[BasicAA] Fix zext & sext handling

[njw45]

Summary

There are several unhandled edge cases in BasicAA's GetLinearExpression method. This changes fixes outstanding issues, including zext / sext of a constant with the sign bit set, and the refusal to decompose zexts or sexts of wrapping arithmetic.

[njw45]

wip

[njw45]

wip

[njw45]

wip

[njw45]

wip

[njw45]

wip

[hfinkel]

I think this is moving in the right direction.

lib/Analysis/BasicAliasAnalysis.cpp

205

nsw -> NSW, nuw -> NUW as per the coding convention.

317

And, generally speaking, you should clang-format the patch.

1168

Can you move this into a separate function?

[njw45]

wip

[njw45]

Hi @hfinkel - I've made the fixes you suggested and have added a couple more comments. Thanks -

Nick

[hfinkel]

lib/Analysis/BasicAliasAnalysis.cpp

219

Why do we always zero-extend here? Why not sign extend? There should at least be a comment explaining this.

230

You might want to add "see below" or some other hint to where this happens.

317

this -> This

320

we -> We

[njw45]

wip

[njw45]

Thanks for the review, @hfinkel - I've updated the commit.

[hfinkel]

LGTM, thanks!

[njw45]

Sorry I dropped the ball on this - could you commit it for me as I still
don't have commit access? Thanks -

Nick

[sanjoy]

Some drop-by-comments inline in case you find them useful. I see this patch has been LGTM'ed so feel free to ignore. :)

lib/Analysis/BasicAliasAnalysis.cpp

317

I'm not sure I understand the comment -- this clause looks like it is implementing sext(sext(X,a),b) == sext(X, a + b).

322

Why is the .zextOrSelf(OldWidth) or the .trunc(SmallWidth) needed? Isn't OldWidth always equal to SmallWidth?

978

Do you mean i3? Additions in i8 are modulo 256.

982

Minor: APIntOps::umin may be clearer here.

[hfinkel]

In D6682#151887, @sanjoy wrote:

Some drop-by-comments inline in case you find them useful. I see this patch has been LGTM'ed so feel free to ignore. :)

No, that's not how things work. All comments need to be addressed. Pre- or post-commit.

In any case, this patch needs to be rebased because it no longer applies cleanly to trunk.

[njw45]

[BasicAA] Fix zext & sext handling

There are several unhandled edge cases in BasicAA's GetLinearExpression method. This changes fixes outstanding issues, including zext / sext of a constant with the sign bit set, and the refusal to decompose zexts or sexts of wrapping arithmetic.

[njw45]

@sanjoy - thanks for the review; bugs in this class are rather hard to track down as they only really manifest themselves in later optimisations, so more eyes are definitely appreciated :). I've replied to all your comments in-line - let me know if anything's not clear.

Nick

lib/Analysis/BasicAliasAnalysis.cpp

317

My latest commit adds more comments to make this clearer - does that explain it well enough?

322

This method can call itself recursively, and so the operator width reduces as we look through zexts + sexts, but the offset always stays at the initial width.

978

You're right - and I've added several unit tests prefixed "constantOffsetHeuristic_" to q.bad.ll to explore this behaviour (and to verify that I'm picking the right scales to multiply by in the heuristic).

982

Thanks - code reviews are one of the best ways to discover new utility functions in the codebase :)

[njw45]

Remove dead code left from testing

[njw45]

Hi Sanjoy - have you had a chance to look at this yet? Thanks -

Nick

[sanjoy]

lib/Analysis/BasicAliasAnalysis.cpp

265

Note that currently in the LangRef, shl nsw X, Y is not the same as mul nsw X (1 << Y), the LangRef has a bug in this regard. David has an out of tree patch to fix this http://reviews.llvm.org/D8890 but meanwhile you might want to not propagate nuw and nsw for shifts.

319

Very minor, but I think it will be clearer if you just add an annotation to each branch of the if statement:

if (is<SEXtInst>(V) && ZExtBits == 0) {
  // sext(sext(A)) == sext(A)

etc. instead of a comprehensive meta comment.

[njw45]

Address review comments

[njw45]

Hi @sanjoy - I've revised the patch to incorporate your suggestions. Is it OK now? Thanks -

Nick

lib/Analysis/BasicAliasAnalysis.cpp

265

That's interesting - I've added an early escape for the Shl that sets NSW & NUW to false in the latest version of this patch so they won't be propagated.

