Miri allows calling function item via null reference.

[theemathas]

I'm not sure if this is a bug, but it does seem really weird.

The following code constructs a null reference pointing to a function item type. Then, it calls that null reference.

fn foo() {}

fn main() {
    let mut f = &foo;
    unsafe {
        (&raw mut f).cast::<usize>().write(0);
    }
    f();
}

According to Miri, the above code somehow doesn't have any UB. This seems wrong.

Strangely, adding another layer of reference causes Miri to report UB:

fn foo() {}

fn main() {
    let mut f = &&foo;
    unsafe {
        (&raw mut f).cast::<usize>().write(0);
    }
    f();
}

error: Undefined Behavior: constructing invalid value of type &&fn() {foo}: encountered a null reference
 --> src/main.rs:8:5
  |
8 |     f();
  |     ^ Undefined Behavior occurred here
  |
  = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
  = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

Reproducible on the playground with Miri version 0.1.0 (2026-07-22 6f72b5dd5f)

[oli-obk]

The null reference itself is a problem, but the call is fine as it never performs a read (zsts aren't read from places)

[RalfJung]

Somehow even the unoptimized MIR is optimized and the function call no longer involves the reference f at all:

    bb2: {
        _5 = foo() -> [return: bb3, unwind continue];
    }

I would have expected this to be _5 = (*_1)();.

[RalfJung]

This looks as expected in the initial MIR

        _8 = copy (*_1);
        _7 = move _8() -> [return: bb3, unwind: bb4];

But then the RemoveZsts pass runs and that removes the UB.

[RalfJung]

The liberal use of is_required on MIR passes is coming to bite us (in this case, introduced by rust-lang/rust#128657).

Not sure what our plans are for that flag but we definitely need to audit the existing ones to ensure all those passes indeed never remove UB, and clarify the docs.
Cc @rust-lang/wg-mir-opt

[RalfJung]

Actually the RemoveZst pass is not the source of the problem. While that pass is "required", it's also only enabled for mir-opt-level > 0, which makes no sense to me but which means it does not run in Miri.

[RalfJung]

This turned out to be a surprisingly deep rabbit hole, and a notable gap in our UB checking (though one that is really hard to hit). Thanks a lot for catching this!

rust-lang/rust#160012 should fix this.