[Bug tree-optimization/94216] [10 Regression] ICE in maybe_canonicalize_mem_ref_addr, at gimple-fold.c:4899 since r10-7237-g4e3d3e40726e1b68bf52fa205c68495124ea60b8

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94216

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #5)
> (In reply to Jakub Jelinek from comment #1)
> > I wonder if we shouldn't do:
> > --- gcc/fold-const.c.jj	2020-03-18 12:47:36.000000000 +0100
> > +++ gcc/fold-const.c	2020-03-18 17:34:14.586455801 +0100
> > @@ -82,6 +82,7 @@ along with GCC; see the file COPYING3.
> >  #include "attribs.h"
> >  #include "tree-vector-builder.h"
> >  #include "vec-perm-indices.h"
> > +#include "tree-ssa.h"
> >  
> >  /* Nonzero if we are folding constants inside an initializer; zero
> >     otherwise.  */
> > @@ -10262,6 +10263,10 @@ fold_binary_loc (location_t loc, enum tr
> >    switch (code)
> >      {
> >      case MEM_REF:
> > +      STRIP_USELESS_TYPE_CONVERSION (arg0);
> 
> We already applied STRIP_NOPS to arg0

Though, if we don't want to strip non-useless conversions, that is wrong even
for the two special cases we have afterwards.
So, shouldn't case MEM_REF: start then with
      arg0 = op0;
      STRIP_USELESS_TYPE_CONVERSION (arg0);
      arg1 = op1;
?
Or fold_convert to the type of op0 if the type conversion isn't useless?
Also, isn't the arg1 handling incorrect or at least dangerous?
I mean, if it does int_const_binop (PLUS_EXPR, arg1, ...) in both cases
then it will have the type of arg1 which is op1 after STRIP_NOPS, so could have
completely different type.  One needs to hope that the last argument to
fold_binary_loc of MEM_REF will always be an INTEGER_CST from which nothing can
be stripped...