[ValueTracking] Make !range metadata imply noundef for load & call results

[mkazantsev]

Summary

According to LangRef:

If the loaded or returned value is not in the specified range, the behavior is undefined. 
...
The range should not represent the full or empty set. That is, a!=b.

These statements together mean that the result of load which contains !range metadata
is immediate of UB if undef is loaded, because undef may take the value missing in the
range. It automatically implies it's not poison either.

[nikic]

This is correct as specified, but I think there were plans to change !range and !nonnull to return poison, and require an additional !noundef to make them immediate UB, which is the way it works for attributes. I'm not sure what the state of that is though.

[mkazantsev]

In D136055#3861580, @nikic wrote:

This is correct as specified, but I think there were plans to change !range and !nonnull to return poison, and require an additional !noundef to make them immediate UB, which is the way it works for attributes. I'm not sure what the state of that is though.

Do you want me to follow-up with inference of !noundef for loads with such attributes in some pass, or?..

[nlopes]

In D136055#3861580, @nikic wrote:

This is correct as specified, but I think there were plans to change !range and !nonnull to return poison, and require an additional !noundef to make them immediate UB, which is the way it works for attributes. I'm not sure what the state of that is though.

FWIW, Alive2 currently models !range as being UB iff !poison && range_is_violated.
This patch proposes to use poison || range_is_violated.
The Alive2 version is bogus in terms of composition of refinement (IPO) as it prevents changing poison to a value that violates the range. But in the past we realized that the proposed (strong UB) semantics didn't work (verification failed for a few optimizations; I don't remember the details).

There's an advantage of keeping poison disentangled, which is that it enables hoisting by dropping just !noundef. I think it's always best to yield poison whenever we can to make movement easier (of loads, calls is less important).

So I agree the best thing to do is to change the semantics, so that a range violation yields poison.

FWIW, there's already a patch for clang to add !noundef to loads by my GSoC student: https://reviews.llvm.org/D134410

[jdoerfert]

In D136055#3861580, @nikic wrote:

This is correct as specified, but I think there were plans to change !range and !nonnull to return poison, and require an additional !noundef to make them immediate UB, which is the way it works for attributes. I'm not sure what the state of that is though.

+1

[mkazantsev]

In some sense, "range implies noundef" is the same thing as "dereferenceable implies noundef". There is no conceptual difference between "integer in specified range" and "pointer in a set of valid pointers". If we do it for dereferenceable pointers, why impede this for ranges?

[nikic]

In D136055#3865454, @mkazantsev wrote:

In some sense, "range implies noundef" is the same thing as "dereferenceable implies noundef". There is no conceptual difference between "integer in specified range" and "pointer in a set of valid pointers". If we do it for dereferenceable pointers, why impede this for ranges?

The relevant difference in how this metadata gets used: APIs using range metadata generally only prove facts modulo poison. If computeKnownBits() says that the top bits of the value are zero, what this really means is that either the top bits are zero or the value is poison. The same is not true for dereferenceable metadata: This metadata is used to speculate loads, and having a "dereferenceable or poison" pointer would be useless in that context.

[mkazantsev]

In D136055#3865543, @nikic wrote:

In D136055#3865454, @mkazantsev wrote:

In some sense, "range implies noundef" is the same thing as "dereferenceable implies noundef". There is no conceptual difference between "integer in specified range" and "pointer in a set of valid pointers". If we do it for dereferenceable pointers, why impede this for ranges?

The relevant difference in how this metadata gets used: APIs using range metadata generally only prove facts modulo poison. If computeKnownBits() says that the top bits of the value are zero, what this really means is that either the top bits are zero or the value is poison. The same is not true for dereferenceable metadata: This metadata is used to speculate loads, and having a "dereferenceable or poison" pointer would be useless in that context.