319

I've changed this in my latest revision of this patch.

[sanjoy]

LGTM, please check in.

[njw45]

Thanks @sanjoy - however I don't have commit rights to the repo so could you (or @hfinkel) commit it for me? Thanks -

Nick

[sanjoy]

I'll take care of it.

lib/Analysis/BasicAliasAnalysis.cpp

namespace {
   enum ExtensionKind {
     EK_NotExtended,
     EK_SignExt,
     EK_ZeroExt
   };
 
   struct VariableGEPIndex {
     const Value *V;
-    ExtensionKind Extension;
+
+    // We need to track what extensions we've done as we consider the same Value
+    // with different extensions as different variables in a GEP's linear expression;
+    // e.g.: if V == -1, then sext(x) != zext(x)
+    SmallVector<ExtensionKind, 6> Extensions;
     int64_t Scale;
 
     bool operator==(const VariableGEPIndex &Other) const {
-      return V == Other.V && Extension == Other.Extension &&
+      return V == Other.V && Extensions == Other.Extensions &&
         Scale == Other.Scale;
     }
 
     bool operator!=(const VariableGEPIndex &Other) const {
       return !operator==(Other);
     }
   };
 }
 
 
 /// GetLinearExpression - Analyze the specified value as a linear expression:
 /// "A*V + B", where A and B are constant integers.  Return the scale and offset
 /// values as APInts and return V as a Value*, and return whether we looked
 /// through any sign or zero extends.  The incoming Value is known to have
 /// IntegerType and it may already be sign or zero extended.
 ///
 /// Note that this looks through extends, so the high bits may not be
 /// represented in the result.
 static Value *GetLinearExpression(Value *V, APInt &Scale, APInt &Offset,
-                                  ExtensionKind &Extension,
+                                  SmallVectorImpl<ExtensionKind> &Extensions,
                                   const DataLayout &DL, unsigned Depth,
                                   AssumptionTracker *AT,
-                                  DominatorTree *DT) {
+                                  DominatorTree *DT,
+                                  bool &nsw,
+                                  bool &nuw) {
   assert(V->getType()->isIntegerTy() && "Not an integer value");
 
   // Limit our recursion depth.
   if (Depth == 6) {
     Scale = 1;
     Offset = 0;
     return V;
   }
 
   if (ConstantInt *Const = dyn_cast<ConstantInt>(V)) {
     // if it's a constant, just convert it to an offset
     // and remove the variable.
-    Offset += Const->getValue();
+    Offset += Const->getValue().zextOrSelf(Offset.getBitWidth());
     assert(Scale == 0 && "Constant values don't have a scale");
     return V;
   }
 
-  if (BinaryOperator *BOp = dyn_cast<BinaryOperator>(V)) {
+  if(BinaryOperator *BOp = dyn_cast<BinaryOperator>(V)) {
     if (ConstantInt *RHSC = dyn_cast<ConstantInt>(BOp->getOperand(1))) {
       switch (BOp->getOpcode()) {
-      default: break;
+      default:
+        // We don't understand this instruction, so we can't decompose it any 
+        // further.
+        Scale = 1;
+        Offset = 0;
+        return V;
       case Instruction::Or:
         // X|C == X+C if all the bits in C are unset in X.  Otherwise we can't
         // analyze it.
         if (!MaskedValueIsZero(BOp->getOperand(0), RHSC->getValue(), &DL, 0,
                                AT, BOp, DT))
           break;
         // FALL THROUGH.
       case Instruction::Add:
-        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
-                                DL, Depth+1, AT, DT);
-        Offset += RHSC->getValue();
-        return V;
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extensions,
+                                DL, Depth+1, AT, DT, nsw, nuw);
+        Offset += RHSC->getValue().zextOrSelf(Offset.getBitWidth());
+        break;
+      case Instruction::Sub:
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extensions,
+                                DL, Depth+1, AT, DT, nsw, nuw);
+        Offset -= RHSC->getValue().zextOrSelf(Offset.getBitWidth());
+        break;
       case Instruction::Mul:
-        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
-                                DL, Depth+1, AT, DT);
-        Offset *= RHSC->getValue();
-        Scale *= RHSC->getValue();
-        return V;
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extensions,
+                                DL, Depth+1, AT, DT, nsw, nuw);
+        Offset *= RHSC->getValue().zextOrSelf(Offset.getBitWidth());
+        Scale *= RHSC->getValue().zextOrSelf(Offset.getBitWidth());
+        break;
       case Instruction::Shl:
-        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
-                                DL, Depth+1, AT, DT);
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extensions,
+                                DL, Depth+1, AT, DT, nsw, nuw);
         Offset <<= RHSC->getValue().getLimitedValue();
         Scale <<= RHSC->getValue().getLimitedValue();
-        return V;
+        break;
       }
+
+      if(isa<OverflowingBinaryOperator>(BOp)) {
+        nuw &= BOp->hasNoUnsignedWrap();
+        nsw &= BOp->hasNoSignedWrap();
+      }
+      return V;
     }
   }
 
