[torque] fix std::set iterator invalidation bug

Bug: v8:7793
Change-Id: Ifb3f27c7da02c2040fdf5042dafa13b336007f94
Reviewed-on: https://chromium-review.googlesource.com/c/1413875
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58890}

src/torque/types.h

@@ -355,11 +355,8 @@ class UnionType final : public Type {
     } else {
       if (t->IsSubtypeOf(this)) return;
       set_parent(CommonSupertype(parent(), t));
-      for (const Type* member : types_) {
-        if (member->IsSubtypeOf(t)) {
-          types_.erase(member);
-        }
-      }
+      EraseIf(&types_,
+              [&](const Type* member) { return member->IsSubtypeOf(t); });
       types_.insert(t);
     }
   }

src/torque/utils.h

@@ -273,6 +273,20 @@ constexpr int kTaggedSize = sizeof(void*);
 static const char* const kConstructMethodName = "constructor";
 static const char* const kSuperMethodName = "super";
 
+// Erase elements of a container that has a constant-time erase function, like
+// std::set or std::list. Calling this on std::vector would have quadratic
+// complexity.
+template <class Container, class F>
+void EraseIf(Container* container, F f) {
+  for (auto it = container->begin(); it != container->end();) {
+    if (f(*it)) {
+      it = container->erase(it);
+    } else {
+      ++it;
+    }
+  }
+}
+
 }  // namespace torque
 }  // namespace internal
 }  // namespace v8

test/torque/test-torque.tq

@@ -467,6 +467,19 @@ namespace test {
     check(TypeswitchExample(FromConstexpr<Number>(0.5)) == 27);
   }
 
+  macro TestTypeswitchAsanLsanFailure(implicit context: Context)(obj: Object) {
+    typeswitch (obj) {
+      case (o: Smi): {
+      }
+      case (o: JSTypedArray): {
+      }
+      case (o: JSReceiver): {
+      }
+      case (o: HeapObject): {
+      }
+    }
+  }
+
   macro ExampleGenericOverload<A: type>(o: Object): A {
     return o;
   }