From 69c8d1557020823d72e75e6b6889b27d1462ff49 Mon Sep 17 00:00:00 2001
From: Slava Pestov <spestov@apple.com>
Date: Mon, 20 Oct 2025 16:59:49 -0400
Subject: [PATCH] Sema: Fix a fuzzer crash

This test case crashes when prepared overloads are disabled, but passes
when enabled. To avoid messing up tests if we have to turn the flag on
and off, fix the crash.
---
 lib/Sema/ConstraintSystem.cpp                 | 54 ++++++++++++++-----
 .../Solution-getFixedType-98b9c4.swift        |  2 +-
 2 files changed, 42 insertions(+), 14 deletions(-)
 rename validation-test/{compiler_crashers => compiler_crashers_fixed}/Solution-getFixedType-98b9c4.swift (82%)

diff --git a/lib/Sema/ConstraintSystem.cpp b/lib/Sema/ConstraintSystem.cpp
index f3dedf8a3f547..7823676ee3e3b 100644
--- a/lib/Sema/ConstraintSystem.cpp
+++ b/lib/Sema/ConstraintSystem.cpp
@@ -2859,14 +2859,8 @@ static bool diagnoseContextualFunctionCallGenericAmbiguity(
     return false;
 
   auto contextualFix = contextualFixes.front();
-  if (!std::all_of(contextualFixes.begin() + 1, contextualFixes.end(),
-                   [&contextualFix](FixInContext fix) {
-                     return fix.second->getLocator() ==
-                            contextualFix.second->getLocator();
-                   }))
-    return false;
-
   auto fixLocator = contextualFix.second->getLocator();
+
   auto contextualAnchor = fixLocator->getAnchor();
   auto *AE = getAsExpr<ApplyExpr>(contextualAnchor);
   // All contextual failures anchored on the same function call.
@@ -2874,12 +2868,17 @@ static bool diagnoseContextualFunctionCallGenericAmbiguity(
     return false;
 
   auto fnLocator = cs.getConstraintLocator(AE->getSemanticFn());
-  auto overload = contextualFix.first->getOverloadChoiceIfAvailable(fnLocator);
-  if (!overload)
-    return false;
 
-  auto applyFnType = overload->adjustedOpenedType->castTo<FunctionType>();
-  auto resultTypeVar = applyFnType->getResult()->getAs<TypeVariableType>();
+  auto getResultTypeVar = [&](FixInContext contextualFix) -> TypeVariableType * {
+    auto overload = contextualFix.first->getOverloadChoiceIfAvailable(fnLocator);
+    if (!overload)
+      return nullptr;
+
+    auto applyFnType = overload->adjustedOpenedType->castTo<FunctionType>();
+    return applyFnType->getResult()->getAs<TypeVariableType>();
+  };
+
+  auto resultTypeVar = getResultTypeVar(contextualFix);
   if (!resultTypeVar)
     return false;
 
@@ -2887,6 +2886,23 @@ static bool diagnoseContextualFunctionCallGenericAmbiguity(
   if (!GP)
     return false;
 
+  if (!std::all_of(contextualFixes.begin() + 1, contextualFixes.end(),
+                   [&](FixInContext fix) {
+                     if (fix.second->getLocator() != fixLocator)
+                       return false;
+
+                     auto resultTypeVar = getResultTypeVar(fix);
+
+                     if (!resultTypeVar)
+                       return false;
+
+                     if (resultTypeVar->getImpl().getGenericParameter() != GP)
+                       return false;
+
+                     return true;
+                   }))
+    return false;
+
   auto applyLoc =
       cs.getConstraintLocator(AE, {LocatorPathElt::ApplyArgument()});
   auto argMatching =
@@ -2903,6 +2919,11 @@ static bool diagnoseContextualFunctionCallGenericAmbiguity(
       continue;
 
     auto argParamMatch = argMatching->second.parameterBindings[i];
+
+    // FIXME: We're just looking at the first solution's overload here,
+    // is that correct?
+    auto overload = contextualFix.first->getOverloadChoiceIfAvailable(fnLocator);
+    auto applyFnType = overload->adjustedOpenedType->castTo<FunctionType>();
     auto param = applyFnType->getParams()[argParamMatch.front()];
     auto paramFnType = param.getPlainType()->getAs<FunctionType>();
     if (!paramFnType)
@@ -2922,8 +2943,15 @@ static bool diagnoseContextualFunctionCallGenericAmbiguity(
   // from all the closure contextual fix/solutions and if there are more than
   // one fixed type diagnose it.
   swift::SmallSetVector<Type, 4> genericParamInferredTypes;
-  for (auto &fix : contextualFixes)
+  for (auto &fix : contextualFixes) {
+    auto resultTypeVar = getResultTypeVar(fix);
+    genericParamInferredTypes.insert(fix.first->getFixedType(resultTypeVar));
+  }
+
+  for (auto &fix : allFixes) {
+    auto resultTypeVar = getResultTypeVar(fix);
     genericParamInferredTypes.insert(fix.first->getFixedType(resultTypeVar));
+  }
 
   if (llvm::all_of(allFixes, [&](FixInContext fix) {
         auto fixLocator = fix.second->getLocator();
diff --git a/validation-test/compiler_crashers/Solution-getFixedType-98b9c4.swift b/validation-test/compiler_crashers_fixed/Solution-getFixedType-98b9c4.swift
similarity index 82%
rename from validation-test/compiler_crashers/Solution-getFixedType-98b9c4.swift
rename to validation-test/compiler_crashers_fixed/Solution-getFixedType-98b9c4.swift
index 41087feedf886..48eb1e317be4c 100644
--- a/validation-test/compiler_crashers/Solution-getFixedType-98b9c4.swift
+++ b/validation-test/compiler_crashers_fixed/Solution-getFixedType-98b9c4.swift
@@ -1,5 +1,5 @@
 // {"kind":"typecheck","signature":"swift::constraints::Solution::getFixedType(swift::TypeVariableType*) const","signatureAssert":"Assertion failed: (knownBinding != typeBindings.end()), function getFixedType"}
-// RUN: not --crash %target-swift-frontend -typecheck %s
+// RUN: not %target-swift-frontend -typecheck %s
 class a {
   static
 b {