[gcc r12-7605] analyzer: fix ICE with -fanalyzer-transitivity [PR104863]

[David Malcolm <dmalcolm@gcc.gnu.org>]

https://gcc.gnu.org/g:d016dd7dbb8140f03cde7e2179ebaf9ec3e9d2f1

commit r12-7605-gd016dd7dbb8140f03cde7e2179ebaf9ec3e9d2f1
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Mar 10 16:52:01 2022 -0500

    analyzer: fix ICE with -fanalyzer-transitivity [PR104863]
    
    gcc/analyzer/ChangeLog:
            PR analyzer/104863
            * constraint-manager.cc (constraint_manager::add_constraint):
            Refresh the EC IDs when adding constraints implied by offsets.
    
    gcc/testsuite/ChangeLog:
            PR analyzer/104863
            * gcc.dg/analyzer/torture/pr104863.c: New test.
    
    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

Diff:
---
 gcc/analyzer/constraint-manager.cc               |  4 ++++
 gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c | 14 ++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/gcc/analyzer/constraint-manager.cc b/gcc/analyzer/constraint-manager.cc
index ac1e4feaee5..9c8c60429f4 100644
--- a/gcc/analyzer/constraint-manager.cc
+++ b/gcc/analyzer/constraint-manager.cc
@@ -1818,6 +1818,10 @@ constraint_manager::add_constraint (const svalue *lhs,
 	      = m_mgr->get_or_create_constant_svalue (offset_of_cst);
 	    if (!add_constraint (implied_lhs, implied_op, implied_rhs))
 	      return false;
+	    /* The above add_constraint could lead to EC merger, so we need
+	       to refresh the EC IDs.  */
+	    lhs_ec_id = get_or_add_equiv_class (lhs);
+	    rhs_ec_id = get_or_add_equiv_class (rhs);
 	  }
 
   add_unknown_constraint (lhs_ec_id, op, rhs_ec_id);
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c b/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c
new file mode 100644
index 00000000000..30ed4fe022d
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/pr104863.c
@@ -0,0 +1,14 @@
+/* { dg-additional-options "-fanalyzer-transitivity" } */
+/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
+
+extern void g();
+struct a {
+} b(int c, int d) {
+  struct a *e = 0;
+  int f;
+  if (c & 1 || !(c & 2))
+    return *e;
+  f = 0;
+  for (; f < d - 1; f++)
+    g(e[1]); /* { dg-warning "dereference of NULL" } */
+}