I'm still not getting this. The code I'm modifying says "dereferenceable pointers don't have to be marked as noundef, but we can still infer noundef from the fact they are dereferenceable". But at the same time we say "loads with range *have* to be marked as noundef explicitly, and we don't want to imply it". This approach is self-contradictory. If you insist that frontend must mark every load with range as !noundef, I'm fine with that. But in this case let's delete

  I->hasMetadata(LLVMContext::MD_dereferenceable) ||
  I->hasMetadata(LLVMContext::MD_dereferenceable_or_null))
return true;

and demand that they are also marked as !noundef explicitly. It should be same for them.

[mkazantsev]

Ping?

llvm/lib/Analysis/ValueTracking.cpp

if (auto *II = dyn_cast<IntrinsicInst>(Op)) {
       case Intrinsic::umul_with_overflow:
         return false;
       }
     }
     [[fallthrough]];
   case Instruction::CallBr:
   case Instruction::Invoke: {
     const auto *CB = cast<CallBase>(Op);
+    if (CB->hasMetadata(LLVMContext::MD_range))
+      return false;
     return !CB->hasRetAttr(Attribute::NoUndef);
   }
   case Instruction::InsertElement:
   case Instruction::ExtractElement: {
     // If index exceeds the length of the vector, it returns poison
     auto *VTy = cast<VectorType>(Op->getOperand(0)->getType());
     unsigned IdxOp = Op->getOpcode() == Instruction::InsertElement ? 2 : 1;
     auto *Idx = dyn_cast<ConstantInt>(Op->getOperand(IdxOp));
if (const auto *PN = dyn_cast<PHINode>(V)) {
         return true;
     } else if (!canCreateUndefOrPoison(Opr) && all_of(Opr->operands(), OpCheck))
       return true;
   }
 
   if (auto *I = dyn_cast<LoadInst>(V))
     if (I->hasMetadata(LLVMContext::MD_noundef) ||
         I->hasMetadata(LLVMContext::MD_dereferenceable) ||
-        I->hasMetadata(LLVMContext::MD_dereferenceable_or_null))
+        I->hasMetadata(LLVMContext::MD_dereferenceable_or_null) ||
+        I->hasMetadata(LLVMContext::MD_range))
       return true;
 
   if (programUndefinedIfUndefOrPoison(V, PoisonOnly))
     return true;
 
   // CxtI may be null or a cloned instruction.
   if (!CtxI || !CtxI->getParent() || !DT)
     return false;

llvm/test/Transforms/Attributor/dereferenceable-1.ll

 ;     p[i] = i;
 ;   }
 ; }
 
 ; NOTE: %p should not be dereferenceable
 define internal void @fill_range_not_inbounds(i32* %p, i64 %start){
 ; CHECK: Function Attrs: argmemonly nofree norecurse nosync nounwind willreturn writeonly
 ; CHECK-LABEL: define {{[^@]+}}@fill_range_not_inbounds
-; CHECK-SAME: (i32* nocapture nofree writeonly [[P:%.*]], i64 [[START:%.*]]) #[[ATTR2]] {
+; CHECK-SAME: (i32* nocapture nofree writeonly [[P:%.*]], i64 noundef [[START:%.*]]) #[[ATTR2]] {
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[TMP0:%.*]] = add nsw i64 [[START]], 9
 ; CHECK-NEXT:    br label [[FOR_BODY:%.*]]
 ; CHECK:       for.cond.cleanup:
 ; CHECK-NEXT:    ret void
 ; CHECK:       for.body:
 ; CHECK-NEXT:    [[I_06:%.*]] = phi i64 [ [[START]], [[ENTRY:%.*]] ], [ [[INC:%.*]], [[FOR_BODY]] ]
 ; CHECK-NEXT:    [[CONV:%.*]] = trunc i64 [[I_06]] to i32
for.body:                                         ; preds = %entry, %for.body
   %cmp = icmp slt i64 %i.06, %0
   br i1 %cmp, label %for.body, label %for.cond.cleanup
 }
 
