rustc_const_eval/interpret/
validity.rs

1//! Check the validity invariant of a given value, and tell the user
2//! where in the value it got violated.
3//! In const context, this goes even further and tries to approximate const safety.
4//! That's useful because it means other passes (e.g. promotion) can rely on `const`s
5//! to be const-safe.
6
7use std::borrow::Cow;
8use std::fmt::Write;
9use std::hash::Hash;
10use std::num::NonZero;
11
12use either::{Left, Right};
13use hir::def::DefKind;
14use rustc_abi::{
15    BackendRepr, FieldIdx, FieldsShape, Scalar as ScalarAbi, Size, VariantIdx, Variants,
16    WrappingRange,
17};
18use rustc_ast::Mutability;
19use rustc_data_structures::fx::FxHashSet;
20use rustc_hir as hir;
21use rustc_middle::bug;
22use rustc_middle::mir::interpret::ValidationErrorKind::{self, *};
23use rustc_middle::mir::interpret::{
24    ExpectedKind, InterpErrorKind, InvalidMetaKind, Misalignment, PointerKind, Provenance,
25    UnsupportedOpInfo, ValidationErrorInfo, alloc_range, interp_ok,
26};
27use rustc_middle::ty::layout::{LayoutCx, TyAndLayout};
28use rustc_middle::ty::{self, Ty};
29use rustc_span::{Symbol, sym};
30use tracing::trace;
31
32use super::machine::AllocMap;
33use super::{
34    AllocId, CheckInAllocMsg, GlobalAlloc, ImmTy, Immediate, InterpCx, InterpResult, MPlaceTy,
35    Machine, MemPlaceMeta, PlaceTy, Pointer, Projectable, Scalar, ValueVisitor, err_ub,
36    format_interp_error,
37};
38use crate::enter_trace_span;
39
40// for the validation errors
41#[rustfmt::skip]
42use super::InterpErrorKind::UndefinedBehavior as Ub;
43use super::InterpErrorKind::Unsupported as Unsup;
44use super::UndefinedBehaviorInfo::*;
45use super::UnsupportedOpInfo::*;
46
47macro_rules! err_validation_failure {
48    ($where:expr, $kind: expr) => {{
49        let where_ = &$where;
50        let path = if !where_.is_empty() {
51            let mut path = String::new();
52            write_path(&mut path, where_);
53            Some(path)
54        } else {
55            None
56        };
57
58        err_ub!(ValidationError(ValidationErrorInfo { path, kind: $kind }))
59    }};
60}
61
62macro_rules! throw_validation_failure {
63    ($where:expr, $kind: expr) => {
64        do yeet err_validation_failure!($where, $kind)
65    };
66}
67
68/// If $e throws an error matching the pattern, throw a validation failure.
69/// Other errors are passed back to the caller, unchanged -- and if they reach the root of
70/// the visitor, we make sure only validation errors and `InvalidProgram` errors are left.
71/// This lets you use the patterns as a kind of validation list, asserting which errors
72/// can possibly happen:
73///
74/// ```ignore(illustrative)
75/// let v = try_validation!(some_fn(), some_path, {
76///     Foo | Bar | Baz => { "some failure" },
77/// });
78/// ```
79///
80/// The patterns must be of type `UndefinedBehaviorInfo`.
81/// An additional expected parameter can also be added to the failure message:
82///
83/// ```ignore(illustrative)
84/// let v = try_validation!(some_fn(), some_path, {
85///     Foo | Bar | Baz => { "some failure" } expected { "something that wasn't a failure" },
86/// });
87/// ```
88///
89/// An additional nicety is that both parameters actually take format args, so you can just write
90/// the format string in directly:
91///
92/// ```ignore(illustrative)
93/// let v = try_validation!(some_fn(), some_path, {
94///     Foo | Bar | Baz => { "{:?}", some_failure } expected { "{}", expected_value },
95/// });
96/// ```
97///
98macro_rules! try_validation {
99    ($e:expr, $where:expr,
100    $( $( $p:pat_param )|+ => $kind: expr ),+ $(,)?
101    ) => {{
102        $e.map_err_kind(|e| {
103            // We catch the error and turn it into a validation failure. We are okay with
104            // allocation here as this can only slow down builds that fail anyway.
105            match e {
106                $(
107                    $($p)|+ => {
108                        err_validation_failure!(
109                            $where,
110                            $kind
111                        )
112                    }
113                ),+,
114                e => e,
115            }
116        })?
117    }};
118}
119
120/// We want to show a nice path to the invalid field for diagnostics,
121/// but avoid string operations in the happy case where no error happens.
122/// So we track a `Vec<PathElem>` where `PathElem` contains all the data we
123/// need to later print something for the user.
124#[derive(Copy, Clone, Debug)]
125pub enum PathElem {
126    Field(Symbol),
127    Variant(Symbol),
128    CoroutineState(VariantIdx),
129    CapturedVar(Symbol),
130    ArrayElem(usize),
131    TupleElem(usize),
132    Deref,
133    EnumTag,
134    CoroutineTag,
135    DynDowncast,
136    Vtable,
137}
138
139/// Extra things to check for during validation of CTFE results.
140#[derive(Copy, Clone)]
141pub enum CtfeValidationMode {
142    /// Validation of a `static`
143    Static { mutbl: Mutability },
144    /// Validation of a promoted.
145    Promoted,
146    /// Validation of a `const`.
147    /// `allow_immutable_unsafe_cell` says whether we allow `UnsafeCell` in immutable memory (which is the
148    /// case for the top-level allocation of a `const`, where this is fine because the allocation will be
149    /// copied at each use site).
150    Const { allow_immutable_unsafe_cell: bool },
151}
152
153impl CtfeValidationMode {
154    fn allow_immutable_unsafe_cell(self) -> bool {
155        match self {
156            CtfeValidationMode::Static { .. } => false,
157            CtfeValidationMode::Promoted { .. } => false,
158            CtfeValidationMode::Const { allow_immutable_unsafe_cell, .. } => {
159                allow_immutable_unsafe_cell
160            }
161        }
162    }
163}
164
165/// State for tracking recursive validation of references
166pub struct RefTracking<T, PATH = ()> {
167    seen: FxHashSet<T>,
168    todo: Vec<(T, PATH)>,
169}
170
171impl<T: Clone + Eq + Hash + std::fmt::Debug, PATH: Default> RefTracking<T, PATH> {
172    pub fn empty() -> Self {
173        RefTracking { seen: FxHashSet::default(), todo: vec![] }
174    }
175    pub fn new(val: T) -> Self {
176        let mut ref_tracking_for_consts =
177            RefTracking { seen: FxHashSet::default(), todo: vec![(val.clone(), PATH::default())] };
178        ref_tracking_for_consts.seen.insert(val);
179        ref_tracking_for_consts
180    }
181    pub fn next(&mut self) -> Option<(T, PATH)> {
182        self.todo.pop()
183    }
184
185    fn track(&mut self, val: T, path: impl FnOnce() -> PATH) {
186        if self.seen.insert(val.clone()) {
187            trace!("Recursing below ptr {:#?}", val);
188            let path = path();
189            // Remember to come back to this later.
190            self.todo.push((val, path));
191        }
192    }
193}
194
195// FIXME make this translatable as well?
196/// Format a path
197fn write_path(out: &mut String, path: &[PathElem]) {
198    use self::PathElem::*;
199
200    for elem in path.iter() {
201        match elem {
202            Field(name) => write!(out, ".{name}"),
203            EnumTag => write!(out, ".<enum-tag>"),
204            Variant(name) => write!(out, ".<enum-variant({name})>"),
205            CoroutineTag => write!(out, ".<coroutine-tag>"),
206            CoroutineState(idx) => write!(out, ".<coroutine-state({})>", idx.index()),
207            CapturedVar(name) => write!(out, ".<captured-var({name})>"),
208            TupleElem(idx) => write!(out, ".{idx}"),
209            ArrayElem(idx) => write!(out, "[{idx}]"),
210            // `.<deref>` does not match Rust syntax, but it is more readable for long paths -- and
211            // some of the other items here also are not Rust syntax. Actually we can't
212            // even use the usual syntax because we are just showing the projections,
213            // not the root.
