Rollup merge of #113699 - RalfJung:miri, r=RalfJung

update Miri

This fixes a pretty nasty bug in the tag GC.

r? ghost

Author: matthiaskrgr

src/tools/miri/rust-version

@@ -1 +1 @@
-743333f3dd90721461c09387ec73d09c080d5f5f
+33a2c2487ac5d9927830ea4c1844335c6b9f77db

src/tools/miri/src/borrow_tracker/mod.rs

@@ -74,7 +74,7 @@ pub struct FrameState {
 
 impl VisitTags for FrameState {
     fn visit_tags(&self, _visit: &mut dyn FnMut(BorTag)) {
-        // `protected_tags` are fine to GC.
+        // `protected_tags` are already recorded by `GlobalStateInner`.
     }
 }
 
@@ -108,9 +108,12 @@ pub struct GlobalStateInner {
 }
 
 impl VisitTags for GlobalStateInner {
-    fn visit_tags(&self, _visit: &mut dyn FnMut(BorTag)) {
-        // The only candidate is base_ptr_tags, and that does not need visiting since we don't ever
-        // GC the bottommost tag.
+    fn visit_tags(&self, visit: &mut dyn FnMut(BorTag)) {
+        for &tag in self.protected_tags.keys() {
+            visit(tag);
+        }
+        // The only other candidate is base_ptr_tags, and that does not need visiting since we don't ever
+        // GC the bottommost/root tag.
     }
 }
 

src/tools/miri/src/borrow_tracker/stacked_borrows/mod.rs

@@ -996,7 +996,7 @@ pub trait EvalContextExt<'mir, 'tcx: 'mir>: crate::MiriInterpCxExt<'mir, 'tcx> {
 
     /// Protect a place so that it cannot be used any more for the duration of the current function
     /// call.
-    /// 
+    ///
     /// This is used to ensure soundness of in-place function argument/return passing.
     fn sb_protect_place(&mut self, place: &MPlaceTy<'tcx, Provenance>) -> InterpResult<'tcx> {
         let this = self.eval_context_mut();

src/tools/miri/src/borrow_tracker/tree_borrows/mod.rs

@@ -497,7 +497,7 @@ pub trait EvalContextExt<'mir, 'tcx: 'mir>: crate::MiriInterpCxExt<'mir, 'tcx> {
 
     /// Protect a place so that it cannot be used any more for the duration of the current function
     /// call.
-    /// 
+    ///
     /// This is used to ensure soundness of in-place function argument/return passing.
     fn tb_protect_place(&mut self, place: &MPlaceTy<'tcx, Provenance>) -> InterpResult<'tcx> {
         let this = self.eval_context_mut();

src/tools/miri/src/lib.rs

@@ -43,19 +43,20 @@
 // Needed for rustdoc from bootstrap (with `-Znormalize-docs`).
 #![recursion_limit = "256"]
 
+extern crate either; // the one from rustc
+
 extern crate rustc_apfloat;
 extern crate rustc_ast;
-extern crate rustc_errors;
-#[macro_use]
-extern crate rustc_middle;
 extern crate rustc_const_eval;
 extern crate rustc_data_structures;
+extern crate rustc_errors;
 extern crate rustc_hir;
 extern crate rustc_index;
+#[macro_use]
+extern crate rustc_middle;
 extern crate rustc_session;
 extern crate rustc_span;
 extern crate rustc_target;
-extern crate either; // the one from rustc
 
 // Necessary to pull in object code as the rest of the rustc crates are shipped only as rmeta
 // files.

src/tools/miri/src/machine.rs

@@ -1097,9 +1097,8 @@ impl<'mir, 'tcx> Machine<'mir, 'tcx> for MiriMachine<'mir, 'tcx> {
         ptr: Pointer<Self::Provenance>,
     ) -> InterpResult<'tcx> {
         match ptr.provenance {
-            Provenance::Concrete { alloc_id, tag } => {
-                intptrcast::GlobalStateInner::expose_ptr(ecx, alloc_id, tag)
-            }
+            Provenance::Concrete { alloc_id, tag } =>
+                intptrcast::GlobalStateInner::expose_ptr(ecx, alloc_id, tag),
             Provenance::Wildcard => {
                 // No need to do anything for wildcard pointers as
                 // their provenances have already been previously exposed.

src/tools/miri/tests/fail/dangling_pointers/dangling_zst_deref.rs

@@ -1,6 +1,5 @@
 // Make sure we find these even with many checks disabled.
-// Some optimizations remove ZST accesses, thus masking this UB.
-//@compile-flags: -Zmir-opt-level=0 -Zmiri-disable-alignment-check -Zmiri-disable-stacked-borrows -Zmiri-disable-validation
+//@compile-flags: -Zmiri-disable-alignment-check -Zmiri-disable-stacked-borrows -Zmiri-disable-validation
 
 fn main() {
     let p = {

src/tools/miri/tests/fail/dangling_pointers/dyn_size.rs

@@ -1,5 +1,5 @@
-// should find the bug even without these, but gets masked by optimizations
-//@compile-flags: -Zmiri-disable-validation -Zmiri-disable-stacked-borrows -Zmir-opt-level=0
+// should find the bug even without these
+//@compile-flags: -Zmiri-disable-validation -Zmiri-disable-stacked-borrows
 
 struct SliceWithHead(u8, [u8]);
 

src/tools/miri/tests/fail/dangling_pointers/maybe_null_pointer_deref_zst.rs

@@ -1,6 +1,3 @@
-// Some optimizations remove ZST accesses, thus masking this UB.
-//@compile-flags: -Zmir-opt-level=0
-
 fn main() {
     // This pointer *could* be NULL so we cannot load from it, not even at ZST
     let ptr = (&0u8 as *const u8).wrapping_sub(0x800) as *const ();

src/tools/miri/tests/fail/dangling_pointers/maybe_null_pointer_write_zst.rs

@@ -1,6 +1,3 @@
-// Some optimizations remove ZST accesses, thus masking this UB.
-//@compile-flags: -Zmir-opt-level=0
-
 fn main() {
     // This pointer *could* be NULL so we cannot load from it, not even at ZST.
     // Not using the () type here, as writes of that type do not even have MIR generated.