 ; FIXME: %p should be dereferenceable(40)
 define internal void @fill_range_inbounds(i32* %p, i64 %start){
 ; CHECK: Function Attrs: argmemonly nofree norecurse nosync nounwind willreturn writeonly
 ; CHECK-LABEL: define {{[^@]+}}@fill_range_inbounds
-; CHECK-SAME: (i32* nocapture nofree writeonly [[P:%.*]], i64 [[START:%.*]]) #[[ATTR2]] {
+; CHECK-SAME: (i32* nocapture nofree writeonly [[P:%.*]], i64 noundef [[START:%.*]]) #[[ATTR2]] {
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[TMP0:%.*]] = add nsw i64 [[START]], 9
 ; CHECK-NEXT:    br label [[FOR_BODY:%.*]]
 ; CHECK:       for.cond.cleanup:
 ; CHECK-NEXT:    ret void
 ; CHECK:       for.body:
 ; CHECK-NEXT:    [[I_06:%.*]] = phi i64 [ [[START]], [[ENTRY:%.*]] ], [ [[INC:%.*]], [[FOR_BODY]] ]
 ; CHECK-NEXT:    [[CONV:%.*]] = trunc i64 [[I_06]] to i32

 }
 
 define void @call_fill_range(i32* nocapture %p, i64* nocapture readonly %range) {
 ; TUNIT: Function Attrs: argmemonly nofree norecurse nosync nounwind willreturn
 ; TUNIT-LABEL: define {{[^@]+}}@call_fill_range
 ; TUNIT-SAME: (i32* nocapture nofree writeonly [[P:%.*]], i64* nocapture nofree noundef nonnull readonly align 8 dereferenceable(8) [[RANGE:%.*]]) #[[ATTR3:[0-9]+]] {
 ; TUNIT-NEXT:  entry:
 ; TUNIT-NEXT:    [[TMP0:%.*]] = load i64, i64* [[RANGE]], align 8, !range [[RNG0:![0-9]+]]
-; TUNIT-NEXT:    tail call void @fill_range_inbounds(i32* nocapture nofree writeonly [[P]], i64 [[TMP0]]) #[[ATTR6:[0-9]+]]
-; TUNIT-NEXT:    tail call void @fill_range_not_inbounds(i32* nocapture nofree writeonly [[P]], i64 [[TMP0]]) #[[ATTR6]]
+; TUNIT-NEXT:    tail call void @fill_range_inbounds(i32* nocapture nofree writeonly [[P]], i64 noundef [[TMP0]]) #[[ATTR6:[0-9]+]]
+; TUNIT-NEXT:    tail call void @fill_range_not_inbounds(i32* nocapture nofree writeonly [[P]], i64 noundef [[TMP0]]) #[[ATTR6]]
 ; TUNIT-NEXT:    ret void
 ;
 ; CGSCC: Function Attrs: argmemonly nofree nosync nounwind willreturn
 ; CGSCC-LABEL: define {{[^@]+}}@call_fill_range
 ; CGSCC-SAME: (i32* nocapture nofree writeonly [[P:%.*]], i64* nocapture nofree noundef nonnull readonly align 8 dereferenceable(8) [[RANGE:%.*]]) #[[ATTR3:[0-9]+]] {
 ; CGSCC-NEXT:  entry:
 ; CGSCC-NEXT:    [[TMP0:%.*]] = load i64, i64* [[RANGE]], align 8, !range [[RNG0:![0-9]+]]
-; CGSCC-NEXT:    tail call void @fill_range_inbounds(i32* nocapture nofree writeonly [[P]], i64 [[TMP0]]) #[[ATTR6:[0-9]+]]
-; CGSCC-NEXT:    tail call void @fill_range_not_inbounds(i32* nocapture nofree writeonly [[P]], i64 [[TMP0]]) #[[ATTR6]]
+; CGSCC-NEXT:    tail call void @fill_range_inbounds(i32* nocapture nofree writeonly [[P]], i64 noundef [[TMP0]]) #[[ATTR6:[0-9]+]]
+; CGSCC-NEXT:    tail call void @fill_range_not_inbounds(i32* nocapture nofree writeonly [[P]], i64 noundef [[TMP0]]) #[[ATTR6]]
 ; CGSCC-NEXT:    ret void
 ;
 entry:
   %0 = load i64, i64* %range, align 8, !range !0
   tail call void @fill_range_inbounds(i32* %p, i64 %0)
   tail call void @fill_range_not_inbounds(i32* %p, i64 %0)
   ret void
 }

