Add a local save point in subtype hot path.

A quick fix for #48582.

Author: N5N3

src/subtype.c

@@ -1439,11 +1439,25 @@ static int may_contain_union_decision(jl_value_t *x, jl_stenv_t *e, jl_typeenv_t
            may_contain_union_decision(xb ? xb->ub : ((jl_tvar_t *)x)->ub, e, &newlog);
 }
 
+static int local_forall_subtype(jl_value_t *x, jl_value_t *y, jl_stenv_t *e, int param) {
+    int sub;
+    while (1) {
+        e->Lunions.more = 0;
+        e->Lunions.depth = 0;
+        sub = subtype(x, y, e, param);
+        if (!sub || !next_union_state(e, 0))
+            break;
+    }
+    return sub;
+}
+
 static int local_forall_exists_subtype(jl_value_t *x, jl_value_t *y, jl_stenv_t *e, int param, int limit_slow)
 {
     int16_t oldRmore = e->Runions.more;
     int sub;
-    if (may_contain_union_decision(y, e, NULL) && pick_union_decision(e, 1) == 0) {
+    if (!may_contain_union_decision(y, e, NULL))
+        sub = local_forall_subtype(x, y, e, param);
+    else if (pick_union_decision(e, 1) == 0) {
         jl_saved_unionstate_t oldRunions; push_unionstate(&oldRunions, &e->Runions);
         e->Lunions.used = e->Runions.used = 0;
         e->Lunions.depth = e->Runions.depth = 0;
@@ -1460,14 +1474,20 @@ static int local_forall_exists_subtype(jl_value_t *x, jl_value_t *y, jl_stenv_t
     }
     else {
         // slow path
-        e->Lunions.used = 0;
+        int oldRmore = e->Runions.more;
+        jl_value_t *saved = NULL; jl_savedenv_t se;
+        JL_GC_PUSH1(&saved);
+        save_env(e, &saved, &se);
         while (1) {
-            e->Lunions.more = 0;
-            e->Lunions.depth = 0;
-            sub = subtype(x, y, e, param);
-            if (!sub || !next_union_state(e, 0))
+            sub = local_forall_subtype(x, y, e, param);
+            if (sub || e->Runions.more == oldRmore)
                 break;
+            next_union_state(e, 1);
+            restore_env(e, saved, &se); // also restore depth here.
+            e->Runions.more = oldRmore;
         }
+        free_env(&se);
+        JL_GC_POP();
     }
     return sub;
 }