Auto merge of rust-lang#121936 - RalfJung:miri, r=RalfJung

Miri subtree update r? `@ghost`

Author: bors

src/tools/miri/README.md

@@ -412,6 +412,8 @@ to Miri failing to detect cases of undefined behavior in a program.
  The default is to search for and remove unreachable provenance once every `10000` basic blocks. Setting
  this to `0` disables the garbage collector, which causes some programs to have explosive memory
  usage and/or super-linear runtime.
+* `-Zmiri-track-alloc-accesses` show not only allocation and free events for tracked allocations,
+ but also reads and writes.
 * `-Zmiri-track-alloc-id=<id1>,<id2>,...` shows a backtrace when the given allocations are
  being allocated or freed. This helps in debugging memory leaks and
  use after free bugs. Specifying this argument multiple times does not overwrite the previous
@@ -588,6 +590,7 @@ Definite bugs found:
 * [Dropping with unaligned pointers in `vec::IntoIter`](https://github.com/rust-lang/rust/pull/106084)
 * [Deallocating with the wrong layout in new specializations for in-place `Iterator::collect`](https://github.com/rust-lang/rust/pull/118460)
 * [Incorrect offset computation for highly-aligned types in `portable-atomic-util`](https://github.com/taiki-e/portable-atomic/pull/138)
+* [Occasional memory leak in `std::mpsc` channels](https://github.com/rust-lang/rust/issues/121582) (original code in [crossbeam](https://github.com/crossbeam-rs/crossbeam/pull/1084))
 
 Violations of [Stacked Borrows] found that are likely bugs (but Stacked Borrows is currently just an experiment):
 

src/tools/miri/miri-script/src/commands.rs

@@ -356,11 +356,17 @@ impl Command {
  .unwrap_or_else(|_| "0".into())
  .parse()
  .context("failed to parse MIRI_SEED_START")?;
- let seed_count: u64 = env::var("MIRI_SEEDS")
- .unwrap_or_else(|_| "256".into())
- .parse()
- .context("failed to parse MIRI_SEEDS")?;
- let seed_end = seed_start + seed_count;
+ let seed_end: u64 = match (env::var("MIRI_SEEDS"), env::var("MIRI_SEED_END")) {
+ (Ok(_), Ok(_)) => bail!("Only one of MIRI_SEEDS and MIRI_SEED_END may be set"),
+ (Ok(seeds), Err(_)) =>
+ seed_start + seeds.parse::<u64>().context("failed to parse MIRI_SEEDS")?,
+ (Err(_), Ok(seed_end)) => seed_end.parse().context("failed to parse MIRI_SEED_END")?,
+ (Err(_), Err(_)) => seed_start + 256,
+ };
+ if seed_end <= seed_start {
+ bail!("the end of the seed range must be larger than the start.");
+ }
+
  let Some((command_name, trailing_args)) = command.split_first() else {
  bail!("expected many-seeds command to be non-empty");
  };

src/tools/miri/miri-script/src/main.rs

@@ -113,8 +113,9 @@ sysroot, to prevent conflicts with other toolchains.
 ./miri many-seeds <command>:
 Runs <command> over and over again with different seeds for Miri. The MIRIFLAGS
 variable is set to its original value appended with ` -Zmiri-seed=$SEED` for
-many different seeds. The MIRI_SEEDS variable controls how many seeds are being
-tried; MIRI_SEED_START controls the first seed to try.
+many different seeds. MIRI_SEED_START controls the first seed to try (default: 0).
+MIRI_SEEDS controls how many seeds are being tried (default: 256);
+alternatively, MIRI_SEED_END controls the end of the (exclusive) seed range to try.
 
 ./miri bench <benches>:
 Runs the benchmarks from bench-cargo-miri in hyperfine. hyperfine needs to be installed.

src/tools/miri/miri.bat

@@ -2,7 +2,10 @@
 :: Windows will not execute the bash script, and select this.
 @echo off
 set MIRI_SCRIPT_TARGET_DIR=%0\..\miri-script\target
-cargo build %CARGO_EXTRA_FLAGS% -q --target-dir %MIRI_SCRIPT_TARGET_DIR% --manifest-path %0\..\miri-script\Cargo.toml
+
+:: If any other steps are added, the "|| exit /b" must be appended to early
+:: return from the script. If not, it will continue execution.
+cargo build %CARGO_EXTRA_FLAGS% -q --target-dir %MIRI_SCRIPT_TARGET_DIR% --manifest-path %0\..\miri-script\Cargo.toml || exit /b
 
