ICE: integer overflow in heap_opt::taint_range with --newyork on valid Yul

resolc --yul --newyork --bin panics with "attempt to add with overflow" at crates/newyork/src/optimizer/heap_opt.rs:724 on valid Yul input. The panic occurs in the taint_range function when processing mstore(add(mul(MAX_U256, 1), 0x41), v) — the multiplication+addition overflows usize in range arithmetic.

MRE:

object "C" {
  code { datacopy(0, dataoffset("C_deployed"), datasize("C_deployed")) return(0, datasize("C_deployed")) }
  object "C_deployed" {
    code {
      mstore(0x40, 0x80)
      mstore(add(mul(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff, 1), 0x41),
             0x000000000000000000000000000000000000000000000000ffffffffffffffff)
      let fmp := mload(0x40)
      let f2 := mload(0x40)
      mstore(f2, 0xC0FFEE)
      let rb := mload(f2)
      mstore(0, fmp)
      mstore(32, rb)
      return(0, 64)
    }
  }
}

To reproduce:

$ resolc --yul --bin -O 3            # OK
$ resolc --yul --newyork --bin -O 3  # PANIC at heap_opt.rs:724

The Yul is valid — mul(MAX_U256, 1) produces MAX_U256, and add(MAX_U256, 0x41) is valid 256-bit arithmetic. The optimizer assumes U256 values fit in usize in taint_range.

Git commit: ed95ffbdfe9e70a800fd0e227c0529940bbc2637; LLVM 22.1.5; resolc v1.4.0+commit.ed95ffb.

Suggested fix: use checked arithmetic (.checked_add(), usize::try_from) in taint_range at heap_opt.rs:724 rather than assuming U256 values fit in usize.

Several aliases share the same panic site: large MStore offsets and zero-length copy paths all trigger the same "attempt to add with overflow" at heap_opt.rs:724.