ICE: codegen ssa: index out of bounds

[matthiaskrgr]

auto-reduced (treereduce-rust):

//@compile-flags: -Zsanitizer=kcfi -Cpanic=abort -Clink-dead-code=true -Cunsafe-allow-abi-mismatch=sanitizer
#![feature(c_variadic)]

struct Struct(i32);

trait Trait: Sized {
    fn get(&self) -> i32;

    unsafe extern "C" fn trait_method_mut(&mut self, mut ap: ...) -> i32 {
        self.get() + unsafe { ap.arg::<i32>() }
    }
}

impl Trait for Struct {
    fn get(&self) -> i32 {
        self.0
    }
}

fn main() {
    unsafe {
        type Method<T> = unsafe extern "C" fn(T, ...) -> i32;

        assert_eq!(
            (Struct::trait_method_mut as Method<_>)(&mut Struct(100), 32),
            132
        );
    }
}

original code

original:

//@ run-pass
#![feature(c_variadic)]

#[repr(transparent)]
struct Struct(i32);

impl Struct {
    unsafe extern "C" fn associated_function(mut ap: ...) -> i32 {
        unsafe { ap.arg() }
    }

    unsafe extern "C" fn method(&self, mut ap: ...) -> i32 {
        self.0 + unsafe { ap.arg::<i32>() }
    }
}

trait Trait: Sized {
    fn get(&self) -> i32;

    unsafe extern "C" fn trait_associated_function(mut ap: ...) -> i32 {
        unsafe { ap.arg() }
    }

    unsafe extern "C" fn trait_method_owned(self, mut ap: ...) -> i32 {
        self.get() + unsafe { ap.arg::<i32>() }
    }

    unsafe extern "C" fn trait_method_ref(&self, mut ap: ...) -> i32 {
        self.get() + unsafe { ap.arg::<i32>() }
    }

    unsafe extern "C" fn trait_method_mut(&mut self, mut ap: ...) -> i32 {
        self.get() + unsafe { ap.arg::<i32>() }
    }

    unsafe extern "C" fn trait_fat_pointer(self: Box<Self>, mut ap: ...) -> i32 {
        self.get() + unsafe { ap.arg::<i32>() }
    }
}

impl Trait for Struct {
    fn get(&self) -> i32 {
        self.0
    }
}

fn main() {
    unsafe {
        assert_eq!(Struct::associated_function(32), 32);
        assert_eq!(Struct(100).method(32), 132);

        assert_eq!(Struct::trait_associated_function(32), 32);
        assert_eq!(Struct(100).trait_method_owned(32), 132);
        assert_eq!(Struct(100).trait_method_ref(32), 132);
        assert_eq!(Struct(100).trait_method_mut(32), 132);
        assert_eq!(Struct::trait_fat_pointer(Box::new(Struct(100)), 32), 132);

        assert_eq!(<Struct as Trait>::trait_associated_function(32), 32);
        assert_eq!(Trait::trait_method_owned(Struct(100), 32), 132);
        assert_eq!(Trait::trait_method_ref(&Struct(100), 32), 132);
        assert_eq!(Trait::trait_method_mut(&mut Struct(100), 32), 132);
        assert_eq!(Trait::trait_fat_pointer(Box::new(Struct(100)), 32), 132);

        type Associated = unsafe extern "C" fn(...) -> i32;
        type Method<T> = unsafe extern "C" fn(T, ...) -> i32;

        assert_eq!((Struct::trait_associated_function as Associated)(32), 32);
        assert_eq!((Struct::trait_method_owned as Method<_>)(Struct(100), 32), 132);
        assert_eq!((Struct::trait_method_ref as Method<_>)(&Struct(100), 32), 132);
        assert_eq!((Struct::trait_method_mut as Method<_>)(&mut Struct(100), 32), 132);
        assert_eq!((Struct::trait_fat_pointer as Method<_>)(Box::new(Struct(100)), 32), 132);
    }
}

Version information

rustc 1.92.0-nightly (6710835ae 2025-09-21)
binary: rustc
commit-hash: 6710835ae739ca326441ff6c63d24fb123858300
commit-date: 2025-09-21
host: x86_64-unknown-linux-gnu
release: 1.92.0-nightly
LLVM version: 21.1.1

Command:
/home/matthias/.rustup/toolchains/master/bin/rustc -Zsanitizer=kcfi -Cpanic=abort -Clink-dead-code=true -Cunsafe-allow-abi-mismatch=sanitizer

