Fix invalid pointer deref in Weak::as_ptr

2 files changed, 2 insertions, 2 deletions

diff --git a/src/liballoc/rc.rs b/src/liballoc/rc.rs
index 8f7b8efd811..ab64d533087 100644
--- a/src/liballoc/rc.rs
+++ b/src/liballoc/rc.rs
@@ -1711,7 +1711,7 @@ impl<T> Weak<T> {
         // because dangling weaks are only created for sized T. wrapping_offset
         // is used so that we can use the same code path for dangling weak refs.
         unsafe {
-            let offset = data_offset(&raw const (*ptr).value);
+            let offset = data_offset(fake_ptr);
             set_data_ptr(fake_ptr, (ptr as *mut u8).wrapping_offset(offset))
         }
     }
diff --git a/src/liballoc/sync.rs b/src/liballoc/sync.rs
index 27c36f4a569..e9af80d326f 100644
--- a/src/liballoc/sync.rs
+++ b/src/liballoc/sync.rs
@@ -1479,7 +1479,7 @@ impl<T> Weak<T> {
         // because dangling weaks are only created for sized T. wrapping_offset
         // is used so that we can use the same code path for dangling weak refs.
         unsafe {
-            let offset = data_offset(&raw const (*ptr).data);
+            let offset = data_offset(fake_ptr);
             set_data_ptr(fake_ptr, (ptr as *mut u8).wrapping_offset(offset))
         }
     }