Merge pull request #23497 from theblixguy/fix/SR-10146

[CSApply] Fix a KeyPath crash in SIL when base type is AnyObject

Author: jckarter

lib/Sema/CSApply.cpp

@@ -4184,7 +4184,16 @@ namespace {
       auto keyPathTy = cs.getType(E)->castTo<BoundGenericType>();
       Type baseTy = keyPathTy->getGenericArgs()[0];
       Type leafTy = keyPathTy->getGenericArgs()[1];
-      
+
+      // We do not allow keypaths to go through AnyObject
+      if (baseTy->isAnyObject()) {
+        auto rootTyRepr = E->getRootType();
+        cs.TC.diagnose(rootTyRepr->getLoc(),
+                       diag::expr_swift_keypath_invalid_component)
+             .highlight(rootTyRepr->getSourceRange());
+        return nullptr;
+      }
+
       for (unsigned i : indices(E->getComponents())) {
         auto &origComponent = E->getMutableComponents()[i];
 

validation-test/compiler_crashers_2_fixed/sr10146.swift

@@ -0,0 +1,12 @@
+// RUN: not %target-swift-frontend -emit-sil %s
+// REQUIRES: OS=ios
+
+import UIKit
+
+// Just make sure we don't crash.
+
+class Foo: NSObject {
+  func crash() {
+    let kp = \AnyObject.accessibilityFrame
+  }
+}