Any hints on how to solve crash 10131?

I’m investigating crash 10131 and I managed to reduce the test case to this:

#include

class StringRef

{

public:

StringRef(std::string const& s) : length(s.size() {}

size_t length;

};

Here is what I have so far. The execution reaches this far (see abbreviated call stack) and then returns to Parser::ParseCXXMemberSpecification. At the end of this method ParsingDef.Pop() is called and it clears the SmallVector holding tokens (I think it’s the CachedTokens member inside LexedMethod), execution returns to first ParseDeclarationOrFunctionDefinition where ConsumeToken is called. This ends up inside TokenLexer::Lex that tries accessing Tokens member pointing to now deleted tokens. I don’t really understand the code in order to fix it but I’m not ready to surrender yet. Any hints?