214            Deref => write!(out, ".<deref>"),
215            DynDowncast => write!(out, ".<dyn-downcast>"),
216            Vtable => write!(out, ".<vtable>"),
217        }
218        .unwrap()
219    }
220}
221
222/// Represents a set of `Size` values as a sorted list of ranges.
223// These are (offset, length) pairs, and they are sorted and mutually disjoint,
224// and never adjacent (i.e. there's always a gap between two of them).
225#[derive(Debug, Clone)]
226pub struct RangeSet(Vec<(Size, Size)>);
227
228impl RangeSet {
229    fn add_range(&mut self, offset: Size, size: Size) {
230        if size.bytes() == 0 {
231            // No need to track empty ranges.
232            return;
233        }
234        let v = &mut self.0;
235        // We scan for a partition point where the left partition is all the elements that end
236        // strictly before we start. Those are elements that are too "low" to merge with us.
237        let idx =
238            v.partition_point(|&(other_offset, other_size)| other_offset + other_size < offset);
239        // Now we want to either merge with the first element of the second partition, or insert ourselves before that.
240        if let Some(&(other_offset, other_size)) = v.get(idx)
241            && offset + size >= other_offset
242        {
243            // Their end is >= our start (otherwise it would not be in the 2nd partition) and
244            // our end is >= their start. This means we can merge the ranges.
245            let new_start = other_offset.min(offset);
246            let mut new_end = (other_offset + other_size).max(offset + size);
247            // We grew to the right, so merge with overlapping/adjacent elements.
248            // (We also may have grown to the left, but that can never make us adjacent with
249            // anything there since we selected the first such candidate via `partition_point`.)
250            let mut scan_right = 1;
251            while let Some(&(next_offset, next_size)) = v.get(idx + scan_right)
252                && new_end >= next_offset
253            {
254                // Increase our size to absorb the next element.
255                new_end = new_end.max(next_offset + next_size);
256                // Look at the next element.
257                scan_right += 1;
258            }
259            // Update the element we grew.
260            v[idx] = (new_start, new_end - new_start);
261            // Remove the elements we absorbed (if any).
262            if scan_right > 1 {
263                drop(v.drain((idx + 1)..(idx + scan_right)));
264            }
265        } else {
266            // Insert new element.
267            v.insert(idx, (offset, size));
268        }
269    }
270}
271
272struct ValidityVisitor<'rt, 'tcx, M: Machine<'tcx>> {
273    /// The `path` may be pushed to, but the part that is present when a function
274    /// starts must not be changed!  `visit_fields` and `visit_array` rely on
275    /// this stack discipline.
276    path: Vec<PathElem>,
277    ref_tracking: Option<&'rt mut RefTracking<MPlaceTy<'tcx, M::Provenance>, Vec<PathElem>>>,
278    /// `None` indicates this is not validating for CTFE (but for runtime).
279    ctfe_mode: Option<CtfeValidationMode>,
280    ecx: &'rt mut InterpCx<'tcx, M>,
281    /// Whether provenance should be reset outside of pointers (emulating the effect of a typed
282    /// copy).
283    reset_provenance_and_padding: bool,
284    /// This tracks which byte ranges in this value contain data; the remaining bytes are padding.
285    /// The ideal representation here would be pointer-length pairs, but to keep things more compact
286    /// we only store a (range) set of offsets -- the base pointer is the same throughout the entire
287    /// visit, after all.
288    /// If this is `Some`, then `reset_provenance_and_padding` must be true (but not vice versa:
289    /// we might not track data vs padding bytes if the operand isn't stored in memory anyway).
290    data_bytes: Option<RangeSet>,
291}
292
293impl<'rt, 'tcx, M: Machine<'tcx>> ValidityVisitor<'rt, 'tcx, M> {
294    fn aggregate_field_path_elem(&mut self, layout: TyAndLayout<'tcx>, field: usize) -> PathElem {
295        // First, check if we are projecting to a variant.
296        match layout.variants {
297            Variants::Multiple { tag_field, .. } => {
298                if tag_field.as_usize() == field {
299                    return match layout.ty.kind() {
300                        ty::Adt(def, ..) if def.is_enum() => PathElem::EnumTag,
301                        ty::Coroutine(..) => PathElem::CoroutineTag,
302                        _ => bug!("non-variant type {:?}", layout.ty),
303                    };
304                }
305            }
306            Variants::Single { .. } | Variants::Empty => {}
307        }
308
309        // Now we know we are projecting to a field, so figure out which one.
310        match layout.ty.kind() {
311            // coroutines, closures, and coroutine-closures all have upvars that may be named.
312            ty::Closure(def_id, _) | ty::Coroutine(def_id, _) | ty::CoroutineClosure(def_id, _) => {
313                let mut name = None;
314                // FIXME this should be more descriptive i.e. CapturePlace instead of CapturedVar
315                // https://github.com/rust-lang/project-rfc-2229/issues/46
316                if let Some(local_def_id) = def_id.as_local() {
317                    let captures = self.ecx.tcx.closure_captures(local_def_id);
318                    if let Some(captured_place) = captures.get(field) {
319                        // Sometimes the index is beyond the number of upvars (seen
320                        // for a coroutine).
321                        let var_hir_id = captured_place.get_root_variable();
322                        let node = self.ecx.tcx.hir_node(var_hir_id);
323                        if let hir::Node::Pat(pat) = node
324                            && let hir::PatKind::Binding(_, _, ident, _) = pat.kind
325                        {
326                            name = Some(ident.name);
327                        }
328                    }
329                }
330
331                PathElem::CapturedVar(name.unwrap_or_else(|| {
332                    // Fall back to showing the field index.
333                    sym::integer(field)
334                }))
335            }
336
337            // tuples
338            ty::Tuple(_) => PathElem::TupleElem(field),
339
340            // enums
341            ty::Adt(def, ..) if def.is_enum() => {
342                // we might be projecting *to* a variant, or to a field *in* a variant.
343                match layout.variants {
344                    Variants::Single { index } => {
345                        // Inside a variant
346                        PathElem::Field(def.variant(index).fields[FieldIdx::from_usize(field)].name)
347                    }
348                    Variants::Empty => panic!("there is no field in Variants::Empty types"),
349                    Variants::Multiple { .. } => bug!("we handled variants above"),
350                }
351            }
352
353            // other ADTs
354            ty::Adt(def, _) => {
355                PathElem::Field(def.non_enum_variant().fields[FieldIdx::from_usize(field)].name)
356            }
357
358            // arrays/slices
359            ty::Array(..) | ty::Slice(..) => PathElem::ArrayElem(field),
360
361            // dyn traits
362            ty::Dynamic(..) => {
363                assert_eq!(field, 0);
364                PathElem::DynDowncast
365            }
366
367            // nothing else has an aggregate layout
368            _ => bug!("aggregate_field_path_elem: got non-aggregate type {:?}", layout.ty),
369        }
370    }
371
372    fn with_elem<R>(
373        &mut self,
374        elem: PathElem,
375        f: impl FnOnce(&mut Self) -> InterpResult<'tcx, R>,
376    ) -> InterpResult<'tcx, R> {
377        // Remember the old state
378        let path_len = self.path.len();
379        // Record new element
380        self.path.push(elem);
381        // Perform operation
382        let r = f(self)?;
383        // Undo changes
384        self.path.truncate(path_len);
385        // Done
386        interp_ok(r)
387    }
388
389    fn read_immediate(
390        &self,
391        val: &PlaceTy<'tcx, M::Provenance>,
392        expected: ExpectedKind,
393    ) -> InterpResult<'tcx, ImmTy<'tcx, M::Provenance>> {
394        interp_ok(try_validation!(
395            self.ecx.read_immediate(val),
396            self.path,
397            Ub(InvalidUninitBytes(_)) =>
398                Uninit { expected },
399            // The `Unsup` cases can only occur during CTFE
400            Unsup(ReadPointerAsInt(_)) =>
401                PointerAsInt { expected },
402            Unsup(ReadPartialPointer(_)) =>
403                PartialPointer,
404        ))
405    }
406
407    fn read_scalar(
408        &self,
409        val: &PlaceTy<'tcx, M::Provenance>,
410        expected: ExpectedKind,
411    ) -> InterpResult<'tcx, Scalar<M::Provenance>> {
412        interp_ok(self.read_immediate(val, expected)?.to_scalar())
413    }
414
415    fn deref_pointer(
416        &mut self,
417        val: &PlaceTy<'tcx, M::Provenance>,
418        expected: ExpectedKind,
419    ) -> InterpResult<'tcx, MPlaceTy<'tcx, M::Provenance>> {
420        // Not using `ecx.deref_pointer` since we want to use our `read_immediate` wrapper.
