escape-on-cast, now ptr-deref does not change the tag at all, ever

Author: RalfJung

src/lib.rs

@@ -461,9 +461,9 @@ impl<'a, 'mir, 'tcx> Machine<'a, 'mir, 'tcx> for Evaluator<'tcx> {
             // No tracking
             Ok(place.ptr)
         } else {
-            let ptr = place.ptr.to_ptr()?; // assert this is not a scalar
-            let tag = ecx.tag_dereference(place, size, mutability.into())?;
-            Ok(Scalar::Ptr(Pointer::new_with_tag(ptr.alloc_id, ptr.offset, tag)))
+            ecx.ptr_dereference(place, size, mutability.into())?;
+            // We never change the pointer
+            Ok(place.ptr)
         }
     }
 

src/stacked_borrows.rs

@@ -405,12 +405,12 @@ impl<'tcx> Stacks {
 
 
 pub trait EvalContextExt<'tcx> {
-    fn tag_dereference(
+    fn ptr_dereference(
         &self,
         place: MPlaceTy<'tcx, Borrow>,
         size: Size,
         mutability: Option<Mutability>,
-    ) -> EvalResult<'tcx, Borrow>;
+    ) -> EvalResult<'tcx>;
 
     fn tag_new_allocation(
         &mut self,
@@ -480,13 +480,13 @@ impl<'a, 'mir, 'tcx> EvalContextExt<'tcx> for MiriEvalContext<'a, 'mir, 'tcx> {
     ///
     /// Note that this does NOT mean that all this memory will actually get accessed/referenced!
     /// We could be in the middle of `&(*var).1`.
-    fn tag_dereference(
+    fn ptr_dereference(
         &self,
         place: MPlaceTy<'tcx, Borrow>,
         size: Size,
         mutability: Option<Mutability>,
-    ) -> EvalResult<'tcx, Borrow> {
-        trace!("tag_dereference: Accessing {} reference for {:?} (pointee {})",
+    ) -> EvalResult<'tcx> {
+        trace!("ptr_dereference: Accessing {} reference for {:?} (pointee {})",
             if let Some(mutability) = mutability { format!("{:?}", mutability) } else { format!("raw") },
             place.ptr, place.layout.ty);
         let ptr = place.ptr.to_ptr()?;
@@ -497,12 +497,8 @@ impl<'a, 'mir, 'tcx> EvalContextExt<'tcx> for MiriEvalContext<'a, 'mir, 'tcx> {
         // That can transmute a raw ptr to a (shared/mut) ref, and a mut ref to a shared one.
         match (mutability, ptr.tag) {
             (None, _) => {
-                // Don't use the tag, this is a raw access!  They should happen tagless.
-                // This is needed for `*mut` to make any sense: Writes *do* enforce the
-                // `Uniq` tag to be up top, but we must make sure raw writes do not do that.
-                // This does mean, however, that `&*foo` is *not* a NOP *if* `foo` is a raw ptr.
-                // Also don't do any further validation, this is raw after all.
-                return Ok(Borrow::default());
+                // No further validation on raw accesses.
+                return Ok(());
             }
             (Some(MutMutable), Borrow::Uniq(_)) |
             (Some(MutImmutable), Borrow::Shr(_)) => {
@@ -543,8 +539,8 @@ impl<'a, 'mir, 'tcx> EvalContextExt<'tcx> for MiriEvalContext<'a, 'mir, 'tcx> {
             alloc.extra.deref(ptr, size, kind)?;
         }
 
-        // All is good, and do not change the tag
-        Ok(ptr.tag)
+        // All is good
+        Ok(())
     }
 
     /// The given place may henceforth be accessed through raw pointers.

tests/compile-fail-fullmir/stacked_borrows/buggy_as_mut_slice.rs

@@ -1,5 +1,3 @@
-// error-pattern: mutable reference with frozen tag
-
 mod safe {
     use std::slice::from_raw_parts_mut;
 
@@ -12,10 +10,8 @@ mod safe {
 
 fn main() {
     let v = vec![0,1,2];
-    let _v1 = safe::as_mut_slice(&v);
-/*
-    let v2 = safe::as_mut_slice(&v);
+    let v1 = safe::as_mut_slice(&v);
+    let _v2 = safe::as_mut_slice(&v);
     v1[1] = 5;
-    v1[1] = 6;
-*/
+    //~^ ERROR does not exist on the stack
 }

tests/compile-fail-fullmir/stacked_borrows/transmute-is-no-escape.rs

@@ -8,5 +8,6 @@ use std::mem;
 fn main() {
     let mut x: i32 = 42;
     let raw: *mut i32 = unsafe { mem::transmute(&mut x) };
+    let raw = raw as usize as *mut i32; // make sure we killed the tag
     unsafe { *raw = 13; } //~ ERROR does not exist on the stack
 }