Borrow checker bug when matching select().await with &mut references

[MatrixDev]

I've tried to simplify this example to the best of my abilities so here it goes. For some reason borrow checker doesn't treat match as taking ownership / consuming the argument:

async fn job(value: &mut usize) -> usize {
    *value
}

let mut value1 = 42;
let mut value2 = 42;
let mut future1 = Box::pin(job(&mut value1));
let mut future2 = Box::pin(job(&mut value2));

loop {
    let result = select(future1, future2).await;
    match result {
        Either::Left(e) => println!("{}", e.0),
        Either::Right(e) => println!("{}", e.0),
    }

    future1 = Box::pin(job(&mut value1)); // ERROR: cannot borrow `value1` as mutable more than once at a time [E0499]
    future2 = Box::pin(job(&mut value2)); // ERROR: cannot borrow `value1` as mutable more than once at a time [E0499]
}

The most weird thing I found is that this issue can be worked around with a very simple trick:

async fn job(value: &mut usize) -> usize {
    *value
}

fn noop<T>(value: T) -> T {
    value
}

let mut value1 = 42;
let mut value2 = 42;
let mut future1 = Box::pin(job(&mut value1));
let mut future2 = Box::pin(job(&mut value2));

loop {
    let result = select(future1, future2).await;
    match noop(result) { // explicitly consuming and returning result fixes borrowing errors
        Either::Left(e) => println!("{}", e.0),
        Either::Right(e) => println!("{}", e.0),
    }

    future1 = Box::pin(job(&mut value1)); // NO ERROR
    future2 = Box::pin(job(&mut value2)); // NO ERROR
}

I expected to see this happen:
Match must consume all &mut references and allow me to create new &mut references after it.

Instead, this happened:
It seams that borrow checker doesn't think that match consumed &mut references.

Meta

Bug reproduces on both stable and nightly versions.

rustc --version --verbose:

rustc 1.71.0 (8ede3aae2 2023-07-12)
binary: rustc
commit-hash: 8ede3aae28fe6e4d52b38157d7bfe0d3bceef225
commit-date: 2023-07-12
host: aarch64-apple-darwin
release: 1.71.0
LLVM version: 16.0.5

Backtrace

    Blocking waiting for file lock on build directory
   Compiling futures-sink v0.3.28
   Compiling pin-project-lite v0.2.10
   Compiling pin-utils v0.1.0
   Compiling futures-core v0.3.28
   Compiling memchr v2.5.0
   Compiling futures-task v0.3.28
   Compiling futures-io v0.3.28
   Compiling slab v0.4.8
   Compiling futures-channel v0.3.28
   Compiling futures-util v0.3.28
   Compiling futures-executor v0.3.28
   Compiling futures v0.3.28
   Compiling rust-test v0.1.0 (/Users/matrixdev/Projects/rust-test)
error[E0499]: cannot borrow `value1` as mutable more than once at a time
  --> src/main.rs:20:32
   |
10 |     let mut future1 = Box::pin(job(&mut value1));
   |                                    ----------- first mutable borrow occurs here
...
20 |         future1 = Box::pin(job(&mut value1));
   |                                ^^^^^^^^^^^ second mutable borrow occurs here
21 |         future2 = Box::pin(job(&mut value2));
22 |     }
   |     - first borrow might be used here, when `result` is dropped and runs the destructor for type `Either<(usize, Pin<Box<impl futures::Future<Output = usize>>>), (usize, Pin<Box<impl futures::Future<Output = usize>>>)>`

error[E0499]: cannot borrow `value2` as mutable more than once at a time
  --> src/main.rs:21:32
   |
11 |     let mut future2 = Box::pin(job(&mut value2));
   |                                    ----------- first mutable borrow occurs here
...
21 |         future2 = Box::pin(job(&mut value2));
   |                                ^^^^^^^^^^^ second mutable borrow occurs here
22 |     }
   |     - first borrow might be used here, when `result` is dropped and runs the destructor for type `Either<(usize, Pin<Box<impl futures::Future<Output = usize>>>), (usize, Pin<Box<impl futures::Future<Output = usize>>>)>`

For more information about this error, try `rustc --explain E0499`.
error: could not compile `rust-test` (bin "rust-test") due to 2 previous errors

[eholk]

We discussed this in wg-async triage today. We're not sure what's going on yet, so we need some more investigation. It'd be good to test this with -Zpolonius and see if that does any better. It might be possible to reduce the test case a little further (for example, remove the dependency on the futures crate).

