This PR aims to correct bad code generation when %int_as_pointer is used at local mode, in a context where the corresponding region is not required for any actual stack allocation. For example in the following (which can be compiled with the boot compiler using -nostdlib -nopervasives):

[@@@ocaml.flambda_o3]

external int_as_pointer : int -> local_ int = "%int_as_pointer"

let iop t = local_ (int_as_pointer t) [@inline]

let u t (local_ f) = f (local_ (iop t)) [@nontail] [@inline]

external unsafe_set: local_ 'a array -> int -> 'a -> unit = "%array_unsafe_set"
external magic : (_[@local_opt]) -> (_[@local_opt]) = "%obj_magic"

let set t i v =
  u t (fun[@inline] t -> unsafe_set ((magic t) : int array) i v)

let normal_set (t : int array) i v =
  unsafe_set t i v

we would like it to be the case that the code for set is the same as for normal_set except for one subtraction (corresponding to %int_as_pointer). This is the case after this PR. At the moment it is not the case, with the generated code loading and storing the local stack pointer.

The %int_as_pointer primitive should be (and is) treated in the main part of flambda2 (everything before To_cmm) a bit like a zero-sized stack allocation. The aim is to ensure that the primitive is not pushed past the end-region, just like any other local allocation. (At present I think this is really enforced by the fact that End_region is a hard barrier in To_cmm, but with a more advanced effect analysis in that pass in the future, the region variable named by the Int_as_pointer primitive will ensure this.)

Not pushing %int_of_pointer past an end-region is actually a proxy for the real property we are trying to ensure, which is that the GC can never see the result of this primitive (as it is untagged and could cause misbehaviour, especially with a no-naked-pointers compiler or runtime5).

The idea of this patch, then, is to delete "unused" regions during To_cmm. The definition of "unused" here is "not needed to do any stack allocation", so in particular, a region only held onto via Int_as_pointer is to be deleted. Now it seems like there might a risk of code motion transformations (now or in the future) in the backend needing the region in order to ensure soundness. Indeed, there is arguably a pre-existing problem here, because Int_as_pointer is expanded into Cmm code that does not name any region variable during Cmm_helpers. This patch aims to adopt a straightforward approach which I hope is going to work when tested on a large scale: make that Cmm code have return machtype Addr. This in theory would allow the backend to move the primitive past an End_region, although I don't think there is currently any code in the compiler which would do this, but it does ensure (at compile time) the above property relating to the GC. This is the critical part.

The patch itself is fairly easy. There are probably three PRs here to be split out:

1. Make Cmm_helpers.int_as_pointer return something of machtype Addr.
2. Make To_cmm traverse the flambda2 terms in dominator order, so something straightforward can be done in point 3 below. I think this is probably a good change anyway. Some more thinking needs doing about the handling of loops (especially in conjunction with point 3. below), I just haven't had time yet.
3. Track in To_cmm_result which regions have been seen to be used, and don't emit Cmm code for End_region primitives if the corresponding region is unused. It's a bit unfortunate that this seems to involve passing the Simple.t for the argument to the unary primitive simplification function, but this does seem to be much better than trying to do this based on the Cmm variables (as Ident.t). I tried that latter way and it got complicated very quickly.

I think the %int_of_pointer test at local mode in the testsuite may not really be testing the right thing, but I will discuss with @riaqn .