GHC-9.4 panics due to failing lookupIdSubst for KnownNat

Summary

GHC panics when compiling the module that is shown below.

The issue happens with GHC-9.4 (tested with GHC 9.4.6 and 9.4.7) and optimization enabled (-O1 and -O2) on all tested operating systems and platforms.

GHC-8.10.7, GHC-9.2 and GHC-9.6 are not affected.

Steps to reproduce

{-# LANGUAGE DataKinds #-}

module Bug where

import Numeric.Natural (Natural)
import GHC.TypeNats (KnownNat, natVal)
import Data.Proxy (Proxy(..))

newtype M (n :: Natural) = M Natural

-- Using a smaller value for `PC` makes the issue go away.
type PC :: Natural
type PC = 0x1_0000_0000_0000_0000

-- remove (or simplifying) one case makes the issue go away.
f :: forall n . KnownNat n => M n -> M n
f (M 0) = M 0
f (M x) = M (natVal @n Proxy + x)

-- removing one invocation of `f` makes the issue go away.
g :: KnownNat n => M n -> M n
g x = f (f x)

-- removing the let binding or one invocation of `g` makes the issue go away.
h :: M PC -> M PC
h x = let a = g (g x) in a

Compiling this module with GHC-9.4.7 and -O1 or -O2 as follows

ghc -O1 Bug.hs

Results in the output

[1 of 1] Compiling Bug              ( Bug.hs, Bug.o ) [Source file changed]

<no location info>: error:
    panic! (the 'impossible' happened)
  GHC version 9.4.7:
        lookupIdSubst
  $dKnownNat_sUW
  InScope {wild_X2 z_anJ $krep_aQG $krep_aQH $krep_aQI $krep_aQJ
           $krep_aQK h $tc'M $trModule $tcM f g $trModule_sUK $trModule_sUL
           $trModule_sUM $trModule_sUN $krep_sUO $tcM_sUP $tcM_sUQ $krep_sUR
           $tc'M_sUS $tc'M_sUT $sg_sV3}
  Call stack:
      CallStack (from HasCallStack):
        callStackDoc, called at compiler/GHC/Utils/Panic.hs:182:37 in ghc:GHC.Utils.Panic
        pprPanic, called at compiler/GHC/Core/Subst.hs:260:17 in ghc:GHC.Core.Subst

Please report this as a GHC bug:  https://www.haskell.org/ghc/reportabug

Expected behavior

GHC compiles the module.

Environment

The issue was reproduced with

• GHC-9.4.6 and GHC-9.6.7
• ubuntu/linux (amd64) and macOS (amd64 as well as aarch64).