   // Since GEP indices are sign extended anyway, we don't care about the high
   // bits of a sign or zero extended value - just scales and offsets.  The
   // extensions have to be consistent though.
-  if ((isa<SExtInst>(V) && Extension != EK_ZeroExt) ||
-      (isa<ZExtInst>(V) && Extension != EK_SignExt)) {
+  if (isa<SExtInst>(V) ||
+      isa<ZExtInst>(V)) {
     Value *CastOp = cast<CastInst>(V)->getOperand(0);
-    unsigned OldWidth = Scale.getBitWidth();
-    unsigned SmallWidth = CastOp->getType()->getPrimitiveSizeInBits();
-    Scale = Scale.trunc(SmallWidth);
-    Offset = Offset.trunc(SmallWidth);
-    Extension = isa<SExtInst>(V) ? EK_SignExt : EK_ZeroExt;
-
-    Value *Result = GetLinearExpression(CastOp, Scale, Offset, Extension,
-                                        DL, Depth+1, AT, DT);
-    Scale = Scale.zext(OldWidth);
-
-    // We have to sign-extend even if Extension == EK_ZeroExt as we can't
-    // decompose a sign extension (i.e. zext(x - 1) != zext(x) - zext(-1)).
-    Offset = Offset.sext(OldWidth);
+    APInt SmallScale = Scale, SmallOffset = Offset;
+    Value *Result = GetLinearExpression(CastOp, SmallScale, SmallOffset, Extensions,
+                                        DL, Depth+1, AT, DT, nsw, nuw);
+
+    ExtensionKind ThisExt;
+    if(isa<SExtInst>(V)) {
+      ThisExt = EK_SignExt;
+      if(nsw) {
+        // we haven't sign-wrapped, so it's valid to decompose sext(%x + c)
+        // into sext(%x) + sext(c). We'll sext the Offset ourselves:
+        Scale = SmallScale;
+        Offset = SmallOffset.
+          trunc(CastOp->getType()->getPrimitiveSizeInBits()).
+          sext(Offset.getBitWidth());
+      } else {
+        // We may have signed-wrapped, so don't decompose sext(%x + c) into sext(%x) + sext(c)
+        Result = CastOp;
+      }
+    } else {
+      ThisExt = EK_ZeroExt;
+      if(nuw) {
+        Scale = SmallScale;
+        // We get the zext for free, as zext(trunc(%x)) == %x
+        Offset = SmallOffset;
+      } else {
+        // We may have unsigned-wrapped, so don't decompose zext(%x + c) into zext(%x) + zext(c)
+        Result = CastOp;
+      }
+    }
+
+    // zext(zext(%x)) == zext(%x), and similiarly for sext, so we don't need
+    // to have consective duplicate ExtensionKinds in the Extensions vector.
+    if (Extensions.empty() || Extensions.back() != ThisExt) {
+      Extensions.push_back(ThisExt);
+    }
 
     return Result;
   }
 
   Scale = 1;
   Offset = 0;
   return V;
 }
 
 /// DecomposeGEPExpression - If V is a symbolic pointer expression, decompose it
 /// into a base pointer with a constant offset and a number of scaled symbolic
 /// offsets.
 ///
 /// The scaled symbolic offsets (represented by pairs of a Value* and a scale in
 /// the VarIndices vector) are Value*'s that are known to be scaled by the
 /// specified amount, but which may have other unrepresented high bits. As such,
 /// the gep cannot necessarily be reconstructed from its decomposed form.
 ///
for (User::const_op_iterator I = GEPOp->op_begin()+1,
       // For an array/pointer, add the element offset, explicitly scaled.
       if (ConstantInt *CIdx = dyn_cast<ConstantInt>(Index)) {
         if (CIdx->isZero()) continue;
         BaseOffs += DL->getTypeAllocSize(*GTI)*CIdx->getSExtValue();
         continue;
       }
 
       uint64_t Scale = DL->getTypeAllocSize(*GTI);
-      ExtensionKind Extension = EK_NotExtended;
+
+      // size based on GetLinearExpression's recursion depth.
+      SmallVector<ExtensionKind, 6> Extensions;
 
