c++: Fix tsubst ICE with invalid static_cast [PR95728]

Since r11-423 tsubst_copy_and_build/TREE_LIST uses tsubst_tree_list
instead of open coding it.  While the latter could return an error
node wrapped in a TREE_LIST, the former can return a naked error node.

That broke in tsubst_copy_and_build/NEW_EXPR:
  tree placement = RECUR (TREE_OPERAND (t, 0));
  // placement is now error_mark_node, so...
  for (; placement != NULL_TREE; placement = TREE_CHAIN (placement))
  // ... this crashes

If we just return, we avoid the ICE and improve the diagnostic a bit.

gcc/cp/ChangeLog:

	PR c++/95728
	* pt.c (tsubst_copy_and_build) <case NEW_EXPR>: Return error_mark_node
	if placement is erroneous.

gcc/testsuite/ChangeLog:

	PR c++/95728
	* g++.dg/template/cast6.C: New test.

gcc/cp/pt.c

@@ -19633,6 +19633,8 @@ tsubst_copy_and_build (tree t,
 
 	if (placement == NULL_TREE)
 	  placement_vec = NULL;
+	else if (placement == error_mark_node)
+	  RETURN (error_mark_node);
 	else
 	  {
 	    placement_vec = make_tree_vector ();

gcc/testsuite/g++.dg/template/cast6.C

@@ -0,0 +1,19 @@
+// PR c++/95728
+
+template<typename T>
+  void
+  construct(T* p)
+  { ::new(static_cast<void*>(p)) T; } // { dg-error "invalid .static_cast." }
+
+template<typename T>
+void
+f(const T* t)
+{
+  construct(t);
+}
+
+int main()
+{
+  int i[1];
+  f(i);
+}