[Bug tree-optimization/106027] [11/12/13 Regression] ICE: 'verify_gimple' failed (error: mismatching comparison operand types) since r11-2450-g10231958fcfb13bc

["rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106027

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
So the issue seems to be that

#4  0x0000000000f82be3 in fold_binary_loc (loc=2147483656, 
    code=TRUTH_ANDIF_EXPR, type=<integer_type 0x7ffff68dd690 unsigned int>, 
    op0=<nop_expr 0x7ffff6a0f240>, op1=<nop_expr 0x7ffff6a0f220>)
    at /space/rguenther/src/gcc/gcc/fold-const.cc:12044
      /* A < X && A + 1 > Y ==> A < X && A >= Y.  Normally A + 1 > Y
         means A >= Y && A != MAX, but in this case we know that
         A < X <= MAX.  */

      if (!TREE_SIDE_EFFECTS (arg0)
          && !TREE_SIDE_EFFECTS (arg1))
        {
          tem = fold_to_nonsharp_ineq_using_bound (loc, arg0, arg1);
          if (tem && !operand_equal_p (tem, arg0, 0))
            return fold_build2_loc (loc, code, type, tem, arg1);

          tem = fold_to_nonsharp_ineq_using_bound (loc, arg1, arg0);
          if (tem && !operand_equal_p (tem, arg1, 0))
            return fold_build2_loc (loc, code, type, arg0, tem);

builds unsigned type TRUTH_ANDIF_EXPR with signed type arg0/tem (op0/op1
are conversions to unsigned type).  The offending revision just chokes
on the invalid input.