Built-in indexing doesn't ensure bounds checks stay valid

[matthewjasper]

For example, the bounds check for x[1] in the following code is invalidated by the assignment in the next indexer.

fn modify_after_assert_slice_array(x: &[&[i32; 3]]) -> i32 {
    let mut x = x;
    let z = [1, 2, 3];
    let y = &[&z];
    // 1. checks `x[1]` is not out of bounds - OK `x.len() = 2`.
    // 2. modifies `x` so that `x == y`. Now `x.len() == 1`
    // 3. tries to read `x[1][2]` which is now out of bounds.
    x[1][{ x = y; 2}]
}
fn main() {
    println!("{}", modify_after_assert_slice_array(&[&[4, 5, 6], &[9, 10, 11]]));
}