Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ICE: CFI: typeid_for_instance: couldn't get fn_abi of instance Layout(ReferencesError(ErrorGuaranteed(()))) #123053

Closed
matthiaskrgr opened this issue Mar 25, 2024 · 2 comments · Fixed by #123066
Assignees
Labels
C-bug Category: This is a bug. I-ICE Issue: The compiler panicked, giving an Internal Compilation Error (ICE) ❄️ PG-exploit-mitigations Project group: Exploit mitigations S-has-mcve Status: A Minimal Complete and Verifiable Example has been found for this issue T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.

Comments

@matthiaskrgr
Copy link
Member

matthiaskrgr commented Mar 25, 2024

auto-reduced (treereduce-rust):

trait Iterable {
    type Item<'a>
    where
        Self: 'a;
    type Iter<'a>: Iterator<Item = Self::Item<'a>>
    where
        Self: 'a;

    fn iter<'a>(&'a self) -> Self::Iter<'a>;
}

impl<T> Iterable for [T] {
    type Item<'a> = <std::slice::Iter<'a, T> as Iterator>::Item where T: 'a;
    type Iter<'a> = std::slice::Iter<'a, T> where T: 'a;

    fn iter<'a>(&'a self) -> Self::Iter<'a> {
        self.iter()
    }
}

fn get_first<'a, I: Iterable + ?Sized>(it: &'a I) -> Option<I::Item<'a>> {
    it.iter().next()
}

fn main() {
    let v = vec![1, 2, 3];

    assert_eq!(Some(&1), get_first(&*v));
}
original code

original:

//@ run-pass

trait Iterable {
    type Item<'a> where Self: 'a;
    type Iter<'a>: Iterator<Item = Self::Item<'a>> where Self: 'a;

    fn iter<'a>(&'a self) -> Self::Iter<'a>;
}

// Impl for struct type
impl<T> Iterable for Vec<T> {
    type Item<'a> = <std::slice::Iter<'a, T> as Iterator>::Item where T: 'a;
    type Iter<'a> = std::slice::Iter<'a, T> where T: 'a;

    fn iter<'a>(&'a self) -> Self::Iter<'a> {
        self[..].iter()
    }
}

// Impl for a primitive type
impl<T> Iterable for [T] {
    type Item<'a> = <std::slice::Iter<'a, T> as Iterator>::Item where T: 'a;
    type Iter<'a> = std::slice::Iter<'a, T> where T: 'a;

    fn iter<'a>(&'a self) -> Self::Iter<'a> {
        self.iter()
    }
}

fn make_iter<'a, I: Iterable + ?Sized>(it: &'a I) -> I::Iter<'a> {
    it.iter()
}

fn get_first<'a, I: Iterable + ?Sized>(it: &'a I) -> Option<I::Item<'a>> {
    it.iter().next()
}

fn main() {
    let v = vec![1, 2, 3];
    assert_eq!(v, make_iter(&v).copied().collect::<Vec<_>>());
    assert_eq!(v, make_iter(&*v).copied().collect::<Vec<_>>());
    assert_eq!(Some(&1), get_first(&v));
    assert_eq!(Some(&1), get_first(&*v));
}

Version information

rustc 1.79.0-nightly (60b5ca627 2024-03-25)
binary: rustc
commit-hash: 60b5ca62752ecc25d578066c8b82e1a4887267d4
commit-date: 2024-03-25
host: x86_64-unknown-linux-gnu
release: 1.79.0-nightly
LLVM version: 18.1.2

Command:
/home/matthias/.rustup/toolchains/master/bin/rustc -Zsanitizer=cfi -Ccodegen-units=1 -Clto

