rustc_mir_transform/
validate.rs

1//! Validates the MIR to ensure that invariants are upheld.
2
3use rustc_abi::{ExternAbi, FIRST_VARIANT, Size};
4use rustc_data_structures::fx::{FxHashMap, FxHashSet};
5use rustc_hir::LangItem;
6use rustc_hir::attrs::InlineAttr;
7use rustc_index::IndexVec;
8use rustc_index::bit_set::DenseBitSet;
9use rustc_infer::infer::TyCtxtInferExt;
10use rustc_infer::traits::{Obligation, ObligationCause};
11use rustc_middle::mir::coverage::CoverageKind;
12use rustc_middle::mir::visit::{NonUseContext, PlaceContext, Visitor};
13use rustc_middle::mir::*;
14use rustc_middle::ty::adjustment::PointerCoercion;
15use rustc_middle::ty::print::with_no_trimmed_paths;
16use rustc_middle::ty::{
17    self, CoroutineArgsExt, InstanceKind, ScalarInt, Ty, TyCtxt, TypeVisitableExt, Upcast, Variance,
18};
19use rustc_middle::{bug, span_bug};
20use rustc_trait_selection::traits::ObligationCtxt;
21
22use crate::util::{self, is_within_packed};
23
24#[derive(Copy, Clone, Debug, PartialEq, Eq)]
25enum EdgeKind {
26    Unwind,
27    Normal,
28}
29
30pub(super) struct Validator {
31    /// Describes at which point in the pipeline this validation is happening.
32    pub when: String,
33}
34
35impl<'tcx> crate::MirPass<'tcx> for Validator {
36    fn run_pass(&self, tcx: TyCtxt<'tcx>, body: &mut Body<'tcx>) {
37        // FIXME(JakobDegen): These bodies never instantiated in codegend anyway, so it's not
38        // terribly important that they pass the validator. However, I think other passes might
39        // still see them, in which case they might be surprised. It would probably be better if we
40        // didn't put this through the MIR pipeline at all.
41        if matches!(body.source.instance, InstanceKind::Intrinsic(..) | InstanceKind::Virtual(..)) {
42            return;
43        }
44        let def_id = body.source.def_id();
45        let typing_env = body.typing_env(tcx);
46        let can_unwind = if body.phase <= MirPhase::Runtime(RuntimePhase::Initial) {
47            // In this case `AbortUnwindingCalls` haven't yet been executed.
48            true
49        } else if !tcx.def_kind(def_id).is_fn_like() {
50            true
51        } else {
52            let body_ty = tcx.type_of(def_id).skip_binder();
53            let body_abi = match body_ty.kind() {
54                ty::FnDef(..) => body_ty.fn_sig(tcx).abi(),
55                ty::Closure(..) => ExternAbi::RustCall,
56                ty::CoroutineClosure(..) => ExternAbi::RustCall,
57                ty::Coroutine(..) => ExternAbi::Rust,
58                // No need to do MIR validation on error bodies
59                ty::Error(_) => return,
60                _ => span_bug!(body.span, "unexpected body ty: {body_ty}"),
61            };
62
63            ty::layout::fn_can_unwind(tcx, Some(def_id), body_abi)
64        };
65
66        let mut cfg_checker = CfgChecker {
67            when: &self.when,
68            body,
69            tcx,
70            unwind_edge_count: 0,
71            reachable_blocks: traversal::reachable_as_bitset(body),
72            value_cache: FxHashSet::default(),
73            can_unwind,
74        };
75        cfg_checker.visit_body(body);
76        cfg_checker.check_cleanup_control_flow();
77
78        // Also run the TypeChecker.
79        for (location, msg) in validate_types(tcx, typing_env, body, body) {
80            cfg_checker.fail(location, msg);
81        }
82
83        if let MirPhase::Runtime(_) = body.phase
84            && let ty::InstanceKind::Item(_) = body.source.instance
85            && body.has_free_regions()
86        {
87            cfg_checker.fail(
88                Location::START,
89                format!("Free regions in optimized {} MIR", body.phase.name()),
90            );
91        }
92    }
93
94    fn is_required(&self) -> bool {
95        true
96    }
97}
98
99/// This checker covers basic properties of the control-flow graph, (dis)allowed statements and terminators.
100/// Everything checked here must be stable under substitution of generic parameters. In other words,
101/// this is about the *structure* of the MIR, not the *contents*.
102///
103/// Everything that depends on types, or otherwise can be affected by generic parameters,
104/// must be checked in `TypeChecker`.
105struct CfgChecker<'a, 'tcx> {
106    when: &'a str,
107    body: &'a Body<'tcx>,
108    tcx: TyCtxt<'tcx>,
109    unwind_edge_count: usize,
110    reachable_blocks: DenseBitSet<BasicBlock>,
111    value_cache: FxHashSet<u128>,
112    // If `false`, then the MIR must not contain `UnwindAction::Continue` or
113    // `TerminatorKind::Resume`.
114    can_unwind: bool,
115}
116
117impl<'a, 'tcx> CfgChecker<'a, 'tcx> {
118    #[track_caller]
119    fn fail(&self, location: Location, msg: impl AsRef<str>) {
120        // We might see broken MIR when other errors have already occurred.
121        if self.tcx.dcx().has_errors().is_none() {
122            span_bug!(
123                self.body.source_info(location).span,
124                "broken MIR in {:?} ({}) at {:?}:\n{}",
125                self.body.source.instance,
126                self.when,
127                location,
128                msg.as_ref(),
129            );
130        }
131    }
132
133    fn check_edge(&mut self, location: Location, bb: BasicBlock, edge_kind: EdgeKind) {
134        if bb == START_BLOCK {
135            self.fail(location, "start block must not have predecessors")
136        }
137        if let Some(bb) = self.body.basic_blocks.get(bb) {
138            let src = self.body.basic_blocks.get(location.block).unwrap();
139            match (src.is_cleanup, bb.is_cleanup, edge_kind) {
140                // Non-cleanup blocks can jump to non-cleanup blocks along non-unwind edges
141                (false, false, EdgeKind::Normal)
142                // Cleanup blocks can jump to cleanup blocks along non-unwind edges
143                | (true, true, EdgeKind::Normal) => {}
144                // Non-cleanup blocks can jump to cleanup blocks along unwind edges
145                (false, true, EdgeKind::Unwind) => {
146                    self.unwind_edge_count += 1;
147                }
148                // All other jumps are invalid
149                _ => {
150                    self.fail(
151                        location,
152                        format!(
153                            "{:?} edge to {:?} violates unwind invariants (cleanup {:?} -> {:?})",
154                            edge_kind,
155                            bb,
156                            src.is_cleanup,
157                            bb.is_cleanup,
158                        )
159                    )
160                }
161            }
162        } else {
163            self.fail(location, format!("encountered jump to invalid basic block {bb:?}"))
164        }
165    }
166
167    fn check_cleanup_control_flow(&self) {
168        if self.unwind_edge_count <= 1 {
169            return;
170        }
171        let doms = self.body.basic_blocks.dominators();
172        let mut post_contract_node = FxHashMap::default();
173        // Reusing the allocation across invocations of the closure
174        let mut dom_path = vec![];
175        let mut get_post_contract_node = |mut bb| {
176            let root = loop {
177                if let Some(root) = post_contract_node.get(&bb) {
178                    break *root;
179                }
180                let parent = doms.immediate_dominator(bb).unwrap();
181                dom_path.push(bb);
182                if !self.body.basic_blocks[parent].is_cleanup {
183                    break bb;
184                }
185                bb = parent;
186            };
187            for bb in dom_path.drain(..) {
188                post_contract_node.insert(bb, root);
189            }
190            root
191        };
192
193        let mut parent = IndexVec::from_elem(None, &self.body.basic_blocks);
194        for (bb, bb_data) in self.body.basic_blocks.iter_enumerated() {
195            if !bb_data.is_cleanup || !self.reachable_blocks.contains(bb) {
196                continue;
197            }
198            let bb = get_post_contract_node(bb);
199            for s in bb_data.terminator().successors() {
200                let s = get_post_contract_node(s);
201                if s == bb {
202                    continue;
203                }
204                let parent = &mut parent[bb];
205                match parent {
206                    None => {
207                        *parent = Some(s);
208                    }
209                    Some(e) if *e == s => (),
210                    Some(e) => self.fail(
211                        Location { block: bb, statement_index: 0 },
212                        format!(
213                            "Cleanup control flow violation: The blocks dominated by {:?} have edges to both {:?} and {:?}",
214                            bb,
215                            s,
216                            *e
217                        )
218                    ),
219                }
220            }
221        }
222
223        // Check for cycles
224        let mut stack = FxHashSet::default();
225        for (mut bb, parent) in parent.iter_enumerated_mut() {
226            stack.clear();
227            stack.insert(bb);
228            loop {
229                let Some(parent) = parent.take() else { break };
230                let no_cycle = stack.insert(parent);
231                if !no_cycle {
232                    self.fail(
233                        Location { block: bb, statement_index: 0 },
234                        format!(
235                            "Cleanup control flow violation: Cycle involving edge {bb:?} -> {parent:?}",
236                        ),
237                    );
238                    break;
239                }
240                bb = parent;
241            }
242        }
243    }
244
245    fn check_unwind_edge(&mut self, location: Location, unwind: UnwindAction) {
246        let is_cleanup = self.body.basic_blocks[location.block].is_cleanup;
247        match unwind {
248            UnwindAction::Cleanup(unwind) => {
249                if is_cleanup {
250                    self.fail(location, "`UnwindAction::Cleanup` in cleanup block");
251                }
252                self.check_edge(location, unwind, EdgeKind::Unwind);
253            }
254            UnwindAction::Continue => {
255                if is_cleanup {
256                    self.fail(location, "`UnwindAction::Continue` in cleanup block");
257                }
258
259                if !self.can_unwind {
260                    self.fail(location, "`UnwindAction::Continue` in no-unwind function");
261                }
262            }
263            UnwindAction::Terminate(UnwindTerminateReason::InCleanup) => {
264                if !is_cleanup {
265                    self.fail(
266                        location,
267                        "`UnwindAction::Terminate(InCleanup)` in a non-cleanup block",
268                    );
269                }
270            }
271            // These are allowed everywhere.
