analyzer: fix ICE with -fanalyzer-transitivity [PR104863]

gcc/analyzer/ChangeLog:
	PR analyzer/104863
	* constraint-manager.cc (constraint_manager::add_constraint):
	Refresh the EC IDs when adding constraints implied by offsets.

gcc/testsuite/ChangeLog:
	PR analyzer/104863
	* gcc.dg/analyzer/torture/pr104863.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

diff --git a/gcc/analyzer/constraint-manager.cc b/gcc/analyzer/constraint-manager.cc
index ac1e4fe..9c8c604 100644 (file)
--- a/gcc/analyzer/constraint-manager.cc
+++ b/gcc/analyzer/constraint-manager.cc
@@ -1818,6 +1818,10 @@ constraint_manager::add_constraint (const svalue *lhs,
              = m_mgr->get_or_create_constant_svalue (offset_of_cst);
            if (!add_constraint (implied_lhs, implied_op, implied_rhs))
              return false;
+           /* The above add_constraint could lead to EC merger, so we need
+              to refresh the EC IDs.  */
+           lhs_ec_id = get_or_add_equiv_class (lhs);
+           rhs_ec_id = get_or_add_equiv_class (rhs);
          }
 
   add_unknown_constraint (lhs_ec_id, op, rhs_ec_id);

diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c b/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c
new file mode 100644 (file)
index 0000000..30ed4fe
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c
@@ -0,0 +1,14 @@
+/* { dg-additional-options "-fanalyzer-transitivity" } */
+/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
+
+extern void g();
+struct a {
+} b(int c, int d) {
+  struct a *e = 0;
+  int f;
+  if (c & 1 || !(c & 2))
+    return *e;
+  f = 0;
+  for (; f < d - 1; f++)
+    g(e[1]); /* { dg-warning "dereference of NULL" } */
+}