Miri reports UB with opt-level 4 in code that should not have UB

[RalfJung]

  tests/pass/ptr_raw.rs FAILED:
  command: "/home/runner/work/miri/miri/target/debug/miri" "--error-format=json" "-Dwarnings" "-Dunused" "-Zmiri-tag-gc=1" "-O" "-Zmir-opt-level=4" "-Cdebug-assertions=yes" "-Zui-testing" "--target" "x86_64-unknown-linux-gnu" "tests/pass/ptr_raw.rs" "--edition" "2021"
  
  Error: no message
  error file=tests/pass/ptr_raw.rs,line=0,title=pass test got exit status: 1, but expected 0::no message
  
  Error: Error: Undefined Behavior: attempting a write access using <2732> at alloc1455[0x0], but that tag does not exist in the borrow stack for this location
  error file=tests/pass/ptr_raw.rs,line=9,title=Unmatched diagnostics::Error: Undefined Behavior: attempting a write access using <2732> at alloc1455[0x0], but that tag does not exist in the borrow stack for this location
  
  pass test got exit status: 1, but expected 0
  
  There were 1 unmatched diagnostics at tests/pass/ptr_raw.rs:9
      Error: Undefined Behavior: attempting a write access using <2732> at alloc1455[0x0], but that tag does not exist in the borrow stack for this location
  
  full stderr:
  warning: Miri does not support optimizations. If you have enabled optimizations by selecting a Cargo profile (such as --release) which changes other profile settings such as whether debug assertions and overflow checks are enabled, those settings are still applied.
  
  warning: You have explicitly enabled MIR optimizations, overriding Miri's default which is to completely disable them. Any optimizations may hide UB that Miri would otherwise detect, and it is not necessarily possible to predict what kind of UB will be missed. If you are enabling optimizations to make Miri run faster, we advise using cfg(miri) to shrink your workload instead. The performance benefit of enabling MIR optimizations is usually marginal at best.
  
  error: Undefined Behavior: attempting a write access using <2732> at alloc1455[0x0], but that tag does not exist in the borrow stack for this location
    --> tests/pass/ptr_raw.rs:9:9
     |
  LL |         *raw = 42;
     |         ^^^^^^^^^
     |         |
     |         attempting a write access using <2732> at alloc1455[0x0], but that tag does not exist in the borrow stack for this location
     |         this error occurs as part of an access at alloc1455[0x0..0x4]
     |
     = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
     = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
  help: <2732> was created by a Unique retag at offsets [0x0..0x4]
    --> tests/pass/ptr_raw.rs:3:13
     |
  LL |     let x = &mut x;
     |             ^^^^^^
  help: <2732> was later invalidated at offsets [0x0..0x4] by a SharedReadOnly retag
    --> tests/pass/ptr_raw.rs:5:5
     |
  LL |     assert_eq!(*x, 12);
     |     ^^^^^^^^^^^^^^^^^^
     = note: BACKTRACE (of the first span):
     = note: inside `basic_raw` at tests/pass/ptr_raw.rs:9:9: 9:18
  note: inside `main`
    --> tests/pass/ptr_raw.rs:24:5
     |
  LL |     basic_raw();
     |     ^^^^^^^^^^^
     = note: this error originates in the macro `assert_eq` (in Nightly builds, run with -Z macro-backtrace for more info)
  
  note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
  
  error: aborting due to previous error; 2 warnings emitted
  
  
  
  
  tests/pass/stacked-borrows/stacked-borrows.rs FAILED:
  command: "/home/runner/work/miri/miri/target/debug/miri" "--error-format=json" "-Dwarnings" "-Dunused" "-Zmiri-tag-gc=1" "-O" "-Zmir-opt-level=4" "-Cdebug-assertions=yes" "-Zui-testing" "--target" "x86_64-unknown-linux-gnu" "tests/pass/stacked-borrows/stacked-borrows.rs" "-Zmiri-retag-fields" "--edition" "2021"
  
  Error: no message
  error file=tests/pass/stacked-borrows/stacked-borrows.rs,line=0,title=pass test got exit status: 1, but expected 0::no message
  
