From 5559c7fbd5bbb0205de4ec0a4564027786cb2611 Mon Sep 17 00:00:00 2001
From: Alexander McCord <amccord@roblox.com>
Date: Fri, 2 Feb 2024 13:20:35 -0800
Subject: [PATCH] Fix the stack-use-after-scope.

---
 Analysis/include/Luau/TypeUtils.h |  2 ++
 Analysis/src/TypeChecker2.cpp     | 22 ++++++++++++++--------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/Analysis/include/Luau/TypeUtils.h b/Analysis/include/Luau/TypeUtils.h
index 801fd4ed..8803d924 100644
--- a/Analysis/include/Luau/TypeUtils.h
+++ b/Analysis/include/Luau/TypeUtils.h
@@ -140,6 +140,8 @@ struct TryPair
 template<typename A, typename B, typename Ty>
 TryPair<const A*, const B*> get2(Ty one, Ty two)
 {
+    static_assert(std::is_pointer_v<Ty>, "argument must be a pointer type");
+
     const A* a = get<A>(one);
     const B* b = get<B>(two);
     if (a && b)
diff --git a/Analysis/src/TypeChecker2.cpp b/Analysis/src/TypeChecker2.cpp
index cf404445..0badb2c5 100644
--- a/Analysis/src/TypeChecker2.cpp
+++ b/Analysis/src/TypeChecker2.cpp
@@ -2400,14 +2400,20 @@ struct TypeChecker2
             if (reasoning.subPath.empty() && reasoning.superPath.empty())
                 continue;
 
-            std::optional<TypeOrPack> subLeaf = traverse(subTy, reasoning.subPath, builtinTypes);
-            std::optional<TypeOrPack> superLeaf = traverse(superTy, reasoning.superPath, builtinTypes);
+            std::optional<TypeOrPack> optSubLeaf = traverse(subTy, reasoning.subPath, builtinTypes);
+            std::optional<TypeOrPack> optSuperLeaf = traverse(superTy, reasoning.superPath, builtinTypes);
 
-            if (!subLeaf || !superLeaf)
+            if (!optSubLeaf || !optSuperLeaf)
                 ice->ice("Subtyping test returned a reasoning with an invalid path", location);
 
-            auto [subLeafTy, superLeafTy] = get2<TypeId, TypeId>(*subLeaf, *superLeaf);
-            auto [subLeafTp, superLeafTp] = get2<TypePackId, TypePackId>(*subLeaf, *superLeaf);
+            const TypeOrPack& subLeaf = *optSubLeaf;
+            const TypeOrPack& superLeaf = *optSuperLeaf;
+
+            auto subLeafTy = get<TypeId>(subLeaf);
+            auto superLeafTy = get<TypeId>(superLeaf);
+
+            auto subLeafTp = get<TypePackId>(subLeaf);
+            auto superLeafTp = get<TypePackId>(superLeaf);
 
             if (!subLeafTy && !superLeafTy && !subLeafTp && !superLeafTp)
                 ice->ice("Subtyping test returned a reasoning where one path ends at a type and the other ends at a pack.", location);
@@ -2420,10 +2426,10 @@ struct TypeChecker2
 
             std::string reason;
             if (reasoning.subPath == reasoning.superPath)
-                reason = "at " + toString(reasoning.subPath) + ", " + toString(*subLeaf) + " is not " + relation + " " + toString(*superLeaf);
+                reason = "at " + toString(reasoning.subPath) + ", " + toString(subLeaf) + " is not " + relation + " " + toString(superLeaf);
             else
-                reason = "type " + toString(subTy) + toString(reasoning.subPath, /* prefixDot */ true) + " (" + toString(*subLeaf) + ") is not " +
-                         relation + " " + toString(superTy) + toString(reasoning.superPath, /* prefixDot */ true) + " (" + toString(*superLeaf) + ")";
+                reason = "type " + toString(subTy) + toString(reasoning.subPath, /* prefixDot */ true) + " (" + toString(subLeaf) + ") is not " +
+                         relation + " " + toString(superTy) + toString(reasoning.superPath, /* prefixDot */ true) + " (" + toString(superLeaf) + ")";
 
             reasons.push_back(reason);