interpret: ensure that calls via no-unwind ABIs do not unwind - #161628
Merged
Conversation
rustbot
added
S-waiting-on-author
RalfJung
force-pushed
the
no-unwind-abi-check
branch
from
August 24, 2026 06:23
21d1c2a to
d1e3bca
Compare
RalfJung
marked this pull request as ready for review
August 24, 2026 06:24
rustbot
added
the
S-waiting-on-review
Collaborator
|
Some changes occurred to the CTFE / Miri interpreter cc @rust-lang/miri
cc @rust-lang/miri Some changes occurred to the CTFE machinery |
rustbot
removed
the
S-waiting-on-author
Collaborator
|
r? @mati865 rustbot has assigned @mati865. Use Why was this reviewer chosen?The reviewer was selected based on:
|
This comment has been minimized.
This comment has been minimized.
RalfJung
force-pushed
the
no-unwind-abi-check
branch
from
August 24, 2026 07:28
d1e3bca to
1c53cd0
Compare
This comment has been minimized.
This comment has been minimized.
Member
|
Should be reviewed by somebody more knowledgeable in this area. |
Member
Author
|
r? @saethlin |
This comment has been minimized.
This comment has been minimized.
RalfJung
force-pushed
the
no-unwind-abi-check
branch
from
August 25, 2026 20:09
1c53cd0 to
5965328
Compare
Collaborator
|
This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed. Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers. |
Member
|
@bors r+ |
Contributor
rust-bors
Bot
added
S-waiting-on-bors
jhpratt
added a commit
to jhpratt/rust
that referenced
this pull request
Aug 27, 2026
…ethlin interpret: ensure that calls via no-unwind ABIs do not unwind According to our [ABI docs](https://doc.rust-lang.org/nightly/std/primitive.fn.html#abi-compatibility), programs like this are okay: ```rust extern "C-unwind" fn does_not_unwind_but_could() {} fn main() { let f: extern "C-unwind" fn() = does_not_unwind_but_could; let f: extern "C" fn() = unsafe { std::mem::transmute(f) }; f(); } ``` So let's add a test for that. And also, let's adjust the checks in Miri's shims accordingly (see `src/tools/miri/src/shims/sig.rs`). We used to reject calls to functions that *might* unwind with a signature that does not allow unwinding, even if no unwinding occurred. I don't think we have an actual example of a potentially-unwinding shim with an ABI that has a compatible ABI that does not allow unwinding ("C-unwind" and "C"), so we can't add a test for this.
rust-bors Bot
pushed a commit
that referenced
this pull request
Aug 27, 2026
Rollup of 7 pull requests Successful merges: - #150075 (Implement clamp_to) - #161034 (Add SVE-accelerated Vec::retain_mut for aarch64) - #161628 (interpret: ensure that calls via no-unwind ABIs do not unwind) - #161012 (borrowck: Normalize non-rigid aliases in NLL type relating) - #161702 (Use `drop_guard` in some places in {core,alloc,std}) - #161813 (Change `is_eligible_for_coverage` from a hook to a query) - #161842 (chore: fix cargo lints)
jhpratt
added a commit
to jhpratt/rust
that referenced
this pull request
Aug 27, 2026
…ethlin interpret: ensure that calls via no-unwind ABIs do not unwind According to our [ABI docs](https://doc.rust-lang.org/nightly/std/primitive.fn.html#abi-compatibility), programs like this are okay: ```rust extern "C-unwind" fn does_not_unwind_but_could() {} fn main() { let f: extern "C-unwind" fn() = does_not_unwind_but_could; let f: extern "C" fn() = unsafe { std::mem::transmute(f) }; f(); } ``` So let's add a test for that. And also, let's adjust the checks in Miri's shims accordingly (see `src/tools/miri/src/shims/sig.rs`). We used to reject calls to functions that *might* unwind with a signature that does not allow unwinding, even if no unwinding occurred. I don't think we have an actual example of a potentially-unwinding shim with an ABI that has a compatible ABI that does not allow unwinding ("C-unwind" and "C"), so we can't add a test for this.
rust-bors Bot
pushed a commit
that referenced
this pull request
Aug 27, 2026
Rollup of 6 pull requests Successful merges: - #161034 (Add SVE-accelerated Vec::retain_mut for aarch64) - #161628 (interpret: ensure that calls via no-unwind ABIs do not unwind) - #161012 (borrowck: Normalize non-rigid aliases in NLL type relating) - #161702 (Use `drop_guard` in some places in {core,alloc,std}) - #161813 (Change `is_eligible_for_coverage` from a hook to a query) - #161842 (chore: fix cargo lints)
rust-bors Bot
pushed a commit
that referenced
this pull request
Aug 27, 2026
Rollup of 7 pull requests Successful merges: - #161034 (Add SVE-accelerated Vec::retain_mut for aarch64) - #161628 (interpret: ensure that calls via no-unwind ABIs do not unwind) - #161012 (borrowck: Normalize non-rigid aliases in NLL type relating) - #161691 (Assorted bootstrap config refactors (part 1/N)) - #161813 (Change `is_eligible_for_coverage` from a hook to a query) - #161842 (chore: fix cargo lints) - #161843 (rustdoc: fix lint `cargo::non_kebab_case_bins`)
rust-bors Bot
pushed a commit
that referenced
this pull request
Aug 27, 2026
Rollup merge of #161628 - RalfJung:no-unwind-abi-check, r=saethlin interpret: ensure that calls via no-unwind ABIs do not unwind According to our [ABI docs](https://doc.rust-lang.org/nightly/std/primitive.fn.html#abi-compatibility), programs like this are okay: ```rust extern "C-unwind" fn does_not_unwind_but_could() {} fn main() { let f: extern "C-unwind" fn() = does_not_unwind_but_could; let f: extern "C" fn() = unsafe { std::mem::transmute(f) }; f(); } ``` So let's add a test for that. And also, let's adjust the checks in Miri's shims accordingly (see `src/tools/miri/src/shims/sig.rs`). We used to reject calls to functions that *might* unwind with a signature that does not allow unwinding, even if no unwinding occurred. I don't think we have an actual example of a potentially-unwinding shim with an ABI that has a compatible ABI that does not allow unwinding ("C-unwind" and "C"), so we can't add a test for this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
According to our ABI docs, programs like this are okay:
So let's add a test for that.
And also, let's adjust the checks in Miri's shims accordingly (see
src/tools/miri/src/shims/sig.rs). We used to reject calls to functions that might unwind with a signature that does not allow unwinding, even if no unwinding occurred. I don't think we have an actual example of a potentially-unwinding shim with an ABI that has a compatible ABI that does not allow unwinding ("C-unwind" and "C"), so we can't add a test for this.