UB dropping BTreeMap containing dangling items

[dtolnay]

Based on rust-lang/unsafe-code-guidelines#283 I believe the following code illustrates UB:

use fallible_collections::btree::BTreeMap;

fn main() {
    let mut map;
    let s = "...".to_owned();
    map = BTreeMap::<&str, &str>::new();
    map.try_insert(&s, &s).unwrap();

    // s is dropped
    // then map is dropped
}

The drop of map is running this Drop impl:

fallible_collections/src/btree/map.rs

Lines 129 to 135 in 2742886

	unsafe impl<#[may_dangle] K, #[may_dangle] V> Drop for BTreeMap<K, V> {
	fn drop(&mut self) {
	unsafe {
	drop(ptr::read(self).into_iter());
	}
	}
	}

Based on the IntoIterator impl for BTreeMap, that's converting BTreeMap<&'dangling str, &'dangling str> into IntoIter<&'dangling str, &'dangling str>:

fallible_collections/src/btree/map.rs

Lines 1350 to 1352 in 2742886

	impl<K, V> IntoIterator for BTreeMap<K, V> {
	type Item = (K, V);
	type IntoIter = IntoIter<K, V>;

and dropping the IntoIter using this impl:

fallible_collections/src/btree/map.rs

Lines 1368 to 1370 in 2742886

	impl<K, V> Drop for IntoIter<K, V> {
	fn drop(&mut self) {
	self.for_each(drop);

However, that ends up materializing a (&'dangling str, &'dangling str) as part of doing self.for_each(drop). As I understand it, it's UB to touch/pass/return dangling references like that by value.