Function type with opaque return type can be coerced to `dyn Fn` with arbitrary return type

[Noratrieb]

I tried this code:

fn hi() -> impl Sized { std::ptr::null::<u8>() }

fn main() {
    let b: Box<dyn Fn() -> Box<u8>> = Box::new(hi);
    let boxed = b();
    let null = *boxed;
    println!("{null:?}");
}

https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=a78a1c65a7788a1fc16bbb49823e31b1

I expected to see this happen: Compiler error, since impl Sized cannot be coerced to Box<u8>.

Instead, this happened: Code compiles, segfault

Meta

rustc --version --verbose:

rustc 1.64.0-nightly (2f3ddd9f5 2022-06-27)
binary: rustc
commit-hash: 2f3ddd9f594adf9773547aa7cedb43c4ac8ffd2f
commit-date: 2022-06-27
host: x86_64-unknown-linux-gnu
release: 1.64.0-nightly
LLVM version: 14.0.6

[JakobDegen]

This regressed in 1.61, unfortunately my wifi is not currently up for running a proper bisect.

@rustbot label +regression-from-stable-to-stable

[oli-obk]

likely cause is one of the uses of take_opaque_type without actually registering the hidden types

[5225225]

searched nightlies: from nightly-2022-01-01 to nightly-2022-06-26
regressed nightly: nightly-2022-03-31
searched commit range: 9c06e1b...c5cf08d
regressed commit: f132bcf

bisected with cargo-bisect-rustc v0.6.1

Host triple: x86_64-unknown-linux-gnu
Reproduce with:

cargo bisect-rustc --preserve --regress non-error --start 2022-01-01 

So yeah, it looks to be #94081