Sema: fix crash when ref coercion dest is var args

When analyzing the `validate_ref_ty` ZIR instruction, an assertion would
trip if the result type was a var args function argument. The fix is the
same as e6b73be870a39f4da7a08a40da23e38b5e9613da - inline the logic of
`resolveType` and handle the case of var args.

Closes #17494

1 files changed, 11 insertions, 5 deletions

diff --git a/src/Sema.zig b/src/Sema.zig
index 559f5d2731..0f3ae46c1b 100644
--- a/src/Sema.zig
+++ b/src/Sema.zig
@@ -4371,13 +4371,19 @@ fn zirValidateRefTy(sema: *Sema, block: *Block, inst: Zir.Inst.Index) CompileErr
     const mod = sema.mod;
     const un_tok = sema.code.instructions.items(.data)[inst].un_tok;
     const src = un_tok.src();
-    const ty_operand = sema.resolveType(block, src, un_tok.operand) catch |err| switch (err) {
-        error.GenericPoison => {
-            // We don't actually have a type, so this will be treated as an untyped address-of operator.
-            return;
-        },
+    // In case of GenericPoison, we don't actually have a type, so this will be
+    // treated as an untyped address-of operator.
+    if (un_tok.operand == .var_args_param_type) return;
+    const operand_air_inst = sema.resolveInst(un_tok.operand) catch |err| switch (err) {
+        error.GenericPoison => return,
+        else => |e| return e,
+    };
+    if (operand_air_inst == .var_args_param_type) return;
+    const ty_operand = sema.analyzeAsType(block, src, operand_air_inst) catch |err| switch (err) {
+        error.GenericPoison => return,
         else => |e| return e,
     };
+    if (ty_operand.isGenericPoison()) return;
     if (ty_operand.optEuBaseType(mod).zigTypeTag(mod) != .Pointer) {
         return sema.failWithOwnedErrorMsg(block, msg: {
             const msg = try sema.errMsg(block, src, "expected type '{}', found pointer", .{ty_operand.fmt(mod)});