       // If the integer type is smaller than the pointer size, it is implicitly
       // sign extended to pointer size.
       unsigned Width = Index->getType()->getIntegerBitWidth();
       if (DL->getPointerSizeInBits(AS) > Width)
-        Extension = EK_SignExt;
+        Extensions.push_back(EK_SignExt);
 
       // Use GetLinearExpression to decompose the index into a C1*V+C2 form.
       APInt IndexScale(Width, 0), IndexOffset(Width, 0);
-      Index = GetLinearExpression(Index, IndexScale, IndexOffset, Extension,
-                                  *DL, 0, AT, DT);
+      bool nsw = true, nuw = true;
+      Index = GetLinearExpression(Index, IndexScale, IndexOffset, Extensions,
+                                  *DL, 0, AT, DT, nsw, nuw);
 
       // The GEP index scale ("Scale") scales C1*V+C2, yielding (C1*V+C2)*Scale.
       // This gives us an aggregate computation of (C1*Scale)*V + C2*Scale.
       BaseOffs += IndexOffset.getSExtValue()*Scale;
       Scale *= IndexScale.getSExtValue();
 
       // If we already had an occurrence of this index variable, merge this
       // scale into it.  For example, we want to handle:
       //   A[x][x] -> x*16 + x*4 -> x*20
       // This also ensures that 'x' only appears in the index list once.
       for (unsigned i = 0, e = VarIndices.size(); i != e; ++i) {
         if (VarIndices[i].V == Index &&
-            VarIndices[i].Extension == Extension) {
+            VarIndices[i].Extensions == Extensions) {
           Scale += VarIndices[i].Scale;
           VarIndices.erase(VarIndices.begin()+i);
           break;
         }
       }
 
       // Make sure that we have a scale that makes sense for this target's
       // pointer size.
       if (unsigned ShiftBits = 64 - DL->getPointerSizeInBits(AS)) {
         Scale <<= ShiftBits;
         Scale = (int64_t)Scale >> ShiftBits;
       }
 
       if (Scale) {
-        VariableGEPIndex Entry = {Index, Extension,
+        VariableGEPIndex Entry = {Index, Extensions,
                                   static_cast<int64_t>(Scale)};
         VarIndices.push_back(Entry);
       }
     }
 
     // Analyze the base pointer next.
     V = GEPOp->getOperand(0);
   } while (--MaxLookup);
if (const GEPOperator *GEP2 = dyn_cast<GEPOperator>(V2)) {
     if ((BaseAlias == MayAlias) && V1Size == V2Size) {
       // Do the base pointers alias assuming type and size.
       AliasResult PreciseBaseAlias = aliasCheck(UnderlyingV1, V1Size,
                                                 V1AAInfo, UnderlyingV2,
                                                 V2Size, V2AAInfo);
       if (PreciseBaseAlias == NoAlias) {
         // See if the computed offset from the common pointer tells us about the
         // relation of the resulting pointer.
         int64_t GEP2BaseOffset;
         bool GEP2MaxLookupReached;
         SmallVector<VariableGEPIndex, 4> GEP2VariableIndices;
         const Value *GEP2BasePtr =
           DecomposeGEPExpression(GEP2, GEP2BaseOffset, GEP2VariableIndices,
                                  GEP2MaxLookupReached, DL, AT, DT);
         const Value *GEP1BasePtr =
           DecomposeGEPExpression(GEP1, GEP1BaseOffset, GEP1VariableIndices,
                                  GEP1MaxLookupReached, DL, AT, DT);
         // DecomposeGEPExpression and GetUnderlyingObject should return the
         // same result except when DecomposeGEPExpression has no DataLayout.
         if (GEP1BasePtr != UnderlyingV1 || GEP2BasePtr != UnderlyingV2) {
           assert(!DL &&
for (unsigned i = 0, e = GEP1VariableIndices.size(); i != e; ++i) {
         bool SignKnownZero, SignKnownOne;
         ComputeSignBit(
           const_cast<Value *>(V),
           SignKnownZero, SignKnownOne,
           DL, 0, AT, nullptr, DT);
 