Program output

error: internal compiler error: compiler/rustc_symbol_mangling/src/typeid/typeid_itanium_cxx_abi.rs:1156:13: typeid_for_instance: couldn't get fn_abi of instance Layout(ReferencesError(ErrorGuaranteed(())))

thread 'rustc' panicked at compiler/rustc_symbol_mangling/src/typeid/typeid_itanium_cxx_abi.rs:1156:13:
Box<dyn Any>
stack backtrace:
   0:     0x7e02d0c78fd5 - std::backtrace_rs::backtrace::libunwind::trace::h3d729e02b7e4f4c0
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/../../backtrace/src/backtrace/libunwind.rs:105:5
   1:     0x7e02d0c78fd5 - std::backtrace_rs::backtrace::trace_unsynchronized::hf9eb6a6851ced4d3
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x7e02d0c78fd5 - std::sys_common::backtrace::_print_fmt::h5805b0883c8e47eb
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/sys_common/backtrace.rs:68:5
   3:     0x7e02d0c78fd5 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h3942b2eb4c92ae4e
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x7e02d0cca13b - core::fmt::rt::Argument::fmt::hd383c8373911ab98
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/core/src/fmt/rt.rs:142:9
   5:     0x7e02d0cca13b - core::fmt::write::h8fb8e625d0cb91a1
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/core/src/fmt/mod.rs:1153:17
   6:     0x7e02d0c6dcef - std::io::Write::write_fmt::h0c3f4e542287e339
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/io/mod.rs:1843:15
   7:     0x7e02d0c78dae - std::sys_common::backtrace::_print::h1a365287e06139f8
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/sys_common/backtrace.rs:47:5
   8:     0x7e02d0c78dae - std::sys_common::backtrace::print::h392e73d3ce4b6fbf
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/sys_common/backtrace.rs:34:9
   9:     0x7e02d0c7ba29 - std::panicking::default_hook::{{closure}}::h86ce919162e2a311
  10:     0x7e02d0c7b793 - std::panicking::default_hook::h621dc5c1001ac910
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/panicking.rs:292:9
  11:     0x7e02cd5c955f - std[1b6e1574881e4af5]::panicking::update_hook::<alloc[bf78e88bc4a89855]::boxed::Box<rustc_driver_impl[7d29d24e5efe687d]::install_ice_hook::{closure#0}>>::{closure#0}
  12:     0x7e02d0c7c12c - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::ha0bc3aa1b224b6ca
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/alloc/src/boxed.rs:2029:9
  13:     0x7e02d0c7c12c - std::panicking::rust_panic_with_hook::ha13a99f805e025ca
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/panicking.rs:793:13
  14:     0x7e02cd5f98f4 - std[1b6e1574881e4af5]::panicking::begin_panic::<rustc_errors[c5cbbdbb9312513c]::ExplicitBug>::{closure#0}
  15:     0x7e02cd5f6546 - std[1b6e1574881e4af5]::sys_common::backtrace::__rust_end_short_backtrace::<std[1b6e1574881e4af5]::panicking::begin_panic<rustc_errors[c5cbbdbb9312513c]::ExplicitBug>::{closure#0}, !>
  16:     0x7e02cd5f1a56 - std[1b6e1574881e4af5]::panicking::begin_panic::<rustc_errors[c5cbbdbb9312513c]::ExplicitBug>
  17:     0x7e02cd602d81 - <rustc_errors[c5cbbdbb9312513c]::diagnostic::BugAbort as rustc_errors[c5cbbdbb9312513c]::diagnostic::EmissionGuarantee>::emit_producing_guarantee
  18:     0x7e02cda94d6c - rustc_middle[55fe5918396ccd80]::util::bug::opt_span_bug_fmt::<rustc_span[58a22cdedf80650f]::span_encoding::Span>::{closure#0}
  19:     0x7e02cda783ca - rustc_middle[55fe5918396ccd80]::ty::context::tls::with_opt::<rustc_middle[55fe5918396ccd80]::util::bug::opt_span_bug_fmt<rustc_span[58a22cdedf80650f]::span_encoding::Span>::{closure#0}, !>::{closure#0}
