[libc++] std::ranges::__movable_box can overwrite data that comes after it

[huixie90]

std::ranges::__movable_box can overwrite data that comes after it
this is similar to #68552

This example shows how user would hit this bug

int main() {
    auto f = [l = 0.0L, b = false](int i) { return i; };

    auto v1 = std::vector{1, 2, 3, 4, 5} | std::views::transform(f);
    auto v2 = std::vector{1, 2, 3, 4, 5} | std::views::transform(f);

    v1 = std::move(v2);

    for (auto x : v1) {  // SEGV here
        std::cout << x;
    }
}

This example explains why it happens

struct A {
    A() {}

    double x{};
    bool y{};

    A(const A&) = default;
    A& operator=(const A&) = delete;
};

struct Test {
    Test() {}

    [[no_unique_address]] std::ranges::__movable_box<A> a;
    bool b = true;
};


int main(){
    static_assert(std::ranges::__doesnt_need_empty_state<A>);
    Test test;
    assert(test.b);
    test.a = std::ranges::__movable_box<A>{};
    assert(test.b);  // boom
}

movable boxes are widely used in ranges.

It uses [[no_unique_address]] in its data member. But on operator=, it calls destroy_at followed by construct_at. If the data member has tail padding, the tail padding would be zeroed out. If the user put the next data in the tail padding, this would overwrite the next data member. We have done this by ourselves, e.g. in transform_view, the next data member is the underlying view and the first example shows that the underlying view's memory was zeroed out, causing it to crash

https://godbolt.org/z/GcYoer4W4
https://godbolt.org/z/hvh4v1EWK