Polymorph the Box's drop as well

Doing this for allocating them was a nice perf win in 152737, so might help here too.

Author: scottmcm

library/alloc/src/boxed.rs

@@ -1923,12 +1923,27 @@ unsafe impl<#[may_dangle] T: ?Sized, A: Allocator> Drop for Box<T, A> {
     fn drop(&mut self) {
         // the T in the Box is dropped by the compiler before the destructor is run
 
-        let ptr = self.0;
-
+        let ptr = Box::as_ptr(self);
+        // SAFETY: By type invariants, this is the allocator and layout for the pointer.
         unsafe {
-            let layout = Layout::for_value_raw(ptr.as_ptr());
-            if layout.size() != 0 {
-                self.1.deallocate(From::from(ptr.cast()), layout);
+            box_drop_inner(&self.1, ptr as *const u8, Layout::for_value_raw(ptr));
+        }
+
+        /// # Safety
+        /// If `layout` is non-ZST, then `ptr` must have been allocated
+        /// with compatible `layout` by `a`.
+        /// (or `layout` is a ZST)
+        // This is intentionally polymorphized, like `box_new_uninit`, so we
+        // keep it from inlining in MIR, and leave it up to the backend to
+        // decide whether it's actually worth inlining.
+        #[rustc_no_mir_inline]
+        #[inline]
+        unsafe fn box_drop_inner(a: &impl Allocator, ptr: *const u8, layout: Layout) {
+            // SAFETY: Obligations propagated to the caller
+            unsafe {
+                if layout.size() != 0 {
+                    a.deallocate(NonNull::new_unchecked(ptr.cast_mut()), layout);
+                }
             }
         }
     }