about summary refs log tree commit diff
path: root/src/tools/miri
AgeCommit message (Collapse)AuthorLines
2025-08-23Rollup merge of #144531 - Urgau:int_to_ptr_transmutes, r=jackh726Jacob Pratt-0/+12
Add lint against integer to pointer transmutes # `integer_to_ptr_transmutes` *warn-by-default* The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference. ### Example ```rust fn foo(a: usize) -> *const u8 { unsafe { std::mem::transmute::<usize, *const u8>(a) } } ``` ``` warning: transmuting an integer to a pointer creates a pointer without provenance --> a.rs:1:9 | 158 | std::mem::transmute::<usize, *const u8>(a) | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = note: this is dangerous because dereferencing the resulting pointer is undefined behavior = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut` = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers> = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance> = note: `#[warn(integer_to_ptr_transmutes)]` on by default help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance | 158 - std::mem::transmute::<usize, *const u8>(a) 158 + std::ptr::with_exposed_provenance::<u8>(a) | ``` ### Explanation Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance. Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used. See [std::mem::transmute] in the reference for more details. [std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html -------- People are getting tripped up on this, see https://github.com/rust-lang/rust/issues/128409 and https://github.com/rust-lang/rust/issues/141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code). Fixes https://github.com/rust-lang/rust-clippy/issues/13140 Fixes https://github.com/rust-lang/rust/issues/141220 Fixes https://github.com/rust-lang/rust/issues/145523 `@rustbot` labels +I-lang-nominated +T-lang cc `@traviscross` r? compiler
2025-08-24Allow `integer_to_ptr_transmutes` in testsUrgau-0/+12
2025-08-23Merge pull request #4540 from RalfJung/tb-refactorsRalf Jung-144/+116
tree borrows: refactor new-permission logic
2025-08-23refactor tb_rebor: reduce code duplicationRalf Jung-38/+22
2025-08-23tree borrows: refactor new-permission logicRalf Jung-110/+98
2025-08-23Rollup merge of #145744 - RalfJung:miri-inplace-aliasing, r=compiler-errorsSamuel Tardieu-0/+95
miri: also detect aliasing of in-place argument and return place This is a follow-up to https://github.com/rust-lang/rust/pull/145585 where I forgot to deal with the case of the return place aliasing an in-place argument -- as ``@Amanieu`` mentioned in https://github.com/rust-lang/rust/issues/71117#issuecomment-3212885817, that case must also be forbidden. r? ``@compiler-errors``
2025-08-23Rollup merge of #145540 - nia-e:prov-map-range, r=RalfJungSamuel Tardieu-8/+3
interpret/allocation: get_range on ProvenanceMap Helper method to grab all provenances in a given address range for an allocation, making some logic in Miri nicer.
2025-08-23Merge pull request #4524 from Stypox/tracing-chrome-overhead-rdtscRalf Jung-78/+283
Account for time spent tracing, use RDTSC for faster time
2025-08-23Account for time spent tracing, use RDTSC for faster timeStypox-78/+283
2025-08-22Rollup merge of #145573 - veluca93:unsafe-force-target-feature, r=davidtwcoJacob Pratt-1/+2
Add an experimental unsafe(force_target_feature) attribute. This uses the feature gate for https://github.com/rust-lang/rust/issues/143352, but is described in https://github.com/rust-lang/rfcs/pull/3820 which is strongly tied to the experiment.
2025-08-22interpret/allocation: get_range on ProvenanceMapNia Espera-8/+3
2025-08-22Merge pull request #4538 from RalfJung/zst-reborRalf Jung-1/+21
add some ZST reborrow tests
2025-08-22miri: also detect aliasing of in-place argument and return placeRalf Jung-0/+95
2025-08-22add some ZST reborrow testsRalf Jung-1/+21
2025-08-22Merge ref '8e3710ef31a0' from rust-lang/rustThe Miri Cronjob Bot-1/+1
Pull recent changes from https://github.com/rust-lang/rust via Josh. Upstream ref: 8e3710ef31a0b2cdf5a1c2f3929b7735d1e28c20 Filtered ref: 3629e47f19f1c1c9710f45b80a31eb32d851baf6 This merge was created using https://github.com/rust-lang/josh-sync.
