libarena::TypedArena::alloc_from_iter does not allow for recursive allocations

[cjgillot]

I stumbled on this while debugging #66936

I tried calling TypedArena::alloc_from_iter with an iterator which itself allocates on the arena.
If that iterator has fixed size (known through size_hint), the allocation goes in the fast path.
In that case, the allocation for the range and the recursive allocations get interlaced.
The returned pointers are wrong, and valid objects get overwritten.
This can lead to undropped objects and infinite loops.

A simple fix has been committed to #66936.
A more intelligent one may be better.

[Mark-Simulacrum]

Can you split out the fix (presuming it's to TypedArena itself) from the arena code? It sounds like if we're returning wrong pointers this is a "soundness" bug too, since that method is safe; which is not great. Nominating for compiler team so we can hopefully assign someone to investigate a proper fix.

[pnkfelix]

triage: sounds very bad. has PR. P-high. removing nomination.