[MIR] Implement overflow checking #33905

eddyb · 2016-05-27T12:16:58Z

The initial set of changes is from @Aatch's #33255 PR, rebased on master, plus:

Added an Assert terminator to MIR, to simplify working with overflow and bounds checks.
With this terminator, error cases can be accounted for directly, instead of looking for lang item calls.
It also keeps the MIR slimmer, with no extra explicit blocks for the actual panic calls.

Warnings can be produced when the Assert is known to always panic at runtime, e.g.:

warning: index out of bounds: the len is 1 but the index is 3
 --> <anon>:1:14
1 |> fn main() { &[std::io::stdout()][3]; }
  |>              ^^^^^^^^^^^^^^^^^^^^^^

Generalized the OperandValue::FatPtr optimization to any aggregate pair of immediates.
This allows us to generate the same IR for overflow checks as old trans, not something worse.
For example, addition on i16 calls llvm.sadd.with.overflow.i16, which returns {i16, i1}.
However, the Rust type (i16, bool), has to be {i16, i8}, only an immediate bool is i1.
But if we split the pair into an i16 and an i1, we can pass them around as such for free.

The latest addition is a rebase of #34054, updated to work for pairs too. Closes #34054, fixes #33873.

Last but not least, the #[rustc_inherit_overflow_checks] attribute was introduced to control the
overflow checking behavior of generic or #[inline] functions, when translated in another crate.

It is not intended to be used by crates other than libcore, which is in the unusual position of
being distributed as only an optimized build with no checks, even when used from debug mode.
Before MIR-based translation, this worked out fine, as the decision for overflow was made at
translation time, in the crate being compiled, but MIR stored in rlib has to contain the checks.

To avoid always generating the checks and slowing everything down, a decision was made to
use an attribute in the few spots of libcore that need it (see #33255 for previous discussion):

core::ops::{Add, Sub, Mul, Neg, Shl, Shr} implementations for integers, which have #[inline] methods and can be used in generic abstractions from other crates
core::ops::{Add, Sub, Mul, Neg, Shl, Shr}Assign same as above, for augmented assignment
pow and abs methods on integers, which intentionally piggy-back on built-in multiplication and negation, respectively, to get overflow checks
core::iter::{Iterator, Chain, Peek}::count and core::iter::Enumerate::{next, nth}, also documented as panicking on overflow, from addition, counting elements of an iterator in an usize

rust-highfive · 2016-05-27T12:17:11Z

r? @nikomatsakis

(rust_highfive has picked a reviewer for you, use r? to override)

bluss · 2016-05-27T12:29:18Z

#[rustc_inherit_overflow_checks] is needed on RangeFrom::next in libcore/iter/range.rs too

eddyb · 2016-05-27T12:34:35Z

@bluss Those didn't even make it into my mega warning list, because they are generic over Add and Sub so they just get the same behavior everyone else does, via the integer implementations of those traits (which do have #[rustc_inherit_overflow_checks]).

alexcrichton · 2016-05-27T16:59:36Z

@eddyb nice! An unstable attribute seems like a reasonable compromise for libcore for now, although we should discuss in libs how to remove the dependency on it pronto :)

nikomatsakis · 2016-05-27T19:46:22Z

@alexcrichton I think there's a case to be made that we should extend the language with the ability to enable overflow checks for a given module, as well as to make overflow checks "inherited" from the caller.

nikomatsakis · 2016-05-29T09:55:23Z

@bors retry

nikomatsakis · 2016-05-29T09:55:32Z

oops, wrong PR :)

nikomatsakis · 2016-05-29T09:55:47Z

@bors r-

nikomatsakis · 2016-05-29T09:55:51Z

(just in case)

nikomatsakis · 2016-06-03T19:28:45Z

src/librustc_const_eval/eval.rs

@@ -853,9 +853,6 @@ pub fn eval_const_expr_partial<'a, 'tcx>(tcx: TyCtxt<'a, 'tcx, 'tcx>,
                Integral(U8(data[idx as usize]))
            },

