Repository navigation
rustc_typeck::check::compare_method::compare_const_impl doesn't drain its fullfillment context nor invoke regionck. #41323
Description
UPDATE: Mentoring instructions for fixing this bug can be found here.
There are some calls to add obligations to a fulfillment context but it's never checked.
Some examples of code that shouldn't compile:
trait TransmuteTarget: Sized {
type Out: Sized;
}
// Can't use generic impl here.
impl TransmuteTarget for String {
type Out = String;
}
trait Transmute: TransmuteTarget {
const FROM: Self::Out;
}
impl<T: TransmuteTarget> Transmute for T {
// Associated type projections aren't checked (obligation fulfillment).
const FROM: &'static str = "foo";
}trait Foo {
const NAME: &'static str;
}
impl<'a> Foo for &'a () {
// Lifetimes aren't checked (regionck).
const NAME: &'a str = "unit";
}cc @rust-lang/compiler
Activity
nikomatsakis commentedon Apr 20, 2017
triage: P-medium
withoutboats commentedon May 22, 2017
@eddyb does this block stabilization of associated consts?
eddyb commentedon May 22, 2017
@withoutboats Yes, as it allows const types in impls that don't match the trait definition.
withoutboats commentedon May 22, 2017
This can be exploited to elongate lifetimes:
[-]rustc_typeck::check::compare_method::compare_const_impl doesn't use its fullfillment context.[/-][+]rustc_typeck::check::compare_method::compare_const_impl doesn't drain its fullfillment context nor invoke regionck.[/+]aturon commentedon May 22, 2017
I'm renominating, given the exploit that @withoutboats found.
nikomatsakis commentedon May 26, 2017
This is a fairly straight-forward fix, so I'm going to write up some mentoring instructions. Maybe somebody wants to jump in on it!
In general, the code in
compare_method.rsis used to compare an associated item definition found in an impl against the trait specification. The name of the file is somewhat outdated; used to be that methods were the only thing where we needed special checks.I actually suspect that the code for methods and constants could be combined into one function (as this comment suggests), but we can leave that for bonus points.
Let's walk through what the code does now. Imagine we have something like
impl<T> Foo<T> for Vec<T> { const X: U = .... Our goal is to check that this typeUmatches what it says in the trait.Foo<T> for Vec<T>, in our example) here and extract its "substs" -- these are the values for the generic paramters of the trait ([Vec<T>, T], as the first thing is theSelfparameter).U) hereVec<T>forSelfandTfor the trait's other type parameter, basically.This is where things go wrong. First off, I suspect it'd be better to just require that the types are equal, rather than subtypes. That can be done by changing from
subtoeq. But more importantly, the subtype operation works like this:Basically, we've enqueued up a bunch of further checks that we ought to do, but nowhere are we doing them.
We ought to be adding two things (here I am giving links into the method code):
select_all_or_error(&infcx).In both cases, we should be able to essentially cut-and-paste the existing code.
nikomatsakis commentedon May 26, 2017
Tagging as E-mentor.
associated_consts: check trait obligations and regionck for associate…
Rollup merge of rust-lang#42324 - seanmonstar:41323-compare_const_imp…
Rollup merge of rust-lang#42324 - seanmonstar:41323-compare_const_imp…