"Queried ... before it was resolved" in GetConstantInSpecific from toolchain/sem_ir/generic.cpp

[josh11b]

Description of the bug:

I'm getting a crash from the fuzzer, and #4202 seems like the most likely culprit.

What did you do, or what's a simple way to reproduce the bug?

This input:

class C(T:! type) {
  fn F() {
    data;
  }
  var data: {};
}

produces:

CHECK failure at toolchain/sem_ir/generic.cpp:84: value_block_id.is_valid(): Queried genericInstInDef3 in specific0 for {kind: ClassDecl, arg0: class0, arg1: block5, type: type(inst+8)} before it was resolved.

but:

class C(T:! type) {
  fn F() {
    x;
  }
  var data: {};
}

succeeds (printing diagnostics). The only difference is data vs. x in the body of F.

I've tried to minimize the input that triggers the failure. For example, making this non-generic by removing (T:! type) causes it to succeed.

What did you expect to happen?

No CHECK failure

What actually happened?

CHECK failure

Any other information, logs, or outputs that you want to share?

Here is the Stack dump when it crashes:

Stack dump:
0.      Program arguments: /usr/local/google/home/joshl/.cache/bazel/_bazel_joshl/421d196ee907b61a6dba5ef703299466/execroot/_main/bazel-out/k8-fastbuild/bin/toolchain/driver/carbon compile --phase=check /tmp/t2.carbon
1.      Check::Context
          NodeStack:
            0. FunctionDefinitionStart: function0
          inst_block_stack_:
            0. block<invalid> {
                package: <namespace> = namespace [template] {
                  .Core = <unexpected>.inst+2
                  .C = <unexpected>.inst+6.loc1_19
                }
                <unexpected>.inst+1 = import Core
                <unexpected>.inst+6.loc1_19: %C.type = class_decl @C [template = constants.%C.1] {
                  <unexpected>.inst+3.loc1_9: type = param T
                  <unexpected>.inst+4.loc1_9: type = bind_symbolic_name T 0, <unexpected>.inst+3.loc1_9 [symbolic = @C.%T (constants.%T)]
                }
              }
            1. block19 {}
          param_and_arg_refs_stack:
          args_type_info_stack_:
2.      /tmp/t2.carbon:3:5: checking IdentifierNameExpr
              data;
              ^~~~

...

#10 0x0000558e4fb1129f Carbon::SemIR::GetConstantInSpecific(Carbon::SemIR::File const&, Carbon::SemIR::SpecificId, Carbon::SemIR::ConstantId) (...)
#11 0x0000558e4fb1149c Carbon::SemIR::GetTypeInSpecific(Carbon::SemIR::File const&, Carbon::SemIR::SpecificId, Carbon::SemIR::TypeId) (...)
#12 0x0000558e4f95d3ba Carbon::Check::HandleNameAsExpr(Carbon::Check::Context&, Carbon::Parse::NodeId, Carbon::SemIR::NameId) handle_name.cpp:0:0
#13 0x0000558e4f95d30b Carbon::Check::HandleParseNode(Carbon::Check::Context&, Carbon::Parse::NodeIdForKind<Carbon::Parse::NodeKind::IdentifierNameExpr>) (...)
#14 0x0000558e4f8be68a Carbon::Check::ProcessNodeIds(Carbon::Check::Context&, llvm::raw_ostream*, Carbon::ErrorTrackingDiagnosticConsumer&, Carbon::Parse::NodeLocConverter*) check.cpp:0:0
#15 0x0000558e4f8a578e Carbon::Check::CheckParseTree(llvm::MutableArrayRef<Carbon::Parse::NodeLocConverter*>, Carbon::Check::(anonymous namespace)::UnitInfo&, int, llvm::raw_ostream*) check.cpp:0:0
#16 0x0000558e4f8a273b Carbon::Check::CheckParseTrees(llvm::MutableArrayRef<Carbon::Check::Unit>, bool, llvm::raw_ostream*) (...)
#17 0x0000558e4f165b34 Carbon::Driver::Compile(Carbon::Driver::CompileOptions const&, Carbon::Driver::CodegenOptions const&) (...)