Stacked Borrows: not enough UB to justify `noalias` on `Box`

[RalfJung]

The following example passes Miri, but has UB in LLVM:

unsafe fn test(mut x: Box<i32>, y: *const i32) -> i32 {
    // We will call this in a way that x and y alias.
    *x = 5;
    std::mem::forget(x);
    *y // this invalidates x, but that's fine since Box can be invalidated during the function
}

fn main() { unsafe {
    let mut v = 42;
    let ptr = &mut v as *mut i32;
    test(Box::from_raw(ptr), ptr);
} }

The reason for this is that we allow a Box pointer to be invalidated while test runs (which is necessary because the function might deallocate it), so Stacked Borrows says it is fine to use an aliasing pointer (y) while test runs as long as we don't use x again afterwards.

[saethlin]

The implementation of Stacked Borrows in Miri deliberately doesn't create a protector for Box. It sounds to me like adding a protector here would be sufficient UB. Is that correct? But we can't add protectors for Box, because that would make drop(Box::new(1)) UB?

If the answers to my questions are yes, I wonder if we could fix this by weakening protectors so that they do not completely forbid deallocation. At least as far as I can understand, what LLVM wants is to insert speculative reads. If deallocating a protected pointer is for sure the last thing that a function does before returning, it seems to me like that would be compatible with inserting speculative reads.

[RalfJung]

On &mut we cannot allow deallocation though since we do emit dereferenceable (and it means "dereferenceable for duration of function call").

If deallocating a protected pointer is for sure the last thing that a function does before returning, it seems to me like that would be compatible with inserting speculative reads.

The speculative read could still be inserted after that last thing. I don't see how this can work. (Leaving aside the question of how to formalize "the last thing a function does before returning".)

I have a pretty clear idea for a fix: we need a weaker kind of protector, that still disallows any action by other pointers that would invalidate this one, but allows this pointer itself to be used for deallocation.

[RalfJung]

#377 describes the fix in some more detail, and rust-lang/miri#2684 implements it in Miri.