Rollup merge of #144885 - zachs18:ptr_guaranteed_cmp_more, r=RalfJung

Implement some more checks in `ptr_guaranteed_cmp`.
* Pointers with different residues modulo their allocations' least common alignment are never equal.
* Pointers to the same static allocation are equal if and only if they have the same offset.
* Pointers to different non-zero-sized static allocations are unequal if both point within their allocation, and not on opposite ends.
Tracking issue for `const_raw_ptr_comparison`: <#53020>
This should not affect `is_null`, the only usage of this intrinsic on stable.
Closes#144584

Author: Zalathar

compiler/rustc_const_eval/src/const_eval/machine.rs

@@ -280,22 +280,110 @@ impl<'tcx> CompileTimeInterpCx<'tcx> {
 interp_ok(match(a, b){
 // Comparisons between integers are always known.
 (Scalar::Int(a),Scalar::Int(b)) => (a == b)asu8,
-// Comparisons of null with an arbitrary scalar can be known if `scalar_may_be_null`
-// indicates that the scalar can definitely *not* be null.
-(Scalar::Int(int), ptr) | (ptr,Scalar::Int(int))
-if int.is_null() && !self.scalar_may_be_null(ptr)? =>
-{
-0
+// Comparing a pointer `ptr` with an integer `int` is equivalent to comparing
+// `ptr-int` with null, so we can reduce this case to a `scalar_may_be_null` test.
+(Scalar::Int(int),Scalar::Ptr(ptr, _)) | (Scalar::Ptr(ptr, _),Scalar::Int(int)) => {
+let int = int.to_target_usize(*self.tcx);
+// The `wrapping_neg` here may produce a value that is not
+// a valid target usize any more... but `wrapping_offset` handles that correctly.
+let offset_ptr = ptr.wrapping_offset(Size::from_bytes(int.wrapping_neg()),self);
+if !self.scalar_may_be_null(Scalar::from_pointer(offset_ptr,self))? {
+// `ptr.wrapping_sub(int)` is definitely not equal to `0`, so `ptr != int`
+0
+}else{
+// `ptr.wrapping_sub(int)` could be equal to `0`, but might not be,
+// so we cannot know for sure if `ptr == int` or not
+2
+}
+}
+(Scalar::Ptr(a, _),Scalar::Ptr(b, _)) => {
+let(a_prov, a_offset) = a.prov_and_relative_offset();
+let(b_prov, b_offset) = b.prov_and_relative_offset();
+let a_allocid = a_prov.alloc_id();
+let b_allocid = b_prov.alloc_id();
+let a_info = self.get_alloc_info(a_allocid);
+let b_info = self.get_alloc_info(b_allocid);
+
+// Check if the pointers cannot be equal due to alignment
+if a_info.align > Align::ONE && b_info.align > Align::ONE{
+let min_align = Ord::min(a_info.align.bytes(), b_info.align.bytes());
+let a_residue = a_offset.bytes() % min_align;
+let b_residue = b_offset.bytes() % min_align;
+if a_residue != b_residue {
+// If the two pointers have a different residue modulo their
+// common alignment, they cannot be equal.
+returninterp_ok(0);
+}
+// The pointers have the same residue modulo their common alignment,
+// so they could be equal. Try the other checks.
+}
+
+iflet(Some(GlobalAlloc::Static(a_did)),Some(GlobalAlloc::Static(b_did))) = (
+self.tcx.try_get_global_alloc(a_allocid),
+self.tcx.try_get_global_alloc(b_allocid),
+){
+if a_allocid == b_allocid {
+debug_assert_eq!(
+ a_did, b_did,
+"different static item DefIds had same AllocId? {a_allocid:?} == {b_allocid:?}, {a_did:?} != {b_did:?}"
+);
+// Comparing two pointers into the same static. As per
