ICE in StableHasher

[joshlf]

Code

The code in question is from this change in Fuchsia.

In order to reproduce, first download Fuchsia and then build.

Once that's done, perform the following steps from inside the Fuchsia repository:

# Download a recent known-good version
$ git fetch https://fuchsia.googlesource.com/fuchsia refs/changes/03/583203/4 && git checkout FETCH_HEAD

# Use Netstack3 (if you're not on x86_64, substitute your target for `x64`)
$ fx set core.x64 --with //src/connectivity/network/netstack3:bin --cargo-toml-gen

# Do a full build as a prerequisite for the next step
$ fx build && fx build build/rust:cargo_toml_gen

# Generate a `Cargo.toml` file for Netstack3
$ fx gen-cargo //src/connectivity/network/netstack3:bin

# Check out the problematic code
$ git fetch https://fuchsia.googlesource.com/fuchsia refs/changes/09/583209/1 && git checkout FETCH_HEAD

# Try to build Netstack3
$ cd src/connectivity/network/netstack3 && cargo check --target x86_64-fuchsia

Meta

Version from error output:

rustc 1.56.0-nightly (1f94abcda 2021-08-06) running on x86_64-unknown-linux-gnu

Error output

error: internal compiler error: compiler/rustc_middle/src/ich/impls_ty.rs:94:17: StableHasher: unexpected region RePlaceholder(Placeholder { universe: U4, name: BrNamed(DefId(0:199 ~ netstack3[e4ac]::bindings::ethernet_worker::EthernetWorker::'a), 'a) })

thread 'rustc' panicked at 'Box<dyn Any>', compiler/rustc_errors/src/lib.rs:1046:9
stack backtrace:
   0: std::panicking::begin_panic
   1: std::panic::panic_any
   2: rustc_errors::HandlerInner::bug
   3: rustc_errors::Handler::bug
   4: rustc_middle::util::bug::opt_span_bug_fmt::{{closure}}
   5: rustc_middle::ty::context::tls::with_opt::{{closure}}
   6: rustc_middle::ty::context::tls::with_opt
   7: rustc_middle::util::bug::opt_span_bug_fmt
   8: rustc_middle::util::bug::bug_fmt
   9: rustc_middle::ich::impls_ty::<impl rustc_data_structures::stable_hasher::HashStable<rustc_middle::ich::hcx::StableHashingContext> for rustc_middle::ty::sty::RegionKind>::hash_stable
  10: <rustc_middle::ty::TyS as rustc_data_structures::stable_hasher::HashStable<rustc_middle::ich::hcx::StableHashingContext>>::hash_stable
  11: std::thread::local::LocalKey<T>::with
  12: <rustc_middle::ty::TyS as rustc_data_structures::stable_hasher::HashStable<rustc_middle::ich::hcx::StableHashingContext>>::hash_stable
  13: std::thread::local::LocalKey<T>::with
  14: rustc_middle::ich::impls_ty::<impl rustc_data_structures::stable_hasher::HashStable<rustc_middle::ich::hcx::StableHashingContext> for rustc_middle::ty::sty::Binder<T>>::hash_stable
  15: <T as rustc_query_system::dep_graph::dep_node::DepNodeParams<Ctxt>>::to_fingerprint
  16: rustc_query_system::query::plumbing::get_query_impl
  17: <rustc_query_impl::Queries as rustc_middle::ty::query::QueryEngine>::diagnostic_hir_wf_check
  18: <rustc_infer::infer::InferCtxt as rustc_trait_selection::traits::error_reporting::InferCtxtExt>::report_selection_error
  19: <rustc_infer::infer::InferCtxt as rustc_trait_selection::traits::error_reporting::InferCtxtPrivExt>::report_fulfillment_error
  20: <rustc_infer::infer::InferCtxt as rustc_trait_selection::traits::error_reporting::InferCtxtExt>::report_fulfillment_errors
  21: rustc_typeck::check::fn_ctxt::_impl::<impl rustc_typeck::check::fn_ctxt::FnCtxt>::select_all_obligations_or_error
  22: rustc_infer::infer::InferCtxtBuilder::enter
  23: rustc_typeck::check::wfcheck::check_item_well_formed
  24: rustc_query_system::dep_graph::graph::DepGraph<K>::with_task_impl
  25: rustc_data_structures::stack::ensure_sufficient_stack
  26: rustc_query_system::query::plumbing::force_query_with_job
  27: rustc_query_system::query::plumbing::get_query_impl
  28: <rustc_query_impl::Queries as rustc_middle::ty::query::QueryEngine>::check_item_well_formed
  29: <rustc_typeck::check::wfcheck::CheckTypeWellFormedVisitor as rustc_hir::intravisit::Visitor>::visit_item
  30: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
  31: rustc_data_structures::sync::par_for_each_in
  32: rustc_session::session::Session::track_errors
  33: rustc_typeck::check_crate
  34: rustc_interface::passes::analysis
  35: rustc_query_system::dep_graph::graph::DepGraph<K>::with_task_impl
  36: rustc_data_structures::stack::ensure_sufficient_stack
  37: rustc_query_system::query::plumbing::force_query_with_job
  38: rustc_query_system::query::plumbing::get_query_impl
  39: <rustc_query_impl::Queries as rustc_middle::ty::query::QueryEngine>::analysis
  40: rustc_interface::queries::<impl rustc_interface::interface::Compiler>::enter
  41: rustc_span::with_source_map
  42: rustc_interface::interface::create_compiler_and_run
  43: scoped_tls::ScopedKey<T>::set
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