2025-08-22Prepare for merging from rust-lang/rustThe Miri Cronjob Bot-1/+1
This updates the rust-version file to 8e3710ef31a0b2cdf5a1c2f3929b7735d1e28c20.
2025-08-22Add an experimental unsafe(force_target_feature) attribute.Luca Versari-1/+2
This uses the feature gate for https://github.com/rust-lang/rust/issues/143352, but is described in https://github.com/rust-lang/rfcs/pull/3820 which is strongly tied to the experiment.
2025-08-21Rollup merge of #145137 - Kmeakin:km/optimize-slice-index-panicking, r=jhprattJacob Pratt-1/+1
Consolidate panicking functions in `slice/index.rs` Consolidate all the panicking functions in `slice/index.rs` to use a single `slice_index_fail` function, similar to how it is done in `str/traits.rs`. Split off from https://github.com/rust-lang/rust/pull/145024
2025-08-21CI: also test on powerpcRalf Jung-0/+5
2025-08-21update rustc-build-sysrootRalf Jung-3/+3
2025-08-21Auto merge of #145647 - RalfJung:miri, r=RalfJungbors-51/+214
miri subtree update Subtree update of `miri` to https://github.com/rust-lang/miri/commit/980da679e4da038a723c56b2af892ff7ea0209fc. Created using https://github.com/rust-lang/josh-sync. r? `@ghost`
2025-08-21Consolidate panicking functions in `slice/index.rs`Karl Meakin-1/+1
Consolidate all the panicking functions in `slice/index.rs` to use a single `slice_index_fail` function, similar to how it is done in `str/traits.rs`.
2025-08-21Merge ref '125ff8a788c5' from rust-lang/rustThe Miri Cronjob Bot-0/+23
Pull recent changes from https://github.com/rust-lang/rust via Josh. Upstream ref: 125ff8a788c5d6a66917f499abdc00051afe6886 Filtered ref: bcbe2eb9c674ba7e35befb4557f33a1956964256 This merge was created using https://github.com/rust-lang/josh-sync.
2025-08-21Prepare for merging from rust-lang/rustThe Miri Cronjob Bot-1/+1
This updates the rust-version file to 125ff8a788c5d6a66917f499abdc00051afe6886.
2025-08-20Bump slab from 0.4.10 to 0.4.11 in /tests/depsdependabot[bot]-2/+2
Bumps [slab](https://github.com/tokio-rs/slab) from 0.4.10 to 0.4.11. - [Release notes](https://github.com/tokio-rs/slab/releases) - [Changelog](https://github.com/tokio-rs/slab/blob/master/CHANGELOG.md) - [Commits](https://github.com/tokio-rs/slab/compare/v0.4.10...v0.4.11) --- updated-dependencies: - dependency-name: slab dependency-version: 0.4.11 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
2025-08-20Merge pull request #4532 from rust-lang/rustup-2025-08-20Ralf Jung-39/+136
Automatic Rustup
2025-08-20allow cfg(bootstrap)Ralf Jung-0/+1
2025-08-20bless new testsRalf Jung-0/+1
2025-08-20add back cfg(bootstrap), it is still neededRalf Jung-0/+1
2025-08-20Merge ref 'f605b57042ff' from rust-lang/rustThe Miri Cronjob Bot-38/+132
Pull recent changes from https://github.com/rust-lang/rust via Josh. Upstream ref: f605b57042ffeb320d7ae44490113a827139b766 Filtered ref: c69d2743ed4676c4529ebb60b258f6c1273c9145 This merge was created using https://github.com/rust-lang/josh-sync.
2025-08-20Prepare for merging from rust-lang/rustThe Miri Cronjob Bot-1/+1
This updates the rust-version file to f605b57042ffeb320d7ae44490113a827139b766.
