[Attributor] Deduce dereferenceable based on accessed bytes map

[uenoku]

Summary

This patch introduces the deduction based on load/store instructions whose pointer operand is a non-inbounds GEP instruction.
For example if we have,

void f(int *u){
 u[0] = 0;
 u[1] = 1;
 u[2] = 2;
}

then u must be dereferenceable(12).

This patch is inspired by D64258

[spatel]

Please rebase/update with additional tests after:
rG2bd252ea8941

And what is the plan for enabling Attributor by default? Are there any known bugs?

[xbolva00]

And I think Attributor needs to run before InstCombine and after InstCombine too. InstCombine infers a lot of derefereceable attrs for libcalls but there is no pass to propagate info futher into function signature, etc.

[spatel]

There's also a question about whether this proposed Attributor functionality obsoletes:
D37579

[lebedev.ri]

In D70714#1760179, @spatel wrote:

There's also a question about whether this proposed Attributor functionality obsoletes:
D37579

Not in it's present state, no.
There's an upcoming RFC from @jdoerfert that will be aiming to improve that problem.

[jdoerfert]

After reading though the tests it looks to me like this works just fine. I still didn't quite understand why there is a std::max. Could you elaborate on that?

---

In D70714#1760190, @lebedev.ri wrote:

In D70714#1760179, @spatel wrote:

There's also a question about whether this proposed Attributor functionality obsoletes:
D37579

Not in it's present state, no.

Correct, I answered in the thread now as wellh.

There's an upcoming RFC from @jdoerfert that will be aiming to improve that problem.

No pressure, ...

In D70714#1760177, @xbolva00 wrote:

And I think Attributor needs to run before InstCombine and after InstCombine too. InstCombine infers a lot of derefereceable attrs for libcalls but there is no pass to propagate info futher into function signature, etc.

It needs to be (also) a CG-SCC pass. Working on that part right now.

In D70714#1760169, @spatel wrote:

Please rebase/update with additional tests after: rG2bd252ea8941

Yes. We have to figure out the test situation though. I think we need to copy all test used by the Attributor into a dedicted forlder. @uenoku @sstefan1 if one of you wants to start doing that, please let me know :)

And what is the plan for enabling Attributor by default? Are there any known bugs?

Not at the time of the Dev meeting. The roadmap I made up right now:

• Make it an CG-SCC pass and run it in the inliner loop.
• Introduce a switch that determines what values we initially look at (the seeding phase) to limit compile time (which was not bad!).
• Redo my testing and fixing of new/exposed bugs.
• Send and RFC telling people to please run their tests with the Attributor.
• Enable it by default

Help with any of the steps is always appreciated, the first one I think I've got though.

llvm/include/llvm/Transforms/IPO/Attributor.h

1829

Could we do uint64_t?

1842

This confuses me. Do we handle "holes" correctly? Do we have a test for holes?

I mean

int *A = ...
A[ 0] = 2
A[10] = 1

should not result in deref(40) if the geps are not inbounds.

1900

Why std::max? I thought the map holds <offset, size> entries.

llvm/test/Transforms/FunctionAttrs/align.ll

372 ↗

(On Diff #231053)

This is due to the special case with offset 0, correct? If so, commit that special case and these test changes on their own. LGTM on that part.

llvm/test/Transforms/InferFunctionAttrs/dereferenceable.ll

236

Here do the "hole" test start. I see.

[uenoku]

Yes. We have to figure out the test situation though. I think we need to copy all test used by the Attributor into a dedicted forlder. @uenoku @sstefan1 if one of you wants to start doing that, please let me know :)

I can work on this. You mean that copy all test in Transforms/FunctionAttrs/, Transforms/InferFunctionAttrs/ to some directory(something like Transforms/Attributor, right? What about ArgumentPromotion or something like that?

llvm/include/llvm/Transforms/IPO/Attributor.h

1842

int f(int *A){
   *A = 0;
   *(A+2) = 2;
   *(A+1) = 1;
   *(A+10) = 10;
}

In that case, AccessedBytesMap is {0:4, 4:4, 8:4, 40:4}. AccessedBytesMap is std::map so it is iterated in accending order on key(Offset).
So KnownBytes will be updated like this:

