UnsafePinned: also include the effects of UnsafeCell

[RalfJung]

This tackles #137750 by including an UnsafeCell in UnsafePinned, thus imbuing it with all the usual properties of interior mutability (no noalias nor dereferenceable on shared refs, special treatment by Miri's aliasing model). The soundness issue is not fixed yet because coroutine lowering does not use UnsafePinned.

The RFC said that UnsafePinned would not permit mutability on shared references, but since then, #137750 has demonstrated that this is not tenable. In the face of those examples, I propose that we do the "obvious" thing and permit shared mutable state inside UnsafePinned. This seems loosely consistent with the fact that we allow going from Pin<&mut T> to &T (where the former can be aliased with other pointers that perform mutation, and hence the same goes for the latter) -- but the as_ref example shows that we in fact would need to add this UnsafeCell even if we didn't have a safe conversion to &T, since for the compiler and Miri, &T and Pin<&T> are basically the same type.

To make this possible, I had to remove the Copy and Clone impls for UnsafePinned.

Tracking issue: #125735
Cc @rust-lang/lang @rust-lang/opsem @Sky9x
I don't think this needs FCP since the type is still unstable -- we'll finally decide whether we like this approach when UnsafePinned is moved towards stabilization (IOW, this PR is reversible). However, I'd still like to make sure that the lang team is okay with the direction I am proposing here.

[rustbot]

r? @thomcc

rustbot has assigned @thomcc.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

[rustbot]

The Miri subtree was changed

cc @rust-lang/miri

[Sky9x]

getting rid of those Copy/Clone impls is nice

[traviscross]

@rustbot labels -I-lang-nominated +I-lang-radar

We talked about this in the lang call today with 2/5 present. We felt it indeed made sense, given what we've found, for &UnsafePinned<T> to also be special.

[RalfJung]

@WaffleLapkin @tgross35 could one of you review this?

[RalfJung]

After 3 weeks without a review, I'll reassign.
r? @tgross35
(or maybe @WaffleLapkin ?)

[workingjubilee]

Soundness fix. Well, pre-fix. Code looks fine to me. Approving.

@bors r+ rollup

[bors]

📌 Commit 259d6f4 has been approved by workingjubilee

It is now in the queue for this repository.

[onestacked]

@RalfJung This PR missed changing the comment and doctest on UnsafePinned::get()

rust/library/core/src/pin/unsafe_pinned.rs

Lines 91 to 107 in 321dde1

	/// Note that `&UnsafePinned<T>` is read-only if `&T` is read-only. This means that if there is
	/// mutation of the `T`, future reads from the `*const T` returned here are UB! Use
	/// [`UnsafeCell`] if you also need interior mutability.
	///
	/// [`UnsafeCell`]: crate::cell::UnsafeCell
	///
	/// ```rust,no_run
	/// #![feature(unsafe_pinned)]
	/// use std::pin::UnsafePinned;
	///
	/// unsafe {
	/// let mut x = UnsafePinned::new(0);
	/// let ptr = x.get(); // read-only pointer, assumes immutability
	/// x.get_mut_unchecked().write(1);
	/// ptr.read(); // UB!
	/// }
	/// ```

[RalfJung]

Good point, I filed a follow-up at #142162.