Auto merge of #55716 - RalfJung:escape-to-raw, r=oli-obk

Add escape-to-raw MIR statement

Add a new MIR "ghost state statement": Escaping a ptr to permit raw accesses.

~~This includes #55549, [click here](https://github.com/RalfJung/rust/compare/miri-visitor...RalfJung:escape-to-raw) for just the new commits.~~

3 files changed, 68 insertions, 4 deletions

diff --git a/src/test/mir-opt/array-index-is-temporary.rs b/src/test/mir-opt/array-index-is-temporary.rs
new file mode 100644
index 00000000000..856e1063f60
--- /dev/null
+++ b/src/test/mir-opt/array-index-is-temporary.rs
@@ -0,0 +1,43 @@
+// Retagging (from Stacked Borrows) relies on the array index being a fresh
+// temporary, so that side-effects cannot change it.
+// Test that this is indeed the case.
+
+unsafe fn foo(z: *mut usize) -> u32 {
+    *z = 2;
+    99
+}
+
+fn main() {
+    let mut x = [42, 43, 44];
+    let mut y = 1;
+    let z: *mut usize = &mut y;
+    x[y] = unsafe { foo(z) };
+}
+
+// END RUST SOURCE
+// START rustc.main.EraseRegions.after.mir
+//     bb0: {
+//         ...
+//         _6 = &mut _2;
+//         _5 = &mut (*_6);
+//         _4 = move _5 as *mut usize (Misc);
+//         _3 = move _4;
+//         ...
+//         _8 = _3;
+//         _7 = const foo(move _8) -> bb1;
+//     }
+//
+//     bb1: {
+//         ...
+//         _9 = _2;
+//         _10 = Len(_1);
+//         _11 = Lt(_9, _10);
+//         assert(move _11, "index out of bounds: the len is move _10 but the index is _9") -> bb2;
+//     }
+//
+//     bb2: {
+//         _1[_9] = move _7;
+//         ...
+//         return;
+//     }
+// END rustc.main.EraseRegions.after.mir
diff --git a/src/test/mir-opt/inline-retag.rs b/src/test/mir-opt/inline-retag.rs
index 4b3280ee561..1e5e1ad5ed1 100644
--- a/src/test/mir-opt/inline-retag.rs
+++ b/src/test/mir-opt/inline-retag.rs
@@ -32,6 +32,8 @@ fn bar() -> bool {
 //     bb0: {
 //         ...
 //         Retag(_3);
+//         ...
+//         Retag(_3);
 //         Retag(_6);
 //         StorageLive(_9);
 //         _9 = (*_3);
diff --git a/src/test/mir-opt/retag.rs b/src/test/mir-opt/retag.rs
index 9c013008ab2..7da55c0868c 100644
--- a/src/test/mir-opt/retag.rs
+++ b/src/test/mir-opt/retag.rs
@@ -26,7 +26,9 @@ fn main() {
     {
         let v = Test(0).foo(&mut x); // just making sure we do not panic when there is a tuple struct ctor
         let w = { v }; // assignment
-        let _w = w; // reborrow
+        let w = w; // reborrow
+        // escape-to-raw (mut)
+        let _w = w as *mut _;
     }
 
     // Also test closures
@@ -35,6 +37,9 @@ fn main() {
 
     // need to call `foo_shr` or it doesn't even get generated
     Test(0).foo_shr(&0);
+
+    // escape-to-raw (shr)
+    let _w = _w as *const _;
 }
 
 // END RUST SOURCE
@@ -44,6 +49,7 @@ fn main() {
 //         Retag([fn entry] _2);
 //         ...
 //         _0 = &mut (*_3);
+//         Retag(_0);
 //         ...
 //         return;
 //     }
@@ -73,23 +79,36 @@ fn main() {
 //         _9 = move _3;
 //         Retag(_9);
 //         _8 = &mut (*_9);
+//         Retag(_8);
 //         StorageDead(_9);
 //         StorageLive(_10);
 //         _10 = move _8;
 //         Retag(_10);
 //         ...
-//         _13 = move _14(move _15) -> bb2;
+//         _14 = &mut (*_10);
+//         Retag(_14);
+//         EscapeToRaw(move _14);
+//         _13 = move _14 as *mut i32 (Misc);
+//         ...
+//         _17 = move _18(move _19) -> bb2;
 //     }
 //
 //     bb2: {
-//         Retag(_13);
+//         Retag(_17);
+//         ...
+//         _21 = const Test::foo_shr(move _22, move _24) -> bb3;
+//     }
+//
+//     bb3: {
 //         ...
+//         return;
 //     }
+//
 //     ...
 // }
 // END rustc.main.EraseRegions.after.mir
 // START rustc.main-{{closure}}.EraseRegions.after.mir
-// fn main::{{closure}}(_1: &[closure@NodeId(117)], _2: &i32) -> &i32 {
+// fn main::{{closure}}(_1: &[closure@NodeId(124)], _2: &i32) -> &i32 {
 //     ...
 //     bb0: {
 //         Retag([fn entry] _1);