implied bound computation can use overly restrictive where-clauses to have stronger assumptions

[lcnr]

original found by @carlini, it's bug 8 from zulip https://rust-lang.zulipchat.com/#narrow/channel/364551-t-types.2Ftrait-system-refactor/topic/Reporting.20a.20collection.20of.20soundness.20bugs.20in.20next-solver/near/617737400

trait Tr<'r> {
    type Out;
}
impl<'r, T> Tr<'r> for T {
    type Out = &'r ();
}

struct Foo<'b, X: Tr<'b> + 'b>(X, &'b ())
where
    X::Out: 'b;


fn bad<'a, 'b, X>(_wf: <Foo<'b, X> as Tr<'b>>::Out, s: &'a str) -> &'b str
where
    'b: 'a,
    X: Tr<'a, Out = &'a ()>,
{
    s
}

fn main() {
    let s = String::from("use after free?");
    let r: &'static str = bad::<()>(&(), &s);
    drop(s);
    println!("{r}");
}

The underlying issue is as follows:

• we assume Foo<'b, X> is wf, this implies X::Out: 'b
• proving X: Tr<'b> in the caller normalizes this to &'b (): 'b which trivially holds
• when checking the function, we instead use the X: Tr<'a, Out = &'a ()> where bound, equating 'a and 'b
• this should result in an error, however, the combination of the 'b: 'a bound and the implied &'a (): 'b bound mean that this is actually accepted.

[lcnr]

trait Tr<'r> {
    type Out;
}
impl<'r, T> Tr<'r> for T {
    type Out = &'r ();
}

struct Foo<'b, X: Tr<'b> + 'b>(Option<(X, &'b ())>)
where
    X::Out: 'b;


fn bad<'a, 'b, X>(_wf: Foo<'b, X>, s: &'a str) -> &'b str
where
    'b: 'a,
    X: Tr<'a, Out = &'a ()>,
{
    s
}

fn main() {
    let s = String::from("use after free?");
    let r: &'static str = bad::<()>(Foo(None), &s);
    drop(s);
    println!("{r}");
}

This would be unsound, however, we canonicalize 'a and 'b to existential regions as input to the implied_outlives_bounds query, so this hits #106569 and drops the 'a: 'b implied bound. This is also why this unsoundness only affects the new solver as we've already merged #160491 there. I think the underlying unsoundness already affects the old solver