Migrate toolchain nightly-2025-02-14 -> nightly-2026-06-01

[jellllly420]

Migrate toolchain nightly-2025-02-14 → nightly-2026-06-01

Bumps the pinned toolchain ~12 nightly versions and brings the driver, predicates,
and .rpl patterns back to green on current rustc (1.98.0-nightly).

Status — all CI gates pass locally

Gate	Result
cargo fmt --check	✅
cargo clippy -- -D warnings	✅ (0 warnings)
cargo test --all (embedded patterns)	✅ 207 ui + all lib tests
cargo test --all with RPL_PATS=docs/patterns-pest	✅ 207
cargo rpl --workspace --all-targets (dogfood)	✅

UI failures went 186 → 0 over the migration.

What changed (three parts)

1. rustc-internal API churn (so the driver compiles): tcx.hir() → hir_*;
HIR Visitor map → MaybeTyCtxt; the fluent-diagnostics removal
(#[diag("…")], into_diag, deleted messages.en.ftl); the #[inline]
parsed-attribute refactor (#138165); MIR enum changes (Rvalue::{Len,NullaryOp},
StatementKind::{Deinit,Retag} removed; new Operand::RuntimeChecks); plus a
real ICE fix — tcx.item_name panics on nameless items (closure/anonymous
consts), so the matcher (match_sized_type_property, match_path) and
rpl_resolve now use opt_item_name. (This last one only reproduces via
cargo rpl on the workspace, not the UI suite.)

2. One new predicate — is_size_of($T, $size_const) (a TyConst predicate).
size_of::<T>() no longer lowers to NullOp; for a known type it folds into a
const operand of arithmetic (Mul(const <T>::SIZE, const N)), leaving no $size
local to bind. The predicate matches the symbolic SizedTypeProperties::SIZE
const so a pattern can bind it directly. (Symbolic-only by design — a value
comparison would false-positive on any literal equal to the type's size.) This is
the const-operand workaround; no new predicate kind was added.

3. Pattern & fixture updates to the new MIR shapes — niche types
(NonNull/UsizeNoHighBit) now built via Transmute not struct literals;
assume_init → raw-pointer read; AtomicU64 → Atomic<u64>; Pin.__pointer →
pointer; alloc-shim; folded-size_of rules; and per-revision test
reconciliations for constructs that inlining now erases.

Based on current master

Rebased onto master (incl. #110). #110's RPL_PATS env/file tracking is
preserved — ported from the old ParseSess/psess_created mechanism to the new
Session/config.track_state depinfo API.

Known limitation (documented in-tree)

The mem::uninitialized() vs MaybeUninit::uninit().assume_init() inline cases are
structurally indistinguishable after inlining (byte-identical MIR), so no
pattern can separate them; those inline revisions are gated to [normal]///FIXME
with //@[inline] check-pass.

---

Authored by Claude (Claude Opus 4.8, 1M context) on behalf of @jellllly420.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Migrates the project to nightly-2026-06-01 and updates the driver, matchers, patterns, and UI fixtures to accommodate rustc/HIR/MIR and stdlib lowering changes introduced since the previous pinned nightly.

Changes:

• Bump toolchain to nightly-2026-06-01 and update driver/rustc-internal integration for new APIs and diagnostics infrastructure.
• Update RPL matchers/predicates and .rpl patterns for new MIR/HIR shapes (pattern types, folded size_of, alloc shim changes, etc.).
• Re-bless UI tests and fixtures to the new compiler outputs and document migration rationale/limitations.