         // Zero-extension widens the variable, and so forces the sign
         // bit to zero.
-        bool IsZExt = GEP1VariableIndices[i].Extension == EK_ZeroExt;
+        auto &Extensions = GEP1VariableIndices[i].Extensions;
+        bool IsZExt = !Extensions.empty() && Extensions.back() == EK_ZeroExt;
         SignKnownZero |= IsZExt;
         SignKnownOne &= !IsZExt;
 
         // If the variable begins with a zero then we know it's
         // positive, regardless of whether the value is signed or
         // unsigned.
         int64_t Scale = GEP1VariableIndices[i].Scale;
         AllPositive =
if (V1Size != UnknownSize && V2Size != UnknownSize &&
       return NoAlias;
 
     // If we know all the variables are positive, then GEP1 >= GEP1BasePtr.
     // If GEP1BasePtr > V2 (GEP1BaseOffset > 0) then we know the pointers
     // don't alias if V2Size can fit in the gap between V2 and GEP1BasePtr.
     if (AllPositive && GEP1BaseOffset > 0 && V2Size <= (uint64_t) GEP1BaseOffset)
       return NoAlias;
   }
 
   // Statically, we can see that the base objects are the same, but the
   // pointers have dynamic offsets which we can't resolve. And none of our
   // little tricks above worked.
   //
   // TODO: Returning PartialAlias instead of MayAlias is a mild hack; the
   // practical effect of this is protecting TBAA in the case of dynamic
   // indices into arrays of unions or malloc'd memory.
   return PartialAlias;

 void BasicAliasAnalysis::GetIndexDifference(
     SmallVectorImpl<VariableGEPIndex> &Dest,
     const SmallVectorImpl<VariableGEPIndex> &Src) {
   if (Src.empty())
     return;
 
   for (unsigned i = 0, e = Src.size(); i != e; ++i) {
     const Value *V = Src[i].V;
-    ExtensionKind Extension = Src[i].Extension;
+    auto Extensions = Src[i].Extensions;
     int64_t Scale = Src[i].Scale;
 
     // Find V in Dest.  This is N^2, but pointer indices almost never have more
     // than a few variable indexes.
     for (unsigned j = 0, e = Dest.size(); j != e; ++j) {
       if (!isValueEqualInPotentialCycles(Dest[j].V, V) ||
-          Dest[j].Extension != Extension)
+          Dest[j].Extensions != Extensions)
         continue;
 
       // If we found it, subtract off Scale V's from the entry in Dest.  If it
       // goes to zero, remove the entry.
       if (Dest[j].Scale != Scale)
         Dest[j].Scale -= Scale;
       else
         Dest.erase(Dest.begin() + j);
       Scale = 0;
       break;
     }
 
     // If we didn't consume this entry, add it to the end of the Dest list.
     if (Scale) {
-      VariableGEPIndex Entry = { V, Extension, -Scale };
+      VariableGEPIndex Entry = { V, Extensions, -Scale };
       Dest.push_back(Entry);
     }
   }
 }

