analyzer: add test coverage for fixed ICE [PR94047]

PR analyzer/94047 reports an ICE, which turned out to be caused
by the erroneous use of TREE_TYPE on the view region's type
in region_model::get_representative_path_var that I introduced
in r10-7024-ge516294a and
fixed in g:787477a226033e36be3f6d16b71be13dd917e982.

This patch adds a regression test for the ICE.

gcc/testsuite/ChangeLog:
	PR analyzer/94047
	* gcc.dg/analyzer/pr94047.c: New test.

gcc/testsuite/ChangeLog

+2020-03-18  David Malcolm  <dmalcolm@redhat.com>
+
+	PR analyzer/94047
+	* gcc.dg/analyzer/pr94047.c: New test.
+
 2020-03-18   Richard Biener  <rguenther@suse.de>
 
 	PR middle-end/94206

gcc/testsuite/gcc.dg/analyzer/pr94047.c

+/* { dg-additional-options "-Wno-analyzer-too-complex" } */
+/* TODO: the above ought not to be necessary, but currently is due to a
+   state explosion within the for loop.  */
+
+typedef struct list
+{
+  struct list *next;
+} tlist;
+
+void
+bar (struct list *l)
+{
+  l->next = l->next->next;
+}
+
+void
+foo (void)
+{
+  struct list l;
+  tlist t = l;
+  for (;;)
+    bar (&t);
+}