Analyzer crash when inheriting covariance on a method inherited with substitution

[stereotype441]

The following code crashes the analyzer:

class A<T> {
  void foo<U>(covariant Object a, U b, int c) {}
}

class B extends A<int> implements C {}

class C {
  void foo<U>(Object a, U b, covariant Object c) {}
}

main() {}

It's accepted by the CFE without complaint.

This issue is blocking me, and I think I understand what's going wrong, so I'll work on a fix.