rust-lang / rust · Issue No. 160525
I tried this code (playpen):
fn main() {
let mut arr = [[Box::new(42)]];
let alias = &mut arr[0][{ let [row] = arr; drop(row); 0 }];
println!("{}", **alias); // use-after-free of arr's dead stack slot
}
I expected to see this happen: Compiler rejects code as unsound.
Instead, this happened: Compiler accepts code and prints a garbage number.
When run under Miri, we see this output:
error: Undefined Behavior: constructing invalid value of type std::boxed::Box<i32>: encountered a dangling box (use-after-free)
--> src/main.rs:4:20
|
4 | println!("{}", **alias); // use-after-free of arr's dead stack slot
| ^^^^^^^ Undefined Behavior occurred here
|
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
Hypothesis: after a move _1[ConstantIndex{0 of 1}], a subsequent use of _1[Index(_6)] is not flagged as a use-of-partially-moved. The "any subpath moved" check of borrowck treats ConstantIndex as a sibling of a runtime Index projection, rather than a potential alias.
Nightly channel
Build using the Nightly version: 1.99.0-nightly
(2026-08-03 504869653f510b279c54)
Relay reads this issue against the repository's contribution signals: the files it is likely to touch, how the maintainers triage work this size, and what the first contribution would exercise.
The full analysis for this issue is still being assembled. Until then, the description above and the thread on GitHub are the most reliable context.