Spurious miri library rwlock test failure?

[jieyouxu]

Failed in #133068 (comment) on the x86_64-gnu-aux job.

error: Undefined Behavior: trying to retag from <54379001> for SharedReadWrite permission at alloc19481375[0x10], but that tag does not exist in the borrow stack for this location
##[error]   --> /checkout/library/core/src/ptr/non_null.rs:375:18
    |
375 |         unsafe { &*self.as_ptr().cast_const() }
    |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |                  |
    |                  trying to retag from <54379001> for SharedReadWrite permission at alloc19481375[0x10], but that tag does not exist in the borrow stack for this location
    |                  this error occurs as part of retag at alloc19481375[0x0..0x30]
    |
    = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
    = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
help: <54379001> was created by a SharedReadWrite retag at offsets [0x0..0x29]
   --> /checkout/library/core/src/ptr/mod.rs:799:5
    |
799 |     r
    |     ^
help: <54379001> was later invalidated at offsets [0x18..0x20] by a write access
   --> std/src/sys/sync/rwlock/queue.rs:396:13
    |
396 |             node.prev = AtomicLink::new(None);
    |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    = note: BACKTRACE (of the first span) on thread `unnamed-995`:
    = note: inside `core::ptr::NonNull::<sys::sync::rwlock::queue::Node>::as_ref::<'_>` at /checkout/library/core/src/ptr/non_null.rs:375:18: 375:46
note: inside `sys::sync::rwlock::queue::find_tail_and_add_backlinks`
   --> std/src/sys/sync/rwlock/queue.rs:279:18
    |
279 |             next.as_ref().prev.set(Some(current));
    |                  ^^^^^^^^
note: inside `sys::sync::rwlock::queue::RwLock::unlock_queue`
   --> std/src/sys/sync/rwlock/queue.rs:646:33
    |
646 |             let tail = unsafe { find_tail_and_add_backlinks(to_node(state)) };
    |                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: inside `sys::sync::rwlock::queue::RwLock::lock_contended`
   --> std/src/sys/sync/rwlock/queue.rs:437:21
    |
437 |                     self.unlock_queue(next);
    |                     ^^^^^^^^^^^^^^^^^^^^^^^
note: inside `sys::sync::rwlock::queue::RwLock::write`
   --> std/src/sys/sync/rwlock/queue.rs:356:13
    |
356 |             self.lock_contended(true)
    |             ^^^^^^^^^^^^^^^^^^^^^^^^^
note: inside `sync::rwlock::RwLock::<usize>::write`
   --> std/src/sync/rwlock.rs:362:13
    |
362 |             self.inner.write();
    |             ^^^^^^^^^^^^^^^^^^
note: inside closure
   --> std/src/sync/rwlock/tests.rs:533:46
    |
533 |                     let mut write_guard = rw.write().unwrap();
    |                                              ^^^^^^^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

�[1m�[31merror�[0m�[1m:�[0m test failed, to rerun pass `-p std --lib`

Caused by:
  process didn't exit successfully: `/checkout/obj/build/x86_64-unknown-linux-gnu/stage0-tools-bin/cargo-miri runner /checkout/obj/build/x86_64-unknown-linux-gnu/stage1-std/miri/aarch64-apple-darwin/debug/deps/std-fa3c0a26ad940e73 'time::' 'sync::' 'thread::' 'env::' -Z unstable-options --format json` (exit status: 1)
�[1m�[36mnote�[0m�[1m:�[0m test exited abnormally; to see the full output pass --nocapture to the harness.

cc @RalfJung do you have any idea what could be triggering this? Maybe similar to #133200?

---

See related failures ( CI-ABA-ptr-provenance-lockless-queue-fail CI spurious failure: related to #121950 ): https://github.com/rust-lang/rust/pulls?q=is%3Apr+label%3ACI-ABA-ptr-provenance-lockless-queue-fail+

[jieyouxu]

Judging from test failure location, probably due to #121950?

[RalfJung]

This does sound like another instance of #121950, but it's odd that it would now happen more often.

[jieyouxu]

AFAIK these spurious miri test failures from rwlock tests are only occuring more frequently recently, I have never seen this failure on older PRs.

[RalfJung]

The original #121950 occurred around once every 1000 executions, which is about once every 3 months on a bors run (assuming a bors run every 2h).

We could try to do some statistics on these newly failing tests to see how often they fail (but I don't have the time for that right now).

[jieyouxu]

It doesn't happen super often (completely dwarved by the other msvc-related failures we have 😆), so I'm inclined to just leave this as a known issue in case someone else runs into it.

[RalfJung]

For the test_downgrade_atomic test, failure rate seems to be around 2/2048. I guess we got "lucky" hitting it so quickly after it got added.

The failure above is in test_downgrade_observe. That test takes quite a while to run in Miri so it's hard to get a good failure rate. It seems to occur around 4 times out of 64, so a lot more often than the others.