https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128356
--- Comment #2 from liu zhenyu <lzy20000419 at outlook dot com> --- PR126536 is the same constructor with exactly 255 pairs: invert () needs 256 pairs and overflows the buffer (ICE /heap corruption). The trunk fix (r17-3206, "Allow range invert to fail") only handles that overflow. Here the first case is 0 (the type minimum) so the inverse fits and invert () succeeds, and the wrong range is used silently. A possible fix is to give up (set both ranges to varying) when the union had to be merged, for example when the number of case ranges on the edge exceeds what the range can hold. Disclaimer: This test case was generated by a fuzzer, and the report was written with LLM assistance.
