Started with r9-1948-gd893b683f40884cd00b5beb392566ecc7b67f721

Another slightly different ICE in the same code:

$ cat t.c && gcc -O2 -Wall t.c
void f (void*);

int g (int n)
{
  int a[0][n];

  f (a);

  return ((int*) a)[0];
}

during GIMPLE pass: vrp
t.c: In function ‘g’:
t.c:3:5: internal compiler error: tree check: expected integer_cst, have var_decl in get_len, at tree.h:5947
    3 | int g (int n)
      |     ^
0x1777567 tree_check_failed(tree_node const*, char const*, int, char const*, ...)
	/ssd/src/gcc/10-branch/gcc/tree.c:9730
0x8d48d7 tree_check(tree_node const*, char const*, int, char const*, tree_code)
	/ssd/src/gcc/10-branch/gcc/tree.h:3550
0xaa24bf wi::extended_tree<128>::get_len() const
	/ssd/src/gcc/10-branch/gcc/tree.h:5947
0xaa20fc wi::int_traits<generic_wide_int<wi::extended_tree<128> > >::decompose(long*, unsigned int, generic_wide_int<wi::extended_tree<128> > const&)
	/ssd/src/gcc/10-branch/gcc/wide-int.h:985
0xaa1a32 wide_int_ref_storage<true, false>::wide_int_ref_storage<generic_wide_int<wi::extended_tree<128> > >(generic_wide_int<wi::extended_tree<128> > const&, unsigned int)
	/ssd/src/gcc/10-branch/gcc/wide-int.h:1034
0xaa0a1a generic_wide_int<wide_int_ref_storage<true, false> >::generic_wide_int<generic_wide_int<wi::extended_tree<128> > >(generic_wide_int<wi::extended_tree<128> > const&, unsigned int)
	/ssd/src/gcc/10-branch/gcc/wide-int.h:790
0xafc231 fixed_wide_int_storage<128>::fixed_wide_int_storage<generic_wide_int<wi::extended_tree<128> > >(generic_wide_int<wi::extended_tree<128> > const&)
	/ssd/src/gcc/10-branch/gcc/wide-int.h:1262
0xafad7c generic_wide_int<fixed_wide_int_storage<128> >& generic_wide_int<fixed_wide_int_storage<128> >::operator=<generic_wide_int<wi::extended_tree<128> > >(generic_wide_int<wi::extended_tree<128> > const&)
	/ssd/src/gcc/10-branch/gcc/wide-int.h:937
0x1746e1e vrp_prop::check_mem_ref(unsigned int, tree_node*, bool)
	/ssd/src/gcc/10-branch/gcc/tree-vrp.c:3826
0x1748412 check_array_bounds
	/ssd/src/gcc/10-branch/gcc/tree-vrp.c:4050
0x1782e0c walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*), void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*, tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*), void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*))
	/ssd/src/gcc/10-branch/gcc/tree.c:12000
0xe07e82 walk_gimple_op(gimple*, tree_node* (*)(tree_node**, int*, void*), walk_stmt_info*)
	/ssd/src/gcc/10-branch/gcc/gimple-walk.c:202
0x1748545 check_array_bounds_dom_walker::before_dom_children(basic_block_def*)
	/ssd/src/gcc/10-branch/gcc/tree-vrp.c:4106
0x2201748 dom_walker::walk(basic_block_def*)
	/ssd/src/gcc/10-branch/gcc/domwalk.c:309
0x17485ac vrp_prop::check_all_array_refs()
	/ssd/src/gcc/10-branch/gcc/tree-vrp.c:4123
0x174ba18 vrp_prop::vrp_finalize(bool)
	/ssd/src/gcc/10-branch/gcc/tree-vrp.c:5195
0x174baad execute_vrp
	/ssd/src/gcc/10-branch/gcc/tree-vrp.c:5263
0x174bcc7 execute
	/ssd/src/gcc/10-branch/gcc/tree-vrp.c:5345
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Patch: https://gcc.gnu.org/pipermail/gcc-patches/2021-February/565405.html

GCC 9.4 is being released, retargeting bugs to GCC 9.5.