-            Str(ref s) if idx as usize >= s.len() => signal!(e, IndexOutOfBounds),
-            // FIXME: return a const char
-            Str(_) => signal!(e, UnimplementedConstVal("indexing into str")),


bors · 2016-06-04T05:34:08Z

☔ The latest upstream changes (presumably #33803) made this pull request unmergeable. Please resolve the merge conflicts.

nikomatsakis · 2016-06-04T16:30:53Z

r=me

bors · 2016-06-05T10:14:21Z

☔ The latest upstream changes (presumably #33622) made this pull request unmergeable. Please resolve the merge conflicts.

Add, Sub, Mul, Shl, and Shr are checked using a new Rvalue: CheckedBinaryOp, while Div, Rem and Neg are handled with explicit checks in the MIR.

Factors out the common pattern across the several places that do arithmetic checks

This is simpler to work with than `with_cond`.

eddyb · 2016-06-05T12:16:58Z

@bors r=nikomatsakis

bors · 2016-06-05T12:16:59Z

📌 Commit c497e87 has been approved by nikomatsakis

arielb1 · 2016-06-05T12:27:41Z

The r= is on the wrong commit.

eddyb · 2016-06-05T12:30:22Z

@arielb1 No, I just pushed a potential fix, the commit I r='d didn't actually pass the latest test, I'll r= again once I know it works.

eddyb · 2016-06-05T12:34:40Z

@bors r=nikomatsakis

bors · 2016-06-05T12:34:41Z

📌 Commit cee244d has been approved by nikomatsakis

bors · 2016-06-05T13:08:37Z

⌛ Testing commit cee244d with merge 8cbffc5...

@Aatch

[MIR] Implement overflow checking The initial set of changes is from @Aatch's #33255 PR, rebased on master, plus: Added an `Assert` terminator to MIR, to simplify working with overflow and bounds checks. With this terminator, error cases can be accounted for directly, instead of looking for lang item calls. It also keeps the MIR slimmer, with no extra explicit blocks for the actual panic calls. Warnings can be produced when the `Assert` is known to always panic at runtime, e.g.: ```rust warning: index out of bounds: the len is 1 but the index is 3 --> <anon>:1:14 1 |> fn main() { &[std::io::stdout()][3]; } |> ^^^^^^^^^^^^^^^^^^^^^^ ``` Generalized the `OperandValue::FatPtr` optimization to any aggregate pair of immediates. This allows us to generate the same IR for overflow checks as old trans, not something worse. For example, addition on `i16` calls `llvm.sadd.with.overflow.i16`, which returns `{i16, i1}`. However, the Rust type `(i16, bool)`, has to be `{i16, i8}`, only an immediate `bool` is `i1`. But if we split the pair into an `i16` and an `i1`, we can pass them around as such for free. The latest addition is a rebase of #34054, updated to work for pairs too. Closes #34054, fixes #33873. Last but not least, the `#[rustc_inherit_overflow_checks]` attribute was introduced to control the overflow checking behavior of generic or `#[inline]` functions, when translated in another crate. It is **not** intended to be used by crates other than `libcore`, which is in the unusual position of being distributed as only an optimized build with no checks, even when used from debug mode. Before MIR-based translation, this worked out fine, as the decision for overflow was made at translation time, in the crate being compiled, but MIR stored in `rlib` has to contain the checks. To avoid always generating the checks and slowing everything down, a decision was made to use an attribute in the few spots of `libcore` that need it (see #33255 for previous discussion): * `core::ops::{Add, Sub, Mul, Neg, Shl, Shr}` implementations for integers, which have `#[inline]` methods and can be used in generic abstractions from other crates * `core::ops::{Add, Sub, Mul, Neg, Shl, Shr}Assign` same as above, for augmented assignment * `pow` and `abs` methods on integers, which intentionally piggy-back on built-in multiplication and negation, respectively, to get overflow checks * `core::iter::{Iterator, Chain, Peek}::count` and `core::iter::Enumerate::{next, nth}`, also documented as panicking on overflow, from addition, counting elements of an iterator in an `usize`

