Drop guards in slice sorting derive src pointers from &mut T, which is invalidated by interior mutation in comparison#92092