2025-08-20Rollup merge of #145626 - folkertdev:prefetch-fallback, r=AmanieuJacob Pratt-0/+23
add a fallback implementation for the `prefetch_*` intrinsics related ACP: https://github.com/rust-lang/libs-team/issues/638 The fallback is to just ignore the arguments. That is a valid implementation because this intrinsic is just a hint. I also added the `miri::intrinsic_fallback_is_spec` annotation, so that miri now supports these operations. A prefetch intrinsic call is valid on any pointer. (specifically LLVM guarantees this https://llvm.org/docs/LangRef.html#llvm-prefetch-intrinsic) Next, I made the `LOCALITY` argument a const generic. That argument must be const (otherwise LLVM crashes), but that was not reflected in the type. Finally, with these changes, the intrinsic can be safe and `const` (a prefetch at const evaluation time is just a no-op). cc `@Amanieu` r? `@RalfJung`
2025-08-20make `prefetch` intrinsics safeFolkert de Vries-14/+14
2025-08-19Enable triagebot `[review-changes-since]` featureUrgau-0/+3
2025-08-19Auto merge of #145600 - jieyouxu:rollup-jw0bpnt, r=jieyouxubors-1/+1
Rollup of 15 pull requests Successful merges: - rust-lang/rust#145338 (actually provide the correct args to coroutine witnesses) - rust-lang/rust#145429 (Couple of codegen_fn_attrs improvements) - rust-lang/rust#145452 (Do not strip binaries in bootstrap everytime if they are unchanged) - rust-lang/rust#145464 (Stabilize `const_pathbuf_osstring_new` feature) - rust-lang/rust#145474 (Properly recover from parenthesized use-bounds (precise capturing lists) plus small cleanups) - rust-lang/rust#145486 (Fix `unicode_data.rs` mention message) - rust-lang/rust#145490 (Trace some basic I/O operations in bootstrap) - rust-lang/rust#145493 (remove `should_render` in `PrintAttribute` derive) - rust-lang/rust#145500 (Port must_use to the new target checking) - rust-lang/rust#145505 (Simplify span caches) - rust-lang/rust#145510 (Visit and print async_fut local for async drop.) - rust-lang/rust#145511 (Rust build fails on OpenBSD after using file_lock feature) - rust-lang/rust#145532 (resolve: debug for block module) - rust-lang/rust#145533 (Reorder `lto` options from most to least optimizing) - rust-lang/rust#145537 (Do not consider a `T: !Sized` candidate to satisfy a `T: !MetaSized` obligation.) r? `@ghost` `@rustbot` modify labels: rollup
2025-08-19add a fallback implementation for the `prefetch_*` intrinsicsFolkert de Vries-0/+23
The fallback is to just ignore the arguments. That is a valid implementation because this intrinsic is just a hint. I also added `miri::intrinsic_fallback_is_spec` annotation, so that miri now supports these operations. A prefetch intrinsic call is valid on any pointer.
2025-08-19Support weak definitionsbjorn3-28/+114
When a symbol only has a weak definition, this definition will be picked. When a symbol has both a weak and a regular definition, the regular definition will be picked instead.
2025-08-19God bless the testsJohannes Hostert-0/+53
2025-08-19link to TB doc in unsafe-code-guidelinesJohannes Hostert-1/+2
2025-08-19Rollup merge of #145429 - bjorn3:codegen_fn_attrs_improvements, r=jdonszelmann许杰友 Jieyou Xu (Joe)-1/+1
Couple of codegen_fn_attrs improvements As noted in https://github.com/rust-lang/rust/pull/144678#discussion_r2245060329 here is no need to keep link_name and export_name separate, which the third commit fixes by merging them. The second commit removes some dead code and the first commit merges two ifs with equivalent conditions. The last commit is an unrelated change which removes an unused `feature(autodiff)`.
2025-08-19Rollup merge of #145585 - RalfJung:miri-inplace-arg-checks, r=compiler-errors许杰友 Jieyou Xu (Joe)-37/+129
Miri: fix handling of in-place argument and return place handling This fixes two separate bugs (in two separate commits): - If the return place is `_local` and not `*ptr`, we didn't always properly protect it if there were other pointers pointing to that return place. - If two in-place arguments are *the same* local variable, we didn't always detect that aliasing.
