[SMTChecker] Fix ICE in branch-inline function call-modify local variable

test/libsolidity/smtCheckerTests/control_flow/function_call_inside_branch.sol

@@ -0,0 +1,20 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f() public pure {
+		if (true) {
+			address a = g();
+			assert(a == address(0));
+		}
+	}
+	function g() public pure returns (address) {
+		address a;
+		a = address(0);
+		return a;
+	}
+}
+// ----
+// Warning: (208-218): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (123-133): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (208-218): Type conversion is not yet fully supported and might yield false positives.

test/libsolidity/smtCheckerTests/control_flow/function_call_inside_branch_2.sol

@@ -0,0 +1,27 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f() public pure {
+		if (true) {
+			address a = g();
+			assert(a == address(0));
+		}
+		else
+		{
+			address b = g();
+			assert(b == address(0));
+		}
+	}
+	function g() public pure returns (address) {
+		address a;
+		a = address(0);
+		return a;
+	}
+}
+// ----
+// Warning: (271-281): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (123-133): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (271-281): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (186-196): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (271-281): Type conversion is not yet fully supported and might yield false positives.

test/libsolidity/smtCheckerTests/control_flow/function_call_inside_branch_3.sol

@@ -0,0 +1,27 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f() public pure {
+		if (true) {
+			address a = g();
+			assert(a == address(0));
+		}
+		if (true) {
+			address a = g();
+			assert(a == address(0));
+		}
+
+	}
+	function g() public pure returns (address) {
+		address a;
+		a = address(0);
+		return a;
+	}
+}
+// ----
+// Warning: (275-285): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (123-133): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (275-285): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (189-199): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (275-285): Type conversion is not yet fully supported and might yield false positives.

test/libsolidity/smtCheckerTests/control_flow/function_call_inside_branch_4.sol

@@ -0,0 +1,31 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f() public pure {
+		if (true) {
+			address a = g();
+			assert(a == address(0));
+		}
+		if (true) {
+			address a = h();
+			assert(a == address(0));
+		}
+
+	}
+	function g() public pure returns (address) {
+		address a;
+		a = address(0);
+		return a;
+	}
+	function h() public pure returns (address) {
+		address a;
+		return a;
+	}
+
+}
+// ----
+// Warning: (275-285): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (123-133): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (189-199): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (275-285): Type conversion is not yet fully supported and might yield false positives.

test/libsolidity/smtCheckerTests/control_flow/function_call_inside_else_branch.sol

@@ -0,0 +1,21 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f() public pure {
+		if (true) {
+		} else {
+			address a = g();
+			assert(a == address(0));
+		}
+	}
+	function g() public pure returns (address) {
+		address x;
+		x = address(0);
+		return x;
+	}
+}
+// ----
+// Warning: (219-229): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (134-144): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (219-229): Type conversion is not yet fully supported and might yield false positives.

test/libsolidity/smtCheckerTests/control_flow/function_call_inside_modifier_branch.sol

@@ -0,0 +1,24 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	modifier m(address a) {
+		if (true) {
+			a = g();
+			_;
+			assert(a == address(0));
+		}
+	}
+
+	function f(address a) m(a) public pure {
+	}
+	function g() public pure returns (address) {
+		address a;
+		a = address(0);
+		return a;
+	}
+}
+// ----
+// Warning: (249-259): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (118-128): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (249-259): Type conversion is not yet fully supported and might yield false positives.

test/libsolidity/smtCheckerTests/control_flow/function_call_inside_placeholder_inside_modifier_branch.sol

@@ -0,0 +1,25 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	modifier m {
+		if (true)
+			_;
+	}
+
+	function f(address a) m public pure {
+		if (true) {
+			a = g();
+			assert(a == address(0));
+		}
+	}
+	function g() public pure returns (address) {
+		address a;
+		a = address(0);
+		return a;
+	}
+}
+// ----
+// Warning: (247-257): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (162-172): Type conversion is not yet fully supported and might yield false positives.
+// Warning: (247-257): Type conversion is not yet fully supported and might yield false positives.