analyzer: fix folding of '(PTR + 0) => PTR' [PR105784]

gcc/analyzer/ChangeLog:
	PR analyzer/105784
	* region-model-manager.cc
	(region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
	PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
	type matches that of arg0 in favor of a cast.

gcc/testsuite/ChangeLog:
	PR analyzer/105784
	* gcc.dg/analyzer/torture/fold-ptr-arith-pr105784.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

2 files changed, 47 insertions, 4 deletions

diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index d9a7ae9..ae63c66 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -613,13 +613,13 @@ region_model_manager::maybe_fold_binop (tree type, enum tree_code op,
     case POINTER_PLUS_EXPR:
     case PLUS_EXPR:
       /* (VAL + 0) -> VAL.  */
-      if (cst1 && zerop (cst1) && type == arg0->get_type ())
-	return arg0;
+      if (cst1 && zerop (cst1))
+	return get_or_create_cast (type, arg0);
       break;
     case MINUS_EXPR:
       /* (VAL - 0) -> VAL.  */
-      if (cst1 && zerop (cst1) && type == arg0->get_type ())
-	return arg0;
+      if (cst1 && zerop (cst1))
+	return get_or_create_cast (type, arg0);
       break;
     case MULT_EXPR:
       /* (VAL * 0).  */
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/fold-ptr-arith-pr105784.c b/gcc/testsuite/gcc.dg/analyzer/torture/fold-ptr-arith-pr105784.c
new file mode 100644
index 0000000..5e5a2bf
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/fold-ptr-arith-pr105784.c
@@ -0,0 +1,43 @@
+/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
+
+#include "../analyzer-decls.h"
+
+extern _Bool quit_flag;
+extern void char_charset (int);
+
+static void
+__analyzer_ccl_driver (int *source, int src_size)
+{
+  int *src = source, *src_end = src + src_size;
+  int i = 0;
+
+  while (!quit_flag)
+    {
+      if (src < src_end)
+	{
+	  __analyzer_dump_path (); /* { dg-message "path" } */
+	  i = *src++; /* { dg-bogus "uninit" } */
+	}
+      char_charset (i);
+    }
+}
+
+void
+Fccl_execute_on_string (char *str, long str_bytes)
+{
+  while (1)
+    {
+      char *p = str;
+      char *endp = str + str_bytes;
+      int source[1024];
+      int src_size = 0;
+
+      while (src_size < 1024 && p < endp)
+	{
+	  __analyzer_dump_path (); /* { dg-message "path" } */
+	  source[src_size++] = *p++;
+	}
+
+      __analyzer_ccl_driver (source, src_size);
+    }
+}