Here's a link to the bug in question: https://github.com/rust-lang/rust/issues/10184 , which can be realized by casting floats whose value is beyond a certain threshold to integers and then using them to index. The ultimate fix will probably involve migrating away from using LLVM's provided conversion intrinsics and implementing custom support that doesn't invoke undefined behavior.

Interesting observation -- just because I've checked `%i` is within array bounds, doesn't mean `a[%i]` is safe to access, since `%i` could be `undef` and pass the range check spuriously.

Yeah. And range checks are used to take subslices, so you can take a "sub"slice that's half the memory space, and you have unchecked access to everything after that point :-)