272            UnwindAction::Unreachable | UnwindAction::Terminate(UnwindTerminateReason::Abi) => (),
273        }
274    }
275
276    fn is_critical_call_edge(&self, target: Option<BasicBlock>, unwind: UnwindAction) -> bool {
277        let Some(target) = target else { return false };
278        matches!(unwind, UnwindAction::Cleanup(_) | UnwindAction::Terminate(_))
279            && self.body.basic_blocks.predecessors()[target].len() > 1
280    }
281}
282
283impl<'a, 'tcx> Visitor<'tcx> for CfgChecker<'a, 'tcx> {
284    fn visit_local(&mut self, local: Local, _context: PlaceContext, location: Location) {
285        if self.body.local_decls.get(local).is_none() {
286            self.fail(
287                location,
288                format!("local {local:?} has no corresponding declaration in `body.local_decls`"),
289            );
290        }
291    }
292
293    fn visit_statement(&mut self, statement: &Statement<'tcx>, location: Location) {
294        match &statement.kind {
295            StatementKind::AscribeUserType(..) => {
296                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
297                    self.fail(
298                        location,
299                        "`AscribeUserType` should have been removed after drop lowering phase",
300                    );
301                }
302            }
303            StatementKind::FakeRead(..) => {
304                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
305                    self.fail(
306                        location,
307                        "`FakeRead` should have been removed after drop lowering phase",
308                    );
309                }
310            }
311            StatementKind::SetDiscriminant { .. } => {
312                if self.body.phase < MirPhase::Runtime(RuntimePhase::Initial) {
313                    self.fail(location, "`SetDiscriminant`is not allowed until deaggregation");
314                }
315            }
316            StatementKind::Deinit(..) => {
317                if self.body.phase < MirPhase::Runtime(RuntimePhase::Initial) {
318                    self.fail(location, "`Deinit`is not allowed until deaggregation");
319                }
320            }
321            StatementKind::Retag(kind, _) => {
322                // FIXME(JakobDegen) The validator should check that `self.body.phase <
323                // DropsLowered`. However, this causes ICEs with generation of drop shims, which
324                // seem to fail to set their `MirPhase` correctly.
325                if matches!(kind, RetagKind::TwoPhase) {
326                    self.fail(location, format!("explicit `{kind:?}` is forbidden"));
327                }
328            }
329            StatementKind::Coverage(kind) => {
330                if self.body.phase >= MirPhase::Analysis(AnalysisPhase::PostCleanup)
331                    && let CoverageKind::BlockMarker { .. } | CoverageKind::SpanMarker { .. } = kind
332                {
333                    self.fail(
334                        location,
335                        format!("{kind:?} should have been removed after analysis"),
336                    );
337                }
338            }
339            StatementKind::Assign(..)
340            | StatementKind::StorageLive(_)
341            | StatementKind::StorageDead(_)
342            | StatementKind::Intrinsic(_)
343            | StatementKind::ConstEvalCounter
344            | StatementKind::PlaceMention(..)
345            | StatementKind::BackwardIncompatibleDropHint { .. }
346            | StatementKind::Nop => {}
347        }
348
349        self.super_statement(statement, location);
350    }
351
352    fn visit_terminator(&mut self, terminator: &Terminator<'tcx>, location: Location) {
353        match &terminator.kind {
354            TerminatorKind::Goto { target } => {
355                self.check_edge(location, *target, EdgeKind::Normal);
356            }
357            TerminatorKind::SwitchInt { targets, discr: _ } => {
358                for (_, target) in targets.iter() {
359                    self.check_edge(location, target, EdgeKind::Normal);
360                }
361                self.check_edge(location, targets.otherwise(), EdgeKind::Normal);
362
363                self.value_cache.clear();
364                self.value_cache.extend(targets.iter().map(|(value, _)| value));
365                let has_duplicates = targets.iter().len() != self.value_cache.len();
366                if has_duplicates {
367                    self.fail(
368                        location,
369                        format!(
370                            "duplicated values in `SwitchInt` terminator: {:?}",
371                            terminator.kind,
372                        ),
373                    );
374                }
375            }
376            TerminatorKind::Drop { target, unwind, drop, .. } => {
377                self.check_edge(location, *target, EdgeKind::Normal);
378                self.check_unwind_edge(location, *unwind);
379                if let Some(drop) = drop {
380                    self.check_edge(location, *drop, EdgeKind::Normal);
381                }
382            }
383            TerminatorKind::Call { func, args, .. }
384            | TerminatorKind::TailCall { func, args, .. } => {
385                // FIXME(explicit_tail_calls): refactor this & add tail-call specific checks
386                if let TerminatorKind::Call { target, unwind, destination, .. } = terminator.kind {
387                    if let Some(target) = target {
388                        self.check_edge(location, target, EdgeKind::Normal);
389                    }
390                    self.check_unwind_edge(location, unwind);
391
392                    // The code generation assumes that there are no critical call edges. The
393                    // assumption is used to simplify inserting code that should be executed along
394                    // the return edge from the call. FIXME(tmiasko): Since this is a strictly code
395                    // generation concern, the code generation should be responsible for handling
396                    // it.
397                    if self.body.phase >= MirPhase::Runtime(RuntimePhase::Optimized)
398                        && self.is_critical_call_edge(target, unwind)
399                    {
400                        self.fail(
401                            location,
402                            format!(
403                                "encountered critical edge in `Call` terminator {:?}",
404                                terminator.kind,
405                            ),
406                        );
407                    }
408
409                    // The call destination place and Operand::Move place used as an argument might
410                    // be passed by a reference to the callee. Consequently they cannot be packed.
