prevent deref coercions in pin!

library/core/src/pin.rs

@@ -2031,9 +2031,19 @@ unsafe impl<T: ?Sized> PinCoerceUnsized for *mut T {}
 // `super` gets removed by rustfmt
 #[rustfmt::skip]
 pub macro pin($value:expr $(,)?) {
-    {
+    'p: {
         super let mut pinned = $value;
         // SAFETY: The value is pinned: it is the local above which cannot be named outside this macro.
-        unsafe { $crate::pin::Pin::new_unchecked(&mut pinned) }
+        break 'p unsafe { $crate::pin::Pin::new_unchecked(&mut pinned) };
+
+        // HACK: We need to ensure that, given `$value: T`, `pin!($value)` has type `Pin<&mut T>`.
+        // Otherwise, it's possible for a type annotation on the result of `pin!` to unsoundly add
+        // deref coercions. E.g. for `$value: &mut T`, we can get `pin!($value): Pin<&mut T>`,
+        // violating the pinning invariant; see <https://github.com/rust-lang/rust/issues/153438>.
+        fn unreachable_type_constraint<'a, T>(_: T) -> $crate::pin::Pin<&'a mut T> {
+            unreachable!()
+        }
+        #[expect(unreachable_code)]
+        unreachable_type_constraint(pinned)
     }
 }

tests/ui/iterators/iter-macro-not-async-closure.rs

@@ -27,6 +27,8 @@ fn main() {
     //~^^ ERROR AsyncFnOnce()` is not satisfied
     //~^^^ ERROR AsyncFnOnce()` is not satisfied
     //~^^^^ ERROR AsyncFnOnce()` is not satisfied
+    //~^^^^^ ERROR AsyncFnOnce()` is not satisfied
+    //~^^^^^^ ERROR AsyncFnOnce()` is not satisfied
     x.poll(&mut Context::from_waker(Waker::noop()));
     //~^ ERROR AsyncFnOnce()` is not satisfied
 }

tests/ui/iterators/iter-macro-not-async-closure.stderr

@@ -49,7 +49,31 @@ LL | async fn call_async_once(f: impl AsyncFnOnce()) {
    |                                  ^^^^^^^^^^^^^ required by this bound in `call_async_once`
 
 error[E0277]: the trait bound `{gen closure@$DIR/iter-macro-not-async-closure.rs:19:21: 19:28}: AsyncFnOnce()` is not satisfied
-  --> $DIR/iter-macro-not-async-closure.rs:30:5
+  --> $DIR/iter-macro-not-async-closure.rs:25:13
+   |
+LL |     let x = pin!(call_async_once(f));
+   |             ^^^^^^^^^^^^^^^^^^^^^^^^ the trait `AsyncFnOnce()` is not implemented for `{gen closure@$DIR/iter-macro-not-async-closure.rs:19:21: 19:28}`
+   |
+note: required by a bound in `call_async_once`
+  --> $DIR/iter-macro-not-async-closure.rs:14:34
+   |
+LL | async fn call_async_once(f: impl AsyncFnOnce()) {
+   |                                  ^^^^^^^^^^^^^ required by this bound in `call_async_once`
+
+error[E0277]: the trait bound `{gen closure@$DIR/iter-macro-not-async-closure.rs:19:21: 19:28}: AsyncFnOnce()` is not satisfied
+  --> $DIR/iter-macro-not-async-closure.rs:25:13
+   |
+LL |     let x = pin!(call_async_once(f));
+   |             ^^^^^^^^^^^^^^^^^^^^^^^^ the trait `AsyncFnOnce()` is not implemented for `{gen closure@$DIR/iter-macro-not-async-closure.rs:19:21: 19:28}`
+   |
+note: required by a bound in `call_async_once`
+  --> $DIR/iter-macro-not-async-closure.rs:14:34
+   |
+LL | async fn call_async_once(f: impl AsyncFnOnce()) {
+   |                                  ^^^^^^^^^^^^^ required by this bound in `call_async_once`
+
+error[E0277]: the trait bound `{gen closure@$DIR/iter-macro-not-async-closure.rs:19:21: 19:28}: AsyncFnOnce()` is not satisfied
+  --> $DIR/iter-macro-not-async-closure.rs:32:5
    |
 LL |     x.poll(&mut Context::from_waker(Waker::noop()));
    |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the trait `AsyncFnOnce()` is not implemented for `{gen closure@$DIR/iter-macro-not-async-closure.rs:19:21: 19:28}`
@@ -60,6 +84,6 @@ note: required by a bound in `call_async_once`
 LL | async fn call_async_once(f: impl AsyncFnOnce()) {
    |                                  ^^^^^^^^^^^^^ required by this bound in `call_async_once`
 
-error: aborting due to 5 previous errors
+error: aborting due to 7 previous errors
 
 For more information about this error, try `rustc --explain E0277`.

tests/ui/pin/dont-deref-coerce-pinned-value.rs

@@ -0,0 +1,13 @@
+//! Regression test for <https://github.com/rust-lang/rust/issues/153438>: when there's a type
+//! expectation on `pin!`'s result, make sure we don't deref-coerce the argument to
+//! `Pin::new_unchecked` to get its type to match up. That violates the pinning invariant, leading
+//! to unsoundness!
+
+use std::pin::{Pin, pin};
+
+fn wrong_pin<T>(data: &mut T, callback: impl FnOnce(Pin<&mut T>)) {
+    callback(pin!(data));
+    //~^ ERROR: mismatched types
+}
+
+fn main() {}

tests/ui/pin/dont-deref-coerce-pinned-value.stderr

@@ -0,0 +1,27 @@
+error[E0308]: mismatched types
+  --> $DIR/dont-deref-coerce-pinned-value.rs:9:14
+   |
+LL | fn wrong_pin<T>(data: &mut T, callback: impl FnOnce(Pin<&mut T>)) {
+   |              - expected this type parameter
+LL |     callback(pin!(data));
+   |              ^^^^^^^^^^
+   |              |
+   |              expected type parameter `T`, found `&mut T`
+   |              arguments to this function are incorrect
+   |
+   = note: expected type parameter `_`
+           found mutable reference `&mut _`
+help: the return type of this call is `&mut T` due to the type of the argument passed
+  --> $DIR/dont-deref-coerce-pinned-value.rs:9:14
+   |
+LL |     callback(pin!(data));
+   |              ^^^^^^^^^^ this argument influences the return type of `unreachable_type_constraint`
+note: function defined here
+  --> $DIR/dont-deref-coerce-pinned-value.rs:9:14
+   |
+LL |     callback(pin!(data));
+   |              ^^^^^^^^^^
+
+error: aborting due to 1 previous error
+
+For more information about this error, try `rustc --explain E0308`.