ICE `assertion failed: !maybe`

[matthiaskrgr]

auto-reduced (treereduce-rust):

//@compile-flags: -Zextra-const-ub-checks
use std::mem;

#[repr(C)]

const MAYBE_NULL_FN_PTR: fn() = unsafe {
    mem::transmute({
        fn fun() {}
        let ptr = fun as fn();
        (ptr as *const u8).wrapping_add(10)
    })
};

original code

original:

// ignore-tidy-linelength
// Strip out raw byte dumps to make comparison platform-independent:
//@ normalize-stderr: "(the raw bytes of the constant) \(size: [0-9]*, align: [0-9]*\)" -> "$1 (size: $$SIZE, align: $$ALIGN)"
//@ normalize-stderr: "([0-9a-f][0-9a-f] |__ |╾─*ALLOC[0-9]+(\+[a-z0-9]+)?(<imm>)?─*╼ )+ *│.*" -> "HEX_DUMP"
//@ dont-require-annotations: NOTE
//@ normalize-stderr: "0x[0-9](\.\.|\])" -> "0x%$1"
#![feature(rustc_attrs)]
#![allow(invalid_value)]

use std::mem;

#[repr(C)]
union MaybeUninit<T: Copy> {
    uninit: (),
    init: T,
}

const UNALIGNED: &u16 = unsafe { mem::transmute(&[0u8; 4]) };
//~^ ERROR constructing invalid value: encountered an unaligned reference (required 2 byte alignment but found 1)

const UNALIGNED_BOX: Box<u16> = unsafe { mem::transmute(&[0u8; 4]) };
//~^ ERROR constructing invalid value: encountered an unaligned box (required 2 byte alignment but found 1)

const NULL: &u16 = unsafe { mem::transmute(0usize) };
//~^ ERROR invalid value

const NULL_BOX: Box<u16> = unsafe { mem::transmute(0usize) };
//~^ ERROR invalid value

const MAYBE_NULL_BOX: Box<()> = unsafe { mem::transmute({
//~^ ERROR maybe-null
    let ref_ = &0u8;
    (ref_ as *const u8).wrapping_add(10)
}) };

// It is very important that we reject this: We do promote `&(4 * REF_AS_USIZE)`,
// but that would fail to compile; so we ended up breaking user code that would
// have worked fine had we not promoted.
const REF_AS_USIZE: usize = unsafe { mem::transmute(&0) };
//~^ ERROR unable to turn pointer into integer

const REF_AS_USIZE_SLICE: &[usize] = &[unsafe { mem::transmute(&0) }];
//~^ ERROR unable to turn pointer into integer

const REF_AS_USIZE_BOX_SLICE: Box<[usize]> = unsafe { mem::transmute::<&[usize], _>(&[mem::transmute(&0)]) };
//~^ ERROR unable to turn pointer into integer

const USIZE_AS_REF: &'static u8 = unsafe { mem::transmute(1337usize) };
//~^ ERROR invalid value

const USIZE_AS_BOX: Box<u8> = unsafe { mem::transmute(1337usize) };
//~^ ERROR invalid value

const UNINIT_PTR: *const i32 = unsafe { MaybeUninit { uninit: () }.init };
//~^ ERROR uninitialized

const NULL_FN_PTR: fn() = unsafe { mem::transmute(0usize) };
//~^ ERROR invalid value
const UNINIT_FN_PTR: fn() = unsafe { MaybeUninit { uninit: () }.init };
//~^ ERROR uninitialized
const DANGLING_FN_PTR: fn() = unsafe { mem::transmute(13usize) };
//~^ ERROR invalid value
const DATA_FN_PTR: fn() = unsafe { mem::transmute(&13) };
//~^ ERROR invalid value
const MAYBE_NULL_FN_PTR: fn() = unsafe { mem::transmute({
//~^ ERROR invalid value
    fn fun() {}
    let ptr = fun as fn();
    (ptr as *const u8).wrapping_add(10)
}) };

const UNALIGNED_READ: () = unsafe {
    let x = &[0u8; 4];
    let ptr = x.as_ptr().cast::<u32>();
    ptr.read(); //~ ERROR accessing memory
};

// Check the general case of a pointer value not falling into the scalar valid range.
#[rustc_layout_scalar_valid_range_start(1000)]
pub struct High {
    pointer: *const (),
}
static S: u32 = 0; // just a static to construct a pointer with unknown absolute address
const INVALID_VALUE_PTR: High = unsafe { mem::transmute(&S) };
//~^ ERROR invalid value


fn main() {}

Version information

rustc 1.92.0-nightly (8b6b15b87 2025-10-03)
binary: rustc
commit-hash: 8b6b15b877fbceb1ee5d9a5a4746e7515901574a
commit-date: 2025-10-03
host: x86_64-unknown-linux-gnu
release: 1.92.0-nightly
LLVM version: 21.1.2

