Repository navigation
Soundness regression with for<'lt> closure having an implied bound from return type #114936
Description
Bug originally found by @ast-ral, over Discord, which I've then reduced.
Code
I tried this code:
fn whoops(
s: String,
f: impl for<'s> FnOnce(&'s str) -> (&'static str, [&'static &'s (); 0]),
) -> &'static str
{
f(&s).0
}I expected to see this happen:
error[E0597]: `s` does not live long enough
--> <source>:6:7
|
6 | f(&s).0
| --^^-
| | |
| | borrowed value does not live long enough
| argument requires that `s` is borrowed for `'static`
7 | }
| - `s` dropped here while still borrowed
error: aborting due to previous error
For more information about this error, try `rustc --explain E0597`.Instead, this happened: code compiles successfully
Version it soundly rejected this code:
Version with soundness regression
1.65.0 and onwards
Proof of unsoundness:
fn static_str_identity()
-> impl for<'s> FnOnce(&'s str) -> (
[&'static &'s (); 0],
&'static str,
)
{
|s: &/* 's */ str| ( // <----------------+ inputs restricted to `'s`.
[], // `: [&'static &'s (); 0]`, |
// thus `'s : 'static` ->------+
// +-<----------------+
// |
// v
s, // `: &'s str <: &'static str`
)
}
fn main()
{
let f = static_str_identity();
let local = String::from("...");
let s: &'static str = f(&local).1; // <- should be rejected!
drop(local);
let _unrelated = String::from("UB!");
dbg!(s); // <- compiles and prints `"UB!"`
}@rustbot modify labels: +I-unsound +regression-from-stable-to-stable -regression-untriaged
Observations
-
This does not occur if the implied-lifetime-bounds array is in closure parameter position; so it looks like a bug w.r.t. not properly checking the closure output type implied bounds?
-
-Ztrait-solver=nextdoes not help (as of2023-08-16)
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
lqd commentedon Aug 17, 2023
Bisected to nightly-2022-08-10:
Fnbounds #100205mir::MutVisitorto not invalidate CFG. #100089apiraino commentedon Aug 17, 2023
@lqd you beat me by one minute :)
cc @lcnr for #99217 being possible cause of this unsoundness?
apiraino commentedon Aug 17, 2023
WG-prioritization assigning priority (Zulip discussion).
@rustbot label -I-prioritize +P-high +T-compiler -needs-triage
ast-ral commentedon Aug 17, 2023
Oh, neat it did turn out to be a new soundness bug instead of a dupe of #25860. Thanks for figuring out this was a regression, @danielhenrymantilla.
5 remaining items
Auto merge of rust-lang#118882 - compiler-errors:normalized-sig-wf, r…
Auto merge of rust-lang#118882 - compiler-errors:normalized-sig-wf, r…
Auto merge of rust-lang#118882 - compiler-errors:normalized-sig-wf, r…
Rollup merge of rust-lang#118882 - compiler-errors:normalized-sig-wf,…
Rollup merge of rust-lang#118882 - compiler-errors:normalized-sig-wf,…
Unrolled build for rust-lang#118882