Final Code

Here's the whole module. It compiles, it passes basic tests, and you would never use it. The borrow checks are runtime, the error mode is panic, the API leaks Ref<T>, and Iter/IterMut are unimplementable. Chapter 5 starts over with raw pointers.

All in one place. Note what you don't see: no unsafe, no raw pointers, no manual Drop. The Rc graph cleans itself up because a doubly-linked list has no cycles between its endpoints — when the list drops, the head Rc decrements, which drops the next link, which decrements the next Rc, and so on.

use std::cell::{Ref, RefCell, RefMut};
use std::rc::Rc;

pub struct List<T> {
    head: Link<T>,
    tail: Link<T>,
}

type Link<T> = Option<Rc<RefCell<Node<T>>>>;

struct Node<T> {
    elem: T,
    next: Link<T>,
    prev: Link<T>,
}

impl<T> List<T> {
    pub fn new() -> Self {
        List { head: None, tail: None }
    }

    pub fn push_front(&mut self, elem: T) {
        let new_head = Rc::new(RefCell::new(Node { elem, prev: None, next: None }));
        match self.head.take() {
            Some(old_head) => {
                old_head.borrow_mut().prev = Some(new_head.clone());
                new_head.borrow_mut().next = Some(old_head);
                self.head = Some(new_head);
            }
            None => {
                self.tail = Some(new_head.clone());
                self.head = Some(new_head);
            }
        }
    }

    pub fn pop_front(&mut self) -> Option<T> {
        self.head.take().map(|old_head| {
            match old_head.borrow_mut().next.take() {
                Some(new_head) => {
                    new_head.borrow_mut().prev.take();
                    self.head = Some(new_head);
                }
                None => { self.tail.take(); }
            }
            Rc::try_unwrap(old_head).ok().unwrap().into_inner().elem
        })
    }

    pub fn push_back(&mut self, elem: T) {
        let new_tail = Rc::new(RefCell::new(Node { elem, prev: None, next: None }));
        match self.tail.take() {
            Some(old_tail) => {
                old_tail.borrow_mut().next = Some(new_tail.clone());
                new_tail.borrow_mut().prev = Some(old_tail);
                self.tail = Some(new_tail);
            }
            None => {
                self.head = Some(new_tail.clone());
                self.tail = Some(new_tail);
            }
        }
    }

    pub fn pop_back(&mut self) -> Option<T> {
        self.tail.take().map(|old_tail| {
            match old_tail.borrow_mut().prev.take() {
                Some(new_tail) => {
                    new_tail.borrow_mut().next.take();
                    self.tail = Some(new_tail);
                }
                None => { self.head.take(); }
            }
            Rc::try_unwrap(old_tail).ok().unwrap().into_inner().elem
        })
    }

    pub fn peek_front(&self) -> Option<Ref<T>> {
        self.head.as_ref().map(|n| Ref::map(n.borrow(), |n| &n.elem))
    }
    pub fn peek_back(&self) -> Option<Ref<T>> {
        self.tail.as_ref().map(|n| Ref::map(n.borrow(), |n| &n.elem))
    }
    pub fn peek_front_mut(&mut self) -> Option<RefMut<T>> {
        self.head.as_ref().map(|n| RefMut::map(n.borrow_mut(), |n| &mut n.elem))
    }
    pub fn peek_back_mut(&mut self) -> Option<RefMut<T>> {
        self.tail.as_ref().map(|n| RefMut::map(n.borrow_mut(), |n| &mut n.elem))
    }
}

pub struct IntoIter<T>(List<T>);

impl<T> List<T> {
    pub fn into_iter(self) -> IntoIter<T> { IntoIter(self) }
}

impl<T> Iterator for IntoIter<T> {
    type Item = T;
    fn next(&mut self) -> Option<T> { self.0.pop_front() }
}

impl<T> DoubleEndedIterator for IntoIter<T> {
    fn next_back(&mut self) -> Option<T> { self.0.pop_back() }
}

02

Why you wouldn't ship this: every operation pays for two atomic-ish ops on the Rc count plus a non-atomic borrow flag flip on the RefCell. Errors that should be compile failures are runtime panics. The peek API leaks Ref<T>. There is no Iter or IterMut. And cycles — which a real circular deque might want — are leaked, because Rc can't collect them.
```
// Costs of every operation, roughly:
// - 1+ Rc clone/drop  (refcount +/- per neighbour pointer)
// - 1+ RefCell borrow (runtime flag check, panics on violation)
// - 1 heap allocation for push, 1 free for pop
// Compare to the unsafe queue in Chapter 5, which is just a couple of
// raw-pointer writes and a Box allocation.
```

End of Chapter IV

Three perspectives on what you just read

C-track For readers from C, C++, C#

You just built a doubly-linked list with zero unsafe blocks, and the bill came due in three places. Every node access goes through a runtime borrow check, which is a single-threaded mutex with the thread-safety stripped out and the panic-on-contention behavior left in. The Ref<T> and RefMut<T> guards are RAII tokens, and the moment peek had to return one, your lock_guard<> bled into the public type signature and poisoned every iterator you tried to write on top of it. Compile-time aliasing rules became runtime crashes, the kind that survive code review and ship to production. The structure works, but you traded static guarantees for opaque failure modes and an API that forces every caller to hold a guard they did not ask for. Safe Rust let you write this; that does not mean Rust wanted you to.

Py-track For readers from Ruby, Python, JavaScript

In the languages you came from, any reference can mutate any object at any time, and that flexibility is so normal it is invisible. Rc<RefCell<T>> is the escape hatch that lets you do the same thing in Rust: shared ownership with mutation through any handle. This chapter showed you what that costs once you actually use it. The borrow checker did not disappear, it just moved to runtime, which means the errors you used to get as red squiggles in your editor now arrive as panics while the program is running. Worse, the wrapper types leaked outward: peek could not hand back a plain reference, so callers received a guard object they had to understand and release. You can build the data structure this way, and it will run, but you have given up the thing that made you reach for Rust in the first place and kept most of the friction.

0-track For readers new to programming

You just finished building a list where each item knows about the item before it and the item after it, and you did the whole thing without writing the word unsafe anywhere. That sounds like a win, and in one narrow sense it is, but the chapter was really about the price of getting there. To make it work, every read and every write had to be wrapped in a small object that says trust me, I promise nothing else is touching this right now, and if that promise turns out to be wrong the program crashes instead of refusing to compile. The compiler usually catches mistakes before your program ever runs; here, you traded that early warning for a later, louder failure. On top of that, the wrapper objects leaked into the parts of the code other people would use, so the list became awkward to hold and awkward to loop over. The lesson is not that this technique is forbidden, only that being allowed to do something is not the same as it being a good idea, and this is one of the times it is not.