Associated type bound from supertrait isn't checked for trait object

[theemathas]

The following code compiles and causes a use-after-free.

trait Super {
    type Assoc;
}

trait Sub: Super<Assoc: Copy> {}

fn unchecked_copy<T: Sub<Assoc = String> + ?Sized>(x: &String) -> String {
    *x
}

fn main() {
    let x: String = String::from("abc");
    let y: String = unchecked_copy::<dyn Sub<Assoc = String>>(&x);
    drop(x);
    println!("{y}");
}

It seems that the compiler is somehow concluding that T::Assoc = String and T::Assoc: Copy are true at the same time.

cc @lcnr

Meta

Reproducible on the playground with version 1.95.0-nightly (2026-02-12 47611e16044c68ef27ba)

[theemathas]

And here's a variant that causes an ICE:

trait Trait {
    fn method();
}

trait Super {
    type Assoc;
}

trait Sub: Super<Assoc: Trait> {}

fn weird<T: Sub<Assoc = String> + ?Sized>() {
    String::method();
}

fn main() {
    weird::<dyn Sub<Assoc = String>>();
}

Error output

error: internal compiler error: /rustc-dev/47611e16044c68ef27bac31c35fda2ba1dc20b73/compiler/rustc_middle/src/ty/instance.rs:579:21: failed to resolve instance for <String as Trait>::method
  --> src/main.rs:12:5
   |
12 |     String::method();
   |     ^^^^^^^^^^^^^^^^


thread 'rustc' (26) panicked at /rustc-dev/47611e16044c68ef27bac31c35fda2ba1dc20b73/compiler/rustc_middle/src/ty/instance.rs:579:21:
Box<dyn Any>
stack backtrace:
   0: std::panicking::begin_panic::<rustc_errors::ExplicitBug>
   1: <rustc_errors::diagnostic::BugAbort as rustc_errors::diagnostic::EmissionGuarantee>::emit_producing_guarantee
   2: <rustc_errors::DiagCtxtHandle>::span_bug::<rustc_span::span_encoding::Span, alloc::string::String>
   3: rustc_middle::util::bug::opt_span_bug_fmt::<rustc_span::span_encoding::Span>::{closure#0}
   4: rustc_middle::ty::context::tls::with_opt::<rustc_middle::util::bug::opt_span_bug_fmt<rustc_span::span_encoding::Span>::{closure#0}, !>::{closure#0}
   5: rustc_middle::ty::context::tls::with_context_opt::<rustc_middle::ty::context::tls::with_opt<rustc_middle::util::bug::opt_span_bug_fmt<rustc_span::span_encoding::Span>::{closure#0}, !>::{closure#0}, !>
   6: rustc_middle::util::bug::span_bug_fmt::<rustc_span::span_encoding::Span>
   7: <rustc_middle::ty::instance::Instance>::expect_resolve
   8: <rustc_monomorphize::collector::MirUsedCollector as rustc_middle::mir::visit::Visitor>::visit_terminator
   9: rustc_monomorphize::collector::items_of_instance
      [... omitted 1 frame ...]
  10: rustc_monomorphize::collector::collect_items_rec
  11: rustc_monomorphize::collector::collect_items_rec
  12: rustc_monomorphize::collector::collect_crate_mono_items::{closure#1}::{closure#0}
  13: rustc_monomorphize::partitioning::collect_and_partition_mono_items
      [... omitted 1 frame ...]
  14: rustc_codegen_ssa::base::codegen_crate::<rustc_codegen_llvm::LlvmCodegenBackend>
  15: <rustc_codegen_llvm::LlvmCodegenBackend as rustc_codegen_ssa::traits::backend::CodegenBackend>::codegen_crate
  16: <rustc_interface::queries::Linker>::codegen_and_build_linker
  17: <rustc_interface::passes::create_and_enter_global_ctxt<core::option::Option<rustc_interface::queries::Linker>, rustc_driver_impl::run_compiler::{closure#0}::{closure#2}>::{closure#2} as core::ops::function::FnOnce<(&rustc_session::session::Session, rustc_middle::ty::context::CurrentGcx, alloc::sync::Arc<rustc_data_structures::jobserver::Proxy>, &std::sync::once_lock::OnceLock<rustc_middle::ty::context::GlobalCtxt>, &rustc_data_structures::sync::worker_local::WorkerLocal<rustc_middle::arena::Arena>, &rustc_data_structures::sync::worker_local::WorkerLocal<rustc_hir::Arena>, rustc_driver_impl::run_compiler::{closure#0}::{closure#2})>>::call_once::{shim:vtable#0}
  18: rustc_interface::interface::run_compiler::<(), rustc_driver_impl::run_compiler::{closure#0}>::{closure#1}
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: please make sure that you have updated to the latest nightly

