Aliasing violation in `drain()`

[Shnatsel]

The following unit test makes miri fail, even under Tree Borrows which the more permissive aliasing model:

#[test]
fn miri_drain_drop_mutates_buffer_while_slice_borrow_is_alive() {
    let mut tester: ArrayDeque<_, 4> = ArrayDeque::new();
    tester.extend_back(0..4);

    // Issue: `Drain` stores an `Iter` containing a slice reference into the
    // deque's buffer, then `Drain::drop` reconstructs the deque by writing
    // through a raw pointer while that slice field is still alive. Safe code
    // only has to drain a middle range; Tree Borrows reports the write as
    // violating the still-protected slice borrow.
    drop(tester.drain(1..2));
}

you can reproduce it with:

MIRIFLAGS=-Zmiri-tree-borrows cargo +nightly miri test --release miri_drain_drop_mutates_buffer_while_slice_borrow_is_alive