analyzer: fix ICE on 'bind' that returns a struct [PR107788]

gcc/analyzer/ChangeLog:
	PR analyzer/107788
	* region-model.cc (region_model::update_for_int_cst_return):
	Require that the return type be an integer type.
	(region_model::update_for_nonzero_return): Likewise.

gcc/testsuite/ChangeLog:
	PR analyzer/107788
	* g++.dg/analyzer/fd-bind-pr107783.C: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 1d5b09a..e71fd41 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -1930,6 +1930,8 @@
 {
   if (!cd.get_lhs_type ())
     return;
+  if (TREE_CODE (cd.get_lhs_type ()) != INTEGER_TYPE)
+    return;
   const svalue *result
     = m_mgr->get_or_create_int_cst (cd.get_lhs_type (), retval);
   if (unmergeable)
@@ -1955,6 +1957,8 @@
 {
   if (!cd.get_lhs_type ())
     return;
+  if (TREE_CODE (cd.get_lhs_type ()) != INTEGER_TYPE)
+    return;
   const svalue *zero
     = m_mgr->get_or_create_int_cst (cd.get_lhs_type (), 0);
   const svalue *result
diff --git a/gcc/testsuite/g++.dg/analyzer/fd-bind-pr107783.C b/gcc/testsuite/g++.dg/analyzer/fd-bind-pr107783.C
new file mode 100644
index 0000000..eb5e23c
--- /dev/null
+++ b/gcc/testsuite/g++.dg/analyzer/fd-bind-pr107783.C
@@ -0,0 +1,11 @@
+// { dg-do compile { target c++11 } }
+
+struct minus {
+} _1;
+int _2;
+struct _Bind {
+  _Bind(_Bind &);
+};
+template <typename _Func, typename _BoundArgs>
+_Bind bind(_Func, _BoundArgs &&...);
+void test01() { bind(minus(), _2, _1); }