1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
//! A lint that checks for known panics like
//! overflows, division by zero,
//! out-of-bound access etc.
//! Uses const propagation to determine the
//! values of operands during checks.

use std::fmt::Debug;

use rustc_const_eval::const_eval::DummyMachine;
use rustc_const_eval::interpret::{
    format_interp_error, ImmTy, InterpCx, InterpResult, Projectable, Scalar,
};
use rustc_data_structures::fx::FxHashSet;
use rustc_hir::def::DefKind;
use rustc_hir::HirId;
use rustc_index::bit_set::BitSet;
use rustc_index::IndexVec;
use rustc_middle::bug;
use rustc_middle::mir::visit::{MutatingUseContext, NonMutatingUseContext, PlaceContext, Visitor};
use rustc_middle::mir::*;
use rustc_middle::ty::layout::{LayoutError, LayoutOf, LayoutOfHelpers, TyAndLayout};
use rustc_middle::ty::{self, ConstInt, ParamEnv, ScalarInt, Ty, TyCtxt, TypeVisitableExt};
use rustc_span::Span;
use rustc_target::abi::{Abi, FieldIdx, HasDataLayout, Size, TargetDataLayout, VariantIdx};
use tracing::{debug, instrument, trace};

use crate::errors::{AssertLint, AssertLintKind};
use crate::MirLint;

pub struct KnownPanicsLint;

impl<'tcx> MirLint<'tcx> for KnownPanicsLint {
    fn run_lint(&self, tcx: TyCtxt<'tcx>, body: &Body<'tcx>) {
        if body.tainted_by_errors.is_some() {
            return;
        }

        let def_id = body.source.def_id().expect_local();
        let def_kind = tcx.def_kind(def_id);
        let is_fn_like = def_kind.is_fn_like();
        let is_assoc_const = def_kind == DefKind::AssocConst;

        // Only run const prop on functions, methods, closures and associated constants
        if !is_fn_like && !is_assoc_const {
            // skip anon_const/statics/consts because they'll be evaluated by miri anyway
            trace!("KnownPanicsLint skipped for {:?}", def_id);
            return;
        }

        // FIXME(welseywiser) const prop doesn't work on coroutines because of query cycles
        // computing their layout.
        if tcx.is_coroutine(def_id.to_def_id()) {
            trace!("KnownPanicsLint skipped for coroutine {:?}", def_id);
            return;
        }

        trace!("KnownPanicsLint starting for {:?}", def_id);

        let mut linter = ConstPropagator::new(body, tcx);
        linter.visit_body(body);

        trace!("KnownPanicsLint done for {:?}", def_id);
    }
}

/// Visits MIR nodes, performs const propagation
/// and runs lint checks as it goes
struct ConstPropagator<'mir, 'tcx> {
    ecx: InterpCx<'tcx, DummyMachine>,
    tcx: TyCtxt<'tcx>,
    param_env: ParamEnv<'tcx>,
    worklist: Vec<BasicBlock>,
    visited_blocks: BitSet<BasicBlock>,
    locals: IndexVec<Local, Value<'tcx>>,
    body: &'mir Body<'tcx>,
    written_only_inside_own_block_locals: FxHashSet<Local>,
    can_const_prop: IndexVec<Local, ConstPropMode>,
}

#[derive(Debug, Clone)]
enum Value<'tcx> {
    Immediate(ImmTy<'tcx>),
    Aggregate { variant: VariantIdx, fields: IndexVec<FieldIdx, Value<'tcx>> },
    Uninit,
}

impl<'tcx> From<ImmTy<'tcx>> for Value<'tcx> {
    fn from(v: ImmTy<'tcx>) -> Self {
        Self::Immediate(v)
    }
}

impl<'tcx> Value<'tcx> {
    fn project(
        &self,
        proj: &[PlaceElem<'tcx>],
        prop: &ConstPropagator<'_, 'tcx>,
    ) -> Option<&Value<'tcx>> {
        let mut this = self;
        for proj in proj {
            this = match (*proj, this) {
                (PlaceElem::Field(idx, _), Value::Aggregate { fields, .. }) => {
                    fields.get(idx).unwrap_or(&Value::Uninit)
                }
                (PlaceElem::Index(idx), Value::Aggregate { fields, .. }) => {
                    let idx = prop.get_const(idx.into())?.immediate()?;
                    let idx = prop.ecx.read_target_usize(idx).ok()?.try_into().ok()?;
                    if idx <= FieldIdx::MAX_AS_U32 {
                        fields.get(FieldIdx::from_u32(idx)).unwrap_or(&Value::Uninit)
                    } else {
                        return None;
                    }
                }
                (
                    PlaceElem::ConstantIndex { offset, min_length: _, from_end: false },
                    Value::Aggregate { fields, .. },
                ) => fields
                    .get(FieldIdx::from_u32(offset.try_into().ok()?))
                    .unwrap_or(&Value::Uninit),
                _ => return None,
            };
        }
        Some(this)
    }

