fine though if I run it with -Zmiri-disable-stacked-borrows. I will update the ticket in case I find a way to reproduce it with a minimal example.

Meta

note: rustc 1.66.0-nightly (b8b5caee0 2022-10-16) running on x86_64-unknown-linux-gnu

note: compiler flags: -C embed-bitcode=no -C debuginfo=2 -C linker=/usr/local/bin/clang -C incremental=[REDACTED] -C link-arg=--ld-path=/usr/local/bin/mold -C target-cpu=haswell```

Error output

The len is not always 101. It seems to vary.

thread 'rustc' panicked at 'index out of bounds: the len is 101 but the index is 18446744073709551615', src/tools/miri/src/stacked_borrows/stack.rs:52:24
stack backtrace:
   0:     0x7f76f2f456e0 - std::backtrace_rs::backtrace::libunwind::trace::h420b76cfb3ed276a
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   1:     0x7f76f2f456e0 - std::backtrace_rs::backtrace::trace_unsynchronized::hacbdb913ccea9101
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7f76f2f456e0 - std::sys_common::backtrace::_print_fmt::h953538eb8ba96ed5
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/sys_common/backtrace.rs:65:5
   3:     0x7f76f2f456e0 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h93076eeb0a1bbed5
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x7f76f2fa15fe - core::fmt::write::h56b300bf57434f0c
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/core/src/fmt/mod.rs:1209:17
   5:     0x7f76f2f35855 - std::io::Write::write_fmt::h17ff8142c543b395
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/io/mod.rs:1682:15
   6:     0x7f76f2f454a5 - std::sys_common::backtrace::_print::h3d4b2f01b3435b19
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/sys_common/backtrace.rs:47:5
   7:     0x7f76f2f454a5 - std::sys_common::backtrace::print::hf0ed5585934d912e
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/sys_common/backtrace.rs:34:9
   8:     0x7f76f2f482af - std::panicking::default_hook::{{closure}}::h042859901da68b6e
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/panicking.rs:267:22
   9:     0x7f76f2f47fea - std::panicking::default_hook::h37c1e6eb5579d239
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/panicking.rs:286:9
  10:     0x7f76f58808a4 - <rustc_driver[1e91e83c40bca741]::DEFAULT_HOOK::{closure#0}::{closure#0} as core[d82daa41da2dcefe]::ops::function::FnOnce<(&core[d82daa41da2dcefe]::panic::panic_info::PanicInfo,)>>::call_once::{shim:vtable#0}
  11:     0x7f76f2f48ad9 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::h6a10e1e797bea4c6
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/alloc/src/boxed.rs:1952:9
  12:     0x7f76f2f48ad9 - std::panicking::rust_panic_with_hook::ha30c889a2575a2e7
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/panicking.rs:692:13
  13:     0x7f76f2f48857 - std::panicking::begin_panic_handler::{{closure}}::h05a6c6601af742f3
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/panicking.rs:579:13
  14:     0x7f76f2f45b8c - std::sys_common::backtrace::__rust_end_short_backtrace::h1f8e6345c4ccc6b4
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/sys_common/backtrace.rs:137:18
  15:     0x7f76f2f48572 - rust_begin_unwind
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/panicking.rs:575:5
  16:     0x7f76f2f9dfe3 - core::panicking::panic_fmt::h4e865b31b9e1bf2f
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/core/src/panicking.rs:65:14
  17:     0x7f76f2f9e1b2 - core::panicking::panic_bounds_check::h969e95bf83fee39f
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/core/src/panicking.rs:151:5
  18:     0x55eaede085dd - <miri[153892d8abf64b8a]::stacked_borrows::stack::Stack>::retain
  19:     0x55eaeddd1185 - <miri[153892d8abf64b8a]::mono_hash_map::MonoHashMap<rustc_middle[964f6684a34862c]::mir::interpret::AllocId, (rustc_const_eval[50e6fab6802f709a]::interpret::memory::MemoryKind<miri[153892d8abf64b8a]::machine::MiriMemoryKind>, rustc_middle[964f6684a34862c]::mir::interpret::allocation::Allocation<miri[153892d8abf64b8a]::machine::Provenance, miri[153892d8abf64b8a]::machine::AllocExtra>)>>::iter::<(), <rustc_const_eval[50e6fab6802f709a]::interpret::eval_context::InterpCx<miri[153892d8abf64b8a]::machine::MiriMachine> as miri[153892d8abf64b8a]::tag_gc::EvalContextExt>::remove_unreachable_tags::{closure#0}>
  20:     0x55eaeddad8fc - <rustc_const_eval[50e6fab6802f709a]::interpret::eval_context::InterpCx<miri[153892d8abf64b8a]::machine::MiriMachine> as miri[153892d8abf64b8a]::tag_gc::EvalContextExt>::garbage_collect_tags
  21:     0x55eaedcf3c26 - <miri[153892d8abf64b8a]::machine::MiriMachine as rustc_const_eval[50e6fab6802f709a]::interpret::machine::Machine>::before_terminator
  22:     0x55eaede18357 - <core[d82daa41da2dcefe]::panic::unwind_safe::AssertUnwindSafe<miri[153892d8abf64b8a]::eval::eval_entry::{closure#0}> as core[d82daa41da2dcefe]::ops::function::FnOnce<()>>::call_once
  23:     0x55eaeddf0a0d - miri[153892d8abf64b8a]::eval::eval_entry
  24:     0x55eaedc5eba5 - <rustc_interface[b8f074db5ccc3360]::passes::QueryContext>::enter::<<miri[462ec713bdb5374c]::MiriCompilerCalls as rustc_driver[1e91e83c40bca741]::Callbacks>::after_analysis::{closure#0}, ()>
  25:     0x55eaedc63443 - <miri[462ec713bdb5374c]::MiriCompilerCalls as rustc_driver[1e91e83c40bca741]::Callbacks>::after_analysis
  26:     0x7f76f45cf640 - rustc_interface[b8f074db5ccc3360]::interface::create_compiler_and_run::<core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>, rustc_driver[1e91e83c40bca741]::run_compiler::{closure#1}>
  27:     0x7f76f45ce442 - <scoped_tls[e8b2fb1c76acaf86]::ScopedKey<rustc_span[b9d6d35501d56459]::SessionGlobals>>::set::<rustc_interface[b8f074db5ccc3360]::interface::run_compiler<core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>, rustc_driver[1e91e83c40bca741]::run_compiler::{closure#1}>::{closure#0}, core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>>
  28:     0x7f76f45cd91f - std[c2cba6617b893ef2]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[b8f074db5ccc3360]::util::run_in_thread_pool_with_globals<rustc_interface[b8f074db5ccc3360]::interface::run_compiler<core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>, rustc_driver[1e91e83c40bca741]::run_compiler::{closure#1}>::{closure#0}, core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>>::{closure#0}, core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>>
  29:     0x7f76f569816f - <<std[c2cba6617b893ef2]::thread::Builder>::spawn_unchecked_<rustc_interface[b8f074db5ccc3360]::util::run_in_thread_pool_with_globals<rustc_interface[b8f074db5ccc3360]::interface::run_compiler<core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>, rustc_driver[1e91e83c40bca741]::run_compiler::{closure#1}>::{closure#0}, core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>>::{closure#0}, core[d82daa41da2dcefe]::result::Result<(), rustc_errors[ecc419c4e7845dee]::ErrorGuaranteed>>::{closure#1} as core[d82daa41da2dcefe]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  30:     0x7f76f2f525f3 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h989602533cadda4e
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/alloc/src/boxed.rs:1938:9
  31:     0x7f76f2f525f3 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h1a2c4b6f03540d6c
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/alloc/src/boxed.rs:1938:9
  32:     0x7f76f2f525f3 - std::sys::unix::thread::Thread::new::thread_start::h0a8188ba46c415bc
                               at /rustc/b8b5caee04116c7383eb1c6470fcf15c437a60d4/library/std/src/sys/unix/thread.rs:108:17
  33:     0x7f76f2e0d609 - start_thread
  34:     0x7f76f2be1133 - clone
  35:                0x0 - <unknown>