Access	KnownBytes
(0, 4)	0 -> 4
(4, 4)	4 -> 8
(8, 4)	8 -> 12
(40, 4)	12 (break)

1900

I want to handle these cases:

void f(int *A){
  double *B = (double*)A; 
  *B = 0.0;
  *A = 0;
}
void g(int *A){
  double *B = (double*)A; 
  *A = 0;
  *B = 0.0;
}

llvm/test/Transforms/FunctionAttrs/align.ll

372 ↗

(On Diff #231053)

Yes. I'll commit separately.

[jdoerfert]

LGTM with two requests inlined.

In D70714#1761254, @uenoku wrote:

Yes. We have to figure out the test situation though. I think we need to copy all test used by the Attributor into a dedicted forlder. @uenoku @sstefan1 if one of you wants to start doing that, please let me know :)

I can work on this. You mean that copy all test in Transforms/FunctionAttrs/, Transforms/InferFunctionAttrs/ to some directory(something like Transforms/Attributor, right? What about ArgumentPromotion or something like that?

Yes, that is what I mean. Start with the ones that run the Attributor right now, or which should run the Attributor right now.

llvm/include/llvm/Transforms/IPO/Attributor.h

1842

This was too smart for me. Can you put this example as a comment into or above computeKnownDerefBytesFromAccessedMap please? I know I'll forget it again.

1900

Makes sense! I think I was just tired and didn't read the code properly. Can you add this as a test case?

[uenoku]

llvm/include/llvm/Transforms/IPO/Attributor.h

1829

<int64_t, uint64_t> is fine but <uint64_t, uint64_t> is not good considering minus offset.

1900

OK, I'll add it.

[uenoku]

Rebase and address comments.

[uenoku]

llvm/test/Transforms/InferFunctionAttrs/dereferenceable.ll

278

It will be fixed in D70789

[uenoku]

Add test

[uenoku]

Rebase

llvm/include/llvm/Transforms/IPO/Attributor.h

 };
 
 /// State for dereferenceable attribute
 struct DerefState : AbstractState {
 
   /// State representing for dereferenceable bytes.
   IncIntegerState<> DerefBytesState;
 
+  /// Map representing for accessed memory offsets and sizes.
+  /// A key is Offset and a value is size.
+  /// If there is a load/store instruction something like,
+  ///   p[offset] = v;
+  /// (offset, sizeof(v)) will be inserted to this map.
+  /// std::map is used because we want to iterate keys in ascending order.
+  std::map<int64_t, uint64_t> AccessedBytesMap;
+
+  /// Helper function to calculate dereferenceable bytes from current known
+  /// bytes and accessed bytes.
+  ///
+  /// int f(int *A){
+  ///    *A = 0;
+  ///    *(A+2) = 2;
+  ///    *(A+1) = 1;
+  ///    *(A+10) = 10;
+  /// }
+  /// ```
+  /// In that case, AccessedBytesMap is `{0:4, 4:4, 8:4, 40:4}`.
+  /// AccessedBytesMap is std::map so it is iterated in accending order on
+  /// key(Offset). So KnownBytes will be updated like this: |Access | KnownBytes
+  /// |(0, 4)| 0 -> 4
+  /// |(4, 4)| 4 -> 8
+  /// |(8, 4)| 8 -> 12
+  /// |(40, 4) | 12 (break)
+  void computeKnownDerefBytesFromAccessedMap() {
+    int64_t KnownBytes = DerefBytesState.getKnown();
+    for (auto &Access : AccessedBytesMap) {
+      if (KnownBytes < Access.first)
+        break;
+      KnownBytes = std::max(KnownBytes, Access.first + (int64_t)Access.second);
+    }
+
+    DerefBytesState.takeKnownMaximum(KnownBytes);
+  }
+
   /// State representing that whether the value is globaly dereferenceable.
   BooleanState GlobalState;
 
   /// See AbstractState::isValidState()
   bool isValidState() const override { return DerefBytesState.isValidState(); }
 