    fn project_mut(&mut self, proj: &[PlaceElem<'_>]) -> Option<&mut Value<'tcx>> {
        let mut this = self;
        for proj in proj {
            this = match (proj, this) {
                (PlaceElem::Field(idx, _), Value::Aggregate { fields, .. }) => {
                    fields.ensure_contains_elem(*idx, || Value::Uninit)
                }
                (PlaceElem::Field(..), val @ Value::Uninit) => {
                    *val =
                        Value::Aggregate { variant: VariantIdx::ZERO, fields: Default::default() };
                    val.project_mut(&[*proj])?
                }
                _ => return None,
            };
        }
        Some(this)
    }

    fn immediate(&self) -> Option<&ImmTy<'tcx>> {
        match self {
            Value::Immediate(op) => Some(op),
            _ => None,
        }
    }
}

impl<'tcx> LayoutOfHelpers<'tcx> for ConstPropagator<'_, 'tcx> {
    type LayoutOfResult = Result<TyAndLayout<'tcx>, LayoutError<'tcx>>;

    #[inline]
    fn handle_layout_err(&self, err: LayoutError<'tcx>, _: Span, _: Ty<'tcx>) -> LayoutError<'tcx> {
        err
    }
}

impl HasDataLayout for ConstPropagator<'_, '_> {
    #[inline]
    fn data_layout(&self) -> &TargetDataLayout {
        &self.tcx.data_layout
    }
}

impl<'tcx> ty::layout::HasTyCtxt<'tcx> for ConstPropagator<'_, 'tcx> {
    #[inline]
    fn tcx(&self) -> TyCtxt<'tcx> {
        self.tcx
    }
}

impl<'tcx> ty::layout::HasParamEnv<'tcx> for ConstPropagator<'_, 'tcx> {
    #[inline]
    fn param_env(&self) -> ty::ParamEnv<'tcx> {
        self.param_env
    }
}

impl<'mir, 'tcx> ConstPropagator<'mir, 'tcx> {
    fn new(body: &'mir Body<'tcx>, tcx: TyCtxt<'tcx>) -> ConstPropagator<'mir, 'tcx> {
        let def_id = body.source.def_id();
        let param_env = tcx.param_env_reveal_all_normalized(def_id);

        let can_const_prop = CanConstProp::check(tcx, param_env, body);
        let ecx = InterpCx::new(tcx, tcx.def_span(def_id), param_env, DummyMachine);

        ConstPropagator {
            ecx,
            tcx,
            param_env,
            worklist: vec![START_BLOCK],
            visited_blocks: BitSet::new_empty(body.basic_blocks.len()),
            locals: IndexVec::from_elem_n(Value::Uninit, body.local_decls.len()),
            body,
            can_const_prop,
            written_only_inside_own_block_locals: Default::default(),
        }
    }

    fn local_decls(&self) -> &'mir LocalDecls<'tcx> {
        &self.body.local_decls
    }

    fn get_const(&self, place: Place<'tcx>) -> Option<&Value<'tcx>> {
        self.locals[place.local].project(&place.projection, self)
    }

    /// Remove `local` from the pool of `Locals`. Allows writing to them,
    /// but not reading from them anymore.
    fn remove_const(&mut self, local: Local) {
        self.locals[local] = Value::Uninit;
        self.written_only_inside_own_block_locals.remove(&local);
    }

    fn access_mut(&mut self, place: &Place<'_>) -> Option<&mut Value<'tcx>> {
        match self.can_const_prop[place.local] {
            ConstPropMode::NoPropagation => return None,
            ConstPropMode::OnlyInsideOwnBlock => {
                self.written_only_inside_own_block_locals.insert(place.local);
            }
            ConstPropMode::FullConstProp => {}
        }
        self.locals[place.local].project_mut(place.projection)
    }

    fn lint_root(&self, source_info: SourceInfo) -> Option<HirId> {
        source_info.scope.lint_root(&self.body.source_scopes)
    }

    fn use_ecx<F, T>(&mut self, f: F) -> Option<T>
    where
        F: FnOnce(&mut Self) -> InterpResult<'tcx, T>,
    {
        match f(self) {
            Ok(val) => Some(val),
            Err(error) => {
                trace!("InterpCx operation failed: {:?}", error);
                // Some errors shouldn't come up because creating them causes
                // an allocation, which we should avoid. When that happens,
                // dedicated error variants should be introduced instead.
                assert!(
                    !error.kind().formatted_string(),
                    "known panics lint encountered formatting error: {}",
                    format_interp_error(self.ecx.tcx.dcx(), error),
                );
                None
            }
        }
    }

