How safe Rust reached undefined behavior in cgmath — and how Miri found the wider scope

yilin0518 reported a soundness bug in cgmath 0.18.0: Matrix2::swap_columns, Matrix3::swap_columns, and Matrix4::swap_columns are implemented as unsafe { ptr::swap(&mut self[a], &mut self[b]) }; and calling m.swap_columns(0, 0) — a same-index swap, reachable from ordinary safe code with no unsafe anywhere in the caller — creates two overlapping &mut borrows of the same memory through a safe API. Miri flags it immediately: error: Undefined Behavior: attempting a read access using <281> ... ...