bugc: CSE gathers an inlined call site's source range onto an instruction that other paths run #385

At -O2, common subexpression elimination folds an instruction into an earlier one that dominates it and gathers the folded instruction's source ranges onto the one it keeps. When the folded instruction is an inlined body's first instruction, those ranges include the call site's own range (a()), which the inliner gathers there so the call site maps to some instruction. The kept instruction can run on other paths, so the call site then maps to an instruction that runs whether or not the call happens.

name Dispatch;
define {
  function a() { r = msg.data[4:36] as bytes32 as uint256; };
  function b() { s = msg.data[4:36] as bytes32 as uint256 + 1; };
}
storage { [0] r: uint256; [1] s: uint256; }
create { r = 0; }
code {
  if (msg.data[0:4] as bytes4 == 0x00000001) { a(); return; }
  if (msg.data[0:4] as bytes4 == 0x00000002) { b(); return; }
}

At -O2, the dispatch's msg.data read (the first instruction of main, before the selector check) has code ranges for msg.data in main, msg.data in a and in b, and both call sites, a() and b(). Every transaction runs it.

#384 keeps the invoke and return markers off the kept instruction (they move to an instruction on the call's own path). The call site's range is the same kind of path-specific information, but it is a code range gathered with the body's own, so it needs its own handling: for example, a call-site range that stays on the call's path (with the invoke), or one marked apart from the body's ranges so that a merge can leave it out.