GcCellRefMut::map causes assertion failed: finalizer_safe()

[andersk]

This causes a panic at assert!(finalizer_safe()):

use gc::{Gc, GcCell, GcCellRefMut};
fn main() {
    GcCellRefMut::map(
        Gc::new(GcCell::new((0, Gc::new(1)))).borrow_mut(),
        |(a, _)| a,
    );
}

Backtrace

thread 'main' panicked at 'assertion failed: finalizer_safe()', /home/anders/.cargo/registry/src/github.com-1ecc6299db9ec823/gc-0.3.6/src/lib.rs:126:9
stack backtrace:
   0: std::panicking::begin_panic
             at /build/rustc-1.48.0-src/library/std/src/panicking.rs:505
   1: gc::Gc<T>::inner
             at /home/anders/.cargo/registry/src/github.com-1ecc6299db9ec823/gc-0.3.6/src/lib.rs:126
   2: <gc::Gc<T> as core::ops::drop::Drop>::drop
             at /home/anders/.cargo/registry/src/github.com-1ecc6299db9ec823/gc-0.3.6/src/lib.rs:271
   3: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
   4: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
   5: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
   6: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
   7: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
   8: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
   9: <gc::gc::GcState as core::ops::drop::Drop>::drop
             at /home/anders/.cargo/registry/src/github.com-1ecc6299db9ec823/gc-0.3.6/src/gc.rs:35
  10: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
  11: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
  12: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
  13: core::ptr::drop_in_place
             at /build/rustc-1.48.0-src/library/core/src/ptr/mod.rs:175
  14: core::mem::drop
             at /build/rustc-1.48.0-src/library/core/src/mem/mod.rs:881
  15: std::thread::local::fast::destroy_value
             at /build/rustc-1.48.0-src/library/std/src/thread/local.rs:519
  16: __call_tls_dtors
  17: __run_exit_handlers
  18: __GI_exit
  19: __libc_start_main
  20: _start
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
fatal runtime error: failed to initiate panic, error 5
Aborted (core dumped)

I think what’s happened here is that GcCellRefMut::drop unrooted the wrong value after the GcCellRefMut::map.