alloc-tls: how can panicking in with’s closure cause UB?

[cormacrelf]

I’ve read the code a few times and I don’t quite understand how the closure panicking could cause undefined behaviour. As far as I can tell, f is only ever called in “tail position”, after all the initialisation is done, even in with_slow. The TLSSlot passes it a pointer to the storage, wraps the result in Some and returns. There is no transient state that has to be cleaned up after it returns. There are no variables in scope with a Drop implementation in either with or with_slow. When you unwind it, it’s pretty much identical to having returned normally. How does it cause UB?