    /// Returns the value, if any, of evaluating `c`.
    fn eval_constant(&mut self, c: &ConstOperand<'tcx>) -> Option<ImmTy<'tcx>> {
        // FIXME we need to revisit this for #67176
        if c.has_param() {
            return None;
        }

        // Normalization needed b/c known panics lint runs in
        // `mir_drops_elaborated_and_const_checked`, which happens before
        // optimized MIR. Only after optimizing the MIR can we guarantee
        // that the `RevealAll` pass has happened and that the body's consts
        // are normalized, so any call to resolve before that needs to be
        // manually normalized.
        let val = self.tcx.try_normalize_erasing_regions(self.param_env, c.const_).ok()?;

        self.use_ecx(|this| this.ecx.eval_mir_constant(&val, c.span, None))?
            .as_mplace_or_imm()
            .right()
    }

    /// Returns the value, if any, of evaluating `place`.
    #[instrument(level = "trace", skip(self), ret)]
    fn eval_place(&mut self, place: Place<'tcx>) -> Option<ImmTy<'tcx>> {
        match self.get_const(place)? {
            Value::Immediate(imm) => Some(imm.clone()),
            Value::Aggregate { .. } => None,
            Value::Uninit => None,
        }
    }

    /// Returns the value, if any, of evaluating `op`. Calls upon `eval_constant`
    /// or `eval_place`, depending on the variant of `Operand` used.
    fn eval_operand(&mut self, op: &Operand<'tcx>) -> Option<ImmTy<'tcx>> {
        match *op {
            Operand::Constant(ref c) => self.eval_constant(c),
            Operand::Move(place) | Operand::Copy(place) => self.eval_place(place),
        }
    }

    fn report_assert_as_lint(
        &self,
        location: Location,
        lint_kind: AssertLintKind,
        assert_kind: AssertKind<impl Debug>,
    ) {
        let source_info = self.body.source_info(location);
        if let Some(lint_root) = self.lint_root(*source_info) {
            let span = source_info.span;
            self.tcx.emit_node_span_lint(
                lint_kind.lint(),
                lint_root,
                span,
                AssertLint { span, assert_kind, lint_kind },
            );
        }
    }

    fn check_unary_op(&mut self, op: UnOp, arg: &Operand<'tcx>, location: Location) -> Option<()> {
        let arg = self.eval_operand(arg)?;
        // The only operator that can overflow is `Neg`.
        if op == UnOp::Neg && arg.layout.ty.is_integral() {
            // Compute this as `0 - arg` so we can use `SubWithOverflow` to check for overflow.
            let (arg, overflow) = self.use_ecx(|this| {
                let arg = this.ecx.read_immediate(&arg)?;
                let (_res, overflow) = this
                    .ecx
                    .binary_op(BinOp::SubWithOverflow, &ImmTy::from_int(0, arg.layout), &arg)?
                    .to_scalar_pair();
                Ok((arg, overflow.to_bool()?))
            })?;
            if overflow {
                self.report_assert_as_lint(
                    location,
                    AssertLintKind::ArithmeticOverflow,
                    AssertKind::OverflowNeg(arg.to_const_int()),
                );
                return None;
            }
        }

        Some(())
    }

    fn check_binary_op(
        &mut self,
        op: BinOp,
        left: &Operand<'tcx>,
        right: &Operand<'tcx>,
        location: Location,
    ) -> Option<()> {
        let r =
            self.eval_operand(right).and_then(|r| self.use_ecx(|this| this.ecx.read_immediate(&r)));
        let l =
            self.eval_operand(left).and_then(|l| self.use_ecx(|this| this.ecx.read_immediate(&l)));
        // Check for exceeding shifts *even if* we cannot evaluate the LHS.
        if matches!(op, BinOp::Shr | BinOp::Shl) {
            let r = r.clone()?;
            // We need the type of the LHS. We cannot use `place_layout` as that is the type
            // of the result, which for checked binops is not the same!
            let left_ty = left.ty(self.local_decls(), self.tcx);
            let left_size = self.ecx.layout_of(left_ty).ok()?.size;
            let right_size = r.layout.size;
            let r_bits = r.to_scalar().to_bits(right_size).ok();
            if r_bits.is_some_and(|b| b >= left_size.bits() as u128) {
                debug!("check_binary_op: reporting assert for {:?}", location);
                let panic = AssertKind::Overflow(
                    op,
                    // Invent a dummy value, the diagnostic ignores it anyway
                    ConstInt::new(
                        ScalarInt::try_from_uint(1_u8, left_size).unwrap(),
                        left_ty.is_signed(),
                        left_ty.is_ptr_sized_integral(),
                    ),
                    r.to_const_int(),
                );
                self.report_assert_as_lint(location, AssertLintKind::ArithmeticOverflow, panic);
                return None;
            }
        }

