LLVM replaces pointer with null without respecting provenance

[maxdexh]

Based on an observation by @scottmcm on zulip.

https://rust.godbolt.org/z/z6Evsrdob

pub fn wat(p: *const u8) -> *const u8 {
    assert!(p.is_null());
    p // optimized to `ptr null`, without provenance
}

pub fn off_and_back(p: *const u8, n: usize) -> *const u8 {
    let q = p.wrapping_add(n); // q = p + n
    assert!(q.is_null(), "{q:?} is not null");
    wat(q).wrapping_sub(n) // q - n = p
}

pub fn broken(x: &u8) -> u8 {
    // SAFETY: `off_and_back` returns `x`, which is valid for reads
    unsafe {
        off_and_back(x, std::ptr::from_ref(x).addr().wrapping_neg())
            .read()
    }
}


pub fn main() {
    // panics on "0x0 is not null"
    broken(std::hint::black_box(&1));
}

Similar issue: #80309

@rustbot label I-miscompile A-llvm I-unsound T-compiler

[maxdexh]

As pointed out by @tmiasko, this is case 2 of llvm/llvm-project#220206.

Related: #162078 (case 1 of the llvm issue), #147538 (case 3 of the llvm issue)

[maxdexh]

cc @nikic