Skip to content

ICE: CFI: encode_region: unexpected ReStatic #111205

@matthiaskrgr

Description

@matthiaskrgr

Code

compile with -Zsanitizer=cfi -Clto

trait Empty {}

#[repr(transparent)]
pub struct FunnyPointer(dyn Empty);

pub struct Meta;

#[repr(C)]
pub struct FatPointer {
    pub data: *const (),
    pub vtable: *const (),
}

impl FunnyPointer {
    pub unsafe fn from_data_ptr(data: &String, ptr: *const Meta) -> &Self {
        let obj = FatPointer {
            data: data as *const _ as *const (),
            vtable: ptr as *const _ as *const (),
        };
        let obj = std::mem::transmute::<FatPointer, *mut FunnyPointer>(obj);
        &*obj
    }
}

fn main() {
    unsafe {
        let meta = Meta;
        let hello = "hello".to_string();
        FunnyPointer::from_data_ptr(&hello, &meta as *const _);
    }
}

Meta

rustc --version --verbose:

rustc 1.71.0-nightly (6f8c0557e 2023-05-04)
binary: rustc
commit-hash: 6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c
commit-date: 2023-05-04
host: x86_64-unknown-linux-gnu
release: 1.71.0-nightly
LLVM version: 16.0.2

Error output

<output>
Backtrace

error: internal compiler error: compiler/rustc_symbol_mangling/src/typeid/typeid_itanium_cxx_abi.rs:285:13: encode_region: unexpected `ReStatic`

