GVN pass introduces UB by reborrowing from disabled reference

[RalfJung]

fn fmt_mutref_string(s: & &mut String) {
    let _str = &**s;
}

fn main() {
    let mut s = String::from("hello");
    let ptr = &mut s as *mut String;

    let a = unsafe { &mut (*ptr) };
    a.push_str(" world");

    fmt_mutref_string(&a);
}

This program is fine according to both TB and SB, but if I run this with Miri with -Zmir-opt-level=1 -Zmir-enable-passes=+GVN, it reports UB in the final line:

error: Undefined Behavior: reborrow through <452> at alloc311[0x0] is forbidden
  --> gvn.rs:2:16
   |
 2 |     let _str = &**s;
   |                ^^^^ Undefined Behavior occurred here
   |
   = help: this indicates a potential bug in the program: it performed an invalid operation, but the Tree Borrows rules it violated are still experimental
   = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/tree-borrows.md for further information
   = help: the accessed tag <452> has state Disabled which forbids this reborrow (acting as a child read access)
help: the accessed tag <452> was created here, in the initial state Reserved
  --> gvn.rs:9:22
   |
 9 |     let a = unsafe { &mut (*ptr) };
   |                      ^^^^^^^^^^^
help: the accessed tag <452> later transitioned to Disabled due to a foreign write access at offsets [0x0..0x8]
  --> gvn.rs:10:5
   |
10 |     a.push_str(" world");
   |     ^^^^^^^^^^^^^^^^^^^^
   = help: this transition corresponds to a loss of read and write permissions
   = note: stack backtrace:
           0: fmt_mutref_string
               at gvn.rs:2:16: 2:20
           1: main
               at gvn.rs:12:5: 12:26

Cc @rust-lang/wg-mir-opt

[RalfJung]

Before GVN we roughly have

        _5 = &mut (*_2);
        _4 = copy _5;
        _7 = no_retag copy _4;
        _6 = String::push_str(move _7, move _8) -> [return: bb2, unwind: bb5];
        _12 = &_4;
        _11 = copy _12;
        _10 = fmt_mutref_string(move _11) -> [return: bb3, unwind: bb5];

After GVN we have

        _5 = &mut (*_2);
        _4 = copy _5;
        _6 = String::push_str(copy _5, const " world") -> [return: bb2, unwind: bb5];
        _12 = &_4;
        _11 = copy _12;
        _10 = fmt_mutref_string(copy _12) -> [return: bb3, unwind: bb5];

Note how originally push_str received effectively _4 which is also what _12 takes the reference to. After GVN, push_str receives _5, which is the parent of _4 and therefore invalidates _4, so when _4 gets used again later we have a problem.

Isn't GVN supposed to do all-or-nothing replacemnet for mutable references to avoid exactly this?

[rustbot]

Assigning P-high (discussion on Zulip).