Undefined Behaviour find by Miri

[yilin0518]

Hi!

We are a team of researchers studying memory safety in Rust. As part of our ongoing research, we tested elementtree (version: 1.2.3)
and found that the following code snippet is reported as undefined behavior by Miri:

Problematic Snippet

#![feature(allocator_api)]
extern crate alloc;
use elementtree::*;
fn main() {
    let v17 = "𩕛祋\u{52f8f}𝋑\u{ee6c9}\u{6b5e8}\u{ce3dd}";
    let v18 = String::from(v17);
    let v19: &'_ str = &v18;
    let v20 = QName::<'_>::from_name(v19);
    let v21 = "𡝡Ƀ\u{7212f}\u{4dca4}\u{c17ec}\u{fc2b5}\u{5cc28}\u{cb938}";
    let v22 = String::from(v21);
    let v23: &'_ str = &v22;
    let v24 = Element::new::<'_, &'_ str>(v23);
    let v25: &'_ Element = &v24;
    let v26: &'_ QName::<'_> = &v20;
    let v27 = Element::get_attr::<'_, &'_ QName::<'_>>(v25, v26);
    let v28: &'_ QName::<'_> = &v20;
    let v29 = QName::<'_>::name(v28);
    let v30 = QName::<'_>::from_ns_name(v27, v29);
    let v31: &'_ QName::<'_> = &v30;
    let v32 = QName::<'_>::name(v31);
    let v33 = QName::<'_>::from_ns_name(v27, v32);
    let v34: &'_ QName::<'_> = &v33;
    let v35 = <QName::<'_> as std::clone::Clone>::clone(v34);
}

Miri Error Excerpt

error: Undefined Behavior: reborrow through <188714> at alloc78974[0x10] is forbidden
   --> /home/rose/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/string_cache-0.8.9/src/dynamic_set.rs:102:41
    |
102 |             let entry_ptr: *mut Entry = &mut **entry_ptr;
    |                                         ^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
    |
    = help: this indicates a potential bug in the program: it performed an invalid operation, but the Tree Borrows rules it violated are still experimental
    = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/tree-borrows.md for further information
    = help: the accessed tag <188714> is a child of the conflicting tag <188710>
    = help: the conflicting tag <188710> has state Disabled which forbids this reborrow (acting as a child read access)
help: the accessed tag <188714> was created here
   --> src/main.rs:24:1
    |
 24 | }
    | ^
help: the conflicting tag <188710> was created here, in the initial state Reserved
   --> src/main.rs:24:1
    |
 24 | }
    | ^
help: the conflicting tag <188710> later transitioned to Disabled due to a foreign write access at offsets [0x10..0x18]
   --> src/main.rs:24:1
    |
 24 | }
    | ^
    = help: this transition corresponds to a loss of read and write permissions
    = note: BACKTRACE (of the first span):
    = note: inside `string_cache::dynamic_set::Set::remove` at /home/rose/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/string_cache-0.8.9/src/dynamic_set.rs:102:41: 102:57
    = note: inside `<string_cache::atom::Atom<Static> as std::ops::Drop>::drop::drop_slow::<string_cache::static_sets::EmptyStaticAtomSet>` at /home/rose/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/string_cache-0.8.9/src/atom.rs:269:13: 269:71
    = note: inside `<string_cache::atom::Atom<string_cache::static_sets::EmptyStaticAtomSet> as std::ops::Drop>::drop` at /home/rose/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/string_cache-0.8.9/src/atom.rs:263:17: 263:32
    = note: inside `std::ptr::drop_in_place::<string_cache::atom::Atom<string_cache::static_sets::EmptyStaticAtomSet>> - shim(Some(string_cache::atom::Atom<string_cache::static_sets::EmptyStaticAtomSet>))` at /home/rose/.rustup/toolchains/nightly-2025-12-06-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:805:1: 807:25
    = note: inside `std::ptr::drop_in_place::<elementtree::XmlAtom<'_>> - shim(Some(elementtree::XmlAtom<'_>))` at /home/rose/.rustup/toolchains/nightly-2025-12-06-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:805:1: 807:25
    = note: inside `std::ptr::drop_in_place::<elementtree::QName<'_>> - shim(Some(elementtree::QName<'_>))` at /home/rose/.rustup/toolchains/nightly-2025-12-06-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:805:1: 807:25
    = note: inside `std::ptr::drop_in_place::<elementtree::Element> - shim(Some(elementtree::Element))` at /home/rose/.rustup/toolchains/nightly-2025-12-06-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:805:1: 807:25
note: inside `main`
   --> src/main.rs:24:1
    |
 24 | }
    | ^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

Command used:

  MIRIFLAGS="-Zmiri-ignore-leaks -Zmiri-tree-borrows" RUSTFLAGS=-Awarnings RUST_BACKTRACE=1 cargo miri run

We’d appreciate it if you could take a look and confirm whether this behavior indicates a real issue, or if it’s a false positive or an expected limitation of Miri.

Thank you very much for your time and for maintaining this project!