Undefined behavior in servo_arc HeaderSlice

[Brian Anderson]

HeaderSlice constructs and dereferences invalid pointers created from non-pointer integers in from_header_and_iter_alloc.

Here's what miri has to say about it:

error: Undefined Behavior: invalid use of 8 as a pointer
    --> components/servo_arc/lib.rs:716:69
     |                                                                                                                                       
716  |             let fake_ref: &ArcInner<HeaderSlice<H, [T]>> = unsafe { &*fake_ptr };
     |                                                                     ^^^^^^^^^^ invalid use of 8 as a pointer                                |
     = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior                                 = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information                            = note: inside `Arc::<HeaderSlice<HeaderWithLength<u32>, [i32]>>::from_header_and_iter_alloc::<[closure@components/servo_arc/lib.rs:815:1
3: 826:14], std::iter::Empty<i32>>` at components/servo_arc/lib.rs:716:69     

[Brian Anderson]

Repro by running:

cargo +nightly-2020-04-10 miri test -p servo_arc -- -Zmiri-disable-isolation

inside the servo_arc directory.

[Brian Anderson]

miri has at least one other issue with this block of code that can be repro'd the same way.

[Ralf Jung]

Yeah, ArcInner is definitely not a ZST, so this code is creating a dangling shared reference, which is UB.