[ICE]: `callee_abis.next().is_none()`

[matthiaskrgr]

auto-reduced (treereduce-rust):

#![feature(const_c_variadic)]
#![feature(const_destruct)]

const unsafe extern "C" fn read_n<const N: usize>(_: ...) {}

unsafe fn read_too_many() {
    const { read_n::<0>(read_as::<u32>) }
}

fn read_as<T>() -> () {}

original:

#![feature(const_c_variadic)]
#![feature(const_destruct)]
#![feature(c_variadic)]

const unsafe extern "C" fn read_n<const N: usize>(_: ...) {}

unsafe fn read_too_many() {
    const { read_n::<0>(read_as::<u32>) }
}

const unsafe extern "C" fn read_as<T>() -> () {}

fn main() {}

Version information

rustc 1.96.0-nightly (1b7d722f4 2026-03-03)
binary: rustc
commit-hash: 1b7d722f429f09c87b08b757d89c689c6cf7f6e7
commit-date: 2026-03-03
host: x86_64-unknown-linux-gnu
release: 1.96.0-nightly
LLVM version: 22.1.0

Possibly related line of code:

rust/compiler/rustc_const_eval/src/interpret/stack.rs

Lines 649 to 661 in 1b7d722

	let op = fn_arg.copy_fn_arg();
	let mplace = self.allocate(op.layout, MemoryKind::Stack)?;
	self.copy_op(&op, &mplace)?;
	varargs.push(mplace);
	}
	assert!(callee_abis.next().is_none());
	interp_ok(varargs)
	}
	/// Deallocate the variadic arguments in the list (that must have been created with `allocate_varargs`).
	fn deallocate_varargs(

Command:
/home/matthias/.rustup/toolchains/master/bin/rustc

Program output

error[E0658]: C-variadic functions are unstable
 --> /tmp/icemaker_global_tempdir.6DbyeX1z5eEj/rustc_testrunner_tmpdir_reporting.Whwgd9ZBnBHB/mvce.rs:4:1
  |
4 | const unsafe extern "C" fn read_n<const N: usize>(_: ...) {}
  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: see issue #44930 <https://github.com/rust-lang/rust/issues/44930> for more information
  = help: add `#![feature(c_variadic)]` to the crate attributes to enable
  = note: this compiler was built on 2026-03-03; consider upgrading it if it is out of date

error[E0601]: `main` function not found in crate `mvce`
  --> /tmp/icemaker_global_tempdir.6DbyeX1z5eEj/rustc_testrunner_tmpdir_reporting.Whwgd9ZBnBHB/mvce.rs:10:25
   |
10 | fn read_as<T>() -> () {}
   |                         ^ consider adding a `main` function to `/tmp/icemaker_global_tempdir.6DbyeX1z5eEj/rustc_testrunner_tmpdir_reporting.Whwgd9ZBnBHB/mvce.rs`

error[E0617]: can't pass a function item to a variadic function
 --> /tmp/icemaker_global_tempdir.6DbyeX1z5eEj/rustc_testrunner_tmpdir_reporting.Whwgd9ZBnBHB/mvce.rs:7:25
  |
7 |     const { read_n::<0>(read_as::<u32>) }
  |                         ^^^^^^^^^^^^^^
  |
  = help: a function item is zero-sized and needs to be cast into a function pointer to be used in FFI
  = note: for more information on function items, visit https://doc.rust-lang.org/reference/types/function-item.html
help: use a function pointer instead
  |
7 |     const { read_n::<0>(read_as::<u32> as fn()) }
  |                                        +++++++