421        let imm = self.read_immediate(val, expected)?;
422        // Reset provenance: ensure slice tail metadata does not preserve provenance,
423        // and ensure all pointers do not preserve partial provenance.
424        if self.reset_provenance_and_padding {
425            if matches!(imm.layout.backend_repr, BackendRepr::Scalar(..)) {
426                // A thin pointer. If it has provenance, we don't have to do anything.
427                // If it does not, ensure we clear the provenance in memory.
428                if matches!(imm.to_scalar(), Scalar::Int(..)) {
429                    self.ecx.clear_provenance(val)?;
430                }
431            } else {
432                // A wide pointer. This means we have to worry both about the pointer itself and the
433                // metadata. We do the lazy thing and just write back the value we got. Just
434                // clearing provenance in a targeted manner would be more efficient, but unless this
435                // is a perf hotspot it's just not worth the effort.
436                self.ecx.write_immediate_no_validate(*imm, val)?;
437            }
438            // The entire thing is data, not padding.
439            self.add_data_range_place(val);
440        }
441        // Now turn it into a place.
442        self.ecx.ref_to_mplace(&imm)
443    }
444
445    fn check_wide_ptr_meta(
446        &mut self,
447        meta: MemPlaceMeta<M::Provenance>,
448        pointee: TyAndLayout<'tcx>,
449    ) -> InterpResult<'tcx> {
450        let tail = self.ecx.tcx.struct_tail_for_codegen(pointee.ty, self.ecx.typing_env);
451        match tail.kind() {
452            ty::Dynamic(data, _) => {
453                let vtable = meta.unwrap_meta().to_pointer(self.ecx)?;
454                // Make sure it is a genuine vtable pointer for the right trait.
455                try_validation!(
456                    self.ecx.get_ptr_vtable_ty(vtable, Some(data)),
457                    self.path,
458                    Ub(DanglingIntPointer{ .. } | InvalidVTablePointer(..)) =>
459                        InvalidVTablePtr { value: format!("{vtable}") },
460                    Ub(InvalidVTableTrait { vtable_dyn_type, expected_dyn_type }) => {
461                        InvalidMetaWrongTrait { vtable_dyn_type, expected_dyn_type }
462                    },
463                );
464            }
465            ty::Slice(..) | ty::Str => {
466                let _len = meta.unwrap_meta().to_target_usize(self.ecx)?;
467                // We do not check that `len * elem_size <= isize::MAX`:
468                // that is only required for references, and there it falls out of the
469                // "dereferenceable" check performed by Stacked Borrows.
470            }
471            ty::Foreign(..) => {
472                // Unsized, but not wide.
473            }
474            _ => bug!("Unexpected unsized type tail: {:?}", tail),
475        }
476
477        interp_ok(())
478    }
479
480    /// Check a reference or `Box`.
481    fn check_safe_pointer(
482        &mut self,
483        value: &PlaceTy<'tcx, M::Provenance>,
484        ptr_kind: PointerKind,
485    ) -> InterpResult<'tcx> {
486        let place = self.deref_pointer(value, ptr_kind.into())?;
487        // Handle wide pointers.
488        // Check metadata early, for better diagnostics
489        if place.layout.is_unsized() {
490            self.check_wide_ptr_meta(place.meta(), place.layout)?;
491        }
492        // Make sure this is dereferenceable and all.
493        let size_and_align = try_validation!(
494            self.ecx.size_and_align_of_val(&place),
495            self.path,
496            Ub(InvalidMeta(msg)) => match msg {
497                InvalidMetaKind::SliceTooBig => InvalidMetaSliceTooLarge { ptr_kind },
498                InvalidMetaKind::TooBig => InvalidMetaTooLarge { ptr_kind },
499            }
500        );
501        let (size, align) = size_and_align
502            // for the purpose of validity, consider foreign types to have
503            // alignment and size determined by the layout (size will be 0,
504            // alignment should take attributes into account).
505            .unwrap_or_else(|| (place.layout.size, place.layout.align.abi));
506        // Direct call to `check_ptr_access_align` checks alignment even on CTFE machines.
507        try_validation!(
508            self.ecx.check_ptr_access(
509                place.ptr(),
510                size,
511                CheckInAllocMsg::Dereferenceable, // will anyway be replaced by validity message
512            ),
513            self.path,
514            Ub(DanglingIntPointer { addr: 0, .. }) => NullPtr { ptr_kind, maybe: false },
515            Ub(DanglingIntPointer { addr: i, .. }) => DanglingPtrNoProvenance {
516                ptr_kind,
517                // FIXME this says "null pointer" when null but we need translate
518                pointer: format!("{}", Pointer::<Option<AllocId>>::without_provenance(i))
519            },
520            Ub(PointerOutOfBounds { .. }) => DanglingPtrOutOfBounds {
521                ptr_kind
522            },
523            Ub(PointerUseAfterFree(..)) => DanglingPtrUseAfterFree {
524                ptr_kind,
525            },
526        );
527        try_validation!(
528            self.ecx.check_ptr_align(
529                place.ptr(),
530                align,
531            ),
532            self.path,
533            Ub(AlignmentCheckFailed(Misalignment { required, has }, _msg)) => UnalignedPtr {
534                ptr_kind,
535                required_bytes: required.bytes(),
536                found_bytes: has.bytes()
537            },
538        );
539        // Make sure this is non-null. We checked dereferenceability above, but if `size` is zero
540        // that does not imply non-null.
541        let scalar = Scalar::from_maybe_pointer(place.ptr(), self.ecx);
542        if self.ecx.scalar_may_be_null(scalar)? {
543            let maybe = !M::Provenance::OFFSET_IS_ADDR && matches!(scalar, Scalar::Ptr(..));
544            throw_validation_failure!(self.path, NullPtr { ptr_kind, maybe })
545        }
546        // Do not allow references to uninhabited types.
547        if place.layout.is_uninhabited() {
548            let ty = place.layout.ty;
549            throw_validation_failure!(self.path, PtrToUninhabited { ptr_kind, ty })
550        }
551        // Recursive checking
552        if let Some(ref_tracking) = self.ref_tracking.as_deref_mut() {
553            // Proceed recursively even for ZST, no reason to skip them!
554            // `!` is a ZST and we want to validate it.
555            if let Some(ctfe_mode) = self.ctfe_mode {
556                let mut skip_recursive_check = false;
557                // CTFE imposes restrictions on what references can point to.
558                if let Ok((alloc_id, _offset, _prov)) =
559                    self.ecx.ptr_try_get_alloc_id(place.ptr(), 0)
560                {
561                    // Everything should be already interned.
