Panic when taking the address of a struct within a struct

[pcwalton]

Description

This panics:

struct S0 {
    a: f32,
}

struct S1 {
    s0: S0,
    b: f32,
}

fn g(s0: ptr<function, S0>) {}

fn f(s1: ptr<function, S1>) {
    g(&(*s1).s0);
}

@compute
@workgroup_size(64, 1, 1)
fn main() {
    var s1: S1;
    s1.s0.a = 0.0;
    s1.b = 0.0;
    f(&s1);
}

internal error: entered unreachable code: Expression [2] is not cached!

Repro steps

$ target\debug\naga.exe bug.wgsl bug.spv
thread 'main' panicked at naga\src\back\spv\block.rs:2254:56:
internal error: entered unreachable code: Expression [2] is not cached!
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Platform
Windows 11, x86-64

[teoxoy]

This looks like a duplicate of #4540.