ICE with type-pruned complex smart pointer

[thepowersgang]

Converting my Aref type to handle unsized types has exposed an ICE (assertion failure) in librustc_trans/trans/glue.rs when handling ArefInner's destructor.

error: internal compiler error: unexpected panic
note: the compiler unexpectedly panicked. this is a bug.
note: we would appreciate a bug report: https://github.com/rust-lang/rust/blob/master/CONTRIBUTING.md#bug-reports
note: run with `RUST_BACKTRACE=1` for a backtrace
thread 'rustc' panicked at 'assertion failed: `(left == right)` (left: `2`, right: `1`)', ../src/librustc_trans/trans/glue.rs:358


playpen: application terminated with error code 101

Reproduction code (triggers assertion on playpen, and current nightly rustc 1.3.0-nightly (faa04a8b9 2015-06-30))

#![feature(unsize,coerce_unsized,unsafe_no_drop_flag)]
use std::{ops,marker};
use std::sync::atomic::{Ordering,AtomicUsize};

pub struct Aref<T: ?Sized> {
    __inner: Box<ArefInner<T>>,
}
// Allow coercing
impl<T: ?Sized + marker::Unsize<U>, U: ?Sized> ops::CoerceUnsized<Aref<U>> for Aref<T> {}

#[unsafe_no_drop_flag]
pub struct ArefInner<T: ?Sized> {
        count: AtomicUsize,
        data: T,
}

impl<T: ?Sized> ops::Drop for ArefInner<T> {
        fn drop(&mut self) {
                assert_eq!(self.count.load(Ordering::Relaxed), 0);
        }
}

impl<T> Aref<T> {
        pub fn new(val: T) -> Aref<T> {
                Aref {
                        __inner: Box::new(unsafe{ ArefInner::new(val) }),
                }
        }
}

impl<T> ArefInner<T> {
        pub unsafe fn new(val: T) -> ArefInner<T> {
                ArefInner {
                        count: AtomicUsize::new(0),
                        data: val,
                }
        }
}


fn main() {
    let ar = Aref::new(1234);
    let ar_disp: Aref<::std::fmt::Display> = ar;
}

[eddyb]

Reduced test case:

struct Wrapper<T: ?Sized>(T);

impl<T: ?Sized> Drop for Wrapper<T> {
    fn drop(&mut self) {}
}

fn main() {
    let wrapper = Box::new(Wrapper(123));
    let _: Box<Wrapper<Send>> = wrapper;
}

The assert seems to be tripped by #26411, trans::glue wants a single argument for a Drop::drop call, but it's seeing two (because a fat pointer is now passed in two immediate arguments).
cc @dotdash