411                    if is_within_packed(self.tcx, &self.body.local_decls, destination).is_some() {
412                        // This is bad! The callee will expect the memory to be aligned.
413                        self.fail(
414                            location,
415                            format!(
416                                "encountered packed place in `Call` terminator destination: {:?}",
417                                terminator.kind,
418                            ),
419                        );
420                    }
421                }
422
423                for arg in args {
424                    if let Operand::Move(place) = &arg.node {
425                        if is_within_packed(self.tcx, &self.body.local_decls, *place).is_some() {
426                            // This is bad! The callee will expect the memory to be aligned.
427                            self.fail(
428                                location,
429                                format!(
430                                    "encountered `Move` of a packed place in `Call` terminator: {:?}",
431                                    terminator.kind,
432                                ),
433                            );
434                        }
435                    }
436                }
437
438                if let ty::FnDef(did, ..) = func.ty(&self.body.local_decls, self.tcx).kind()
439                    && self.body.phase >= MirPhase::Runtime(RuntimePhase::Optimized)
440                    && matches!(self.tcx.codegen_fn_attrs(did).inline, InlineAttr::Force { .. })
441                {
442                    self.fail(location, "`#[rustc_force_inline]`-annotated function not inlined");
443                }
444            }
445            TerminatorKind::Assert { target, unwind, .. } => {
446                self.check_edge(location, *target, EdgeKind::Normal);
447                self.check_unwind_edge(location, *unwind);
448            }
449            TerminatorKind::Yield { resume, drop, .. } => {
450                if self.body.coroutine.is_none() {
451                    self.fail(location, "`Yield` cannot appear outside coroutine bodies");
452                }
453                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
454                    self.fail(location, "`Yield` should have been replaced by coroutine lowering");
455                }
456                self.check_edge(location, *resume, EdgeKind::Normal);
457                if let Some(drop) = drop {
458                    self.check_edge(location, *drop, EdgeKind::Normal);
459                }
460            }
461            TerminatorKind::FalseEdge { real_target, imaginary_target } => {
462                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
463                    self.fail(
464                        location,
465                        "`FalseEdge` should have been removed after drop elaboration",
466                    );
467                }
468                self.check_edge(location, *real_target, EdgeKind::Normal);
469                self.check_edge(location, *imaginary_target, EdgeKind::Normal);
470            }
471            TerminatorKind::FalseUnwind { real_target, unwind } => {
472                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
473                    self.fail(
474                        location,
475                        "`FalseUnwind` should have been removed after drop elaboration",
476                    );
477                }
478                self.check_edge(location, *real_target, EdgeKind::Normal);
479                self.check_unwind_edge(location, *unwind);
480            }
481            TerminatorKind::InlineAsm { targets, unwind, .. } => {
482                for &target in targets {
483                    self.check_edge(location, target, EdgeKind::Normal);
484                }
485                self.check_unwind_edge(location, *unwind);
486            }
487            TerminatorKind::CoroutineDrop => {
488                if self.body.coroutine.is_none() {
489                    self.fail(location, "`CoroutineDrop` cannot appear outside coroutine bodies");
490                }
491                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
492                    self.fail(
493                        location,
494                        "`CoroutineDrop` should have been replaced by coroutine lowering",
495                    );
496                }
497            }
498            TerminatorKind::UnwindResume => {
499                let bb = location.block;
500                if !self.body.basic_blocks[bb].is_cleanup {
501                    self.fail(location, "Cannot `UnwindResume` from non-cleanup basic block")
502                }
503                if !self.can_unwind {
504                    self.fail(location, "Cannot `UnwindResume` in a function that cannot unwind")
505                }
506            }
507            TerminatorKind::UnwindTerminate(_) => {
508                let bb = location.block;
509                if !self.body.basic_blocks[bb].is_cleanup {
510                    self.fail(location, "Cannot `UnwindTerminate` from non-cleanup basic block")
511                }
512            }
513            TerminatorKind::Return => {
514                let bb = location.block;
515                if self.body.basic_blocks[bb].is_cleanup {
516                    self.fail(location, "Cannot `Return` from cleanup basic block")
517                }
518            }
519            TerminatorKind::Unreachable => {}
520        }
521
522        self.super_terminator(terminator, location);
523    }
524
525    fn visit_source_scope(&mut self, scope: SourceScope) {
526        if self.body.source_scopes.get(scope).is_none() {
527            self.tcx.dcx().span_bug(
528                self.body.span,
529                format!(
530                    "broken MIR in {:?} ({}):\ninvalid source scope {:?}",
531                    self.body.source.instance, self.when, scope,
532                ),
533            );
534        }
535    }
536}
537
538/// A faster version of the validation pass that only checks those things which may break when
539/// instantiating any generic parameters.
540///
541/// `caller_body` is used to detect cycles in MIR inlining and MIR validation before
542/// `optimized_mir` is available.
543pub(super) fn validate_types<'tcx>(
544    tcx: TyCtxt<'tcx>,
545    typing_env: ty::TypingEnv<'tcx>,
546    body: &Body<'tcx>,
547    caller_body: &Body<'tcx>,
548) -> Vec<(Location, String)> {
549    let mut type_checker = TypeChecker { body, caller_body, tcx, typing_env, failures: Vec::new() };
550    // The type checker formats a bunch of strings with type names in it, but these strings
551    // are not always going to be encountered on the error path since the inliner also uses
552    // the validator, and there are certain kinds of inlining (even for valid code) that
553    // can cause validation errors (mostly around where clauses and rigid projections).
554    with_no_trimmed_paths!({
555        type_checker.visit_body(body);
556    });
557    type_checker.failures
558}
559
560struct TypeChecker<'a, 'tcx> {
561    body: &'a Body<'tcx>,
562    caller_body: &'a Body<'tcx>,
563    tcx: TyCtxt<'tcx>,
564    typing_env: ty::TypingEnv<'tcx>,
565    failures: Vec<(Location, String)>,
566}
567
568impl<'a, 'tcx> TypeChecker<'a, 'tcx> {
569    fn fail(&mut self, location: Location, msg: impl Into<String>) {
570        self.failures.push((location, msg.into()));
571    }
572
573    /// Check if src can be assigned into dest.
574    /// This is not precise, it will accept some incorrect assignments.
575    fn mir_assign_valid_types(&self, src: Ty<'tcx>, dest: Ty<'tcx>) -> bool {
576        // Fast path before we normalize.
577        if src == dest {
578            // Equal types, all is good.
579            return true;
580        }
581
582        // We sometimes have to use `defining_opaque_types` for subtyping
583        // to succeed here and figuring out how exactly that should work
584        // is annoying. It is harmless enough to just not validate anything
585        // in that case. We still check this after analysis as all opaque
586        // types have been revealed at this point.
587        if (src, dest).has_opaque_types() {
588            return true;
589        }
590
591        // After borrowck subtyping should be fully explicit via
592        // `Subtype` projections.
593        let variance = if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
594            Variance::Invariant
595        } else {
596            Variance::Covariant
597        };
598
599        crate::util::relate_types(self.tcx, self.typing_env, variance, src, dest)
600    }
601
602    /// Check that the given predicate definitely holds in the param-env of this MIR body.
603    fn predicate_must_hold_modulo_regions(
604        &self,
605        pred: impl Upcast<TyCtxt<'tcx>, ty::Predicate<'tcx>>,
606    ) -> bool {
607        let pred: ty::Predicate<'tcx> = pred.upcast(self.tcx);
608
609        // We sometimes have to use `defining_opaque_types` for predicates
610        // to succeed here and figuring out how exactly that should work
611        // is annoying. It is harmless enough to just not validate anything
612        // in that case. We still check this after analysis as all opaque
613        // types have been revealed at this point.
