Auto merge of #91813 - matthiaskrgr:rollup-nryyeyj, r=matthiaskrgr

Rollup of 8 pull requests

Successful merges:

 - #90081 (Make `intrinsics::write_bytes` const)
 - #91643 (asm: Allow using r9 (ARM) and x18 (AArch64) if they are not reserved by the current target)
 - #91737 (Make certain panicky stdlib functions behave better under panic_immediate_abort)
 - #91750 (rustdoc: Add regression test for Iterator as notable trait on &T)
 - #91764 (Do not ICE when suggesting elided lifetimes on non-existent spans.)
 - #91780 (Remove hir::Node::hir_id.)
 - #91797 (Fix zero-sized reference to deallocated memory)
 - #91806 (Make `Unique`s methods `const`)

Failed merges:

r? `@ghost`
`@rustbot` modify labels: rollup

1 files changed, 6 insertions, 4 deletions

diff --git a/library/alloc/src/vec/drain.rs b/library/alloc/src/vec/drain.rs
index 089cd4db64c..1bff19d05c1 100644
--- a/library/alloc/src/vec/drain.rs
+++ b/library/alloc/src/vec/drain.rs
@@ -128,10 +128,6 @@ impl<T, A: Allocator> Drop for Drain<'_, T, A> {
 
         let iter = mem::replace(&mut self.iter, (&mut []).iter());
         let drop_len = iter.len();
-        let drop_ptr = iter.as_slice().as_ptr();
-
-        // forget iter so there's no aliasing reference
-        drop(iter);
 
         let mut vec = self.vec;
 
@@ -155,6 +151,12 @@ impl<T, A: Allocator> Drop for Drain<'_, T, A> {
             return;
         }
 
+        // as_slice() must only be called when iter.len() is > 0 because
+        // vec::Splice modifies vec::Drain fields and may grow the vec which would invalidate
+        // the iterator's internal pointers. Creating a reference to deallocated memory
+        // is invalid even when it is zero-length
+        let drop_ptr = iter.as_slice().as_ptr();
+
         unsafe {
             // drop_ptr comes from a slice::Iter which only gives us a &[T] but for drop_in_place
             // a pointer with mutable provenance is necessary. Therefore we must reconstruct