[llvm] [PAC][InstCombine] Replace auth+sign with resign (PR #130807)

[Anatoly Trosinenko via llvm-commits]

================
@@ -2978,6 +2978,29 @@ Instruction *InstCombinerImpl::visitCallInst(CallInst &CI) {
         Intrinsic::getOrInsertDeclaration(II->getModule(), NewIntrin);
     return CallInst::Create(NewFn, CallArgs);
   }
+  case Intrinsic::ptrauth_sign: {
+    // auth + sign can be replaced with resign, which prevents unsafe
+    // spills and reloads of intermediate authenticated value.
----------------
atrosinenko wrote:

Updated in 3b4d9b537dfd08941a1c4319d5758bd6ea63fae0, though, with different wording - hopefully this would be even easier to understand:
```cpp
    // Replace auth+sign with a single resign intrinsic.
    // When auth and sign operations are performed separately, later compiler
    // passes may spill intermediate result to memory as a raw, unprotected
    // pointer, which makes it possible for an attacker to replace it under
    // PAuth threat model. On the other hand, resign intrinsic is not expanded
    // until AsmPrinter, when it is emitted as a contiguous, non-attackable
    // sequence of instructions.
```

https://github.com/llvm/llvm-project/pull/130807