Program output

thread 'rustc' (2122669) panicked at /rustc-dev/6710835ae739ca326441ff6c63d24fb123858300/compiler/rustc_codegen_ssa/src/mir/block.rs:519:30:
index out of bounds: the len is 2 but the index is 2
stack backtrace:
   0:     0x7f70073fd2f3 - <std::sys::backtrace::BacktraceLock::print::DisplayBacktrace as core::fmt::Display>::fmt::h8b9f34974c088868
   1:     0x7f7007a02084 - core::fmt::write::ha84e1c9772833f1c
   2:     0x7f70073b1ca1 - std::io::Write::write_fmt::hdb5fdb4d0e28d1be
   3:     0x7f70073c3062 - std::sys::backtrace::BacktraceLock::print::h29e4d84151a2f709
   4:     0x7f70073c8fc9 - std::panicking::default_hook::{{closure}}::h90e623ca4a255582
   5:     0x7f70073c8af3 - std::panicking::default_hook::h02e3e409619ad50e
   6:     0x7f70063ebbd7 - std[69fcff7c3a8a2b12]::panicking::update_hook::<alloc[83c71a3d7acdd5e5]::boxed::Box<rustc_driver_impl[9b7ad042c9288b75]::install_ice_hook::{closure#1}>>::{closure#0}
   7:     0x7f70073c93ef - std::panicking::panic_with_hook::h40deba1fb83c7386
   8:     0x7f70073c91aa - std::panicking::panic_handler::{{closure}}::hf930f7faa6618f23
   9:     0x7f70073c31a9 - std::sys::backtrace::__rust_end_short_backtrace::hbfedcee875752d04
  10:     0x7f70073a3cdd - __rustc[c91a49d78905620d]::rust_begin_unwind
  11:     0x7f70046fcc60 - core::panicking::panic_fmt::hc59e92dd4cdaa921
  12:     0x7f700572a663 - core::panicking::panic_bounds_check::h773f2b05fe592ccd
  13:     0x7f7008e47b77 - rustc_codegen_ssa[52db6c6f4607f207]::mir::codegen_mir::<rustc_codegen_llvm[c977ac9a13b61e8c]::builder::GenericBuilder<rustc_codegen_llvm[c977ac9a13b61e8c]::context::FullCx>>
  14:     0x7f7007d530aa - rustc_codegen_llvm[c977ac9a13b61e8c]::base::compile_codegen_unit::module_codegen
  15:     0x7f7008b8771f - <rustc_codegen_llvm[c977ac9a13b61e8c]::LlvmCodegenBackend as rustc_codegen_ssa[52db6c6f4607f207]::traits::backend::ExtraBackendMethods>::compile_codegen_unit
  16:     0x7f7008b856ce - <rustc_codegen_llvm[c977ac9a13b61e8c]::LlvmCodegenBackend as rustc_codegen_ssa[52db6c6f4607f207]::traits::backend::CodegenBackend>::codegen_crate
  17:     0x7f7008c4a630 - <rustc_interface[3d67779a474127f6]::queries::Linker>::codegen_and_build_linker
  18:     0x7f7008c48180 - rustc_interface[3d67779a474127f6]::passes::create_and_enter_global_ctxt::<core[218f6bb2377652a6]::option::Option<rustc_interface[3d67779a474127f6]::queries::Linker>, rustc_driver_impl[9b7ad042c9288b75]::run_compiler::{closure#0}::{closure#2}>::{closure#2}::{closure#0}
  19:     0x7f7008cb303e - rustc_interface[3d67779a474127f6]::interface::run_compiler::<(), rustc_driver_impl[9b7ad042c9288b75]::run_compiler::{closure#0}>::{closure#1}
  20:     0x7f7008ba63b8 - std[69fcff7c3a8a2b12]::sys::backtrace::__rust_begin_short_backtrace::<rustc_interface[3d67779a474127f6]::util::run_in_thread_with_globals<rustc_interface[3d67779a474127f6]::util::run_in_thread_pool_with_globals<rustc_interface[3d67779a474127f6]::interface::run_compiler<(), rustc_driver_impl[9b7ad042c9288b75]::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>
  21:     0x7f7008ba609c - <<std[69fcff7c3a8a2b12]::thread::Builder>::spawn_unchecked_<rustc_interface[3d67779a474127f6]::util::run_in_thread_with_globals<rustc_interface[3d67779a474127f6]::util::run_in_thread_pool_with_globals<rustc_interface[3d67779a474127f6]::interface::run_compiler<(), rustc_driver_impl[9b7ad042c9288b75]::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>::{closure#1} as core[218f6bb2377652a6]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  22:     0x7f7008babe4d - std::sys::thread::unix::Thread::new::thread_start::h2cf3668a0ebb503f
  23:     0x7f70024969cb - <unknown>
  24:     0x7f700251aa0c - <unknown>
  25:                0x0 - <unknown>

error: the compiler unexpectedly panicked. this is a bug.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: please make sure that you have updated to the latest nightly

note: rustc 1.92.0-nightly (6710835ae 2025-09-21) running on x86_64-unknown-linux-gnu

note: compiler flags: -Z sanitizer=kcfi -C panic=abort -C link-dead-code=true -C unsafe-allow-abi-mismatch=sanitizer -Z dump-mir-dir=dir

query stack during panic:
end of query stack

@rustbot label +F-c_variadic

[matthiaskrgr]

bit smaller

#![feature(c_variadic)]
struct Struct(i32);
trait Trait {
    fn get(&self) -> i32;
    unsafe extern "C" fn trait_method_mut(&mut self, mut ap: ...) -> i32 {
        ap.arg()
    }
}
impl Trait for Struct {
    fn get(&self) -> i32 {
        self.0
    }
}
fn main() {
    unsafe {
        type Method<T> = unsafe extern "C" fn(T, ...) -> i32;
        assert_eq!((Struct::trait_method_mut as Method<_>)(&mut Struct(0)), 2)
    }
}

[matthiaskrgr]

since #146434

[cyrgani]

with rustc -Zsanitizer=kcfi -Cpanic=abort -Cunsafe-allow-abi-mismatch=sanitizer src/main.rs

#![feature(c_variadic)]
trait Trait {
    unsafe extern "C" fn foo(_: ...) -> i32 {
        0
    }
}
impl Trait for i32 {}
fn main() {
    let _f = i32::foo as unsafe extern "C" fn(...) -> i32;
}

[workingjubilee]

cc @folkertdev