[committed] analyzer: fix ICE with -fanalyzer-transitivity [PR104863]

[David Malcolm via Gcc-patches]

Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to trunk as r12-7605-gd016dd7dbb8140f03cde7e2179ebaf9ec3e9d2f1.
gcc/analyzer/ChangeLog:
        PR analyzer/104863
        * constraint-manager.cc (constraint_manager::add_constraint):
        Refresh the EC IDs when adding constraints implied by offsets.

gcc/testsuite/ChangeLog:
        PR analyzer/104863
        * gcc.dg/analyzer/torture/pr104863.c: New test.

Signed-off-by: David Malcolm <dmalc...@redhat.com>
---
 gcc/analyzer/constraint-manager.cc               |  4 ++++
 gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c | 14 ++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c

diff --git a/gcc/analyzer/constraint-manager.cc 
b/gcc/analyzer/constraint-manager.cc
index ac1e4feaee5..9c8c60429f4 100644
--- a/gcc/analyzer/constraint-manager.cc
+++ b/gcc/analyzer/constraint-manager.cc
@@ -1818,6 +1818,10 @@ constraint_manager::add_constraint (const svalue *lhs,
              = m_mgr->get_or_create_constant_svalue (offset_of_cst);
            if (!add_constraint (implied_lhs, implied_op, implied_rhs))
              return false;
+           /* The above add_constraint could lead to EC merger, so we need
+              to refresh the EC IDs.  */
+           lhs_ec_id = get_or_add_equiv_class (lhs);
+           rhs_ec_id = get_or_add_equiv_class (rhs);
          }
 
   add_unknown_constraint (lhs_ec_id, op, rhs_ec_id);
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c 
b/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c
new file mode 100644
index 00000000000..30ed4fe022d
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c
@@ -0,0 +1,14 @@
+/* { dg-additional-options "-fanalyzer-transitivity" } */
+/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
+
+extern void g();
+struct a {
+} b(int c, int d) {
+  struct a *e = 0;
+  int f;
+  if (c & 1 || !(c & 2))
+    return *e;
+  f = 0;
+  for (; f < d - 1; f++)
+    g(e[1]); /* { dg-warning "dereference of NULL" } */
+}
-- 
2.26.3