found a bug in the borrow checker

[d34db3ff]

I tried this code:

fn main() {
    let mut zero = &mut 0;
    let mut one = 1;

    {
        let mut _r = &mut zero;
        let mut y = &mut one;
        _r = &mut y;
    }

    println!("{}", one); // compiler complains that there's a mutable reference.
    println!("{}", zero);

}

I expected to see this happen: print 1 then 0.

Instead, this happened: compile error

Meta

rustc --version --verbose:

rustc 1.42.0 (b8cedc004 2020-03-09)
binary: rustc
commit-hash: b8cedc00407a4c56a3bda1ed605c6fc166655447
commit-date: 2020-03-09
host: x86_64-pc-windows-msvc
release: 1.42.0
LLVM version: 9.0

Backtrace

error[E0502]: cannot borrow `one` as immutable because it is also borrowed as mutable
  --> src\main.rs:11:20
   |
7  |         let mut y = &mut one;
   |                     -------- mutable borrow occurs here
...
11 |     println!("{}", one);
   |                    ^^^ immutable borrow occurs here
12 |     println!("{}", zero);
   |                    ---- mutable borrow later used here

EDIT: Here's a concise version of the original snippet which produces the same error:

fn main() {

    let mut v1 = &mut 0;
    let mut v2 = 1;

    {
        let mut x = &mut &mut v2;
        x = &mut v1;
    }
    
    println!("{}", v2); // compiler would complain there's a mutable reference.
    println!("{}", v1);
}

it is weird since the buggy behavior depends on the access order between the variables v1 and v2, if change the order or access only one of the two variables, the compiler error disappears

[Centril]

cc @nikomatsakis @lqd @matthewjasper

this snippet compiles with -Zpolonius

[RodBurman]

With the above code abnd using

cargo 1.83.0 (5ffbef321 2024-10-29)
release: 1.83.0
commit-hash: 5ffbef3211a8c378857905775a15c5b32a174d3b
commit-date: 2024-10-29
host: aarch64-apple-darwin
libgit2: 1.8.1 (sys:0.19.0 vendored)
libcurl: 8.7.1 (sys:0.4.74+curl-8.9.0 system ssl:(SecureTransport) LibreSSL/3.3.6)
ssl: OpenSSL 1.1.1w  11 Sep 2023
os: Mac OS 15.2.0 [64-bit]

The compiler still gives the following errors:

Compiling borrowbad v0.1.0 (/Users/rod/code/rust/triage/borrowbad)
error[E0502]: cannot borrow `one` as immutable because it is also borrowed as mutable
  --> src/main.rs:11:20
   |
7  |         let mut y = &mut one;
   |                     -------- mutable borrow occurs here
...
11 |     println!("{}", one); // compiler complains there's a mutable reference to one already exists.
   |                    ^^^ immutable borrow occurs here
12 |     println!("{}", zero);
   |                    ---- mutable borrow later used here
   |
   = note: this error originates in the macro `$crate::format_args_nl` which comes from the expansion of the macro `println` (in Nightly builds, run with -Z macro-backtrace for more info)

For more information about this error, try 'rustc --explain E0502'.
error: could not compile `borrowbad` (bin "borrowbad") due to 1 previous error

So not fixed in stable as of 1.83.

[d34db3ff]

Time flies... it's been 5 years....

It seems that this bug boils down to an UB(?) when a variable inside an inner scope is assigned with a &mut &mut and then another &mut &mut to refer something outside that scope.

Here's some other snippets that break the borrow checker, though I'm not sure if it shares the same root cause as the original issue, perhaps it’s worth examining:

fn main() {

    let mut v = &mut 0;

    {
        let mut y = &mut &mut 0;
        y = &mut v;
    }

    println!("{}", v);

}

or

fn main() {

    let mut v = &mut 0;

    {
        let mut y = &mut v;
        y = &mut &mut 0;
    }
    
    println!("{}", v);
    
}

I can confirm that the above two snippets compile seamlessly with -Zpolonius on a nightly rustc