562                    let Some(global_alloc) = self.ecx.tcx.try_get_global_alloc(alloc_id) else {
563                        if self.ecx.memory.alloc_map.contains_key(&alloc_id) {
564                            // This can happen when interning didn't complete due to, e.g.
565                            // missing `make_global`. This must mean other errors are already
566                            // being reported.
567                            self.ecx.tcx.dcx().delayed_bug(
568                                "interning did not complete, there should be an error",
569                            );
570                            return interp_ok(());
571                        }
572                        // We can't have *any* references to non-existing allocations in const-eval
573                        // as the rest of rustc isn't happy with them... so we throw an error, even
574                        // though for zero-sized references this isn't really UB.
575                        // A potential future alternative would be to resurrect this as a zero-sized allocation
576                        // (which codegen will then compile to an aligned dummy pointer anyway).
577                        throw_validation_failure!(self.path, DanglingPtrUseAfterFree { ptr_kind });
578                    };
579                    let (size, _align) =
580                        global_alloc.size_and_align(*self.ecx.tcx, self.ecx.typing_env);
581                    let alloc_actual_mutbl =
582                        global_alloc.mutability(*self.ecx.tcx, self.ecx.typing_env);
583
584                    match global_alloc {
585                        GlobalAlloc::Static(did) => {
586                            let DefKind::Static { nested, .. } = self.ecx.tcx.def_kind(did) else {
587                                bug!()
588                            };
589                            assert!(!self.ecx.tcx.is_thread_local_static(did));
590                            assert!(self.ecx.tcx.is_static(did));
591                            match ctfe_mode {
592                                CtfeValidationMode::Static { .. }
593                                | CtfeValidationMode::Promoted { .. } => {
594                                    // We skip recursively checking other statics. These statics must be sound by
595                                    // themselves, and the only way to get broken statics here is by using
596                                    // unsafe code.
597                                    // The reasons we don't check other statics is twofold. For one, in all
598                                    // sound cases, the static was already validated on its own, and second, we
599                                    // trigger cycle errors if we try to compute the value of the other static
600                                    // and that static refers back to us (potentially through a promoted).
601                                    // This could miss some UB, but that's fine.
602                                    // We still walk nested allocations, as they are fundamentally part of this validation run.
603                                    // This means we will also recurse into nested statics of *other*
604                                    // statics, even though we do not recurse into other statics directly.
605                                    // That's somewhat inconsistent but harmless.
606                                    skip_recursive_check = !nested;
607                                }
608                                CtfeValidationMode::Const { .. } => {
609                                    // If this is mutable memory or an `extern static`, there's no point in checking it -- we'd
610                                    // just get errors trying to read the value.
611                                    if alloc_actual_mutbl.is_mut()
612                                        || self.ecx.tcx.is_foreign_item(did)
613                                    {
614                                        skip_recursive_check = true;
615                                    }
616                                }
617                            }
618                        }
619                        _ => (),
620                    }
621
622                    // If this allocation has size zero, there is no actual mutability here.
623                    if size != Size::ZERO {
624                        // Determine whether this pointer expects to be pointing to something mutable.
625                        let ptr_expected_mutbl = match ptr_kind {
626                            PointerKind::Box => Mutability::Mut,
627                            PointerKind::Ref(mutbl) => {
628                                // We do not take into account interior mutability here since we cannot know if
629                                // there really is an `UnsafeCell` inside `Option<UnsafeCell>` -- so we check
630                                // that in the recursive descent behind this reference (controlled by
631                                // `allow_immutable_unsafe_cell`).
632                                mutbl
633                            }
634                        };
635                        // Mutable pointer to immutable memory is no good.
636                        if ptr_expected_mutbl == Mutability::Mut
637                            && alloc_actual_mutbl == Mutability::Not
638                        {
639                            // This can actually occur with transmutes.
640                            throw_validation_failure!(self.path, MutableRefToImmutable);
641                        }
642                        // In a const, any kind of mutable reference is not good.
643                        if matches!(self.ctfe_mode, Some(CtfeValidationMode::Const { .. })) {
644                            if ptr_expected_mutbl == Mutability::Mut {
645                                throw_validation_failure!(self.path, MutableRefInConst);
646                            }
647                        }
648                    }
649                }
650                // Potentially skip recursive check.
651                if skip_recursive_check {
652                    return interp_ok(());
653                }
654            } else {
655                // This is not CTFE, so it's Miri with recursive checking.
656                // FIXME: we do *not* check behind boxes, since creating a new box first creates it uninitialized
657                // and then puts the value in there, so briefly we have a box with uninit contents.
658                // FIXME: should we also skip `UnsafeCell` behind shared references? Currently that is not
659                // needed since validation reads bypass Stacked Borrows and data race checks.
660                if matches!(ptr_kind, PointerKind::Box) {
661                    return interp_ok(());
662                }
663            }
664            let path = &self.path;
665            ref_tracking.track(place, || {
666                // We need to clone the path anyway, make sure it gets created
667                // with enough space for the additional `Deref`.
668                let mut new_path = Vec::with_capacity(path.len() + 1);
669                new_path.extend(path);
670                new_path.push(PathElem::Deref);
671                new_path
672            });
673        }
674        interp_ok(())
675    }
676
677    /// Check if this is a value of primitive type, and if yes check the validity of the value
678    /// at that type. Return `true` if the type is indeed primitive.
679    ///
680    /// Note that not all of these have `FieldsShape::Primitive`, e.g. wide references.
681    fn try_visit_primitive(
682        &mut self,
683        value: &PlaceTy<'tcx, M::Provenance>,
684    ) -> InterpResult<'tcx, bool> {
685        // Go over all the primitive types
686        let ty = value.layout.ty;
687        match ty.kind() {
688            ty::Bool => {
689                let scalar = self.read_scalar(value, ExpectedKind::Bool)?;
690                try_validation!(
691                    scalar.to_bool(),
692                    self.path,
693                    Ub(InvalidBool(..)) => ValidationErrorKind::InvalidBool {
694                        value: format!("{scalar:x}"),
695                    }
696                );
697                if self.reset_provenance_and_padding {
698                    self.ecx.clear_provenance(value)?;
699                    self.add_data_range_place(value);
700                }
701                interp_ok(true)
702            }
703            ty::Char => {
704                let scalar = self.read_scalar(value, ExpectedKind::Char)?;
705                try_validation!(
706                    scalar.to_char(),
707                    self.path,
708                    Ub(InvalidChar(..)) => ValidationErrorKind::InvalidChar {
709                        value: format!("{scalar:x}"),
710                    }
711                );
712                if self.reset_provenance_and_padding {
713                    self.ecx.clear_provenance(value)?;
714                    self.add_data_range_place(value);
715                }
716                interp_ok(true)
717            }
718            ty::Float(_) | ty::Int(_) | ty::Uint(_) => {
719                // NOTE: Keep this in sync with the array optimization for int/float
720                // types below!
721                self.read_scalar(
722                    value,
723                    if matches!(ty.kind(), ty::Float(..)) {
724                        ExpectedKind::Float
725                    } else {
726                        ExpectedKind::Int
727                    },
728                )?;
729                if self.reset_provenance_and_padding {
730                    self.ecx.clear_provenance(value)?;
731                    self.add_data_range_place(value);
732                }
733                interp_ok(true)
734            }
735            ty::RawPtr(..) => {
736                let place = self.deref_pointer(value, ExpectedKind::RawPtr)?;
737                if place.layout.is_unsized() {
738                    self.check_wide_ptr_meta(place.meta(), place.layout)?;
739                }
740                interp_ok(true)
741            }
742            ty::Ref(_, _ty, mutbl) => {
743                self.check_safe_pointer(value, PointerKind::Ref(*mutbl))?;
744                interp_ok(true)
745            }
746            ty::FnPtr(..) => {
747                let scalar = self.read_scalar(value, ExpectedKind::FnPtr)?;
748
749                // If we check references recursively, also check that this points to a function.
