Open
Description
edit: while this tests currently results in an error, the underying issue still exists #112417 (comment)
trait CallMeMaybe<'a, 'b> {
fn mk() -> Self;
fn subtype<T>(self, x: &'b T) -> &'a T;
}
struct Foo<'a, 'b: 'a>(&'a (), &'b ());
impl<'a, 'b> CallMeMaybe<'a, 'b> for Foo<'a, 'b> {
fn mk() -> Self {
Foo(&(), &())
}
fn subtype<T>(self, x: &'b T) -> &'a T {
x
}
}
// `foo` must not compile but does.
fn foo<'a, 'b>() -> impl CallMeMaybe<'a, 'b> {
panic!();
Foo(&(), &())
}
// The rest is only to exploit that unsoundness.
trait Func {
type RetTy;
}
impl<F: FnOnce() -> R, R> Func for F {
type RetTy = R;
}
fn subtype<'a, 'b, F: FnOnce() -> R, R: CallMeMaybe<'a, 'b>, T>(_: F, x: &'b T) -> &'a T {
let proof = R::mk();
proof.subtype(x)
}
fn main() {
let y = subtype(foo, &String::from("Hello World"));
println!("{y}"); // use after free
}
With the current implementation foo
only defines the opaque type during HIR typeck and not in MIR typeck as the defining use is in dead code. HIR typeck does not check regions so we use erased regions instead. This hidden type with erased regions is then used as the actual hidden type of the RPIT because there is no hidden type defined by MIR typeck.
We then never check that the RPIT is well-formed outside of HIR typeck itself, so we never check that the region constraints hold for the opaque type.
Metadata
Metadata
Assignees
Labels
Area: `impl Trait`. Universally / existentially quantified anonymous types with static dispatch.Category: This is a bug.Issue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessMedium priorityStatus: This issue has no reproduction and needs a reproduction to make progress.Relevant to the types team, which will review and decide on the PR/issue.
Type
Projects
Status
unblocked