VecDeque::drain: make sure the 'drain' raw pointer is actually still …

…usable

src/liballoc/collections/vec_deque.rs

@@ -1019,14 +1019,19 @@ impl<T> VecDeque<T> {
  // the drain is complete and the Drain destructor is run.
  self.head = drain_tail;
 
+ // `deque` and `ring` overlap in what they point to, so we must make sure
+ // that `ring` is "derived-from" `deque`, or else even just creating ring
+ // from `self` already invalidates `deque`.
+ let deque = NonNull::from(&mut *self);
+
  Drain {
- deque: NonNull::from(&mut *self),
+ deque,
  after_tail: drain_head,
  after_head: head,
  iter: Iter {
  tail: drain_tail,
  head: drain_head,
- ring: unsafe { self.buffer_as_mut_slice() },
+ ring: unsafe { (&mut *deque.as_ptr()).buffer_as_mut_slice() },
  },
  }
  }