error: internal compiler error: unexpected panic

note: rustc 1.66.0-nightly (b8b5caee0 2022-10-16) running on x86_64-unknown-linux-gnu

note: compiler flags: -C embed-bitcode=no -C debuginfo=2 -C linker=/usr/local/bin/clang -C incremental=[REDACTED] -C link-arg=--ld-path=/usr/local/bin/mold -C target-cpu=haswell

note: some of the compiler flags provided by cargo are hidden

query stack during panic:
end of query stack

Miri caused an ICE during evaluation. Here's the interpreter backtrace at the time of the panic:
note: the place in the program where the ICE was triggered
    --> /home/foolius/.rustup/toolchains/nightly-2022-10-17-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mut_ptr.rs:40:28
     |
40   |             Some(res) => res,
     |                            ^
     |
     = note: inside `std::ptr::mut_ptr::<impl *mut u8>::is_null` at /home/foolius/.rustup/toolchains/nightly-2022-10-17-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mut_ptr.rs:40:28
     = note: inside `std::ptr::NonNull::<u8>::new` at /home/foolius/.rustup/toolchains/nightly-2022-10-17-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/non_null.rs:219:13
     = note: inside `std::alloc::Global::alloc_impl` at /home/foolius/.rustup/toolchains/nightly-2022-10-17-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/alloc.rs:182:27
     = note: inside `<std::alloc::Global as std::alloc::Allocator>::allocate` at /home/foolius/.rustup/toolchains/nightly-2022-10-17-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/alloc.rs:241:9
     = note: inside `alloc::alloc::exchange_malloc` at /home/foolius/.rustup/toolchains/nightly-2022-10-17-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/alloc.rs:330:11
     = note: inside `arrow::array::data::layout` at /home/foolius/.rustup/toolchains/nightly-2022-10-17-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/macros.rs:52:13
     = note: inside `arrow::array::ArrayData::validate` at /home/foolius/.cargo/registry/src/github.com-1ecc6299db9ec823/arrow-22.0.0/src/array/data.rs:662:22
     = note: inside `arrow::array::ArrayData::validate_full` at /home/foolius/.cargo/registry/src/github.com-1ecc6299db9ec823/arrow-22.0.0/src/array/data.rs:1004:9

[saethlin]

You could pass -Zmiri-tag-gc=0 as well, that will just make things slower but you'll still get Stacked Borrows checks.

Can you share the code that causes this crash? (a whole repo works)

[saethlin]

@rustbot claim
🤦 found the bug

[pdegler]

-Zmiri-tag-gc=0

Just setting this flag did help to prevent the ICE. Seems like you really found it.

[pdegler]

How do I know whether a miri-fix is part of the latest nightly?