Segfault or wrong values from `const FOO: u32 = 0 - 1; println!("{}", FOO);`

[ollie27]

The following programs produce a binary that will either segfault or produce a nonsense value seemingly depending on whether optimizations are enabled or not.

fn main() {
    const FOO: u32 = 0 - 1;
    println!("{}", FOO);
}

fn main() {
    println!("{}", 0u32 - 1);
}

On 1.25.0 they behave as expected (the first doesn't even compile) but 1.26.0 and newer are broken.

[varkor]

The constant evaluation error is being flagged, but only as a warning, so the code is still executed.

cc @oli-obk

[oli-obk]

@eddyb the way promotion works we can't back out of promoting in case of const eval failure, can we?

The named const case can be fixed. But I'm not sure what do do on the promotion case

[eddyb]

@oli-obk Ah, this is where we disagree - overflow is not an evaluation error.
That is, because this is compiled in release mode, there's no Assert MIR terminator, which means that wrapping should happen.

But there is a more general issue, where if a const fn is called, and evaluation fails in it (for whatever reason, e.g. wrong unsafe code), a promoted call to it doesn't inject a runtime panic.
So I think we have to add that panic to the runtime codegen, and keep compile-time warnings.

[oli-obk]

Ok so this is super easy to fix. Just remove the check in https://github.com/rust-lang/rust/blob/master/src/librustc_mir/interpret/eval_context.rs#L533

The const fn part is "fine" right now, because users can't write any const fns and the const fns that libstd offers are safe to use.

[eddyb]

@oli-obk I would not rely on assumptions about libstd, IMO, it's too fragile. We have code to emit an Assert failure, just need to reuse it for errors while evaluating a promoted.

[oli-obk]

Ok. some irc discussion has shown that this is a horrible situation we're in. Summary:

Let's use a strawman union for demonstration purposes, but it's not necessary, there are other ways to fail the const evaluator, they just aren't short examples.

/// Helper for casting `&'static u32` into `usize`
union Union {
    a: &'static u32,
    b: usize,
}

1. unsafe { Union { a: &1 }.b == Union { a: &2 }.b } is perfectly sane at runtime (but not doable at compile-time right now. This is just a placeholder example. Take any piece of code that works at runtime but should be const evaluable but isn't at the moment.
   • This means that perfectly safe and working code that in the future could become promoted, would, after promotion, not be evaluable by miri. We can't report an error, because that would be a breaking change, we also can't turn this into a runtime panic, because that's also a breaking change. So we'd need to keep doing the original runtime code before promotion. We can't do that, because we need the result to be in static memory because promotion already promised the 'static lifetime.
2. We can't make promotion depend on the const evaluation succeeding, because typeck needs to know whether promotion will actually succeed. At typeck time we don't know the generic arguments to non-monomorphized function.
   • We could do a breaking change and make promoteds like regular statics, so you can't depend on the surrounding function's generics. That would allow typeck to simply evaluate the promoted during the creation of the promoted and skip promoting it in the case of errors. I hate suggesting this, but it seems like the sanest option.
3. rustc 1.25 just hard errored at monomorphization time. We can reintroduce that error, but it'll mean we can never improve promotion to accept more code.