From 809dc73d90d191c75b24840113797bd4f7e138b3 Mon Sep 17 00:00:00 2001
From: Gary Guo <gary@garyguo.net>
Date: Fri, 11 Oct 2024 11:54:16 +0100
Subject: [PATCH] Make asm label blocks safe context
`asm!()` is forced to be wrapped inside unsafe. If there's no special
treatment, the label blocks would also always be unsafe with no way
of opting out.
---
.../rustc_mir_build/src/check_unsafety.rs | 39 ++++++++++++++++++-
.../src/language-features/asm-goto.md | 4 +-
tests/ui/asm/x86_64/goto-block-safe.rs | 23 +++++++++++
tests/ui/asm/x86_64/goto-block-safe.stderr | 14 +++++++
4 files changed, 78 insertions(+), 2 deletions(-)
create mode 100644 tests/ui/asm/x86_64/goto-block-safe.rs
create mode 100644 tests/ui/asm/x86_64/goto-block-safe.stderr
diff --git a/compiler/rustc_mir_build/src/check_unsafety.rs b/compiler/rustc_mir_build/src/check_unsafety.rs
index 8512763a595..2e3169bbf89 100644
--- a/compiler/rustc_mir_build/src/check_unsafety.rs
+++ b/compiler/rustc_mir_build/src/check_unsafety.rs
@@ -541,8 +541,45 @@ impl<'a, 'tcx> Visitor<'a, 'tcx> for UnsafetyVisitor<'a, 'tcx> {
self.requires_unsafe(expr.span, DerefOfRawPointer);
}
}
- ExprKind::InlineAsm { .. } => {
+ ExprKind::InlineAsm(box InlineAsmExpr {
+ asm_macro: _,
+ ref operands,
+ template: _,
+ options: _,
+ line_spans: _,
+ }) => {
self.requires_unsafe(expr.span, UseOfInlineAssembly);
+
+ // For inline asm, do not use `walk_expr`, since we want to handle the label block
+ // specially.
+ for op in &**operands {
+ use rustc_middle::thir::InlineAsmOperand::*;
+ match op {
+ In { expr, reg: _ }
+ | Out { expr: Some(expr), reg: _, late: _ }
+ | InOut { expr, reg: _, late: _ } => self.visit_expr(&self.thir()[*expr]),
+ SplitInOut { in_expr, out_expr, reg: _, late: _ } => {
+ self.visit_expr(&self.thir()[*in_expr]);
+ if let Some(out_expr) = out_expr {
+ self.visit_expr(&self.thir()[*out_expr]);
+ }
+ }
+ Out { expr: None, reg: _, late: _ }
+ | Const { value: _, span: _ }
+ | SymFn { value: _, span: _ }
+ | SymStatic { def_id: _ } => {}
+ Label { block } => {
+ // Label blocks are safe context.
+ // `asm!()` is forced to be wrapped inside unsafe. If there's no special
+ // treatment, the label blocks would also always be unsafe with no way
+ // of opting out.
+ self.in_safety_context(SafetyContext::Safe, |this| {
+ visit::walk_block(this, &this.thir()[*block])
+ });
+ }
+ }
+ }
+ return;
}
ExprKind::Adt(box AdtExpr {
adt_def,
diff --git a/src/doc/unstable-book/src/language-features/asm-goto.md b/src/doc/unstable-book/src/language-features/asm-goto.md
index d72eb7c0c6e..823118bcae1 100644
--- a/src/doc/unstable-book/src/language-features/asm-goto.md
+++ b/src/doc/unstable-book/src/language-features/asm-goto.md
@@ -21,7 +21,9 @@ unsafe {
}
```
-The block must have unit type or diverge.
+The block must have unit type or diverge. The block starts a new safety context,
+so despite outer `unsafe`, you need extra unsafe to perform unsafe operations
+within `label <block>`.
When `label <block>` is used together with `noreturn` option, it means that the
assembly will not fallthrough. It's allowed to jump to a label within the
diff --git a/tests/ui/asm/x86_64/goto-block-safe.rs b/tests/ui/asm/x86_64/goto-block-safe.rs
new file mode 100644
index 00000000000..ee833a48a4b
--- /dev/null
+++ b/tests/ui/asm/x86_64/goto-block-safe.rs
@@ -0,0 +1,23 @@
+//@ only-x86_64
+//@ needs-asm-support
+
+#![deny(unreachable_code)]
+#![feature(asm_goto)]
+
+use std::arch::asm;
+
+fn goto_fallthough() {
+ unsafe {
+ asm!(
+ "/* {} */",
+ label {
+ core::hint::unreachable_unchecked();
+ //~^ ERROR [E0133]
+ }
+ )
+ }
+}
+
+fn main() {
+ goto_fallthough();
+}
diff --git a/tests/ui/asm/x86_64/goto-block-safe.stderr b/tests/ui/asm/x86_64/goto-block-safe.stderr
new file mode 100644
index 00000000000..49818db7484
--- /dev/null
+++ b/tests/ui/asm/x86_64/goto-block-safe.stderr
@@ -0,0 +1,14 @@
+error[E0133]: call to unsafe function `unreachable_unchecked` is unsafe and requires unsafe function or block
+ --> $DIR/goto-block-safe.rs:14:17
+ |
+LL | unsafe {
+ | ------ items do not inherit unsafety from separate enclosing items
+...
+LL | core::hint::unreachable_unchecked();
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ call to unsafe function
+ |
+ = note: consult the function's documentation for information on how to avoid undefined behavior
+
+error: aborting due to 1 previous error
+
+For more information about this error, try `rustc --explain E0133`.