thread 'rustc' (256474) panicked at /rustc-dev/1b7d722f429f09c87b08b757d89c689c6cf7f6e7/compiler/rustc_const_eval/src/interpret/stack.rs:655:9:
assertion failed: callee_abis.next().is_none()
stack backtrace:
   0:     0x7f2156d5860b - <<std[284bc44e398d798e]::sys::backtrace::BacktraceLock>::print::DisplayBacktrace as core[c88c01294d6d5abc]::fmt::Display>::fmt
   1:     0x7f2157422908 - core[c88c01294d6d5abc]::fmt::write
   2:     0x7f2156d6f616 - <std[284bc44e398d798e]::sys::stdio::unix::Stderr as std[284bc44e398d798e]::io::Write>::write_fmt
   3:     0x7f2156d2e6e8 - std[284bc44e398d798e]::panicking::default_hook::{closure#0}
   4:     0x7f2156d4ba73 - std[284bc44e398d798e]::panicking::default_hook
   5:     0x7f2155d3984c - std[284bc44e398d798e]::panicking::update_hook::<alloc[53dcbfea654489fb]::boxed::Box<rustc_driver_impl[b9925340d7eb0d08]::install_ice_hook::{closure#1}>>::{closure#0}
   6:     0x7f2156d4bd52 - std[284bc44e398d798e]::panicking::panic_with_hook
   7:     0x7f2156d2e7da - std[284bc44e398d798e]::panicking::panic_handler::{closure#0}
   8:     0x7f2156d22cf9 - std[284bc44e398d798e]::sys::backtrace::__rust_end_short_backtrace::<std[284bc44e398d798e]::panicking::panic_handler::{closure#0}, !>
   9:     0x7f2156d3020d - __rustc[81a9f9e8ca82058f]::rust_begin_unwind
  10:     0x7f21538cafac - core[c88c01294d6d5abc]::panicking::panic_fmt
  11:     0x7f21533fe232 - core[c88c01294d6d5abc]::panicking::panic
  12:     0x7f21578d97d8 - <rustc_const_eval[f53a2e14d882bd28]::interpret::eval_context::InterpCx<rustc_const_eval[f53a2e14d882bd28]::const_eval::machine::CompileTimeMachine>>::init_stack_frame
  13:     0x7f21578cf3c7 - <rustc_const_eval[f53a2e14d882bd28]::interpret::eval_context::InterpCx<rustc_const_eval[f53a2e14d882bd28]::const_eval::machine::CompileTimeMachine>>::init_fn_call
  14:     0x7f21584e3984 - rustc_const_eval[f53a2e14d882bd28]::const_eval::eval_queries::eval_to_allocation_raw_provider
  15:     0x7f21584e2556 - rustc_query_impl[f8080f5464e40736]::query_impl::eval_to_allocation_raw::invoke_provider_fn::__rust_begin_short_backtrace
  16:     0x7f215811a9c3 - rustc_query_impl[f8080f5464e40736]::execution::try_execute_query::<rustc_middle[8b92c1aa48f9158]::query::caches::DefaultCache<rustc_middle[8b92c1aa48f9158]::ty::PseudoCanonicalInput<rustc_middle[8b92c1aa48f9158]::mir::interpret::GlobalId>, rustc_middle[8b92c1aa48f9158]::query::erase::ErasedData<[u8; 24usize]>>, false>
  17:     0x7f215811a37f - rustc_query_impl[f8080f5464e40736]::query_impl::eval_to_allocation_raw::execute_query_non_incr::__rust_end_short_backtrace
  18:     0x7f215811bf71 - rustc_const_eval[f53a2e14d882bd28]::const_eval::eval_queries::eval_to_const_value_raw_provider
  19:     0x7f215811bae8 - rustc_query_impl[f8080f5464e40736]::query_impl::eval_to_const_value_raw::invoke_provider_fn::__rust_begin_short_backtrace
  20:     0x7f215811a8c7 - rustc_query_impl[f8080f5464e40736]::execution::try_execute_query::<rustc_middle[8b92c1aa48f9158]::query::caches::DefaultCache<rustc_middle[8b92c1aa48f9158]::ty::PseudoCanonicalInput<rustc_middle[8b92c1aa48f9158]::mir::interpret::GlobalId>, rustc_middle[8b92c1aa48f9158]::query::erase::ErasedData<[u8; 24usize]>>, false>
  21:     0x7f215811a43f - rustc_query_impl[f8080f5464e40736]::query_impl::eval_to_const_value_raw::execute_query_non_incr::__rust_end_short_backtrace
  22:     0x7f2157dff3e9 - <rustc_middle[8b92c1aa48f9158]::ty::context::TyCtxt>::const_eval_resolve
  23:     0x7f2157d40a96 - <rustc_mir_transform[d63848adec2d2e5f]::known_panics_lint::ConstPropagator as rustc_middle[8b92c1aa48f9158]::mir::visit::Visitor>::visit_assign
  24:     0x7f2157d3c939 - <rustc_mir_transform[d63848adec2d2e5f]::known_panics_lint::ConstPropagator as rustc_middle[8b92c1aa48f9158]::mir::visit::Visitor>::visit_body
  25:     0x7f2157d39cdf - <rustc_mir_transform[d63848adec2d2e5f]::known_panics_lint::KnownPanicsLint as rustc_mir_transform[d63848adec2d2e5f]::pass_manager::MirLint>::run_lint
  26:     0x7f215740ceea - rustc_mir_transform[d63848adec2d2e5f]::run_analysis_to_runtime_passes
  27:     0x7f2158210ec4 - rustc_mir_transform[d63848adec2d2e5f]::mir_drops_elaborated_and_const_checked
  28:     0x7f2158210921 - rustc_query_impl[f8080f5464e40736]::query_impl::mir_drops_elaborated_and_const_checked::invoke_provider_fn::__rust_begin_short_backtrace
  29:     0x7f21574689ca - rustc_query_impl[f8080f5464e40736]::execution::try_execute_query::<rustc_data_structures[bb16df1a7a653477]::vec_cache::VecCache<rustc_span[f1d8e5cad33ca5f]::def_id::LocalDefId, rustc_middle[8b92c1aa48f9158]::query::erase::ErasedData<[u8; 8usize]>, rustc_middle[8b92c1aa48f9158]::dep_graph::graph::DepNodeIndex>, false>
  30:     0x7f2157468103 - rustc_query_impl[f8080f5464e40736]::query_impl::mir_drops_elaborated_and_const_checked::execute_query_non_incr::__rust_end_short_backtrace
  31:     0x7f2157466488 - <rustc_middle[8b92c1aa48f9158]::ty::context::TyCtxt>::par_hir_body_owners::<rustc_interface[8c1386fdb9c77e28]::passes::run_required_analyses::{closure#1}::{closure#0}>::{closure#0}
  32:     0x7f2157465875 - rustc_interface[8c1386fdb9c77e28]::passes::analysis
  33:     0x7f215862f59c - rustc_query_impl[f8080f5464e40736]::execution::try_execute_query::<rustc_middle[8b92c1aa48f9158]::query::caches::SingleCache<rustc_middle[8b92c1aa48f9158]::query::erase::ErasedData<[u8; 0usize]>>, false>
  34:     0x7f215862f2fb - rustc_query_impl[f8080f5464e40736]::query_impl::analysis::execute_query_non_incr::__rust_end_short_backtrace
  35:     0x7f21585fd42d - rustc_interface[8c1386fdb9c77e28]::interface::run_compiler::<(), rustc_driver_impl[b9925340d7eb0d08]::run_compiler::{closure#0}>::{closure#1}
  36:     0x7f21585e1b3e - std[284bc44e398d798e]::sys::backtrace::__rust_begin_short_backtrace::<rustc_interface[8c1386fdb9c77e28]::util::run_in_thread_with_globals<rustc_interface[8c1386fdb9c77e28]::util::run_in_thread_pool_with_globals<rustc_interface[8c1386fdb9c77e28]::interface::run_compiler<(), rustc_driver_impl[b9925340d7eb0d08]::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>
  37:     0x7f21585e21a0 - <std[284bc44e398d798e]::thread::lifecycle::spawn_unchecked<rustc_interface[8c1386fdb9c77e28]::util::run_in_thread_with_globals<rustc_interface[8c1386fdb9c77e28]::util::run_in_thread_pool_with_globals<rustc_interface[8c1386fdb9c77e28]::interface::run_compiler<(), rustc_driver_impl[b9925340d7eb0d08]::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>::{closure#1} as core[c88c01294d6d5abc]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  38:     0x7f21585e302c - <std[284bc44e398d798e]::sys::thread::unix::Thread>::new::thread_start
  39:     0x7f215205e98b - <unknown>
  40:     0x7f21520e2a0c - <unknown>
  41:                0x0 - <unknown>