614        if pred.has_opaque_types() {
615            return true;
616        }
617
618        let (infcx, param_env) = self.tcx.infer_ctxt().build_with_typing_env(self.typing_env);
619        let ocx = ObligationCtxt::new(&infcx);
620        ocx.register_obligation(Obligation::new(
621            self.tcx,
622            ObligationCause::dummy(),
623            param_env,
624            pred,
625        ));
626        ocx.evaluate_obligations_error_on_ambiguity().is_empty()
627    }
628}
629
630impl<'a, 'tcx> Visitor<'tcx> for TypeChecker<'a, 'tcx> {
631    fn visit_operand(&mut self, operand: &Operand<'tcx>, location: Location) {
632        // This check is somewhat expensive, so only run it when -Zvalidate-mir is passed.
633        if self.tcx.sess.opts.unstable_opts.validate_mir
634            && self.body.phase < MirPhase::Runtime(RuntimePhase::Initial)
635        {
636            // `Operand::Copy` is only supposed to be used with `Copy` types.
637            if let Operand::Copy(place) = operand {
638                let ty = place.ty(&self.body.local_decls, self.tcx).ty;
639
640                if !self.tcx.type_is_copy_modulo_regions(self.typing_env, ty) {
641                    self.fail(location, format!("`Operand::Copy` with non-`Copy` type {ty}"));
642                }
643            }
644        }
645
646        self.super_operand(operand, location);
647    }
648
649    fn visit_projection_elem(
650        &mut self,
651        place_ref: PlaceRef<'tcx>,
652        elem: PlaceElem<'tcx>,
653        context: PlaceContext,
654        location: Location,
655    ) {
656        match elem {
657            ProjectionElem::OpaqueCast(ty)
658                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) =>
659            {
660                self.fail(
661                    location,
662                    format!("explicit opaque type cast to `{ty}` after `PostAnalysisNormalize`"),
663                )
664            }
665            ProjectionElem::Index(index) => {
666                let index_ty = self.body.local_decls[index].ty;
667                if index_ty != self.tcx.types.usize {
668                    self.fail(location, format!("bad index ({index_ty} != usize)"))
669                }
670            }
671            ProjectionElem::Deref
672                if self.body.phase >= MirPhase::Runtime(RuntimePhase::PostCleanup) =>
673            {
674                let base_ty = place_ref.ty(&self.body.local_decls, self.tcx).ty;
675
676                if base_ty.is_box() {
677                    self.fail(location, format!("{base_ty} dereferenced after ElaborateBoxDerefs"))
678                }
679            }
680            ProjectionElem::Field(f, ty) => {
681                let parent_ty = place_ref.ty(&self.body.local_decls, self.tcx);
682                let fail_out_of_bounds = |this: &mut Self, location| {
683                    this.fail(location, format!("Out of bounds field {f:?} for {parent_ty:?}"));
684                };
685                let check_equal = |this: &mut Self, location, f_ty| {
686                    if !this.mir_assign_valid_types(ty, f_ty) {
687                        this.fail(
688                            location,
689                            format!(
690                                "Field projection `{place_ref:?}.{f:?}` specified type `{ty}`, but actual type is `{f_ty}`"
691                            )
692                        )
693                    }
694                };
695
696                let kind = match parent_ty.ty.kind() {
697                    &ty::Alias(ty::Opaque, ty::AliasTy { def_id, args, .. }) => {
698                        self.tcx.type_of(def_id).instantiate(self.tcx, args).kind()
699                    }
700                    kind => kind,
701                };
702
703                match kind {
704                    ty::Tuple(fields) => {
705                        let Some(f_ty) = fields.get(f.as_usize()) else {
706                            fail_out_of_bounds(self, location);
707                            return;
708                        };
709                        check_equal(self, location, *f_ty);
710                    }
711                    ty::Adt(adt_def, args) => {
712                        // see <https://github.com/rust-lang/rust/blob/7601adcc764d42c9f2984082b49948af652df986/compiler/rustc_middle/src/ty/layout.rs#L861-L864>
713                        if self.tcx.is_lang_item(adt_def.did(), LangItem::DynMetadata) {
714                            self.fail(
715                                location,
716                                format!(
717                                    "You can't project to field {f:?} of `DynMetadata` because \
718                                     layout is weird and thinks it doesn't have fields."
719                                ),
720                            );
721                        }
722
723                        if adt_def.repr().simd() {
724                            self.fail(
725                                location,
726                                format!(
727                                    "Projecting into SIMD type {adt_def:?} is banned by MCP#838"
728                                ),
729                            );
730                        }
731
732                        let var = parent_ty.variant_index.unwrap_or(FIRST_VARIANT);
733                        let Some(field) = adt_def.variant(var).fields.get(f) else {
734                            fail_out_of_bounds(self, location);
735                            return;
736                        };
737                        check_equal(self, location, field.ty(self.tcx, args));
738                    }
739                    ty::Closure(_, args) => {
740                        let args = args.as_closure();
741                        let Some(&f_ty) = args.upvar_tys().get(f.as_usize()) else {
742                            fail_out_of_bounds(self, location);
743                            return;
744                        };
745                        check_equal(self, location, f_ty);
746                    }
747                    ty::CoroutineClosure(_, args) => {
748                        let args = args.as_coroutine_closure();
749                        let Some(&f_ty) = args.upvar_tys().get(f.as_usize()) else {
750                            fail_out_of_bounds(self, location);
751                            return;
752                        };
753                        check_equal(self, location, f_ty);
754                    }
755                    &ty::Coroutine(def_id, args) => {
756                        let f_ty = if let Some(var) = parent_ty.variant_index {
757                            // If we're currently validating an inlined copy of this body,
758                            // then it will no longer be parameterized over the original
759                            // args of the coroutine. Otherwise, we prefer to use this body
760                            // since we may be in the process of computing this MIR in the
761                            // first place.
762                            let layout = if def_id == self.caller_body.source.def_id() {
763                                self.caller_body
764                                    .coroutine_layout_raw()
765                                    .or_else(|| self.tcx.coroutine_layout(def_id, args).ok())
766                            } else if self.tcx.needs_coroutine_by_move_body_def_id(def_id)
767                                && let ty::ClosureKind::FnOnce =
768                                    args.as_coroutine().kind_ty().to_opt_closure_kind().unwrap()
769                                && self.caller_body.source.def_id()
770                                    == self.tcx.coroutine_by_move_body_def_id(def_id)
771                            {
772                                // Same if this is the by-move body of a coroutine-closure.
