[InstCombine] Pointer equality propagated without regard to provenance

[dtcxzyw]

It is a variant of #115574.
Reproducer: https://alive2.llvm.org/ce/z/FLg923

define ptr @src1(ptr %p, ptr %q) {
#0:
  %cmp = icmp eq ptr %p, %q
  %#1 = freeze i1 %cmp
  %select = select i1 %#1, ptr %p, ptr %q
  ret ptr %select
}
=>
define ptr @src1(ptr %p, ptr %q) {
#0:
  %q.fr = freeze ptr %q
  ret ptr %q.fr
}
Transformation doesn't verify!

ERROR: Value mismatch

Example:
ptr %p = pointer(non-local, block_id=1, offset=0) / Address=#x1
ptr %q = pointer(non-local, block_id=0, offset=1) / Address=#x1

Source:
i1 %cmp = #x1 (1)
i1 %#1 = #x1 (1)
ptr %select = pointer(non-local, block_id=1, offset=0) / Address=#x1

SOURCE MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >	size: 0	align: 1	alloc type: 0	alive: false	address: #x0
Block 1 >	size: 13	align: 1	alloc type: 0	alive: true	address: #x1
Block 2 >	size: 0	align: 1	alloc type: 0	alive: true	address: #xf

Target:
ptr %q.fr = pointer(non-local, block_id=0, offset=1) / Address=#x1

TARGET MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >	size: 0	align: 1	alloc type: 0	alive: false	address: #x0
Block 1 >	size: 13	align: 1	alloc type: 0	alive: true	address: #x1
Block 2 >	size: 0	align: 1	alloc type: 0	alive: true	address: #xf
Source value: pointer(non-local, block_id=1, offset=0) / Address=#x1
Target value: pointer(non-local, block_id=0, offset=1) / Address=#x1

[nikic]

I expect it's due to this special case fold:

llvm-project/llvm/lib/Transforms/InstCombine/InstCombineSelect.cpp

Lines 2937 to 2961 in 99ce206

	static Value *foldSelectWithFrozenICmp(SelectInst &Sel, InstCombiner::BuilderTy &Builder) {
	FreezeInst *FI = dyn_cast<FreezeInst>(Sel.getCondition());
	if (!FI)
	return nullptr;
	Value *Cond = FI->getOperand(0);
	Value *TrueVal = Sel.getTrueValue(), *FalseVal = Sel.getFalseValue();
	// select (freeze(x == y)), x, y --> y
	// select (freeze(x != y)), x, y --> x
	// The freeze should be only used by this select. Otherwise, remaining uses of
	// the freeze can observe a contradictory value.
	// c = freeze(x == y) ; Let's assume that y = poison & x = 42; c is 0 or 1
	// a = select c, x, y ;
	// f(a, c) ; f(poison, 1) cannot happen, but if a is folded
	// ; to y, this can happen.
	CmpPredicate Pred;
	if (FI->hasOneUse() &&
	match(Cond, m_c_ICmp(Pred, m_Specific(TrueVal), m_Specific(FalseVal))) &&
	(Pred == ICmpInst::ICMP_EQ || Pred == ICmpInst::ICMP_NE)) {
	return Pred == ICmpInst::ICMP_EQ ? FalseVal : TrueVal;
	}
	return nullptr;
	}

Note that this fold has become useless due to #154336 and should be deleted entirely, I just forgot about it.

[nikic]

I expect it's due to this special case fold:

Okay, having tried that, it's not this fold. I'll still put up a PR to delete it...

[dtcxzyw]

I am preparing for a fix: main...dtcxzyw:llvm-project:perf/fix-161636