Rust: ICE: index out of bounds: the len is 0 but the index is 0

[DutchGhost]

The following ICE's on nightly and beta:

use std::marker::PhantomData;

use std::mem::{self, MaybeUninit};

struct Bug<S> {
    A: [(); {
        let x: S = MaybeUninit::uninit();
        let b = &*(&x as *const _ as *const S);
        0
    }],
}

Backtrace:

thread 'rustc' panicked at 'index out of bounds: the len is 0 but the index is 0', /rustc/da3629b05f8f1b425a738bfe9fe9aedd47c5417a/src/libcore/slice/mod.rs:2791:10
stack backtrace:
   0: backtrace::backtrace::libunwind::trace
             at /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.40/src/backtrace/libunwind.rs:88
   1: backtrace::backtrace::trace_unsynchronized
             at /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.40/src/backtrace/mod.rs:66
   2: std::sys_common::backtrace::_print_fmt
             at src/libstd/sys_common/backtrace.rs:77
   3: <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt
             at src/libstd/sys_common/backtrace.rs:59
   4: core::fmt::write
             at src/libcore/fmt/mod.rs:1057
   5: std::io::Write::write_fmt
             at src/libstd/io/mod.rs:1426
   6: std::sys_common::backtrace::_print
             at src/libstd/sys_common/backtrace.rs:62
   7: std::sys_common::backtrace::print
             at src/libstd/sys_common/backtrace.rs:49
   8: std::panicking::default_hook::{{closure}}
             at src/libstd/panicking.rs:195
   9: std::panicking::default_hook
             at src/libstd/panicking.rs:215
  10: rustc_driver::report_ice
  11: std::panicking::rust_panic_with_hook
             at src/libstd/panicking.rs:476
  12: rust_begin_unwind
             at src/libstd/panicking.rs:376
  13: core::panicking::panic_fmt
             at src/libcore/panicking.rs:84
  14: core::panicking::panic_bounds_check
             at src/libcore/panicking.rs:62
  15: rustc::ty::Generics::type_param
  16: rustc::ty::error::<impl rustc::ty::context::TyCtxt>::note_and_explain_type_err
  17: rustc::infer::error_reporting::<impl rustc::infer::InferCtxt>::note_type_err
  18: rustc::infer::error_reporting::<impl rustc::infer::InferCtxt>::report_and_explain_type_error
  19: rustc::infer::InferCtxt::report_mismatched_types
  20: rustc_typeck::check::demand::<impl rustc_typeck::check::FnCtxt>::demand_coerce_diag
  21: rustc_typeck::check::demand::<impl rustc_typeck::check::FnCtxt>::demand_coerce
  22: rustc_typeck::check::FnCtxt::check_decl_local
  23: rustc_typeck::check::FnCtxt::check_stmt
  24: rustc_typeck::check::FnCtxt::check_block_with_expected
  25: rustc_typeck::check::expr::<impl rustc_typeck::check::FnCtxt>::check_expr_kind
  26: rustc_typeck::check::expr::<impl rustc_typeck::check::FnCtxt>::check_expr_with_expectation_and_needs
  27: rustc::ty::context::tls::with_context::{{closure}}
  28: rustc_typeck::check::typeck_tables_of
  29: rustc::ty::query::__query_compute::typeck_tables_of
  30: rustc::ty::query::<impl rustc::ty::query::config::QueryAccessors for rustc::ty::query::queries::typeck_tables_of>::compute
  31: rustc::dep_graph::graph::DepGraph::with_task_impl