+// https://doc.rust-lang.org/nightly/reference/items/static-items.html#r-items.static.intro
+// a static cannot be duplicated, so if two pointers are into the same
+// static, they are equal if and only if their offsets are equal.
+(a_offset == b_offset)asu8
+}else{
+debug_assert_ne!(
+ a_did, b_did,
+"same static item DefId had two different AllocIds? {a_allocid:?} != {b_allocid:?}, {a_did:?} == {b_did:?}"
+);
+// Comparing two pointers into the different statics.
+// We can never determine for sure that two pointers into different statics
+// are *equal*, but we can know that they are *inequal* if they are both
+// strictly in-bounds (i.e. in-bounds and not one-past-the-end) of
+// their respective static, as different non-zero-sized statics cannot
+// overlap or be deduplicated as per
+// https://doc.rust-lang.org/nightly/reference/items/static-items.html#r-items.static.intro
+// (non-deduplication), and
+// https://doc.rust-lang.org/nightly/reference/items/static-items.html#r-items.static.storage-disjointness
+// (non-overlapping).
+if a_offset < a_info.size && b_offset < b_info.size{
+0
+}else{
+// Otherwise, conservatively say we don't know.
+// There are some cases we could still return `0` for, e.g.
+// if the pointers being equal would require their statics to overlap
+// one or more bytes, but for simplicity we currently only check
+// strictly in-bounds pointers.
+2
+}
+}
+}else{
+// All other cases we conservatively say we don't know.
+//
+// For comparing statics to non-statics, as per https://doc.rust-lang.org/nightly/reference/items/static-items.html#r-items.static.storage-disjointness
+// immutable statics can overlap with other kinds of allocations sometimes.
+//
+// FIXME: We could be more decisive for (non-zero-sized) mutable statics,
+// which cannot overlap with other kinds of allocations.
+//
+// Functions and vtables can be duplicated and deduplicated, so we
+// cannot be sure of runtime equality of pointers to the same one, or the
+// runtime inequality of pointers to different ones (see e.g. #73722),
+// so comparing those should return 2, whether they are the same allocation
+// or not.
+//
+// `GlobalAlloc::TypeId` exists mostly to prevent consteval from comparing
+// `TypeId`s, so comparing those should always return 2, whether they are the
+// same allocation or not.
+//
+// FIXME: We could revisit comparing pointers into the same
+// `GlobalAlloc::Memory` once https://github.com/rust-lang/rust/issues/128775
+// is fixed (but they can be deduplicated, so comparing pointers into different
+// ones should return 2).
+2
+}
 }
-// Other ways of comparing integers and pointers can never be known for sure.
-(Scalar::Int{ .. },Scalar::Ptr(..)) | (Scalar::Ptr(..),Scalar::Int{ .. }) => 2,
-// FIXME: return a `1` for when both sides are the same pointer, *except* that
-// some things (like functions and vtables) do not have stable addresses
-// so we need to be careful around them (see e.g. #73722).
-// FIXME: return `0` for at least some comparisons where we can reliably
-// determine the result of runtime inequality tests at compile-time.
-// Examples include comparison of addresses in different static items.
-(Scalar::Ptr(..),Scalar::Ptr(..)) => 2,
 })
 }
 }