        // Div/Rem are handled via the assertions they trigger.
        // But for Add/Sub/Mul, those assertions only exist in debug builds, and we want to
        // lint in release builds as well, so we check on the operation instead.
        // So normalize to the "overflowing" operator, and then ensure that it
        // actually is an overflowing operator.
        let op = op.wrapping_to_overflowing().unwrap_or(op);
        // The remaining operators are handled through `wrapping_to_overflowing`.
        if let (Some(l), Some(r)) = (l, r)
            && l.layout.ty.is_integral()
            && op.is_overflowing()
        {
            if self.use_ecx(|this| {
                let (_res, overflow) = this.ecx.binary_op(op, &l, &r)?.to_scalar_pair();
                overflow.to_bool()
            })? {
                self.report_assert_as_lint(
                    location,
                    AssertLintKind::ArithmeticOverflow,
                    AssertKind::Overflow(op, l.to_const_int(), r.to_const_int()),
                );
                return None;
            }
        }
        Some(())
    }

    fn check_rvalue(&mut self, rvalue: &Rvalue<'tcx>, location: Location) -> Option<()> {
        // Perform any special handling for specific Rvalue types.
        // Generally, checks here fall into one of two categories:
        //   1. Additional checking to provide useful lints to the user
        //        - In this case, we will do some validation and then fall through to the
        //          end of the function which evals the assignment.
        //   2. Working around bugs in other parts of the compiler
        //        - In this case, we'll return `None` from this function to stop evaluation.
        match rvalue {
            // Additional checking: give lints to the user if an overflow would occur.
            // We do this here and not in the `Assert` terminator as that terminator is
            // only sometimes emitted (overflow checks can be disabled), but we want to always
            // lint.
            Rvalue::UnaryOp(op, arg) => {
                trace!("checking UnaryOp(op = {:?}, arg = {:?})", op, arg);
                self.check_unary_op(*op, arg, location)?;
            }
            Rvalue::BinaryOp(op, box (left, right)) => {
                trace!("checking BinaryOp(op = {:?}, left = {:?}, right = {:?})", op, left, right);
                self.check_binary_op(*op, left, right, location)?;
            }

            // Do not try creating references (#67862)
            Rvalue::RawPtr(_, place) | Rvalue::Ref(_, _, place) => {
                trace!("skipping RawPtr | Ref for {:?}", place);

                // This may be creating mutable references or immutable references to cells.
                // If that happens, the pointed to value could be mutated via that reference.
                // Since we aren't tracking references, the const propagator loses track of what
                // value the local has right now.
                // Thus, all locals that have their reference taken
                // must not take part in propagation.
                self.remove_const(place.local);

                return None;
            }
            Rvalue::ThreadLocalRef(def_id) => {
                trace!("skipping ThreadLocalRef({:?})", def_id);

                return None;
            }

            // There's no other checking to do at this time.
            Rvalue::Aggregate(..)
            | Rvalue::Use(..)
            | Rvalue::CopyForDeref(..)
            | Rvalue::Repeat(..)
            | Rvalue::Len(..)
            | Rvalue::Cast(..)
            | Rvalue::ShallowInitBox(..)
            | Rvalue::Discriminant(..)
            | Rvalue::NullaryOp(..) => {}
        }

        // FIXME we need to revisit this for #67176
        if rvalue.has_param() {
            return None;
        }
        if !rvalue.ty(self.local_decls(), self.tcx).is_sized(self.tcx, self.param_env) {
            // the interpreter doesn't support unsized locals (only unsized arguments),
            // but rustc does (in a kinda broken way), so we have to skip them here
            return None;
        }

        Some(())
    }

    fn check_assertion(
        &mut self,
        expected: bool,
        msg: &AssertKind<Operand<'tcx>>,
        cond: &Operand<'tcx>,
        location: Location,
    ) {
        let Some(value) = &self.eval_operand(cond) else { return };
        trace!("assertion on {:?} should be {:?}", value, expected);

        let expected = Scalar::from_bool(expected);
        let Some(value_const) = self.use_ecx(|this| this.ecx.read_scalar(value)) else { return };

        if expected != value_const {
            // Poison all places this operand references so that further code
            // doesn't use the invalid value
            if let Some(place) = cond.place() {
                self.remove_const(place.local);
            }

