Rules governing references to private types in public APIs not enforced in impls

[nikomatsakis]

This code compiles, it should not:

mod x {
pub struct Foo { x: u32 }

struct Bar { x: u32 }

impl Foo {
    pub fn foo(&self, x: Self, y: Bar) { }
}
}

fn main() { }

cc @nrc

[nikomatsakis]

nominating, as this seems like a backcompat hazard.

[bluss]

See also #18082

[nikomatsakis]

triage: P-high

[pnkfelix]

(a slightly more complicated example that shows the privacy hole being exploited:

mod x {
    pub struct Foo { pub x: u32 }

    struct Bar { _x: u32 }

    impl Foo {
        pub fn foo(&self, _x: Self, _y: Bar) { }
        pub fn bar(&self) -> Bar { Bar { _x: self.x } }
    }
}

pub fn main() {
    let f = x::Foo { x: 4 };
    let b = f.bar();
    f.foo(x::Foo { x: 5 }, b);

}

)

[nikomatsakis]

@petrochenkov do you think your rewritten privacy pass will fix this?

[petrochenkov]

Yes, it should.
(But this part isn't written yet)