Rollup merge of rust-lang#90383 - tmiasko:union-validity, r=RalfJung

Extend check for UnsafeCell in consts to cover unions

A validity companion to changes from rust-lang#90373.

`@rust-lang/wg-const-eval`

Author: matthiaskrgr

compiler/rustc_const_eval/src/interpret/validity.rs

@@ -14,6 +14,7 @@ use rustc_middle::mir::interpret::InterpError;
 use rustc_middle::ty;
 use rustc_middle::ty::layout::{LayoutOf, TyAndLayout};
 use rustc_span::symbol::{sym, Symbol};
+use rustc_span::DUMMY_SP;
 use rustc_target::abi::{Abi, Scalar as ScalarAbi, Size, VariantIdx, Variants, WrappingRange};
 
 use std::hash::Hash;
@@ -736,9 +737,15 @@ impl<'rt, 'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> ValueVisitor<'mir, 'tcx, M>
     #[inline(always)]
     fn visit_union(
         &mut self,
-        _op: &OpTy<'tcx, M::PointerTag>,
+        op: &OpTy<'tcx, M::PointerTag>,
         _fields: NonZeroUsize,
     ) -> InterpResult<'tcx> {
+        // Special check preventing `UnsafeCell` inside unions in the inner part of constants.
+        if matches!(self.ctfe_mode, Some(CtfeValidationMode::Const { inner: true, .. })) {
+            if !op.layout.ty.is_freeze(self.ecx.tcx.at(DUMMY_SP), self.ecx.param_env) {
+                throw_validation_failure!(self.path, { "`UnsafeCell` in a `const`" });
+            }
+        }
         Ok(())
     }
 

src/test/ui/consts/invalid-union.32bit.stderr

@@ -0,0 +1,24 @@
+error[E0080]: it is undefined behavior to use this value
+  --> $DIR/invalid-union.rs:41:1
+   |
+LL | fn main() {
+   | ^^^^^^^^^ type validation failed at .<deref>.y.<enum-variant(B)>.0: encountered `UnsafeCell` in a `const`
+   |
+   = note: The rules on what exactly is undefined behavior aren't clear, so this check might be overzealous. Please open an issue on the rustc repository if you believe it should not be considered undefined behavior.
+   = note: the raw bytes of the constant (size: 4, align: 4) {
+               ╾─alloc7──╼                                     │ ╾──╼
+           }
+
+error: erroneous constant used
+  --> $DIR/invalid-union.rs:42:25
+   |
+LL |     let _: &'static _ = &C;
+   |                         ^^ referenced constant has errors
+   |
+   = note: `#[deny(const_err)]` on by default
+   = warning: this was previously accepted by the compiler but is being phased out; it will become a hard error in a future release!
+   = note: for more information, see issue #71800 <https://github.com/rust-lang/rust/issues/71800>
+
+error: aborting due to 2 previous errors
+
+For more information about this error, try `rustc --explain E0080`.

src/test/ui/consts/invalid-union.64bit.stderr

@@ -0,0 +1,24 @@
+error[E0080]: it is undefined behavior to use this value
+  --> $DIR/invalid-union.rs:41:1
+   |
+LL | fn main() {
+   | ^^^^^^^^^ type validation failed at .<deref>.y.<enum-variant(B)>.0: encountered `UnsafeCell` in a `const`
+   |
+   = note: The rules on what exactly is undefined behavior aren't clear, so this check might be overzealous. Please open an issue on the rustc repository if you believe it should not be considered undefined behavior.
+   = note: the raw bytes of the constant (size: 8, align: 8) {
+               ╾───────alloc7────────╼                         │ ╾──────╼
+           }
+
+error: erroneous constant used
+  --> $DIR/invalid-union.rs:42:25
+   |
+LL |     let _: &'static _ = &C;
+   |                         ^^ referenced constant has errors
+   |
+   = note: `#[deny(const_err)]` on by default
+   = warning: this was previously accepted by the compiler but is being phased out; it will become a hard error in a future release!
+   = note: for more information, see issue #71800 <https://github.com/rust-lang/rust/issues/71800>
+
+error: aborting due to 2 previous errors
+
+For more information about this error, try `rustc --explain E0080`.

src/test/ui/consts/invalid-union.rs

@@ -0,0 +1,44 @@
+// Check that constants with interior mutability inside unions are rejected
+// during validation.
+//
+// Note that this test case relies on undefined behaviour to construct a
+// constant with interior mutability that is "invisible" to the static checks.
+// If for some reason this approach no longer works, it is should be fine to
+// remove the test case.
+//
+// build-fail
+// stderr-per-bitwidth
+#![feature(const_mut_refs)]
+#![feature(const_ptr_offset)]
+#![feature(untagged_unions)]
+use std::cell::Cell;
+
+#[repr(C)]
+struct S {
+    x: u32,
+    y: E,
+}
+
+#[repr(u32)]
+enum E {
+    A,
+    B(U)
+}
+
+union U {
+    cell: Cell<u32>,
+}
+
+const C: S = {
+    let s = S { x: 0, y: E::A };
+    // Go through an &u32 reference which is definitely not allowed to mutate anything.
+    let p = &s.x as *const u32 as *mut u32;
+    // Change enum tag to E::B.
+    unsafe { *p.add(1) = 1 };
+    s
+};
+
+fn main() { //~ ERROR it is undefined behavior to use this value
+    let _: &'static _ = &C; //~ ERROR erroneous constant used
+    //~^ WARN this was previously accepted
+}