Crash in narrowing when using for-in

[DanielRosenwasser]

var C = [];
for (var a in C)
    if (C.hasOwnProperty(a)) {
    }
}

TypeError: Cannot read properties of undefined (reading 'length')
    at isFunctionObjectType (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:70256:47)
    at getTypeFacts (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:70302:21)
    at isNullableType (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:75165:23)
    at getNonNullableTypeIfNeeded (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:75168:20)
    at getTypeAtFlowAssignment (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:71169:28)
    at getTypeAtFlowNode (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:71049:32)
    at getFlowTypeOfReference (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:71003:51)
    at checkIdentifier (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:72433:28)
    at checkExpressionWorker (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:80598:28)
    at checkExpression (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:80547:38)
    at checkNonNullExpression (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:75162:37)
    at checkPropertyAccessExpression (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:75207:85)
    at getSymbolOfNameOrPropertyAccessExpression (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:87207:25)
    at getSymbolAtLocation (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:87314:32)
    at Object.getSymbolAtLocation (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:48831:31)
    at getSymbolAtLocationForQuickInfo (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:167703:24)
    at Object.getQuickInfoAtPosition (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:166736:26)
    at IpcIOSession.Session.getQuickInfoWorker (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:178739:62)
    at Session.handlers.ts.Map.ts.getEntries._a.<computed> (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:177461:61)
    at c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:179575:96
    at IpcIOSession.Session.executeWithRequestId (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:179566:28)
    at IpcIOSession.Session.executeCommand (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:179575:41)
    at IpcIOSession.Session.onMessage (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:179603:35)
    at process.<anonymous> (c:/Users/Daniel/.vscode-insiders/extensions/ms-vscode.vscode-typescript-next-4.8.20220717/node_modules/typescript/lib/tsserver.js:183769:31)
    at process.emit (node:events:390:28)
    at emit (node:internal/child_process:917:12)
    at processTicksAndRejections (node:internal/process/task_queues:84:21)

Either #49887 (@jakebailey) or #49625 (@ahejlsberg) likely caused this since it appears consistently and happened after Friday.

[jakebailey]

I can't seem to make this break; where did you hover in order to trigger the crash?

[DanielRosenwasser]

It was on hasOwnProperty but I realized that to get it to happen with tsc, you have to be in a .js file or under --strict in a .ts file. Also, use nightly.

https://www.typescriptlang.org/play?ts=4.8.0-dev.20220718#code/G4QwTgBAwhC8EG0C6BuAUAMwPaQBSkhAgEsA7aASjQhpIwlygDoALEAZwHkB3UgBTBYADgFMwAFwCeuEBQoQA3tVoBfNCqA

[jakebailey]

Thanks, I can reproduce it now.

[jakebailey]

Bisected to #49330 (which isn't one of those two).

[jakebailey]

It looks like resolveStructuredTypeMembers isn't fully resolving a type. Throwing a bunch of asserts for things that should not be undefined does hit an assert (before the length check), but only fails this one test (which is good in terms of this having broken something else unknowingly).

[jakebailey]

The type is an EvolvingArray, which doesn't have a case in resolveStructuredTypeMembers. (It also can't be printed, which is fun.)