Repository: rust
Issue: SIGSEGV: invalid memory reference on beta channel
Labels: I-crash,P-low,T-compiler,regression-from-stable-to-stable,C-bug

<!--
Thank you for filing a bug report! 🐛 Please provide a short summary of the bug,
along with any information you feel relevant to replicating the bug.
-->

I tried this code: [playground](   https://play.rust-lang.org/?version=beta&mode=debug&edition=2021&code=%23%21%5Brecursion_limit+%3D+%221024%22%5D%0A%23%21%5Ballow%28unused%29%5D%0Ause+std%3A%3Amarker%3A%3APhantomData%3B%0A%0Astruct+Apple%3B%0A%0Astruct+Nil%3B%0Astruct+Cons%3CCar%2C+Cdr%3E%28PhantomData%3C%28Car%2C+Cdr%29%3E%29%3B%0A%0A%0A%2F%2F+%3D%3D%3D%3D%3D%3D%3D%3D%3D+Concat+%3D%3D%3D%3D%3D%3D%3D%3D%3D%0A%0Atrait+Concat+%7B%0A++++type+Output%3B%0A%7D%0A%0Aimpl%3CL2%3E+Concat+for+%28Nil%2C+L2%29+%7B%0A++++type+Output+%3D+L2%3B%0A%7D%0A%0Aimpl%3CCar%2C+Cdr%2C+L2%3E+Concat+for+%28Cons%3CCar%2C+Cdr%3E%2C+L2%29+%0Awhere+%0A++++%28Cdr%2C+L2%29%3A+Concat%2C+%2F%2F+Recursive+step%0A%7B%0A++++type+Output+%3D+Cons%3CCar%2C+%3C%28Cdr%2C+L2%29+as+Concat%3E%3A%3AOutput%3E%3B%0A%7D%0A%0A%2F%2F+%3D%3D%3D%3D%3D%3D%3D%3D%3D+Flat+%3D%3D%3D%3D%3D%3D%3D%3D%3D%0A%0Atrait+Flat+%7B%0A++++type+Output%3B%0A%7D%0A%0Aimpl+Flat+for+Nil+%7B%0A++++type+Output+%3D+Nil%3B%0A%7D%0A%0A%2F%2F+Head+is+not+Cons%0Aimpl%3CHead%2C+Tail%3E+Flat+for+Cons%3CHead%2C+Tail%3E%0Awhere+%0A++++Tail%3A+Flat%2C%0A%7B%0A++++type+Output+%3D+Cons%3CHead%2C+%3CTail+as+Flat%3E%3A%3AOutput%3E%3B%0A%7D%0A%0A%2F%2F+Head+is+Cons%0Aimpl%3CHeadCar%2C+HeadCdr%2C+Tail%3E+Flat+for+Cons%3CCons%3CHeadCar%2C+HeadCdr%3E%2C+Tail%3E%0Awhere+%0A++++Cons%3CHeadCar%2C+HeadCdr%3E%3A+Flat%2C%0A++++Tail%3A+Flat%2C%0A++++%28%3CCons%3CHeadCar%2C+HeadCdr%3E+as+Flat%3E%3A%3AOutput%2C+%3CTail+as+Flat%3E%3A%3AOutput%29%3A+Concat%2C%0A%7B%0A++++type+Output+%3D+%3C%28%3CCons%3CHeadCar%2C+HeadCdr%3E+as+Flat%3E%3A%3AOutput%2C+%3CTail+as+Flat%3E%3A%3AOutput%29+as+Concat%3E%3A%3AOutput%3B%0A%7D%0A%0Atype+Computation+%3D+%3CCons%3CApple%2C+Nil%3E+as+Flat%3E%3A%3AOutput%3B%0A%0Afn+main%28%29+%7B%0A++++println%21%28%0A++++++++%22%7B%7D%22%2C%0A++++++++std%3A%3Aany%3A%3Atype_name%3A%3A%3CComputation%3E%28%29%0A++++%29%3B%0A%7D%0A  ). 

```rust
#![recursion_limit = "1024"]
#![allow(unused)]
use std::marker::PhantomData;

struct Apple;

struct Nil;
struct Cons<Car, Cdr>(PhantomData<(Car, Cdr)>);


// ========= Concat =========

trait Concat {
    type Output;
}

impl<L2> Concat for (Nil, L2) {
    type Output = L2;
}

impl<Car, Cdr, L2> Concat for (Cons<Car, Cdr>, L2) 
where 
    (Cdr, L2): Concat, // Recursive step
{
    type Output = Cons<Car, <(Cdr, L2) as Concat>::Output>;
}

// ========= Flat =========

trait Flat {
    type Output;
}

impl Flat for Nil {
    type Output = Nil;
}

// Head is not Cons
impl<Head, Tail> Flat for Cons<Head, Tail>
where 
    Tail: Flat,
{
    type Output = Cons<Head, <Tail as Flat>::Output>;
}

// Head is Cons
impl<HeadCar, HeadCdr, Tail> Flat for Cons<Cons<HeadCar, HeadCdr>, Tail>
where 
    Cons<HeadCar, HeadCdr>: Flat,
    Tail: Flat,
    (<Cons<HeadCar, HeadCdr> as Flat>::Output, <Tail as Flat>::Output): Concat,
{
    type Output = <(<Cons<HeadCar, HeadCdr> as Flat>::Output, <Tail as Flat>::Output) as Concat>::Output;
}

type Computation = <Cons<Apple, Nil> as Flat>::Output;

fn main() {
    println!(
        "{}",
        std::any::type_name::<Computation>()
    );
}

```

I expected to see this happen: Compiler gives compilation error or compiles

Instead, this happened: segfault

On my machine, it segfaults on stable either, but not in playground. On playground it segfaults on beta and nightly.

`rustc` on my **local** machine, stable. Not segfaults on playground stable
```
❯ rustc --version --verbose
rustc 1.70.0 (90c541806 2023-05-31)
binary: rustc
commit-hash: 90c541806f23a127002de5b4038be731ba1458ca
commit-date: 2023-05-31
host: x86_64-unknown-linux-gnu
release: 1.70.0
LLVM version: 16.0.2
```

### Meta
<!--
If you're using the stable version of the compiler, you should also check if the
bug also exists in the beta or nightly versions.
-->


<!--
Include a backtrace in the code block by setting `RUST_BACKTRACE=1` in your
environment. E.g. `RUST_BACKTRACE=1 cargo build`.
-->
Backtrace: Too long for github. I would not cut it, because I don't know what I'm doing.
</details>