Fix a soundness hole allowing multiple mutable borrows

.travis.yml

@@ -1,7 +1,7 @@
 language: rust
 matrix:
   include:
-    - rust: 1.21.0
+    - rust: 1.24.1
     - rust: stable
     - os: osx
     - rust: beta

src/heap_lazy.rs

@@ -8,27 +8,27 @@
 extern crate std;
 
 use self::std::prelude::v1::*;
+use self::std::cell::Cell;
 use self::std::sync::Once;
 pub use self::std::sync::ONCE_INIT;
 
-pub struct Lazy<T: Sync>(*const T, Once);
+pub struct Lazy<T: Sync>(Cell<*const T>, Once);
 
 impl<T: Sync> Lazy<T> {
-    pub const INIT: Self = Lazy(0 as *const T, ONCE_INIT);
+    pub const INIT: Self = Lazy(Cell::new(0 as *const T), ONCE_INIT);
 
     #[inline(always)]
-    pub fn get<F>(&'static mut self, f: F) -> &T
+    pub fn get<F>(&'static self, f: F) -> &T
     where
         F: FnOnce() -> T,
     {
-        unsafe {
-            let r = &mut self.0;
-            self.1.call_once(|| {
-                *r = Box::into_raw(Box::new(f()));
-            });
-
-            &*self.0
-        }
+        self.1.call_once(|| {
+            self.0.set(Box::into_raw(Box::new(f())));
+        });
+
+        // `self.0` is guaranteed to have a value by this point
+        // The `Once` will catch and propegate panics
+        unsafe { &*self.0.get() }
     }
 }
 
@@ -38,6 +38,6 @@ unsafe impl<T: Sync> Sync for Lazy<T> {}
 #[doc(hidden)]
 macro_rules! __lazy_static_create {
     ($NAME:ident, $T:ty) => {
-        static mut $NAME: $crate::lazy::Lazy<$T> = $crate::lazy::Lazy::INIT;
+        static $NAME: $crate::lazy::Lazy<$T> = $crate::lazy::Lazy::INIT;
     };
 }

src/inline_lazy.rs

@@ -9,27 +9,28 @@ extern crate core;
 extern crate std;
 
 use self::std::prelude::v1::*;
+use self::std::cell::Cell;
 use self::std::sync::Once;
 pub use self::std::sync::ONCE_INIT;
 
-pub struct Lazy<T: Sync>(Option<T>, Once);
+pub struct Lazy<T: Sync>(Cell<Option<T>>, Once);
 
 impl<T: Sync> Lazy<T> {
-    pub const INIT: Self = Lazy(None, ONCE_INIT);
+    pub const INIT: Self = Lazy(Cell::new(None), ONCE_INIT);
 
     #[inline(always)]
-    pub fn get<F>(&'static mut self, f: F) -> &T
+    pub fn get<F>(&'static self, f: F) -> &T
     where
         F: FnOnce() -> T,
     {
-        {
-            let r = &mut self.0;
-            self.1.call_once(|| {
-                *r = Some(f());
-            });
-        }
+        self.1.call_once(|| {
+            self.0.set(Some(f()));
+        });
+
+        // `self.0` is guaranteed to be `Some` by this point
+        // The `Once` will catch and propegate panics
         unsafe {
-            match self.0 {
+            match *self.0.as_ptr() {
                 Some(ref x) => x,
                 None => unreachable_unchecked(),
             }
@@ -43,7 +44,7 @@ unsafe impl<T: Sync> Sync for Lazy<T> {}
 #[doc(hidden)]
 macro_rules! __lazy_static_create {
     ($NAME:ident, $T:ty) => {
-        static mut $NAME: $crate::lazy::Lazy<$T> = $crate::lazy::Lazy::INIT;
+        static $NAME: $crate::lazy::Lazy<$T> = $crate::lazy::Lazy::INIT;
     };
 }