cmd/compile: "bad ptr to array in slice" in SSA slice handling

[prattmic]

#!stacks
"cmd/compile/internal/ssagen.(*state).slice:+14"

Issue created by stacks.

This stack XSjlkw was reported by telemetry:

• compile/bug
• cmd/compile/internal/base.FatalfAt:+3
• cmd/compile/internal/base.Fatalf:=195
• cmd/compile/internal/ssagen.(*ssafn).Fatalf:+3
• cmd/compile/internal/ssagen.(*state).Fatalf:+1
• cmd/compile/internal/ssagen.(*state).slice:+14
• cmd/compile/internal/ssagen.(*state).exprCheckPtr:+619
• cmd/compile/internal/ssagen.(*state).expr:=2776
• cmd/compile/internal/ssagen.(*state).stmt:+252
• cmd/compile/internal/ssagen.(*state).stmtList:=1442
• cmd/compile/internal/ssagen.buildssa:+277
• cmd/compile/internal/ssagen.Compile:+1
• cmd/compile/internal/gc.compileFunctions.func5.1:+1
• cmd/compile/internal/gc.compileFunctions.func2:+1
• cmd/compile/internal/gc.compileFunctions.func5:+4
• cmd/compile/internal/gc.compileFunctions.func5.1:+2
• cmd/compile/internal/gc.compileFunctions.func2:+1

cmd/compile@go1.23.2 go1.23.2 linux/amd64 (8)

https://cs.opensource.google/go/go/+/refs/tags/go1.23.2:src/cmd/compile/internal/ssagen/ssa.go;l=6151;drc=a130fb63091bf3103bb7baabbd2484f7e560edae

func (s *state) slice(v, i, j, k *ssa.Value, bounded bool) (p, l, c *ssa.Value) {
	t := v.Type
	var ptr, len, cap *ssa.Value
	switch {
...
	case t.IsPtr():
		if !t.Elem().IsArray() {
			s.Fatalf("bad ptr to array in slice %v\n", t)
		}

cc @golang/compiler

[randall77]

Not sure how this could happen. We're trying to compile the slice of a pointer, but it isn't a pointer to an array.
I don't think the frontend should let such code through - it should fail typecheck.
Possibly this is something that could be triggered with generics? Maybe the right underlying types setup would let it happen? I tried a bunch of combinations but either the frontend reported a typecheck error or the backend compiled successfully.

@griesemer