What is the operational semantics of Box derefs?

[RalfJung]

Currently, this code does not have (language) UB:

#[repr(align(8))]
struct S {
    f: (),
}

fn main() {
    let mut x = Box::new(S { f: () });
    unsafe { (&raw mut x).cast::<usize>().write(1) };
    let _val = &(*x).f;
}

This is because the *x desugars to projecting to the underlying NonNull inside the Box, and then deref'ing that. That is UB if the pointer is null, but does not care about alignment.

Basically, this is where Box behaves more like a library type than a language type. That nicely avoids Miri having to deal with the custom allocator on a Box, but it also means we are losing some information on the opsem level.

I feel like we should probably preserve the actual Box deref for Miri so that we can fully check this case for UB.

[RalfJung]

Something similar happens with Boxes that are not dereferenceable:

#[repr(C)]
struct S {
    a: (),
    b: i8,
}

fn main() {
    let mut x = Box::new(S { a: (), b: 0 });
    unsafe { (&raw mut x).cast::<usize>().write(16) };
    let _val = x.a; //~ERROR: must be dereferenceable for 1 byte, but got 0x10[noalloc] which is a dangling pointer
}