transform: track escapes through nested aggregate results

[davecheney]

Escape analysis follows pointers returned by a callee, but stops at
extractvalue when the extracted value is an aggregate. This loses
pointers inside the aggregate and can place escaping allocations on the
stack, leaving callers with pointers to dead stack storage. This was
possibly introduced in 27f8ec1.

The effect is not limited to multiple return values and single array
returns. A slice returned alongside another value, an escape to a
package-level variable, a capture by a closure, a value reaching the
return through a phi, a non-error interface and multi-level forwarding
chains are all affected, at every optimisation level that runs
OptimizeAllocs.

Follow extracted values whose types contain pointers. Share the
recursive type check used by GC root discovery so pointer-free
aggregates and zero-length arrays do not cause unnecessary heap
allocations. extractvalue was the only unsound arm of the opcode
switch: getelementptr, bitcast and insertvalue already recurse, load
and icmp are safe, store escapes when the value is the stored operand,
ret is gated on allowReturn, and everything else falls through to the
conservative default.

Binary size is unchanged. The -size=short output is byte-identical for
testdata/json.go, testdata/stdlib.go, testdata/map.go, microbit with
examples/serial, and pico with examples/machinetest.

Expand IR and Go coverage for nested aggregates, forwarding calls,
escape destinations and nonescaping uses. Add runtime regressions with
volatile stack writes so optimization cannot remove the stack clobber.

[davecheney]

@deadprogram i'm still validating this, but please keep this on the list of 0.43; this is a possible escape analysis issue.

[davecheney]

@deadprogram @jakebailey @dgryski i'm marking this ready for review. I've thrown every tool I have at this. The bulk of this PR are test fixtures which all fail without the fix. I'm confident they demonstrate an escape analysis failure. I'm also reasonably confident they fix the bug they demonstrate.

[deadprogram]

Thank you for working on this. I tested locally and it does what it promises. Now merging!

[dgryski]

I'm amazed nothing in the test corpus hit this (at least not obviously..)