Vec::drain is unsound with range_bounds_assert_len feature #81157
Description
Manually implementing assert_len can cause unsoundness in Vec::drain. This only happens in nightly, as overriding assert_len is only possible in nightly releases.
The following program will segfault.
#![feature(range_bounds_assert_len)]
use std::cell::Cell;
use std::ops::{Bound, Range, RangeBounds};
struct EvilRange(Cell<bool>);
impl RangeBounds<usize> for EvilRange {
fn start_bound(&self) -> Bound<&usize> {
unimplemented!()
}
fn end_bound(&self) -> Bound<&usize> {
unimplemented!()
}
fn assert_len(self, _len: usize) -> Range<usize> {
0..42
}
}
fn main() {
vec![1, 2, 3].drain(EvilRange(Cell::new(false)));
}