Panic when parsing nom operations

[mibes]

After adding nom to a project, rust-analyzer started to panic.

It looks like a line like this one is the culprit:

let (remainder, magic) = take(4u8)(input)?;

As soon as such lines are commented out, the panic disappears.
To double-check, I've opened an older project that uses nom too and saw the same behaviour.

version: 0.3.1277-standalone (d03c1c87d 2022-11-05)
rustc 1.65.0 (897e37553 2022-11-02)
nom = "7.1"

Panic context:
> 
version: 0.3.1277-standalone (d03c1c87d 2022-11-05)
request: textDocument/inlayHint InlayHintParams {
    work_done_progress_params: WorkDoneProgressParams {
        work_done_token: None,
    },
    text_document: TextDocumentIdentifier {
        uri: Url {
            scheme: "file",
            cannot_be_a_base: false,
            username: "",
            password: None,
            host: None,
            port: None,
            path: "/xxxxxx/src/parser.rs",
            query: None,
            fragment: None,
        },
    },
    range: Range {
        start: Position {
            line: 104,
            character: 0,
        },
        end: Position {
            line: 245,
            character: 32,
        },
    },
}

thread 'Worker' panicked at 'unexpected free variable with depth `^0.0` with outer binder ^0', /Users/runner/.cargo/registry/src/github.com-1ecc6299db9ec823/chalk-ir-0.86.0/src/fold.rs:437:13
stack backtrace:
   0: _rust_begin_unwind
   1: core::panicking::panic_fmt
   2: chalk_solve::infer::canonicalize::_::<impl chalk_ir::fold::FallibleTypeFolder<I> for chalk_solve::infer::canonicalize::Canonicalizer<I>>::try_fold_free_var_ty
   3: chalk_ir::fold::TypeSuperFoldable::super_fold_with
   4: chalk_ir::fold::boring_impls::<impl chalk_ir::fold::TypeFoldable<I> for chalk_ir::GenericArg<I>>::try_fold_with
   5: <smallvec::SmallVec<A> as core::iter::traits::collect::Extend<<A as smallvec::Array>::Item>>::extend
   6: chalk_ir::fold::boring_impls::<impl chalk_ir::fold::TypeFoldable<I> for chalk_ir::Substitution<I>>::try_fold_with
   7: chalk_ir::fold::TypeSuperFoldable::super_fold_with
   8: chalk_ir::fold::boring_impls::<impl chalk_ir::fold::TypeFoldable<I> for chalk_ir::GenericArg<I>>::try_fold_with
   9: <smallvec::SmallVec<A> as core::iter::traits::collect::Extend<<A as smallvec::Array>::Item>>::extend
  10: chalk_ir::fold::boring_impls::<impl chalk_ir::fold::TypeFoldable<I> for chalk_ir::Substitution<I>>::try_fold_with
  11: chalk_ir::_::<impl chalk_ir::fold::TypeFoldable<I> for chalk_ir::WhereClause<I>>::try_fold_with
  12: chalk_ir::_::<impl chalk_ir::fold::TypeFoldable<I> for chalk_ir::DomainGoal<I>>::try_fold_with
  13: chalk_ir::fold::TypeSuperFoldable::super_fold_with
  14: chalk_solve::infer::canonicalize::<impl chalk_solve::infer::InferenceTable<I>>::canonicalize
  15: hir_ty::infer::unify::InferenceTable::canonicalize
  16: hir_ty::infer::unify::InferenceTable::register_obligation_in_env
  17: hir_ty::infer::unify::InferenceTable::normalize_projection_ty
  18: <DB as hir_ty::db::HirDatabase>::normalize_projection
  19: hir_ty::callable_sig_from_fnonce
  20: hir::Type::as_callable
  21: ide::inlay_hints::param_name_hints
  22: ide::inlay_hints::hints
  23: <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::fold
  24: ide::inlay_hints::inlay_hints
  25: std::panicking::try
  26: rust_analyzer::handlers::handle_inlay_hints
  27: std::panicking::try
  28: <F as threadpool::FnBox>::call_box
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
[Error - 8:13:19 AM] Request textDocument/inlayHint failed.
  Message: request handler panicked: unexpected free variable with depth `^0.0` with outer binder ^0
  Code: -32603 

[mibes]

This is a minimal example that triggers the panic:

use nom::{bytes::complete::take, IResult};

fn main() {
    let input = "Hello, world!".as_bytes();
    let (_remainder, first_byte) = get_first(input).unwrap();
    println!("First byte: {:?}", first_byte);
}

fn get_first(input: &[u8]) -> IResult<&[u8], u8> {
    let (remainder, first_byte) = take(1u8)(input)?;
    Ok((remainder, first_byte[0]))
}

If line 10 is commented out, the panic disappears.

[jonas-schievink]

Caused by #13525

Reproduction without nom:

fn f() {
    take(2)();
}

fn take<C, Error>(
    count: C
) -> impl Fn() -> C  {
    move || count
}