out of bounds access in insn-automata.c

[Aldy Hernandez]

Howdy!

I'm working on enhancements to our out-of-bounds warnings in VRP, such 
that we can warn and isolate conditionally out-of-bound accesses 
(similar to what we do in gimple-ssa-isolate-paths.c for NULL accesses).

With my WIP I have found the following out of bounds in the array access 
at the end of maximal_insn_latency:

int
maximal_insn_latency (rtx insn)
{
   int insn_code;

   if (insn == 0)
     insn_code = DFA__ADVANCE_CYCLE;


   else
     {
       insn_code = dfa_insn_code (as_a <rtx_insn *> (insn));
       if (insn_code > DFA__ADVANCE_CYCLE)
         return 0;
     }
   return internal_maximal_insn_latency (insn_code, insn);
}

In the case where insn==0, insn_code is set to the size of 
default_latencies[] which will get accessed in the return.

Does insn==0 never happen?  Are we reading past the end of 
default_latencies[]?  What am I missing?

Perhaps we can do:

	if (insn == 0) {
		gcc_unreachable();
		return 1;
	}

Or is insn==0?  In which case, what should we return?

Aldy