VecDeque::drain: make sure the 'drain' raw pointer is actually still usable

1 files changed, 7 insertions, 2 deletions

diff --git a/src/liballoc/collections/vec_deque.rs b/src/liballoc/collections/vec_deque.rs
index c8ee40f3d27..60b5d8063bf 100644
--- a/src/liballoc/collections/vec_deque.rs
+++ b/src/liballoc/collections/vec_deque.rs
@@ -1019,14 +1019,19 @@ impl<T> VecDeque<T> {
         // the drain is complete and the Drain destructor is run.
         self.head = drain_tail;
 
+        // `deque` and `ring` overlap in what they point to, so we must make sure
+        // that `ring` is "derived-from" `deque`, or else even just creating ring
+        // from `self` already invalidates `deque`.
+        let deque = NonNull::from(&mut *self);
+
         Drain {
-            deque: NonNull::from(&mut *self),
+            deque,
             after_tail: drain_head,
             after_head: head,
             iter: Iter {
                 tail: drain_tail,
                 head: drain_head,
-                ring: unsafe { self.buffer_as_mut_slice() },
+                ring: unsafe { (&mut *deque.as_ptr()).buffer_as_mut_slice() },
             },
         }
     }