tree-optimization/114048 - ICE in copy_reference_ops_from_ref

The following adds another omission to the assert verifying we're
not running into spurious off == -1.

	PR tree-optimization/114048
	* tree-ssa-sccvn.cc (copy_reference_ops_from_ref): MEM_REF
	can also produce -1 off.

	* gcc.dg/torture/pr114048.c: New testcase.

gcc/testsuite/gcc.dg/torture/pr114048.c

@@ -0,0 +1,25 @@
+/* { dg-do compile } */
+
+typedef struct {
+  void *child[2];
+  char otherbits;
+} critbit0_node;
+
+int allprefixed_traverse(char *top)
+{
+  if (top)
+    {
+      critbit0_node *q = (void *)top - 1;
+      int direction = 0;
+      for (;; ++direction)
+	switch (allprefixed_traverse(q->child[direction]))
+	  {
+	  case 1:
+	    break;
+	  case 0:
+	    return 0;
+	  default:
+	    return 1;
+	  }
+    }
+}

gcc/tree-ssa-sccvn.cc

@@ -1185,6 +1185,8 @@ copy_reference_ops_from_ref (tree ref, vec<vn_reference_op_s> *result)
 	      else
 		{
 		  gcc_assert (known_ne (op.off, -1)
+			      /* The constant offset can be -1.  */
+			      || op.opcode == MEM_REF
 			      /* Out-of-bound indices can compute to
 				 a known -1 offset.  */
 			      || ((op.opcode == ARRAY_REF