Why is async_executor's lifetime 'a invariant?

[cr1901]

A few months ago, I started looking at smol's internals to get an idea of "how does one write an async runtime that's understandable by a single person". I've circled around back to this, and remembered where I left off.

The Executor struct contains an UnsafeCell to make the Executor struct invariant in State "lifetime" a. I'm still a bit shaky on what this means, but AIUI, this means "any types that contaning the Executor lifetime 'a must last exactly as long as 'a and no more:

pub struct Executor<'a> {
    /// The executor state.
    state: AtomicPtr<State>,

    /// Makes the `'a` lifetime invariant.
    _marker: PhantomData<std::cell::UnsafeCell<&'a ()>>,
}

Why is this invariance required, and what safety guarantees/assumptions break if the invariance is removed?

I found the a playground snippet I wrote a few months ago as an MCVE of the difference between having the lifetime invariant vs not: https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=7b7b7c97c6bef5b1d698e2f1d9fbbbd7

This snippet compiles if the lifetime is covariant, and fails to compile if its invariant. So there is a difference. But I was unable to figure out how my MCVE relates to the reasons smol uses an invariant lifetime.

[SkiFire13]

Intuitively you can think of the Executor as holding futures with lifetime 'a, so its state holds a lifetime 'a. However it also allows to spawn futures using a shared reference to the Executor, meaning its state is internally mutable, so it would have to be wrapped in something like a UnsafeCell/RwLock/RefCell/etc etc, which ultimately makes it invariant over the lifetime 'a.

but AIUI, this means "any types that contaning the Executor lifetime 'a must last exactly as long as 'a and no more

Not really, they can last less than 'a.

what safety guarantees/assumptions break if the invariance is removed?

If the lifetime 'a was covariant you could take a &Executor<'long>, coerce it to a &Executor<'short> (thanks to the covariance of the lifetime), and spawn a future with lifetime 'short. This however results in the Executor<'long> holding something that really has lifetime 'short, and that's unsound because the executor can then outlive its contents.