gcc-ia16 crashes when compiling a _fmemcpy function which uses C99 variable-length arrays

[tkchia]

$ cat foo.c
void
_fmemcpy (void __far *dest, const void __far *src, unsigned n)
{
  typedef struct __attribute__ ((packed))
    {
      char x[n];
    } buf_t;
  * (buf_t __far *) dest = * (const buf_t __far *) src;
}
$ ia16-elf-gcc -Os -S foo.c
trying to convert pointer or address in address space 0
with unexpected mode:
(reg/v/f:SI 24 [ dest ])
foo.c: In function ‘_fmemcpy’:
foo.c:8:26: internal compiler error: in convert_memory_address_addr_space_1, at explow.c:315
   * (buf_t __far *) dest = * (const buf_t __far *) src;
   ~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x70be2f convert_memory_address_addr_space_1(machine_mode, rtx_def*, unsigned char, bool, bool)
	../../gcc-ia16/gcc/explow.c:315
0x70bf75 convert_memory_address_addr_space(machine_mode, rtx_def*, unsigned char)
	../../gcc-ia16/gcc/explow.c:417
0x70bf75 memory_address_addr_space(machine_mode, rtx_def*, unsigned char)
	../../gcc-ia16/gcc/explow.c:431
0x630fe3 get_memory_rtx
	../../gcc-ia16/gcc/builtins.c:1241
0x636fba expand_builtin_memcpy_args
	../../gcc-ia16/gcc/builtins.c:2930
0x63ca0d expand_builtin_memcpy
	../../gcc-ia16/gcc/builtins.c:2991
0x63ca0d expand_builtin(tree_node*, rtx_def*, rtx_def*, machine_mode, int)
	../../gcc-ia16/gcc/builtins.c:5965
0x720cec expand_expr_real_1(tree_node*, rtx_def*, machine_mode, expand_modifier, rtx_def**, bool)
	../../gcc-ia16/gcc/expr.c:10639
0x653fbd expand_expr
	../../gcc-ia16/gcc/expr.h:256
0x653fbd expand_call_stmt
	../../gcc-ia16/gcc/cfgexpand.c:2660
0x653fbd expand_gimple_stmt_1
	../../gcc-ia16/gcc/cfgexpand.c:3548
0x653fbd expand_gimple_stmt
	../../gcc-ia16/gcc/cfgexpand.c:3714
0x65551e expand_gimple_tailcall
	../../gcc-ia16/gcc/cfgexpand.c:3761
0x65551e expand_gimple_basic_block
	../../gcc-ia16/gcc/cfgexpand.c:5697
0x65982e execute
	../../gcc-ia16/gcc/cfgexpand.c:6335
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.