r? @folkertdev

rustbot has assigned @folkertdev.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Reminder, once the PR becomes ready for a review, use @rustbot ready.

Sure, it stops the spelling the issue used, but you can still trigger the same move-on-drop through an explicit &pin mut / ref pin mut projection with no #[pin_v2] anywhere.

Could you provide example code for this?

Sure, it stops the spelling the issue used, but you can still trigger the same move-on-drop through an explicit &pin mut / ref pin mut projection with no #[pin_v2] anywhere.

Could you provide example code for this?

yeah here's a repro w/ no #[pin_v2] anywhere. it's basically the issue's example w/ the attrs stripped off, projecting purely through the explicit &pin mut / ref pin mut patterns:

#![feature(pin_ergonomics)]
#![allow(incomplete_features)]

use std::{marker::PhantomPinned, pin::{Pin, pin}};

// no #[pin_v2] on either type
#[repr(C, packed(4))]
struct One<T>(T);

#[repr(C, align(4096))]
struct Two(Thing);

struct Thing(#[expect(dead_code)] i32, PhantomPinned);

fn main() {
    let pinned_one: Pin<&mut One<Two>> = pin!(One(Two(Thing(0, PhantomPinned))));
    let &pin mut One(Two(ref pin mut pinned_thing)) = pinned_one;
    access(pinned_thing);
}

fn access(x: Pin<&mut Thing>) {
    println!("Pinned access at {x:p}")
}

impl Drop for Thing {
    fn drop(&mut self) {
        println!("Dropped at       {self:p}");
    }
}

the pinned-access addr and the drop addr come out different, so the Pin invariant is broken, same as the original.

afaict #[pin_v2] only gates the implicit projection (the default binding-mode shift, like plain Foo { x, y } against a Pin<&mut Foo>). the explicit ref pin mut / &pin mut patterns project in place no matter whether the type opted in. the projection check in rustc_hir_typeck/src/pat.rs only runs under default_binding_modes, so spelling the deref out (&pin mut .. ref pin mut ..) just walks right past it. so banning pin_v2 + packed kills the exact spelling the issue used, but this one still hands you an in-place Pin<&mut> into the field that the packed drop glue then moves.

two things worth noting. i used align(4096) instead of the issue's 65536 just so it prints cleanly, at 65536 it segfaults on my machine (stack realignment during the drop-glue move), same unsoundness, just louder. and the &pin mut <place> borrow operator (like &pin mut one.0.0) doesn't repro this, it copies the packed field out to an aligned temp first so it stays safe. it's specifically the pattern form that pins in place.

yeah here's a repro w/ no #[pin_v2]

Is there an issue for this and can either of you open one if it doesn't exist?

yeah here's a repro w/ no #[pin_v2]

Is there an issue for this and can either of you open one if it doesn't exist?

On my search I didn't found any related with this specifically....so, yes, I will open one.

e for this and can either of you open one if it doesn't exist?

On my search I didn't found any related with this specifically....so, yes, I will open one.

Can you guys validate, please?
#157615

cc// @theemathas @mejrs

📌 Commit 9663384 has been approved by mejrs

It is now in the queue for this repository.