  32: rustc::ty::query::plumbing::<impl rustc::ty::context::TyCtxt>::get_query
  33: rustc_mir::const_eval::eval_queries::const_eval_raw_provider
  34: rustc::ty::query::__query_compute::const_eval_raw
  35: rustc::ty::query::<impl rustc::ty::query::config::QueryAccessors for rustc::ty::query::queries::const_eval_raw>::compute
  36: rustc::dep_graph::graph::DepGraph::with_task_impl
  37: rustc::ty::query::plumbing::<impl rustc::ty::context::TyCtxt>::get_query
  38: rustc_mir::const_eval::eval_queries::const_eval_validated_provider
  39: rustc::ty::query::__query_compute::const_eval_validated
  40: rustc::ty::query::<impl rustc::ty::query::config::QueryAccessors for rustc::ty::query::queries::const_eval_validated>::compute
  41: rustc::dep_graph::graph::DepGraph::with_task_impl
  42: rustc::ty::query::plumbing::<impl rustc::ty::context::TyCtxt>::get_query
  43: rustc_mir::const_eval::eval_queries::const_eval_validated_provider
  44: rustc::ty::query::__query_compute::const_eval_validated
  45: rustc::ty::query::<impl rustc::ty::query::config::QueryAccessors for rustc::ty::query::queries::const_eval_validated>::compute
  46: rustc::dep_graph::graph::DepGraph::with_task_impl
  47: rustc::ty::query::plumbing::<impl rustc::ty::context::TyCtxt>::get_query
  48: rustc::mir::interpret::queries::<impl rustc::ty::context::TyCtxt>::const_eval_instance
  49: rustc::ty::sty::Const::eval::{{closure}}
  50: rustc::ty::sty::Const::eval
  51: rustc::ty::structural_impls::<impl rustc::ty::fold::TypeFoldable for &rustc::ty::TyS>::super_fold_with
  52: <rustc::traits::project::AssocTypeNormalizer as rustc::ty::fold::TypeFolder>::fold_ty
  53: rustc::traits::project::normalize
  54: rustc_typeck::check::FnCtxt::normalize_associated_types_in
  55: <core::iter::adapters::Map<I,F> as core::iter::traits::iterator::Iterator>::fold
  56: rustc::ty::context::GlobalCtxt::enter_local
  57: rustc_typeck::check::wfcheck::check_item_well_formed
  58: rustc::ty::query::__query_compute::check_item_well_formed
  59: rustc::ty::query::<impl rustc::ty::query::config::QueryAccessors for rustc::ty::query::queries::check_item_well_formed>::compute
  60: rustc::dep_graph::graph::DepGraph::with_task_impl
  61: rustc::ty::query::plumbing::<impl rustc::ty::context::TyCtxt>::get_query
  62: rustc::ty::query::plumbing::<impl rustc::ty::context::TyCtxt>::ensure_query
  63: __rust_maybe_catch_panic
             at src/libpanic_unwind/lib.rs:79
  64: rustc_data_structures::sync::par_for_each_in
  65: __rust_maybe_catch_panic
             at src/libpanic_unwind/lib.rs:79
  66: rustc::hir::Crate::par_visit_all_item_likes
  67: rustc::util::common::time
  68: rustc_typeck::check_crate
  69: rustc_interface::passes::analysis
  70: rustc::ty::query::__query_compute::analysis
  71: rustc::dep_graph::graph::DepGraph::with_task_impl
  72: rustc::ty::query::plumbing::<impl rustc::ty::context::TyCtxt>::get_query
  73: rustc::ty::context::tls::enter_global
  74: rustc_interface::interface::run_compiler_in_existing_thread_pool
  75: scoped_tls::ScopedKey<T>::set
  76: syntax::with_globals
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

