Skip to content

ConstantIndex and Index not flagged as potential aliases #160525

Description

@pnkfelix

I tried this code (playpen):

fn main() {
    let mut arr = [[Box::new(42)]];
    let alias = &mut arr[0][{ let [row] = arr; drop(row); 0 }];
    println!("{}", **alias); // use-after-free of arr's dead stack slot
}

I expected to see this happen: Compiler rejects code as unsound.

Instead, this happened: Compiler accepts code and prints a garbage number.

When run under Miri, we see this output:

error: Undefined Behavior: constructing invalid value of type std::boxed::Box<i32>: encountered a dangling box (use-after-free)
 --> src/main.rs:4:20
  |
4 |     println!("{}", **alias); // use-after-free of arr's dead stack slot
  |                    ^^^^^^^ Undefined Behavior occurred here
  |
  = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
  = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

Hypothesis: after a move _1[ConstantIndex{0 of 1}], a subsequent use of _1[Index(_6)] is not flagged as a use-of-partially-moved. The "any subpath moved" check of borrowck treats ConstantIndex as a sibling of a runtime Index projection, rather than a potential alias.

Meta

Nightly channel
Build using the Nightly version: 1.99.0-nightly

(2026-08-03 5048696)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

A-NLLArea: Non-lexical lifetimes (NLL)A-arrayArea: `[T; N]`A-borrow-checkerArea: The borrow checkerC-bugCategory: This is a bug.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-highHigh priorityT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.T-typesRelevant to the types team, which will review and decide on the PR/issue.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions