Weak::new() segfaults on uninhabited types

[jleedev]

This gives a segmentation fault:

fn main() {
    enum Void {}
    std::rc::Weak::<Void>::new();
}

There's no rust backtrace to show; I could reproduce this on various platforms and compiler versions.

[vitalyd]

std::mem::uninitialized::<T>() that gets called in Weak::new() is UB. The x86 assembly that gets generated, however, doesn’t have the ud illegal instruction but rather it does a bogus movq $0, 1

This is a nice one :)

[sfackler]

Seems like we should be able to fix it by replacing the T in the data with a

union MaybeInitialized<T> {
    initialized: T,
    uninitialized: (),
}

right?

[vitalyd]

@sfackler, yeah seems like that might work (admittedly, I’ve not thought about it too deeply). I’m assuming the unstable T: Copy requirement for the union wouldn’t be an issue for std types right?

[vitalyd]

Or rather, std would allow T: !Copy (the T: Copy is required for stable).

[sfackler]

Yeah, std doesn’t need to worry about that.

…

On Sat, Feb 24, 2018 at 7:32 AM vitalyd ***@***.***> wrote: Or rather, std would allow T: !Copy (the T: Copy is required for stable). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#48493 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABY2UQ-hbEs8ffqB5pkAhNiLjPvIGRkrks5tYCt0gaJpZM4SRtVH> .

[sfackler]

There is a bit of a complication unfortunately - Unsize isn't implemented for unions the same way it's implemented for structs currently which breaks the CoerceUnsized impls :(

[alexcrichton]

@sfackler in the meantime while we wait for #47650 I wonder, would it be possible to fix this otherwise? Could we perhaps, for example, use MaybeInitialized to create a value and place it in memory?

[sfackler]

Not sure - if the inner struct contains a bare T, I think it's undefined behavior for an instance of it to exist at all if T is uninhabited. We could use Option<T> and an accessor that does match value { Some(ref v) => v, None => intrinsics::unreachable() } I think?

[sfackler]

The Option<T> approach adds an extra tag byte in some cases though unfortunately.