Unsoundness in Polonius involving impl Trait

The following code was created based on #160979 with trial and error. It compiles in nightly and segfaults. It doesn't compile with -Zpolonius=off.

type Payload = Box<i32>;

trait Produce<'a> {
    fn produce(self) -> &'a &'a Payload;
}
impl<'a> Produce<'a> for &'a &'a Payload {
    fn produce(self) -> &'a &'a Payload {
        self
    }
}

trait Outlives<'a, 'b> {
    fn shorten(x: impl Produce<'a> + 'a) -> impl Produce<'a> + 'b;
}
impl<'a: 'b, 'b> Outlives<'a, 'b> for () {
    fn shorten(x: impl Produce<'a> + 'a) -> impl Produce<'a> + 'b {
        x
    }
}

fn make_producer<'a, 'b>(payload: &'a &'b Payload) -> impl Produce<'a> + 'b + use<'a, 'b>
where
    (): Outlives<'a, 'b>,
{
    <()>::shorten(payload)
}

fn main() {
    let wrong: &&Payload;
    let a = Box::new(1);
    {
        let mut r: &Payload = &a;
        let x: &&Payload = &r;
        wrong = make_producer(x).produce();
        r = &*Box::new(Box::new(2));
    }
    println!("{wrong}");
}

Meta

Reproducible on the playground with version 1.99.0-nightly (2026-08-12 c98d0cb27cc63afdd626)

Start with the provided Rust reproducer, compiling it on nightly and with -Zpolonius=off to confirm the differing behavior. Investigate the Polonius and impl Trait handling implicated by the example; done means the compiler no longer accepts this unsound case or segfaults.