inline: bind storage for a parameter the body hands to a ref parameter

The splice substitutes the caller's argument expression for a parameter.
That breaks when the body passes the parameter on to a REF parameter:
the substituted value has no storage, so the inner call stops matching
("can't pass non-ref to ref"), and a program that compiled before the
pass now does not.

Record, per callee parameter, whether it is read as the argument of a ref
parameter, and bind a temp for those instead of substituting - for the
constant case as well as the computed one. A by-value parameter is a copy
in the real call anyway, so the temp is what the un-inlined code did.

Worse than a diagnostic when the substituted value is constant: the
folder then evaluates the native with a value where the C++ signature
wants `const T &` and dereferences storage that was never materialized,
which segfaults the compiler:

    das::FoldingVisitor::evalAndFold -> Context::evalWithCatch -> <native>

The added test covers that shape - a private (so budget-exempt) callee
whose parameter goes to an implicit const-ref native, called with an
expression built from const locals. It crashed the compiler before this
change.

Found in dagor's enlisted: traceray_normalized in shell_fx_common.das
reported as no matching function after get_floor_material_name spliced.

Author: aleksisch

src/ast/ast_inline.cpp

@@ -175,6 +175,10 @@ namespace das {
         struct ParamReadStats {
             das_hash_map<Variable *, int>   readCount;
             das_hash_set<Variable *>        readUnderLoop;
+            // read as the argument of a REF parameter: such a read needs real storage, so the splice
+            // must bind a temp rather than substitute a value. an implicit const-ref native parameter
+            // is the case that bites - it cannot bind a bare value ("can't pass non-ref to ref")
+            das_hash_set<Variable *>        readAsRefArg;
         };
 
         class ParamReadScan : public Visitor {
@@ -201,6 +205,22 @@ namespace das {
                     if ( loopDepth ) stats.readUnderLoop.insert(expr->variable);
                 }
             }
+            void notePos ( ExprCallFunc * call ) {
+                if ( !call->func ) return;
+                for ( size_t i=0, is=call->arguments.size(); i!=is && i!=call->func->arguments.size(); ++i ) {
+                    auto & fa = call->func->arguments[i];
+                    if ( !fa->type || !fa->type->isRef() ) continue;
+                    Expression * a = call->arguments[i];
+                    if ( a && a->rtti_isR2V() ) a = static_cast<ExprRef2Value *>(a)->subexpr;
+                    if ( a && a->rtti_isVar() ) {
+                        auto v = static_cast<ExprVar *>(a)->variable;
+                        if ( v && params.find(v)!=params.end() ) stats.readAsRefArg.insert(v);
+                    }
+                }
+            }
+            virtual void preVisit ( ExprCall * expr ) override { Visitor::preVisit(expr); notePos(expr); }
+            virtual void preVisit ( ExprOp1 * expr ) override { Visitor::preVisit(expr); notePos(expr); }
+            virtual void preVisit ( ExprOp2 * expr ) override { Visitor::preVisit(expr); notePos(expr); }
         };
 
         // ----- cross-module reference scan (splice gate) -----
@@ -2264,6 +2284,11 @@ namespace das {
                         // a mutable by-value param IS a local copy
                         makeArgTemp(A->clone(), false, false, A->type && !A->type->canCopy());
                     } else if ( leafConst ) {
+                        // a constant substituted where the body hands the parameter to a ref parameter
+                        // would stop matching, same as the computed case - bind storage for it
+                        if ( stats.readAsRefArg.find(P)!=stats.readAsRefArg.end() ) {
+                            makeArgTemp(A->clone(), true, false, false);
+                        } else
                         // an enum constant re-resolves its enumeration by name - under a
                         // module-scope wrap that name lands in the wrong module; bind it out
                         if ( needScope && leafA->type && leafA->type->isEnumT() ) {
@@ -2311,7 +2336,13 @@ namespace das {
                         if ( rit != stats.readCount.end() ) reads = rit->second;
                         bool underLoop = stats.readUnderLoop.find(P)!=stats.readUnderLoop.end();
                         bool orderSafe = writeFree || argReadsOnlyPrivateLocals(A, sa);
-                        if ( reads<=1 && !underLoop && inlinePure(A) && orderSafe && !needScope ) {
+                        // a parameter the body hands to a REF parameter needs real storage: substituting
+                        // a value there stops matching ("can't pass non-ref to ref"). a by-value param is
+                        // a copy in the real call anyway, so binding the temp is what the un-inlined code
+                        // did
+                        bool needsStorage = stats.readAsRefArg.find(P)!=stats.readAsRefArg.end()
+                            && !(A->type && A->type->ref);
+                        if ( reads<=1 && !underLoop && inlinePure(A) && orderSafe && !needScope && !needsStorage ) {
                             sub.substitute = A;
                         } else {
                             makeArgTemp(A->clone(), true, false, A->type && !A->type->canCopy());

tests/language/inline_ref_arg.das

@@ -0,0 +1,42 @@
+options gen2
+options auto_inline_functions = true
+require dastest/testing_boost
+require UnitTest
+
+// REPRO (crashes the compiler before the fix, see below).
+//
+// doubleSamplePoint3 is bound from C++ as `Point3 doubleSamplePoint3(const Point3 &)`, so its
+// parameter is an implicit const ref.
+//
+// `private` + referenced once makes this callee budget-exempt, so it splices even though the body is
+// over the heuristic budget. The splice substitutes the caller's argument EXPRESSION for `p`, and the
+// caller passes `a + b` built from two const locals - which constant-folds. So the folder ends up
+// evaluating doubleSamplePoint3(<constant>) at compile time and dereferences a `const Point3 &` that
+// was never materialized:
+//
+//   CRASH: SIGSEGV
+//     das::FoldingVisitor::evalAndFold -> das::Context::evalWithCatch -> doubleSamplePoint3
+//
+// Same family as fold_extern_at_compile.das - the compiler must not execute a C++-bound function - but
+// this one crashes rather than baking a wrong constant, so it is the sharper case. Dagor closes it by
+// refusing to fold builtIn (C++-bound) calls at all.
+//
+// A non-constant argument (two globals instead of const locals) does NOT crash: the value binds and
+// runs fine. So the trigger is specifically inlining + constant propagation + a native const-ref param.
+def private big_callee(p : float3; k : float) : float3 {
+    var acc = float3()
+    var i = 0
+    while (i < 2) { acc += float3(float(i)); i++ }
+    let scaled = acc * k
+    let doubled = UnitTest::doubleSamplePoint3(p)
+    var out = doubled + scaled
+    out.x += 0.
+    return out
+}
+
+[test]
+def test_no_compile_time_call_of_native_const_ref(t : T?) {
+    let a = float3(1, 2, 3)
+    let b = float3(1, 0, 0)
+    t |> equal(big_callee(a + b, 0.), float3(4, 4, 6))
+}