[ValueTracking] Loads with !dereferenceable metadata cannot be undef/poison

[nikic]

Summary

A load with !dereferenceable or !dereferenceable_or_null metadata must return a well-defined (non-undef/poison) value. Effectively they imply !noundef. This is the same as we do for the dereferenceable(N) attribute.

This should fix https://github.com/llvm/llvm-project/issues/55672, or at least the specific case discussed there.

[aqjune]

Per LangRef statements of the definition of dereferenceable(<n>) attribute:

The pointer should be well defined, otherwise it is undefined behavior. This means dereferenceable(<n>) implies noundef.

And the dereferenceable metadata says:

This is analogous to the ‘’dereferenceable’’ attribute on parameters and return values.

would like to interpret this wording as the metadata being equivalent to the attribute.

[nlopes]

I just implemented !dereferenceable in Alive2 and got this commit flagged.

I don't see why !dereferenceable should imply !noundef. They are separate concepts: one is about the object's properties (size) and the other is about the object's contents. If you want both, you should create loads with both.
We should strive to have metadata/attributes as disjoint as possible, otherwise some use cases get lost. For example, we have an internal use case, where we badly need to tag loads with !dereferenceable, but not with !noundef.

Can we revert this?

[nlopes]

In D126296#4658046, @nlopes wrote:

I just implemented !dereferenceable in Alive2 and got this commit flagged.

I don't see why !dereferenceable should imply !noundef. They are separate concepts: one is about the object's properties (size) and the other is about the object's contents. If you want both, you should create loads with both.
We should strive to have metadata/attributes as disjoint as possible, otherwise some use cases get lost. For example, we have an internal use case, where we badly need to tag loads with !dereferenceable, but not with !noundef.

Can we revert this?

Aaah, nervermind. !dereferenceable applies to the loaded value, not to the input ptr. My bad, sorry.

llvm/lib/Analysis/ValueTracking.cpp

if (const auto *PN = dyn_cast<PHINode>(V)) {
       }
       if (IsWellDefined)
         return true;
     } else if (!canCreateUndefOrPoison(Opr) && all_of(Opr->operands(), OpCheck))
       return true;
   }
 
   if (auto *I = dyn_cast<LoadInst>(V))
-    if (I->getMetadata(LLVMContext::MD_noundef))
+    if (I->hasMetadata(LLVMContext::MD_noundef) ||
+        I->hasMetadata(LLVMContext::MD_dereferenceable) ||
+        I->hasMetadata(LLVMContext::MD_dereferenceable_or_null))
       return true;
 
   if (programUndefinedIfUndefOrPoison(V, PoisonOnly))
     return true;
 
   // CxtI may be null or a cloned instruction.
   if (!CtxI || !CtxI->getParent() || !DT)
     return false;

llvm/test/Transforms/InstCombine/freeze.ll

;
   %p = load i8*, i8** %ptr, !noundef !0
   %p.fr = freeze i8* %p
   ret i8* %p.fr
 }
 
 define i8* @freeze_load_dereferenceable(i8** %ptr) {
 ; CHECK-LABEL: @freeze_load_dereferenceable(
 ; CHECK-NEXT:    [[P:%.*]] = load i8*, i8** [[PTR:%.*]], align 8, !dereferenceable !1
-; CHECK-NEXT:    [[P_FR:%.*]] = freeze i8* [[P]]
-; CHECK-NEXT:    ret i8* [[P_FR]]
+; CHECK-NEXT:    ret i8* [[P]]
 ;
   %p = load i8*, i8** %ptr, !dereferenceable !1
   %p.fr = freeze i8* %p
   ret i8* %p.fr
 }
 
 define i8* @freeze_load_dereferenceable_or_null(i8** %ptr) {
 ; CHECK-LABEL: @freeze_load_dereferenceable_or_null(
 ; CHECK-NEXT:    [[P:%.*]] = load i8*, i8** [[PTR:%.*]], align 8, !dereferenceable_or_null !1
-; CHECK-NEXT:    [[P_FR:%.*]] = freeze i8* [[P]]
-; CHECK-NEXT:    ret i8* [[P_FR]]
+; CHECK-NEXT:    ret i8* [[P]]
 ;
   %p = load i8*, i8** %ptr, !dereferenceable_or_null !1
   %p.fr = freeze i8* %p
   ret i8* %p.fr
 }
 
 !0 = !{}
 !1 = !{i64 4}