  20:     0x7e02cda7826b - rustc_middle[55fe5918396ccd80]::ty::context::tls::with_context_opt::<rustc_middle[55fe5918396ccd80]::ty::context::tls::with_opt<rustc_middle[55fe5918396ccd80]::util::bug::opt_span_bug_fmt<rustc_span[58a22cdedf80650f]::span_encoding::Span>::{closure#0}, !>::{closure#0}, !>
  21:     0x7e02cbeb7d20 - rustc_middle[55fe5918396ccd80]::util::bug::bug_fmt
  22:     0x7e02cdf4f324 - rustc_symbol_mangling[1f67e53bc0a52e50]::typeid::typeid_itanium_cxx_abi::typeid_for_instance
  23:     0x7e02cbd7b7d2 - <rustc_codegen_llvm[eca60bb37ad821a4]::context::CodegenCx as rustc_codegen_ssa[cf87dacc1c61a2e2]::traits::declare::PreDefineMethods>::predefine_fn
  24:     0x7e02cf7024fb - rustc_codegen_llvm[eca60bb37ad821a4]::base::compile_codegen_unit::module_codegen
  25:     0x7e02cf6fe856 - <rustc_codegen_llvm[eca60bb37ad821a4]::LlvmCodegenBackend as rustc_codegen_ssa[cf87dacc1c61a2e2]::traits::backend::ExtraBackendMethods>::compile_codegen_unit
  26:     0x7e02cf88fb0f - rustc_codegen_ssa[cf87dacc1c61a2e2]::base::codegen_crate::<rustc_codegen_llvm[eca60bb37ad821a4]::LlvmCodegenBackend>
  27:     0x7e02cf8828a9 - <rustc_codegen_llvm[eca60bb37ad821a4]::LlvmCodegenBackend as rustc_codegen_ssa[cf87dacc1c61a2e2]::traits::backend::CodegenBackend>::codegen_crate
  28:     0x7e02cf88221f - rustc_interface[7babf4294a672537]::passes::start_codegen
  29:     0x7e02cf8819bd - <rustc_interface[7babf4294a672537]::queries::Queries>::codegen_and_build_linker
  30:     0x7e02cf658aeb - rustc_interface[7babf4294a672537]::interface::run_compiler::<core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>, rustc_driver_impl[7d29d24e5efe687d]::run_compiler::{closure#0}>::{closure#0}
  31:     0x7e02cf7698e3 - std[1b6e1574881e4af5]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[7babf4294a672537]::util::run_in_thread_with_globals<rustc_interface[7babf4294a672537]::util::run_in_thread_pool_with_globals<rustc_interface[7babf4294a672537]::interface::run_compiler<core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>, rustc_driver_impl[7d29d24e5efe687d]::run_compiler::{closure#0}>::{closure#0}, core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>>::{closure#0}, core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>>
  32:     0x7e02cf769710 - <<std[1b6e1574881e4af5]::thread::Builder>::spawn_unchecked_<rustc_interface[7babf4294a672537]::util::run_in_thread_with_globals<rustc_interface[7babf4294a672537]::util::run_in_thread_pool_with_globals<rustc_interface[7babf4294a672537]::interface::run_compiler<core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>, rustc_driver_impl[7d29d24e5efe687d]::run_compiler::{closure#0}>::{closure#0}, core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>>::{closure#0}, core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[e3c0811248e600b8]::result::Result<(), rustc_span[58a22cdedf80650f]::ErrorGuaranteed>>::{closure#1} as core[e3c0811248e600b8]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  33:     0x7e02d0c85a49 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h56e8ce0a1b41a1a0
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/alloc/src/boxed.rs:2015:9
  34:     0x7e02d0c85a49 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h6a8104fa0ae9471b
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/alloc/src/boxed.rs:2015:9
  35:     0x7e02d0c85a49 - std::sys::pal::unix::thread::Thread::new::thread_start::h40043a2934fc5170
                               at /rustc/60b5ca62752ecc25d578066c8b82e1a4887267d4/library/std/src/sys/pal/unix/thread.rs:108:17
  36:     0x7e02ca4a955a - <unknown>
  37:     0x7e02ca526a3c - <unknown>
  38:                0x0 - <unknown>