773                                self.caller_body.coroutine_layout_raw()
774                            } else {
775                                self.tcx.coroutine_layout(def_id, args).ok()
776                            };
777
778                            let Some(layout) = layout else {
779                                self.fail(
780                                    location,
781                                    format!("No coroutine layout for {parent_ty:?}"),
782                                );
783                                return;
784                            };
785
786                            let Some(&local) = layout.variant_fields[var].get(f) else {
787                                fail_out_of_bounds(self, location);
788                                return;
789                            };
790
791                            let Some(f_ty) = layout.field_tys.get(local) else {
792                                self.fail(
793                                    location,
794                                    format!("Out of bounds local {local:?} for {parent_ty:?}"),
795                                );
796                                return;
797                            };
798
799                            ty::EarlyBinder::bind(f_ty.ty).instantiate(self.tcx, args)
800                        } else {
801                            let Some(&f_ty) = args.as_coroutine().prefix_tys().get(f.index())
802                            else {
803                                fail_out_of_bounds(self, location);
804                                return;
805                            };
806
807                            f_ty
808                        };
809
810                        check_equal(self, location, f_ty);
811                    }
812                    _ => {
813                        self.fail(location, format!("{:?} does not have fields", parent_ty.ty));
814                    }
815                }
816            }
817            ProjectionElem::UnwrapUnsafeBinder(unwrapped_ty) => {
818                let binder_ty = place_ref.ty(&self.body.local_decls, self.tcx);
819                let ty::UnsafeBinder(binder_ty) = *binder_ty.ty.kind() else {
820                    self.fail(
821                        location,
822                        format!("WrapUnsafeBinder does not produce a ty::UnsafeBinder"),
823                    );
824                    return;
825                };
826                let binder_inner_ty = self.tcx.instantiate_bound_regions_with_erased(*binder_ty);
827                if !self.mir_assign_valid_types(unwrapped_ty, binder_inner_ty) {
828                    self.fail(
829                        location,
830                        format!(
831                            "Cannot unwrap unsafe binder {binder_ty:?} into type {unwrapped_ty}"
832                        ),
833                    );
834                }
835            }
836            _ => {}
837        }
838        self.super_projection_elem(place_ref, elem, context, location);
839    }
840
841    fn visit_var_debug_info(&mut self, debuginfo: &VarDebugInfo<'tcx>) {
842        if let Some(box VarDebugInfoFragment { ty, ref projection }) = debuginfo.composite {
843            if ty.is_union() || ty.is_enum() {
844                self.fail(
845                    START_BLOCK.start_location(),
846                    format!("invalid type {ty} in debuginfo for {:?}", debuginfo.name),
847                );
848            }
849            if projection.is_empty() {
850                self.fail(
851                    START_BLOCK.start_location(),
852                    format!("invalid empty projection in debuginfo for {:?}", debuginfo.name),
853                );
854            }
855            if projection.iter().any(|p| !matches!(p, PlaceElem::Field(..))) {
856                self.fail(
857                    START_BLOCK.start_location(),
858                    format!(
859                        "illegal projection {:?} in debuginfo for {:?}",
860                        projection, debuginfo.name
861                    ),
862                );
863            }
864        }
865        match debuginfo.value {
866            VarDebugInfoContents::Const(_) => {}
867            VarDebugInfoContents::Place(place) => {
868                if place.projection.iter().any(|p| !p.can_use_in_debuginfo()) {
869                    self.fail(
870                        START_BLOCK.start_location(),
871                        format!("illegal place {:?} in debuginfo for {:?}", place, debuginfo.name),
872                    );
873                }
874            }
875        }
876        self.super_var_debug_info(debuginfo);
877    }
878
879    fn visit_place(&mut self, place: &Place<'tcx>, cntxt: PlaceContext, location: Location) {
880        // Set off any `bug!`s in the type computation code
881        let _ = place.ty(&self.body.local_decls, self.tcx);
882
883        if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial)
884            && place.projection.len() > 1
885            && cntxt != PlaceContext::NonUse(NonUseContext::VarDebugInfo)
886            && place.projection[1..].contains(&ProjectionElem::Deref)
887        {
888            self.fail(
889                location,
890                format!("place {place:?} has deref as a later projection (it is only permitted as the first projection)"),
891            );
892        }
893
894        // Ensure all downcast projections are followed by field projections.
895        let mut projections_iter = place.projection.iter();
896        while let Some(proj) = projections_iter.next() {
897            if matches!(proj, ProjectionElem::Downcast(..)) {
898                if !matches!(projections_iter.next(), Some(ProjectionElem::Field(..))) {
899                    self.fail(
900                        location,
901                        format!(
902                            "place {place:?} has `Downcast` projection not followed by `Field`"
903                        ),
904                    );
905                }
906            }
907        }
908
909        self.super_place(place, cntxt, location);
910    }
911
912    fn visit_rvalue(&mut self, rvalue: &Rvalue<'tcx>, location: Location) {
913        macro_rules! check_kinds {
914            ($t:expr, $text:literal, $typat:pat) => {
915                if !matches!(($t).kind(), $typat) {
916                    self.fail(location, format!($text, $t));
917                }
918            };
919        }
920        match rvalue {
921            Rvalue::Use(_) | Rvalue::CopyForDeref(_) => {}
922            Rvalue::Aggregate(kind, fields) => match **kind {
923                AggregateKind::Tuple => {}
924                AggregateKind::Array(dest) => {
925                    for src in fields {
926                        if !self.mir_assign_valid_types(src.ty(self.body, self.tcx), dest) {
927                            self.fail(location, "array field has the wrong type");
928                        }
929                    }
930                }
931                AggregateKind::Adt(def_id, idx, args, _, Some(field)) => {
932                    let adt_def = self.tcx.adt_def(def_id);
933                    assert!(adt_def.is_union());
934                    assert_eq!(idx, FIRST_VARIANT);
935                    let dest_ty = self.tcx.normalize_erasing_regions(
936                        self.typing_env,
937                        adt_def.non_enum_variant().fields[field].ty(self.tcx, args),
938                    );
939                    if let [field] = fields.raw.as_slice() {
940                        let src_ty = field.ty(self.body, self.tcx);
941                        if !self.mir_assign_valid_types(src_ty, dest_ty) {
942                            self.fail(location, "union field has the wrong type");
943                        }
944                    } else {
945                        self.fail(location, "unions should have one initialized field");
946                    }
947                }
948                AggregateKind::Adt(def_id, idx, args, _, None) => {
949                    let adt_def = self.tcx.adt_def(def_id);
950                    assert!(!adt_def.is_union());
951                    let variant = &adt_def.variants()[idx];
952                    if variant.fields.len() != fields.len() {
953                        self.fail(location, "adt has the wrong number of initialized fields");
954                    }
955                    for (src, dest) in std::iter::zip(fields, &variant.fields) {
956                        let dest_ty = self
957                            .tcx
958                            .normalize_erasing_regions(self.typing_env, dest.ty(self.tcx, args));
959                        if !self.mir_assign_valid_types(src.ty(self.body, self.tcx), dest_ty) {
960                            self.fail(location, "adt field has the wrong type");
961                        }
962                    }
963                }
964                AggregateKind::Closure(_, args) => {
965                    let upvars = args.as_closure().upvar_tys();
966                    if upvars.len() != fields.len() {
967                        self.fail(location, "closure has the wrong number of initialized fields");
968                    }
969                    for (src, dest) in std::iter::zip(fields, upvars) {
970                        if !self.mir_assign_valid_types(src.ty(self.body, self.tcx), dest) {
971                            self.fail(location, "closure field has the wrong type");
972                        }
973                    }
974                }
975                AggregateKind::Coroutine(_, args) => {
976                    let upvars = args.as_coroutine().upvar_tys();
977                    if upvars.len() != fields.len() {
978                        self.fail(location, "coroutine has the wrong number of initialized fields");
979                    }
980                    for (src, dest) in std::iter::zip(fields, upvars) {
981                        if !self.mir_assign_valid_types(src.ty(self.body, self.tcx), dest) {
982                            self.fail(location, "coroutine field has the wrong type");
983                        }
984                    }
985                }
986                AggregateKind::CoroutineClosure(_, args) => {
987                    let upvars = args.as_coroutine_closure().upvar_tys();
988                    if upvars.len() != fields.len() {
989                        self.fail(
990                            location,
991                            "coroutine-closure has the wrong number of initialized fields",
992                        );
993                    }
994                    for (src, dest) in std::iter::zip(fields, upvars) {
995                        if !self.mir_assign_valid_types(src.ty(self.body, self.tcx), dest) {
996                            self.fail(location, "coroutine-closure field has the wrong type");
997                        }
998                    }
999                }
1000                AggregateKind::RawPtr(pointee_ty, mutability) => {
1001                    if !matches!(self.body.phase, MirPhase::Runtime(_)) {
1002                        // It would probably be fine to support this in earlier phases, but at the
1003                        // time of writing it's only ever introduced from intrinsic lowering, so
1004                        // earlier things just `bug!` on it.