Possibly related line of code:

rust/compiler/rustc_const_eval/src/interpret/validity.rs

Lines 760 to 772 in 8b6b15b

	// Otherwise (for standalone Miri), we have to still check it to be non-null.
	if self.ecx.scalar_may_be_null(scalar)? {
	let maybe =
	!M::Provenance::OFFSET_IS_ADDR && matches!(scalar, Scalar::Ptr(..));
	// This can't be a "maybe-null" pointer since the check for this being
	// a fn ptr at all already ensures that the pointer is inbounds.
	assert!(!maybe);
	throw_validation_failure!(self.path, NullFnPtr);
	}
	}
	if self.reset_provenance_and_padding {
	// Make sure we do not preserve partial provenance. This matches the thin
	// pointer handling in `deref_pointer`.

Command:
/home/matthias/.rustup/toolchains/master/bin/rustc -Zextra-const-ub-checks

Program output

error[E0601]: `main` function not found in crate `mvce`
  --> /tmp/icemaker_global_tempdir.T2gfbmbCHUYi/rustc_testrunner_tmpdir_reporting.4l2BIEk2rJHa/mvce.rs:11:3
   |
11 | };
   |   ^ consider adding a `main` function to `/tmp/icemaker_global_tempdir.T2gfbmbCHUYi/rustc_testrunner_tmpdir_reporting.4l2BIEk2rJHa/mvce.rs`

error[E0517]: attribute should be applied to a struct, enum, or union
  --> /tmp/icemaker_global_tempdir.T2gfbmbCHUYi/rustc_testrunner_tmpdir_reporting.4l2BIEk2rJHa/mvce.rs:3:8
   |
 3 |   #[repr(C)]
   |          ^
 4 |
 5 | / const MAYBE_NULL_FN_PTR: fn() = unsafe {
 6 | |     mem::transmute({
 7 | |         fn fun() {}
 8 | |         let ptr = fun as fn();
 9 | |         (ptr as *const u8).wrapping_add(10)
10 | |     })
11 | | };
   | |__- not a struct, enum, or union


