cmd/compile: do not use special literal assignment if LHS is address-taken

A composite literal assignment

x = T{field: v}

may be compiled to

x = T{}
x.field = v

We already do not use this form is RHS uses LHS. If LHS is
address-taken, RHS may uses LHS implicitly, e.g.

v = &x.field
x = T{field: *v}

The lowering above would change the value of RHS (*v).

Fixes #52953.

Change-Id: I3f798e00598aaa550b8c17182c7472fef440d483
Reviewed-on: https://go-review.googlesource.com/c/go/+/407014
Reviewed-by: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Run-TryBot: Cherry Mui <cherryyz@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

src/cmd/compile/internal/walk/complit.go

@@ -618,6 +618,12 @@ func oaslit(n *ir.AssignStmt, init *ir.Nodes) bool {
 		// not a special composite literal assignment
 		return false
 	}
+	if x.Addrtaken() {
+		// If x is address-taken, the RHS may (implicitly) uses LHS.
+		// Not safe to do a special composite literal assignment
+		// (which may expand to multiple assignments).
+		return false
+	}
 
 	switch n.Y.Op() {
 	default:
@@ -626,7 +632,7 @@ func oaslit(n *ir.AssignStmt, init *ir.Nodes) bool {
 
 	case ir.OSTRUCTLIT, ir.OARRAYLIT, ir.OSLICELIT, ir.OMAPLIT:
 		if ir.Any(n.Y, func(y ir.Node) bool { return ir.Uses(y, x) }) {
-			// not a special composite literal assignment
+			// not safe to do a special composite literal assignment if RHS uses LHS.
 			return false
 		}
 		anylit(n.Y, n.X, init)

test/fixedbugs/issue52953.go

@@ -0,0 +1,29 @@
+// run
+
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Issue 52953: miscompilation for composite literal assignment
+// when LHS is address-taken.
+
+package main
+
+type T struct {
+	Field1 bool
+}
+
+func main() {
+	var ret T
+	ret.Field1 = true
+	var v *bool = &ret.Field1
+	ret = T{Field1: *v}
+	check(ret.Field1)
+}
+
+//go:noinline
+func check(b bool) {
+	if !b {
+		panic("FAIL")
+	}
+}