implied bound computation can use overly restrictive where-clauses to have stronger assumptions

original found by @carlini, it's bug 8 from zulip https://rust-lang.zulipchat.com/#narrow/channel/364551-t-types.2Ftrait-system-refactor/topic/Reporting.20a.20collection.20of.20soundness.20bugs.20in.20next-solver/near/617737400

trait Tr<'r> {
    type Out;
}
impl<'r, T> Tr<'r> for T {
    type Out = &'r ();
}

struct Foo<'b, X: Tr<'b> + 'b>(X, &'b ())
where
    X::Out: 'b;


fn bad<'a, 'b, X>(_wf: <Foo<'b, X> as Tr<'b>>::Out, s: &'a str) -> &'b str
where
    'b: 'a,
    X: Tr<'a, Out = &'a ()>,
{
    s
}

fn main() {
    let s = String::from("use after free?");
    let r: &'static str = bad::<()>(&(), &s);
    drop(s);
    println!("{r}");
}

The underlying issue is as follows:

• we assume Foo<'b, X> is wf, this implies X::Out: 'b
• proving X: Tr<'b> in the caller normalizes this to &'b (): 'b which trivially holds
• when checking the function, we instead use the X: Tr<'a, Out = &'a ()> where bound, equating 'a and 'b
• this should result in an error, however, the combination of the 'b: 'a bound and the implied &'a (): 'b bound mean that this is actually accepted.

Start by compiling the Rust reproducer in the issue and confirm that it is accepted despite the stated use-after-free concern. Then trace implied bound computation and the handling of the where clauses; done means the example is rejected without regressing related trait-system behavior.