rust-lang / rust-lang/rust

`min_specialization` is unsound due to trivially-false lifetime bound

Open
#149,257 3 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-impossible-bounds A-specialization A-trait-system C-bug F-min_specialization I-unsound T-types
Dominant language
Rust
Stars
119k
Forks
16.1k
PR merge metrics
PR metrics pending

Description

The min_specialization feature is supposed to be sound, except for the existence of rustc_unsafe_specialization_marker. However, the following code compiles without errors and SIGILLs when ran.

I am unsure whether this unsoundness is observable in stable code (via std specializations). (Edit: Probably not.)

#![feature(min_specialization)]

trait IsStatic {}
impl<'a: 'static> IsStatic for &'a () {}

struct Thing<T>(T);
trait Trait {
    fn method(&self);
}

impl<T> Trait for Thing<T> {
    default fn method(&self) {
        println!("default");
    }
}

impl Trait for Thing<i32>
where
    for<'a> &'a (): IsStatic,
{
    fn method(&self) {
        println!("specialized");
    }
}

fn indirect<T>(x: &Thing<T>) {
    x.method();
}

fn main() {
    indirect(&Thing(1i32));
}

Miri output:

error: Undefined Behavior: entering unreachable code
  --> src/main.rs:22:9
   |
22 |         println!("specialized");
   |         ^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
   = note: BACKTRACE:
   = note: inside `<Thing<i32> as Trait>::method` at /playground/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/macros.rs:143:28: 143:61
note: inside `indirect::<i32>`
  --> src/main.rs:27:5
   |
27 |     x.method();
   |     ^^^^^^^^^^
note: inside `main`
  --> src/main.rs:31:5
   |
31 |     indirect(&Thing(1i32));
   |     ^^^^^^^^^^^^^^^^^^^^^^
   = note: this error originates in the macro `$crate::format_args_nl` which comes from the expansion of the macro `println` (in Nightly builds, run with -Z macro-backtrace for more info)

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error
Meta

Reproducible on the playground with version 1.93.0-nightly (2025-11-23 c23ed3ef28b3cc306583)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the provided min_specialization example on the reported nightly and running it under Miri. Investigate how the compiler handles the trivially false lifetime bound during specialization; done means the example no longer reaches undefined behavior and the behavior is covered by an appropriate compiler validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
compilers
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.