error: the compiler unexpectedly panicked. This is a bug

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: please make sure that you have updated to the latest nightly

note: rustc 1.96.0-nightly (1b7d722f4 2026-03-03) running on x86_64-unknown-linux-gnu

query stack during panic:
#0 [eval_to_allocation_raw] const-evaluating + checking `read_too_many::{constant#0}`
#1 [eval_to_const_value_raw] simplifying constant for the type system `read_too_many::{constant#0}`
#2 [mir_drops_elaborated_and_const_checked] elaborating drops for `read_too_many`
#3 [analysis] running analysis passes on crate `mvce`
end of query stack
error: aborting due to 3 previous errors

Some errors have detailed explanations: E0601, E0617, E0658.
For more information about an error, try `rustc --explain E0601`.

@rustbot label +F-const_c_variadic +F-const_destruct +F-c_variadic

[rustbot]

Error: Unknown labels: F-const_c_variadic, F-const_destruct

Please file an issue on GitHub at triagebot if there's a problem with this bot, or reach out on #triagebot on Zulip.

[matthiaskrgr]

since #150601

[RalfJung]

@oli-obk @BoxyUwU any idea why we're even running that const, given that it apparently didn't even pass typeck?

[folkertdev]

Using a function type is a bit special actually, it has its own custom error. Passing e.g. () will still trigger the ICE, but won't cause a type error. I believe this is basically #61275.

We emit these custom errors here:

rust/compiler/rustc_hir_typeck/src/fn_ctxt/checks.rs

Lines 495 to 515 in 70d86e3

	match arg_ty.kind() {
	ty::Float(ty::FloatTy::F32) => {
	variadic_error(tcx.sess, arg.span, arg_ty, "c_double");
	}
	ty::Int(ty::IntTy::I8 | ty::IntTy::I16) | ty::Bool => {
	variadic_error(tcx.sess, arg.span, arg_ty, "c_int");
	}
	ty::Uint(ty::UintTy::U8 | ty::UintTy::U16) => {
	variadic_error(tcx.sess, arg.span, arg_ty, "c_uint");
	}
	ty::FnDef(..) => {
	let fn_ptr = Ty::new_fn_ptr(self.tcx, arg_ty.fn_sig(self.tcx));
	let fn_ptr = self.resolve_vars_if_possible(fn_ptr).to_string();
	let fn_item_spa = arg.span;
	tcx.sess.dcx().emit_err(errors::PassFnItemToVariadicFunction {
	span: fn_item_spa,
	sugg_span: fn_item_spa.shrink_to_hi(),
	replace: fn_ptr,
	});
	}

We really should ensure that the argument implements VaArgSafe here. That is technically a breaking change, but programs that don't satisfy that constraint very likely have UB. cc @workingjubilee what's your thinking about adding that restriction at this point?

[workingjubilee]

It has long been my belief we probably should do that, yes.