tests/ui/consts/ptr_comparisons.rs

@@ -1,43 +1,205 @@
 //@ compile-flags: --crate-type=lib
 //@ check-pass
+//@ edition: 2024
+#![feature(const_raw_ptr_comparison)]
+#![feature(fn_align)]
+// Generally:
+// For any `Some` return, `None` would also be valid, unless otherwise noted.
+// For any `None` return, only `None` is valid, unless otherwise noted.
 
-#![feature(
- core_intrinsics,
- const_raw_ptr_comparison,
-)]
+macro_rules! do_test {
+($a:expr, $b:expr, $expected:pat) => {
+const _:() = {
+let a:*const _ = $a;
+let b:*const _ = $b;
+ assert!(matches!(<*constu8>::guaranteed_eq(a.cast(), b.cast()), $expected));
+};
+};
+}
 
-constFOO:&usize = &42;
+#[repr(align(2))]
+structT(#[allow(unused)]u16);
 
-macro_rules! check {
-(eq, $a:expr, $b:expr) => {
-pubconst _:() =
- assert!(std::intrinsics::ptr_guaranteed_cmp($a as*constu8, $b as*constu8) == 1);
-};
-(ne, $a:expr, $b:expr) => {
-pubconst _:() =
- assert!(std::intrinsics::ptr_guaranteed_cmp($a as*constu8, $b as*constu8) == 0);
+#[repr(align(2))]
+structAlignedZst;
+
+staticA:T = T(42);
+staticB:T = T(42);
+staticmutMUT_STATIC:T = T(42);
+staticZST:() = ();
+staticALIGNED_ZST:AlignedZst = AlignedZst;
+staticLARGE_WORD_ALIGNED:[usize;2] = [0,1];
+staticmutMUT_LARGE_WORD_ALIGNED:[usize;2] = [0,1];
+
+constFN_PTR:*const() = {
+fnfoo(){}
+unsafe{ std::mem::transmute(foo asfn())}
+};
+
+constALIGNED_FN_PTR:*const() = {
+#[rustc_align(2)]
+fnaligned_foo(){}
+unsafe{ std::mem::transmute(aligned_foo asfn())}
+};
+
+traitTrait{
+#[allow(unused)]
+fnmethod(&self) -> u8;
+}
+implTraitforu32{
+fnmethod(&self) -> u8{1}
+}
+implTraitfori32{
+fnmethod(&self) -> u8{2}
+}
+
+constVTABLE_PTR_1:*const() = {
+let[_data, vtable] = unsafe{
+ std::mem::transmute::<&dynTrait,[*const();2]>(&42_u32as&dynTrait)
 };
-(!, $a:expr, $b:expr) => {
-pubconst _:() =
- assert!(std::intrinsics::ptr_guaranteed_cmp($a as*constu8, $b as*constu8) == 2);
+ vtable
+};
+constVTABLE_PTR_2:*const() = {
+let[_data, vtable] = unsafe{
+ std::mem::transmute::<&dynTrait,[*const();2]>(&42_i32as&dynTrait)
 };
-}
+ vtable
+};
 
-check!(eq,0,0);
-check!(ne,0,1);
-check!(ne,FOOas*const _,0);
-check!(ne,unsafe{(FOOas*constusize).offset(1)},0);
-check!(ne,unsafe{(FOOas*constusizeas*constu8).offset(3)},0);
+// Cannot be `None`: `is_null` is stable with strong guarantees about integer-valued pointers.
+do_test!(0as*constu8,0as*constu8,Some(true));
+do_test!(0as*constu8,1as*constu8,Some(false));
 
-// We want pointers to be equal to themselves, but aren't checking this yet because
-// there are some open questions (e.g. whether function pointers to the same function
-// compare equal: they don't necessarily do at runtime).
-check!(!,FOOas*const _,FOOas*const _);
+// Integer-valued pointers can always be compared.
+do_test!(1as*constu8,1as*constu8,Some(true));
+do_test!(1as*constu8,2as*constu8,Some(false));
+
+// Cannot be `None`: `static`s' addresses, references, (and within and one-past-the-end of those),
+// and `fn` pointers cannot be null, and `is_null` is stable with strong guarantees, and
+// `is_null` is implemented using `guaranteed_cmp`.
+do_test!(&A,0as*constu8,Some(false));
+do_test!((&raw constA).cast::<u8>().wrapping_add(1),0as*constu8,Some(false));
+do_test!((&raw constA).wrapping_add(1),0as*constu8,Some(false));
+do_test!(&ZST,0as*constu8,Some(false));
+do_test!(&(),0as*constu8,Some(false));
+do_test!(const{&()},0as*constu8,Some(false));
+do_test!(FN_PTR,0as*constu8,Some(false));
+
+// This pointer is out-of-bounds, but still cannot be equal to 0 because of alignment.
+do_test!((&raw constA).cast::<u8>().wrapping_add(size_of::<T>() + 1),0as*constu8,Some(false));
 