note: please attach the file at `/playground/rustc-ice-2026-02-14T07_30_23-24.txt` to your bug report

note: rustc 1.95.0-nightly (47611e160 2026-02-12) running on x86_64-unknown-linux-gnu

note: compiler flags: --crate-type bin -C embed-bitcode=no -C codegen-units=1 -C debuginfo=2

note: some of the compiler flags provided by cargo are hidden

query stack during panic:
#0 [items_of_instance] collecting items used by `weird::<dyn Sub<Assoc = alloc::string::String>>`
#1 [collect_and_partition_mono_items] collect_and_partition_mono_items
end of query stack
error: could not compile `playground` (bin "playground")

[theemathas]

Another variant of the use-after-free:

trait Super {
    type Assoc;
}

trait Sub: Super<Assoc: Copy> {}

trait Weird: Sub + Super<Assoc = String> {}

fn wut<T: Sub + ?Sized>(x: &T::Assoc) -> T::Assoc {
    *x
}

fn unchecked_copy<T: Weird + ?Sized>(x: &String) -> String {
    wut::<T>(x)
}

fn main() {
    let x: String = String::from("abc");
    let y: String = unchecked_copy::<dyn Weird>(&x);
    drop(x);
    println!("{y}");
}

[Human9000-bit]

Miri output of the first snippet (playground link):

error: Undefined Behavior: pointer not dereferenceable: alloc282 has been freed, so this pointer is dangling
    --> /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:1750:13
     |
1750 |             &*core::intrinsics::aggregate_raw_ptr::<*const [T], _, _>(self.as_ptr(), self.len)
     |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
     |
     = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
     = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
help: alloc282 was allocated here:
    --> src/main.rs:12:21
     |
  12 |     let x: String = String::from("abc");
     |                     ^^^^^^^^^^^^^^^^^^^
help: alloc282 was deallocated here:
    --> src/main.rs:14:5
     |
  14 |     drop(x);
     |     ^^^^^^^
     = note: stack backtrace:
             0: std::vec::Vec::<u8>::as_slice
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:1750:13: 1750:95
             1: std::string::String::as_str
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/string.rs:1055:43: 1055:62
             2: <std::string::String as std::ops::Deref>::deref
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/string.rs:2825:9: 2825:22
             3: <std::string::String as std::fmt::Display>::fmt
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/string.rs:2714:28: 2714:34
             4: core::fmt::rt::Argument::<'_>::fmt
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/rt.rs:152:76: 152:95
             5: std::fmt::write
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/mod.rs:1684:17: 1686:80
             6: std::io::default_write_fmt::<std::io::StdoutLock<'_>>
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/mod.rs:639:11: 639:40
             7: <std::io::StdoutLock<'_> as std::io::Write>::write_fmt
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/mod.rs:1994:13: 1994:42
             8: <&std::io::Stdout as std::io::Write>::write_fmt
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:834:9: 834:36
             9: <std::io::Stdout as std::io::Write>::write_fmt
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:808:9: 808:33
             10: std::io::stdio::print_to::<std::io::Stdout>
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:1164:21: 1164:47
             11: std::io::_print
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:1275:5: 1275:37
             12: main
                 at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/macros.rs:143:9: 143:62

[apiraino]

Assigning priority (discussion on Zulip).

@rustbot label -I-prioritize +P-high

[lcnr]

We elaborate associated type bounds from super traits in the param_env, but don't actually prove them for the trait objects to implement trait/to be well-formed.

I think ideally T: Trait<Assoc = String> would error. Given the way the current impl is setup, the responsible part of the code would be the check that the trait object implements Trait.