[gcc r14-9135] tree-optimization/114048 - ICE in copy_reference_ops_from_ref

[Richard Biener <rguenth@gcc.gnu.org>]

https://gcc.gnu.org/g:92c40297991f51e7fa942f29517bc4398fce33f9

commit r14-9135-g92c40297991f51e7fa942f29517bc4398fce33f9
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Feb 22 14:22:29 2024 +0100

    tree-optimization/114048 - ICE in copy_reference_ops_from_ref
    
    The following adds another omission to the assert verifying we're
    not running into spurious off == -1.
    
            PR tree-optimization/114048
            * tree-ssa-sccvn.cc (copy_reference_ops_from_ref): MEM_REF
            can also produce -1 off.
    
            * gcc.dg/torture/pr114048.c: New testcase.

Diff:
---
 gcc/testsuite/gcc.dg/torture/pr114048.c | 25 +++++++++++++++++++++++++
 gcc/tree-ssa-sccvn.cc                   |  2 ++
 2 files changed, 27 insertions(+)

diff --git a/gcc/testsuite/gcc.dg/torture/pr114048.c b/gcc/testsuite/gcc.dg/torture/pr114048.c
new file mode 100644
index 000000000000..338000b30062
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr114048.c
@@ -0,0 +1,25 @@
+/* { dg-do compile } */
+
+typedef struct {
+  void *child[2];
+  char otherbits;
+} critbit0_node;
+
+int allprefixed_traverse(char *top)
+{
+  if (top)
+    {
+      critbit0_node *q = (void *)top - 1;
+      int direction = 0;
+      for (;; ++direction)
+	switch (allprefixed_traverse(q->child[direction]))
+	  {
+	  case 1:
+	    break;
+	  case 0:
+	    return 0;
+	  default:
+	    return 1;
+	  }
+    }
+}
diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index 3e93685e80a6..2587eb1c5052 100644
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -1185,6 +1185,8 @@ copy_reference_ops_from_ref (tree ref, vec<vn_reference_op_s> *result)
 	      else
 		{
 		  gcc_assert (known_ne (op.off, -1)
+			      /* The constant offset can be -1.  */
+			      || op.opcode == MEM_REF
 			      /* Out-of-bound indices can compute to
 				 a known -1 offset.  */
 			      || ((op.opcode == ARRAY_REF