Could someone explain the unsafety concern behind requiring Self: 'a for some GATs?

42 points javajunkie314

I was revisiting the Rust Blog article The push for GATs stabilization because I'm considering using a GAT in a project I'm working on. In the section on LendingIterator, there's the following mention:

As an aside, there's one thing to note about this trait and impl that you might be curious about: the where Self: 'a clause on Item. Briefly, this allows us to use &'a mut [T]; without this where clause, someone could try to return Self::Item<'static> and extend the lifetime of the slice.

And there's a link to a GitHub issue, GATs: Decide whether to have defaults for where Self: 'a. I read through that issue, as well as Generic Associated Types Initiative: Required Bounds, linked toward the end of the thread.

I believe I understand why having the Self: 'a bound is desirable. Without it, we're very limited in what types can actually be assigned to, e.g., Item<'a> in impls of LendingIterator — possibly to the point that no type with a lifetime bound could be assigned, which defeats the purpose of having the GAT.

My confusion is this: several times it's been mentioned that the bound is required to prevent unsafety, not just for ergonomics. E.g., in the blog article I quoted above there's the mention of Self::Item<'static>, and it's also alluded to in the GitHub issue. But I don't understand what the actual concern is, because I don't understand how being able to name the type implies that unsafety can actually occur.

Could someone provide an example of how, if Rust did not enforce the Self: 'a bound for those sorts of GATs, we could actually construct a program that, e.g., allows a reference to outlive its target, or some other form of unsafety.

Thank you very much!