# Stacked Borrows: An Aliasing Model For Rust

**URL:** <https://internals.rust-lang.org/t/stacked-borrows-an-aliasing-model-for-rust/8153>\
**Category:** Unsafe Code Guidelines\
**Created:** [August 7, 2018, 7:46pm UTC](https://internals.rust-lang.org/t/stacked-borrows-an-aliasing-model-for-rust/8153 "2018-08-07T19:46:06Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![comex](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/comex/32/2587_2.png) [@comex](https://internals.rust-lang.org/u/comex)\
**Post date:** [August 8, 2018, 8:42am UTC](https://internals.rust-lang.org/t/stacked-borrows-an-aliasing-model-for-rust/8153/12 "2018-08-08T08:42:44Z")

</div>

Looks good.

I’m somewhat concerned about how barriers interact with cases where lifetime disjointness is enforced by dynamic checks. Let’s take your demo code, which you explained would be UB if `x` and `y` point to the same location:

```rust
fn demo5(x: &mut i32, y: usize) -> i32 {
  *x = 42;
  foo(y);
}

fn foo(y: usize) {
  let y = unsafe { &mut *(y as *mut i32) };
  *y = 7;
}

```

But then change `&mut i32` to `RefMut<i32>`, and `usize` to `&&RefCell<i32>`:

```rust
use std::cell::{RefCell, RefMut};
use std::mem::drop;

fn demo5x(mut x: RefMut<i32>, y: &&RefCell<i32>) {
  *x = 42;
  drop(x);
  foo(y);
}

fn foo(y: &&RefCell<i32>) {
  *y.borrow_mut() = 7;
}

fn main() {
    let x = RefCell::new(42);
    demo5x(x.borrow_mut(), &&x);
}

```

This is now entirely safe code. But from your borrow model’s perspective, it ought to be equivalent:

- `RefMut<T>` contains `&mut T` as a field.
- `&RefCell<T>` is a shared reference with interior mutability, which in your model behaves like a raw pointer (using a `Raw` item). The double reference (`&&RefCell<T>`) is so that retagging doesn’t take effect, i.e. neither `demo5x` nor `foo` will push another `Raw` on entry.
- I had to explicitly `drop` the `RefMut`, but that shouldn’t affect anything; it only writes to the `RefCell`'s state field, not the value itself.

So this should also be UB. Am I mistaken?

---

_[View the full topic](https://internals.rust-lang.org/t/stacked-borrows-an-aliasing-model-for-rust/8153)._