ptrtoaddr fold doesn't take gep overflow into account

[nunoplopes]

The gep below needs to be inbounds.

; Transforms/InstSimplify/ptrtoaddr.ll
@g = global 1 bytes, align 1

define i64 @ptrtoaddr_sub_consts_offset() {
  %__constexpr_1 = gep ptr @g, 1 x i64 42
  %__constexpr_0 = ptrtoaddr ptr %__constexpr_1 to i64
  %__constexpr_2 = ptrtoaddr ptr @g to i64
  %sub = sub i64 %__constexpr_0, %__constexpr_2
  ret i64 %sub
}
=>
@g = global 1 bytes, align 1

define i64 @ptrtoaddr_sub_consts_offset() {
  ret i64 42
}
Transformation doesn't verify! (unsound)
ERROR: Value mismatch

Example:

Source:
ptr %__constexpr_1 = pointer(non-local, block_id=0, offset=42) / Address=#x1c
i64 %__constexpr_0 = #x000000000000001c (28)
i64 %__constexpr_2 = #x00000000000000f2 (242)
i64 %sub = #xffffffffffffff2a (18446744073709551402, -214)

SOURCE MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >	size: 1	align: 1	alloc type: 0	alive: true	address: #xf2

Source value: #xffffffffffffff2a (18446744073709551402, -214)
Target value: #x000000000000002a (42)

cc @nikic

[nikic]

I don't understand the alive2 output. It seems like it performed the GEP on 8 bits maybe, even though the address width must be 64-bit (the ptrtoaddr result type)?

[nunoplopes]

Sorry, I didn't read the counterexample carefully. This is false positive of Alive2 (optimizing offset size too much).