thread 'rustc' panicked at 'Box<dyn Any>', /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/compiler/rustc_errors/src/lib.rs:1643:9
stack backtrace:
   0:     0x7f9acdf69441 - std::backtrace_rs::backtrace::libunwind::trace::ha1124e3c4b659eb5
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:     0x7f9acdf69441 - std::backtrace_rs::backtrace::trace_unsynchronized::h3a8d622ec81b6cb5
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7f9acdf69441 - std::sys_common::backtrace::_print_fmt::h2128e938c7086b6e
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/sys_common/backtrace.rs:65:5
   3:     0x7f9acdf69441 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hc50c3543d0b1b52f
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x7f9acdfca0df - core::fmt::rt::Argument::fmt::h84c36e9580f5b71f
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/core/src/fmt/rt.rs:138:9
   5:     0x7f9acdfca0df - core::fmt::write::h326e01f7a9aa5dd9
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/core/src/fmt/mod.rs:1094:21
   6:     0x7f9acdf5c4f1 - std::io::Write::write_fmt::h71f0f6281149b8c8
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/io/mod.rs:1712:15
   7:     0x7f9acdf69255 - std::sys_common::backtrace::_print::h6b9c2111a065fb89
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/sys_common/backtrace.rs:47:5
   8:     0x7f9acdf69255 - std::sys_common::backtrace::print::hf8d0af7625f66057
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/sys_common/backtrace.rs:34:9
   9:     0x7f9acdf6bee7 - std::panicking::default_hook::{{closure}}::h630fe7740556559d
  10:     0x7f9acdf6bcd4 - std::panicking::default_hook::h337047625b381696
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/panicking.rs:288:9
  11:     0x7f9ad1171715 - rustc_driver_impl[f38315262de66e12]::DEFAULT_HOOK::{closure#0}::{closure#0}
  12:     0x7f9acdf6c607 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::h1ac669e77ecf459f
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/alloc/src/boxed.rs:1999:9
  13:     0x7f9acdf6c607 - std::panicking::rust_panic_with_hook::h22ef26cea64ec65c
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/panicking.rs:695:13
  14:     0x7f9ad1639901 - std[2e06b57a958d7603]::panicking::begin_panic::<rustc_errors[5778b576bff5e43e]::ExplicitBug>::{closure#0}
  15:     0x7f9ad16392a6 - std[2e06b57a958d7603]::sys_common::backtrace::__rust_end_short_backtrace::<std[2e06b57a958d7603]::panicking::begin_panic<rustc_errors[5778b576bff5e43e]::ExplicitBug>::{closure#0}, !>
  16:     0x7f9ad165fca6 - std[2e06b57a958d7603]::panicking::begin_panic::<rustc_errors[5778b576bff5e43e]::ExplicitBug>
  17:     0x7f9ad165d114 - <rustc_errors[5778b576bff5e43e]::HandlerInner>::bug::<alloc[3df6c3833cdafa3e]::string::String>
  18:     0x7f9ad165ce46 - <rustc_errors[5778b576bff5e43e]::Handler>::bug::<alloc[3df6c3833cdafa3e]::string::String>
  19:     0x7f9ad16e52cc - rustc_middle[9b03ef73197c8750]::util::bug::opt_span_bug_fmt::<rustc_span[e5d9edf586a8e474]::span_encoding::Span>::{closure#0}
  20:     0x7f9ad16e4afa - rustc_middle[9b03ef73197c8750]::ty::context::tls::with_opt::<rustc_middle[9b03ef73197c8750]::util::bug::opt_span_bug_fmt<rustc_span[e5d9edf586a8e474]::span_encoding::Span>::{closure#0}, !>::{closure#0}
  21:     0x7f9ad16e4aca - rustc_middle[9b03ef73197c8750]::ty::context::tls::with_context_opt::<rustc_middle[9b03ef73197c8750]::ty::context::tls::with_opt<rustc_middle[9b03ef73197c8750]::util::bug::opt_span_bug_fmt<rustc_span[e5d9edf586a8e474]::span_encoding::Span>::{closure#0}, !>::{closure#0}, !>
  22:     0x7f9acf850ccd - rustc_middle[9b03ef73197c8750]::util::bug::bug_fmt
  23:     0x7f9ad1bc6b8a - rustc_symbol_mangling[1bf499ff7f75842a]::typeid::typeid_itanium_cxx_abi::encode_region
  24:     0x7f9ad1bc7d75 - rustc_symbol_mangling[1bf499ff7f75842a]::typeid::typeid_itanium_cxx_abi::encode_ty
  25:     0x7f9ad1bc80b9 - rustc_symbol_mangling[1bf499ff7f75842a]::typeid::typeid_itanium_cxx_abi::encode_ty
  26:     0x7f9ad1bc9dd8 - rustc_symbol_mangling[1bf499ff7f75842a]::typeid::typeid_itanium_cxx_abi::typeid_for_fnabi
  27:     0x7f9acf77059f - <rustc_codegen_llvm[d78081c433bf4e31]::context::CodegenCx as rustc_codegen_ssa[7c934ba332e0ab85]::traits::declare::PreDefineMethods>::predefine_fn
  28:     0x7f9ad061a0dd - rustc_codegen_llvm[d78081c433bf4e31]::base::compile_codegen_unit::module_codegen
  29:     0x7f9ad0618fb0 - rustc_codegen_llvm[d78081c433bf4e31]::base::compile_codegen_unit
  30:     0x7f9ad085c416 - rustc_codegen_ssa[7c934ba332e0ab85]::base::codegen_crate::<rustc_codegen_llvm[d78081c433bf4e31]::LlvmCodegenBackend>
  31:     0x7f9ad085bce2 - <rustc_codegen_llvm[d78081c433bf4e31]::LlvmCodegenBackend as rustc_codegen_ssa[7c934ba332e0ab85]::traits::backend::CodegenBackend>::codegen_crate
  32:     0x7f9ad03ff8e0 - rustc_interface[32f66f6c15b482f4]::passes::start_codegen
  33:     0x7f9ad03facc7 - <rustc_middle[9b03ef73197c8750]::ty::context::GlobalCtxt>::enter::<<rustc_interface[32f66f6c15b482f4]::queries::Queries>::ongoing_codegen::{closure#0}::{closure#0}, core[351080cb3919538e]::result::Result<alloc[3df6c3833cdafa3e]::boxed::Box<dyn core[351080cb3919538e]::any::Any>, rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>>
  34:     0x7f9ad03fa2a8 - <rustc_interface[32f66f6c15b482f4]::queries::Queries>::ongoing_codegen
  35:     0x7f9ad03f99e3 - <rustc_interface[32f66f6c15b482f4]::interface::Compiler>::enter::<rustc_driver_impl[f38315262de66e12]::run_compiler::{closure#1}::{closure#2}, core[351080cb3919538e]::result::Result<core[351080cb3919538e]::option::Option<rustc_interface[32f66f6c15b482f4]::queries::Linker>, rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>>
  36:     0x7f9ad03f714f - std[2e06b57a958d7603]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[32f66f6c15b482f4]::util::run_in_thread_pool_with_globals<rustc_interface[32f66f6c15b482f4]::interface::run_compiler<core[351080cb3919538e]::result::Result<(), rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>, rustc_driver_impl[f38315262de66e12]::run_compiler::{closure#1}>::{closure#0}, core[351080cb3919538e]::result::Result<(), rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[351080cb3919538e]::result::Result<(), rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>>
  37:     0x7f9ad0a58a1e - <<std[2e06b57a958d7603]::thread::Builder>::spawn_unchecked_<rustc_interface[32f66f6c15b482f4]::util::run_in_thread_pool_with_globals<rustc_interface[32f66f6c15b482f4]::interface::run_compiler<core[351080cb3919538e]::result::Result<(), rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>, rustc_driver_impl[f38315262de66e12]::run_compiler::{closure#1}>::{closure#0}, core[351080cb3919538e]::result::Result<(), rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[351080cb3919538e]::result::Result<(), rustc_span[e5d9edf586a8e474]::ErrorGuaranteed>>::{closure#1} as core[351080cb3919538e]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  38:     0x7f9acdf76ad5 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::he4e640066a72afb4
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/alloc/src/boxed.rs:1985:9
  39:     0x7f9acdf76ad5 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h6a43b4ec147b3dd9
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/alloc/src/boxed.rs:1985:9
  40:     0x7f9acdf76ad5 - std::sys::unix::thread::Thread::new::thread_start::h8c269a865bc351fb
                               at /rustc/6f8c0557e0b73c73a8a7163a15f4a5a3feca7d5c/library/std/src/sys/unix/thread.rs:108:17
  41:     0x7f9acdd12bb5 - <unknown>
  42:     0x7f9acdd94d90 - <unknown>
  43:                0x0 - <unknown>

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.71.0-nightly (6f8c0557e 2023-05-04) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z sanitizer=cfi -Z sanitizer-cfi-normalize-integers -C lto

query stack during panic:
end of query stack
error: aborting due to previous error

Metadata

Metadata

Assignees

Labels

C-bugCategory: This is a bug.I-ICEIssue: The compiler panicked, giving an Internal Compilation Error (ICE) ❄️PG-exploit-mitigationsProject group: Exploit mitigationsT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions