In SubtypingDiscoverer::processResumeHandlers (src/ir/subtype-exprs.h, line 527), the inner loop iterates with variable j but indexes with the outer variable i:
for (Index j = 0; j < tagSig.params.size(); ++j) {
self()->noteSubtype(tagSig.params[i], expected[i]); // bug: should be [j]
}
What goes wrong:
- For a handler at index
i with N params, the code notes (params[i], expected[i]) N times instead of (params[0], expected[0]) ... (params[N-1], expected[N-1]).
- When
i >= tagSig.params.size(), this is an out-of-bounds access.
- This affects the
--unsubtyping pass, which relies on SubtypingDiscoverer to find required subtype relationships.
Fix: #8289 — changes [i] to [j].