tree-optimization/117912 - bogus address equivalences for __builtin_object_size

VN again is the culprit for exploiting address equivalences before
__builtin_object_size got the chance to do its job.  This time
it isn't about union members but adjacent structure fields where
an address to one after the last element of an array field can
spill over to the next field.

The following protects all out-of-bound accesses on the upper bound
side (singling out TYPE_MAX_VALUE + 1 is more expensive).  It
ignores other out-of-bound addresses that would invoke UB.

Zero-sized arrays are a bit awkward because the C++ represents them
with a -1U upper bound.

There's a similar issue for zero-sized components whose address can
be the same as the adjacent field in C.

	PR tree-optimization/117912
	* tree-ssa-sccvn.cc (copy_reference_ops_from_ref): For addresses
	of zero-sized components do not set ->off if the object size pass
	didn't run.
	For OOB ARRAY_REF accesses in address expressions avoid setting
	->off if the object size pass didn't run.
	(valueize_refs_1): Likewise.

	* c-c++-common/torture/pr117912-1.c: New testcase.
	* c-c++-common/torture/pr117912-2.c: Likewise.
	* c-c++-common/torture/pr117912-3.c: Likewise.