1005                        self.fail(location, "RawPtr should be in runtime MIR only");
1006                    }
1007
1008                    if let [data_ptr, metadata] = fields.raw.as_slice() {
1009                        let data_ptr_ty = data_ptr.ty(self.body, self.tcx);
1010                        let metadata_ty = metadata.ty(self.body, self.tcx);
1011                        if let ty::RawPtr(in_pointee, in_mut) = data_ptr_ty.kind() {
1012                            if *in_mut != mutability {
1013                                self.fail(location, "input and output mutability must match");
1014                            }
1015
1016                            // FIXME: check `Thin` instead of `Sized`
1017                            if !in_pointee.is_sized(self.tcx, self.typing_env) {
1018                                self.fail(location, "input pointer must be thin");
1019                            }
1020                        } else {
1021                            self.fail(
1022                                location,
1023                                "first operand to raw pointer aggregate must be a raw pointer",
1024                            );
1025                        }
1026
1027                        // FIXME: Check metadata more generally
1028                        if pointee_ty.is_slice() {
1029                            if !self.mir_assign_valid_types(metadata_ty, self.tcx.types.usize) {
1030                                self.fail(location, "slice metadata must be usize");
1031                            }
1032                        } else if pointee_ty.is_sized(self.tcx, self.typing_env) {
1033                            if metadata_ty != self.tcx.types.unit {
1034                                self.fail(location, "metadata for pointer-to-thin must be unit");
1035                            }
1036                        }
1037                    } else {
1038                        self.fail(location, "raw pointer aggregate must have 2 fields");
1039                    }
1040                }
1041            },
1042            Rvalue::Ref(_, BorrowKind::Fake(_), _) => {
1043                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
1044                    self.fail(
1045                        location,
1046                        "`Assign` statement with a `Fake` borrow should have been removed in runtime MIR",
1047                    );
1048                }
1049            }
1050            Rvalue::Ref(..) => {}
1051            Rvalue::BinaryOp(op, vals) => {
1052                use BinOp::*;
1053                let a = vals.0.ty(&self.body.local_decls, self.tcx);
1054                let b = vals.1.ty(&self.body.local_decls, self.tcx);
1055                if crate::util::binop_right_homogeneous(*op) {
1056                    if let Eq | Lt | Le | Ne | Ge | Gt = op {
1057                        // The function pointer types can have lifetimes
1058                        if !self.mir_assign_valid_types(a, b) {
1059                            self.fail(
1060                                location,
1061                                format!("Cannot {op:?} compare incompatible types {a} and {b}"),
1062                            );
1063                        }
1064                    } else if a != b {
1065                        self.fail(
1066                            location,
1067                            format!("Cannot perform binary op {op:?} on unequal types {a} and {b}"),
1068                        );
1069                    }
1070                }
1071
1072                match op {
1073                    Offset => {
1074                        check_kinds!(a, "Cannot offset non-pointer type {:?}", ty::RawPtr(..));
1075                        if b != self.tcx.types.isize && b != self.tcx.types.usize {
1076                            self.fail(location, format!("Cannot offset by non-isize type {b}"));
1077                        }
1078                    }
1079                    Eq | Lt | Le | Ne | Ge | Gt => {
1080                        for x in [a, b] {
1081                            check_kinds!(
1082                                x,
1083                                "Cannot {op:?} compare type {:?}",
1084                                ty::Bool
1085                                    | ty::Char
1086                                    | ty::Int(..)
1087                                    | ty::Uint(..)
1088                                    | ty::Float(..)
1089                                    | ty::RawPtr(..)
1090                                    | ty::FnPtr(..)
1091                            )
1092                        }
1093                    }
1094                    Cmp => {
1095                        for x in [a, b] {
1096                            check_kinds!(
1097                                x,
1098                                "Cannot three-way compare non-integer type {:?}",
1099                                ty::Char | ty::Uint(..) | ty::Int(..)
1100                            )
1101                        }
1102                    }
1103                    AddUnchecked | AddWithOverflow | SubUnchecked | SubWithOverflow
1104                    | MulUnchecked | MulWithOverflow | Shl | ShlUnchecked | Shr | ShrUnchecked => {
1105                        for x in [a, b] {
1106                            check_kinds!(
1107                                x,
1108                                "Cannot {op:?} non-integer type {:?}",
1109                                ty::Uint(..) | ty::Int(..)
1110                            )
1111                        }
1112                    }
1113                    BitAnd | BitOr | BitXor => {
1114                        for x in [a, b] {
1115                            check_kinds!(
1116                                x,
1117                                "Cannot perform bitwise op {op:?} on type {:?}",
1118                                ty::Uint(..) | ty::Int(..) | ty::Bool
1119                            )
1120                        }
1121                    }
1122                    Add | Sub | Mul | Div | Rem => {
1123                        for x in [a, b] {
1124                            check_kinds!(
1125                                x,
1126                                "Cannot perform arithmetic {op:?} on type {:?}",
1127                                ty::Uint(..) | ty::Int(..) | ty::Float(..)
1128                            )
1129                        }
1130                    }
1131                }
1132            }
1133            Rvalue::UnaryOp(op, operand) => {
1134                let a = operand.ty(&self.body.local_decls, self.tcx);
1135                match op {
1136                    UnOp::Neg => {
1137                        check_kinds!(a, "Cannot negate type {:?}", ty::Int(..) | ty::Float(..))
1138                    }
1139                    UnOp::Not => {
1140                        check_kinds!(
1141                            a,
1142                            "Cannot binary not type {:?}",
1143                            ty::Int(..) | ty::Uint(..) | ty::Bool
1144                        );
1145                    }
1146                    UnOp::PtrMetadata => {
1147                        check_kinds!(
1148                            a,
1149                            "Cannot PtrMetadata non-pointer non-reference type {:?}",
1150                            ty::RawPtr(..) | ty::Ref(..)
1151                        );
1152                    }
1153                }
1154            }
1155            Rvalue::ShallowInitBox(operand, _) => {
1156                let a = operand.ty(&self.body.local_decls, self.tcx);
1157                check_kinds!(a, "Cannot shallow init type {:?}", ty::RawPtr(..));
1158            }
1159            Rvalue::Cast(kind, operand, target_type) => {
1160                let op_ty = operand.ty(self.body, self.tcx);
1161                match kind {
1162                    // FIXME: Add Checks for these
1163                    CastKind::PointerWithExposedProvenance | CastKind::PointerExposeProvenance => {}
1164                    CastKind::PointerCoercion(PointerCoercion::ReifyFnPointer, _) => {
1165                        // FIXME: check signature compatibility.
1166                        check_kinds!(
1167                            op_ty,
1168                            "CastKind::{kind:?} input must be a fn item, not {:?}",
1169                            ty::FnDef(..)
1170                        );
1171                        check_kinds!(
1172                            target_type,
1173                            "CastKind::{kind:?} output must be a fn pointer, not {:?}",
1174                            ty::FnPtr(..)
1175                        );
1176                    }
1177                    CastKind::PointerCoercion(PointerCoercion::UnsafeFnPointer, _) => {
1178                        // FIXME: check safety and signature compatibility.
1179                        check_kinds!(
1180                            op_ty,
1181                            "CastKind::{kind:?} input must be a fn pointer, not {:?}",
1182                            ty::FnPtr(..)
1183                        );
1184                        check_kinds!(
1185                            target_type,
1186                            "CastKind::{kind:?} output must be a fn pointer, not {:?}",
1187                            ty::FnPtr(..)
1188                        );
1189                    }
1190                    CastKind::PointerCoercion(PointerCoercion::ClosureFnPointer(..), _) => {
1191                        // FIXME: check safety, captures, and signature compatibility.
1192                        check_kinds!(
1193                            op_ty,
1194                            "CastKind::{kind:?} input must be a closure, not {:?}",
1195                            ty::Closure(..)
1196                        );
1197                        check_kinds!(
1198                            target_type,
1199                            "CastKind::{kind:?} output must be a fn pointer, not {:?}",
1200                            ty::FnPtr(..)
1201                        );
1202                    }
1203                    CastKind::PointerCoercion(PointerCoercion::MutToConstPointer, _) => {
1204                        // FIXME: check same pointee?
