Repository navigation
Polonius soundness bug with higher ranked function pointers #161471
Description
I'm filing this issue on behalf of @carlini, who discovered the initial unsoundness reproducer with an LLM. I then minimized the code to the code below.
The code below creates a &mut that aliases with a &, and somehow uses both of them, causing unsoundness. The aliasing references are r and p.
#![forbid(unsafe_code)]
type Payload = Option<Box<i32>>;
type P<'a, 'b> = for<'x> fn(&'a mut &'b Payload, &'x ()) -> &'x Payload;
fn f<'a, 'b, 'c>(x: &'a mut &'b Payload, _: &'c ()) -> &'b Payload {
*x
}
fn main() {
let p: &'static mut Payload = Box::leak(Box::new(Some(Box::new(1))));
let mid: &mut &Payload = Box::leak(Box::new(&*p));
let r: &Payload = (f as P<'_, '_>)(mid, &());
let b: &Box<i32> = r.as_ref().unwrap();
if false {
let _: &mut &'static Payload = mid;
} else {
*p = None;
println!("{b}"); // Segfault
};
}The unsoundness reproduces with -Zpolonius=next, but doesn't reproduce (fails to compile) with -Zpolonius=no.
Meta
Reproducible on the playground with version 1.100.0-nightly (2026-08-20 8925ea358a0f265ca610)
Reacted by kamulos
Activity
lcnr commentedon Aug 25, 2026
let r: &Payload = (f as P<'_, '_>)(mid, &());seems like it's very much related to #25860. Unsure what causes polonius to behave worse hereamandasystems commentedon Sep 16, 2026
I've looked into this some (and will look into it more) and I think the reason for the difference here is a placeholder outlives constraint which increases the lifetime in NLL, but for some reason doesn't in Polonius.