GVN misunderstands aliasing, can create overlapping assignments

[saethlin]

Reduced example from rustlantis, which is accepted by Miri without optimizations enabled:

#![feature(custom_mir, core_intrinsics)]

use std::intrinsics::mir::*;

#[custom_mir(dialect = "runtime")]
fn fn17() {
    mir!{
        let _17: Adt;
        let _33: *mut Adt;
        let _48: u32;
        let _73: &Adt;
        {
            _17 = Adt::Some(0);
            _33 = core::ptr::addr_of_mut!(_17);
            _73 = &(*_33);
            _48 = Field(Variant((*_73), 1), 0);
            (*_33) = Adt::Some(_48);
            Return()
        }
    }
}

fn main() {
    fn17();
}

enum Adt {
    None,
    Some(u32),
}

If I run this under Miri with -Zmir-enable-passes=+GVN, I see:

error: Undefined Behavior: `copy_nonoverlapping` called on overlapping ranges
  --> gvn-overlapping.rs:17:13
   |
17 |             (*_33) = Adt::Some(_48);
   |             ^^^^^^^^^^^^^^^^^^^^^^^ `copy_nonoverlapping` called on overlapping ranges
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
   = note: BACKTRACE:
   = note: inside `fn17` at gvn-overlapping.rs:17:13: 17:36

The MIR diff for GVN is:

-// MIR for `fn17` before GVN
+// MIR for `fn17` after GVN
 
 fn fn17() -> () {
     let mut _0: ();
@@ -8,11 +8,15 @@ fn fn17() -> () {
     let mut _4: &Adt;
 
     bb0: {
-        _1 = Adt::Some(const 0_u32);
+        _1 = const Adt::Some(0_u32);
         _2 = &raw mut _1;
         _4 = &(*_2);
         _3 = copy (((*_4) as variant#1).0: u32);
-        (*_2) = Adt::Some(copy _3);
+        (*_2) = copy (*_4);
         return;
     }
 }
+
+alloc1 (size: 8, align: 4) {
+    01 00 00 00 00 00 00 00                         │ ........
+}

[saethlin]

Found a similar issue with GVN, the reproducer looks different but I suspect it's the same aliasing problem:

#![feature(custom_mir, core_intrinsics)]
#![allow(internal_features)]

use std::intrinsics::mir::*;

#[custom_mir(dialect = "runtime")]
fn main() {
    mir!{
        let _1;
        let _2: &'static i32;
        let _3;
        let _4;
        let _5;
        let _6: &'static i32;
        let _7;
        let _8;
        let _9;
        {
            _4 = 0;
            _5 = 0;
            _6 = &_4;
            _2 = _6;
            _7 = [*_2, *_2, *_2, *_2, *_2];
            Goto(bb1)
        }
        bb1 = {
            _3 = 0;
            match _5 {
                0 => bb2,
                _ => bb1,
            }
        }
        bb2 = {
            _6 = &_9;
            _8 = &_7[_5];
            _5 = 5;
            match _3 {
                0 => bb3,
                _ => bb2,
            }
        }
        bb3 = {
            _1 = *_8;
            Return()
        }
    }
}

error: Undefined Behavior: indexing out of bounds: the len is 5 but the index is 5
  --> 7735683935374907524.rs:43:13
   |
43 |             _1 = *_8;
   |             ^^^^^^^^ indexing out of bounds: the len is 5 but the index is 5
   |

     bb2: {
         _6 = &_9;
         _8 = &_7[_5];
         _5 = const 5_usize;
-        switchInt(copy _3) -> [0: bb3, otherwise: bb2];
+        switchInt(const 0_i32) -> [0: bb3, otherwise: bb2];
     }
 
     bb3: {
-        _1 = copy (*_8);
+        _1 = copy _7[_5];
         return;
     }

[dianqk]

#141218 fixes the first one.

[dianqk]

Reopen for the second one.

[dianqk]

I think this could be a new issue: #141251. Also, I'd like to backport this fix.