Segfault when failing to cast subexpression to 'isz' in pointer subtraction #2305.

releasenotes.md

@@ -52,6 +52,7 @@
 - Resize bug when resizing memory down in ArenaAllocator, DynamicArenaAllocator, BackedArenaAllocator.
 - Error message for missing arg incorrect for methods with zero args #2296.
 - Fix stringify of $vaexpr #2301.
+- Segfault when failing to cast subexpression to 'isz' in pointer subtraction #2305.
 
 ### Stdlib changes
 - Improve contract for readline. #2280

src/compiler/sema_expr.c

@@ -7352,7 +7352,7 @@ static bool sema_expr_analyse_sub(SemaContext *context, Expr *expr, Expr *left,
 		}
 
 		// 6. Convert to isz
-		if (!cast_implicit_binary(context, right, offset_type, failed_ref)) return true;
+		if (!cast_implicit_binary(context, right, offset_type, failed_ref)) return false;
 
 		if (left->expr_kind == EXPR_POINTER_OFFSET)
 		{

test/test_suite/expressions/sub_pointer_cast_fail.c3

@@ -0,0 +1,11 @@
+fn int main()
+{
+	int ctrl = 0;
+	char* op;
+	if (ctrl >= 32)
+	{
+		uint len = (ctrl >> 5) - 1;
+        char* ref = op - ((ctrl & 31) << 8) - 1; // #error: an explicit cast to 'isz'
+	}
+	return 0;
+}