thread 'rustc' (1998871) panicked at compiler/rustc_const_eval/src/interpret/validity.rs:766:25:
assertion failed: !maybe
stack backtrace:
   0:     0x7f9b85fc1833 - <std::sys::backtrace::BacktraceLock::print::DisplayBacktrace as core::fmt::Display>::fmt::hed2261a43b78c0cc
   1:     0x7f9b86601fbc - core::fmt::write::h893d5fa3e643eb86
   2:     0x7f9b85f76233 - std::io::Write::write_fmt::h85f18fc203482c94
   3:     0x7f9b85f877f2 - std::sys::backtrace::BacktraceLock::print::hfccb3f0ef11fe676
   4:     0x7f9b85f8d869 - std::panicking::default_hook::{{closure}}::h0dc0e660eac28fe2
   5:     0x7f9b85f8d393 - std::panicking::default_hook::hd4d52bf86faf3ac6
   6:     0x7f9b84fa50e7 - std[f6e09ed3ef841227]::panicking::update_hook::<alloc[f0299ca33c2e9505]::boxed::Box<rustc_driver_impl[7264269f2a44828]::install_ice_hook::{closure#1}>>::{closure#0}
   7:     0x7f9b85f8dc8f - std::panicking::panic_with_hook::h0289c92005f87e5f
   8:     0x7f9b85f8da16 - std::panicking::panic_handler::{{closure}}::hfce1335104aa2194
   9:     0x7f9b85f87929 - std::sys::backtrace::__rust_end_short_backtrace::h4069dfe4b3af6f22
  10:     0x7f9b85f6846d - __rustc[d228c1d09b215461]::rust_begin_unwind
  11:     0x7f9b82fcd4a0 - core::panicking::panic_fmt::hf6585f22a3d4de47
  12:     0x7f9b8292f20c - core::panicking::panic::h365f05da6616c5fd
  13:     0x7f9b8689fb99 - <rustc_const_eval[d0c63f6f9f8cb6a9]::interpret::validity::ValidityVisitor<rustc_const_eval[d0c63f6f9f8cb6a9]::const_eval::machine::CompileTimeMachine>>::try_visit_primitive
  14:     0x7f9b8689fda7 - <rustc_const_eval[d0c63f6f9f8cb6a9]::interpret::validity::ValidityVisitor<rustc_const_eval[d0c63f6f9f8cb6a9]::const_eval::machine::CompileTimeMachine> as rustc_const_eval[d0c63f6f9f8cb6a9]::interpret::visitor::ValueVisitor<rustc_const_eval[d0c63f6f9f8cb6a9]::const_eval::machine::CompileTimeMachine>>::visit_value
  15:     0x7f9b868ea0a9 - <rustc_const_eval[d0c63f6f9f8cb6a9]::interpret::eval_context::InterpCx<rustc_const_eval[d0c63f6f9f8cb6a9]::const_eval::machine::CompileTimeMachine>>::validate_operand_internal
  16:     0x7f9b872fe368 - <rustc_const_eval[d0c63f6f9f8cb6a9]::interpret::eval_context::InterpCx<rustc_const_eval[d0c63f6f9f8cb6a9]::const_eval::machine::CompileTimeMachine>>::eval_rvalue_into_place
  17:     0x7f9b872d95af - rustc_const_eval[d0c63f6f9f8cb6a9]::const_eval::eval_queries::eval_to_allocation_raw_provider
  18:     0x7f9b872d8850 - rustc_query_impl[23d4920e140ac1d6]::plumbing::__rust_begin_short_backtrace::<rustc_query_impl[23d4920e140ac1d6]::query_impl::eval_to_allocation_raw::dynamic_query::{closure#2}::{closure#0}, rustc_middle[a0c660311585e6eb]::query::erase::Erased<[u8; 24usize]>>
  19:     0x7f9b872ce21b - rustc_query_system[b43c2ed1b28e4643]::query::plumbing::try_execute_query::<rustc_query_impl[23d4920e140ac1d6]::DynamicConfig<rustc_query_system[b43c2ed1b28e4643]::query::caches::DefaultCache<rustc_middle[a0c660311585e6eb]::ty::PseudoCanonicalInput<rustc_middle[a0c660311585e6eb]::mir::interpret::GlobalId>, rustc_middle[a0c660311585e6eb]::query::erase::Erased<[u8; 24usize]>>, false, false, false>, rustc_query_impl[23d4920e140ac1d6]::plumbing::QueryCtxt, false>
  20:     0x7f9b872cddb9 - rustc_query_impl[23d4920e140ac1d6]::query_impl::eval_to_allocation_raw::get_query_non_incr::__rust_end_short_backtrace
  21:     0x7f9b872d03a4 - rustc_const_eval[d0c63f6f9f8cb6a9]::const_eval::eval_queries::eval_to_const_value_raw_provider
  22:     0x7f9b872d01c0 - rustc_query_impl[23d4920e140ac1d6]::plumbing::__rust_begin_short_backtrace::<rustc_query_impl[23d4920e140ac1d6]::query_impl::eval_to_const_value_raw::dynamic_query::{closure#2}::{closure#0}, rustc_middle[a0c660311585e6eb]::query::erase::Erased<[u8; 24usize]>>
  23:     0x7f9b872cf943 - rustc_query_system[b43c2ed1b28e4643]::query::plumbing::try_execute_query::<rustc_query_impl[23d4920e140ac1d6]::DynamicConfig<rustc_query_system[b43c2ed1b28e4643]::query::caches::DefaultCache<rustc_middle[a0c660311585e6eb]::ty::PseudoCanonicalInput<rustc_middle[a0c660311585e6eb]::mir::interpret::GlobalId>, rustc_middle[a0c660311585e6eb]::query::erase::Erased<[u8; 24usize]>>, false, true, false>, rustc_query_impl[23d4920e140ac1d6]::plumbing::QueryCtxt, false>
  24:     0x7f9b872cf4bd - rustc_query_impl[23d4920e140ac1d6]::query_impl::eval_to_const_value_raw::get_query_non_incr::__rust_end_short_backtrace
  25:     0x7f9b870f0d78 - <rustc_middle[a0c660311585e6eb]::ty::context::TyCtxt>::par_hir_body_owners::<rustc_hir_analysis[8cf6de4457f0b6a8]::check_crate::{closure#2}>::{closure#0}