llvm/test/Transforms/Attributor/range.ll

;
   %a = load i32, i32* %p, !range !0
   ret i32 %a
 }
 
 define i32 @test0-range-check(i32* %p) {
 ; TUNIT: Function Attrs: argmemonly nofree norecurse nosync nounwind readonly willreturn
 ; TUNIT-LABEL: define {{[^@]+}}@test0-range-check
 ; TUNIT-SAME: (i32* nocapture nofree readonly align 4 [[P:%.*]]) #[[ATTR0]] {
-; TUNIT-NEXT:    [[A:%.*]] = tail call i32 @test0(i32* nocapture nofree readonly align 4 [[P]]) #[[ATTR3:[0-9]+]], !range [[RNG0]]
+; TUNIT-NEXT:    [[A:%.*]] = tail call noundef i32 @test0(i32* nocapture nofree readonly align 4 [[P]]) #[[ATTR3:[0-9]+]], !range [[RNG0]]
 ; TUNIT-NEXT:    ret i32 [[A]]
 ;
 ; CGSCC: Function Attrs: argmemonly nofree nosync nounwind readonly willreturn
 ; CGSCC-LABEL: define {{[^@]+}}@test0-range-check
 ; CGSCC-SAME: (i32* nocapture nofree noundef nonnull readonly align 4 dereferenceable(4) [[P:%.*]]) #[[ATTR1:[0-9]+]] {
-; CGSCC-NEXT:    [[A:%.*]] = tail call i32 @test0(i32* nocapture nofree noundef nonnull readonly align 4 dereferenceable(4) [[P]]) #[[ATTR5:[0-9]+]]
+; CGSCC-NEXT:    [[A:%.*]] = tail call noundef i32 @test0(i32* nocapture nofree noundef nonnull readonly align 4 dereferenceable(4) [[P]]) #[[ATTR5:[0-9]+]]
 ; CGSCC-NEXT:    ret i32 [[A]]
 ;
   %a = tail call i32 @test0(i32* %p)
   ret i32 %a
 }
 
