ICE with dyn of subtrait of Pointee

[theemathas]

Code

#![feature(ptr_metadata)]

use std::ptr::Pointee;

pub trait SubPointee: Pointee<Metadata = Self::SubMetadata> {
    type SubMetadata;
}

impl<T: ?Sized> SubPointee for T {
    type SubMetadata = <T as Pointee>::Metadata;
}

pub fn foo<T: SubPointee + ?Sized>() -> <T as SubPointee>::SubMetadata {
    panic!()
}

pub fn bar() {
    foo::<dyn SubPointee<SubMetadata = (), Metadata = ()>>();
}

Meta

Reproducible on the playground with version 1.93.0-nightly (2025-10-27 adaa838976ff99a4f066)

Error output

note: no errors encountered even though delayed bugs were created

note: those delayed bugs will now be shown as internal compiler errors

error: internal compiler error: error performing operation: fully_perform
  --> src/lib.rs:18:5
   |
18 |     foo::<dyn SubPointee<SubMetadata = (), Metadata = ()>>();
   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   |
note: delayed at /rustc-dev/adaa838976ff99a4f0661136322f64cb466b58a0/compiler/rustc_trait_selection/src/traits/query/type_op/custom.rs:95:25

Backtrace

         0: <rustc_errors::DiagCtxtInner>::emit_diagnostic
         1: <rustc_errors::DiagCtxtHandle>::emit_diagnostic
         2: <rustc_span::ErrorGuaranteed as rustc_errors::diagnostic::EmissionGuarantee>::emit_producing_guarantee
         3: <rustc_errors::DiagCtxtHandle>::span_delayed_bug::<rustc_span::span_encoding::Span, alloc::string::String>
         4: <rustc_borrowck::type_check::TypeChecker as rustc_middle::mir::visit::Visitor>::visit_body
         5: rustc_borrowck::type_check::type_check
         6: <rustc_borrowck::root_cx::BorrowCheckRootCtxt>::do_mir_borrowck
         7: rustc_borrowck::mir_borrowck
         8: rustc_query_impl::plumbing::__rust_begin_short_backtrace::<rustc_query_impl::query_impl::mir_borrowck::dynamic_query::{closure#2}::{closure#0}, rustc_middle::query::erase::Erased<[u8; 8]>>
         9: rustc_query_system::query::plumbing::try_execute_query::<rustc_query_impl::DynamicConfig<rustc_data_structures::vec_cache::VecCache<rustc_span::def_id::LocalDefId, rustc_middle::query::erase::Erased<[u8; 8]>, rustc_query_system::dep_graph::graph::DepNodeIndex>, false, false, false>, rustc_query_impl::plumbing::QueryCtxt, false>
        10: rustc_query_impl::query_impl::mir_borrowck::get_query_non_incr::__rust_end_short_backtrace
        11: <rustc_middle::ty::context::TyCtxt>::par_hir_body_owners::<rustc_interface::passes::run_required_analyses::{closure#1}::{closure#0}>::{closure#0}
        12: rustc_interface::passes::analysis
        13: rustc_query_impl::plumbing::__rust_begin_short_backtrace::<rustc_query_impl::query_impl::analysis::dynamic_query::{closure#2}::{closure#0}, rustc_middle::query::erase::Erased<[u8; 0]>>
        14: rustc_query_system::query::plumbing::try_execute_query::<rustc_query_impl::DynamicConfig<rustc_query_system::query::caches::SingleCache<rustc_middle::query::erase::Erased<[u8; 0]>>, false, false, false>, rustc_query_impl::plumbing::QueryCtxt, false>
        15: rustc_query_impl::query_impl::analysis::get_query_non_incr::__rust_end_short_backtrace
        16: <rustc_interface::passes::create_and_enter_global_ctxt<core::option::Option<rustc_interface::queries::Linker>, rustc_driver_impl::run_compiler::{closure#0}::{closure#2}>::{closure#2} as core::ops::function::FnOnce<(&rustc_session::session::Session, rustc_middle::ty::context::CurrentGcx, alloc::sync::Arc<rustc_data_structures::jobserver::Proxy>, &std::sync::once_lock::OnceLock<rustc_middle::ty::context::GlobalCtxt>, &rustc_data_structures::sync::worker_local::WorkerLocal<rustc_middle::arena::Arena>, &rustc_data_structures::sync::worker_local::WorkerLocal<rustc_hir::Arena>, rustc_driver_impl::run_compiler::{closure#0}::{closure#2})>>::call_once::{shim:vtable#0}
        17: rustc_interface::interface::run_compiler::<(), rustc_driver_impl::run_compiler::{closure#0}>::{closure#1}
        18: std::sys::backtrace::__rust_begin_short_backtrace::<rustc_interface::util::run_in_thread_with_globals<rustc_interface::util::run_in_thread_pool_with_globals<rustc_interface::interface::run_compiler<(), rustc_driver_impl::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>
        19: <<std::thread::Builder>::spawn_unchecked_<rustc_interface::util::run_in_thread_with_globals<rustc_interface::util::run_in_thread_pool_with_globals<rustc_interface::interface::run_compiler<(), rustc_driver_impl::run_compiler::{closure#0}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>::{closure#1} as core::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
        20: std::sys::thread::unix::Thread::new::thread_start
        21: <unknown>
        22: clone
  --> src/lib.rs:18:5
   |
18 |     foo::<dyn SubPointee<SubMetadata = (), Metadata = ()>>();
   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

note: we would appreciate a bug report: https://github.com/rust-lang/rust/issues/new?labels=C-bug%2C+I-ICE%2C+T-compiler&template=ice.md

note: please make sure that you have updated to the latest nightly

note: please attach the file at `/playground/rustc-ice-2025-10-28T09_55_02-253.txt` to your bug report

note: compiler flags: --crate-type lib -C embed-bitcode=no -C codegen-units=1 -C debuginfo=2

note: some of the compiler flags provided by cargo are hidden

query stack during panic:
end of query stack

[GrigorenkoPV]

Regression in nightly-2023-06-21 (fe7454b...4651421)

• Rollup of 7 pull requests #112805
• Add alloc::rc::UniqueRc #111849
• Rollup of 8 pull requests #112817
• Add implement_via_object to rustc_deny_explicit_impl to control object candidate assembly #112320
• Rollup of 6 pull requests #112839
• Revert #112758 and add test case #112847
• proof tree nits #112835