Skip to content

Conversation

@justanotheranonymoususer

Per my understanding, needed for mut access next line.

Per my understanding, needed for mut access next line.
@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jan 5, 2026
@rustbot
Copy link
Collaborator

rustbot commented Jan 5, 2026

r? @scottmcm

rustbot has assigned @scottmcm.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

@scottmcm
Copy link
Member

scottmcm commented Jan 9, 2026

Punting on pin,
@rustbot reroll

@rustbot rustbot assigned joboet and unassigned scottmcm Jan 9, 2026
@joboet
Copy link
Member

joboet commented Jan 9, 2026

Sure, though this isn't intended to compile anyway...
@bors r+ rollup

@rust-bors rust-bors bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jan 9, 2026
@rust-bors
Copy link
Contributor

rust-bors bot commented Jan 9, 2026

📌 Commit 39b08b6 has been approved by joboet

It is now in the queue for this repository.

@justanotheranonymoususer
Copy link
Author

this isn't intended to compile anyway...

Only because get_pin_mut doesn't exist. It compiles without that line.

Also, I figured the argument to exploit_ref_cell should be mut.

This compiles:

use std::cell::RefCell;
use std::pin::Pin;

trait RefCellPinExt<'a, T> {
    fn get_pin_mut(self) -> Pin<&'a mut T>;
}

impl<'a, T> RefCellPinExt<'a, T> for Pin<&'a mut RefCell<T>> {
    fn get_pin_mut(self) -> Pin<&'a mut T> {
        // SAFETY: That's actually unsafe. Don't do this in real code!
        unsafe { self.map_unchecked_mut(|rc| rc.get_mut()) }
    }
}

fn exploit_ref_cell<T>(mut rc: Pin<&mut RefCell<T>>) {
    // Here we get pinned access to the `T`.
    let _: Pin<&mut T> = rc.as_mut().get_pin_mut();

    // And here we have `&mut T` to the same data.
    let shared: &RefCell<T> = rc.into_ref().get_ref();
    let mut borrow = shared.borrow_mut();
    let content = &mut *borrow;
}

https://play.rust-lang.org/?version=stable&mode=debug&edition=2024&gist=e54a0a6082785b63359650b128f15071

Maybe we better replace it with this version? It's longer, but the compiler can check that it compiles. It's incorrect and unsafe, but having it compile makes sure the example is not bogus.

Updated to code that compiles
@rust-bors rust-bors bot added the S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. label Jan 9, 2026
@rust-bors
Copy link
Contributor

rust-bors bot commented Jan 9, 2026

⚠️ A new commit 2a68b2ec8a6735435fe91af086b0f32042540151 was pushed to the branch, the PR will need to be re-approved.

@rust-bors rust-bors bot removed the S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. label Jan 9, 2026
@justanotheranonymoususer
Copy link
Author

Updated to code that compiles, LMK WDYT

@rust-log-analyzer

This comment has been minimized.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. T-libs Relevant to the library team, which will review and decide on the PR/issue.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants