analyzer: fix ICE on function pointer casts [PR 93775]

PR analyzer/93775 reports an ICE in cgraph_node::get when -fanalyzer is
used on code that calls a function pointer that was generated via a cast
from a non-function.

This patch fixes it by bulletproofing region_model::get_fndecl_for_call
for the case where the code_region's get_tree_for_child_region returns
NULL.

gcc/analyzer/ChangeLog:
	PR analyzer/93775
	* region-model.cc (region_model::get_fndecl_for_call): Handle the
	case where the code_region's get_tree_for_child_region returns
	NULL.

gcc/testsuite/ChangeLog:
	PR analyzer/93775
	* gcc.dg/analyzer/20020129-1.c: New test.

gcc/analyzer/ChangeLog

 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
 
+	PR analyzer/93775
+	* region-model.cc (region_model::get_fndecl_for_call): Handle the
+	case where the code_region's get_tree_for_child_region returns
+	NULL.
+
+2020-02-17  David Malcolm  <dmalcolm@redhat.com>
+
 	PR analyzer/93388
 	* engine.cc (impl_region_model_context::on_unknown_tree_code):
 	New.

gcc/analyzer/region-model.cc

@@ -6693,6 +6693,8 @@ region_model::get_fndecl_for_call (const gcall *call,
       if (code)
 	{
 	  tree fn_decl = code->get_tree_for_child_region (fn_rid);
+	  if (!fn_decl)
+	    return NULL_TREE;
 	  const cgraph_node *ultimate_node
 	    = cgraph_node::get (fn_decl)->ultimate_alias_target ();
 	  if (ultimate_node)

gcc/testsuite/ChangeLog

+2020-02-17  David Malcolm  <dmalcolm@redhat.com>
+
+	PR analyzer/93775
+	* gcc.dg/analyzer/20020129-1.c: New test.
+
 2020-02-17  Alexandre Oliva <oliva@adacore.com>
 
 	* gcc.dg/tls/emutls-3.c: New, combining emutls-2.c and

gcc/testsuite/gcc.dg/analyzer/20020129-1.c

+/* { dg-require-effective-target indirect_calls } */
+#include "../../gcc.c-torture/compile/20020129-1.c"