A possible regression with -Zpolonius=next

[krasimirgg]

A possible regression with -Zpolonius=next. Appears to be in how Polonius handles opaque types. These sound like they may be related:

• normalizing opaques while computing implied bounds trait-system-refactor-initiative#159 (comment)
• move implied bounds computation out of borrowck #160491.

I tried this code:

struct Lifetimed<'a> {
    some_tuple: &'a (),
}
static LIFETIMED: Lifetimed<'static> = Lifetimed { some_tuple: &() };

struct ClosureMaker<'a> {
    some_string: &'a str,
}

impl<'a> ClosureMaker<'a> {
    // Returns an opaque type implementing Fn() -> T where T is &'a Lifetimed<'a>.
    // The closure itself is 'static (no captures).
    fn make_closure_simple(&self) -> impl Fn() -> &'a Lifetimed<'a> + 'static {
        || {
            &LIFETIMED // Coerced from 'static to 'a
        }
    }
}

fn leak_it<T: 'static>(val: T) -> &'static T {
    Box::leak(Box::new(val))
}

fn return_value_with_dangling_lifetime() {
    let s = String::from("");
    let cm = ClosureMaker { some_string: &s };
    let val = cm.make_closure_simple()(); // Type is &'a Lifetimed<'a>
    let leaked = leak_it(val); // REQUIRES &'a Lifetimed<'a>: 'static
}

I expected to see this happen: compilation to fail like it does with the old borrow checker:

% rustc -Zpolonius=off --crate-type=rlib lib.rs
error[E0597]: `s` does not live long enough
  --> lib.rs:26:42
   |
25 |     let s = String::from("");
   |         - binding `s` declared here
26 |     let cm = ClosureMaker { some_string: &s };
   |                                          ^^ borrowed value does not live long enough
27 |     let val = cm.make_closure_simple()(); // Type is &'a Lifetimed<'a>
28 |     let leaked = leak_it(val); // REQUIRES &'a Lifetimed<'a>: 'static
   |                  ------------ argument requires that `s` is borrowed for `'static`
29 | }
   | - `s` dropped here while still borrowed
   |
note: requirement that the value outlives `'static` introduced here
  --> lib.rs:20:15
   |
20 | fn leak_it<T: 'static>(val: T) -> &'static T {
   |               ^^^^^^^

Instead, this happened: compilation succeeded with the new borrow checker:

% rustc -Zpolonius=next --crate-type=rlib lib.rs
warning: unused variable: `leaked`
  --> lib.rs:28:9
   |
28 |     let leaked = leak_it(val); // REQUIRES &'a Lifetimed<'a>: 'static
   |         ^^^^^^ help: if this is intentional, prefix it with an underscore: `_leaked`
   |
   = note: `#[warn(unused_variables)]` (part of `#[warn(unused)]`) on by default

warning: struct `Lifetimed` is never constructed
 --> lib.rs:1:8
  |
1 | struct Lifetimed<'a> {
  |        ^^^^^^^^^
  |
  = note: `#[warn(dead_code)]` (part of `#[warn(unused)]`) on by default

warning: static `LIFETIMED` is never used
 --> lib.rs:4:8
  |
4 | static LIFETIMED: Lifetimed<'static> = Lifetimed { some_tuple: &() };
  |        ^^^^^^^^^

warning: struct `ClosureMaker` is never constructed
 --> lib.rs:6:8
  |
6 | struct ClosureMaker<'a> {
  |        ^^^^^^^^^^^^

warning: method `make_closure_simple` is never used
  --> lib.rs:13:8
   |
10 | impl<'a> ClosureMaker<'a> {
   | ------------------------- method in this implementation
...
13 |     fn make_closure_simple(&self) -> impl Fn() -> &'a Lifetimed<'a> + 'static {
   |        ^^^^^^^^^^^^^^^^^^^

warning: function `leak_it` is never used
  --> lib.rs:20:4
   |
20 | fn leak_it<T: 'static>(val: T) -> &'static T {
   |    ^^^^^^^

warning: function `return_value_with_dangling_lifetime` is never used
  --> lib.rs:24:4
   |
24 | fn return_value_with_dangling_lifetime() {
   |    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

warning: 7 warnings emitted

Meta

rustc --version --verbose:

% rustc --version --verbose
rustc 1.99.0-nightly (3d6c19bb9 2026-08-11)
binary: rustc
commit-hash: 3d6c19bb9ab4798ecfb2ee943df01a811720fc27
commit-date: 2026-08-11
host: x86_64-unknown-linux-gnu
release: 1.99.0-nightly
LLVM version: 23.1.0

Backtrace

<backtrace>

[theemathas]

This seems related to #151861.

Here's a code snippet showing that this is of questionable soundness. It compiles in polonius, but not in the old borrow checker.

type Payload = Box<i32>;

trait Produce<'a> {
    fn produce(self) -> &'a Payload;
}

fn make_producer<'a>(payload: &'a Payload) -> impl Produce<'a> + 'static {
    struct Producer {
        ptr: *const Payload,
    }
    impl<'a> Produce<'a> for Producer {
        fn produce(self) -> &'a Payload {
            unsafe { &*self.ptr }
        }
    }

    // SAFETY: Surely a user of this can only produce a &'a Payload from this?
    Producer { ptr: payload }
}

fn main() {
    let x: Box<Payload> = Box::new(Box::new(1));
    // Removing this type annotation makes it also compile in the old borrow checker
    let wrong: &'static Payload = make_producer(&x).produce();
    drop(x);
    println!("{wrong}"); // segfaults
}

cc @jackh726

[jackh726]

The above variation without the &'static Payload annotation failed to compile in 1.74.0 and started compiling in 1.75.0. That is when #116733 landed, so I wouldn't be surprised if that caused this example to "regress" too. I'll defer to #151861 on how to actually fix that.

As for the example as written: it seems like the only thing that really compiles with Polonius Alpha but not with NLL is the &'static Payload lifetime. But regardless, that's orthogonal to the existing soundness question here. I can imagine that the reason why Polonius Alpha things that the let wrong: &'static Payload = make_producer(&x).produce() line is "okay" is because 'a isn't live here because of the 'static bound.

It's easy to point to the unsafe in the above example and call it out - but the fact that the OP example has no unsafe is concerning. (edit: though, I am seeing that LIFETIMED has a lifetime of 'static, so &LIFETIMED is promoted and I think this is all fine™)

[theemathas]

@jackh726 The original reproducer seems be related to the fact that a 'static closure can have a non-'static return type, which is already known to be a problematic thing.

Reproducing the issue without closures required me to change the "return type" from an associated type to being a generic instead.

[panstromek]

'static closure can have a non-'static return type, which is already known to be a problematic thing.

It's not clear to me from the discussion here or on #151861, whether this is considered problematic already in the type definition or whether the problem is in how it is handled (e.g. in borrowck in this case).

For me it seems that the right answer it's the latter, and the unsafe block here is just a red herring that should be considered correct.

impl Produce<'a> + 'static seems like an interesting pattern, that could potentially be useful. It allows you to create type for which some of its functions can be disabled when 'a is invalidated, but you can still hold on to it and use it for something that doesn't depend on 'a (altough I don't think you can do much with it in the language currently, I don't think you can even pass it to a function).

[theemathas]

I found an unsoundness related to this, and filed it as #161038

[Jules-Bertholet]

'static closure can have a non-'static return type, which is already known to be a problematic thing.

It's not clear to me from the discussion here or on #151861, whether this is considered problematic already in the type definition or whether the problem is in how it is handled (e.g. in borrowck in this case).

It's the former. make_closure_simple's return type is 'static with a non-'static associated type, and that is unsound.