 // aside from 0, these pointers might end up pretty much anywhere.
-check!(!,FOOas*const _,1);// this one could be `ne` by taking into account alignment
-check!(!,FOOas*const _,1024);
+do_test!(&A, align_of::<T>()as*constu8,None);
+do_test!((&raw constA).wrapping_byte_add(1),(align_of::<T>() + 1)as*constu8,None);
+
+// except that they must still be aligned
+do_test!(&A,1as*constu8,Some(false));
+do_test!((&raw constA).wrapping_byte_add(1), align_of::<T>()as*constu8,Some(false));
+
+// If `ptr.wrapping_sub(int)` cannot be null (because it is in-bounds or one-past-the-end of
+// `ptr`'s allocation, or because it is misaligned from `ptr`'s allocation), then we know that
+// `ptr != int`, even if `ptr` itself is out-of-bounds or one-past-the-end of its allocation.
+do_test!((&raw constA).wrapping_byte_add(1),1as*constu8,Some(false));
+do_test!((&raw constA).wrapping_byte_add(2),2as*constu8,Some(false));
+do_test!((&raw constA).wrapping_byte_add(3),1as*constu8,Some(false));
+do_test!((&raw constZST).wrapping_byte_add(1),1as*constu8,Some(false));
+do_test!(VTABLE_PTR_1.wrapping_byte_add(1),1as*constu8,Some(false));
+do_test!(FN_PTR.wrapping_byte_add(1),1as*constu8,Some(false));
+do_test!(&A, size_of::<T>().wrapping_neg()as*constu8,Some(false));
+do_test!(&LARGE_WORD_ALIGNED, size_of::<usize>().wrapping_neg()as*constu8,Some(false));
+// (`ptr - int != 0` due to misalignment)
+do_test!((&raw constA).wrapping_byte_add(2),1as*constu8,Some(false));
+do_test!((&raw constALIGNED_ZST).wrapping_byte_add(2),1as*constu8,Some(false));
 
