Borrow checker incorrectly accepts code when calling function with complex lifetime bounds through a fn pointer

[ennis]

The following code compiles and prints a bogus value:

fn shorten_lifetime<'a, 'b, 'min>(a: &'a i32, b: &'b i32) -> &'min i32
where 'a: 'min, 'b: 'min
{
    if *a < *b {
        &a
    } else {
        &b
    }
}


fn main()
{
    let fnptr = &shorten_lifetime;
    
    let a = &5;
    let ptr = {
        let b = 3;
        let b = &b;
        //let c = shorten_lifetime(a, b);
        let c = fnptr(a, b);
        c
    };
    
    println!("ptr = {:?}", ptr);
    
}

Output (release mode):

ptr = -1876488848

(playground: https://play.rust-lang.org/?version=stable&mode=release&edition=2018&gist=048d856b4689599b1e35f0a44ebe629f)

Expected result: a borrow checker error, the same as the one obtained when calling shorten_lifetime directly.

I accidentally ran into this issue when trying to spell the fn pointer type of fnptr (I'm not sure how to add constraints to the lifetimes of a higher-ranked fn type like for<'a, 'b> fn(...) -> T)

[jonas-schievink]

The 2015 edition correctly rejects this (which doesn't yet have NLL)

[nagisa]

cc @pnkfelix

[nagisa]

@rust-lang/wg-compiler-nll

[matthewjasper]

It appears that we lose the function bounds when we promote shorten_lifetime. Relavant FIXME:

rust/src/librustc_mir/borrow_check/nll/type_check/mod.rs

Lines 433 to 443 in 48742c6

	// FIXME -- promoted MIR return types reference
	// various "free regions" (e.g., scopes and things)
	// that they ought not to do. We have to figure out
	// how best to handle that -- probably we want treat
	// promoted MIR much like closures, renumbering all
	// their free regions and propagating constraints
	// upwards. We have the same acyclic guarantees, so
	// that should be possible. But for now, ignore them.
	//
	// let promoted_mir = &self.mir.promoted[index];
	// promoted_mir.return_ty()

[pnkfelix]

triage: P-high. Hopefully fix in PR #57202 lands very soon.