[CHERI] generate cap for SMUL overflow temporary

This was previously a pointer from AS0 (i32) which trips an assertion
later in `getCopyToParts` (called by `LoweCall`) when a capability is
copied into that position.

Author: jwnrt

llvm/lib/CodeGen/SelectionDAG/LegalizeIntegerTypes.cpp

@@ -1748,7 +1748,7 @@ SDValue DAGTypeLegalizer::PromoteIntRes_VAARG(SDNode *N) {
     Part = DAG.getNode(
         ISD::SHL, dl, NVT, Part,
         DAG.getConstant(i * RegVT.getSizeInBits(), dl,
-                        TLI.getPointerRangeTy(DAG.getDataLayout())));
+                        rogramI.getPointerRangeTy(DAG.getDataLayout())));
     Res = DAG.getNode(ISD::OR, dl, NVT, Res, Part);
   }
 
@@ -4822,7 +4822,9 @@ void DAGTypeLegalizer::ExpandIntRes_XMULO(SDNode *N,
 
   Type *RetTy = VT.getTypeForEVT(*DAG.getContext());
   EVT PtrRangeVT = TLI.getPointerRangeTy(DAG.getDataLayout());
-  Type *PtrTy = PtrRangeVT.getTypeForEVT(*DAG.getContext());
+  EVT PtrVT = TLI.getPointerTy(DAG.getDataLayout(),
+                               DAG.getDataLayout().getProgramAddressSpace());
+  Type *PtrTy = PtrVT.getTypeForEVT(*DAG.getContext());
 
   // Replace this with a libcall that will check overflow.
   RTLIB::Libcall LC = RTLIB::UNKNOWN_LIBCALL;
@@ -4875,7 +4877,8 @@ void DAGTypeLegalizer::ExpandIntRes_XMULO(SDNode *N,
 
   // Also pass the address of the overflow check.
   Entry.Node = Temp;
-  Entry.Ty = PointerType::getUnqual(PtrTy->getContext());
+  Entry.Ty =
+      PointerType::get(PtrTy, DAG.getDataLayout().getProgramAddressSpace());
   Entry.IsSExt = true;
   Entry.IsZExt = false;
   Args.push_back(Entry);