 declare void @use3-dummy(i1, i1, i1)
 define void @use3(i1, i1, i1) {

 ; CGSCC-SAME: (i32* nocapture nofree noundef nonnull readonly align 4 dereferenceable(4) [[P:%.*]]) {
 ; CGSCC-NEXT:    [[RET:%.*]] = tail call i32 @test0(i32* nocapture nofree noundef nonnull readonly align 4 dereferenceable(4) [[P]]) #[[ATTR5]]
 ; CGSCC-NEXT:    [[CMP_EQ_1:%.*]] = icmp eq i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_EQ_2:%.*]] = icmp eq i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_EQ_3:%.*]] = icmp eq i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_EQ_4:%.*]] = icmp eq i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_EQ_5:%.*]] = icmp eq i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_EQ_6:%.*]] = icmp eq i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_EQ_1]], i1 [[CMP_EQ_2]], i1 [[CMP_EQ_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_EQ_4]], i1 [[CMP_EQ_5]], i1 [[CMP_EQ_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_EQ_1]], i1 noundef [[CMP_EQ_2]], i1 noundef [[CMP_EQ_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_EQ_4]], i1 noundef [[CMP_EQ_5]], i1 noundef [[CMP_EQ_6]])
 ; CGSCC-NEXT:    [[CMP_NE_1:%.*]] = icmp ne i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_NE_2:%.*]] = icmp ne i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_NE_3:%.*]] = icmp ne i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_NE_4:%.*]] = icmp ne i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_NE_5:%.*]] = icmp ne i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_NE_6:%.*]] = icmp ne i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_NE_1]], i1 [[CMP_NE_2]], i1 [[CMP_NE_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_NE_4]], i1 [[CMP_NE_5]], i1 [[CMP_NE_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_NE_1]], i1 noundef [[CMP_NE_2]], i1 noundef [[CMP_NE_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_NE_4]], i1 noundef [[CMP_NE_5]], i1 noundef [[CMP_NE_6]])
 ; CGSCC-NEXT:    [[CMP_UGT_1:%.*]] = icmp ugt i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_UGT_2:%.*]] = icmp ugt i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_UGT_3:%.*]] = icmp ugt i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_UGT_4:%.*]] = icmp ugt i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_UGT_5:%.*]] = icmp ugt i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_UGT_6:%.*]] = icmp ugt i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_UGT_1]], i1 [[CMP_UGT_2]], i1 [[CMP_UGT_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_UGT_4]], i1 [[CMP_UGT_5]], i1 [[CMP_UGT_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_UGT_1]], i1 noundef [[CMP_UGT_2]], i1 noundef [[CMP_UGT_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_UGT_4]], i1 noundef [[CMP_UGT_5]], i1 noundef [[CMP_UGT_6]])
 ; CGSCC-NEXT:    [[CMP_UGE_1:%.*]] = icmp uge i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_UGE_2:%.*]] = icmp uge i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_UGE_3:%.*]] = icmp uge i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_UGE_4:%.*]] = icmp uge i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_UGE_5:%.*]] = icmp uge i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_UGE_6:%.*]] = icmp uge i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_UGE_1]], i1 [[CMP_UGE_2]], i1 [[CMP_UGE_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_UGE_4]], i1 [[CMP_UGE_5]], i1 [[CMP_UGE_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_UGE_1]], i1 noundef [[CMP_UGE_2]], i1 noundef [[CMP_UGE_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_UGE_4]], i1 noundef [[CMP_UGE_5]], i1 noundef [[CMP_UGE_6]])
 ; CGSCC-NEXT:    [[CMP_SGT_1:%.*]] = icmp sgt i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_SGT_2:%.*]] = icmp sgt i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_SGT_3:%.*]] = icmp sgt i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_SGT_4:%.*]] = icmp sgt i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_SGT_5:%.*]] = icmp sgt i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_SGT_6:%.*]] = icmp sgt i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_SGT_1]], i1 [[CMP_SGT_2]], i1 [[CMP_SGT_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_SGT_4]], i1 [[CMP_SGT_5]], i1 [[CMP_SGT_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_SGT_1]], i1 noundef [[CMP_SGT_2]], i1 noundef [[CMP_SGT_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_SGT_4]], i1 noundef [[CMP_SGT_5]], i1 noundef [[CMP_SGT_6]])
 ; CGSCC-NEXT:    [[CMP_GTE_1:%.*]] = icmp sge i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_GTE_2:%.*]] = icmp sge i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_GTE_3:%.*]] = icmp sge i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_GTE_4:%.*]] = icmp sge i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_GTE_5:%.*]] = icmp sge i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_GTE_6:%.*]] = icmp sge i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_GTE_1]], i1 [[CMP_GTE_2]], i1 [[CMP_GTE_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_GTE_4]], i1 [[CMP_GTE_5]], i1 [[CMP_GTE_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_GTE_1]], i1 noundef [[CMP_GTE_2]], i1 noundef [[CMP_GTE_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_GTE_4]], i1 noundef [[CMP_GTE_5]], i1 noundef [[CMP_GTE_6]])
 ; CGSCC-NEXT:    [[CMP_SLT_1:%.*]] = icmp slt i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_SLT_2:%.*]] = icmp slt i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_SLT_3:%.*]] = icmp slt i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_SLT_4:%.*]] = icmp slt i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_SLT_5:%.*]] = icmp slt i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_SLT_6:%.*]] = icmp slt i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_SLT_1]], i1 [[CMP_SLT_2]], i1 [[CMP_SLT_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_SLT_4]], i1 [[CMP_SLT_5]], i1 [[CMP_SLT_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_SLT_1]], i1 noundef [[CMP_SLT_2]], i1 noundef [[CMP_SLT_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_SLT_4]], i1 noundef [[CMP_SLT_5]], i1 noundef [[CMP_SLT_6]])
 ; CGSCC-NEXT:    [[CMP_LTE_1:%.*]] = icmp sle i32 [[RET]], 10
 ; CGSCC-NEXT:    [[CMP_LTE_2:%.*]] = icmp sle i32 [[RET]], 9
 ; CGSCC-NEXT:    [[CMP_LTE_3:%.*]] = icmp sle i32 [[RET]], 8
 ; CGSCC-NEXT:    [[CMP_LTE_4:%.*]] = icmp sle i32 [[RET]], 1
 ; CGSCC-NEXT:    [[CMP_LTE_5:%.*]] = icmp sle i32 [[RET]], 0
 ; CGSCC-NEXT:    [[CMP_LTE_6:%.*]] = icmp sle i32 [[RET]], -1
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_LTE_1]], i1 [[CMP_LTE_2]], i1 [[CMP_LTE_3]])
-; CGSCC-NEXT:    tail call void @use3(i1 [[CMP_LTE_4]], i1 [[CMP_LTE_5]], i1 [[CMP_LTE_6]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_LTE_1]], i1 noundef [[CMP_LTE_2]], i1 noundef [[CMP_LTE_3]])
+; CGSCC-NEXT:    tail call void @use3(i1 noundef [[CMP_LTE_4]], i1 noundef [[CMP_LTE_5]], i1 noundef [[CMP_LTE_6]])
 ; CGSCC-NEXT:    ret void
 ;
   %ret = tail call i32 @test0(i32 *%p)
 
