Segfault due to `impossible_predicates` treating ambiguous obligation as impossible

[compiler-errors]

I tried this code:

trait Mirror {
    type Assoc: ?Sized;
}
impl<T: ?Sized> Mirror for T {
    type Assoc = T;
}

trait Q: 'static {
    fn q(&self);
}

impl Q for i32 {
    fn q(&self) { println!("i32"); }
}

impl Q for <dyn Q as Mirror>::Assoc where Self: 'static {
    fn q(&self) { println!("dyn Q"); }
}

fn foo<T: Q + ?Sized>(t: &T) {
    t.q();
}

fn main() {
    foo(&1 as &dyn Q);
}

I expected it to work. But instead:

Exited with signal 11 (SIGSEGV): segmentation violation

This is a manifestation of two bugs:

• Overlap between built-in and user-written impls for dyn Trait: Trait
• Ambiguity was being treated as a hard error in the impossible_predicates method

Since the new trait solver treats some dyn Trait: Trait overlap as ambiguity (specifically when the responses from the two candidates differ), and we strike methods from the vtable if impossible_predicates returns true, a false positive will lead to a segfault.

Meta

rustc --version --verbose:

rustc 1.89.0-nightly (16d2276fa 2025-05-16)
binary: rustc
commit-hash: 16d2276fa6fccb0cc239a542d4c3f0eb46f660ec
commit-date: 2025-05-16
host: x86_64-unknown-linux-gnu
release: 1.89.0-nightly
LLVM version: 20.1.4

[compiler-errors]

Partly due to #136988, partly due to very very old code:

https://github.com/rust-lang/rust/blame/c6ed442f401d90211ae36a9808ccaf0a3dc025f6/src/librustc_trait_selection/traits/mod.rs#L126

We've basically always treated ambiguity as error for this case 💀

[matthiaskrgr]

miri:

error: Undefined Behavior: `dyn` call trying to call something that is not a method
  --> src/main.rs:21:5
   |
21 |     t.q();
   |     ^^^^^ `dyn` call trying to call something that is not a method
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
   = note: BACKTRACE:
   = note: inside `foo::<dyn Q>` at src/main.rs:21:5: 21:10
note: inside `main`
  --> src/main.rs:25:5
   |
25 |     foo(&1 as &dyn Q);
   |     ^^^^^^^^^^^^^^^^^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error