test/Analysis/BasicAA/q.bad.ll

+; RUN: opt < %s -basicaa -aa-eval -print-all-alias-modref-info -disable-output 2>&1 | FileCheck %s
+target datalayout = "e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv7--linux-gnueabi"
+
+; CHECK-LABEL: test_zext_sext_255
+; CHECK: NoAlias: i8* %a, i8* %b
+define void @test_zext_sext_255(i8* %mem) {
+  %zext.255 = zext i8 255 to i16 ; 0x00FF
+  %sext.255 = sext i8 255 to i16 ; 0xFFFF
+  %zext.sext.255 = zext i16 %sext.255 to i32 ; 0x0000FFFF
+  %sext.zext.255 = sext i16 %zext.255 to i32 ; 0x000000FF
+  %zext.zext.sext.255 = zext i32 %zext.sext.255 to i64
+  %zext.sext.zext.255 = zext i32 %sext.zext.255 to i64
+  %a = getelementptr inbounds i8* %mem, i64 %zext.zext.sext.255
+  %b = getelementptr inbounds i8* %mem, i64 %zext.sext.zext.255
+  ret void
+}
+
+; CHECK-LABEL: test_path_dependence
+; CHECK: PartialAlias: i8* %a, i8* %b
+; CHECK: MustAlias: i8* %a, i8* %c
+; CHECK: PartialAlias: i8* %a, i8* %d
+define void @test_path_dependence(i32 %p, i8* %mem) {
+  %p.minus1 = add i32 %p, -1 ; this will always unsigned-wrap, unless %p == 0
+  %p.minus1.64 = zext i32 %p.minus1 to i64
+  %p.64.again = add i64 %p.minus1.64, 1 ; either %p (if we wrapped) or 4294967296 (if we didn't)
+
+  %p.nsw.nuw.minus1 = sub nsw nuw i32 %p, 1 ; as nuw we know %p >= 1, and as nsw %p <=   2147483647
+  %p.nsw.nuw.minus1.64 = zext i32 %p.nsw.nuw.minus1 to i64
+  %p.nsw.nuw.64.again = add nsw nuw i64 %p.nsw.nuw.minus1.64, 1 ; ...so always exactly %p
+
+  %p.nsw.minus1 = sub nsw i32 %p, 1 ; only nsw, so can only guarantee %p != 0x10000000
+  %p.nsw.minus1.64 = zext i32 %p.nsw.minus1 to i64 ; when %p > 0x10000000 (ie <= 0 as a signed number) then the zext will make this a huge positive number
+  %p.nsw.64.again = add nsw i64 %p.nsw.minus1.64, 1 ; ...and so this is very much != %p
+
+  %p.64 = zext i32 %p to i64
+  %a = getelementptr inbounds i8* %mem, i64 %p.64
+  %b = getelementptr inbounds i8* %mem, i64 %p.64.again
+  %c = getelementptr inbounds i8* %mem, i64 %p.nsw.nuw.64.again
+  %d = getelementptr inbounds i8* %mem, i64 %p.nsw.64.again
+  ret void
+}
+
+; CHECK-LABEL: test_zext_sext_num
+; CHECK: PartialAlias: i8* %a, i8* %b
+; %a and %b NoAlias if %num == 255 (see @test_zext_sext_255), but %a and %b NoAlias for other values of %num (e.g. 0)
+define void @test_zext_sext_num(i8* %mem, i8 %num) {
+  %zext.num = zext i8 %num to i16
+  %sext.num = sext i8 %num to i16
+  %zext.sext.num = zext i16 %sext.num to i32
+  %sext.zext.num = sext i16 %zext.num to i32
+  %zext.zext.sext.num = zext i32 %zext.sext.num to i64
+  %zext.sext.zext.num = zext i32 %sext.zext.num to i64
+  %a = getelementptr inbounds i8* %mem, i64 %zext.zext.sext.num
+  %b = getelementptr inbounds i8* %mem, i64 %zext.sext.zext.num
+  ret void
+}
+
+; CHECK-LABEL: based_on_pr18068
+; CHECK: NoAlias: i8* %a, i8* %b
+; CHECK: NoAlias: i8* %a, i8* %c
+define void @based_on_pr18068(i32 %loaded, i8* %mem) {
+  %loaded.64 = zext i32 %loaded to i64
+  %add1 = add i32 %loaded, -1 ; unsigned wraps unless %loaded == 0
+  %add1.64 = zext i32 %add1 to i64 ; is zext(%loaded) always != zext(%loaded - 1)? Yes -> NoAlias
+  %sub1 = sub i32 %loaded, 1 ; unsigned wraps iff %loaded == 0
+  %sub1.64 = zext i32 %sub1 to i64 ; is zext(%loaded) always != zext(%loaded - 1)? Yes -> NoAlias
+  %a = getelementptr inbounds i8* %mem, i64 %loaded.64
+  %b = getelementptr inbounds i8* %mem, i64 %add1.64
+  %c = getelementptr inbounds i8* %mem, i64 %sub1.64
+  ret void
+}
+
+; CHECK-LABEL: uncompressStream
+; CHECK: MustAlias:  i8* %a, i8* %b
+; CHECK: NoAlias:  i8* %a, i8* %c
+define void @uncompressStream(i8* %mem) {
+  %zext.255 = zext i8 255 to i32
+  %sext.255 = sext i8 255 to i32
+  %a = getelementptr inbounds i8* %mem, i32 255
+  %b = getelementptr inbounds i8* %mem, i32 %zext.255
+  %c = getelementptr inbounds i8* %mem, i32 %sext.255
+  ret void
+}