I was reading up on pinning in the std::pin module documentation. In the section about structural pinning there is an example involving RefCell and a hypothetical method on it fn get_pin_mut(self: Pin<&mut Self>) -> Pin<&mut T>.
It is supposed to be a more involved example of a type that provides structural pinning to one of its fields while also having other methods that allow violating the pinning guarantees.

I know this isn't a real example, as the hypothetical method on RefCell does not exist. However, apart from that, the rest of the code should be standard Rust. And I don't think it is.

Here is the example as of this post.

fn exploit_ref_cell<T>(rc: Pin<&mut RefCell<T>>) {
    // Here we get pinned access to the `T`.
    let _: Pin<&mut T> = rc.as_mut().get_pin_mut();

    // And here we have `&mut T` to the same data.
    let shared: &RefCell<T> = rc.into_ref().get_ref();
    let borrow = shared.borrow_mut();
    let content = &mut *borrow;
}

I see two issues with this example (aside from this being meant as a bad case).
Firstly, calling as_mut() on a Pin<&mut T> would require rc to be mut.
Secondly, the as_mut() is not needed, as this would just convert Pin<&mut RefCell<T>> to Pin<&mut RefCell<T>> using DerefMut of &mut T.

I guess my question is, are these issues really present, or am I missing something?

2 posts - 2 participants

Read full topic