LangRef: clarify semantics of `dereferenceable`

[RalfJung]

It is well-known, albeit unfortunately not documented in the LangRef, that dereferenceable on an argument means "this pointer must be dereferenceable for the entire duration of the function call".

But, what exactly does dereferenceable on the return type mean? This example by @nikic shows that apparently it does not just mean "dereferenceable here and now". But then what exactly is the scope for which that pointer is assumed to be dereferenceable? Is it the entire caller? That seems odd for two reasons:

• How can a function promise that its caller will keep the pointer dereferenceable? It has no way of knowing that...
• What about inlining? If this doesn't do anything special, it will extend the scope for which dereferenceable has to hold. To make that correct, basically dereferenceable would have to mean "dereferenceable for the entire rest of the program execution". Is that really the intent?

EDIT: Seems like indeed this persists through inlining.

[programmerjake]

I got it to miscompile from rust: https://rust.godbolt.org/z/f5WjG7E61
I don't think I have Rust-level UB, but am not sure

[nikic]

Worth noting that Clang also emits deferenceable on reference returns, and those references obviously can't be assumed to be dereferenceable forever.

[RalfJung]

Clang also emits deferenceable on C++ reference arguments, which is also unsound.