Correctly handle interior mutable data in Box

Previously, the pointee type would be behind a `*const` pointer, so
`ty_is_freeze` would always be `true`, even if there was an
`UnsafeCell` in `Box`.

src/tools/miri/src/borrow_tracker/tree_borrows/mod.rs

@@ -173,7 +173,7 @@ impl<'tcx> NewPermission {
         pointee.is_unpin(*cx.tcx, cx.typing_env()).then_some(()).map(|()| {
             // Regular `Unpin` box, give it `noalias` but only a weak protector
             // because it is valid to deallocate it within the function.
-            let ty_is_freeze = ty.is_freeze(*cx.tcx, cx.typing_env());
+            let ty_is_freeze = pointee.is_freeze(*cx.tcx, cx.typing_env());
             let protected = kind == RetagKind::FnEntry;
             let initial_state = Permission::new_reserved(ty_is_freeze, protected);
             Self {

src/tools/miri/tests/pass/tree_borrows/cell-inside-box.rs

@@ -0,0 +1,19 @@
+//@compile-flags: -Zmiri-tree-borrows
+#![feature(box_as_ptr)]
+#[path = "../../utils/mod.rs"]
+#[macro_use]
+mod utils;
+
+use std::cell::UnsafeCell;
+
+pub fn main() {
+    let cell = UnsafeCell::new(42);
+    let mut root = Box::new(cell);
+
+    let a = Box::as_mut_ptr(&mut root);
+    unsafe {
+        name!(a);
+        let alloc_id = alloc_id!(a);
+        print_state!(alloc_id);
+    }
+}

src/tools/miri/tests/pass/tree_borrows/cell-inside-box.stderr

@@ -0,0 +1,6 @@
+──────────────────────────────────────────────────
+Warning: this tree is indicative only. Some tags may have been hidden.
+0..   4
+| Act |    └─┬──<TAG=root of the allocation>
+| ReIM|      └────<TAG=a>
+──────────────────────────────────────────────────