   ; ret = [0, 10), eq
   %cmp-eq-1 = icmp eq i32 %ret, 10
   %cmp-eq-2 = icmp eq i32 %ret, 9
   %cmp-eq-3 = icmp eq i32 %ret, 8

llvm/test/Transforms/InstCombine/freeze.ll

;
   %p = load ptr, ptr %ptr, !dereferenceable_or_null !1
   %p.fr = freeze ptr %p
   ret ptr %p.fr
 }
 
 define i32 @freeze_load_with_range(ptr %ptr) {
 ; CHECK-LABEL: @freeze_load_with_range(
 ; CHECK-NEXT:    [[X:%.*]] = load i32, ptr [[PTR:%.*]], align 4, !range [[RNG2:![0-9]+]]
-; CHECK-NEXT:    [[X_FR:%.*]] = freeze i32 [[X]]
-; CHECK-NEXT:    ret i32 [[X_FR]]
+; CHECK-NEXT:    ret i32 [[X]]
 ;
   %x = load i32, ptr %ptr, !range !2
   %x.fr = freeze i32 %x
   ret i32 %x.fr
 }
 
 declare i32 @foo.i32()
 
 define i32 @freeze_call_with_range() {
 ; CHECK-LABEL: @freeze_call_with_range(
 ; CHECK-NEXT:    [[X:%.*]] = call i32 @foo.i32(), !range [[RNG2]]
-; CHECK-NEXT:    [[X_FR:%.*]] = freeze i32 [[X]]
-; CHECK-NEXT:    ret i32 [[X_FR]]
+; CHECK-NEXT:    ret i32 [[X]]
 ;
   %x = call i32 @foo.i32(), !range !2
   %x.fr = freeze i32 %x
   ret i32 %x.fr
 }
 
 !0 = !{}
 !1 = !{i64 4}
 !2 = !{i32 0, i32 100}