fix: pass plain variable arguments to REFERENCE TO inputs by address (1.0.x)

[ghaith]

Note

This PR was authored by Claude (Anthropic) on behalf of @ghaith.

Backport of #1846 to release/1.0.x (clean cherry-pick of both commits).

Problem

A plain variable passed to a REFERENCE TO VAR_INPUT of a function or method arrived as its value instead of its address: the caller emitted call @func(i64 %value) against a callee declared as define @func(ptr). The receiving reference ended up null (for zero-valued arguments) or pointing at a garbage address, so REF= assignments from such inputs silently produced unusable references, and writes through them corrupted memory. Certain combinations of these mistyped calls also made the LLVM backend abort with Cannot emit physreg copy instruction.

Fix

• generate_function_arguments now routes any REFERENCE TO parameter through the by-ref argument path (previously only when the argument itself was a reference), matching the callee signature and the existing FB/PROGRAM call path.
• generate_empty_expression gives omitted REFERENCE TO arguments a freshly allocated dummy address instead of a garbage value.

New validations

Arguments to by-ref parameters (REFERENCE TO, VAR_IN_OUT, function VAR_OUTPUT, VAR_INPUT {ref}) are checked following CODESYS semantics (C0041/C0141/C0201):

• E031: a REFERENCE TO argument must be a reference — literals, expressions and empty assignments are rejected.
• E031: constants are rejected for REFERENCE TO, VAR_IN_OUT and VAR_OUTPUT (write access needed). {ref} inputs keep accepting constants and literals (read-only optimization used by the stdlib).
• E037: elementary argument types must match. REFERENCE TO rejects any difference; the other kinds reject a smaller argument — the callee would access memory beyond the argument's storage, and the VAR_IN_OUT case previously crashed codegen with an internal Builder error (invalid cast opcode). Larger arguments keep the established E067 implicit-downcast warning, so existing downcast behavior is unchanged.
• E030: method calls must pass REFERENCE TO inputs (bound per call). Inputs of stateful POUs keep their persistent instance binding and stay optional.

Tests

• 6 lit tests: pointer-identity and write-through semantics for functions and methods, plus a mixed-combination test that pins the former LLVM backend abort.
• 5 validator unit tests covering E030/E031/E037, including the valid control cases.
• One updated snapshot: a mismatched function VAR_OUTPUT (REAL output into an INT variable) now errors instead of only warning — that direction writes beyond the target variable.

Verified on this branch: full workspace test suite and the pointer lit tests.

🤖 Generated with Claude Code

[github-actions]

Build Artifacts

🐧 Linux

Artifact	Link	Size
deb-x86_64	Download	10.9 MB
schema	Download	0.0 MB
stdlib	Download	33.5 MB
plc-x86_64	Download	43.5 MB
deb-aarch64	Download	5.4 MB
plc-aarch64	Download	43.3 MB

From workflow run

🪟 Windows

Artifact	Link	Size
stdlib.lib	Download	4.0 MB
stdlib.dll	Download	0.1 MB
plc.exe	Download	38.3 MB

From workflow run