750                if let Some(_) = self.ref_tracking {
751                    let ptr = scalar.to_pointer(self.ecx)?;
752                    let _fn = try_validation!(
753                        self.ecx.get_ptr_fn(ptr),
754                        self.path,
755                        Ub(DanglingIntPointer{ .. } | InvalidFunctionPointer(..)) =>
756                            InvalidFnPtr { value: format!("{ptr}") },
757                    );
758                    // FIXME: Check if the signature matches
759                } else {
760                    // Otherwise (for standalone Miri and for `-Zextra-const-ub-checks`),
761                    // we have to still check it to be non-null.
762                    if self.ecx.scalar_may_be_null(scalar)? {
763                        let maybe =
764                            !M::Provenance::OFFSET_IS_ADDR && matches!(scalar, Scalar::Ptr(..));
765                        throw_validation_failure!(self.path, NullFnPtr { maybe });
766                    }
767                }
768                if self.reset_provenance_and_padding {
769                    // Make sure we do not preserve partial provenance. This matches the thin
770                    // pointer handling in `deref_pointer`.
771                    if matches!(scalar, Scalar::Int(..)) {
772                        self.ecx.clear_provenance(value)?;
773                    }
774                    self.add_data_range_place(value);
775                }
776                interp_ok(true)
777            }
778            ty::Never => throw_validation_failure!(self.path, NeverVal),
779            ty::Foreign(..) | ty::FnDef(..) => {
780                // Nothing to check.
781                interp_ok(true)
782            }
783            ty::UnsafeBinder(_) => todo!("FIXME(unsafe_binder)"),
784            // The above should be all the primitive types. The rest is compound, we
785            // check them by visiting their fields/variants.
786            ty::Adt(..)
787            | ty::Tuple(..)
788            | ty::Array(..)
789            | ty::Slice(..)
790            | ty::Str
791            | ty::Dynamic(..)
792            | ty::Closure(..)
793            | ty::Pat(..)
794            | ty::CoroutineClosure(..)
795            | ty::Coroutine(..) => interp_ok(false),
796            // Some types only occur during typechecking, they have no layout.
797            // We should not see them here and we could not check them anyway.
798            ty::Error(_)
799            | ty::Infer(..)
800            | ty::Placeholder(..)
801            | ty::Bound(..)
802            | ty::Param(..)
803            | ty::Alias(..)
804            | ty::CoroutineWitness(..) => bug!("Encountered invalid type {:?}", ty),
805        }
806    }
807
808    fn visit_scalar(
809        &mut self,
810        scalar: Scalar<M::Provenance>,
811        scalar_layout: ScalarAbi,
812    ) -> InterpResult<'tcx> {
813        let size = scalar_layout.size(self.ecx);
814        let valid_range = scalar_layout.valid_range(self.ecx);
815        let WrappingRange { start, end } = valid_range;
816        let max_value = size.unsigned_int_max();
817        assert!(end <= max_value);
818        let bits = match scalar.try_to_scalar_int() {
819            Ok(int) => int.to_bits(size),
820            Err(_) => {
821                // So this is a pointer then, and casting to an int failed.
822                // Can only happen during CTFE.
823                // We support 2 kinds of ranges here: full range, and excluding zero.
824                if start == 1 && end == max_value {
825                    // Only null is the niche. So make sure the ptr is NOT null.
826                    if self.ecx.scalar_may_be_null(scalar)? {
827                        throw_validation_failure!(self.path, NonnullPtrMaybeNull)
828                    } else {
829                        return interp_ok(());
830                    }
831                } else if scalar_layout.is_always_valid(self.ecx) {
832                    // Easy. (This is reachable if `enforce_number_validity` is set.)
833                    return interp_ok(());
834                } else {
835                    // Conservatively, we reject, because the pointer *could* have a bad
836                    // value.
837                    throw_validation_failure!(
838                        self.path,
839                        PtrOutOfRange { range: valid_range, max_value }
840                    )
841                }
842            }
843        };
844        // Now compare.
845        if valid_range.contains(bits) {
846            interp_ok(())
847        } else {
848            throw_validation_failure!(
849                self.path,
850                OutOfRange { value: format!("{bits}"), range: valid_range, max_value }
851            )
852        }
853    }
854
855    fn in_mutable_memory(&self, val: &PlaceTy<'tcx, M::Provenance>) -> bool {
856        debug_assert!(self.ctfe_mode.is_some());
857        if let Some(mplace) = val.as_mplace_or_local().left() {
858            if let Some(alloc_id) = mplace.ptr().provenance.and_then(|p| p.get_alloc_id()) {
859                let tcx = *self.ecx.tcx;
860                // Everything must be already interned.
861                let mutbl = tcx.global_alloc(alloc_id).mutability(tcx, self.ecx.typing_env);
862                if let Some((_, alloc)) = self.ecx.memory.alloc_map.get(alloc_id) {
863                    assert_eq!(alloc.mutability, mutbl);
864                }
865                mutbl.is_mut()
866            } else {
867                // No memory at all.
868                false
869            }
870        } else {
871            // A local variable -- definitely mutable.
872            true
873        }
874    }
875
876    /// Add the given pointer-length pair to the "data" range of this visit.
877    fn add_data_range(&mut self, ptr: Pointer<Option<M::Provenance>>, size: Size) {
878        if let Some(data_bytes) = self.data_bytes.as_mut() {
879            // We only have to store the offset, the rest is the same for all pointers here.
880            // The logic is agnostic to whether the offset is relative or absolute as long as
881            // it is consistent.
882            let (_prov, offset) = ptr.into_raw_parts();
883            // Add this.
884            data_bytes.add_range(offset, size);
885        };
886    }
887
888    /// Add the entire given place to the "data" range of this visit.
889    fn add_data_range_place(&mut self, place: &PlaceTy<'tcx, M::Provenance>) {
890        // Only sized places can be added this way.
891        debug_assert!(place.layout.is_sized());
892        if let Some(data_bytes) = self.data_bytes.as_mut() {
893            let offset = Self::data_range_offset(self.ecx, place);
894            data_bytes.add_range(offset, place.layout.size);
895        }
896    }
897
898    /// Convert a place into the offset it starts at, for the purpose of data_range tracking.
899    /// Must only be called if `data_bytes` is `Some(_)`.
900    fn data_range_offset(ecx: &InterpCx<'tcx, M>, place: &PlaceTy<'tcx, M::Provenance>) -> Size {
901        // The presence of `data_bytes` implies that our place is in memory.
902        let ptr = ecx
903            .place_to_op(place)
904            .expect("place must be in memory")
905            .as_mplace_or_imm()
906            .expect_left("place must be in memory")
907            .ptr();
908        let (_prov, offset) = ptr.into_raw_parts();
909        offset
910    }
911
912    fn reset_padding(&mut self, place: &PlaceTy<'tcx, M::Provenance>) -> InterpResult<'tcx> {
913        let Some(data_bytes) = self.data_bytes.as_mut() else { return interp_ok(()) };
914        // Our value must be in memory, otherwise we would not have set up `data_bytes`.
915        let mplace = self.ecx.force_allocation(place)?;
916        // Determine starting offset and size.
917        let (_prov, start_offset) = mplace.ptr().into_raw_parts();
918        let (size, _align) = self
919            .ecx
920            .size_and_align_of_val(&mplace)?
921            .unwrap_or((mplace.layout.size, mplace.layout.align.abi));
922        // If there is no padding at all, we can skip the rest: check for
923        // a single data range covering the entire value.
924        if data_bytes.0 == &[(start_offset, size)] {
925            return interp_ok(());
926        }
927        // Get a handle for the allocation. Do this only once, to avoid looking up the same
928        // allocation over and over again. (Though to be fair, iterating the value already does
929        // exactly that.)
930        let Some(mut alloc) = self.ecx.get_ptr_alloc_mut(mplace.ptr(), size)? else {
931            // A ZST, no padding to clear.