bors · 2016-06-05T16:07:35Z

☀️ Test successful - auto-linux-32-nopt-t, auto-linux-32-opt, auto-linux-32cross-opt, auto-linux-64-cargotest, auto-linux-64-cross-armhf, auto-linux-64-cross-armsf, auto-linux-64-cross-freebsd, auto-linux-64-cross-netbsd, auto-linux-64-debug-opt, auto-linux-64-nopt-t, auto-linux-64-opt, auto-linux-64-opt-mir, auto-linux-64-opt-rustbuild, auto-linux-64-x-android-t, auto-linux-cross-opt, auto-linux-musl-64-opt, auto-mac-32-opt, auto-mac-64-nopt-t, auto-mac-64-opt, auto-mac-64-opt-rustbuild, auto-mac-cross-ios-opt, auto-win-gnu-32-nopt-t, auto-win-gnu-32-opt, auto-win-gnu-32-opt-rustbuild, auto-win-gnu-64-nopt-t, auto-win-gnu-64-opt, auto-win-msvc-32-cross-opt, auto-win-msvc-32-opt, auto-win-msvc-64-cargotest, auto-win-msvc-64-opt, auto-win-msvc-64-opt-mir, auto-win-msvc-64-opt-rustbuild

Switch to MIR-based translation by default. This patch makes `-Z orbit` default to "on", which means that by default, functions will be translated from Rust to LLVM IR through the upcoming MIR backend, instead of the antiquated AST backend. This switch is made possible by the recently merged #33622, #33905 and smaller fixes. If you experience any issues, please file a report for each of them. You can switch to the old backend to work around problems by either setting `RUSTFLAGS="-Zorbit=off"` or by annotating specific functions with `#[rustc_no_mir]` (which requires `#![feature(rustc_attrs)]` at the crate-level). I would like this PR to get into nightly soon so that we can get early feedback in this release cycle and focus on correctness fixes and performance improvements, with the potential for removing the old backend implementation before beta branches off. cc @rust-lang/compiler

rust-highfive assigned nikomatsakis May 27, 2016

eddyb mentioned this pull request May 27, 2016

"this could sometimes panic" lint rust-lang/rust-clippy#959

Open

eddyb force-pushed the mir-overflow branch from c469e72 to 055f608 Compare May 28, 2016 05:11

eddyb force-pushed the mir-overflow branch from 055f608 to 4ed6d14 Compare May 31, 2016 10:18

nikomatsakis reviewed Jun 3, 2016
View reviewed changes

eddyb force-pushed the mir-overflow branch from 4ed6d14 to cd7044d Compare June 4, 2016 16:53

Aatch and others added 12 commits June 5, 2016 14:02

Check arithmetic in the MIR

73f3054

Add, Sub, Mul, Shl, and Shr are checked using a new Rvalue: CheckedBinaryOp, while Div, Rem and Neg are handled with explicit checks in the MIR.

Add a with_cond method

f2c983b

Factors out the common pattern across the several places that do arithmetic checks

Enable the overflow-related tests for MIR

bcdb260

Change with_cond to build_cond_br

7fbff36

This is simpler to work with than `with_cond`.

Add a new Assert terminator to MIR for bounds & arithmetic checks.

156b1fb

trans: generalize OperandValue::FatPtr to all pairs of immediates.

f1f453c

trans: support uses of projections of immediate pairs.

cab35ff

mir: report when overflow checks would be missing cross-crate.

4adc967

core: mark relevant functions with #[rustc_inherit_overflow_checks].