  26:     0x7f9b870efc3a - rustc_hir_analysis[8cf6de4457f0b6a8]::check_crate
  27:     0x7f9b86f11730 - rustc_interface[5df0a448bc9cc49c]::passes::analysis
  28:     0x7f9b86f113e7 - rustc_query_impl[23d4920e140ac1d6]::plumbing::__rust_begin_short_backtrace::<rustc_query_impl[23d4920e140ac1d6]::query_impl::analysis::dynamic_query::{closure#2}::{closure#0}, rustc_middle[a0c660311585e6eb]::query::erase::Erased<[u8; 0usize]>>
  29:     0x7f9b87586d66 - rustc_query_system[b43c2ed1b28e4643]::query::plumbing::try_execute_query::<rustc_query_impl[23d4920e140ac1d6]::DynamicConfig<rustc_query_system[b43c2ed1b28e4643]::query::caches::SingleCache<rustc_middle[a0c660311585e6eb]::query::erase::Erased<[u8; 0usize]>>, false, false, false>, rustc_query_impl[23d4920e140ac1d6]::plumbing::QueryCtxt, false>
  30:     0x7f9b87586b4e - rustc_query_impl[23d4920e140ac1d6]::query_impl::analysis::get_query_non_incr::__rust_end_short_backtrace
  31:     0x7f9b8788cc80 - rustc_interface[5df0a448bc9cc49c]::passes::create_and_enter_global_ctxt::<core[20d0511d4037a4ac]::option::Option<rustc_interface[5df0a448bc9cc49c]::queries::Linker>, rustc_driver_impl[7264269f2a44828]::run_compiler::{closure#0}::{closure#2}>::{closure#2}::{closure#0}
  32:     0x7f9b87894783 - <rustc_interface[5df0a448bc9cc49c]::passes::create_and_enter_global_ctxt<core[20d0511d4037a4ac]::option::Option<rustc_interface[5df0a448bc9cc49c]::queries::Linker>, rustc_driver_impl[7264269f2a44828]::run_compiler::{closure#0}::{closure#2}>::{closure#2} as core[20d0511d4037a4ac]::ops::function::FnOnce<(&rustc_session[1ac415ad5d96725a]::session::Session, rustc_middle[a0c660311585e6eb]::ty::context::CurrentGcx, alloc[f0299ca33c2e9505]::sync::Arc<rustc_data_structures[f4bd0cca79893aeb]::jobserver::Proxy>, &std[f6e09ed3ef841227]::sync::once_lock::OnceLock<rustc_middle[a0c660311585e6eb]::ty::context::GlobalCtxt>, &rustc_data_structures[f4bd0cca79893aeb]::sync::worker_local::WorkerLocal<rustc_middle[a0c660311585e6eb]::arena::Arena>, &rustc_data_structures[f4bd0cca79893aeb]::sync::worker_local::WorkerLocal<rustc_hir[5b05836b39b89aa]::Arena>, rustc_driver_impl[7264269f2a44828]::run_compiler::{closure#0}::{closure#2})>>::call_once::{shim:vtable#0}
  33:     0x7f9b877df87e - rustc_interface[5df0a448bc9cc49c]::interface::run_compiler::<(), rustc_driver_impl[7264269f2a44828]::run_compiler::{closure#0}>::{closure#1}
  34:     0x7f9b876fcdc7 - std[f6e09ed3ef841227]::sys::backtrace::__rust_begin_short_backtrace::<rustc_interface[5df0a448bc9cc49c]::util::run_in_thread_with_globals<rustc_interface[5df0a448bc9cc49c]::util::run_in_thread_pool_with_globals<rustc_interface[5df0a448bc9cc49c]::interface::run_compiler<(), rustc_driver_impl[7264269f2a44828]::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>
  35:     0x7f9b876fcaa8 - <<std[f6e09ed3ef841227]::thread::Builder>::spawn_unchecked_<rustc_interface[5df0a448bc9cc49c]::util::run_in_thread_with_globals<rustc_interface[5df0a448bc9cc49c]::util::run_in_thread_pool_with_globals<rustc_interface[5df0a448bc9cc49c]::interface::run_compiler<(), rustc_driver_impl[7264269f2a44828]::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>::{closure#1} as core[20d0511d4037a4ac]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  36:     0x7f9b8770300d - std::sys::thread::unix::Thread::new::thread_start::h2007cd538ed6ab87
  37:     0x7f9b810969cb - <unknown>
  38:     0x7f9b8111aa0c - <unknown>
  39:                0x0 - <unknown>

error: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: please make sure that you have updated to the latest nightly

note: rustc 1.92.0-nightly (8b6b15b87 2025-10-03) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z extra-const-ub-checks -Z dump-mir-dir=dir

query stack during panic:
#0 [eval_to_allocation_raw] const-evaluating + checking `MAYBE_NULL_FN_PTR`
#1 [eval_to_const_value_raw] simplifying constant for the type system `MAYBE_NULL_FN_PTR`
#2 [analysis] running analysis passes on this crate
end of query stack
error: aborting due to 2 previous errors

Some errors have detailed explanations: E0517, E0601.
For more information about an error, try `rustc --explain E0517`.

@rustbot label +F-rustc_attrs

[matthiaskrgr]

smaller

//@compile-flags: -Zextra-const-ub-checks
const MAYBE_NULL_FN_PTR: fn() = unsafe {
    std::mem::transmute({
        fn ptr() {}
        (ptr as *const u8).wrapping_add(10)
    })
};

pub fn main() {}

[matthiaskrgr]

bisects to #146969