We currently store a cancellation token inside a Waker, and it depends on horrible pointer operations (actually there were many segfaults during implementation).
We can implement task-local storage through thread-locals like tokio-rs/tokio#2126, and it's much safer.