702c47b

Respect #[rustc_inherit_overflow_checks] in mir::build and trans.

d8dddbf

rustc_const_eval: remove unused arithmetic ErrKind variants.

b6ce2aa

rustc_const_eval: strings are not indexable in Rust 1.x.

afc598e

eddyb and others added 5 commits June 5, 2016 14:41

rustc_const_eval: track the length and index in IndexOutOfBounds.

1447fbf

trans: use the same messages for both MIR and old arithmetic checks.

b8c5053

trans: implement CheckedBinaryOp in mir::constant.

d735f6b

trans: report as many errors as possible for constants.

e71f6d8

[MIR] Handle call return values that need to be casted properly.

da081e1

eddyb force-pushed the mir-overflow branch from cd7044d to c497e87 Compare June 5, 2016 12:08

eddyb mentioned this pull request Jun 5, 2016

[MIR] Handle call return values that need to be casted properly. #34054

Closed

eddyb force-pushed the mir-overflow branch from c497e87 to 4dea80e Compare June 5, 2016 12:24

trans: update Luqmana's patch for generalized pair handling.

cee244d

eddyb force-pushed the mir-overflow branch from 4dea80e to cee244d Compare June 5, 2016 12:34

bors merged commit cee244d into rust-lang:master Jun 5, 2016

bors mentioned this pull request Jun 5, 2016

[MIR] Fix double-rounding of float constants and ignore NaN sign in tests. #34006

Merged

eddyb deleted the mir-overflow branch June 5, 2016 16:15

bors mentioned this pull request Jun 5, 2016

Prepare ConstVal for constant propagators and reduce eval_const_expr in MIR #33274

Closed

eddyb mentioned this pull request Jun 5, 2016

Switch to MIR-based translation by default. #34096

Merged

pnkfelix mentioned this pull request Jun 6, 2016

Mir: introduce overflow operations #29769

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[MIR] Implement overflow checking #33905

[MIR] Implement overflow checking #33905

eddyb commented May 27, 2016 •

edited

Loading

rust-highfive commented May 27, 2016

bluss commented May 27, 2016

eddyb commented May 27, 2016

alexcrichton commented May 27, 2016

nikomatsakis commented May 27, 2016

nikomatsakis commented May 29, 2016

nikomatsakis commented May 29, 2016

nikomatsakis commented May 29, 2016

nikomatsakis commented May 29, 2016

nikomatsakis Jun 3, 2016

bors commented Jun 4, 2016

nikomatsakis commented Jun 4, 2016

bors commented Jun 5, 2016

eddyb commented Jun 5, 2016

bors commented Jun 5, 2016

arielb1 commented Jun 5, 2016

eddyb commented Jun 5, 2016

eddyb commented Jun 5, 2016

bors commented Jun 5, 2016

bors commented Jun 5, 2016

bors commented Jun 5, 2016

[MIR] Implement overflow checking #33905

[MIR] Implement overflow checking #33905

Conversation

eddyb commented May 27, 2016 • edited Loading

rust-highfive commented May 27, 2016

bluss commented May 27, 2016

eddyb commented May 27, 2016

alexcrichton commented May 27, 2016

nikomatsakis commented May 27, 2016

nikomatsakis commented May 29, 2016

nikomatsakis commented May 29, 2016

nikomatsakis commented May 29, 2016

nikomatsakis commented May 29, 2016

nikomatsakis Jun 3, 2016

Choose a reason for hiding this comment

bors commented Jun 4, 2016

nikomatsakis commented Jun 4, 2016

bors commented Jun 5, 2016

eddyb commented Jun 5, 2016

bors commented Jun 5, 2016

arielb1 commented Jun 5, 2016

eddyb commented Jun 5, 2016

eddyb commented Jun 5, 2016

bors commented Jun 5, 2016

bors commented Jun 5, 2016

bors commented Jun 5, 2016

eddyb commented May 27, 2016 •

edited

Loading