SCCP can resolve a dynamic array index into an invalid immediate index that's rejected by the verifier

[sbillig]

The verifier requires that immediate indexes are non-negative and within bounds. SCCP can sometimes determine that a "dynamic" index is actually statically known, and convert it to an immediate value. This immediate value might be rejected by the verifier.