Sema: Fix incorrect use of STL iterator in associated type inference

lib/Sema/AssociatedTypeInference.cpp

@@ -2644,6 +2644,8 @@ bool AssociatedTypeInference::simplifyCurrentTypeWitnesses() {
     anyChanged = false;
     anyUnsubstituted = false;
 
+  LLVM_DEBUG(llvm::dbgs() << "Simplifying type witnesses -- iteration " << iterations << "\n");
+
     if (++iterations > 100) {
       llvm::errs() << "Too many iterations in simplifyCurrentTypeWitnesses()\n";
 
@@ -2679,6 +2681,10 @@ bool AssociatedTypeInference::simplifyCurrentTypeWitnesses() {
       if (!typeWitness->hasTypeParameter())
         continue;
 
+      LLVM_DEBUG(llvm::dbgs() << "Attempting to simplify witness for "
+                              << assocType->getName()
+                              << ": " << typeWitness << "\n";);
+
       auto simplified = typeWitness.transformRec(
         [&](TypeBase *type) -> std::optional<Type> {
           // Skip.
@@ -2807,10 +2813,16 @@ AssociatedTypeInference::getSubstOptionsWithCurrentTypeWitnesses() {
         return nullptr;
       }
 
-      Type type = self->typeWitnesses.begin(assocType)->first;
+      auto found = self->typeWitnesses.begin(assocType);
+      if (found == self->typeWitnesses.end()) {
+        // Invalid code.
+        return ErrorType::get(thisProto->getASTContext()).getPointer();
+      }
+
+      Type type = found->first;
       if (type->hasTypeParameter()) {
         // Not fully substituted yet.
-        return ErrorType::get(type->getASTContext()).getPointer();
+        return ErrorType::get(thisProto->getASTContext()).getPointer();
       }
 
       return type->mapTypeOutOfContext().getPointer();

test/decl/protocol/req/rdar127575477.swift

@@ -0,0 +1,14 @@
+// RUN: not %target-typecheck-verify-swift
+
+// This is highly invalid, so just don't crash.
+
+struct G<T> {}
+
+extension G: Collection {
+  typealias SubSequence = DoesNotExist
+  typealias Index = DoesNotExist
+
+  subscript(position: Index) -> Element { fatalError() }
+}
+
+extension G: BidirectionalCollection where T: BidirectionalCollection {}