[jwong101]

I believe the root issue is that the borrow checker believes that the drop happens at the end of the loop rather than after the match, even though that's not the case.

Here's a somewhat similar reproduction:

use core::fmt::Debug;

#[derive(Debug)]
struct Noisy<T>(T);

impl<T> Drop for Noisy<T> {
    fn drop(&mut self) {
        println!("dropped");
    }
}

fn main() {
    let mut value1 = 41;
    let result = Some(Noisy(&mut value1));
    match result {
        Some(x) => println!("{x:?}"),
        None => {}
    }
    println!("{value1}");
}

rustc --version:

rustc 1.75.0-nightly (1c05d50c8 2023-10-21)

This is the output I get, which doesn't change with RUSTFLAGS="-Zpolonius":

error[E0502]: cannot borrow `value1` as immutable because it is also borrowed as mutable
  --> src/main.rs:24:15
   |
19 |     let result = Some(Noisy(&mut value1));
   |                             ----------- mutable borrow occurs here
...
24 |     println!("{value1}");
   |               ^^^^^^^^ immutable borrow occurs here
25 | }
   | - mutable borrow might be used here, when `result` is dropped and runs the destructor for type `Option<Noisy<&mut i32>>`
   |
   = note: this error originates in the macro `$crate::format_args_nl` which comes from the expansion of the macro `println` (in Nightly builds, run with -Z macro-backtrace for more info)

For more information about this error, try `rustc --explain E0502`.

However, forcing an explicit move of the scrutinee makes it compile:

use core::fmt::Debug;

#[derive(Debug)]
struct Noisy<T>(T);

impl<T> Drop for Noisy<T> {
    fn drop(&mut self) {
        println!("dropped");
    }
}

fn main() {
    let mut value1 = 41;
    let result = Some(Noisy(&mut value1));
    match { result } {
        Some(x) => println!("{x:?}"),
        None => {}
    }
    println!("{value1}");
}

Output:

Noisy(41)
dropped
41

[eholk]

So I think we're running into some of the rules around temporary scopes. In particular, the scrutinee of a match expression doesn't create a scope: https://doc.rust-lang.org/reference/destructors.html#temporary-scopes

I think that's why the { result } version works though, because it does create a scope for result.

I tried adding an explicit drop and still got an error:

use core::fmt::Debug;

#[derive(Debug)]
struct Noisy<T>(T);

impl<T> Drop for Noisy<T> {
    fn drop(&mut self) {
        println!("dropped");
    }
}

fn main() {
    let mut value1 = 41;
    let result = Some(Noisy(&mut value1));
    match result {
        Some(x) => println!("{x:?}"),
        None => {}
    }
    drop(result);
    println!("{value1}");
}

Output:

error[E0382]: use of partially moved value: `result`
  --> src/main.rs:19:10
   |
16 |         Some(x) => println!("{x:?}"),
   |              - value partially moved here
...
19 |     drop(result);
   |          ^^^^^^ value used here after partial move
   |
   = note: partial move occurs because value has type `Noisy<&mut i32>`, which does not implement the `Copy` trait
help: borrow this binding in the pattern to avoid moving the value
   |
16 |         Some(ref x) => println!("{x:?}"),
   |              +++

For more information about this error, try `rustc --explain E0382`.

I forget whether the borrow checker considers partial drops...

[WinterAtne]

I'm working on a paper about memory safety across various languages for a college class, has this issue been resolved? The issue is open, but hasn't been touched since 2023.