   /// See AbstractState::isAtFixpoint()
   bool isAtFixpoint() const override {
ChangeStatus indicatePessimisticFixpoint() override {
     DerefBytesState.indicatePessimisticFixpoint();
     GlobalState.indicatePessimisticFixpoint();
     return ChangeStatus::CHANGED;
   }
 
   /// Update known dereferenceable bytes.
   void takeKnownDerefBytesMaximum(uint64_t Bytes) {
     DerefBytesState.takeKnownMaximum(Bytes);
+
+    // Known bytes might increase.
+    computeKnownDerefBytesFromAccessedMap();
   }
 
   /// Update assumed dereferenceable bytes.
   void takeAssumedDerefBytesMinimum(uint64_t Bytes) {
     DerefBytesState.takeAssumedMinimum(Bytes);
   }
 
+  /// Add accessed bytes to the map.
+  void addAccessedBytes(int64_t Offset, uint64_t Size) {
+    AccessedBytesMap[Offset] = std::max(AccessedBytesMap[Offset], Size);
+
+    // Known bytes might increase.
+    computeKnownDerefBytesFromAccessedMap();
+  }
+
   /// Equality for DerefState.
   bool operator==(const DerefState &R) {
     return this->DerefBytesState == R.DerefBytesState &&
            this->GlobalState == R.GlobalState;
   }
 
   /// Inequality for DerefState.
   bool operator!=(const DerefState &R) { return !(*this == R); }

llvm/lib/Transforms/IPO/Attributor.cpp

struct AADereferenceableImpl : AADereferenceable {
   }
 
   /// See AbstractAttribute::getState()
   /// {
   StateType &getState() override { return *this; }
   const StateType &getState() const override { return *this; }
   /// }
 
+  /// Helper function for collecting accessed bytes in must-be-executed-context
+  void addAccessedBytesForUse(Attributor &A, const Use *U,
+                              const Instruction *I) {
+    const Value *UseV = U->get();
+    if (!UseV->getType()->isPointerTy())
+      return;
+
+    Type *PtrTy = UseV->getType();
+    const DataLayout &DL = A.getDataLayout();
+    int64_t Offset;
+    if (const Value *Base = getBasePointerOfAccessPointerOperand(
+            I, Offset, DL, /*AllowNonInbounds*/ true)) {
+      if (Base == &getAssociatedValue() && getPointerOperand(I) == UseV) {
+        uint64_t Size = DL.getTypeStoreSize(PtrTy->getPointerElementType());
+        addAccessedBytes(Offset, Size);
+      }
+    }
+    return;
+  }
+
   /// See AAFromMustBeExecutedContext
   bool followUse(Attributor &A, const Use *U, const Instruction *I) {
     bool IsNonNull = false;
     bool TrackUse = false;
     int64_t DerefBytes = getKnownNonNullAndDerefBytesForUse(
         A, *this, getAssociatedValue(), U, I, IsNonNull, TrackUse);
+
+    addAccessedBytesForUse(A, U, I);
     takeKnownDerefBytesMaximum(DerefBytes);
     return TrackUse;
   }
 
   /// See AbstractAttribute::manifest(...).
   ChangeStatus manifest(Attributor &A) override {
     ChangeStatus Change = AADereferenceable::manifest(A);
     if (isAssumedNonNull() && hasAttr(Attribute::DereferenceableOrNull)) {

llvm/test/Transforms/InferFunctionAttrs/dereferenceable.ll

 ; ATTRIBUTOR-LABEL: @PR21780_only_access3_without_inbounds(double* nocapture nofree readonly align 8 %ptr)
   %arrayidx3 = getelementptr double, double* %ptr, i64 3
   %t3 = load double, double* %arrayidx3, align 8
   ret double %t3
 }
 
 define double @PR21780_without_inbounds(double* %ptr) {
 ; CHECK-LABEL: @PR21780_without_inbounds(double* %ptr)
-; FIXME: this should be @PR21780_without_inbounds(double* nonnull dereferenceable(32) %ptr)
-; ATTRIBUTOR-LABEL: @PR21780_without_inbounds(double* nocapture nofree nonnull readonly align 8 dereferenceable(8) %ptr)
+; ATTRIBUTOR-LABEL: @PR21780_without_inbounds(double* nocapture nofree nonnull readonly align 8 dereferenceable(32) %ptr)
 
