CFI: Fix drop and drop_in_place

Fix drop and drop_in_place by transforming self of drop and
drop_in_place methods into Drop trait objects.

Author: rcvalle

compiler/rustc_symbol_mangling/src/typeid/typeid_itanium_cxx_abi.rs

@@ -745,6 +745,19 @@ fn encode_ty<'tcx>(
     typeid
 }
 
+/// Creates a trait object.
+#[inline]
+fn new_dynamic_trait<'tcx>(
+    tcx: TyCtxt<'tcx>,
+    def_id: DefId,
+    args: GenericArgsRef<'tcx>,
+) -> Ty<'tcx> {
+    let predicate =
+        ty::ExistentialPredicate::Trait(ty::ExistentialTraitRef { def_id: def_id, args: args });
+    let predicates = tcx.mk_poly_existential_predicates(&[ty::Binder::dummy(predicate)]);
+    Ty::new_dynamic(tcx, predicates, tcx.lifetimes.re_erased, ty::Dyn)
+}
+
 /// Transforms predicates for being encoded and used in the substitution dictionary.
 fn transform_predicates<'tcx>(
     tcx: TyCtxt<'tcx>,
@@ -1112,8 +1125,31 @@ pub fn typeid_for_instance<'tcx>(
     mut instance: Instance<'tcx>,
     options: TypeIdOptions,
 ) -> String {
-    if matches!(instance.def, ty::InstanceDef::Virtual(..)) {
-        instance.args = strip_receiver_auto(tcx, instance.args)
+    if (matches!(instance.def, ty::InstanceDef::Virtual(..))
+        && instance.def_id() == tcx.lang_items().drop_in_place_fn().unwrap())
+        || matches!(instance.def, ty::InstanceDef::DropGlue(..))
+    {
+        // Adjust the type ids of DropGlues
+        //
+        // DropGlues may have indirect calls to one or more given types drop function. Rust allows
+        // for types to be erased to any trait object and retains the drop function for the original
+        // type, which means at the indirect call sites in DropGlues, when typeid_for_fnabi is
+        // called a second time, it only has information after type erasure and it could be a call
+        // on any arbitrary trait object. Normalize them to a synthesized Drop trait object, both on
+        // declaration/definition, and during code generation at call sites so they have the same
+        // type id and match.
+        //
+        // FIXME(rcvalle): This allows a drop call on any trait object to call the drop function of
+        //   any other type.
+        //
+        let self_ty = Ty::new_mut_ref(
+            tcx,
+            tcx.lifetimes.re_erased,
+            new_dynamic_trait(tcx, tcx.lang_items().drop_trait().unwrap(), List::empty()),
+        );
+        instance.args = tcx.mk_args_trait(self_ty, List::empty());
+    } else if matches!(instance.def, ty::InstanceDef::Virtual(..)) {
+        instance.args = strip_receiver_auto(tcx, instance.args);
     }
 
     if let Some(impl_id) = tcx.impl_of_method(instance.def_id())

tests/ui/sanitizer/cfi-drop-in-place.rs

@@ -0,0 +1,20 @@
+// Verifies that drops can be called on arbitrary trait objects.
+//
+// FIXME(#122848): Remove only-linux when fixed.
+//@ only-linux
+//@ needs-sanitizer-cfi
+//@ compile-flags: -Clto -Copt-level=0 -Cprefer-dynamic=off -Ctarget-feature=-crt-static -Zsanitizer=cfi
+//@ run-pass
+
+struct EmptyDrop;
+
+struct NonEmptyDrop;
+
+impl Drop for NonEmptyDrop {
+    fn drop(&mut self) {}
+}
+
+fn main() {
+    let _ = Box::new(EmptyDrop) as Box<dyn Send>;
+    let _ = Box::new(NonEmptyDrop) as Box<dyn Send>;
+}