Raw pointer deref of uninhabited type allowed in const fn

[DutchGhost]

The code below compiles as of 1.46, but I'm not sure it should, since it dereferences a raw pointer in a const block, which is only allowed in nightly with the #![feature(const_raw_ptr_deref)] flag:

const unsafe fn unreachable() -> ! {
    use core::convert::Infallible;
    
    const INFALLIBLE: *const Infallible = [].as_ptr();
    match *INFALLIBLE {}
}

fn main() {
}

[ohsayan]

@rustbot modify labels to +A-raw-pointers +A-const-fn

[jonas-schievink]

cc @rust-lang/wg-const-eval

[RalfJung]

Ah, that looks like the const version of the old "uninhabited match" problem...

The MIR for unreachable is

fn unreachable() -> ! {
    let mut _0: !;                       // return place in scope 0 at src/main.rs:1:34: 1:35

    bb0: {
        unreachable;                     // scope 0 at src/main.rs:5:11: 5:22
    }
}

So somehow the deref already vanished, and hence the const analysis cannot catch it.

But doesn't unsafety checking also happen on the MIR? Why does that work?

[DutchGhost]

It seems that whenever the dereference is not bound to a variable, it compiles, but whenever bound to a variable, it fails to compile:

const unsafe fn const_deref() {
    use core::convert::Infallible;
    const INFALLIBLE: *const Infallible = [].as_ptr();
    
    match *INFALLIBLE {
        n => {}, // <--- rightfully claims I need #![feature(const_raw_ptr_deref)]
        //_ => {}, // <--- compiles fine
    };
}

[oli-obk]

I don't believe this is an unsoundness. Unsafe code is required to cause anything here.

The MIR for unreachable is

That's the final MIR, since without unsafe fn this will fail to compile, it must be there for unsafety checking, thus it must also be there for const checking. Not sure why we fail to catch this.

[RalfJung]

I don't believe this is an unsoundness. Unsafe code is required to cause anything here.

Agreed. This is a case of "oops a nightly-only feature is available on stable", which is bad, but it is not an unsoundness.

[camelid]

Assigning P-high and removing I-prioritize as discussed in the prioritization working group.

[RalfJung]

The initial MIR looks like this:

fn unreachable() -> ! {
    let mut _0: !;                       // return place in scope 0 at test2.rs:1:34: 1:35
    let mut _1: !;                       // in scope 0 at test2.rs:1:36: 6:2
    let mut _2: !;                       // in scope 0 at test2.rs:5:5: 5:25
    let mut _3: *const std::convert::Infallible; // in scope 0 at test2.rs:5:12: 5:22

    bb0: {
        StorageLive(_1);                 // scope 0 at test2.rs:1:36: 6:2
        StorageLive(_2);                 // scope 0 at test2.rs:5:5: 5:25
        StorageLive(_3);                 // scope 0 at test2.rs:5:12: 5:22
        _3 = const INFALLIBLE;           // scope 0 at test2.rs:5:12: 5:22
                                         // ty::Const
                                         // + ty: *const std::convert::Infallible
                                         // + val: Unevaluated(WithOptConstParam { did: DefId(0:5 ~ test2[317d]::unreachable::INFALLIBLE), const_param_did: None }, [], None)
                                         // mir::Constant
                                         // + span: test2.rs:5:12: 5:22
                                         // + literal: Const { ty: *const std::convert::Infallible, val: Unevaluated(WithOptConstParam { did: DefId(0:5 ~ test2[317d]::unreachable::INFALLIBLE), const_param_did: None }, [], None) }
        FakeRead(ForMatchedPlace, (*_3)); // scope 0 at test2.rs:5:11: 5:22
        unreachable;                     // scope 0 at test2.rs:5:11: 5:22
    }

    bb1: {
        unreachable;                     // scope 0 at test2.rs:5:5: 5:25
    }

    bb2: {
        StorageDead(_2);                 // scope 0 at test2.rs:5:24: 5:25
        unreachable;                     // scope 0 at test2.rs:1:36: 6:2
    }

    bb3: {
        StorageDead(_3);                 // scope 0 at test2.rs:6:1: 6:2
        StorageDead(_1);                 // scope 0 at test2.rs:6:1: 6:2
        return;                          // scope 0 at test2.rs:6:2: 6:2
    }
}

So probably the issue is that const-checking ignores FakeRead?

[oli-obk]

oh... yea.. we ignored it on purpose... "because it doesn't actually do anything" 🙃

I guess we should visit all places within statements that we otherwise ignore during const-checking?

[RalfJung]

Well, at least we need to visit FakeRead. ;)

[RalfJung]

oh... yea.. we ignored it on purpose... "because it doesn't actually do anything" upside_down_face

Do we really? The Deref check is done in visit_projection_elem, which should be called even for the projection in the place in the fake read.

[RalfJung]

Oh wait, we don't call super_statement unconditionally! That seems like... a problem.^^

[RalfJung]

Proposed a fix: #80199