Undefined behavior in servo_arc HeaderSlice

[brson]

HeaderSlice constructs and dereferences invalid pointers created from non-pointer integers in from_header_and_iter_alloc.

Here's what miri has to say about it:

error: Undefined Behavior: invalid use of 8 as a pointer
    --> components/servo_arc/lib.rs:716:69
     |                                                                                                                                       
716  |             let fake_ref: &ArcInner<HeaderSlice<H, [T]>> = unsafe { &*fake_ptr };
     |                                                                     ^^^^^^^^^^ invalid use of 8 as a pointer                                |
     = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior                                 = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information                            = note: inside `Arc::<HeaderSlice<HeaderWithLength<u32>, [i32]>>::from_header_and_iter_alloc::<[closure@components/servo_arc/lib.rs:815:1
3: 826:14], std::iter::Empty<i32>>` at components/servo_arc/lib.rs:716:69     

[brson]

Repro by running:

cargo +nightly-2020-04-10 miri test -p servo_arc -- -Zmiri-disable-isolation

inside the servo_arc directory.

[brson]

miri has at least one other issue with this block of code that can be repro'd the same way.

[RalfJung]

Yeah, ArcInner is definitely not a ZST, so this code is creating a dangling shared reference, which is UB.

[nicoburns]

The invocation to reproduce with latest nightly appears to be MIRIFLAGS="-Zmiri-disable-isolation" cargo +nightly miri test -p servo_arc.

Running with nightly cargo 1.90.0-nightly (84709f085 2025-06-22) I get the following output:

test tests::slices_and_thin ... error: Undefined Behavior: attempting a write access using <214745> at alloc88331[0x20], but that tag does not exist in the borrow stack for this location
    --> servo_arc/lib.rs:806:21
     |
806  | /                     ptr::write(
807  | |                         current,
808  | |                         items
809  | |                             .next()
810  | |                             .expect("ExactSizeIterator over-reported length"),
811  | |                     );
     | |_____________________^ this error occurs as part of an access at alloc88331[0x20..0x24]
     |
     = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
     = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
help: <214745> would have been created here, but this is a zero-size retag ([0x20..0x20]) so the tag in question does not exist anywhere
    --> servo_arc/lib.rs:804:35
     |
804  |                 let mut current = std::ptr::addr_of_mut!(p.as_mut().data.data) as *mut T;
     |                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     = note: BACKTRACE (of the first span) on thread `tests::slices_and_thin`:
     = note: inside `Arc::<HeaderSlice<tests::Canary, i32>>::from_header_and_iter_alloc::<{closure@servo_arc/lib.rs:856:13: 856:21}, std::vec::IntoIter<i32>>` at servo_arc/lib.rs:806:21: 811:22
note: inside `Arc::<HeaderSlice<tests::Canary, i32>>::from_header_and_iter_with_size::<std::vec::IntoIter<i32>>`
    --> servo_arc/lib.rs:855:9
     |
855  | /         Arc::from_header_and_iter_alloc(
856  | |             |layout| unsafe { alloc::alloc(layout) },
857  | |             header,
858  | |             items,
859  | |             num_items,
860  | |             /* is_static = */ false,
861  | |         )
     | |_________^
note: inside `Arc::<HeaderSlice<tests::Canary, i32>>::from_header_and_iter::<std::vec::IntoIter<i32>>`
    --> servo_arc/lib.rs:872:9
     |
872  |         Self::from_header_and_iter_with_size(header, items, len)
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: inside `tests::slices_and_thin`
    --> servo_arc/lib.rs:1192:21
     |
1192 |             let x = Arc::from_header_and_iter(c, v.into_iter());
     |                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: inside closure
    --> servo_arc/lib.rs:1187:25
     |
1186 |     #[test]
     |     ------- in this procedural macro expansion
1187 |     fn slices_and_thin() {
     |                         ^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error; 3 warnings emitted