Unsound drop due to imperfect lifetime checks

[Patryk27]

Looks like it's possible to impl Drop for a stricter lifetime than the one used in the type:

struct Wrapper<'a, T>(&'a T)
where
    T: 'a;

impl<'a, T> Drop for Wrapper<'a, T>
where
    T: 'static, // ayy ayy
{
    fn drop(&mut self) {
      //
    }
}

... which allows to essentially transmute from T: 'a to T: 'static, leading to unsoundness:

use std::{
    fmt::Debug,
    thread::{sleep, spawn},
    time::Duration,
};

struct Wrapper<'a, T>(&'a T)
where
    T: Clone + Debug + Send + 'a;

impl<'a, T> Drop for Wrapper<'a, T>
where
    T: Clone + Debug + Send + 'static,
{
    fn drop(&mut self) {
        let value = self.0.to_owned();

        spawn(move || {
            // Wait for `main()` to finish dropping `self.0`
            sleep(Duration::from_millis(100));

            // Use-after-free 
            println!("value: {:?}", value);
        });
    }
}

#[derive(Clone, Copy, Debug)]
struct StringWrapper<'a>(&'a String);

fn main() {
    let _ = Wrapper(&StringWrapper(&String::from("Hello!")));

    // Wait for the thread to complete
    sleep(Duration::from_secs(1));
}

On my machine, it prints:

value: StringWrapper("SU�Y\u{5}\u{0}")

[BoxyUwU]

oops...

[camelid]

Looks like this regressed in 1.56.0.

[BoxyUwU]

#87770 introduced this

[camelid]

Re-opening to track beta/stable backport.

[apiraino]

Assigning priority as discussed in the Zulip thread of the Prioritization Working Group.

@rustbot label -I-prioritize +P-critical

[pnkfelix]

(I'm investigating making a more limited version of this PR #90840 for backporting to beta/stable.)

[pnkfelix]

we ended up backporting #90840 itself to the 1.57 release. So this is now closed.