            enum DbgVal<T> {
                Val(T),
                Underscore,
            }
            impl<T: std::fmt::Debug> std::fmt::Debug for DbgVal<T> {
                fn fmt(&self, fmt: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
                    match self {
                        Self::Val(val) => val.fmt(fmt),
                        Self::Underscore => fmt.write_str("_"),
                    }
                }
            }
            let mut eval_to_int = |op| {
                // This can be `None` if the lhs wasn't const propagated and we just
                // triggered the assert on the value of the rhs.
                self.eval_operand(op)
                    .and_then(|op| self.ecx.read_immediate(&op).ok())
                    .map_or(DbgVal::Underscore, |op| DbgVal::Val(op.to_const_int()))
            };
            let msg = match msg {
                AssertKind::DivisionByZero(op) => AssertKind::DivisionByZero(eval_to_int(op)),
                AssertKind::RemainderByZero(op) => AssertKind::RemainderByZero(eval_to_int(op)),
                AssertKind::Overflow(bin_op @ (BinOp::Div | BinOp::Rem), op1, op2) => {
                    // Division overflow is *UB* in the MIR, and different than the
                    // other overflow checks.
                    AssertKind::Overflow(*bin_op, eval_to_int(op1), eval_to_int(op2))
                }
                AssertKind::BoundsCheck { ref len, ref index } => {
                    let len = eval_to_int(len);
                    let index = eval_to_int(index);
                    AssertKind::BoundsCheck { len, index }
                }
                // Remaining overflow errors are already covered by checks on the binary operators.
                AssertKind::Overflow(..) | AssertKind::OverflowNeg(_) => return,
                // Need proper const propagator for these.
                _ => return,
            };
            self.report_assert_as_lint(location, AssertLintKind::UnconditionalPanic, msg);
        }
    }

    fn ensure_not_propagated(&self, local: Local) {
        if cfg!(debug_assertions) {
            let val = self.get_const(local.into());
            assert!(
                matches!(val, Some(Value::Uninit))
                    || self
                        .layout_of(self.local_decls()[local].ty)
                        .map_or(true, |layout| layout.is_zst()),
                "failed to remove values for `{local:?}`, value={val:?}",
            )
        }
    }

    #[instrument(level = "trace", skip(self), ret)]
    fn eval_rvalue(&mut self, rvalue: &Rvalue<'tcx>, dest: &Place<'tcx>) -> Option<()> {
        if !dest.projection.is_empty() {
            return None;
        }
        use rustc_middle::mir::Rvalue::*;
        let layout = self.ecx.layout_of(dest.ty(self.body, self.tcx).ty).ok()?;
        trace!(?layout);

        let val: Value<'_> = match *rvalue {
            ThreadLocalRef(_) => return None,

            Use(ref operand) => self.eval_operand(operand)?.into(),

            CopyForDeref(place) => self.eval_place(place)?.into(),

            BinaryOp(bin_op, box (ref left, ref right)) => {
                let left = self.eval_operand(left)?;
                let left = self.use_ecx(|this| this.ecx.read_immediate(&left))?;

                let right = self.eval_operand(right)?;
                let right = self.use_ecx(|this| this.ecx.read_immediate(&right))?;

                let val = self.use_ecx(|this| this.ecx.binary_op(bin_op, &left, &right))?;
                if matches!(val.layout.abi, Abi::ScalarPair(..)) {
                    // FIXME `Value` should properly support pairs in `Immediate`... but currently it does not.
                    let (val, overflow) = val.to_pair(&self.ecx);
                    Value::Aggregate {
                        variant: VariantIdx::ZERO,
                        fields: [val.into(), overflow.into()].into_iter().collect(),
                    }
                } else {
                    val.into()
                }
            }

            UnaryOp(un_op, ref operand) => {
                let operand = self.eval_operand(operand)?;
                let val = self.use_ecx(|this| this.ecx.read_immediate(&operand))?;

                let val = self.use_ecx(|this| this.ecx.unary_op(un_op, &val))?;
                val.into()
            }

            Aggregate(ref kind, ref fields) => Value::Aggregate {
                fields: fields
                    .iter()
                    .map(|field| self.eval_operand(field).map_or(Value::Uninit, Value::Immediate))
                    .collect(),
                variant: match **kind {
                    AggregateKind::Adt(_, variant, _, _, _) => variant,
                    AggregateKind::Array(_)
                    | AggregateKind::Tuple
                    | AggregateKind::RawPtr(_, _)
                    | AggregateKind::Closure(_, _)
                    | AggregateKind::Coroutine(_, _)
                    | AggregateKind::CoroutineClosure(_, _) => VariantIdx::ZERO,
                },
            },

            Repeat(ref op, n) => {
                trace!(?op, ?n);
                return None;
            }

            Len(place) => {
                let len = match self.get_const(place)? {
                    Value::Immediate(src) => src.len(&self.ecx).ok()?,
                    Value::Aggregate { fields, .. } => fields.len() as u64,
                    Value::Uninit => match place.ty(self.local_decls(), self.tcx).ty.kind() {
                        ty::Array(_, n) => n.try_eval_target_usize(self.tcx, self.param_env)?,
                        _ => return None,
                    },
                };
                ImmTy::from_scalar(Scalar::from_target_usize(len, self), layout).into()
            }

