panic safety: double drop may happen within util::{mutate, mutate2}