note: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: rustc 1.56.0-nightly (1f94abcda 2021-08-06) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z panic_abort_tests -C embed-bitcode=no -C debuginfo=2 -C incremental -C panic=abort -C link-arg=--pack-dyn-relocs=relr -C link-args=-zstack-size=0x200000 -C link-arg=-L/usr/local/google/home/joshlf/workspace/fuchsia/out/default/gen/zircon/public/sysroot/cpp/lib -C link-arg=-L/usr/local/google/home/joshlf/workspace/fuchsia/out/default/x64-shared/gen/zircon/public/lib/fdio -C link-arg=-L/usr/local/google/home/joshlf/workspace/fuchsia/out/default/x64-shared/gen/zircon/public/lib/syslog -C link-arg=-L/usr/local/google/home/joshlf/workspace/fuchsia/out/default/x64-shared/gen/zircon/public/lib/trace-engine -C link-arg=-L/usr/local/google/home/joshlf/workspace/fuchsia/prebuilt/third_party/clang/linux-x64/lib/clang/14.0.0/x86_64-fuchsia/lib -C link-arg=-L/usr/local/google/home/joshlf/workspace/fuchsia/out/default -C link-arg=-L/usr/local/google/home/joshlf/workspace/fuchsia/out/default/user.vdso_x64 -C link-arg=--sysroot=/usr/local/google/home/joshlf/workspace/fuchsia/out/default/gen/zircon/public/sysroot/cpp -C link-arg=/usr/local/google/home/joshlf/workspace/fuchsia/out/default/user.libc_x64/obj/zircon/system/ulib/c/crt1.Scrt1.cc.o --crate-type bin

note: some of the compiler flags provided by cargo are hidden

query stack during panic:
#0 [check_item_well_formed] checking that `bindings::ethernet_worker::<impl at src/bindings/ethernet_worker.rs:47:1: 112:2>` is well-formed
#1 [analysis] running analysis passes on this crate
end of query stack

[jackh726]

Easy fix here. I saw this at one point in #85499, but it went away with in the final version of that PR, so I had assumed that as the code evolved, this wouldn't get hit.

Anyways, to fix, just make the RePlaceholder arm be RePlaceholder(p) => p.hash_stable(hcx, hasher) here.

[nerandell]

@rustbot claim

[jackh726]

Any way we can get an MCVE for this? Seems like an important test case for normalization under binders.

@rustbot ping icebreakers-cleanup-crew

[rustbot]

Hey Cleanup Crew ICE-breakers! This bug has been identified as a good
"Cleanup ICE-breaking candidate". In case it's useful, here are some
instructions for tackling these sorts of bugs. Maybe take a look?
Thanks! <3

cc @AminArria @camelid @chrissimpkins @contrun @DutchGhost @elshize @h-michael @HallerPatrick @hdhoang @hellow554 @henryboisdequin @imtsuki @JamesPatrickGill @kanru @KarlK90 @MAdrianMattocks @matheus-consoli @mental32 @nmccarty @Noah-Kennedy @pard68 @PeytonT @pierreN @Redblueflame @RobbieClarken @RobertoSnap @robjtede @SarthakSingh31 @shekohex @sinato @smmalis37 @steffahn @Stupremee @tamuhey @turboladen @woshilapin @yerke

[camelid]

Easy fix here. I saw this at one point in #85499, but it went away with in the final version of that PR, so I had assumed that as the code evolved, this wouldn't get hit.

@jackh726 does that mean this is a stable-to-beta regression? If so, could you add that label (and the 1.56 milestone) to this issue so we can track it better?

[jackh726]

@camelid good question, I don't know. If this indeed is directly caused by #85499, then it would be, yes.

Can somebody check this? I don't personally have the time to right now.

[joshlf]

@jackh726

Any way we can get an MCVE for this? Seems like an important test case for normalization under binders.

I would have no idea how to do that for the change that caused the issue. I was deep in the middle of tearing my hair out trying to figure out why a certain trait (in a very hairy mess of traits) wasn't implemented. I was confused enough as it was without the ICE 😂 MCVE would be great, but I unfortunately can't provide one starting from the offending change. Perhaps someone else can create a snippet tabula rasa based on where the ICE occurred?

[hellow554]

This is a terrible MCVE, but it works and panics with two ICE:

trait BufferMut {}
struct Ctx<D>(D);

trait BufferUdpStateContext<B> {}
impl<B: BufferMut, C> BufferUdpStateContext<B> for C {}

trait StackContext
where
    Ctx<()>: for<'a> BufferUdpStateContext<&'a ()>,
{
    type Dispatcher;
}

trait TimerContext {
    type Handler;
}
impl<C> TimerContext for C
where
    C: StackContext,
{
    type Handler = Ctx<C::Dispatcher>;
}

struct EthernetWorker<C>(C)
where
    Ctx<()>: for<'a> BufferUdpStateContext<&'a ()>;
impl<C> EthernetWorker<C> {}

fn main() {}

After fiddling a bit more with this, the culprit is indeed that BufferMut is not implemented for &'a ().

[jackh726]

@hellow554 wow! You rock!

[joshlf]

Wow, fantastic work, @hellow554 !

[jackh726]

This is fixed on nightly, just needs a test (#89118 (comment)) in higher-ranked-type-bounds/normalize-under-binders

[hameerabbasi]

@rustbot claim