Soundness issue of map_ref_mut

[QuarticCat]

Consider foo.map_ref_mut(|f| *f = new_f), it will drop the old f. If the old f contains a Box, it will cause a double-free issue. Even f is trivially droppable, the modification won't be applied to foo, the compact f. We need to find a way to prevent users from modifying f itself or mark this function as unsafe or invent a new API to replace it.