   %arrayidx1 = getelementptr double, double* %ptr, i64 1
   %arrayidx2 = getelementptr double, double* %ptr, i64 2
   %arrayidx3 = getelementptr double, double* %ptr, i64 3
 
   %t0 = load double, double* %ptr, align 8
   %t1 = load double, double* %arrayidx1, align 8
   %t2 = load double, double* %arrayidx2, align 8
   %t3 = load double, double* %arrayidx3, align 8
 
   ret double %t3
 }
 
 ; Unsimplified, but still valid. Also, throw in some bogus arguments.
 
 define void @gep0(i8* %unused, i8* %other, i8* %ptr) {
 ; CHECK-LABEL: @gep0(i8* %unused, i8* %other, i8* %ptr)
+; ATTRIBUTOR-LABEL: @gep0(i8* nocapture nofree readnone %unused, i8* nocapture nofree nonnull writeonly dereferenceable(1) %other, i8* nocapture nofree nonnull readonly dereferenceable(3) %ptr)
   %arrayidx0 = getelementptr i8, i8* %ptr, i64 0
   %arrayidx1 = getelementptr i8, i8* %ptr, i64 1
   %arrayidx2 = getelementptr i8, i8* %ptr, i64 2
   %t0 = load i8, i8* %arrayidx0
   %t1 = load i8, i8* %arrayidx1
   %t2 = load i8, i8* %arrayidx2
   store i8 %t2, i8* %other
   ret void
 }
 
 ; Order of accesses does not change computation.
 ; Multiple arguments may be dereferenceable.
 
 define void @ordering(i8* %ptr1, i32* %ptr2) {
 ; CHECK-LABEL: @ordering(i8* %ptr1, i32* %ptr2)
+; ATTRIBUTOR-LABEL: @ordering(i8* nocapture nofree nonnull readonly dereferenceable(3) %ptr1, i32* nocapture nofree nonnull readonly dereferenceable(8) %ptr2)
   %a20 = getelementptr i32, i32* %ptr2, i64 0
   %a12 = getelementptr i8, i8* %ptr1, i64 2
   %t12 = load i8, i8* %a12
   %a11 = getelementptr i8, i8* %ptr1, i64 1
   %t20 = load i32, i32* %a20
   %a10 = getelementptr i8, i8* %ptr1, i64 0
   %t10 = load i8, i8* %a10
   %t11 = load i8, i8* %a11
   %a21 = getelementptr i32, i32* %ptr2, i64 1
   %t21 = load i32, i32* %a21
   ret void
 }
 
 ; Not in entry block.
 
 define void @not_entry_but_guaranteed_to_execute(i8* %ptr) {
 ; CHECK-LABEL: @not_entry_but_guaranteed_to_execute(i8* %ptr)
+; ATTRIBUTOR-LABEL: @not_entry_but_guaranteed_to_execute(i8* nocapture nofree nonnull readonly dereferenceable(3) %ptr)
 entry:
   br label %exit
 exit:
   %arrayidx0 = getelementptr i8, i8* %ptr, i64 0
   %arrayidx1 = getelementptr i8, i8* %ptr, i64 1
   %arrayidx2 = getelementptr i8, i8* %ptr, i64 2
   %t0 = load i8, i8* %arrayidx0
   %t1 = load i8, i8* %arrayidx1
   %t2 = load i8, i8* %arrayidx2
   ret void
 }
 
 ; Not in entry block and not guaranteed to execute.
 