1205                        check_kinds!(
1206                            op_ty,
1207                            "CastKind::{kind:?} input must be a raw mut pointer, not {:?}",
1208                            ty::RawPtr(_, Mutability::Mut)
1209                        );
1210                        check_kinds!(
1211                            target_type,
1212                            "CastKind::{kind:?} output must be a raw const pointer, not {:?}",
1213                            ty::RawPtr(_, Mutability::Not)
1214                        );
1215                        if self.body.phase >= MirPhase::Analysis(AnalysisPhase::PostCleanup) {
1216                            self.fail(location, format!("After borrowck, MIR disallows {kind:?}"));
1217                        }
1218                    }
1219                    CastKind::PointerCoercion(PointerCoercion::ArrayToPointer, _) => {
1220                        // FIXME: Check pointee types
1221                        check_kinds!(
1222                            op_ty,
1223                            "CastKind::{kind:?} input must be a raw pointer, not {:?}",
1224                            ty::RawPtr(..)
1225                        );
1226                        check_kinds!(
1227                            target_type,
1228                            "CastKind::{kind:?} output must be a raw pointer, not {:?}",
1229                            ty::RawPtr(..)
1230                        );
1231                        if self.body.phase >= MirPhase::Analysis(AnalysisPhase::PostCleanup) {
1232                            self.fail(location, format!("After borrowck, MIR disallows {kind:?}"));
1233                        }
1234                    }
1235                    CastKind::PointerCoercion(PointerCoercion::Unsize, _) => {
1236                        // Pointers being unsize coerced should at least implement
1237                        // `CoerceUnsized`.
1238                        if !self.predicate_must_hold_modulo_regions(ty::TraitRef::new(
1239                            self.tcx,
1240                            self.tcx.require_lang_item(
1241                                LangItem::CoerceUnsized,
1242                                self.body.source_info(location).span,
1243                            ),
1244                            [op_ty, *target_type],
1245                        )) {
1246                            self.fail(location, format!("Unsize coercion, but `{op_ty}` isn't coercible to `{target_type}`"));
1247                        }
1248                    }
1249                    CastKind::IntToInt | CastKind::IntToFloat => {
1250                        let input_valid = op_ty.is_integral() || op_ty.is_char() || op_ty.is_bool();
1251                        let target_valid = target_type.is_numeric() || target_type.is_char();
1252                        if !input_valid || !target_valid {
1253                            self.fail(
1254                                location,
1255                                format!("Wrong cast kind {kind:?} for the type {op_ty}"),
1256                            );
1257                        }
1258                    }
1259                    CastKind::FnPtrToPtr => {
1260                        check_kinds!(
1261                            op_ty,
1262                            "CastKind::{kind:?} input must be a fn pointer, not {:?}",
1263                            ty::FnPtr(..)
1264                        );
1265                        check_kinds!(
1266                            target_type,
1267                            "CastKind::{kind:?} output must be a raw pointer, not {:?}",
1268                            ty::RawPtr(..)
1269                        );
1270                    }
1271                    CastKind::PtrToPtr => {
1272                        check_kinds!(
1273                            op_ty,
1274                            "CastKind::{kind:?} input must be a raw pointer, not {:?}",
1275                            ty::RawPtr(..)
1276                        );
1277                        check_kinds!(
1278                            target_type,
1279                            "CastKind::{kind:?} output must be a raw pointer, not {:?}",
1280                            ty::RawPtr(..)
1281                        );
1282                    }
1283                    CastKind::FloatToFloat | CastKind::FloatToInt => {
1284                        if !op_ty.is_floating_point() || !target_type.is_numeric() {
1285                            self.fail(
1286                                location,
1287                                format!(
1288                                    "Trying to cast non 'Float' as {kind:?} into {target_type:?}"
1289                                ),
1290                            );
1291                        }
1292                    }
1293                    CastKind::Transmute => {
1294                        // Unlike `mem::transmute`, a MIR `Transmute` is well-formed
1295                        // for any two `Sized` types, just potentially UB to run.
1296
1297                        if !self
1298                            .tcx
1299                            .normalize_erasing_regions(self.typing_env, op_ty)
1300                            .is_sized(self.tcx, self.typing_env)
1301                        {
1302                            self.fail(
1303                                location,
1304                                format!("Cannot transmute from non-`Sized` type {op_ty}"),
1305                            );
1306                        }
1307                        if !self
1308                            .tcx
1309                            .normalize_erasing_regions(self.typing_env, *target_type)
1310                            .is_sized(self.tcx, self.typing_env)
1311                        {
1312                            self.fail(
1313                                location,
1314                                format!("Cannot transmute to non-`Sized` type {target_type:?}"),
1315                            );
1316                        }
1317                    }
1318                    CastKind::Subtype => {
1319                        if !util::sub_types(self.tcx, self.typing_env, op_ty, *target_type) {
1320                            self.fail(
1321                                location,
1322                                format!("Failed subtyping {op_ty} and {target_type}"),
1323                            )
1324                        }
1325                    }
1326                }
1327            }
1328            Rvalue::NullaryOp(NullOp::OffsetOf(indices), container) => {
1329                let fail_out_of_bounds = |this: &mut Self, location, field, ty| {
1330                    this.fail(location, format!("Out of bounds field {field:?} for {ty}"));
1331                };
1332
1333                let mut current_ty = *container;
1334
1335                for (variant, field) in indices.iter() {
1336                    match current_ty.kind() {
1337                        ty::Tuple(fields) => {
1338                            if variant != FIRST_VARIANT {
1339                                self.fail(
1340                                    location,
1341                                    format!("tried to get variant {variant:?} of tuple"),
1342                                );
1343                                return;
1344                            }
1345                            let Some(&f_ty) = fields.get(field.as_usize()) else {
1346                                fail_out_of_bounds(self, location, field, current_ty);
1347                                return;
1348                            };
1349
1350                            current_ty = self.tcx.normalize_erasing_regions(self.typing_env, f_ty);
1351                        }
1352                        ty::Adt(adt_def, args) => {
1353                            let Some(field) = adt_def.variant(variant).fields.get(field) else {
1354                                fail_out_of_bounds(self, location, field, current_ty);
1355                                return;
1356                            };
1357
1358                            let f_ty = field.ty(self.tcx, args);
1359                            current_ty = self.tcx.normalize_erasing_regions(self.typing_env, f_ty);
1360                        }
1361                        _ => {
1362                            self.fail(
1363                                location,
1364                                format!("Cannot get offset ({variant:?}, {field:?}) from type {current_ty}"),
1365                            );
1366                            return;
1367                        }
1368                    }
1369                }
1370            }
1371            Rvalue::Repeat(_, _)
1372            | Rvalue::ThreadLocalRef(_)
1373            | Rvalue::RawPtr(_, _)
1374            | Rvalue::NullaryOp(
1375                NullOp::SizeOf | NullOp::AlignOf | NullOp::UbChecks | NullOp::ContractChecks,
1376                _,
1377            )
1378            | Rvalue::Discriminant(_) => {}
1379
1380            Rvalue::WrapUnsafeBinder(op, ty) => {
1381                let unwrapped_ty = op.ty(self.body, self.tcx);
1382                let ty::UnsafeBinder(binder_ty) = *ty.kind() else {
1383                    self.fail(
1384                        location,
1385                        format!("WrapUnsafeBinder does not produce a ty::UnsafeBinder"),
1386                    );
1387                    return;
1388                };
1389                let binder_inner_ty = self.tcx.instantiate_bound_regions_with_erased(*binder_ty);
1390                if !self.mir_assign_valid_types(unwrapped_ty, binder_inner_ty) {
1391                    self.fail(
1392                        location,
1393                        format!("Cannot wrap {unwrapped_ty} into unsafe binder {binder_ty:?}"),
1394                    );
1395                }
1396            }
1397        }
1398        self.super_rvalue(rvalue, location);
1399    }
1400
1401    fn visit_statement(&mut self, statement: &Statement<'tcx>, location: Location) {
1402        match &statement.kind {
1403            StatementKind::Assign(box (dest, rvalue)) => {
1404                // LHS and RHS of the assignment must have the same type.
