[breaking change] Disallow statics initializing themselves

[oli-obk]

fixes #71078

Self-initialization is unsound because it breaks privacy assumptions that unsafe code can make. In

pub mod foo {
    #[derive(Debug, Copy, Clone)]
    pub struct Foo {
        x: (),
    }
}

pub static FOO: foo::Foo = FOO;

unsafe could could expect that ony functions inside the foo module were able to create a value of type Foo.

[oli-obk]

@bors try

[bors]

⌛ Trying commit 438e1a4f0bbcea7629f327d4aaf0ec90272f2816 with merge 8a5e87609850cdd8679aada01eb0f3062f254ca8...

[oli-obk]

@craterbot check

[bors]

☀️ Try build successful - checks-azure
Build commit: 8a5e87609850cdd8679aada01eb0f3062f254ca8 (8a5e87609850cdd8679aada01eb0f3062f254ca8)

[Centril]

@craterbot check

[craterbot]

👌 Experiment pr-71140 created and queued.
🤖 Automatically detected try build 8a5e87609850cdd8679aada01eb0f3062f254ca8
🔍 You can check out the queue and this experiment's details.

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

[craterbot]

🚧 Experiment pr-71140 is now running

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

[craterbot]

🎉 Experiment pr-71140 is completed!
📊 3 regressed and 6 fixed (98520 total)
📰 Open the full report.

⚠️ If you notice any spurious failure please add them to the blacklist!
ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

[mati865]

All regressions and fixes are spurious.

[oli-obk]

@rust-lang/lang I would like to perform a soundness fixing breaking change. Namely I want to forbid ZST statics from initializing themselves by value. This allows one to create a ZST that has private fields and can usually only be initialized via functions from the same module as the ZST. Since the user can reasonably expect these private parts to be private, self-initialization violates that expectation, breaking assumptions in unsafe code.

There were no crater regressions, and I find it highly unlikely that anyone is using this for purposes other than breaking our privacy rules in private code.

[Mark-Simulacrum]

This has been broken since 1.37 according to the issue. I agree with @oli-obk though that it seems pretty unlikely that there are real use cases for this.

It also feels a static ZST isn't really useful, right?

With my release team hat on, I'd say we can go ahead here. Given the crater run I'm even comfortable with doing so without a warning period, though it'd be good to land it ASAP so that we get the full 12 weeks in nightly before it hits stable.

[nikomatsakis]

I feel comfortable making this change as a soundness fix. I am quite surprised that it works as is, and I definitely think this was not really intended. Given that a crater run was done with no regressions, I think "just land it" (which is permitted per the compiler team policy on these kinds of changes).

[oli-obk]

r? @RalfJung for the impl changes

[RalfJung]

Why do this here and not centrally in Memory::check_ptr_access?

[oli-obk]

Because that function doesn't actually do any reads so far in order to prevent other kind of cycles. I'm not sure whether any of the call sites need this. I moved it to check_ptr_access and am running local tests now.

[oli-obk]

Moving the check worked.

[oli-obk]

So, moving this has started to cause problems, because validation goes through the check_ptr_access without actually doing a read (#71612 (comment)) and because const prop now creates references to foreign statics that later code ICEs on #71709 (comment)

[RalfJung]

r=me with comment nit fixed

[oli-obk]

@bors r=RalfJung

[bors]

📌 Commit ccc2d203cff884cb21d0256d995314a77990e421 has been approved by RalfJung

[oli-obk]

ran rustfmt

@bors r=RalfJung

[bors]

💡 This pull request was already approved, no need to approve it again.

• There's another pull request that is currently being tested, blocking this pull request: Support const args in type dependent paths #71154

[bors]

📌 Commit ccc2d203cff884cb21d0256d995314a77990e421 has been approved by RalfJung

[bors]

💡 This pull request was already approved, no need to approve it again.

• There's another pull request that is currently being tested, blocking this pull request: Support const args in type dependent paths #71154

[bors]

📌 Commit ccc2d203cff884cb21d0256d995314a77990e421 has been approved by RalfJung

[bors]

📌 Commit e4ab4ee has been approved by RalfJung

[rust-highfive]

Your PR failed (pretty log, raw log). Through arcane magic we have determined that the following fragments from the build log may contain information about the problem.