Reviewed changes

Copilot reviewed 98 out of 98 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/ui/utils/print_hir.stderr	Re-bless print_hir output for new HIR printing / spans.
tests/ui/utils/dump_mir.stderr	Re-bless MIR dump expectations to new MIR lowering and stdlib changes.
tests/ui/utils/dump_mir.rs	Update UI annotations/regexes for new dump output structure.
tests/ui/utils/dump_mir.fixed	Keep fixed-output in sync with updated dump_mir.rs expectations.
tests/ui/utils/dump_hir.stderr	Re-bless HIR dump expectations to new HIR data model formatting.
tests/ui/cve/cve_2021_29941_2/cve_2021_29941_2.rs	Gate a diagnostic to [normal] where inlining removes the trait call.
tests/ui/cve/cve_2021_29941_2/cve_2021_29941_2.normal.stderr	Update spans/line numbers after fixture edits.
tests/ui/cve/cve_2021_29941_2/cve_2021_29941_2.inline.stderr	Update inline-revision stderr after diagnostic count changes.
tests/ui/cve/cve_2021_29935/simplified.rs	Inline revision now check-pass; add migration note explaining why.
tests/ui/cve/cve_2021_29935/simplified.inline.stderr	Remove obsolete inline stderr (no diagnostics now).
tests/ui/cve/cve_2021_27376/src/adjusted.rs	Add inline-only annotations for duplicated true-positive diagnostics.
tests/ui/cve/cve_2021_27376/src/adjusted.regular.stderr	Update spans/line numbers for regular revision output.
tests/ui/cve/cve_2021_27376/src/adjusted.inline.stderr	Update inline revision stderr to include call-site duplicates.
tests/ui/cve/cve_2021_25904/cve_2021_25904.rs	Fix fixture for new rustc mismatched_lifetime_syntaxes lint.
tests/ui/cve/cve_2018_21000/simplified.stderr	Update spans/line numbers after fixture/tooling changes.
tests/ui/cve/cve_2018_21000/simplified.rs	Force -Zinline-mir=false to keep call-form matching stable.
tests/ui/cross-stmt-and-func-comparison-with-clippy/src/uninit_assumed_init.rs	Document inline limitation and gate expected lints per revision.
tests/ui/cross-stmt-and-func-comparison-with-clippy/src/uninit_assumed_init.normal.stderr	Update spans after annotation shifts.
tests/ui/cross-stmt-and-func-comparison-with-clippy/src/uninit_assumed_init.inline.stderr	Update expected diagnostics count (inline no longer reports some cases).
tests/ui/cross-stmt-and-func-comparison-with-clippy/src/size_of_in_element_count.inline.stderr	Re-bless caret range output.
tests/ui/cross-stmt-and-func-comparison-with-clippy/src/mem_replace_with_uninit.rs	Gate expected lint to [normal] and document inline limitation.
tests/ui/cross-stmt-and-func-comparison-with-clippy/src/mem_replace_with_uninit.normal.stderr	Update spans/line numbers due to fixture edits.
tests/ui/cross-stmt-and-func-comparison-with-clippy/src/mem_replace_with_uninit.inline.stderr	Remove obsolete inline stderr (no diagnostics now).
tests/ui/clippy/size_of_in_element_count/functions.stderr	Reorder / re-bless stderr after rule changes.
tests/ui/clippy/size_of_in_element_count/expressions.stderr	Update spans due to added compile flags / line shifts.
tests/ui/clippy/size_of_in_element_count/expressions.rs	Pin mir opt level to preserve matchable MIR shapes.
tests/ui/clippy/repl_uninit.rs	Gate expected lint to [normal] and document inline limitation.
tests/ui/clippy/repl_uninit.normal.stderr	Update spans due to added annotation lines.
tests/ui/clippy/repl_uninit.inline.stderr	Remove obsolete inline stderr (no diagnostics now).
tests/ui/clippy/eager_transmute.rs	Port fixture to pattern types and adapt comparisons through helper getter.
tests/ui/clippy/eager_transmute.normal.stderr	Update spans for shifted fixture line numbers.
tests/compile-test.rs	Drop now-unneeded let_chains feature gate.
src/driver.rs	Update driver entrypoint/arg handling and rustc lint allowances for new APIs.
rust-toolchain	Bump pinned nightly to nightly-2026-06-01.
docs/patterns-pest/cve/CVE-2022-23639.rpl	Update atomic type alias to generic Atomic<u64> shape.
docs/patterns-pest/cve/CVE-2021-15551.rpl	Update NonNull construction matching (now transmute-based).
docs/patterns-pest/cve/CVE-2020-35901-2.rpl	Update Pin field name changes (__pointer → pointer).
docs/patterns-pest/cve/CVE-2020-35888.rpl	Avoid mis-binding alloc args; loosen to wildcards with rationale.
docs/patterns-pest/cve/CVE-2020-35862.rpl	Update NonNull construction and copy/move behavior in patterns.
docs/patterns-pest/cve/CVE-2020-25016.rpl	Add const-folded size_of variants using new is_size_of predicate.
docs/patterns-pest/cve/CVE-2019-15548.rpl	Update projections/copy-vs-move to match new optimized MIR.
docs/patterns-pest/cve/CVE-2018-21000.rpl	Reorder statements to strict MIR/source order to keep matcher stable.
docs/patterns-pest/clippy/unsound-collection-transmute.rpl	Add cross-statement copy operand variant for transmute matching.
docs/patterns-pest/clippy/uninit-assumed-init.rpl	Update inlined assume_init matching to new raw-read lowering.
docs/patterns-pest/clippy/size-of-in-element-count.rpl	Fix intrinsic import and add const-folded size_of operand rules.
