Fix ICE on offsetted ZST pointer

A grep for `const_usize.*align` found the same code copied to
rustc_codegen_gcc but I don't see other cases where we get this wrong.

Author: Mark-Simulacrum

compiler/rustc_codegen_cranelift/src/constant.rs

@@ -138,8 +138,10 @@ pub(crate) fn codegen_const_value<'tcx>(
                 let base_addr = match fx.tcx.global_alloc(alloc_id) {
                     GlobalAlloc::Memory(alloc) => {
                         if alloc.inner().len() == 0 {
-                            assert_eq!(offset, Size::ZERO);
-                            fx.bcx.ins().iconst(fx.pointer_type, alloc.inner().align.bytes() as i64)
+                            fx.bcx.ins().iconst(
+                                fx.pointer_type,
+                                alloc.inner().align.bytes().wrapping_add(offset.bytes()) as i64,
+                            )
                         } else {
                             let data_id = data_id_for_alloc_id(
                                 &mut fx.constants_cx,

compiler/rustc_codegen_gcc/src/common.rs

@@ -247,8 +247,9 @@ impl<'gcc, 'tcx> ConstCodegenMethods for CodegenCx<'gcc, 'tcx> {
                         // This avoids generating a zero-sized constant value and actually needing a
                         // real address at runtime.
                         if alloc.inner().len() == 0 {
-                            assert_eq!(offset.bytes(), 0);
-                            let val = self.const_usize(alloc.inner().align.bytes());
+                            let val = self.const_usize(
+                                alloc.inner().align.bytes().wrapping_add(offset.bytes()),
+                            );
                             return if matches!(layout.primitive(), Pointer(_)) {
                                 self.context.new_cast(None, val, ty)
                             } else {

compiler/rustc_codegen_llvm/src/common.rs

@@ -281,8 +281,9 @@ impl<'ll, 'tcx> ConstCodegenMethods for CodegenCx<'ll, 'tcx> {
                         // This avoids generating a zero-sized constant value and actually needing a
                         // real address at runtime.
                         if alloc.inner().len() == 0 {
-                            assert_eq!(offset.bytes(), 0);
-                            let llval = self.const_usize(alloc.inner().align.bytes());
+                            let llval = self.const_usize(
+                                alloc.inner().align.bytes().wrapping_add(offset.bytes()),
+                            );
                             return if matches!(layout.primitive(), Pointer(_)) {
                                 unsafe { llvm::LLVMConstIntToPtr(llval, llty) }
                             } else {

tests/ui/consts/zst_no_llvm_alloc.rs

@@ -5,6 +5,16 @@ struct Foo;
 
 static FOO: Foo = Foo;
 
+// This tests for regression of https://github.com/rust-lang/rust/issues/147516
+//
+// THe compiler will codegen `&Zst` without creating a real allocation, just a properly aligned
+// `usize` (i.e., ptr::dangling). However, code can add an arbitrary offset from that base
+// allocation. We confirm here that we correctly codegen that offset combined with the necessary
+// alignment of the base &() as a 1-ZST and &Foo as a 4-ZST.
+const A: *const () = (&() as *const ()).wrapping_byte_add(2);
+const B: *const () = (&Foo as *const _ as *const ()).wrapping_byte_add(usize::MAX);
+const C: *const () = (&Foo as *const _ as *const ()).wrapping_byte_add(2);
+
 fn main() {
     // There's no stable guarantee that these are true.
     // However, we want them to be true so that our LLVM IR and runtime are a bit faster:
@@ -15,6 +25,13 @@ fn main() {
     let x: &'static Foo = &Foo;
     assert_eq!(x as *const Foo as usize, 4);
 
+    // * A 1-aligned ZST (1-ZST) is placed at 0x1. Then offsetting that by 2 results in 3.
+    // * Foo is a 4-aligned ZST, so is placed at 0x4. +2 = 6
+    // * Foo is a 4-aligned ZST, so is placed at 0x4. +usize::MAX = -1 (same bit pattern) = 3
+    assert_eq!(A.addr(), 3);
+    assert_eq!(B.addr(), 3);
+    assert_eq!(C.addr(), 6);
+
     // The exact addresses returned by these library functions are not necessarily stable guarantees
     // but for now we assert that we're still matching.
     #[allow(dangling_pointers_from_temporaries)]