            Ref(..) | RawPtr(..) => return None,

            NullaryOp(ref null_op, ty) => {
                let op_layout = self.use_ecx(|this| this.ecx.layout_of(ty))?;
                let val = match null_op {
                    NullOp::SizeOf => op_layout.size.bytes(),
                    NullOp::AlignOf => op_layout.align.abi.bytes(),
                    NullOp::OffsetOf(fields) => self
                        .tcx
                        .offset_of_subfield(self.param_env, op_layout, fields.iter())
                        .bytes(),
                    NullOp::UbChecks => return None,
                };
                ImmTy::from_scalar(Scalar::from_target_usize(val, self), layout).into()
            }

            ShallowInitBox(..) => return None,

            Cast(ref kind, ref value, to) => match kind {
                CastKind::IntToInt | CastKind::IntToFloat => {
                    let value = self.eval_operand(value)?;
                    let value = self.ecx.read_immediate(&value).ok()?;
                    let to = self.ecx.layout_of(to).ok()?;
                    let res = self.ecx.int_to_int_or_float(&value, to).ok()?;
                    res.into()
                }
                CastKind::FloatToFloat | CastKind::FloatToInt => {
                    let value = self.eval_operand(value)?;
                    let value = self.ecx.read_immediate(&value).ok()?;
                    let to = self.ecx.layout_of(to).ok()?;
                    let res = self.ecx.float_to_float_or_int(&value, to).ok()?;
                    res.into()
                }
                CastKind::Transmute => {
                    let value = self.eval_operand(value)?;
                    let to = self.ecx.layout_of(to).ok()?;
                    // `offset` for immediates only supports scalar/scalar-pair ABIs,
                    // so bail out if the target is not one.
                    match (value.layout.abi, to.abi) {
                        (Abi::Scalar(..), Abi::Scalar(..)) => {}
                        (Abi::ScalarPair(..), Abi::ScalarPair(..)) => {}
                        _ => return None,
                    }

                    value.offset(Size::ZERO, to, &self.ecx).ok()?.into()
                }
                _ => return None,
            },

            Discriminant(place) => {
                let variant = match self.get_const(place)? {
                    Value::Immediate(op) => {
                        let op = op.clone();
                        self.use_ecx(|this| this.ecx.read_discriminant(&op))?
                    }
                    Value::Aggregate { variant, .. } => *variant,
                    Value::Uninit => return None,
                };
                let imm = self.use_ecx(|this| {
                    this.ecx.discriminant_for_variant(
                        place.ty(this.local_decls(), this.tcx).ty,
                        variant,
                    )
                })?;
                imm.into()
            }
        };
        trace!(?val);

        *self.access_mut(dest)? = val;

        Some(())
    }
}

impl<'tcx> Visitor<'tcx> for ConstPropagator<'_, 'tcx> {
    fn visit_body(&mut self, body: &Body<'tcx>) {
        while let Some(bb) = self.worklist.pop() {
            if !self.visited_blocks.insert(bb) {
                continue;
            }

            let data = &body.basic_blocks[bb];
            self.visit_basic_block_data(bb, data);
        }
    }

    fn visit_operand(&mut self, operand: &Operand<'tcx>, location: Location) {
        self.super_operand(operand, location);
    }

    fn visit_const_operand(&mut self, constant: &ConstOperand<'tcx>, location: Location) {
        trace!("visit_const_operand: {:?}", constant);
        self.super_const_operand(constant, location);
        self.eval_constant(constant);
    }

    fn visit_assign(&mut self, place: &Place<'tcx>, rvalue: &Rvalue<'tcx>, location: Location) {
        self.super_assign(place, rvalue, location);

        let Some(()) = self.check_rvalue(rvalue, location) else { return };

        match self.can_const_prop[place.local] {
            // Do nothing if the place is indirect.
            _ if place.is_indirect() => {}
            ConstPropMode::NoPropagation => self.ensure_not_propagated(place.local),
            ConstPropMode::OnlyInsideOwnBlock | ConstPropMode::FullConstProp => {
                if self.eval_rvalue(rvalue, place).is_none() {
                    // Const prop failed, so erase the destination, ensuring that whatever happens
                    // from here on, does not know about the previous value.
                    // This is important in case we have
                    // ```rust
                    // let mut x = 42;
                    // x = SOME_MUTABLE_STATIC;
                    // // x must now be uninit
                    // ```
                    // FIXME: we overzealously erase the entire local, because that's easier to
                    // implement.
                    trace!(
                        "propagation into {:?} failed.
                        Nuking the entire site from orbit, it's the only way to be sure",
                        place,
                    );
                    self.remove_const(place.local);
                }
            }
        }
    }

    fn visit_statement(&mut self, statement: &Statement<'tcx>, location: Location) {
        trace!("visit_statement: {:?}", statement);