error: internal compiler error: unexpected panic

note: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/blob/master/CONTRIBUTING.md#bug-reports

note: rustc 1.42.0-nightly (da3629b05 2019-12-29) running on x86_64-unknown-linux-gnu

note: compiler flags: -C codegen-units=1 -C debuginfo=2 --crate-type lib

note: some of the compiler flags provided by cargo are hidden

query stack during panic:
#0 [typeck_tables_of] processing `Bug::A::{{constant}}#0`
#1 [const_eval_raw] const-evaluating `Bug::A::{{constant}}#0`
#2 [const_eval_validated] const-evaluating + checking `Bug::A::{{constant}}#0`
#3 [const_eval_validated] const-evaluating + checking `Bug::A::{{constant}}#0`
#4 [check_item_well_formed] processing `Bug`
#5 [analysis] running analysis passes on this crate
end of query stack
error: could not compile `playground`.

To learn more, run the command again with --verbose.

[Centril]

Reduced:

enum Bug<S> {
    Var = {
        let x: S = 0;
        0
    },
}

ICE most likely occurs in:

https://github.com/rust-lang/rust/blob/ebbb2bf37aedaaa64dfaa52ba337ca6efb6b9093/src/librustc/ty/mod.rs#L978

I cannot seem to reproduce this without an AnonConst, so cc @varkor.

[Centril]

Reduced even more:

#![feature(type_ascription)]

enum Bug<S> {
    Var = 0: S,
}

(Please include all 3 variants thus far in a regression test.)

[davidtwco]

I looked into this briefly and found that on this line:

https://github.com/rust-lang/rust/blob/ebbb2bf37aedaaa64dfaa52ba337ca6efb6b9093/src/librustc/ty/mod.rs#L978

...that self has the value:

Generics { parent: None, parent_count: 0, params: [], param_def_id_to_index: {}, has_self: false, has_late_bound_regions: None }

Digging a bit deeper, the generics appear to be empty because of the following lines:

https://github.com/rust-lang/rust/blob/ebbb2bf37aedaaa64dfaa52ba337ca6efb6b9093/src/librustc_typeck/collect.rs#L1006-L1017

I can confirm that adding #![feature(const_generics)] makes this code compile, so I suspect that this is blocked on #43408.

[estebank]

What would be the consequences of always returning the DefId?

[varkor]

What would be the consequences of always returning the DefId?

It causes query cycle errors at the moment.

[pnkfelix]

Discussed at T-compiler meeting. Due to all the known examples being compile-time errors, the ICE here does not seem so strong a hazard as to warrant weekly visits during triage.

(Certainly failing more gracefully would be great. But its not something we're going to e.g. block a release on.)

Downgrading priority to P-medium.

[nikomatsakis]

Some relevant examples. This gives an (incorrect) error on stable that S: Sized does not hold:

use std::marker::PhantomData;

use std::mem::{self, MaybeUninit};

struct Bug<S> {
    A: [(); {
        let x: Option<S> = None;
        0
    }],
}

This ICEs on stable:

use std::marker::PhantomData;

use std::mem::{self, MaybeUninit};

struct Bug<S> {
    A: [(); {
        let x: Option<Box<S>> = None;
        0
    }],
}

[skinny121]

Is there a reason why we can't just disallow type parameters from appearing within constants during resolve, like we do for type parameters from outer functions? Obviously const generics/lazy normization willl loosen this rule.

[nikomatsakis]

@skinny121 good point, I imagine that might work.

[skinny121]

Another variant on this bug:

struct Bug<S:?Sized> {
    A: [(); {
        let x: Option<Box<Self>> = None;
        0
    }],
    B: S
}

[JohnTitor]

Triage: The two examples that Centril posted (https://github.com/rust-lang/rust/issues/67945#issuecomment-571251334 and https://github.com/rust-lang/rust/issues/67945#issuecomment-571252306) are no longer ICEs in the latest nightly. Possibly related to #70825?

[nikomatsakis]

Maybe we should just add tests then?

[JohnTitor]

Maybe we should just add tests then?

Sounds good! I'll do later.

[varkor]

Another variant (though likely the same):

use std::mem::MaybeUninit;

struct Bug<S> {
    A: [(); {
        let x: S = MaybeUninit::uninit();
        let b = &*(&x as *const _ as *const S);
        0
    }],
}

This gives a different to the original, despite being essentially the same code.