Associated type bound from supertrait isn't checked for trait object

The following code compiles and causes a use-after-free.

trait Super {
    type Assoc;
}

trait Sub: Super<Assoc: Copy> {}

fn unchecked_copy<T: Sub<Assoc = String> + ?Sized>(x: &String) -> String {
    *x
}

fn main() {
    let x: String = String::from("abc");
    let y: String = unchecked_copy::<dyn Sub<Assoc = String>>(&x);
    drop(x);
    println!("{y}");
}

It seems that the compiler is somehow concluding that T::Assoc = String and T::Assoc: Copy are true at the same time.

cc @lcnr

Meta

Reproducible on the playground with version 1.95.0-nightly (2026-02-12 47611e16044c68ef27ba)

Start by running the supplied reproducer on the stated nightly version and inspect the compiler’s handling of associated type bounds inherited through trait objects. Trace the relevant trait-object and bound-checking entry points, then add coverage for this example. Done means the unsound program is rejected or otherwise handled soundly without allowing the use-after-free.