Fix UB in Vec::clone

src/index_set.rs

@@ -56,7 +56,8 @@ impl<T: Eq + Hash + StableDeref, S: BuildHasher> FrozenIndexSet<T, S> {
         let ret = unsafe {
             let set = self.set.get();
             let (index, _was_vacant) = (*set).insert_full(value);
-            &*(*set)[index]
+            let set_ref = &(*set);
+            &*set_ref[index]
         };
         self.in_use.set(false);
         ret
@@ -83,7 +84,8 @@ impl<T: Eq + Hash + StableDeref, S: BuildHasher> FrozenIndexSet<T, S> {
         let ret = unsafe {
             let set = self.set.get();
             let (index, _was_vacant) = (*set).insert_full(value);
-            (index, &*(*set)[index])
+            let set_ref = &(*set);
+            (index, &*set_ref[index])
         };
         self.in_use.set(false);
         ret
@@ -261,7 +263,8 @@ impl<T: Eq + Hash + StableDeref, S> Index<usize> for FrozenIndexSet<T, S> {
         self.in_use.set(true);
         let ret = unsafe {
             let set = self.set.get();
-            &*(*set)[idx]
+            let set_ref = &(*set);
+            &*set_ref[idx]
         };
         self.in_use.set(false);
         ret

src/vec.rs

@@ -225,8 +225,19 @@ impl<T> Default for FrozenVec<T> {
 
 impl<T: Clone> Clone for FrozenVec<T> {
     fn clone(&self) -> Self {
+        // Vec::clone() will internally call Clone impls, which may reaccess the FrozenVec
+        // Instead, we iterate element-by-element.
+        let mut newvec;
+        unsafe {
+            let len = self.vec.get().as_ref().unwrap().len();
+            newvec = Vec::with_capacity(len);
+            for i in 0..len {
+                let element = self.vec.get().as_ref().unwrap()[i].clone();
+                newvec.push(element);
+            }
+        }
         Self {
-            vec: unsafe { self.vec.get().as_ref().unwrap() }.clone().into(),
+            vec: UnsafeCell::new(newvec),
         }
     }
 }

tests/frozenvec_clone_miri.rs

@@ -0,0 +1,32 @@
+use elsa::FrozenVec;
+
+struct Yo<'a> {
+    some_flag: bool,
+    reference: &'a FrozenVec<Box<Yo<'a>>>,
+}
+impl Clone for Yo<'_> {
+    fn clone(&self) -> Self {
+        self.reference.push(Box::new(Yo {
+            some_flag: self.some_flag,
+            reference: &self.reference,
+        }));
+
+        Self {
+            some_flag: self.some_flag,
+            reference: self.reference,
+        }
+    }
+}
+
+#[test]
+fn test_miri() {
+    let vec: FrozenVec<Box<Yo>> = FrozenVec::new();
+
+    let something = Box::new(Yo {
+        some_flag: true,
+        reference: &vec,
+    });
+
+    vec.push(something);
+    let _ = vec.clone();
+}