[Bug] VM validation error on inline function

[lightmark]

🐛 Bug
When implement inline fun all<K, V> to SmartTable and run test_all.
The following error shows up:

2023-02-15T18:39:37.467108Z ERROR {"message":"Error: VMError { major_status: UNKNOWN_INVARIANT_VIOLATION_ERROR, sub_status: None, message: Some("moving container with dangling references"), exec_state: Some(ExecutionState { stack_trace: [(Some(ModuleId { address: 0000000000000000000000000000000000000000000000000000000000000001, name: Identifier("smart_table") }), FunctionDefinitionIndex(7), 12), (Some(ModuleId { address: 0000000000000000000000000000000000000000000000000000000000000001, name: Identifier("smart_table") }), FunctionDefinitionIndex(19), 69)] }), location: Module(ModuleId { address: 0000000000000000000000000000000000000000000000000000000000000001, name: Identifier("table_with_length") }), indices: [], offsets: [(FunctionDefinitionIndex(10), 13)] }\nCORE DUMP: >>>>>>>>>>>>\nCall stack:\n frame #0: 0x0000000000000000000000000000000000000000000000000000000000000001::smart_table::test_all [pc = 69]\n frame #1: 0x0000000000000000000000000000000000000000000000000000000000000001::smart_table::destroy [pc = 12]\nframe #2: 0x0000000000000000000000000000000000000000000000000000000000000001::table_with_length::remove [pc = 13]:\n0> CopyLoc(0)\n1> MutBorrowFieldGeneric(FieldInstantiationIndex(0))\n2> MoveLoc(1)\n3> CallGeneric(7)\n4> StLoc(2)\n5> CopyLoc(0)\n6> ImmBorrowFieldGeneric(FieldInstantiationIndex(1))\n7> ReadRef\n8> LdU64(1)\n9> Sub\n10> MoveLoc(0)\n11> MutBorrowFieldGeneric(FieldInstantiationIndex(1))\n12> WriteRef\n13 MoveLoc(2)\nLocals (120f35e08):\n[0] Invalid\n[1] Invalid\n[2] (container 120f37878: [(container 120f36738: [U64(13618872872554492724), U64(47), U64(47)])])\nOperand Stack:\n\n<<<<<<<<<<<<\n"}

To reproduce
git checkout smart_table_debug
cd aptos-core/aptos-move/move-examples/data_structures
aptos move test
Actually this triggers line https://github.com/move-language/move/blob/d80b5bea4cb1eef5fc456d6c26e55485a1223c86/language/move-vm/types/src/values/values_impl.rs#L1007 somehow...
@vgao1996 may have a better understanding of this.

Expected Behavior
test pass

System information
Please complete the following information:

Main Branch
rustc 1.66.1 (90743e729 2023-01-10)
OSX
Additional context
Add any other context about the problem here.

[wrwg]

There might be two problems. (a) Wrong code generation from inline functions (b) wrong code not detected by the verifier

[brmataptos]

Function inlining seems ok here. I've moved the example to tip-of-tree as branch brm-smart-table-bug, renaming to smart_table2 to avoid naming conflicts now that there is a smart_table in Aptos stdlib, with two commits on top which provide a manually-inlined version of the failing test (test_all_manual_inline) and verbose debugging of the inlining process which I've used to validate the correctness of the manual version. see branch https://github.com/aptos-labs/aptos-core/tree/brm-smart-table-bug.

I'm guessing it's a VM validator bug.

[brmataptos]

@lightmark Can you take a look at the manual version I've added in that branch mentioned above and verify it should validate?

[rahxephon89]

@vgao1996 @runtian-zhou This is related to the check in values_impl.rs that has not been enabled. Do you have any idea on how to proceed?

[runtian-zhou]

I'll schedule a sync-up meeting on this!

[brmataptos]

I'm deprioritizing this in favor of a move-compiler-v2 bug to make sure we don't generate code that triggers the VM situation.