        // We want to evaluate operands before any change to the assigned-to value,
        // so we recurse first.
        self.super_statement(statement, location);

        match statement.kind {
            StatementKind::SetDiscriminant { ref place, variant_index } => {
                match self.can_const_prop[place.local] {
                    // Do nothing if the place is indirect.
                    _ if place.is_indirect() => {}
                    ConstPropMode::NoPropagation => self.ensure_not_propagated(place.local),
                    ConstPropMode::FullConstProp | ConstPropMode::OnlyInsideOwnBlock => {
                        match self.access_mut(place) {
                            Some(Value::Aggregate { variant, .. }) => *variant = variant_index,
                            _ => self.remove_const(place.local),
                        }
                    }
                }
            }
            StatementKind::StorageLive(local) => {
                self.remove_const(local);
            }
            StatementKind::StorageDead(local) => {
                self.remove_const(local);
            }
            _ => {}
        }
    }

    fn visit_terminator(&mut self, terminator: &Terminator<'tcx>, location: Location) {
        self.super_terminator(terminator, location);
        match &terminator.kind {
            TerminatorKind::Assert { expected, ref msg, ref cond, .. } => {
                self.check_assertion(*expected, msg, cond, location);
            }
            TerminatorKind::SwitchInt { ref discr, ref targets } => {
                if let Some(ref value) = self.eval_operand(discr)
                    && let Some(value_const) = self.use_ecx(|this| this.ecx.read_scalar(value))
                    && let Ok(constant) = value_const.to_bits(value_const.size())
                {
                    // We managed to evaluate the discriminant, so we know we only need to visit
                    // one target.
                    let target = targets.target_for_value(constant);
                    self.worklist.push(target);
                    return;
                }
                // We failed to evaluate the discriminant, fallback to visiting all successors.
            }
            // None of these have Operands to const-propagate.
            TerminatorKind::Goto { .. }
            | TerminatorKind::UnwindResume
            | TerminatorKind::UnwindTerminate(_)
            | TerminatorKind::Return
            | TerminatorKind::TailCall { .. }
            | TerminatorKind::Unreachable
            | TerminatorKind::Drop { .. }
            | TerminatorKind::Yield { .. }
            | TerminatorKind::CoroutineDrop
            | TerminatorKind::FalseEdge { .. }
            | TerminatorKind::FalseUnwind { .. }
            | TerminatorKind::Call { .. }
            | TerminatorKind::InlineAsm { .. } => {}
        }

        self.worklist.extend(terminator.successors());
    }

    fn visit_basic_block_data(&mut self, block: BasicBlock, data: &BasicBlockData<'tcx>) {
        self.super_basic_block_data(block, data);

        // We remove all Locals which are restricted in propagation to their containing blocks and
        // which were modified in the current block.
        // Take it out of the ecx so we can get a mutable reference to the ecx for `remove_const`.
        let mut written_only_inside_own_block_locals =
            std::mem::take(&mut self.written_only_inside_own_block_locals);

        // This loop can get very hot for some bodies: it check each local in each bb.
        // To avoid this quadratic behaviour, we only clear the locals that were modified inside
        // the current block.
        // The order in which we remove consts does not matter.
        #[allow(rustc::potential_query_instability)]
        for local in written_only_inside_own_block_locals.drain() {
            debug_assert_eq!(self.can_const_prop[local], ConstPropMode::OnlyInsideOwnBlock);
            self.remove_const(local);
        }
        self.written_only_inside_own_block_locals = written_only_inside_own_block_locals;

        if cfg!(debug_assertions) {
            for (local, &mode) in self.can_const_prop.iter_enumerated() {
                match mode {
                    ConstPropMode::FullConstProp => {}
                    ConstPropMode::NoPropagation | ConstPropMode::OnlyInsideOwnBlock => {
                        self.ensure_not_propagated(local);
                    }
                }
            }
        }
    }
}

/// The maximum number of bytes that we'll allocate space for a local or the return value.
/// Needed for #66397, because otherwise we eval into large places and that can cause OOM or just
/// Severely regress performance.
const MAX_ALLOC_LIMIT: u64 = 1024;

/// The mode that `ConstProp` is allowed to run in for a given `Local`.
#[derive(Clone, Copy, Debug, PartialEq)]
pub enum ConstPropMode {
    /// The `Local` can be propagated into and reads of this `Local` can also be propagated.
    FullConstProp,
    /// The `Local` can only be propagated into and from its own block.
    OnlyInsideOwnBlock,
    /// The `Local` cannot be part of propagation at all. Any statement
    /// referencing it either for reading or writing will not get propagated.
    NoPropagation,
}

