ICE: self-type `&unsafe<'a> &'a (dyn Bar + 'a)` for ObjectPick never dereferenced to an object

[cushionbadak]

Code

#![feature(unsafe_binders)]
#![allow(incomplete_features)]

use std::ops::Deref;

trait Foo: Deref<Target = unsafe<'a> &'a dyn Bar> {
    fn method(self: &unsafe<'a> &'a dyn Bar) {}
}

trait Bar {}

fn test(x: &dyn Foo) {
    x.method();
}

fn main() {}

A mutant from tests/ui/self/invalid-self-dyn-receiver.rs

Meta

rustc --version --verbose:

rustc 1.89.0-nightly (2eef47813 2025-05-22)
binary: rustc
commit-hash: 2eef47813f25df637026ce3288880e5c587abd92
commit-date: 2025-05-22
host: x86_64-apple-darwin
release: 1.89.0-nightly
LLVM version: 20.1.5

Error output

command: rustc

error[E0038]: the trait `Foo` is not dyn compatible
  --> conf_r.rs:12:13
   |
7  |     fn method(self: &unsafe<'a> &'a dyn Bar) {}
   |                     ----------------------- help: consider changing method `method`'s `self` parameter to be `&self`: `&Self`
...
12 | fn test(x: &dyn Foo) {
   |             ^^^^^^^ `Foo` is not dyn compatible
   |
note: for a trait to be dyn compatible it needs to allow building a vtable
      for more information, visit <https://doc.rust-lang.org/reference/items/traits.html#dyn-compatibility>
  --> conf_r.rs:7:21
   |
6  | trait Foo: Deref<Target = unsafe<'a> &'a dyn Bar> {
   |       --- this trait is not dyn compatible...
7  |     fn method(self: &unsafe<'a> &'a dyn Bar) {}
   |                     ^^^^^^^^^^^^^^^^^^^^^^^ ...because method `method`'s `self` parameter cannot be dispatched on

error[E0307]: invalid `self` parameter type: `&unsafe<'a> &'a (dyn Bar + 'a)`
 --> conf_r.rs:7:21
  |
7 |     fn method(self: &unsafe<'a> &'a dyn Bar) {}
  |                     ^^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: type of `self` must be `Self` or a type that dereferences to it
  = help: consider changing to `self`, `&self`, `&mut self`, `self: Box<Self>`, `self: Rc<Self>`, `self: Arc<Self>`, or `self: Pin<P>` (where P is one of the previous types except `Self`)

error: internal compiler error: compiler/rustc_hir_typeck/src/method/confirm.rs:378:17: self-type `&unsafe<'a> &'a (dyn Bar + 'a)` for ObjectPick never dereferenced to an object
  --> conf_r.rs:13:7
   |
13 |     x.method();
   |       ^^^^^^


thread 'rustc' panicked at compiler/rustc_hir_typeck/src/method/confirm.rs:378:17:
Box<dyn Any>

Backtrace

stack backtrace:
   0: std::panicking::begin_panic::<rustc_errors::ExplicitBug>
   1: <rustc_errors::diagnostic::BugAbort as rustc_errors::diagnostic::EmissionGuarantee>::emit_producing_guarantee
   2: <rustc_errors::DiagCtxtHandle>::span_bug::<rustc_span::span_encoding::Span, alloc::string::String>
   3: rustc_middle::util::bug::opt_span_bug_fmt::<rustc_span::span_encoding::Span>::{closure#0}
   4: rustc_middle::ty::context::tls::with_opt::<rustc_middle::util::bug::opt_span_bug_fmt<rustc_span::span_encoding::Span>::{closure#0}, !>::{closure#0}
   5: rustc_middle::ty::context::tls::with_context_opt::<rustc_middle::ty::context::tls::with_opt<rustc_middle::util::bug::opt_span_bug_fmt<rustc_span::span_encoding::Span>::{closure#0}, !>::{closure#0}, !>
   6: rustc_middle::util::bug::span_bug_fmt::<rustc_span::span_encoding::Span>
   7: <rustc_hir_typeck::method::confirm::ConfirmContext>::confirm
   8: <rustc_hir_typeck::fn_ctxt::FnCtxt>::check_expr_kind
   9: <rustc_hir_typeck::fn_ctxt::FnCtxt>::check_expr_with_expectation_and_args
  10: <rustc_hir_typeck::fn_ctxt::FnCtxt>::check_expr_block
  11: <rustc_hir_typeck::fn_ctxt::FnCtxt>::check_expr_with_expectation_and_args
  12: <rustc_hir_typeck::fn_ctxt::FnCtxt>::check_return_or_body_tail
  13: rustc_hir_typeck::check::check_fn
  14: rustc_hir_typeck::typeck_with_inspect::{closure#0}
  15: rustc_hir_typeck::typeck
      [... omitted 1 frame ...]
  16: <rustc_middle::ty::context::TyCtxt>::par_hir_body_owners::<rustc_hir_analysis::check_crate::{closure#1}>::{closure#0}
  17: rustc_hir_analysis::check_crate
  18: rustc_interface::passes::run_required_analyses
  19: rustc_interface::passes::analysis
      [... omitted 1 frame ...]
  20: rustc_interface::passes::create_and_enter_global_ctxt::<core::option::Option<rustc_interface::queries::Linker>, rustc_driver_impl::run_compiler::{closure#0}::{closure#2}>
  21: rustc_interface::interface::run_compiler::<(), rustc_driver_impl::run_compiler::{closure#0}>::{closure#1}
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: please make sure that you have updated to the latest nightly

note: please attach the file at `/Volumes/T7/workspace/scratch_250523/run_250522_250505_feat_unsafe_binder/scratch/rustc-ice-2025-05-23T05_10_42-27098.txt` to your bug report

query stack during panic:
#0 [typeck] type-checking `test`
#1 [analysis] running analysis passes on this crate
end of query stack
error: aborting due to 3 previous errors

Some errors have detailed explanations: E0038, E0307.
For more information about an error, try `rustc --explain E0038`.

Bisects to

searched nightlies: from nightly-2024-05-01 to nightly-2025-05-22
regressed nightly: nightly-2024-12-25
searched commit range: bdc6b3d...409998c
regressed commit: f334342

bisected with cargo-bisect-rustc v0.6.9

Host triple: x86_64-unknown-linux-gnu
Reproduce with:

cargo bisect-rustc --end=2025-05-22 --regress ice --preserve --script rustc -- conf_r.rs

Notes

• ICE location: compiler/rustc_hir_typeck/src/method/confirm.rs Line-378
  

  rust/compiler/rustc_hir_typeck/src/method/confirm.rs

  Lines 365 to 383 in 2eef478

  	autoderef
  	.include_raw_pointers()
  	.find_map(|(ty, _)| match ty.kind() {
  	ty::Dynamic(data, ..) => Some(closure(
  	self,
  	ty,
  	data.principal().unwrap_or_else(|| {
  	span_bug!(self.span, "calling trait method on empty object?")
  	}),
  	)),
  	_ => None,
  	})
  	.unwrap_or_else(|| {
  	span_bug!(
  	self.span,
  	"self-type `{}` for ObjectPick never dereferenced to an object",
  	self_ty
  	)
  	})

@rustbot label +F-unsafe_binders

[compiler-errors]

This doesn't have to do with unsafe binders:

use std::ops::Deref;

struct W<T>(T);

trait Foo<'a>: Deref<Target = W<&'a dyn Bar>> {
    fn method(self: &W<&'a dyn Bar>) {}
}

trait Bar {}

fn test(x: &dyn Foo) {
    x.method();
}

fn main() {}