miri error in safe code when mutating the bool inside Option<RefCell<bool>>

[rodrimati1992]

Running this code in miri(2019-12-27) in the playground:

use std::cell::RefCell;

fn main() {
    let optional=Some(RefCell::new(false));
    let mut handle=optional.as_ref().unwrap().borrow_mut();
    optional.is_some();
    *handle=true;
}

https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=3e8c5326890889354418d3161294d0fe

Results in this MIRI error:

error: Miri evaluation error: trying to reborrow for Unique, but parent tag <1307> does not have an appropriate item in the borrow stack
    --> /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libcore/cell.rs:1388:9
     |
1388 |         self.value
     |         ^^^^^^^^^^ Miri evaluation error: trying to reborrow for Unique, but parent tag <1307> does not have an appropriate item in the borrow stack
     |
note: inside call to `<std::cell::RefMut<bool> as std::ops::DerefMut>::deref_mut` at src/main.rs:7:5
    --> src/main.rs:7:5
     |
7    |     *handle=true;
     |     ^^^^^^^
     = note: inside call to `main` at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/rt.rs:67:34
     = note: inside call to closure at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/rt.rs:52:73
     = note: inside call to closure at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/sys_common/backtrace.rs:129:5
     = note: inside call to `std::sys_common::backtrace::__rust_begin_short_backtrace::<[closure@DefId(1:6016 ~ std[49a3]::rt[0]::lang_start_internal[0]::{{closure}}[0]::{{closure}}[0]) 0:&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe], i32>` at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/rt.rs:52:13
     = note: inside call to closure at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/panicking.rs:296:40
     = note: inside call to `std::panicking::r#try::do_call::<[closure@DefId(1:6015 ~ std[49a3]::rt[0]::lang_start_internal[0]::{{closure}}[0]) 0:&&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe], i32>` at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/panicking.rs:272:13
     = note: inside call to `std::panicking::r#try::<i32, [closure@DefId(1:6015 ~ std[49a3]::rt[0]::lang_start_internal[0]::{{closure}}[0]) 0:&&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe]>` at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/panic.rs:394:14
     = note: inside call to `std::panic::catch_unwind::<[closure@DefId(1:6015 ~ std[49a3]::rt[0]::lang_start_internal[0]::{{closure}}[0]) 0:&&dyn std::ops::Fn() -> i32 + std::marker::Sync + std::panic::RefUnwindSafe], i32>` at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/rt.rs:51:25
     = note: inside call to `std::rt::lang_start_internal` at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/rt.rs:67:5
     = note: inside call to `std::rt::lang_start::<()>`

[jonas-schievink]

Is this related to #68206?

[Centril]

cc @RalfJung @rust-lang/lang

[RalfJung]

At a first glance yes, this seems very related to #68206. I think what happens is that borrow_mut creates a mutable reference to the content, asserting uniqueness. Then optional.is_some() reads from that same location, ending the lifetime of the mutable reference. And finally, *handle = true uses the mutable reference again, causing the failure.

[RalfJung]

@rodrimati1992 this is a great catch, and with perfect timing :)