Repository navigation
Conversation
At -C opt-level=2/3 with incremental compilation off (e.g. cargo --release), rustc's MIR Inline pass inlines small same-crate functions into their callers, including ones with requires/ensures and #[thrust::trusted] ones. An inlined call leaves no Call terminator, so its arguments were never checked against the callee's precondition and violations verified as safe. Fixes #348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YQVMLYpCUxi5PMD6MSDMqM
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e44a255a4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| // A call inlined by the MIR inliner leaves no `Call` terminator behind, so the | ||
| // arguments are never checked against the callee's specification. | ||
| config.opts.unstable_opts.inline_mir = Some(false); |
There was a problem hiding this comment.
When a verified crate enables rustc_attrs and marks a specified or trusted callee with #[rustc_force_inline], this setting does not preserve its Call terminator: rustc runs a separate mandatory ForceInline pass whose is_enabled always returns true and which cannot be overridden (rustc source). Consequently, such a callee's precondition can still disappear and an invalid call can verify as safe; account for this pass or reject specifications on force-inlined functions rather than claiming all calls remain visible.
Useful? React with 👍 / 👎.
This branch has not been deployed
2 participants
Fixes #348.
At
-C opt-level=2/3with incremental compilation off (for examplecargo --release), rustc's MIRInlinepass inlines small same-crate functions into their callers. This includes functions withrequires/ensuresand#[thrust::trusted]ones. An inlined call leaves noCallterminator inoptimized_mir, so Thrust never checked the arguments against the callee's precondition, and violations verified assafe.This PR sets
-Zinline-mir=no(unstable_opts.inline_mir = Some(false)) inCompilerCalls::config, next to the MIR passes the driver already disables.Inline::is_enabledchecks this option first, so every call stays a call and is typed through the callee's spec at any opt level.Test
tests/ui/{pass,fail}/trusted_requires_opt_level.rscall a trusted function withrequires(x != 0)at-C opt-level=3, once with1and once with0. Without this change, thefailcase verifies assafe.cargo test(402 UI tests),cargo fmt --checkandcargo clippy -D warningsall pass locally. I also re-ran the issue's reproducers at opt-level 2 and 3. Each now givesUnsat, including theget_uncheckedone under PCSat.Generated by Claude Code