1405                let left_ty = dest.ty(&self.body.local_decls, self.tcx).ty;
1406                let right_ty = rvalue.ty(&self.body.local_decls, self.tcx);
1407
1408                if !self.mir_assign_valid_types(right_ty, left_ty) {
1409                    self.fail(
1410                        location,
1411                        format!(
1412                            "encountered `{:?}` with incompatible types:\n\
1413                            left-hand side has type: {}\n\
1414                            right-hand side has type: {}",
1415                            statement.kind, left_ty, right_ty,
1416                        ),
1417                    );
1418                }
1419                if let Rvalue::CopyForDeref(place) = rvalue {
1420                    if place.ty(&self.body.local_decls, self.tcx).ty.builtin_deref(true).is_none() {
1421                        self.fail(
1422                            location,
1423                            "`CopyForDeref` should only be used for dereferenceable types",
1424                        )
1425                    }
1426                }
1427            }
1428            StatementKind::AscribeUserType(..) => {
1429                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
1430                    self.fail(
1431                        location,
1432                        "`AscribeUserType` should have been removed after drop lowering phase",
1433                    );
1434                }
1435            }
1436            StatementKind::FakeRead(..) => {
1437                if self.body.phase >= MirPhase::Runtime(RuntimePhase::Initial) {
1438                    self.fail(
1439                        location,
1440                        "`FakeRead` should have been removed after drop lowering phase",
1441                    );
1442                }
1443            }
1444            StatementKind::Intrinsic(box NonDivergingIntrinsic::Assume(op)) => {
1445                let ty = op.ty(&self.body.local_decls, self.tcx);
1446                if !ty.is_bool() {
1447                    self.fail(
1448                        location,
1449                        format!("`assume` argument must be `bool`, but got: `{ty}`"),
1450                    );
1451                }
1452            }
1453            StatementKind::Intrinsic(box NonDivergingIntrinsic::CopyNonOverlapping(
1454                CopyNonOverlapping { src, dst, count },
1455            )) => {
1456                let src_ty = src.ty(&self.body.local_decls, self.tcx);
1457                let op_src_ty = if let Some(src_deref) = src_ty.builtin_deref(true) {
1458                    src_deref
1459                } else {
1460                    self.fail(
1461                        location,
1462                        format!("Expected src to be ptr in copy_nonoverlapping, got: {src_ty}"),
1463                    );
1464                    return;
1465                };
1466                let dst_ty = dst.ty(&self.body.local_decls, self.tcx);
1467                let op_dst_ty = if let Some(dst_deref) = dst_ty.builtin_deref(true) {
1468                    dst_deref
1469                } else {
1470                    self.fail(
1471                        location,
1472                        format!("Expected dst to be ptr in copy_nonoverlapping, got: {dst_ty}"),
1473                    );
1474                    return;
1475                };
1476                // since CopyNonOverlapping is parametrized by 1 type,
1477                // we only need to check that they are equal and not keep an extra parameter.
1478                if !self.mir_assign_valid_types(op_src_ty, op_dst_ty) {
1479                    self.fail(location, format!("bad arg ({op_src_ty} != {op_dst_ty})"));
1480                }
1481
1482                let op_cnt_ty = count.ty(&self.body.local_decls, self.tcx);
1483                if op_cnt_ty != self.tcx.types.usize {
1484                    self.fail(location, format!("bad arg ({op_cnt_ty} != usize)"))
1485                }
1486            }
1487            StatementKind::SetDiscriminant { place, .. } => {
1488                if self.body.phase < MirPhase::Runtime(RuntimePhase::Initial) {
1489                    self.fail(location, "`SetDiscriminant`is not allowed until deaggregation");
1490                }
1491                let pty = place.ty(&self.body.local_decls, self.tcx).ty;
1492                if !matches!(
1493                    pty.kind(),
1494                    ty::Adt(..) | ty::Coroutine(..) | ty::Alias(ty::Opaque, ..)
1495                ) {
1496                    self.fail(
1497                        location,
1498                        format!(
1499                            "`SetDiscriminant` is only allowed on ADTs and coroutines, not {pty}"
1500                        ),
1501                    );
1502                }
1503            }
1504            StatementKind::Deinit(..) => {
1505                if self.body.phase < MirPhase::Runtime(RuntimePhase::Initial) {
1506                    self.fail(location, "`Deinit`is not allowed until deaggregation");
1507                }
1508            }
1509            StatementKind::Retag(kind, _) => {
1510                // FIXME(JakobDegen) The validator should check that `self.body.phase <
1511                // DropsLowered`. However, this causes ICEs with generation of drop shims, which
1512                // seem to fail to set their `MirPhase` correctly.
1513                if matches!(kind, RetagKind::TwoPhase) {
1514                    self.fail(location, format!("explicit `{kind:?}` is forbidden"));
1515                }
1516            }
1517            StatementKind::StorageLive(_)
1518            | StatementKind::StorageDead(_)
1519            | StatementKind::Coverage(_)
1520            | StatementKind::ConstEvalCounter
1521            | StatementKind::PlaceMention(..)
1522            | StatementKind::BackwardIncompatibleDropHint { .. }
1523            | StatementKind::Nop => {}
1524        }
1525
1526        self.super_statement(statement, location);
1527    }
1528
1529    fn visit_terminator(&mut self, terminator: &Terminator<'tcx>, location: Location) {
1530        match &terminator.kind {
1531            TerminatorKind::SwitchInt { targets, discr } => {
1532                let switch_ty = discr.ty(&self.body.local_decls, self.tcx);
1533
1534                let target_width = self.tcx.sess.target.pointer_width;
1535
1536                let size = Size::from_bits(match switch_ty.kind() {
1537                    ty::Uint(uint) => uint.normalize(target_width).bit_width().unwrap(),
1538                    ty::Int(int) => int.normalize(target_width).bit_width().unwrap(),
1539                    ty::Char => 32,
1540                    ty::Bool => 1,
1541                    other => bug!("unhandled type: {:?}", other),
1542                });
1543
1544                for (value, _) in targets.iter() {
1545                    if ScalarInt::try_from_uint(value, size).is_none() {
1546                        self.fail(
1547                            location,
1548                            format!("the value {value:#x} is not a proper {switch_ty}"),
1549                        )
1550                    }
1551                }
1552            }
1553            TerminatorKind::Call { func, .. } | TerminatorKind::TailCall { func, .. } => {
1554                let func_ty = func.ty(&self.body.local_decls, self.tcx);
1555                match func_ty.kind() {
1556                    ty::FnPtr(..) | ty::FnDef(..) => {}
1557                    _ => self.fail(
1558                        location,
1559                        format!(
1560                            "encountered non-callable type {func_ty} in `{}` terminator",
1561                            terminator.kind.name()
1562                        ),
1563                    ),
1564                }
1565
1566                if let TerminatorKind::TailCall { .. } = terminator.kind {
1567                    // FIXME(explicit_tail_calls): implement tail-call specific checks here (such
1568                    // as signature matching, forbidding closures, etc)
1569                }
1570            }
1571            TerminatorKind::Assert { cond, .. } => {
1572                let cond_ty = cond.ty(&self.body.local_decls, self.tcx);
1573                if cond_ty != self.tcx.types.bool {
1574                    self.fail(
1575                        location,
1576                        format!(
1577                            "encountered non-boolean condition of type {cond_ty} in `Assert` terminator"
1578                        ),
1579                    );
1580                }
1581            }
1582            TerminatorKind::Goto { .. }
1583            | TerminatorKind::Drop { .. }
1584            | TerminatorKind::Yield { .. }
1585            | TerminatorKind::FalseEdge { .. }
1586            | TerminatorKind::FalseUnwind { .. }
1587            | TerminatorKind::InlineAsm { .. }
1588            | TerminatorKind::CoroutineDrop
1589            | TerminatorKind::UnwindResume
1590            | TerminatorKind::UnwindTerminate(_)
1591            | TerminatorKind::Return
1592            | TerminatorKind::Unreachable => {}
1593        }
1594
1595        self.super_terminator(terminator, location);
1596    }
1597}
rustc_mir_transform/validate.rs

rustc_mir_transform/
validate.rs
