Bug type: miscompilation
Component: DeadStoreElimination
Bug location: llvm/lib/Transforms/Scalar/DeadStoreElimination.cpp: DSEState::getInitializesArgMemLoc
Issue title: [FuncAttrs] `initializes` is incorrectly set on parameters with `byval`
Labels: miscompilation
llvm:transforms
Reported by: dtcxzyw

Reproducer: https://godbolt.org/z/Mcx1nY4E7
```
; bin/opt -passes=function-attrs reduced.ll -S
%struct.a = type { i32, i64, i32, i32 }

@e = dso_local global { i32, [4 x i8], i64, i32, i32 } { i32 5, [4 x i8] zeroinitializer, i64 0, i32 1, i32 90986701 }, align 8

define i8 @ad(ptr byval(%struct.a) %ah) {
entry:
  store i32 0, ptr %ah, align 8
  %call = call i64 @af(ptr %ah)
  %0 = load i8, ptr %ah, align 1
  ret i8 %0
}

define i64 @af(ptr byval(%struct.a) %am) {
entry:
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 8 dereferenceable(24) %am, ptr noundef nonnull align 8 dereferenceable(24) @e, i64 24, i1 false)
  ret i64 0
}

```
```
define i8 @ad(ptr byval(%struct.a) captures(none) initializes((0, 4)) %ah) #0 {
  store i32 0, ptr %ah, align 8
  %call = call i64 @af(ptr %ah)
  %0 = load i8, ptr %ah, align 1
  ret i8 %0
}

define noundef i64 @af(ptr writeonly byval(%struct.a) captures(none) initializes((0, 24)) %am) #0 {
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 8 dereferenceable(24) %am, ptr noundef nonnull align 8 dereferenceable(24) @e, i64 24, i1 false)
  ret i64 0
}
```
After DSE:
```
define i8 @ad(ptr byval(%struct.a) captures(none) initializes((0, 4)) %ah) #0 {
  %call = call i64 @af(ptr %ah)
  %0 = load i8, ptr %ah, align 1
  ret i8 %0
}

define noundef i64 @af(ptr writeonly byval(%struct.a) captures(none) initializes((0, 24)) %am) #0 {
  ret i64 0
}
```

llvm version: d21fc58aeeaa7f0369a24dbe70a0360e0edbf76f


Comments: author: nikic
body: > We should also emit the padding for %struct.a.

Without commenting on whether we should or shouldn't, why is not having the padding a miscompile? As this is not a packed struct, for a i64:64 target, LLVM will implicitly insert the padding and it should have the correct size.
author: dtcxzyw
body: >  As this is not a packed struct, for a i64:64 target, LLVM will implicitly insert the padding and it should have the correct size.

Sorry. It is a DSE bug.

author: dtcxzyw
body: cc @haopliu 
author: nikic
body: @dtcxzyw I think your new IR is over-reduced. You have `initializes((0, 24)` on `@af`, so I think eliminating the store is correct.
author: dtcxzyw
body: > [@dtcxzyw](https://github.com/dtcxzyw) I think your new IR is over-reduced. You have `initializes((0, 24)` on `@af`, so I think eliminating the store is correct.

Fixed.
author: nikic
body: There are two ways we can fix this, depending on what we want the semantics to do:

 1. Don't infer initializes on byval arguments. initializes on byval refers to the original caller memory (or having both attributes is made a verifier error).
 2. Infer initializes on byval, but don't use it in DSE. initializes on byval refers to the callee copy. This matches the semantics of readonly on byval.

I think variant 2 is marginally more powerful. For example, we could do a backend optimization where byval + initializes will allocate the full size of byval on the stack but not copy over the parts covered by initializes.

Fix patch:
commit 2d31a12dbe2339d20844ede70cbb54dbaf4ceea9
Author: Nikita Popov <npopov@redhat.com>
Date:   Mon Feb 10 10:34:03 2025 +0100

    [DSE] Don't use initializes on byval argument (#126259)
    
    There are two ways we can fix this problem, depending on how the
    semantics of byval and initializes should interact:
    
    * Don't infer initializes on byval arguments. initializes on byval
    refers to the original caller memory (or having both attributes is made
    a verifier error).
    * Infer initializes on byval, but don't use it in DSE. initializes on
    byval refers to the callee copy. This matches the semantics of readonly
    on byval. This is slightly more powerful, for example, we could do a
    backend optimization where byval + initializes will allocate the full
    size of byval on the stack but not copy over the parts covered by
    initializes.
    
    I went with the second variant here, skipping byval + initializes in DSE
    (FunctionAttrs already doesn't propagate initializes past byval). I'm
    open to going in the other direction though.
    
    Fixes https://github.com/llvm/llvm-project/issues/126181.

diff --git a/llvm/lib/Transforms/Scalar/DeadStoreElimination.cpp b/llvm/lib/Transforms/Scalar/DeadStoreElimination.cpp
index 05b4f176bfc3..38454053b039 100644
--- a/llvm/lib/Transforms/Scalar/DeadStoreElimination.cpp
+++ b/llvm/lib/Transforms/Scalar/DeadStoreElimination.cpp
@@ -2283,7 +2283,9 @@ DSEState::getInitializesArgMemLoc(const Instruction *I) {
   for (unsigned Idx = 0, Count = CB->arg_size(); Idx < Count; ++Idx) {
     ConstantRangeList Inits;
     Attribute InitializesAttr = CB->getParamAttr(Idx, Attribute::Initializes);
-    if (InitializesAttr.isValid())
+    // initializes on byval arguments refers to the callee copy, not the
+    // original memory the caller passed in.
+    if (InitializesAttr.isValid() && !CB->isByValArgument(Idx))
       Inits = InitializesAttr.getValueAsConstantRangeList();
 
     Value *CurArg = CB->getArgOperand(Idx);


Regression tests:
file: llvm/test/Transforms/DeadStoreElimination/inter-procedural.ll
commands: opt < %s -passes=dse -enable-dse-initializes-attr-improvement -S
tests: test_name: test_byval
test_body: %struct.a = type { i32, i64, i32, i32 }

@e = dso_local global { i32, [4 x i8], i64, i32, i32 } { i32 5, [4 x i8] zeroinitializer, i64 0, i32 1, i32 90986701 }, align 8

define i8 @ad(ptr byval(%struct.a) %ah) {
entry:
  store i32 0, ptr %ah, align 8
  %call = call i64 @af(ptr %ah)
  %0 = load i8, ptr %ah, align 1
  ret i8 %0
}

define i64 @af(ptr byval(%struct.a) initializes((0, 24)) %am) {
entry:
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 8 dereferenceable(24) %am, ptr noundef nonnull align 8 dereferenceable(24) @e, i64 24, i1 false)
  ret i64 0
}

define i32 @main() {
  %res = call i8 @ad(ptr @e)
  %val = sext i8 %res to i32
  ret i32 %val
}