Write to readonly byval argument is not considered UB

[erikdesjardins]

Demo: https://alive2.llvm.org/ce/z/L6zCAg

define void @src(ptr readonly byval(i8) %p) {
  store i8 0, ptr %p
  ret void
}

define void @tgt(ptr readonly byval(i8) %p) {
  unreachable
}

Transformation doesn't verify!

ERROR: Source is more defined than target

This behavior makes some sense, since byval means the argument is copied, so callers can't see any writes.

But, LangRef implies that this is illegal:

The copy is considered to belong to the caller not the callee (for example, readonly functions should not write to byval parameters).

And optimizations do treat it as UB in practice. llvm/llvm-project#64289 is an end-to-end miscompile caused by tailcallelim introducing a write to a readonly byval argument.