ArraySliceType::copyForLocation assertion failure

[agroce]

Description

This contract:

contract C {
    function f( bytes calldata x,bool cond) external pure {
        bytes1 a = x[cond - 1 : 2]. a;
	if (0==1)
	    if (0<1)
		continue;
    }
}

produces:

Internal compiler error during compilation:
/home/user/solidity/libsolidity/ast/Types.h(797): Throw in function virtual std::unique_ptr<ReferenceType> solidity::frontend::ArraySliceType::copyForLocation(solidity::frontend::DataLocation, bool) const
Dynamic exception type: boost::exception_detail::clone_impl<solidity::langutil::InternalCompilerError>
std::exception::what: 
[solidity::util::tag_comment*] = 

when compiled.

On master, using AFL fuzzing. This was found with a new approach, that inlines a generic C-like source code mutation tool as a high-probability AFL havoc mutator.

Environment

• Compiler version: 0.6.3-develop.2020.2.5+commit.f44188ab.Linux.clang
• Target EVM version (as per compiler settings): N/A
• Framework/IDE (e.g. Truffle or Remix): N/A
• EVM execution environment / backend / blockchain client: N/A
• Operating system: Ubuntu 18.04 in docker

Steps to Reproduce

Save this contract in shrink.sol (or whatever filename)

contract C {
    function f( bytes calldata x,bool cond) external pure {
        bytes1 a = x[cond - 1 : 2]. a;
	if (0==1)
	    if (0<1)
		continue;
    }
}

produces:

> solc shrink.sol 
Internal compiler error during compilation:
/home/user/solidity/libsolidity/ast/Types.h(797): Throw in function virtual std::unique_ptr<ReferenceType> solidity::frontend::ArraySliceType::copyForLocation(solidity::frontend::DataLocation, bool) const
Dynamic exception type: boost::exception_detail::clone_impl<solidity::langutil::InternalCompilerError>
std::exception::what: 
[solidity::util::tag_comment*] = 

[chriseth]

Might be related to the other calldata storage location works we are doing.

[axic]

Still in issue on today's develop.

[Marenz]

Reduced testcase:

contract C {
    function f(uint[2] calldata x) external pure {
        x[1:2]. a;
    }
}