Fix ReadRef<T>::cell when T != T::Read::Repr (#8845)

## Description

Fixes the test case introduced in #8843.

The theory is that Vcs are supposed to be stored as `<<T as
VcValueType>::Read as VcRead<T>>::Repr`. However, it looks like due to
an oversight, `ReadRef::cell` is trying to store the value as `T`.

This introduces a way to perform 

## Testing Instructions

```
cargo nextest r -p turbo-tasks -p turbo-tasks-memory
```

crates/turbo-tasks-memory/tests/generics.rs

@@ -147,7 +147,6 @@ async fn test_changing_generic() {
 
 // Test that we can convert a `Vc` to a `ReadRef`, and then back to a `Vc`.
 #[tokio::test]
-#[ignore = "TODO: This panics! There's a casting bug in the generics implementation."]
 async fn test_read_ref_round_trip() {
  run(&REGISTRATION, async move {
  let c: Vc<Option<Vc<u8>>> = Vc::cell(Some(Vc::cell(1)));

crates/turbo-tasks/src/read_ref.rs

@@ -12,6 +12,7 @@ use crate::{
  debug::{ValueDebugFormat, ValueDebugFormatString},
  macro_helpers::find_cell_by_type,
  trace::{TraceRawVcs, TraceRawVcsContext},
+ triomphe_utils::unchecked_sidecast_triomphe_arc,
  SharedReference, Vc, VcRead, VcValueType,
 };
 
@@ -242,8 +243,13 @@ where
  /// Returns a new cell that points to the same value as the given
  /// reference.
  pub fn cell(read_ref: ReadRef<T>) -> Vc<T> {
- let local_cell = find_cell_by_type(T::get_value_type_id());
- local_cell.update_shared_reference(SharedReference::new(read_ref.0));
+ let type_id = T::get_value_type_id();
+ let local_cell = find_cell_by_type(type_id);
+ // SAFETY: `T` and `T::Read::Repr` must have equivalent memory representations,
+ // guaranteed by the unsafe implementation of `VcValueType`.
+ local_cell.update_shared_reference(SharedReference::new(unsafe {
+ unchecked_sidecast_triomphe_arc::<T, <T::Read as VcRead<T>>::Repr>(read_ref.0)
+ }));
  Vc {
  node: local_cell.into(),
  _t: PhantomData,

crates/turbo-tasks/src/triomphe_utils.rs

@@ -5,26 +5,45 @@ use unsize::Coercion;
 /// Attempt to downcast a [`triomphe::Arc<dyn Any + Send +
 /// Sync>`][`triomphe::Arc`] to a concrete type.
 ///
+/// Checks that the downcast is safe using [`Any::is`].
+///
 /// Ported from [`std::sync::Arc::downcast`] to [`triomphe::Arc`].
 pub fn downcast_triomphe_arc<T: Any + Send + Sync>(
  this: triomphe::Arc<dyn Any + Send + Sync>,
 ) -> Result<triomphe::Arc<T>, triomphe::Arc<dyn Any + Send + Sync>> {
  if (*this).is::<T>() {
- unsafe {
- // Get the pointer to the offset (*const T) inside of the ArcInner.
- let ptr = triomphe::Arc::into_raw(this);
- // SAFETY: The negative offset from the data (ptr) in an Arc to the start of the
- // data structure is fixed regardless of type `T`.
- //
- // SAFETY: Casting from a fat pointer to a thin pointer is safe, as long as the
- // types are compatible (they are).
- Ok(triomphe::Arc::from_raw(ptr.cast()))
- }
+ unsafe { Ok(unchecked_sidecast_triomphe_arc(this)) }
  } else {
  Err(this)
  }
 }
 
+/// Transmutes the contents of `Arc<T>` to `Arc<U>`. Updates the `Arc`'s fat
+/// pointer metadata.
+///
+/// Unlike [`downcast_triomphe_arc`] this make no checks the transmute is safe.
+///
+/// # Safety
+///
+/// It must be [safe to transmute][transmutes] from `T` to `U`.
+///
+/// [transmutes]: https://doc.rust-lang.org/nomicon/transmutes.html
+pub unsafe fn unchecked_sidecast_triomphe_arc<T, U>(this: triomphe::Arc<T>) -> triomphe::Arc<U>
+where
+ T: ?Sized,
+{
+ unsafe {
+ // Get the pointer to the offset (*const T) inside of the ArcInner.
+ let ptr = triomphe::Arc::into_raw(this);
+ // SAFETY: The negative offset from the data (ptr) in an Arc to the start of the
+ // data structure is fixed regardless of type `T`.
+ //
+ // SAFETY: Casting from a fat pointer to a thin pointer is safe, as long as the
+ // types are compatible (they are).
+ triomphe::Arc::from_raw(ptr.cast())
+ }
+}
+
 /// [`Coercion::to_any`] except that it coerces to `dyn Any + Send + Sync` as
 /// opposed to `dyn Any`.
 pub fn coerce_to_any_send_sync<T: Any + Send + Sync>() -> Coercion<T, dyn Any + Send + Sync> {