Garbage value when accessing a reference into a field/element of a const value.

[shelvacu]

All of the below code seems to be neccesary to reproduce the bug; If ALL_THE_NUMS is accessed directly within main, the program works as expected.

Example:

fn get_element() -> &'static u32 {
    return &ALL_THE_NUMS[0];
}

const ALL_THE_NUMS : [u32; 1] = [
    1
];

fn main(){
    println!("Num is {}", get_element());
}

I expected to see this happen: Num is 1 as the output, or a compiler error if I'm doing something wrong here (am I?)

Instead, this happened: Num is 32766 or some other garbage value is output

Meta

rustc --version --verbose:

rustc 1.25.0
binary: rustc
commit-hash: unknown
commit-date: unknown
host: x86_64-unknown-linux-gnu
release: 1.25.0
LLVM version: 6.0

Also tested on master-branch version: (same result)

rustc 1.27.0-dev
binary: rustc
commit-hash: unknown
commit-date: unknown
host: x86_64-unknown-linux-gnu
release: 1.27.0-dev
LLVM version: 6.0

[matthewjasper]

It appears that (AST) borrowck thinks that the constant will get promoted to a static, but it isn't. NLL and pre-1.20 borrowck correctly error with a "temporary value does not live long enough" error.

[oli-obk]

cc @eddyb (const promotion)

[eddyb]

Uhhh this should be promoted. AFAIK, &ALL_THE_NUMS[idx] is sugar for &(&ALL_THE_NUMS)[idx] and the inner reference would get promoted, making the indexing safe too.

EDIT: looks like we generate &local_array_copy[idx] as one MIR statement, which won't be promoted because idx is runtime, but non-MIR borrowck doesn't know this detail.

cc @rust-lang/compiler

[nikomatsakis]

After some discussion with @eddyb, we realized this is kind of a more general bug than originally thought. There are also some other troublesome examples:

https://play.rust-lang.org/?gist=5d024782ad35c5e58e000ecea7158cfd&version=stable&mode=debug

Therefore, bumping to P-high. We're gonna try to fix by improving the constant promoter and how it handles projections.

[eddyb]

This is much worse (I've updated the issue description), and it happens on all projections, e.g.:

fn get_element() -> &'static u32 { &(0,).0 }

I think I messed up: instead of promoting only Ref(temp), we should promote Ref(P(temp)) by promoting Ref(temp) to p and replacing Ref(P(temp)) with Ref(P(Deref(p))).
I guess I'll try to hack something up that we can backport.

[oli-obk]

Miri "catches" this kind of UB with an ICE if you try it inside a const fn (see #50529)