Prohibit cycles behind references while static initialization #149973
+295
−31
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
rustbot
added
S-waiting-on-review
Collaborator
ShoyuVanilla
commented
Dec 14, 2025
| if !tcx.is_foreign_item(static_def_id) { | ||
| // Fire the query to detect cycles. We cannot restrict this to only when | ||
| // evaluating statics, since static reference cycles can also be formed | ||
| // through consts, especially promoted ones. |
Member
Author
There was a problem hiding this comment.
Not skiping firing the query when machine.static_root_ids.is_none() here further prohibits some currently compiled codes such as
static FOO: i32 = {
let x = &BAR;
42
};
const BAR: i32 = {
let x = &FOO;
42
};but I guess we might have to refute const cases as well because the following codes slightly modified from the original issue still make problems with it:
enum Never {}
// &&X creates a promoted const
static X: &Never = weird(&&X);
const fn weird(a: &&&Never) -> &'static Never {
// SAFETY: our argument type has an unsatisfiable
// library invariant; therefore, this code is unreachable.
unsafe { std::hint::unreachable_unchecked() };
}// for privacy
mod mrow {
pub struct InBoundsIndex<const N: usize>(());
impl<const N: usize> InBoundsIndex<N> {
pub const fn new() -> Option<InBoundsIndex<N>> {
if N < 32 {
Some(Self(()))
} else {
None
}
}
}
}
use mrow::InBoundsIndex;
static IDX: InBoundsIndex<64> = {
FOO;
// THIS SHOULD PANIC!!! but we do UB first on the line above
InBoundsIndex::<64>::new().unwrap()
};
const FOO: () = {
let _x = index([0; 32], &IDX);
};
const fn index<const N: usize>(arr: [u8; 32], _: &InBoundsIndex<N>) -> u8 {
// SAFETY: InBoundsIndex can only be created by its new, which ensures N is < 32
unsafe { arr.as_ptr().add(N).read() }
}
Collaborator
|
The job Click to see the possible cause of the failure (guessed by this bot) |
Member
Author
|
Oh, this already breaks things as hell like in: static POSTFIX: [(Input, Action); 10] = [
(Keyword("as"), SetState(&[(ExpectType, SetState(&POSTFIX))])),
... |
traviscross
added
the
I-lang-radar
Member
Author
|
@bors try |
rust-bors bot
added a commit
that referenced
this pull request
Dec 14, 2025
Prohibit cycles behind references while static initialization
This comment has been minimized.
This comment has been minimized.
|
💔 Test for 352f3f3 failed: CI. Failed jobs:
|
Collaborator
|
The job Click to see the possible cause of the failure (guessed by this bot) |
RalfJung
reviewed
Dec 14, 2025
| self.layout_of_local(self.frame(), local, None)?.ty.is_ref() | ||
| } else { | ||
| false | ||
| }; |
Member
There was a problem hiding this comment.
This looks like it will be false for &(*local_ref).field, which is not what we want.
Generally, I am not convinced by the implementation approach. This adds a very syntactic check to one specific operation that constructs references, but it's far from clear that this is enough. For instance, the code could take a raw pointer to a static, store it in a [*const T; 1], and transmute that to [&T; 1] -- then you would never see a (re)borrow of a reference but we still have the same underlying unsoundness.
Member
There was a problem hiding this comment.
For instance,
I guess we'd say that the unsafe code needed to construct references this way is unsound... hm. Maybe that is fair but it needs good documentation.
Also, what you implemented is somewhat different from what I sketched, not sure if that is deliberate. You seem to be trying to catch all &expr where expr evaluates to a pointer that points to a static. The original plan was just to catch all &STATIC, i.e. it really syntactically has to have that shape.
In particular, your approach would seem to reject this:
static X: &Never = weird(unsafe { &*&raw const X });I'm not sure that's a good idea. It's unprincipled: it's still possible to write unsafe code that evades your checks, so yo haven't gained any new guarantees. I would rather have a very clear line for which code gets accepted and which gets rejected.
RalfJung
reviewed
Dec 14, 2025
| // - they may be references to some other legitimate static reference | ||
| // (e.g. via a raw pointer), and | ||
| // - if they originate from an illegal static reference, that illegal | ||
| // reference must already appear in the body and will be checked there. |
Member
There was a problem hiding this comment.
I don't quite understand what you mean by this. However, it all seems an artifact of trying to catch cases where the reference points to a static, rather than just the specific syntactic pattern &STATIC.
Member
|
Also I should say, thanks for tackling this. :) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #143047