new VecDeque::splice() method in nightly produce incorrect result

[pkerichang]

When I run the following code on the latest nightly channel, it prints incorrect result:

#![feature(deque_extend_front)]

use std::collections::VecDeque;
use itertools::join;


struct Point([i32; 2]);

fn main() {
    let mut vec_2 = VecDeque::with_capacity(10);
    vec_2.push_back(Point([0, 6]));
    vec_2.push_back(Point([4, 6]));
    vec_2.push_back(Point([4, 2]));
    vec_2.push_back(Point([2, 2]));
    vec_2.push_back(Point([2, 6]));
    vec_2.push_back(Point([0, 6]));

    let mut vec_3 = VecDeque::with_capacity(10);
    vec_3.push_back(Point([8, 6]));
    vec_3.push_back(Point([8, 4]));
    vec_3.push_back(Point([6, 4]));
    vec_3.push_back(Point([6, 6]));

    let mut vec = VecDeque::with_capacity(10);
    vec.push_front(Point([0, 0]));
    vec.push_back(Point([10, 0]));

    let mut points_str = join(
        vec.iter().map(|val| format!("({}, {})", val.0[0], val.0[1])),
            ", ",
    );
    println!("{}", points_str);

    vec.prepend(vec_2.drain(..));

    points_str = join(
        vec.iter().map(|val| format!("({}, {})", val.0[0], val.0[1])),
            ", ",
    );
    println!("{}", points_str);

    vec.splice(1..1, vec_3.drain(..));

    points_str = join(
        vec.iter().map(|val| format!("({}, {})", val.0[0], val.0[1])),
            ", ",
    );
    println!("{}", points_str);
}

I would expect the output of this simple program to be:

(0, 0), (10, 0)
(0, 6), (4, 6), (4, 2), (2, 2), (2, 6), (0, 6), (0, 0), (10, 0)
(0, 6), (8, 6), (8, 4), (6, 4), (6, 6), (4, 6), (4, 2), (2, 2), (2, 6), (0, 0), (10, 0)

but instead the following got print:

(0, 0), (10, 0)
(0, 6), (4, 6), (4, 2), (2, 2), (2, 6), (0, 6), (0, 0), (10, 0)
(0, 6), (8, 6), (8, 4), (6, 4), (6, 6), (4, 6), (4, 2), (2, 2), (2, 6), (0, 0), (0, 0), (0, 0)

As you can see, the last element got remvoed, and two extra elements got inserted. In my actual application (not in this simple example), the extra elements contain random values instead of just zeros.

[cyrgani]

Miri reports UB in the original example:

error: Undefined Behavior: reading memory at alloc7742[0x60..0x64], but memory is uninitialized at [0x60..0x64], and this operation requires initialized memory
   --> /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/num.rs:164:45
    |
164 |                     unsafe { f.pad_integral(*self >= 0, "", self.unsigned_abs()._fmt(&mut buf)) }
    |                                             ^^^^^ Undefined Behavior occurred here
...
599 |     impl_Display!(i8, u8, i16, u16, i32, u32, i64, u64, isize, usize; as u64 into display_u64);
    |     ------------------------------------------------------------------------------------------ in this macro invocation

smaller version:

#![feature(deque_extend_front)]

use std::collections::VecDeque;

fn main() {
    let mut vec = VecDeque::with_capacity(10);
    vec.push_front(0);
    vec.push_back(9);

    vec.splice(1..1, [8]);

    println!("{:?}", vec);
}

[SpriteOvO]

CC @Qelxiros