932            return interp_ok(());
933        };
934        // Add a "finalizer" data range at the end, so that the iteration below finds all gaps
935        // between ranges.
936        data_bytes.0.push((start_offset + size, Size::ZERO));
937        // Iterate, and reset gaps.
938        let mut padding_cleared_until = start_offset;
939        for &(offset, size) in data_bytes.0.iter() {
940            assert!(
941                offset >= padding_cleared_until,
942                "reset_padding on {}: previous field ended at offset {}, next field starts at {} (and has a size of {} bytes)",
943                mplace.layout.ty,
944                (padding_cleared_until - start_offset).bytes(),
945                (offset - start_offset).bytes(),
946                size.bytes(),
947            );
948            if offset > padding_cleared_until {
949                // We found padding. Adjust the range to be relative to `alloc`, and make it uninit.
950                let padding_start = padding_cleared_until - start_offset;
951                let padding_size = offset - padding_cleared_until;
952                let range = alloc_range(padding_start, padding_size);
953                trace!("reset_padding on {}: resetting padding range {range:?}", mplace.layout.ty);
954                alloc.write_uninit(range);
955            }
956            padding_cleared_until = offset + size;
957        }
958        assert!(padding_cleared_until == start_offset + size);
959        interp_ok(())
960    }
961
962    /// Computes the data range of this union type:
963    /// which bytes are inside a field (i.e., not padding.)
964    fn union_data_range<'e>(
965        ecx: &'e mut InterpCx<'tcx, M>,
966        layout: TyAndLayout<'tcx>,
967    ) -> Cow<'e, RangeSet> {
968        assert!(layout.ty.is_union());
969        assert!(layout.is_sized(), "there are no unsized unions");
970        let layout_cx = LayoutCx::new(*ecx.tcx, ecx.typing_env);
971        return M::cached_union_data_range(ecx, layout.ty, || {
972            let mut out = RangeSet(Vec::new());
973            union_data_range_uncached(&layout_cx, layout, Size::ZERO, &mut out);
974            out
975        });
976
977        /// Helper for recursive traversal: add data ranges of the given type to `out`.
978        fn union_data_range_uncached<'tcx>(
979            cx: &LayoutCx<'tcx>,
980            layout: TyAndLayout<'tcx>,
981            base_offset: Size,
982            out: &mut RangeSet,
983        ) {
984            // If this is a ZST, we don't contain any data. In particular, this helps us to quickly
985            // skip over huge arrays of ZST.
986            if layout.is_zst() {
987                return;
988            }
989            // Just recursively add all the fields of everything to the output.
990            match &layout.fields {
991                FieldsShape::Primitive => {
992                    out.add_range(base_offset, layout.size);
993                }
994                &FieldsShape::Union(fields) => {
995                    // Currently, all fields start at offset 0 (relative to `base_offset`).
996                    for field in 0..fields.get() {
997                        let field = layout.field(cx, field);
998                        union_data_range_uncached(cx, field, base_offset, out);
999                    }
1000                }
1001                &FieldsShape::Array { stride, count } => {
1002                    let elem = layout.field(cx, 0);
1003
1004                    // Fast-path for large arrays of simple types that do not contain any padding.
1005                    if elem.backend_repr.is_scalar() {
1006                        out.add_range(base_offset, elem.size * count);
1007                    } else {
1008                        for idx in 0..count {
1009                            // This repeats the same computation for every array element... but the alternative
1010                            // is to allocate temporary storage for a dedicated `out` set for the array element,
1011                            // and replicating that N times. Is that better?
1012                            union_data_range_uncached(cx, elem, base_offset + idx * stride, out);
1013                        }
1014                    }
1015                }
1016                FieldsShape::Arbitrary { offsets, .. } => {
1017                    for (field, &offset) in offsets.iter_enumerated() {
1018                        let field = layout.field(cx, field.as_usize());
1019                        union_data_range_uncached(cx, field, base_offset + offset, out);
1020                    }
1021                }
1022            }
1023            // Don't forget potential other variants.
1024            match &layout.variants {
1025                Variants::Single { .. } | Variants::Empty => {
1026                    // Fully handled above.
1027                }
1028                Variants::Multiple { variants, .. } => {
1029                    for variant in variants.indices() {
1030                        let variant = layout.for_variant(cx, variant);
1031                        union_data_range_uncached(cx, variant, base_offset, out);
1032                    }
1033                }
1034            }
1035        }
1036    }
1037}
1038
1039impl<'rt, 'tcx, M: Machine<'tcx>> ValueVisitor<'tcx, M> for ValidityVisitor<'rt, 'tcx, M> {
1040    type V = PlaceTy<'tcx, M::Provenance>;
1041
1042    #[inline(always)]
1043    fn ecx(&self) -> &InterpCx<'tcx, M> {
1044        self.ecx
1045    }
1046
1047    fn read_discriminant(
1048        &mut self,
1049        val: &PlaceTy<'tcx, M::Provenance>,
1050    ) -> InterpResult<'tcx, VariantIdx> {
1051        self.with_elem(PathElem::EnumTag, move |this| {
1052            interp_ok(try_validation!(
1053                this.ecx.read_discriminant(val),
1054                this.path,
1055                Ub(InvalidTag(val)) => InvalidEnumTag {
1056                    value: format!("{val:x}"),
1057                },
1058                Ub(UninhabitedEnumVariantRead(_)) => UninhabitedEnumVariant,
1059                // Uninit / bad provenance are not possible since the field was already previously
1060                // checked at its integer type.
1061            ))
1062        })
1063    }
1064
1065    #[inline]
1066    fn visit_field(
1067        &mut self,
1068        old_val: &PlaceTy<'tcx, M::Provenance>,
1069        field: usize,
1070        new_val: &PlaceTy<'tcx, M::Provenance>,
1071    ) -> InterpResult<'tcx> {
1072        let elem = self.aggregate_field_path_elem(old_val.layout, field);
1073        self.with_elem(elem, move |this| this.visit_value(new_val))
1074    }
1075
1076    #[inline]
1077    fn visit_variant(
1078        &mut self,
1079        old_val: &PlaceTy<'tcx, M::Provenance>,
1080        variant_id: VariantIdx,
1081        new_val: &PlaceTy<'tcx, M::Provenance>,
1082    ) -> InterpResult<'tcx> {
1083        let name = match old_val.layout.ty.kind() {
1084            ty::Adt(adt, _) => PathElem::Variant(adt.variant(variant_id).name),
1085            // Coroutines also have variants
1086            ty::Coroutine(..) => PathElem::CoroutineState(variant_id),
1087            _ => bug!("Unexpected type with variant: {:?}", old_val.layout.ty),
1088        };
1089        self.with_elem(name, move |this| this.visit_value(new_val))
1090    }
1091
1092    #[inline(always)]
1093    fn visit_union(
1094        &mut self,
1095        val: &PlaceTy<'tcx, M::Provenance>,
1096        _fields: NonZero<usize>,
1097    ) -> InterpResult<'tcx> {
1098        // Special check for CTFE validation, preventing `UnsafeCell` inside unions in immutable memory.
1099        if self.ctfe_mode.is_some_and(|c| !c.allow_immutable_unsafe_cell()) {
1100            // Unsized unions are currently not a thing, but let's keep this code consistent with
1101            // the check in `visit_value`.
1102            let zst = self.ecx.size_and_align_of_val(val)?.is_some_and(|(s, _a)| s.bytes() == 0);
1103            if !zst && !val.layout.ty.is_freeze(*self.ecx.tcx, self.ecx.typing_env) {
1104                if !self.in_mutable_memory(val) {
1105                    throw_validation_failure!(self.path, UnsafeCellInImmutable);
1106                }
1107            }
1108        }
1109        if self.reset_provenance_and_padding
1110            && let Some(data_bytes) = self.data_bytes.as_mut()
1111        {
1112            let base_offset = Self::data_range_offset(self.ecx, val);
1113            // Determine and add data range for this union.