Click to expand the log.

2020-04-23T14:05:11.4546618Z ========================== Starting Command Output ===========================
2020-04-23T14:05:11.4564444Z [command]/bin/bash --noprofile --norc /home/vsts/work/_temp/e1e34a7b-d0e7-429e-a458-d910909cc4a7.sh
2020-04-23T14:05:11.4777655Z 
2020-04-23T14:05:11.4839402Z ##[section]Finishing: Disable git automatic line ending conversion
2020-04-23T14:05:11.4857947Z ##[section]Starting: Checkout rust-lang/rust@refs/pull/71140/merge to s
2020-04-23T14:05:11.4861243Z Task         : Get sources
2020-04-23T14:05:11.5001599Z Description  : Get sources from a repository. Supports Git, TfsVC, and SVN repositories.
2020-04-23T14:05:11.5002011Z Version      : 1.0.0
2020-04-23T14:05:11.5002172Z Author       : Microsoft
---
2020-04-23T14:05:12.6643976Z ##[command]git remote add origin https://github.com/rust-lang/rust
2020-04-23T14:05:12.6649191Z ##[command]git config gc.auto 0
2020-04-23T14:05:12.6652946Z ##[command]git config --get-all http.https://github.com/rust-lang/rust.extraheader
2020-04-23T14:05:12.6656279Z ##[command]git config --get-all http.proxy
2020-04-23T14:05:12.6665907Z ##[command]git -c http.extraheader="AUTHORIZATION: basic ***" fetch --force --tags --prune --progress --no-recurse-submodules --depth=2 origin +refs/heads/*:refs/remotes/origin/* +refs/pull/71140/merge:refs/remotes/pull/71140/merge
---
2020-04-23T14:07:25.6531084Z  ---> 318032b5f0e2
2020-04-23T14:07:25.6532194Z Step 5/8 : ENV RUST_CONFIGURE_ARGS       --build=x86_64-unknown-linux-gnu       --llvm-root=/usr/lib/llvm-8       --enable-llvm-link-shared       --set rust.thin-lto-import-instr-limit=10
2020-04-23T14:07:25.6534222Z  ---> Using cache
2020-04-23T14:07:25.6534975Z  ---> d44a858fd1ce
2020-04-23T14:07:25.6536061Z Step 6/8 : ENV SCRIPT python2.7 ../x.py test --exclude src/tools/tidy &&            python2.7 ../x.py test src/test/mir-opt --pass=build                                   --target=armv5te-unknown-linux-gnueabi &&            python2.7 ../x.py test src/tools/tidy
2020-04-23T14:07:25.6538481Z  ---> 58b910f50f5a
2020-04-23T14:07:25.6538882Z Step 7/8 : ENV NO_DEBUG_ASSERTIONS=1
2020-04-23T14:07:25.6541935Z  ---> Using cache
2020-04-23T14:07:25.6542712Z  ---> ee7702aadba1
---
2020-04-23T14:07:25.6916417Z Looks like docker image is the same as before, not uploading
2020-04-23T14:07:31.7125202Z [CI_JOB_NAME=x86_64-gnu-llvm-8]
2020-04-23T14:07:31.7381241Z [CI_JOB_NAME=x86_64-gnu-llvm-8]
2020-04-23T14:07:31.7409060Z == clock drift check ==
2020-04-23T14:07:31.7425496Z   local time: Thu Apr 23 14:07:31 UTC 2020
2020-04-23T14:07:31.8823485Z   network time: Thu, 23 Apr 2020 14:07:31 GMT
2020-04-23T14:07:31.8847495Z Starting sccache server...
2020-04-23T14:07:31.9577841Z configure: processing command line
2020-04-23T14:07:31.9579637Z configure: 
2020-04-23T14:07:31.9580797Z configure: rust.dist-src        := False

I'm a bot! I can only do what humans tell me to, so if this was not helpful or you have suggestions for improvements, please ping or otherwise contact @rust-lang/infra. (Feature Requests)