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.79.0-nightly (60b5ca627 2024-03-25) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z sanitizer=cfi -C codegen-units=1 -C lto -Z dump-mir-dir=dir

query stack during panic:
end of query stack
error: aborting due to 1 previous error


@matthiaskrgr matthiaskrgr added I-ICE Issue: The compiler panicked, giving an Internal Compilation Error (ICE) ❄️ T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. C-bug Category: This is a bug. labels Mar 25, 2024
@rustbot rustbot added the needs-triage This issue may need triage. Remove it if it has been sufficiently triaged. label Mar 25, 2024
@matthiaskrgr matthiaskrgr added the PG-exploit-mitigations Project group: Exploit mitigations label Mar 25, 2024
@matthiaskrgr
Copy link
Member Author

#123005 cc @maurer

@maurer
Copy link
Contributor

maurer commented Mar 25, 2024

@rustbot claim

@jieyouxu jieyouxu added S-has-mcve Status: A Minimal Complete and Verifiable Example has been found for this issue and removed needs-triage This issue may need triage. Remove it if it has been sufficiently triaged. labels Mar 25, 2024
maurer added a commit to maurer/rust that referenced this issue Mar 25, 2024
`trait_object_ty` assumed that associated types would be fully
determined by the trait. This is *almost* true - const parameters and
type parameters are no longer allowed, but lifetime parameters are.
Since we erase all lifetime parameters anyways, instantiate it with as
many erased regions as it needs.

Fixes: rust-lang#123053
matthiaskrgr added a commit to matthiaskrgr/rust that referenced this issue Mar 26, 2024
…compiler-errors

CFI: (actually) check that methods are object-safe before projecting their receivers to `dyn Trait` in CFI

`trait_object_ty` assumed that associated types would be fully determined by the trait. This is *almost* true - const parameters and type parameters are no longer allowed, but lifetime parameters are. Since we erase all lifetime parameters anyways, instantiate it with as many erased regions as it needs.

Fixes: rust-lang#123053

r? `@compiler-errors`
@bors bors closed this as completed in 70e1d23 Mar 26, 2024
rust-timer added a commit to rust-lang-ci/rust that referenced this issue Mar 26, 2024
Rollup merge of rust-lang#123066 - maurer:cfi-erased-lifetime-ice, r=compiler-errors

CFI: (actually) check that methods are object-safe before projecting their receivers to `dyn Trait` in CFI

`trait_object_ty` assumed that associated types would be fully determined by the trait. This is *almost* true - const parameters and type parameters are no longer allowed, but lifetime parameters are. Since we erase all lifetime parameters anyways, instantiate it with as many erased regions as it needs.

Fixes: rust-lang#123053

r? `@compiler-errors`
yunji-yunji pushed a commit to yunji-yunji/rust that referenced this issue Mar 27, 2024
`trait_object_ty` assumed that associated types would be fully
determined by the trait. This is *almost* true - const parameters and
type parameters are no longer allowed, but lifetime parameters are.
Since we erase all lifetime parameters anyways, instantiate it with as
many erased regions as it needs.

Fixes: rust-lang#123053
maurer added a commit to maurer/rust that referenced this issue Apr 1, 2024
`trait_object_ty` assumed that associated types would be fully
determined by the trait. This is *almost* true - const parameters and
type parameters are no longer allowed, but lifetime parameters are.
Since we erase all lifetime parameters anyways, instantiate it with as
many erased regions as it needs.

Fixes: rust-lang#123053
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C-bug Category: This is a bug. I-ICE Issue: The compiler panicked, giving an Internal Compilation Error (ICE) ❄️ PG-exploit-mitigations Project group: Exploit mitigations S-has-mcve Status: A Minimal Complete and Verifiable Example has been found for this issue T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.
Projects
None yet
4 participants