@@ -1692,8 +1692,22 @@ impl<Ptr: [const] Deref> const Deref for Pin<Ptr> {
16921692mod helper {
16931693 /// Helper that prevents downstream crates from implementing `DerefMut` for `Pin`.
16941694 ///
1695- /// This type is not `#[fundamental]`, so it's possible to relax its `DerefMut` impl bounds in
1696- /// the future, so the orphan rules reject downstream impls of `DerefMut` of `Pin`.
1695+ /// The `Pin` type implements the unsafe trait `PinCoerceUnsized`, which essentially requires
1696+ /// that the type does not have a malicious `Deref` or `DerefMut` impl. However, without this
1697+ /// helper module, downstream crates are able to write `impl DerefMut for Pin<LocalType>` as
1698+ /// long as it does not overlap with the impl provided by stdlib. This is because `Pin` is
1699+ /// `#[fundamental]`, so stdlib promises to never implement traits for `Pin` that it does not
1700+ /// implement today.
1701+ ///
1702+ /// However, this is problematic. Downstream crates could implement `DerefMut` for
1703+ /// `Pin<&LocalType>`, and they could do so maliciously. To prevent this, the implementation for
1704+ /// `Pin` delegates to this helper module. Since `helper::Pin` is not `#[fundamental]`, the
1705+ /// orphan rules assume that stdlib might implement `helper::DerefMut` for `helper::Pin<&_>` in
1706+ /// the future. Because of this, downstream crates can no longer provide an implementation of
1707+ /// `DerefMut` for `Pin<&_>`, as it might overlap with a trait impl that, according to the
1708+ /// orphan rules, the stdlib could introduce without a breaking change in a future release.
1709+ ///
1710+ /// See <https://github.com/rust-lang/rust/issues/85099> for the issue this fixes.
16971711 #[ repr( transparent) ]
16981712 #[ unstable( feature = "pin_derefmut_internals" , issue = "none" ) ]
16991713 #[ allow( missing_debug_implementations) ]
0 commit comments