 :: Forwards all arguments to this file to the executable.
 :: We invoke the binary directly to avoid going through rustup, which would set some extra

src/tools/miri/rust-version

@@ -1 +1 @@
-c5f69bdd5173a948e0131f934fa7c4cbf5e0b55f
+1a1876c9790f168fb51afa335a7ba3e6fc267d75

src/tools/miri/src/bin/miri.rs

@@ -534,6 +534,8 @@ fn main() {
  ),
  };
  miri_config.tracked_alloc_ids.extend(ids);
+ } else if arg == "-Zmiri-track-alloc-accesses" {
+ miri_config.track_alloc_accesses = true;
  } else if let Some(param) = arg.strip_prefix("-Zmiri-compare-exchange-weak-failure-rate=") {
  let rate = match param.parse::<f64>() {
  Ok(rate) if rate >= 0.0 && rate <= 1.0 => rate,

src/tools/miri/src/borrow_tracker/mod.rs

@@ -122,13 +122,6 @@ impl VisitProvenance for GlobalStateInner {
 /// We need interior mutable access to the global state.
 pub type GlobalState = RefCell<GlobalStateInner>;
 
-/// Indicates which kind of access is being performed.
-#[derive(Copy, Clone, Hash, PartialEq, Eq, Debug)]
-pub enum AccessKind {
- Read,
- Write,
-}
-
 impl fmt::Display for AccessKind {
  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
  match self {
@@ -384,7 +377,12 @@ pub trait EvalContextExt<'mir, 'tcx: 'mir>: crate::MiriInterpCxExt<'mir, 'tcx> {
  if matches!(kind, AllocKind::LiveData) {
  let alloc_extra = this.get_alloc_extra(*alloc_id)?; // can still fail for `extern static`
  let alloc_borrow_tracker = &alloc_extra.borrow_tracker.as_ref().unwrap();
- alloc_borrow_tracker.release_protector(&this.machine, borrow_tracker, *tag)?;
+ alloc_borrow_tracker.release_protector(
+ &this.machine,
+ borrow_tracker,
+ *tag,
+ *alloc_id,
+ )?;
  }
  }
  borrow_tracker.borrow_mut().end_call(&frame.extra);
@@ -498,10 +496,12 @@ impl AllocState {
  machine: &MiriMachine<'_, 'tcx>,
  global: &GlobalState,
  tag: BorTag,
+ alloc_id: AllocId, // diagnostics
  ) -> InterpResult<'tcx> {
  match self {
  AllocState::StackedBorrows(_sb) => Ok(()),
- AllocState::TreeBorrows(tb) => tb.borrow_mut().release_protector(machine, global, tag),
+ AllocState::TreeBorrows(tb) =>
+ tb.borrow_mut().release_protector(machine, global, tag, alloc_id),
  }
  }
 }

src/tools/miri/src/borrow_tracker/stacked_borrows/diagnostics.rs

@@ -5,7 +5,7 @@ use rustc_data_structures::fx::FxHashSet;
 use rustc_span::{Span, SpanData};
 use rustc_target::abi::Size;
 
-use crate::borrow_tracker::{AccessKind, GlobalStateInner, ProtectorKind};
+use crate::borrow_tracker::{GlobalStateInner, ProtectorKind};
 use crate::*;
 
 /// Error reporting

src/tools/miri/src/borrow_tracker/stacked_borrows/mod.rs

@@ -16,7 +16,7 @@ use rustc_target::abi::{Abi, Size};
 
 use crate::borrow_tracker::{
  stacked_borrows::diagnostics::{AllocHistory, DiagnosticCx, DiagnosticCxBuilder},
- AccessKind, GlobalStateInner, ProtectorKind,
+ GlobalStateInner, ProtectorKind,
 };
 use crate::*;
 

src/tools/miri/src/borrow_tracker/tree_borrows/diagnostics.rs

@@ -9,7 +9,7 @@ use crate::borrow_tracker::tree_borrows::{
  tree::LocationState,
  unimap::UniIndex,
 };
-use crate::borrow_tracker::{AccessKind, ProtectorKind};
+use crate::borrow_tracker::ProtectorKind;
 use crate::*;
 
 /// Cause of an access: either a real access or one
@@ -278,6 +278,8 @@ impl History {
 pub(super) struct TbError<'node> {
  /// What failure occurred.
  pub error_kind: TransitionError,
+ /// The allocation in which the error is happening.
+ pub alloc_id: AllocId,
  /// The offset (into the allocation) at which the conflict occurred.
  pub error_offset: u64,
  /// The tag on which the error was triggered.
@@ -300,7 +302,11 @@ impl TbError<'_> {
  let accessed = self.accessed_info;
  let conflicting = self.conflicting_info;
  let accessed_is_conflicting = accessed.tag == conflicting.tag;
- let title = format!("{cause} through {accessed} is forbidden");
+ let title = format!(
+ "{cause} through {accessed} at {alloc_id:?}[{offset:#x}] is forbidden",
+ alloc_id = self.alloc_id,
+ offset = self.error_offset
+ );
  let (title, details, conflicting_tag_name) = match self.error_kind {
  ChildAccessForbidden(perm) => {
  let conflicting_tag_name =