assert !temp_readonly(ts) in tcg_reg_alloc_op

["Nicholas Piggin" <npiggin@gmail.com>]

I get a crash running a powerpc64 TCG machine on x86.

It can be triggered by booting a custom vmlinux patched to use powerpc
prefix instructions and pcrel addressing, I don't know if that's related
or coincidence. I can give Linux patches or a vmlinux file to reproduce
if needed, or I can test patches quickly.

The first bad commit is 7058ff5231a0 ("target/ppc: Avoid tcg_const_* in
translate.c")

Some gdb stuff

  0x00007ffff76d5395 in __assert_fail_base
    (fmt=0x7ffff7849a70 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55555625a99c "!temp_readonly(ts)", file=file@entry=0x555556256211 "../tcg/tcg.c", line=line@entry=4450, function=function@entry=0x55555625b640 <__PRETTY_FUNCTION__.9> "tcg_reg_alloc_op") at ./assert/assert.c:92
#5  0x00007ffff76e3df2 in __GI___assert_fail
    (assertion=0x55555625a99c "!temp_readonly(ts)", file=0x555556256211 "../tcg/tcg.c", line=4450, function=0x55555625b640 <__PRETTY_FUNCTION__.9> "tcg_reg_alloc_op") at ./assert/assert.c:101
#6  0x0000555555e078b9 in tcg_reg_alloc_op
    (s=0x7ffd60000b70, op=0x7ffd600097f8) at ../tcg/tcg.c:4450
#7  0x0000555555e08e77 in tcg_gen_code
    (s=0x7ffd60000b70, tb=0x7fffb07612c0, pc_start=13835058055286387916)
    at ../tcg/tcg.c:5122
#8  0x0000555555e49a3f in setjmp_gen_code
    (env=0x555556be9e30, tb=0x7fffb07612c0, pc=13835058055286387916, host_pc=0x7ffd702074cc, max_insns=0x7ffff65076ac, ti=0x7ffff65076c8)
    at ../accel/tcg/translate-all.c:297
#9  0x0000555555e49c67 in tb_gen_code
    (cpu=0x555556be7a40, pc=13835058055286387916, cs_base=0, flags=3053453367, cflags=-16777216) at ../accel/tcg/translate-all.c:365
#10 0x0000555555e40db4 in cpu_exec_loop (cpu=0x555556be7a40, sc=0x7ffff6507800)
    at ../accel/tcg/cpu-exec.c:978
#11 0x0000555555e40f95 in cpu_exec_setjmp
    (cpu=0x555556be7a40, sc=0x7ffff6507800) at ../accel/tcg/cpu-exec.c:1043
#12 0x0000555555e4101c in cpu_exec (cpu=0x555556be7a40)
    at ../accel/tcg/cpu-exec.c:1069

(gdb) frame 6
#6  0x0000555555e078b9 in tcg_reg_alloc_op (s=0x7ffd60000b70,
    op=0x7ffd600097f8) at ../tcg/tcg.c:4450
4450	            tcg_debug_assert(!temp_readonly(ts));
(gdb) p *op
$1 = {opc = INDEX_op_divu2_i32, nargs = 5, param1 = 0, param2 = 0,
  life = 464, link = {tqe_next = 0x7ffd60009840, tqe_circ = {
      tql_next = 0x7ffd60009840, tql_prev = 0x7ffd60009770}}, output_pref = {
    0, 4}, args = 0x7ffd60009818}
(gdb) print *def
$2 = {name = 0x55555625baf5 "divu2_i32", nb_oargs = 2 '\002',
  nb_iargs = 3 '\003', nb_cargs = 0 '\000', nb_args = 5 '\005',
  flags = 0 '\000', args_ct = 0x555556ba793c}
(gdb) p k
$3 = 1
(gdb) p *ts
$4 = {reg = TCG_REG_R12, val_type = TEMP_VAL_CONST, base_type = TCG_TYPE_I32,
  type = TCG_TYPE_I32, kind = TEMP_CONST, indirect_reg = 0, indirect_base = 0,
  mem_coherent = 0, mem_allocated = 0, temp_allocated = 1, temp_subindex = 0,
  val = 0, mem_base = 0x0, mem_offset = 0, name = 0x0, state = 0,
  state_ptr = 0x7ffd6000a9fc}
(gdb) p *arg_ct
$5 = {ct = 0, alias_index = 3, sort_index = 1, pair_index = 0, pair = 0,
  oalias = true, ialias = false, newreg = false, regs = 4}

Thanks,
Nick