docs/patterns-pest/clippy/eager-transmute.rpl	Re-enable/introduce inlined form matching for then_some lowering.
docs/nightly-migration-summary.md	Add comprehensive migration summary and rationale.
docs/nightly-migration-remaining-failures.md	Add resolution history and remaining limitations documentation.
docs/nightly-migration-pattern-changes.md	Add detailed per-pattern/fixture change documentation.
crates/rpl_utils/src/utils.rs	Update HIR traversal, attr handling, diagnostics args, MIR dump path logic.
crates/rpl_utils/src/lib.rs	Remove fluent message plumbing and unused feature gates.
crates/rpl_utils/src/errors.rs	Port to literal diagnostics (fluent system removed) and new arg API.
crates/rpl_utils/messages.en.ftl	Remove fluent message catalog (no longer used).
crates/rpl_resolve/src/lib.rs	Fix ICE on nameless items and update HIR item-child iteration APIs.
crates/rpl_parser/build.rs	Simplify no-op regeneration check using let-chains.
crates/rpl_mir_transform/src/lib.rs	Adjust for mir_borrowck query/keying and return type changes.
crates/rpl_mir_graph/src/lib.rs	Remove unused feature/external crate as rustc internals changed.
crates/rpl_mir_graph/src/graph.rs	Update MutatingUseContext handling after enum variant removals.
crates/rpl_meta/src/symbol_table/diag.rs	Replace rustc_hash with rustc’s FxHashMap from data_structures.
crates/rpl_meta/src/symbol_table.rs	Same FxHashMap migration for meta symbol table.
crates/rpl_meta/src/meta.rs	Simplify pattern name extraction expression.
crates/rpl_meta/src/map.rs	Document dead-code for a public iterator type without constructors.
crates/rpl_meta/src/lib.rs	Remove now-unneeded feature gates and rustc_hash extern crate.
crates/rpl_meta/src/check.rs	Simplify import iteration and use let-chains for bounds check.
crates/rpl_match/src/ty.rs	Update const-param typing API and parent/type normalization changes.
crates/rpl_match/src/statement.rs	Port MIR pattern matching for removed NullOp/Len/etc and new operands.
crates/rpl_match/src/resolve.rs	Skip normalization in type_of resolution and handle new Res variants.
crates/rpl_match/src/predicate_evaluator.rs	Minor panic formatting cleanup.
crates/rpl_match/src/matches/mod.rs	Adjust ExtraSpan representation and add dead-code allowances.
crates/rpl_match/src/matches/color.rs	Update const-param typing API during matching.
crates/rpl_match/src/matches/artifact.rs	Adjust ExtraSpan normalization and span handling.
crates/rpl_match/src/lib.rs	Remove unused feature gates and fluent/hash extern crates.
crates/rpl_match/src/graph/mir.rs	Add explicit arg type for closure and simplify terminator edge conversion.
crates/rpl_match/src/fns.rs	Ensure type normalization is skipped where rustc now returns Unnormalized.
crates/rpl_match/src/adt.rs	Skip normalization when matching field types.
crates/rpl_interface/src/lib.rs	Remove locale resource plumbing (fluent system removed).
crates/rpl_interface/src/callbacks.rs	Port dep-info tracking callback from ParseSess to Session/config.track_state.
crates/rpl_graphviz/src/lib.rs	Remove unused feature gate after rustc/internal API changes.
crates/rpl_driver/src/lib.rs	Port diagnostics derive usage, provider registration shape, and HIR APIs.
crates/rpl_driver/src/errors.rs	Port timing diagnostic to literal message style.
crates/rpl_driver/messages.en.ftl	Remove fluent message catalog (no longer used).
crates/rpl_context/src/pat/utils.rs	Introduce pattern-side NullOp and update parsing helpers.
crates/rpl_context/src/pat/ty.rs	Update pattern tykind variants for new rustc type representation.
crates/rpl_context/src/pat/mir/mod.rs	Add pattern-side NullOp replacement and use it in Rvalue::NullaryOp.
crates/rpl_context/src/pat/item.rs	Update extra-span handling for parsed #[inline] and new span source.
crates/rpl_context/src/pat/error.rs	Port dynamic diagnostics to new Diagnostic API and attr span access.
crates/rpl_context/src/lib.rs	Remove now-unneeded let_chains feature gate.
crates/rpl_context/src/cvt_prim_ty.rs	Remove unused reverse conversions to reduce API surface.
crates/rpl_constraints/src/predicates/ty_const.rs	Add new is_size_of predicate for folded-size constants.
crates/rpl_constraints/src/predicates/translate.rs	Port HIR visitor API changes and body accessors.
crates/rpl_constraints/src/predicates/single_ty.rs	Update lang-item API, normalization handling, and recursion lint.
crates/rpl_constraints/src/predicates/multiple_tys.rs	Update normalization API to accept Unnormalized inputs.
crates/rpl_constraints/src/predicates/mod.rs	Register new is_size_of predicate.
crates/rpl_constraints/src/predicates/locals.rs	Port MIR Rvalue::Use shape changes and retain unused helper.
crates/rpl_constraints/src/lib.rs	Remove now-unneeded feature gates / fluent dependency.
crates/rpl_constraints/src/attributes/mod.rs	Change ExtraSpan to store Span and update attr/body APIs accordingly.
crates/rpl_constraints/src/attributes/inline.rs	Update parsed #[inline] extraction for new attribute kind and span rules.
crates/rpl_constraints/src/attributes/body.rs	Port HIR visitor API (maybe_tcx).

