Fix ICE by avoiding copyForLocation() on ArraySliceType

libsolidity/analysis/TypeChecker.cpp

@@ -2555,7 +2555,7 @@ bool TypeChecker::visit(MemberAccess const& _memberAccess)
 
 	if (possibleMembers.empty())
 	{
-		if (initialMemberCount == 0)
+		if (initialMemberCount == 0 && !dynamic_cast<ArraySliceType const*>(exprType))
 		{
 			// Try to see if the member was removed because it is only available for storage types.
 			auto storageType = TypeProvider::withLocationIfReference(

libsolidity/ast/Types.cpp

@@ -349,14 +349,17 @@ TypePointer Type::fullEncodingType(bool _inLibraryCall, bool _encoderV2, bool) c
 MemberList::MemberMap Type::boundFunctions(Type const& _type, ContractDefinition const& _scope)
 {
 	// Normalise data location of type.
-	TypePointer type = TypeProvider::withLocationIfReference(DataLocation::Storage, &_type);
+	DataLocation typeLocation = DataLocation::Storage;
+	if (auto refType = dynamic_cast<ReferenceType const*>(&_type))
+		typeLocation = refType->location();
+
 	set<Declaration const*> seenFunctions;
 	MemberList::MemberMap members;
 	for (ContractDefinition const* contract: _scope.annotation().linearizedBaseContracts)
 		for (UsingForDirective const* ufd: contract->usingForDirectives())
 		{
-			if (ufd->typeName() && *type != *TypeProvider::withLocationIfReference(
-				DataLocation::Storage,
+			if (ufd->typeName() && _type != *TypeProvider::withLocationIfReference(
+				typeLocation,
 				ufd->typeName()->annotation().type
 			))
 				continue;

test/libsolidity/syntaxTests/array/slice/member_access.sol

@@ -0,0 +1,8 @@
+// Used to cause ICE
+contract C {
+    function f(uint[] calldata x) external pure {
+        x[1:2].a;
+    }
+}
+// ----
+// TypeError: (92-100): Member "a" not found or not visible after argument-dependent lookup in uint256[] calldata slice.