Add a minimal reproducer of the ICE

Co-authored-by: Ralf Jung <post@ralfj.de>

tests/pass/issues/issue-miri-2389.rs

@@ -0,0 +1,17 @@
+use std::cell::Cell;
+
+fn main() {
+    unsafe {
+        let root0 = Cell::new(42);
+        let wildcard = &root0 as *const Cell<i32> as usize as *const Cell<i32>;
+        // empty the stack to unknown (via SRW reborrow from wildcard)
+        let _ref0 = &*wildcard;
+        // Do a non-SRW reborrow from wildcard to start building up a stack again.
+        // Now new refs start being inserted at idx 0, pushing the unique_range up.
+        let _refn = &*&*&*&*&*(wildcard.cast::<i32>());
+        // empty the stack again, but this time with unique_range.start sitting at some high index.
+        let _ref0 = &*wildcard;
+        // and do a read which tries to clear the uniques
+        wildcard.cast::<i32>().read();
+    }
+}

tests/pass/issues/issue-miri-2389.stderr

@@ -0,0 +1,15 @@
+warning: integer-to-pointer cast
+  --> $DIR/issue-miri-2389.rs:LL:CC
+   |
+LL |         let wildcard = &root0 as *const Cell<i32> as usize as *const Cell<i32>;
+   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ integer-to-pointer cast
+   |
+   = help: This program is using integer-to-pointer casts or (equivalently) `ptr::from_exposed_addr`,
+   = help: which means that Miri might miss pointer bugs in this program.
+   = help: See https://doc.rust-lang.org/nightly/std/ptr/fn.from_exposed_addr.html for more details on that operation.
+   = help: To ensure that Miri does not miss bugs in your program, use Strict Provenance APIs (https://doc.rust-lang.org/nightly/std/ptr/index.html#strict-provenance, https://crates.io/crates/sptr) instead.
+   = help: You can then pass the `-Zmiri-strict-provenance` flag to Miri, to ensure you are not relying on `from_exposed_addr` semantics.
+   = help: Alternatively, the `-Zmiri-permissive-provenance` flag disables this warning.
+   = note: backtrace:
+   = note: inside `main` at $DIR/issue-miri-2389.rs:LL:CC
+