2025-08-19Rollup merge of #145306 - Stypox:tracing-misc, r=RalfJung许杰友 Jieyou Xu (Joe)-0/+2
Add tracing to various miscellaneous functions This PR adds tracing to: - `ty.fn_sig()`. There is only one place where `fn_sig` is called for real within `rustc_const_eval`. There are three other places where it's called, but one is inside `ConstCx::fn_sig` (which does not seem to be used anywhere), another is under `if cfg!(debug_assertions)`, and the last is within `call_main` and thus gets called only once. - the two possible things `find_mir_or_eval_fn` can do: "emulate_foreign_item" and "load_mir" - all calls to `Const.eval()` within the Miri or the `rustc_const_eval` codebase. - a separate commit also fixes the style of some tracing macros Those are all quite long-lived operations, that in total make up for 6-7% of the total time spent in the program. I found out about them by looking for long periods of time that were previously not traced at all, using this SQL query in ui.perfetto.dev: ```sql with ordered as (select s1.*, row_number() over (order by s1.ts) as rn from slices as s1 where s1.parent_id is null and s1.dur > 0 and s1.name != "frame" and s1.name != "step" and s1.name != "backtrace") select a.ts+a.dur as ts, b.ts-a.ts-a.dur as dur, a.id, a.track_id, a.category, a.depth, a.stack_id, a.parent_stack_id, a.parent_id, a.arg_set_id, a.thread_ts, a.thread_instruction_count, a.thread_instruction_delta, a.cat, a.slice_id, "empty" as name from ordered as a inner join ordered as b on a.rn=b.rn-1 /*where b.ts-a.ts-a.dur > 5000*/ order by b.ts-a.ts-a.dur desc ``` <details> <summary>How the table was obtained</summary> The above image was obtained in ui.perfetto.dev with the following SQL query after obtaining a trace file by running Miri on the following Rust code with `n=100`. ```sql select "TOTAL PROGRAM DURATION" as name, count(*), max(ts + dur) as "sum(dur)", 100.0 as "%", null as "min(dur)", null as "max(dur)", null as "avg(dur)", null as "stddev(dur)" from slices union select "TOTAL OVER ALL SPANS (excluding events)" as name, count(*), sum(dur), cast(cast(sum(dur) as float) / (select max(ts + dur) from slices) * 1000 as int) / 10.0 as "%", min(dur), max(dur), cast(avg(dur) as int) as "avg(dur)", cast(sqrt(avg(dur*dur)-avg(dur)*avg(dur)) as int) as "stddev(dur)" from slices where parent_id is null and name != "frame" and name != "step" and dur > 0 union select name, count(*), sum(dur), cast(cast(sum(dur) as float) / (select max(ts + dur) from slices) * 1000 as int) / 10.0 as "%", min(dur), max(dur), cast(avg(dur) as int) as "avg(dur)", cast(sqrt(avg(dur*dur)-avg(dur)*avg(dur)) as int) as "stddev(dur)" from slices where parent_id is null and name != "frame" and name != "step" group by name order by sum(dur) desc, count(*) desc ``` ```rust fn main() { let n: usize = std::env::args().nth(1).unwrap().parse().unwrap(); let mut v = (0..n).into_iter().collect::<Vec<_>>(); for i in &mut v { *i += 1; } } ``` </details> <img width="1689" height="317" alt="image" src="https://github.com/user-attachments/assets/ee2c81f5-d74a-4da5-b4b6-ab2770175b14" />
2025-08-19miri: detect passing the same local twice as an in-place argumentRalf Jung-0/+92
2025-08-18Add tracing to various miscellaneous functionsStypox-0/+2
Also use tracing macro syntax instead of format()
2025-08-18interpret: fix in-place return place semantics when the return place ↵Ralf Jung-37/+37
expression is a local variable
2025-08-18triagebot: Show range-diff links on force pushesRalf Jung-2/+5
2025-08-18Merge pull request #4523 from Stypox/data-race-tracingRalf Jung-0/+6
Add tracing to data race functions
2025-08-18fmtThe Miri Cronjob Bot-1/+2
2025-08-18Merge ref '425a9c0a0e36' from rust-lang/rustThe Miri Cronjob Bot-69/+104
Pull recent changes from https://github.com/rust-lang/rust via Josh. Upstream ref: 425a9c0a0e365c0b8c6cfd00c2ded83a73bed9a0 Filtered ref: 7e955d5a6c676a099595bdfaec0705d3703e7a3c This merge was created using https://github.com/rust-lang/josh-sync.
2025-08-18Prepare for merging from rust-lang/rustThe Miri Cronjob Bot-1/+1
This updates the rust-version file to 425a9c0a0e365c0b8c6cfd00c2ded83a73bed9a0.