  Error: Error: Undefined Behavior: attempting a write access using <2768> at alloc1530[0x0], but that tag does not exist in the borrow stack for this location
  error file=tests/pass/stacked-borrows/stacked-borrows.rs,line=57,title=Unmatched diagnostics::Error: Undefined Behavior: attempting a write access using <2768> at alloc1530[0x0], but that tag does not exist in the borrow stack for this location
  
  pass test got exit status: 1, but expected 0
  
  There were 1 unmatched diagnostics at tests/pass/stacked-borrows/stacked-borrows.rs:57
      Error: Undefined Behavior: attempting a write access using <2768> at alloc1530[0x0], but that tag does not exist in the borrow stack for this location
  
  full stderr:
  warning: Miri does not support optimizations. If you have enabled optimizations by selecting a Cargo profile (such as --release) which changes other profile settings such as whether debug assertions and overflow checks are enabled, those settings are still applied.
  
  warning: You have explicitly enabled MIR optimizations, overriding Miri's default which is to completely disable them. Any optimizations may hide UB that Miri would otherwise detect, and it is not necessarily possible to predict what kind of UB will be missed. If you are enabling optimizations to make Miri run faster, we advise using cfg(miri) to shrink your workload instead. The performance benefit of enabling MIR optimizations is usually marginal at best.
  
  error: Undefined Behavior: attempting a write access using <2768> at alloc1530[0x0], but that tag does not exist in the borrow stack for this location
    --> tests/pass/stacked-borrows/stacked-borrows.rs:57:9
     |
  LL |         *xraw = 4;
     |         ^^^^^^^^^
     |         |
     |         attempting a write access using <2768> at alloc1530[0x0], but that tag does not exist in the borrow stack for this location
     |         this error occurs as part of an access at alloc1530[0x0..0x4]
     |
     = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
     = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
  help: <2768> was created by a Unique retag at offsets [0x0..0x4]
    --> tests/pass/stacked-borrows/stacked-borrows.rs:52:16
     |
  LL |     let xref = &mut x;
     |                ^^^^^^
  help: <2768> was later invalidated at offsets [0x0..0x4] by a SharedReadOnly retag
    --> tests/pass/stacked-borrows/stacked-borrows.rs:54:16
     |
  LL |     let xshr = &*xref;
     |                ^^^^^^
     = note: BACKTRACE (of the first span):
     = note: inside `mut_raw_then_mut_shr` at tests/pass/stacked-borrows/stacked-borrows.rs:57:9: 57:18
  note: inside `main`
    --> tests/pass/stacked-borrows/stacked-borrows.rs:9:5
     |
  LL |     mut_raw_then_mut_shr();
     |     ^^^^^^^^^^^^^^^^^^^^^^
  
  note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
  
  error: aborting due to previous error; 2 warnings emitted
  
  
  
  FAILURES:
      tests/pass/ptr_raw.rs
      tests/pass/stacked-borrows/stacked-borrows.rs

Given the timing I would guess this is caused by #106285 -- Cc @cjgillot

[RalfJung]

Cc @rust-lang/wg-mir-opt

[JakobDegen]

$ cat test.rs
#![crate_type = "lib"]

pub fn mut_raw_then_mut_shr() -> (i32, i32) {
    let mut x = 2;
    let xref = &mut x;
    let xraw = &mut *xref as *mut _;
    let xshr = &*xref;
    let a = *xshr;
    unsafe {
        *xraw = 4;
    }
    (a, x)
}
$ rustc +master -Zdump-mir=all test.rs -Zmir-opt-level=0 -Zmir-enable-passes=+ReferencePropagation -Cdebug-assertions=no

With storage statements and some other crap removed, this:

_1 = const 2_i32;
_2 = &mut _1;
_5 = &mut (*_2);
_4 = &raw mut (*_5);
_3 = _4;
_6 = &(*_2);
_7 = (*_6);
(*_3) = const 4_i32;
_10 = _1;

Is turned into:

_1 = const 2_i32;
_2 = &mut _1;
_5 = &mut _1;
_4 = &raw mut (*_2);
_3 = _4;
_6 = &_1;
_7 = (*_2);
(*_5) = const 4_i32;
_10 = _1;

The logic that checks for complete replacement of _2 seems buggy.

I have not checked the other test.

[jyn514]

Is there any way to enable mir-opt-level=4 on stable?

[JakobDegen]

I believe there is not