 define void @not_entry_not_guaranteed_to_execute(i8* %ptr, i1 %cond) {
 ; CHECK-LABEL: @not_entry_not_guaranteed_to_execute(i8* %ptr, i1 %cond)
+; ATTRIBUTOR-LABEL: @not_entry_not_guaranteed_to_execute(i8* nocapture nofree readonly %ptr, i1 %cond)
 entry:
   br i1 %cond, label %loads, label %exit
 loads:
   %arrayidx0 = getelementptr i8, i8* %ptr, i64 0
   %arrayidx1 = getelementptr i8, i8* %ptr, i64 1
   %arrayidx2 = getelementptr i8, i8* %ptr, i64 2
   %t0 = load i8, i8* %arrayidx0
   %t1 = load i8, i8* %arrayidx1
   %t2 = load i8, i8* %arrayidx2
   ret void
 exit:
   ret void
 }
 
 ; The last load may not execute, so derefenceable bytes only covers the 1st two loads.
 
 define void @partial_in_entry(i16* %ptr, i1 %cond) {
 ; CHECK-LABEL: @partial_in_entry(i16* %ptr, i1 %cond)
+; ATTRIBUTOR-LABEL: @partial_in_entry(i16* nocapture nofree nonnull readonly dereferenceable(4) %ptr, i1 %cond)
 entry:
   %arrayidx0 = getelementptr i16, i16* %ptr, i64 0
   %arrayidx1 = getelementptr i16, i16* %ptr, i64 1
   %arrayidx2 = getelementptr i16, i16* %ptr, i64 2
   %t0 = load i16, i16* %arrayidx0
   %t1 = load i16, i16* %arrayidx1
   br i1 %cond, label %loads, label %exit
 loads:
   %t2 = load i16, i16* %arrayidx2
   ret void
 exit:
   ret void
 }
 
 ; The volatile load can't be used to prove a non-volatile access is allowed.
 ; The 2nd and 3rd loads may never execute.
 
 define void @volatile_is_not_dereferenceable(i16* %ptr) {
 ; CHECK-LABEL: @volatile_is_not_dereferenceable(i16* %ptr)
+; ATTRIBUTOR-LABEL: @volatile_is_not_dereferenceable(i16* nofree %ptr)
   %arrayidx0 = getelementptr i16, i16* %ptr, i64 0
   %arrayidx1 = getelementptr i16, i16* %ptr, i64 1
   %arrayidx2 = getelementptr i16, i16* %ptr, i64 2
   %t0 = load volatile i16, i16* %arrayidx0
   %t1 = load i16, i16* %arrayidx1
   %t2 = load i16, i16* %arrayidx2
   ret void
 }
 
 ; TODO: We should allow inference for atomic (but not volatile) ops.
 
 define void @atomic_is_alright(i16* %ptr) {
 ; CHECK-LABEL: @atomic_is_alright(i16* %ptr)
+; ATTRIBUTOR-LABEL: @atomic_is_alright(i16* nocapture nofree nonnull readonly align 2 dereferenceable(6) %ptr)
   %arrayidx0 = getelementptr i16, i16* %ptr, i64 0
   %arrayidx1 = getelementptr i16, i16* %ptr, i64 1
   %arrayidx2 = getelementptr i16, i16* %ptr, i64 2
   %t0 = load atomic i16, i16* %arrayidx0 unordered, align 2
   %t1 = load i16, i16* %arrayidx1
   %t2 = load i16, i16* %arrayidx2
   ret void
 }
 
 declare void @may_not_return()
 
 define void @not_guaranteed_to_transfer_execution(i16* %ptr) {
 ; CHECK-LABEL: @not_guaranteed_to_transfer_execution(i16* %ptr)
+; ATTRIBUTOR-LABEL: @not_guaranteed_to_transfer_execution(i16* nocapture nonnull readonly dereferenceable(2) %ptr)
   %arrayidx0 = getelementptr i16, i16* %ptr, i64 0
   %arrayidx1 = getelementptr i16, i16* %ptr, i64 1
   %arrayidx2 = getelementptr i16, i16* %ptr, i64 2
   %t0 = load i16, i16* %arrayidx0
   call void @may_not_return()
   %t1 = load i16, i16* %arrayidx1
   %t2 = load i16, i16* %arrayidx2
   ret void
 }
 
 ; We must have consecutive accesses.
 
