NormalizeArrayLen MIR opt unsound due to missed writes

[JakobDegen]

The opt, as written today, will miscompile something that looks like this:

slice_ptr = Cast(array_ptr);
r = &mut slice_ptr;
*r = something_else;
Len(slice_ptr)

The bug is roughly on this line:

rust/compiler/rustc_mir_transform/src/normalize_array_len.rs

Line 270 in 696563e

state.remove(&place.local);

This makes an attempt to detect other writes to the slice_ptr local, but it misses a lot of cases. Taking a reference like in the example above is an easy one, but SetDiscriminant is also missed, as well as writes to any aliasing pointers.

As far as I can tell this needs Rvalue::Cast support in custom MIR to reproduce.

@rustbot label A-mir-opt T-compiler requires-nightly

[shamatar]

This optimization is more a workaround of unwillingness to add "len()" function to arrays, so method resolution would not need to use coercion to slice, but I'll check what can be done to fix it