par_merge 中的 Tree Borrow 违规

Hi, during my testing, I found a Tree Borrow violation in the par_merge function in rayon/src/slice/sort.rs. The problem is in rayon/src/slice/sort.rs. Essentially, at

        let mut s = State {
            left_start: left.as_mut_ptr(),
            left_end: left.as_mut_ptr().add(left_len),
            right_start: right.as_mut_ptr(),
            right_end: right.as_mut_ptr().add(right_len),
            dest,
        };

it created a child node for left, say it has tag A. Then, when during the function call for split_for_merge,

            let (left_mid, right_mid) = split_for_merge(left, right, is_less);

it created a sibling tag, S, and this was used to create a child tag when calling is_less

            is_less(&right[right_mid], &left[m])

So the problem is when function is_less modify the second item, the modification propagates thorugh the tree, which acts as a foreign write to s.left_start, making A disabled. Therefore, when we want to touch s.left_start in the drop function, it fails the Tree Borrow.