The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:a110855667782dac7b674d3e328b253b3b3c919b

commit r12-2132-ga110855667782dac7b674d3e328b253b3b3c919b
Author: Martin Sebor <msebor@redhat.com>
Date:   Wed Jul 7 14:05:25 2021 -0600

    Correct handling of variable offset minus constant in -Warray-bounds [PR100137]
    
    Resolves:
    PR tree-optimization/100137 - -Warray-bounds false positive on varying offset plus negative
    PR tree-optimization/99121 - ICE in -Warray-bounds on a multidimensional
    PR tree-optimization/97027 - missing warning on buffer overflow storing a larger scalar into a smaller array
    
    gcc/ChangeLog:
    
            PR tree-optimization/100137
            PR tree-optimization/99121
            PR tree-optimization/97027
            * builtins.c (access_ref::access_ref): Also set offmax.
            (access_ref::offset_in_range): Define new function.
            (access_ref::add_offset): Set offmax.
            (access_ref::inform_access): Handle access_none.
            (handle_mem_ref): Clear ostype.
            (compute_objsize_r): Handle ASSERT_EXPR.
            * builtins.h (struct access_ref): Add offmax member.
            * gimple-array-bounds.cc (array_bounds_checker::check_mem_ref): Use
            compute_objsize() and simplify.
    
    gcc/testsuite/ChangeLog:
    
            PR tree-optimization/100137
            PR tree-optimization/99121
            PR tree-optimization/97027
            * c-c++-common/Warray-bounds-3.c: Remove xfail
            * c-c++-common/Warray-bounds-4.c: Add an expected warning.
            * c-c++-common/Warray-bounds-9.c: New test.
            * c-c++-common/Warray-bounds-10.c: New test.
            * g++.dg/asan/asan_test.C: Suppress expected warnings.
            * g++.dg/pr95768.C: Same.
            * g++.dg/warn/Warray-bounds-10.C: Adjust text of expected messages.
            * g++.dg/warn/Warray-bounds-11.C: Same.
            * g++.dg/warn/Warray-bounds-12.C: Same.
            * g++.dg/warn/Warray-bounds-13.C: Same.
            * g++.dg/warn/Warray-bounds-17.C: Same.
            * g++.dg/warn/Warray-bounds-20.C: Same.
            * gcc.dg/Warray-bounds-29.c: Same.
            * gcc.dg/Warray-bounds-30.c: Add xfail.
            * gcc.dg/Warray-bounds-31.c: Adjust text of expected messages.
            * gcc.dg/Warray-bounds-32.c: Same.
            * gcc.dg/Warray-bounds-52.c: Same.
            * gcc.dg/Warray-bounds-53.c: Same.
            * gcc.dg/Warray-bounds-58.c: Remove xfail.
            * gcc.dg/Warray-bounds-63.c: Adjust text of expected messages.
            * gcc.dg/Warray-bounds-66.c: Same.
            * gcc.dg/Warray-bounds-69.c: Same.
            * gcc.dg/Wstringop-overflow-34.c: Same.
            * gcc.dg/Wstringop-overflow-47.c: Same.
            * gcc.dg/Wstringop-overflow-61.c: Same.
            * gcc.dg/Warray-bounds-77.c: New test.
            * gcc.dg/Warray-bounds-78.c: New test.
            * gcc.dg/Warray-bounds-79.c: New test.

Fixed in GCC 12.0.  The committed patch is too intrusive to backport.

But easily fixed with sth like

diff --git a/gcc/gimple-array-bounds.cc b/gcc/gimple-array-bounds.cc
index 199d9f5d216..b1179518651 100644
--- a/gcc/gimple-array-bounds.cc
+++ b/gcc/gimple-array-bounds.cc
@@ -607,6 +607,8 @@ array_bounds_checker::check_mem_ref (location_t location, tree ref,
 
       if (TREE_CODE (reftype) == ARRAY_TYPE)
        {
+         if (TREE_CODE (TYPE_SIZE_UNIT (TREE_TYPE (reftype))) != INTEGER_CST)
+           return false;
          /* Set to the size of the array element (and adjust below).  */
          eltsize = wi::to_offset (TYPE_SIZE_UNIT (TREE_TYPE (reftype)));
          /* Use log2 of size to convert the array byte size in to its

no?

Yeah.  And it changes only behavior for the cases where we'd ICE, so it shouldn't affect anything where we'd report some useful warning.

Fixed in GCC 12.  It could be fixed on release branches but I'm no longer working on it.

The releases/gcc-11 branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:4662984506b774213df9c4429d2c59664bb09adc

commit r11-9787-g4662984506b774213df9c4429d2c59664bb09adc
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Apr 7 11:59:04 2022 +0200

    tree-optimization/99121 - avoid ICEing for non-constant sizes
    
    The following is a simple fix to avoid ICEing on non-constant
    sizes of ARRAY_REFs instead of backporting too intrusive changes
    done on trunk.
    
    2022-04-07  Richard Biener  <rguenther@suse.de>
    
            PR tree-optimization/99121
            * gimple-array-bounds.cc (array_bounds_checker::check_mem_ref):
            Bail out for non-constant type size.

GCC 9 branch is being closed

GCC 10.4 is being released, retargeting bugs to GCC 10.5.

Fixed in 11.3