/// A visitor that determines locals in a MIR body
/// that can be const propagated
pub struct CanConstProp {
    can_const_prop: IndexVec<Local, ConstPropMode>,
    // False at the beginning. Once set, no more assignments are allowed to that local.
    found_assignment: BitSet<Local>,
}

impl CanConstProp {
    /// Returns true if `local` can be propagated
    pub fn check<'tcx>(
        tcx: TyCtxt<'tcx>,
        param_env: ParamEnv<'tcx>,
        body: &Body<'tcx>,
    ) -> IndexVec<Local, ConstPropMode> {
        let mut cpv = CanConstProp {
            can_const_prop: IndexVec::from_elem(ConstPropMode::FullConstProp, &body.local_decls),
            found_assignment: BitSet::new_empty(body.local_decls.len()),
        };
        for (local, val) in cpv.can_const_prop.iter_enumerated_mut() {
            let ty = body.local_decls[local].ty;
            if ty.is_union() {
                // Unions are incompatible with the current implementation of
                // const prop because Rust has no concept of an active
                // variant of a union
                *val = ConstPropMode::NoPropagation;
            } else {
                match tcx.layout_of(param_env.and(ty)) {
                    Ok(layout) if layout.size < Size::from_bytes(MAX_ALLOC_LIMIT) => {}
                    // Either the layout fails to compute, then we can't use this local anyway
                    // or the local is too large, then we don't want to.
                    _ => {
                        *val = ConstPropMode::NoPropagation;
                        continue;
                    }
                }
            }
        }
        // Consider that arguments are assigned on entry.
        for arg in body.args_iter() {
            cpv.found_assignment.insert(arg);
        }
        cpv.visit_body(body);
        cpv.can_const_prop
    }
}

impl<'tcx> Visitor<'tcx> for CanConstProp {
    fn visit_place(&mut self, place: &Place<'tcx>, mut context: PlaceContext, loc: Location) {
        use rustc_middle::mir::visit::PlaceContext::*;

        // Dereferencing just read the addess of `place.local`.
        if place.projection.first() == Some(&PlaceElem::Deref) {
            context = NonMutatingUse(NonMutatingUseContext::Copy);
        }

        self.visit_local(place.local, context, loc);
        self.visit_projection(place.as_ref(), context, loc);
    }

    fn visit_local(&mut self, local: Local, context: PlaceContext, _: Location) {
        use rustc_middle::mir::visit::PlaceContext::*;
        match context {
            // These are just stores, where the storing is not propagatable, but there may be later
            // mutations of the same local via `Store`
            | MutatingUse(MutatingUseContext::Call)
            | MutatingUse(MutatingUseContext::AsmOutput)
            | MutatingUse(MutatingUseContext::Deinit)
            // Actual store that can possibly even propagate a value
            | MutatingUse(MutatingUseContext::Store)
            | MutatingUse(MutatingUseContext::SetDiscriminant) => {
                if !self.found_assignment.insert(local) {
                    match &mut self.can_const_prop[local] {
                        // If the local can only get propagated in its own block, then we don't have
                        // to worry about multiple assignments, as we'll nuke the const state at the
                        // end of the block anyway, and inside the block we overwrite previous
                        // states as applicable.
                        ConstPropMode::OnlyInsideOwnBlock => {}
                        ConstPropMode::NoPropagation => {}
                        other @ ConstPropMode::FullConstProp => {
                            trace!(
                                "local {:?} can't be propagated because of multiple assignments. Previous state: {:?}",
                                local, other,
                            );
                            *other = ConstPropMode::OnlyInsideOwnBlock;
                        }
                    }
                }
            }
            // Reading constants is allowed an arbitrary number of times
            NonMutatingUse(NonMutatingUseContext::Copy)
            | NonMutatingUse(NonMutatingUseContext::Move)
            | NonMutatingUse(NonMutatingUseContext::Inspect)
            | NonMutatingUse(NonMutatingUseContext::PlaceMention)
            | NonUse(_) => {}

            // These could be propagated with a smarter analysis or just some careful thinking about
            // whether they'd be fine right now.
            MutatingUse(MutatingUseContext::Yield)
            | MutatingUse(MutatingUseContext::Drop)
            | MutatingUse(MutatingUseContext::Retag)
            // These can't ever be propagated under any scheme, as we can't reason about indirect
            // mutation.
            | NonMutatingUse(NonMutatingUseContext::SharedBorrow)
            | NonMutatingUse(NonMutatingUseContext::FakeBorrow)
            | NonMutatingUse(NonMutatingUseContext::RawBorrow)
            | MutatingUse(MutatingUseContext::Borrow)
            | MutatingUse(MutatingUseContext::RawBorrow) => {
                trace!("local {:?} can't be propagated because it's used: {:?}", local, context);
                self.can_const_prop[local] = ConstPropMode::NoPropagation;
            }
            MutatingUse(MutatingUseContext::Projection)
            | NonMutatingUse(NonMutatingUseContext::Projection) => bug!("visit_place should not pass {context:?} for {local:?}"),
        }
    }
}