Fix false negative on storage array references returned by internal functions

test/libsolidity/smtCheckerTests/array_members/push_function_return_value.sol

@@ -0,0 +1,20 @@
+contract C {
+	bytes x;
+
+	function getX() internal view returns (bytes storage) {
+		return x;
+	}
+
+	function s() public {
+		require(x.length == 0);
+		getX().push("a");
+		assert(x.length == 1); // should hold but knowledge is erased due to pushing a reference
+		assert(x.length == 0); // should fail
+	}
+}
+// ====
+// SMTEngine: all
+// SMTIgnoreCex: yes
+// ----
+// Warning 6328: (168-189): CHC: Assertion violation happens here.
+// Warning 6328: (259-280): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/array_members/storage_pointer_push_1.sol

@@ -17,4 +17,5 @@ contract C {
 // SMTEngine: all
 // SMTIgnoreCex: yes
 // ----
+// Warning 6368: (159-169): CHC: Out of bounds access happens here.
 // Warning 6328: (152-181): CHC: Assertion violation happens here.