[praveenperera]

Closes #1724

Problem

A reference constant such as const PAIR: &(u32, u32) = &(3, 4), or a borrow rustc promotes to 'static such as &42, was built as an alloca, a store, and the slot's address inside whichever function named it. The reference is 'static, so safe code can return it. An #[inline(never)] device helper that did so handed its caller a pointer into a dead stack frame, and the caller read zeros.

Raw pointers formed from such references had the same problem. On main, const RAW: *mut u32 = &59_u32 as *const u32 as *mut u32 compiles but returns the same dangling stack pointer.

Fix

• One global per allocation. Each anonymous rustc allocation behind a reference constant becomes one module-level, read-only device global holding rustc's byte image. Every reference into one allocation shares its global, including interior pointers such as &PAIR.1.

• Stable keys. Each global is keyed by a SHA-256 digest of its contents: alignment, bytes, and relocations resolved to their targets' own keys. Its identity is therefore the same in every build: adding unrelated constants or kernels doesn't rename it, unlike a key based on rustc's interning-ordered AllocId. Two read-only allocations with identical contents share one global, which Rust permits because it does not promise constants distinct addresses. Mutable anonymous memory, such as &mut [..] in a static mut initializer, is never merged.

• Nested pointers. Pointers stored inside an allocation become initializer relocations to the inner allocation's own global, or to the device static.

• Aggregate fields and static initializers. The same globals back thin pointer fields of tuple, struct, array, and enum constants, and pointer words in device static initializers (static S: &[u32] = &[1, 2]). Both previously rejected anonymous memory.

• Typed views. When the importer cannot prove a pointee's device layout byte-identical to rustc's, for example &Option<u32>, the reference declares the same global typed as the pointee. Lowering accepts several types for one immutable initialized global, validates each type against the shared bytes, and keeps one symbol. As a result &Option<u32> and &u32 into its payload still compare equal. An interior view is rejected when its pointee's layout cannot be proven.

• *mut T into read-only storage. Such a pointer is established as *const T and then cast raw-to-raw, matching the source's as cast. The storage stays read-only.

• Shared memory. A pointer into a SharedArray or Barrier cannot be stored in a constant or a static. Those pointers are addrspace(3), but every stored pointer targets an initialized global. Two cases are refused at compile time:

  • a constant, constant table, or static initializer that stores a relocation and whose type holds such a pointer;
  • a type-erased stored pointer to a SharedArray or Barrier static.

  The type check is conservative. A value whose type holds a shared-memory pointer is refused whenever it stores any relocated pointer, even if the shared-memory pointer itself is null.

Not changed: a direct &[T; N] constant

A direct &[T; N] reference constant still uses the existing content-keyed promoted-table path. For const A: &[u32; 2] = &[3, 4] and const E: &u32 = &A[0], A and E can therefore get separate globals with the same bytes, and core::ptr::eq(&A[0], E) may be false.

This is allowed. The Rust Reference says constants are inlined wherever they are used, and that references to the same constant are not necessarily guaranteed to refer to the same memory address. Address identity is guaranteed only within a single rustc allocation, and every reference into one allocation shares its global.

Tests

• promoted_ref_return. Each form above is returned from an #[inline(never)] helper, and the kernel reads back 20 values, including a pointer-identity check. The forms are:

  • named and promoted references;
  • nested references;
  • interior pointers;
  • enum payloads;
  • aggregate fields;
  • Option<&T>;
  • pointers into device statics;
  • static initializers;
  • *mut constants.

  Its verify-code-shape.sh checks that no helper keeps an alloca or a .local depot, and that the constants live in read-only addrspace(1) globals, with one global per shared allocation. It also builds a copy of the example with extra kernels that carry their own constants, and checks that every helper's promoted global keeps the same key.

• CI coverage. The compile-only lane for libNVVM-verified examples now builds each example normally and runs its verify-code-shape.sh before emit-ltoir, so these checks, and kernel_reference_validity's, run in CI rather than only in GPU smoketests.

• Negative examples. error_shared_pointer_constant and error_shared_static_relocation pin the two shared-memory diagnostics.

• Lowering. mir-lower tests cover sharing one global across typed views in both declaration orders, and rejecting a view that does not match its bytes.

Follow-up

The DisjointSlice reference-constant refusal added in #1722 (fixture error_disjoint_slice_const_ref) can be lifted on top of this change.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.