Fix soundness hole in FSA due to nested drops

[jacob-hughes]

Imagine a Gc<T> where T has a finalizer. Up until now, a value v allocated locally inside T::drop could create a backdoor where non-finalizer-safe stuff can happen without FSA knowing about it. Consider the following example:

struct S { .. }

impl Drop for S {
    fn drop(&mut self) {
        unsound_external_fn_call(); // called from finalizer.
    }
}

struct T { .. }

impl Drop for T {
    fn drop(&mut self) {
        let s = S { .. };
    } // also calls 'S::drop' for the local 's'.
}

fn main() { Gc::new(T::new()) }

This program is unsound, but it would not be caught by FSA. By allowing the alloca of s, we have inadvertently run the unsound nested S::drop inside a finalizer without checking.

Note that my use of the term 'nested drops' here is distinct from drop glue. Drop glue (i.e. where the drop methods for fields of a type are automatically called too) works as intended.

This commit updates FSA to handle such nested drops. The approach is very similar to how we handle drop methods which contain functions calls. Using the same example from above, we know that the MIR for T::drop (the type being finalized) will contain a terminator to call S::drop, so after FSA has finished looking at T::drop, it will obtain and then check the (potentially monomorphized) MIR for S::drop.

This fix also works when S has drop glue, because that would mean that drop methods for any of S's fields would also be added as terminators in the MIR for T::drop.

If at any stage, the MIR for S::drop is unavailable, then we emit an FSA error.