Trait with HRTB blanket impl is implemented when it shouldn't be

[dtolnay]

trait Deserialize<'de> {}

trait DeserializeOwned: for<'de> Deserialize<'de> {}
impl<T> DeserializeOwned for T where T: for<'de> Deserialize<'de> {}

// Based on this impl, `&'static str` only implements Deserialize<'static>.
// It does not implement for<'de> Deserialize<'de>.
impl<'de: 'a, 'a> Deserialize<'de> for &'a str {}

fn main() {
    // Then why does it implement DeserializeOwned? This compiles.
    fn assert_deserialize_owned<T: DeserializeOwned>() {}
    assert_deserialize_owned::<&'static str>();

    // It correctly does not implement for<'de> Deserialize<'de>.
    //fn assert_hrtb<T: for<'de> Deserialize<'de>>() {}
    //assert_hrtb::<&'static str>();
}

This is a regression between rustc 1.20.0 and 1.21.0.

1.20 correctly rejects this code with the following error.

error[E0279]: the requirement `for<'de> 'de : ` is not satisfied (`expected bound lifetime parameter 'de, found concrete lifetime`)
  --> src/main.rs:13:5
   |
13 |     assert_deserialize_owned::<&'static str>();
   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   |
   = note: required because of the requirements on the impl of `for<'de> Deserialize<'de>` for `&'static str`
   = note: required because of the requirements on the impl of `DeserializeOwned` for `&'static str`
   = note: required by `main::assert_deserialize_owned`

[dtolnay]

Tagging P-high because this very much affects Serde. @rust-lang/compiler

trait Deserialize<'de> {
    fn from_str(s: &'de str) -> Self;
}

trait DeserializeOwned: for<'de> Deserialize<'de> {}
impl<T> DeserializeOwned for T where T: for<'de> Deserialize<'de> {}

impl<'de: 'a, 'a> Deserialize<'de> for &'a str {
    fn from_str(s: &'de str) -> Self {
        s
    }
}

fn main() {
    println!("{}", use_after_free::<&'static str>());
}

fn use_after_free<T: DeserializeOwned>() -> T {
    let s = "oh my".to_owned();
    T::from_str(&s)
}

[dtolnay]

Same issue using Serde traits:

extern crate serde;
extern crate serde_json;

fn use_after_free<T: serde::de::DeserializeOwned>() -> T {
    let json = r#" "oh my" "#.to_owned();
    serde_json::from_str(&json).unwrap()
}

fn main() {
    println!("{}", use_after_free::<&'static str>());
}

(One possible) output:

¢ÚU�

[estebank]

Even better, enabling NLL causes an ICE:

error: internal compiler error: broken MIR in DefId(0/0:7 ~ playground[9687]::main[0]) (NoSolution): could not prove Binder(TraitPredicate(<&str as DeserializeOwned>))

thread 'main' panicked at 'no errors encountered even though `delay_span_bug` issued', librustc_errors/lib.rs:321:17
note: Run with `RUST_BACKTRACE=1` for a backtrace.

error: internal compiler error: unexpected panic

[nikomatsakis]

Perhaps we can bisect this regression? (e.g., with https://github.com/rust-lang-nursery/cargo-bisect-rustc)

[dtolnay]

Bisected to correct behavior in nightly-2017-07-07 -- rustc 1.20.0-nightly (696412d 2017-07-06), incorrect behavior in nightly-2017-07-08 -- rustc 1.20.0-nightly (9b85e1c 2017-07-07).

That range is 696412d...9b85e1c.

Looks like #42840.

[pnkfelix]

visited for triage. Assigning to @nikomatsakis

[nikomatsakis]

@dtolnay thanks, very helpful!