ICE with returns_nonnull in optimized builds

reduced test case:
```c++
class a {};
template class c {
friend b d(c) __attribute__((returns_nonnull)) {
b e;
return e;
}
};
template c f();
c h = f();
void g() { d(h); }
```

crashes when building with -O1 or higher:
```
0. Program arguments: /usr/lib/llvm-21/bin/clang -cc1 -triple x86_64-pc-linux-gnu -O1 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name test_non_null-0eb1a1.cpp -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/tim/reduc -fcoverage-compilation-dir=/home/tim/reduc -resource-dir /usr/lib/llvm-21/lib/clang/21 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/x86_64-linux-gnu/c++/15 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/backward -internal-isystem /usr/lib/llvm-21/lib/clang/21/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/15/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdeprecated-macro -ferror-limit 19 -fmessage-length=281 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcxx-exceptions -fexceptions -fcolor-diagnostics -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/test_non_null-0eb1a1-d7f016.o -x c++ /home/tim/reduc/test_non_null-0eb1a1.cpp
1. parser at end of file
2. Optimizer
3. Running pass "require,function(invalidate),require,cgscc(devirt<4>(inline,function-attrs,function(sroa,early-cse,simplifycfg,instcombine,libcalls-shrinkwrap,simplifycfg,reassociate,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,loop-deletion,loop-unroll-full),sroa,memcpyopt,sccp,bdce,instcombine,coro-elide,adce,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide)),function(invalidate),cgscc(devirt<4>())" on module "/home/tim/reduc/test_non_null-0eb1a1.cpp"
4. Running pass "cgscc(devirt<4>(inline,function-attrs,function(sroa,early-cse,simplifycfg,instcombine,libcalls-shrinkwrap,simplifycfg,reassociate,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,loop-deletion,loop-unroll-full),sroa,memcpyopt,sccp,bdce,instcombine,coro-elide,adce,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide))" on module "/home/tim/reduc/test_non_null-0eb1a1.cpp"
#0 0x000079671f8d9baf llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x44d9baf)
#1 0x000079671f8d7457 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x44d7457)
#2 0x000079671f8da99a (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x44da99a)
#3 0x000079671ac45cb0 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x45cb0)
#4 0x000079672062b5fe llvm::InlineFunction(llvm::CallBase&, llvm::InlineFunctionInfo&, bool, llvm::AAResults*, bool, llvm::Function*, llvm::OptimizationRemarkEmitter*) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x522b5fe)
#5 0x0000796720c62967 llvm::InlinerPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5862967)
#6 0x0000796720c67056 (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5867056)
#7 0x0000796720ffb27a llvm::PassManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5bfb27a)
#8 0x0000796720c672c6 (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x58672c6)
#9 0x0000796720ffcd9e llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5bfcd9e)
#10 0x0000796720c67776 (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5867776)
#11 0x0000796720ffc62a llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5bfc62a)
#12 0x0000796720c67606 (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5867606)
#13 0x000079671fa87ba5 llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x4687ba5)
#14 0x0000796720c64a2e llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x5864a2e)
#15 0x0000796723230be6 (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x7e30be6)
#16 0x000079671fa87ba5 llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/usr/lib/llvm-21/bin/../lib/libLLVM.so.21.1+0x4687ba5)
#17 0x00007967260168ab (/usr/lib/llvm-21/bin/../lib/libclang-cpp.so.21.1+0x26168ab)
#18 0x000079672600deb9 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr>, clang::BackendConsumer*) (/usr/lib/llvm-21/bin/../lib/libclang-cpp.so.21.1+0x260deb9)
#19 0x000079672630c724 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/usr/lib/llvm-21/bin/../lib/libclang-cpp.so.21.1+0x290c724)
#20 0x0000796724e7a8d9 clang::ParseAST(clang::Sema&, bool, bool) (/usr/lib/llvm-21/bin/../lib/libclang-cpp.so.21.1+0x147a8d9)
#21 0x0000796726aa71e2 clang::FrontendAction::Execute() (/usr/lib/llvm-21/bin/../lib/libclang-cpp.so.21.1+0x30a71e2)
#22 0x0000796726a1ac74 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/usr/lib/llvm-21/bin/../lib/libclang-cpp.so.21.1+0x301ac74)
#23 0x0000796726b2ec2c clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/usr/lib/llvm-21/bin/../lib/libclang-cpp.so.21.1+0x312ec2c)
#24 0x0000601ec33f948a cc1_main(llvm::ArrayRef, char const*, void*) (/usr/lib/llvm-21/bin/clang+0x1348a)
#25 0x0000601ec33f6024 (/usr/lib/llvm-21/bin/clang+0x10024)
#26 0x0000601ec33f53f7 clang_main(int, char**, llvm::ToolContext const&) (/usr/lib/llvm-21/bin/clang+0xf3f7)
#27 0x0000601ec3403f53 main (/usr/lib/llvm-21/bin/clang+0x1df53)
#28 0x000079671ac2a601 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:83:3
#29 0x000079671ac2a718 call_init ./csu/../csu/libc-start.c:128:20
#30 0x000079671ac2a718 __libc_start_main ./csu/../csu/libc-start.c:347:5
#31 0x0000601ec33f3d55 _start (/usr/lib/llvm-21/bin/clang+0xdd55)
```