Change:
The intrinsic currently just evaluates to the value of at compile-time. However, can differ between different crates in the same crate graph, which can lead to unsoundness: Crate A: Crate B: Crate C: Crate D: If we now build crate C with but the rest not, then in the value of is so the access is in-bounds, but the actual size of is just since in crate B, evaluates to . (Actually causing this to crash may need slightly more elaborate tricks to ensure we truly evaluate the right queries at the right times and use the result in the right way, but you get the gist.) We can't have a safe intrinsic evaluate to different values in different crates, that's unsound. I can think of two options: make the intrinsic always behave the same in all crates at compile-time (e.g. by using the fallback body, which is and thus returns whether libcore was built with debug assertions). make the intrinsic unsafe and make it a safety requirement that the caller may only use the return value to decide whether a constant successfully evaluates, but not the value it evaluates to. I feel a bit uneasy about the second option since it turns what is usually fully ensured by the interpreter itself (even in the presence of unsafe code) into an invariant upheld by user code -- albeit only by code we control, assuming we will never stabilize this intrinsic. For the second option to be sound, it must be okay for the same constant to sometimes return a value and sometimes fail to evaluate. Currently I am fairly sure that is the case since a constant failing to evaluate will stop compilation. However, if the type system ever needs to "speculatively" evaluate a constant in a way such that const-eval failure does not stop compilation, then I think option 2 above would be unsound and we have to go with option 1. And I seem to recall from the last time we spoke that indeed the type system would like to have such a "speculative" form of constant evaluation? Cc
Could we maybe change this from being a to being something more like a I've always thought it really weird that it's a nullop in the first place, because it's the only nullop that you can't just const-fold once layout is available. All the other UnOps would probably be better as s instead, IMHO.
I previously suggested something like option 1 but asked that I not do that in I don't care very much whether these checks are enabled in Miri or in const eval, because every single bug I've seen these checks catch was in runtime code. The current design with an intrinsic plus a NullOp is not precious to me, and I'd be happy to redesign our way out of this odd case. I think the ideal implementation would have a MIR statement that is passed a function, and when we lower that MIR statement we generate a function call if UB checks are enabled and just ignore the statement entirely if checks are not enabled. The problem with that design is that I don't know how to bolt the library part of writing some closure to the MIR I want to generate because I can't come up with design that doesn't have a parameter.
It doesn't matter whether this is a NullaryOp or a Terminator or whatever, that makes no difference for this issue. The question is how it should behave, not how it is represented.
I don't see why a nullary op should have to be const-evaluatable. It's an operator, it can still operate and do things like fetch some runtime state from the AM. But anyway that's largely off-topic for this issue. Yeah I didn't realize the soundness concerns here. Miri should still check though, I am only talking about compile-time semantics in this issue.
Chiming in a bit late, if we can keep the possibility open for "speculatively" evaluating constants then that seems ideal to me. Definitely happy with having landed on option 1 here :-)

Discussion:
Ok(()) } <ins> /// Determines the result of a `NullaryOp::UbChecks` invocation. fn ub_checks(_ecx: &InterpCx<'tcx, Self>) -> InterpResult<'tcx, bool>; </ins> /// Called when the interpreter encounters a `StatementKind::ConstEvalCounter` instruction. /// You can use this to detect long or endlessly running programs. #[inline]

} #[inline(always)] <ins> fn ub_checks(_ecx: &InterpCx<$tcx, Self>) -> InterpResult<$tcx, bool> { // We can't look at `tcx.sess` here as that can differ across crates, which can lead to // unsound differences in evaluating the same constant at different instantiation sites. Ok(true) } #[inline(always)] </ins> fn adjust_global_allocation<'b>( _ecx: &InterpCx<$tcx, Self>, _id: AllocId,

self.tcx.offset_of_subfield(self.param_env, layout, fields.iter()).bytes(); ImmTy::from_uint(val, usize_layout()) } <del> UbChecks => ImmTy::from_bool(self.tcx.sess.ub_checks(), *self.tcx), </del> <ins> UbChecks => ImmTy::from_bool(M::ub_checks(self)?, *self.tcx), </ins> }) } }

ecx.generate_nan(inputs) } <ins> fn ub_checks(ecx: &InterpCx<'tcx, Self>) -> InterpResult<'tcx, bool> { Ok(ecx.tcx.sess.ub_checks()) } </ins> fn thread_local_static_pointer( ecx: &mut MiriInterpCx<'tcx>, def_id: DefId,