 // When pointers go out-of-bounds, they *might* become null, so these comparions cannot work.
-check!(!,unsafe{(FOOas*constusize).wrapping_add(2)},0);
-check!(!,unsafe{(FOOas*constusize).wrapping_sub(1)},0);
+do_test!((&raw constA).wrapping_add(2),0as*constu8,None);
+do_test!((&raw constA).wrapping_sub(1),0as*constu8,None);
+
+// Statics cannot be duplicated
+do_test!(&A,&A,Some(true));
+
+// Two non-ZST statics cannot have the same address
+do_test!(&A,&B,Some(false));
+do_test!(&A,&raw constMUT_STATIC,Some(false));
+
+// One-past-the-end of one static can be equal to the address of another static.
+do_test!(&A,(&raw constB).wrapping_add(1),None);
+
+// Cannot know if ZST static is at the same address with anything non-null (if alignment allows).
+do_test!(&A,&ZST,None);
+do_test!(&A,&ALIGNED_ZST,None);
+
+// Unclear if ZST statics can be placed "in the middle of" non-ZST statics.
+// For now, we conservatively say they could, and return None here.
+do_test!(&ZST,(&raw constA).wrapping_byte_add(1),None);
+
+// As per https://doc.rust-lang.org/nightly/reference/items/static-items.html#r-items.static.storage-disjointness
+// immutable statics are allowed to overlap with const items and promoteds.
+do_test!(&A,&T(42),None);
+do_test!(&A,const{&T(42)},None);
+do_test!(&A,{constX:T = T(42);&X},None);
+
+// These could return Some(false), since only immutable statics can overlap with const items
+// and promoteds.
+do_test!(&raw constMUT_STATIC,&T(42),None);
+do_test!(&raw constMUT_STATIC,const{&T(42)},None);
+do_test!(&raw constMUT_STATIC,{constX:T = T(42);&X},None);
+
+// An odd offset from a 2-aligned allocation can never be equal to an even offset from a
+// 2-aligned allocation, even if the offsets are out-of-bounds.
+do_test!(&A,(&raw constB).wrapping_byte_add(1),Some(false));
+do_test!(&A,(&raw constB).wrapping_byte_add(5),Some(false));
+do_test!(&A,(&raw constALIGNED_ZST).wrapping_byte_add(1),Some(false));
+do_test!(&ALIGNED_ZST,(&raw constA).wrapping_byte_add(1),Some(false));
+do_test!(&A,(&T(42)as*constT).wrapping_byte_add(1),Some(false));
+do_test!(&A,(const{&T(42)}as*constT).wrapping_byte_add(1),Some(false));
+do_test!(&A,({constX:T = T(42);&X}as*constT).wrapping_byte_add(1),Some(false));
+
+// We could return `Some(false)` for these, as pointers to different statics can never be equal if
+// that would require the statics to overlap, even if the pointers themselves are offset out of
+// bounds or one-past-the-end. We currently only check strictly in-bounds pointers when comparing
+// pointers to different statics, however.
+do_test!((&raw constA).wrapping_add(1),(&raw constB).wrapping_add(1),None);
+do_test!(
+(&raw constLARGE_WORD_ALIGNED).cast::<usize>().wrapping_add(2),
+(&raw constMUT_LARGE_WORD_ALIGNED).cast::<usize>().wrapping_add(1),
+None
+);
+
+// Pointers into the same static are equal if and only if their offset is the same,
+// even if either is out-of-bounds.
+do_test!(&A,&A,Some(true));
+do_test!(&A,&A.0,Some(true));
+do_test!(&A,(&raw constA).wrapping_byte_add(1),Some(false));
+do_test!(&A,(&raw constA).wrapping_byte_add(2),Some(false));
+do_test!(&A,(&raw constA).wrapping_byte_add(51),Some(false));
+do_test!((&raw constA).wrapping_byte_add(51),(&raw constA).wrapping_byte_add(51),Some(true));
+
+// Pointers to the same fn may be unequal, since `fn`s can be duplicated.
+do_test!(FN_PTR,FN_PTR,None);
+do_test!(ALIGNED_FN_PTR,ALIGNED_FN_PTR,None);
+
+// Pointers to different fns may be equal, since `fn`s can be deduplicated.
+do_test!(FN_PTR,ALIGNED_FN_PTR,None);
+
+// Pointers to the same vtable may be unequal, since vtables can be duplicated.
+do_test!(VTABLE_PTR_1,VTABLE_PTR_1,None);
+
+// Pointers to different vtables may be equal, since vtables can be deduplicated.
+do_test!(VTABLE_PTR_1,VTABLE_PTR_2,None);
+
+// Function pointers to aligned function allocations are not necessarily actually aligned,
+// due to platform-specific semantics.
+// See https://github.com/rust-lang/rust/issues/144661
+// FIXME: This could return `Some` on platforms where function pointers' addresses actually
+// correspond to function addresses including alignment, or on platforms where all functions
+// are aligned to some amount (e.g. ARM where a32 function pointers are at least 4-aligned,
+// and t32 function pointers are 2-aligned-offset-by-1).
+do_test!(ALIGNED_FN_PTR,ALIGNED_FN_PTR.wrapping_byte_offset(1),None);
+
+// Conservatively say we don't know.
+do_test!(FN_PTR,VTABLE_PTR_1,None);
+do_test!((&raw constLARGE_WORD_ALIGNED).cast::<usize>().wrapping_add(1),VTABLE_PTR_1,None);
+do_test!((&raw constMUT_LARGE_WORD_ALIGNED).cast::<usize>().wrapping_add(1),VTABLE_PTR_1,None);
+do_test!((&raw constLARGE_WORD_ALIGNED).cast::<usize>().wrapping_add(1),FN_PTR,None);
+do_test!((&raw constMUT_LARGE_WORD_ALIGNED).cast::<usize>().wrapping_add(1),FN_PTR,None);