Panic safety issue in `Zip::next_back()` TrustedRandomAccess specialization

[Qwaz]

rust/library/core/src/iter/adapters/zip.rs

Lines 296 to 301 in 312b894

	if A::MAY_HAVE_SIDE_EFFECT && sz_a > self.len {
	for _ in 0..sz_a - self.len {
	self.a.next_back();
	}
	self.a_len = self.len;
	}

rust/library/core/src/iter/adapters/zip.rs

Lines 235 to 244 in 312b894

	} else if A::MAY_HAVE_SIDE_EFFECT && self.index < self.a_len {
	let i = self.index;
	self.index += 1;
	self.len += 1;
	// match the base implementation's potential side effects
	// SAFETY: we just checked that `i` < `self.a.len()`
	unsafe {
	self.a.__iterator_get_unchecked(i);
	}
	None

Yet another soundness bug in Zip's TRA specialization. Line 300 is not called when line 298 panics. This leaves self.a_len outdated, which results in calling __iterator_get_unchecked() with an invalid index in line 242.

Here is a playground link that demonstrates creating two mutable references to the same memory location without unsafe code.

[apiraino]

How close is this to #85873?

[the8472]

The same functions are involved but the aspects that interact to cause unsafety are quite different.

@rustbot claim

[Qwaz]

I agree, this is much closer to #81740.