unsized_fn_params allows some unsized locals

[RalfJung]

Found in rust-lang/miri#2872: this code

#![feature(core_intrinsics, unsized_fn_params)]
use std::intrinsics;

pub fn forget_unsized(t: [i32]) {
    intrinsics::forget(t)
}

with -Zmir-opt-level=0 generates this LLVM IR

define void @_ZN4test14forget_unsized17h6fbb3409c8556ed4E(ptr %0, i64 %1) unnamed_addr #0 {
start:
  %_2 = alloca { ptr, i64 }, align 8
  %t = alloca { ptr, i64 }, align 8
  %2 = getelementptr inbounds { ptr, i64 }, ptr %t, i32 0, i32 0
  store ptr %0, ptr %2, align 8
  %3 = getelementptr inbounds { ptr, i64 }, ptr %t, i32 0, i32 1
  store i64 %1, ptr %3, align 8
  %4 = getelementptr inbounds { ptr, i64 }, ptr %t, i32 0, i32 0
  %5 = load ptr, ptr %4, align 8, !noundef !2
  %6 = getelementptr inbounds { ptr, i64 }, ptr %t, i32 0, i32 1
  %7 = load i64, ptr %6, align 8, !noundef !2
  %8 = mul nsw i64 %7, 4
  %9 = alloca i8, i64 %8, align 16
  call void @llvm.memcpy.p0.p0.i64(ptr align 16 %9, ptr align 1 %5, i64 %8, i1 false)
  %10 = getelementptr inbounds { ptr, i64 }, ptr %_2, i32 0, i32 0
  store ptr %9, ptr %10, align 8
  %11 = getelementptr inbounds { ptr, i64 }, ptr %_2, i32 0, i32 1
  store i64 %7, ptr %11, align 8
  ret void
}

Notice the alloca. This is bad! Our alloca code path is unsound (it does not properly account for alignment); the point of the unsized_fn_params feature gate (separate from unsized_locals) was to avoid hitting that code path.

I repeat my stance that we should remove the unsound alloca code path (effectively de-imlementing unsized locals) to ensure this can never happen.

We don't have a MIR building ping group AFAIK, so Cc @rust-lang/wg-mir-opt I guess.

Here's a Miri testcase:

#![feature(forget_unsized, unsized_fn_params)]

fn main() {
    let b: Box<[u32]> = Box::new([1, 2, 3]);
    std::mem::forget_unsized(*b);
}

[RalfJung]

I forgot how exactly #78152 works, but for some reason it lets this pass. Either the analysis should reject this, or MIR building needs to not create an unsized local here.

[Jules-Bertholet]

The bad MIR builing is here:

rust/compiler/rustc_mir_build/src/build/expr/as_operand.rs

Line 168 in eac3558

if let ExprKind::Deref { arg } = expr.kind {

Any unsized function call operand other than a Box deref expression not wrapped in a block, is compiled by as_operand which introduces a temporary.

[Jules-Bertholet]

@rustbot label -I-unsound

(#71416 has been closed)

[rustbot]

Error: Parsing relabel command in comment failed: ...'-I-unsound' | error: a label delta at >| ' (#71416 h'...

Please file an issue on GitHub at triagebot if there's a problem with this bot, or reach out on #t-infra on Zulip.

[RalfJung]

This is still an issue with current rustc (fca59ab) -- a similar issue got fixed (#111355) but this one is still open.

[workingjubilee]

Current LLVMIR: https://rust.godbolt.org/z/7zx7Yvr9h

source_filename = "example.f256f209c7383c27-cgu.0"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @_ZN7example14forget_unsized17h4990435afa880043E(ptr align 4 %0, i64 %1) unnamed_addr #0 {
  %_2 = alloca [16 x i8], align 8
  %input = alloca [16 x i8], align 8
  store ptr %0, ptr %input, align 8
  %2 = getelementptr inbounds i8, ptr %input, i64 8
  store i64 %1, ptr %2, align 8
  %3 = load ptr, ptr %input, align 8
  %4 = getelementptr inbounds i8, ptr %input, i64 8
  %5 = load i64, ptr %4, align 8
  %6 = mul nuw nsw i64 %5, 4
  %7 = add i64 %6, 3
  %8 = alloca i8, i64 %7, align 1
  %9 = ptrtoint ptr %8 to i64
  %10 = sub i64 0, %9
  %11 = and i64 %10, 3
  %12 = getelementptr inbounds i8, ptr %8, i64 %11
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %12, ptr align 1 %3, i64 %6, i1 false)
  store ptr %12, ptr %_2, align 8
  %13 = getelementptr inbounds i8, ptr %_2, i64 8
  store i64 %5, ptr %13, align 8
  ret void
}

declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #1

attributes #0 = { nonlazybind uwtable "probe-stack"="inline-asm" "target-cpu"="x86-64" }
attributes #1 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }

!llvm.module.flags = !{!0, !1}
!llvm.ident = !{!2}

!0 = !{i32 8, !"PIC Level", i32 2}
!1 = !{i32 2, !"RtLibUseGOT", i32 1}
!2 = !{!"rustc version 1.89.0-nightly (4d08223c0 2025-05-31)"}

No significant differences aside from less struct types.