Comments suppressed due to low confidence (4)

crates/rpl_utils/src/utils.rs:1

• Falling back to PathBuf::default() if current_dir() fails can silently redirect dumps to an unexpected relative location, making failures harder to diagnose (and potentially polluting the repo root). Since this function already returns io::Result<PathBuf>, propagate the error from current_dir() instead of defaulting.
  crates/rpl_utils/src/utils.rs:1
• DumpMirOptions is now ignored (renamed to _options), which is an observable behavior change if callers rely on include_extra_comments (previously passed into PrettyPrintMirOptions). Either thread the options through to the new dumping implementation (if rustc still supports it) or remove the parameter and update call sites/docs to make the behavior explicit.
  crates/rpl_utils/src/utils.rs:1
• DumpMirOptions is now ignored (renamed to _options), which is an observable behavior change if callers rely on include_extra_comments (previously passed into PrettyPrintMirOptions). Either thread the options through to the new dumping implementation (if rustc still supports it) or remove the parameter and update call sites/docs to make the behavior explicit.
  src/driver.rs:1
• main now returns std::process::ExitCode and no longer calls exit(...) in this diff. If exit isn’t used elsewhere in this file, remove this import to avoid unused-import warnings (especially with -D warnings workflows).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 95 out of 95 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (6)

src/driver.rs:1

• main now returns std::process::ExitCode, but it returns the value of rustc_driver::catch_with_exit_code(...). Depending on the rustc version, catch_with_exit_code has historically returned an i32 exit status; if that's still the case on this pinned toolchain, this will be a type error (or a semantic mismatch if an implicit conversion is relied upon). Convert the returned status to ExitCode explicitly (or, if the API now returns ExitCode, consider adding a brief comment/assertion to prevent accidental regressions when the toolchain changes again).
  src/driver.rs:1
• main now returns std::process::ExitCode, but it returns the value of rustc_driver::catch_with_exit_code(...). Depending on the rustc version, catch_with_exit_code has historically returned an i32 exit status; if that's still the case on this pinned toolchain, this will be a type error (or a semantic mismatch if an implicit conversion is relied upon). Convert the returned status to ExitCode explicitly (or, if the API now returns ExitCode, consider adding a brief comment/assertion to prevent accidental regressions when the toolchain changes again).
  src/driver.rs:1
• main now returns std::process::ExitCode, but it returns the value of rustc_driver::catch_with_exit_code(...). Depending on the rustc version, catch_with_exit_code has historically returned an i32 exit status; if that's still the case on this pinned toolchain, this will be a type error (or a semantic mismatch if an implicit conversion is relied upon). Convert the returned status to ExitCode explicitly (or, if the API now returns ExitCode, consider adding a brief comment/assertion to prevent accidental regressions when the toolchain changes again).
  crates/rpl_utils/src/utils.rs:1
• Two concrete issues here: (1) current_dir().unwrap_or_default() silently turns a failure to get the CWD into an empty PathBuf, which makes the output path relative—contradicting the comment and potentially breaking UI normalization/matching. Prefer falling back to PathBuf::from(\".\") (or returning an io::Error) so the path semantics remain consistent. (2) _options is now ignored, which changes behavior if callers rely on include_extra_comments; either wire the option into the new MIR writer (if supported) or remove/rename the option at its source to avoid a misleading API.
  crates/rpl_utils/src/utils.rs:1
• Two concrete issues here: (1) current_dir().unwrap_or_default() silently turns a failure to get the CWD into an empty PathBuf, which makes the output path relative—contradicting the comment and potentially breaking UI normalization/matching. Prefer falling back to PathBuf::from(\".\") (or returning an io::Error) so the path semantics remain consistent. (2) _options is now ignored, which changes behavior if callers rely on include_extra_comments; either wire the option into the new MIR writer (if supported) or remove/rename the option at its source to avoid a misleading API.
  crates/rpl_utils/src/utils.rs:1
• Falling back to Debug formatting of hir_node is likely to be significantly less stable across nightly updates than the earlier node_to_string-style output, which increases UI test churn and makes the diagnostic output harder to read/compare. If there is a new stable pretty-printing API available for HIR nodes on this toolchain, prefer that over {:?}; otherwise, consider emitting a more constrained fallback (e.g., node kind + span) to minimize instability.