Unsoundness in borrowck around deref and mutable refs

[apasel422]

Stable and nightly happily compile the following:

fn main() {
    let x: &'static str = "x";

    {
        let y = "y".to_string();
        let ref mut x = &*x;
        *x = &*y;
    }

    println!("{:?}", x);
}

Running the program on my local Ubuntu machine yields:

thread '<main>' panicked at 'index 0 and/or 0 in `�` do not lie on character boundary', ../rust/src/libcore/str/mod.rs:1444

The playpen yields different results depending on whether debug or release mode is chosen.

Someone is welcome to retitle this issue more accurately.

[sfackler]

Nominating for P-high.

[eefriedman]

The code isn't semantically unsound. In let ref mut x = &*x;, x is supposed to be a pointer to an unnamed temporary containing an &str. For example:

fn main() {
    let ref mut y = "x";
    *y = "y";
}

The problem is just that trans is taking illegal shortcuts.

[apasel422]

@eefriedman Along those lines, in this example:

fn main() {
    let x: &'static str = "x";

    {
        let z = &mut &*x;
        *z = "z";
    }

    println!("{:?}", x);
}

the code compiles, runs, and prints "z".

[eefriedman]

@apasel422 Yes, same bug.

[woowe]

The same bug is coming up for me when I use html5ever.

[nikomatsakis]

triage: P-high

My preferred fix would be to go through MIR, but this may be worth fixing another way.

[pnkfelix]

cc me

[nrc]

triage: p-medium

Another one that will be fixed by MIR, but not soon. If we think this is higher priority than that we should go back to p-high, but we should make a plan to actually fix it.

[briansmith]

Another one that will be fixed by MIR, but not soon.

It would make Rust advocacy a lot easier if bugs like this one were fixed before MIR. The typechecker and borrow checker are the reasons many people would choose Rust over other languages. The rewrite of the compiler (MIR) is likely to cause induce bugs itself, so I think a lot of people would like to see a very good stable release before MIR, to allow for skipping the first few (at least) MIR-based releases.

[arielb1]

@briansmith

Variations of this bug were one of the primary motivations for MIR - the code that is supposed to be handling this part is horrible and we don't want to make changes to it out of fear of introducing new bugs. I think we will have MIR-based trans+borrowck at 1.8 if not before.

[futile]

This seems to be fixed on nightly (but still crashes on stable & beta): https://is.gd/KqgBhe

[brson]

Only thing left to do here is land a test for it.

[futile]

I can add that.