unexpected object stored at reference

[kvark]

Repro:
Check out crossbeam-rs/crossbeam#849 (currently at revision 7d22763adfe5c07df237da493507c25f3f92a92b) and run ci/loom.sh.

Full log:

running 15 tests
thread 'thread 'steal_batch_and_pop_injector_fifosteal_batch_and_pop_injector_lifo' panicked at '' panicked at '[loom internal bug] unexpected object stored at reference[loom internal bug] unexpected object stored at reference', ', /Users/kvark/.cargo/registry/src/github.zerozr99.workers.dev-1ecc6299db9ec823/loom-0.5.6/src/rt/object.rs/Users/kvark/.cargo/registry/src/github.zerozr99.workers.dev-1ecc6299db9ec823/loom-0.5.6/src/rt/object.rs::287287::1414

note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread 'steal_batch_and_pop_injector_fifo' panicked at 'thread '[loom internal bug] unexpected object stored at referencesteal_batch_and_pop_injector_lifo', ' panicked at '/Users/kvark/.cargo/registry/src/github.zerozr99.workers.dev-1ecc6299db9ec823/loom-0.5.6/src/rt/object.rs[loom internal bug] unexpected object stored at reference:', 287/Users/kvark/.cargo/registry/src/github.zerozr99.workers.dev-1ecc6299db9ec823/loom-0.5.6/src/rt/object.rs::14287
:14
stack backtrace:
   0:        0x1093e13f4 - std::backtrace_rs::backtrace::libunwind::trace::h3cae2b905fd8ac13
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:        0x1093e13f4 - std::backtrace_rs::backtrace::trace_unsynchronized::he35fb4c47e25f88c
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:        0x1093e13f4 - std::sys_common::backtrace::_print_fmt::hdb42afc2298dc41a
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:66:5
   3:        0x1093e13f4 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hc80096156cd24709
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:45:22
   4:        0x1093fe99b - core::fmt::write::hb6b947db0e571766
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/fmt/mod.rs:1194:17
   5:        0x1093ddff8 - std::io::Write::write_fmt::h59c4febf5f8fcb1e
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/io/mod.rs:1655:15
   6:        0x1093e318d - std::sys_common::backtrace::_print::h72a3180302df7468
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:48:5
   7:        0x1093e318d - std::sys_common::backtrace::print::ha0747cec3f48ad89
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:35:9
   8:        0x1093e318d - std::panicking::default_hook::{{closure}}::h0e76f92bbb367061
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:295:22
   9:        0x1093e2e71 - std::panicking::default_hook::hbbbb8c05ad6cce9a
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:314:9
  10:        0x1093e37c6 - std::panicking::rust_panic_with_hook::ha581a2c99399f83b
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:702:17
  11:        0x1093e3603 - std::panicking::begin_panic_handler::{{closure}}::h97df6e4273b6a879
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:588:13
  12:        0x1093e1877 - std::sys_common::backtrace::__rust_end_short_backtrace::ha4a3b48ae6bfb343
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:138:18
  13:        0x1093e32da - rust_begin_unwind
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
  14:        0x109411cc3 - core::panicking::panic_fmt::h4a5343602e6cbb54
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
  15:        0x1093fd01b - core::panicking::panic_display::h186712fd60a27280
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:72:5
  16:        0x1093fcfcc - core::panicking::panic_str::he95b526ac36e11e1
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:56:5
  17:        0x109411b59 - core::option::expect_failed::h300d7f9a8aa7b561
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/option.rs:1874:5
  18:        0x109334f2d - scoped_tls::ScopedKey<T>::with::h1f5174150b388f6b
  19:        0x10933cfa6 - loom::rt::cell::Cell::start_write::h38258bc4eccafb5c
  20:        0x1092d2946 - <crossbeam_deque::deque::Injector<T> as core::ops::drop::Drop>::drop::h338a4618eabece03
  21:        0x1092df87a - core::ops::function::FnOnce::call_once{{vtable.shim}}::h15af63713c546551
  22:        0x109341240 - generator::stack::StackBox<F>::call_once::h007a3427516dc07a
  23:        0x1093b6df7 - generator::gen_impl::gen_init::h23b0719e04b6c529
thread panicked while panicking. aborting.
stack backtrace:
   0:        0x1093e13f4 - std::backtrace_rs::backtrace::libunwind::trace::h3cae2b905fd8ac13
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:        0x1093e13f4 - std::backtrace_rs::backtrace::trace_unsynchronized::he35fb4c47e25f88c
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:        0x1093e13f4 - std::sys_common::backtrace::_print_fmt::hdb42afc2298dc41a
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:66:5
   3:        0x1093e13f4 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hc80096156cd24709
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:45:22
   4:        0x1093fe99b - core::fmt::write::hb6b947db0e571766
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/fmt/mod.rs:1194:17
   5:        0x1093ddff8 - std::io::Write::write_fmt::h59c4febf5f8fcb1e
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/io/mod.rs:1655:15
   6:        0x1093e318d - std::sys_common::backtrace::_print::h72a3180302df7468
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:48:5
   7:        0x1093e318d - std::sys_common::backtrace::print::ha0747cec3f48ad89
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:35:9
   8:        0x1093e318d - std::panicking::default_hook::{{closure}}::h0e76f92bbb367061
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:295:22
   9:        0x1093e2e71 - std::panicking::default_hook::hbbbb8c05ad6cce9a
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:314:9
  10:        0x1093e37c6 - std::panicking::rust_panic_with_hook::ha581a2c99399f83b
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:702:17
  11:        0x1093e3603 - std::panicking::begin_panic_handler::{{closure}}::h97df6e4273b6a879
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:588:13
  12:        0x1093e1877 - std::sys_common::backtrace::__rust_end_short_backtrace::ha4a3b48ae6bfb343
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:138:18
  13:        0x1093e32da - rust_begin_unwind
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
  14:        0x109411cc3 - core::panicking::panic_fmt::h4a5343602e6cbb54
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
  15:        0x1093fd01b - core::panicking::panic_display::h186712fd60a27280
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:72:5
  16:        0x1093fcfcc - core::panicking::panic_str::he95b526ac36e11e1
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:56:5
  17:        0x109411b59 - core::option::expect_failed::h300d7f9a8aa7b561
                               at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/option.rs:1874:5
  18:        0x109334f2d - scoped_tls::ScopedKey<T>::with::h1f5174150b388f6b
  19:        0x10933cfa6 - loom::rt::cell::Cell::start_write::h38258bc4eccafb5c
  20:        0x1092d2946 - <crossbeam_deque::deque::Injector<T> as core::ops::drop::Drop>::drop::h338a4618eabece03
  21:        0x1092e00ca - core::ops::function::FnOnce::call_once{{vtable.shim}}::h4a249a229f317c71
  22:        0x109341240 - generator::stack::StackBox<F>::call_once::h007a3427516dc07a
  23:        0x1093b6df7 - generator::gen_impl::gen_init::h23b0719e04b6c529

[kvark]

Getting this on another project as well. Seems like a blocker to do anything useful, unfortunately. Let me know if you have ideas on how to approach this!

[jschwe]

I just ran into this and in my case it was caused by the following code:

let array: [UnsafeCell<MaybeUninit<E>>; NE]= unsafe { MaybeUninit::uninit().assume_init() }

For the standard library type this was fine (see Maybeuninit documentation), because the UnsafeCell is just a transparent wrapper around the inner type (Maybeuninit, which is allowed to be uninitialized). For the loom type this is however not the case and the type must be initialized.

Maybe we could a magic number to the loom type to give a better error for such cases?