1114            let union_data_range = Self::union_data_range(self.ecx, val.layout);
1115            for &(offset, size) in union_data_range.0.iter() {
1116                data_bytes.add_range(base_offset + offset, size);
1117            }
1118        }
1119        interp_ok(())
1120    }
1121
1122    #[inline]
1123    fn visit_box(
1124        &mut self,
1125        _box_ty: Ty<'tcx>,
1126        val: &PlaceTy<'tcx, M::Provenance>,
1127    ) -> InterpResult<'tcx> {
1128        self.check_safe_pointer(val, PointerKind::Box)?;
1129        interp_ok(())
1130    }
1131
1132    #[inline]
1133    fn visit_value(&mut self, val: &PlaceTy<'tcx, M::Provenance>) -> InterpResult<'tcx> {
1134        trace!("visit_value: {:?}, {:?}", *val, val.layout);
1135
1136        // Check primitive types -- the leaves of our recursive descent.
1137        // This is called even for enum discriminants (which are "fields" of their enum),
1138        // so for integer-typed discriminants the provenance reset will happen here.
1139        // We assume that the Scalar validity range does not restrict these values
1140        // any further than `try_visit_primitive` does!
1141        if self.try_visit_primitive(val)? {
1142            return interp_ok(());
1143        }
1144
1145        // Special check preventing `UnsafeCell` in the inner part of constants
1146        if self.ctfe_mode.is_some_and(|c| !c.allow_immutable_unsafe_cell()) {
1147            // Exclude ZST values. We need to compute the dynamic size/align to properly
1148            // handle slices and trait objects.
1149            let zst = self.ecx.size_and_align_of_val(val)?.is_some_and(|(s, _a)| s.bytes() == 0);
1150            if !zst
1151                && let Some(def) = val.layout.ty.ty_adt_def()
1152                && def.is_unsafe_cell()
1153            {
1154                if !self.in_mutable_memory(val) {
1155                    throw_validation_failure!(self.path, UnsafeCellInImmutable);
1156                }
1157            }
1158        }
1159
1160        // Recursively walk the value at its type. Apply optimizations for some large types.
1161        match val.layout.ty.kind() {
1162            ty::Str => {
1163                let mplace = val.assert_mem_place(); // strings are unsized and hence never immediate
1164                let len = mplace.len(self.ecx)?;
1165                try_validation!(
1166                    self.ecx.read_bytes_ptr_strip_provenance(mplace.ptr(), Size::from_bytes(len)),
1167                    self.path,
1168                    Ub(InvalidUninitBytes(..)) => Uninit { expected: ExpectedKind::Str },
1169                    Unsup(ReadPointerAsInt(_)) => PointerAsInt { expected: ExpectedKind::Str }
1170                );
1171            }
1172            ty::Array(tys, ..) | ty::Slice(tys)
1173                // This optimization applies for types that can hold arbitrary non-provenance bytes (such as
1174                // integer and floating point types).
1175                // FIXME(wesleywiser) This logic could be extended further to arbitrary structs or
1176                // tuples made up of integer/floating point types or inhabited ZSTs with no padding.
1177                if matches!(tys.kind(), ty::Int(..) | ty::Uint(..) | ty::Float(..))
1178                =>
1179            {
1180                let expected = if tys.is_integral() { ExpectedKind::Int } else { ExpectedKind::Float };
1181                // Optimized handling for arrays of integer/float type.
1182
1183                // This is the length of the array/slice.
1184                let len = val.len(self.ecx)?;
1185                // This is the element type size.
1186                let layout = self.ecx.layout_of(*tys)?;
1187                // This is the size in bytes of the whole array. (This checks for overflow.)
1188                let size = layout.size * len;
1189                // If the size is 0, there is nothing to check.
1190                // (`size` can only be 0 if `len` is 0, and empty arrays are always valid.)
1191                if size == Size::ZERO {
1192                    return interp_ok(());
1193                }
1194                // Now that we definitely have a non-ZST array, we know it lives in memory -- except it may
1195                // be an uninitialized local variable, those are also "immediate".
1196                let mplace = match val.to_op(self.ecx)?.as_mplace_or_imm() {
1197                    Left(mplace) => mplace,
1198                    Right(imm) => match *imm {
1199                        Immediate::Uninit =>
1200                            throw_validation_failure!(self.path, Uninit { expected }),
1201                        Immediate::Scalar(..) | Immediate::ScalarPair(..) =>
1202                            bug!("arrays/slices can never have Scalar/ScalarPair layout"),
1203                    }
1204                };
1205
1206                // Optimization: we just check the entire range at once.
1207                // NOTE: Keep this in sync with the handling of integer and float
1208                // types above, in `visit_primitive`.
1209                // No need for an alignment check here, this is not an actual memory access.
1210                let alloc = self.ecx.get_ptr_alloc(mplace.ptr(), size)?.expect("we already excluded size 0");
1211
1212                alloc.get_bytes_strip_provenance().map_err_kind(|kind| {
1213                    // Some error happened, try to provide a more detailed description.
1214                    // For some errors we might be able to provide extra information.
1215                    // (This custom logic does not fit the `try_validation!` macro.)
1216                    match kind {
1217                        Ub(InvalidUninitBytes(Some((_alloc_id, access)))) | Unsup(ReadPointerAsInt(Some((_alloc_id, access)))) => {
1218                            // Some byte was uninitialized, determine which
1219                            // element that byte belongs to so we can
1220                            // provide an index.
1221                            let i = usize::try_from(
1222                                access.bad.start.bytes() / layout.size.bytes(),
1223                            )
1224                            .unwrap();
1225                            self.path.push(PathElem::ArrayElem(i));
1226
1227                            if matches!(kind, Ub(InvalidUninitBytes(_))) {
1228                                err_validation_failure!(self.path, Uninit { expected })
1229                            } else {
1230                                err_validation_failure!(self.path, PointerAsInt { expected })
1231                            }
1232                        }
1233
1234                        // Propagate upwards (that will also check for unexpected errors).
1235                        err => err,
1236                    }
1237                })?;
1238
1239                // Don't forget that these are all non-pointer types, and thus do not preserve
1240                // provenance.
1241                if self.reset_provenance_and_padding {
1242                    // We can't share this with above as above, we might be looking at read-only memory.
1243                    let mut alloc = self.ecx.get_ptr_alloc_mut(mplace.ptr(), size)?.expect("we already excluded size 0");
1244                    alloc.clear_provenance();
1245                    // Also, mark this as containing data, not padding.
1246                    self.add_data_range(mplace.ptr(), size);
1247                }
1248            }
1249            // Fast path for arrays and slices of ZSTs. We only need to check a single ZST element
1250            // of an array and not all of them, because there's only a single value of a specific
1251            // ZST type, so either validation fails for all elements or none.
1252            ty::Array(tys, ..) | ty::Slice(tys) if self.ecx.layout_of(*tys)?.is_zst() => {
1253                // Validate just the first element (if any).
1254                if val.len(self.ecx)? > 0 {
1255                    self.visit_field(val, 0, &self.ecx.project_index(val, 0)?)?;
1256                }
1257            }
1258            ty::Pat(base, pat) => {
1259                // First check that the base type is valid
1260                self.visit_value(&val.transmute(self.ecx.layout_of(*base)?, self.ecx)?)?;
1261                // When you extend this match, make sure to also add tests to
1262                // tests/ui/type/pattern_types/validity.rs((
1263                match **pat {
1264                    // Range patterns are precisely reflected into `valid_range` and thus
1265                    // handled fully by `visit_scalar` (called below).
1266                    ty::PatternKind::Range { .. } => {},
1267
1268                    // FIXME(pattern_types): check that the value is covered by one of the variants.
