MaybeUninit+Cell results in constant evaluation error: Location is not frozen long enough

[Amanieu]

The following code triggers an error in miri:

#![feature(maybe_uninit)]
use std::mem::MaybeUninit;
use std::cell::Cell;

fn main() {
    let x: MaybeUninit<(Cell<u32>, u32)> = MaybeUninit::uninitialized();
    x.as_ptr();
}

error[E0080]: constant evaluation error: Location is not frozen long enough
    --> /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libcore/mem.rs:1141:20
     |
1141 |         unsafe { &*self.value as *const T }
     |                    ^^^^^^^^^^ Location is not frozen long enough
     |
note: inside call to `<std::mem::MaybeUninit<T>><(std::cell::Cell<u32>, u32)>::as_ptr` at src/main.rs:7:5
    --> src/main.rs:7:5
     |
7    |     x.as_ptr();
     |     ^^^^^^^^^^
     = note: inside call to `main` at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/libstd/rt.rs:64:34

[RalfJung]

Ah, I figured there'd be a Cell involved. :/

This is a Stacked Borrows model issue (not an implementation bug) that gets "fixed" by implementing rust-lang/rfcs#2582, but not really.

[RalfJung]

This version of the problem is worse:

#![feature(maybe_uninit)]
use std::mem::MaybeUninit;
use std::cell::Cell;

fn main() {
    let mut x: MaybeUninit<(Cell<u32>, u32)> = MaybeUninit::uninitialized();
    x.set((Cell::new(0), 0));
    unsafe { x.get_ref(); }
}

[RalfJung]

This will be fixed by #695, I added the examples above as a test.