Unsoundness in next-solver when checking lifetime requirements for RPIT

[maxdexh]

The following code results in a segfault when running with -Znext-solver:

trait Convert<T> {
    fn from(it: T) -> Self;
}
impl<'a, 'b: 'a, T> Convert<&'b T> for &'a T {
    fn from(it: &'b T) -> Self {
        it
    }
}

trait GatConvert: Sized {
    type Y<'a>: Convert<Self>
    where
        Self: 'a;

    fn into_y<'a>(self) -> Self::Y<'a>
    where
        Self: 'a,
    {
        Convert::from(self)
    }
}

type Target = Vec<Vec<u8>>;

impl<'b> GatConvert for &'b Target {
    type Y<'a>
        = &'a Target
    where
        Self: 'a;
}

fn wat<'a, T: GatConvert>(t: T) -> impl Sized + 'a {
    t.into_y::<'a>() // This should not compile!
}

fn leak<'a>(t: &'a Target) -> &'static Target {
    let ext = wat::<'static>(t);
    *(&ext as &dyn std::any::Any).downcast_ref().unwrap()
}

fn main() {
    let buf = leak(&vec![vec![1]]);
    dbg!(buf[0][0]);
}

rustc --version --verbose:

rustc 1.97.0-nightly (0febdbab2 2026-04-18)
binary: rustc
commit-hash: 0febdbab2720dc0360cd294c67db88d6d06580d4
commit-date: 2026-04-18
host: x86_64-unknown-linux-gnu
release: 1.97.0-nightly
LLVM version: 22.1.2

[theemathas]

cc @lcnr

[Jules-Bertholet]

@rustbot label I-unsound requires-nightly T-types

[maxdexh]

Simplified version

trait AssocConvert: Sized {
    type Y
    where
        Self: 'static;

    fn into_y(self) -> Self::Y
    where
        Self: 'static; // (This bound is optional, since it is implicitly added by using Y)
}

fn wat<T: AssocConvert>(t: T) -> impl Sized + 'static {
    t.into_y() // This should not compile!
}

// exploitation:
impl<T> AssocConvert for &T {
    type Y
        = &'static T
    where
        Self: 'static;

    fn into_y(self) -> Self::Y
    where
        Self: 'static,
    {
        self
    }
}

fn leak<T>(t: &T) -> &'static T {
    let ext = wat(t);
    *(&ext as &dyn std::any::Any).downcast_ref().unwrap()
}

fn main() {
    let buf = leak(&vec![vec![1]]);
    dbg!(buf[0][0]);
}