1269                    // For now, we rely on layout computation setting the scalar's `valid_range` to
1270                    // match the pattern. However, this cannot always work; the layout may
1271                    // pessimistically cover actually illegal ranges and Miri would miss that UB.
1272                    // The consolation here is that codegen also will miss that UB, so at least
1273                    // we won't see optimizations actually breaking such programs.
1274                    ty::PatternKind::Or(_patterns) => {}
1275                }
1276            }
1277            _ => {
1278                // default handler
1279                try_validation!(
1280                    self.walk_value(val),
1281                    self.path,
1282                    // It's not great to catch errors here, since we can't give a very good path,
1283                    // but it's better than ICEing.
1284                    Ub(InvalidVTableTrait { vtable_dyn_type, expected_dyn_type }) => {
1285                        InvalidMetaWrongTrait { vtable_dyn_type, expected_dyn_type }
1286                    },
1287                );
1288            }
1289        }
1290
1291        // *After* all of this, check further information stored in the layout. We need to check
1292        // this to handle types like `NonNull` where the `Scalar` info is more restrictive than what
1293        // the fields say (`rustc_layout_scalar_valid_range_start`). But in most cases, this will
1294        // just propagate what the fields say, and then we want the error to point at the field --
1295        // so, we first recurse, then we do this check.
1296        //
1297        // FIXME: We could avoid some redundant checks here. For newtypes wrapping
1298        // scalars, we do the same check on every "level" (e.g., first we check
1299        // MyNewtype and then the scalar in there).
1300        if val.layout.is_uninhabited() {
1301            let ty = val.layout.ty;
1302            throw_validation_failure!(self.path, UninhabitedVal { ty });
1303        }
1304        match val.layout.backend_repr {
1305            BackendRepr::Scalar(scalar_layout) => {
1306                if !scalar_layout.is_uninit_valid() {
1307                    // There is something to check here.
1308                    let scalar = self.read_scalar(val, ExpectedKind::InitScalar)?;
1309                    self.visit_scalar(scalar, scalar_layout)?;
1310                }
1311            }
1312            BackendRepr::ScalarPair(a_layout, b_layout) => {
1313                // We can only proceed if *both* scalars need to be initialized.
1314                // FIXME: find a way to also check ScalarPair when one side can be uninit but
1315                // the other must be init.
1316                if !a_layout.is_uninit_valid() && !b_layout.is_uninit_valid() {
1317                    let (a, b) =
1318                        self.read_immediate(val, ExpectedKind::InitScalar)?.to_scalar_pair();
1319                    self.visit_scalar(a, a_layout)?;
1320                    self.visit_scalar(b, b_layout)?;
1321                }
1322            }
1323            BackendRepr::SimdVector { .. } => {
1324                // No checks here, we assume layout computation gets this right.
1325                // (This is harder to check since Miri does not represent these as `Immediate`. We
1326                // also cannot use field projections since this might be a newtype around a vector.)
1327            }
1328            BackendRepr::Memory { .. } => {
1329                // Nothing to do.
1330            }
1331        }
1332
1333        interp_ok(())
1334    }
1335}
1336
1337impl<'tcx, M: Machine<'tcx>> InterpCx<'tcx, M> {
1338    fn validate_operand_internal(
1339        &mut self,
1340        val: &PlaceTy<'tcx, M::Provenance>,
1341        path: Vec<PathElem>,
1342        ref_tracking: Option<&mut RefTracking<MPlaceTy<'tcx, M::Provenance>, Vec<PathElem>>>,
1343        ctfe_mode: Option<CtfeValidationMode>,
1344        reset_provenance_and_padding: bool,
1345    ) -> InterpResult<'tcx> {
1346        trace!("validate_operand_internal: {:?}, {:?}", *val, val.layout.ty);
1347
1348        // Run the visitor.
1349        self.run_for_validation_mut(|ecx| {
1350            let reset_padding = reset_provenance_and_padding && {
1351                // Check if `val` is actually stored in memory. If not, padding is not even
1352                // represented and we need not reset it.
1353                ecx.place_to_op(val)?.as_mplace_or_imm().is_left()
1354            };
1355            let mut v = ValidityVisitor {
1356                path,
1357                ref_tracking,
1358                ctfe_mode,
1359                ecx,
1360                reset_provenance_and_padding,
1361                data_bytes: reset_padding.then_some(RangeSet(Vec::new())),
1362            };
1363            v.visit_value(val)?;
1364            v.reset_padding(val)?;
1365            interp_ok(())
1366        })
1367        .map_err_info(|err| {
1368            if !matches!(
1369                err.kind(),
1370                err_ub!(ValidationError { .. })
1371                    | InterpErrorKind::InvalidProgram(_)
1372                    | InterpErrorKind::Unsupported(UnsupportedOpInfo::ExternTypeField)
1373            ) {
1374                bug!(
1375                    "Unexpected error during validation: {}",
1376                    format_interp_error(self.tcx.dcx(), err)
1377                );
1378            }
1379            err
1380        })
1381    }
1382
1383    /// This function checks the data at `val` to be const-valid.
1384    /// `val` is assumed to cover valid memory if it is an indirect operand.
1385    /// It will error if the bits at the destination do not match the ones described by the layout.
1386    ///
1387    /// `ref_tracking` is used to record references that we encounter so that they
1388    /// can be checked recursively by an outside driving loop.
1389    ///
1390    /// `constant` controls whether this must satisfy the rules for constants:
1391    /// - no pointers to statics.
1392    /// - no `UnsafeCell` or non-ZST `&mut`.
1393    #[inline(always)]
1394    pub(crate) fn const_validate_operand(
1395        &mut self,
1396        val: &PlaceTy<'tcx, M::Provenance>,
1397        path: Vec<PathElem>,
1398        ref_tracking: &mut RefTracking<MPlaceTy<'tcx, M::Provenance>, Vec<PathElem>>,
1399        ctfe_mode: CtfeValidationMode,
1400    ) -> InterpResult<'tcx> {
1401        self.validate_operand_internal(
1402            val,
1403            path,
1404            Some(ref_tracking),
1405            Some(ctfe_mode),
1406            /*reset_provenance*/ false,
1407        )
1408    }
1409
1410    /// This function checks the data at `val` to be runtime-valid.
1411    /// `val` is assumed to cover valid memory if it is an indirect operand.
1412    /// It will error if the bits at the destination do not match the ones described by the layout.
1413    #[inline(always)]
1414    pub fn validate_operand(
1415        &mut self,
1416        val: &PlaceTy<'tcx, M::Provenance>,
1417        recursive: bool,
1418        reset_provenance_and_padding: bool,
1419    ) -> InterpResult<'tcx> {
1420        let _trace = enter_trace_span!(
1421            M,
1422            "validate_operand",
1423            recursive,
1424            reset_provenance_and_padding,
1425            ?val,
1426        );
1427
1428        // Note that we *could* actually be in CTFE here with `-Zextra-const-ub-checks`, but it's
1429        // still correct to not use `ctfe_mode`: that mode is for validation of the final constant
1430        // value, it rules out things like `UnsafeCell` in awkward places.
1431        if !recursive {
1432            return self.validate_operand_internal(
1433                val,
1434                vec![],
1435                None,
1436                None,
1437                reset_provenance_and_padding,
1438            );
1439        }
1440        // Do a recursive check.
1441        let mut ref_tracking = RefTracking::empty();
1442        self.validate_operand_internal(
1443            val,
1444            vec![],
1445            Some(&mut ref_tracking),
1446            None,
1447            reset_provenance_and_padding,
1448        )?;
1449        while let Some((mplace, path)) = ref_tracking.todo.pop() {
1450            // Things behind reference do *not* have the provenance reset.
1451            self.validate_operand_internal(
1452                &mplace.into(),
1453                path,
1454                Some(&mut ref_tracking),
1455                None,
1456                /*reset_provenance_and_padding*/ false,
1457            )?;
1458        }
1459        interp_ok(())
1460    }
1461}