 define void @variable_gep_index(i8* %unused, i8* %ptr, i64 %variable_index) {
 ; CHECK-LABEL: @variable_gep_index(i8* %unused, i8* %ptr, i64 %variable_index)
+; ATTRIBUTOR-LABEL: @variable_gep_index(i8* nocapture nofree readnone %unused, i8* nocapture nofree nonnull readonly dereferenceable(1) %ptr, i64 %variable_index)
   %arrayidx1 = getelementptr i8, i8* %ptr, i64 %variable_index
   %arrayidx2 = getelementptr i8, i8* %ptr, i64 2
   %t0 = load i8, i8* %ptr
   %t1 = load i8, i8* %arrayidx1
   %t2 = load i8, i8* %arrayidx2
   ret void
 }
 
 ; Deal with >1 GEP index.
 
 define void @multi_index_gep(<4 x i8>* %ptr) {
 ; CHECK-LABEL: @multi_index_gep(<4 x i8>* %ptr)
+; FIXME: %ptr should be dereferenceable(4)
+; ATTRIBUTOR-LABEL: @multi_index_gep(<4 x i8>* nocapture nofree nonnull readonly dereferenceable(1) %ptr)
   %arrayidx00 = getelementptr <4 x i8>, <4 x i8>* %ptr, i64 0, i64 0
   %t0 = load i8, i8* %arrayidx00
   ret void
 }
 
 ; Could round weird bitwidths down?
 
 define void @not_byte_multiple(i9* %ptr) {
 ; CHECK-LABEL: @not_byte_multiple(i9* %ptr)
+; ATTRIBUTOR-LABEL: @not_byte_multiple(i9* nocapture nofree nonnull readonly dereferenceable(2) %ptr) 
   %arrayidx0 = getelementptr i9, i9* %ptr, i64 0
   %t0 = load i9, i9* %arrayidx0
   ret void
 }
 
 ; Missing direct access from the pointer.
 
 define void @no_pointer_deref(i16* %ptr) {
 ; CHECK-LABEL: @no_pointer_deref(i16* %ptr)
+; ATTRIBUTOR-LABEL: @no_pointer_deref(i16* nocapture nofree readonly %ptr)
   %arrayidx1 = getelementptr i16, i16* %ptr, i64 1
   %arrayidx2 = getelementptr i16, i16* %ptr, i64 2
   %t1 = load i16, i16* %arrayidx1
   %t2 = load i16, i16* %arrayidx2
   ret void
 }
 
 ; Out-of-order is ok, but missing access concludes dereferenceable range.
 
 define void @non_consecutive(i32* %ptr) {
 ; CHECK-LABEL: @non_consecutive(i32* %ptr)
+; ATTRIBUTOR-LABEL: @non_consecutive(i32* nocapture nofree nonnull readonly dereferenceable(8) %ptr)
   %arrayidx1 = getelementptr i32, i32* %ptr, i64 1
   %arrayidx0 = getelementptr i32, i32* %ptr, i64 0
   %arrayidx3 = getelementptr i32, i32* %ptr, i64 3
   %t1 = load i32, i32* %arrayidx1
   %t0 = load i32, i32* %arrayidx0
   %t3 = load i32, i32* %arrayidx3
   ret void
 }
 
 ; Improve on existing dereferenceable attribute.
 
 define void @more_bytes(i32* dereferenceable(8) %ptr) {
 ; CHECK-LABEL: @more_bytes(i32* dereferenceable(8) %ptr)
+; ATTRIBUTOR-LABEL: @more_bytes(i32* nocapture nofree nonnull readonly dereferenceable(16) %ptr)
   %arrayidx3 = getelementptr i32, i32* %ptr, i64 3
   %arrayidx1 = getelementptr i32, i32* %ptr, i64 1
   %arrayidx0 = getelementptr i32, i32* %ptr, i64 0
   %arrayidx2 = getelementptr i32, i32* %ptr, i64 2
   %t3 = load i32, i32* %arrayidx3
   %t1 = load i32, i32* %arrayidx1
   %t2 = load i32, i32* %arrayidx2
   %t0 = load i32, i32* %arrayidx0
   ret void
 }
 
 ; Improve on existing dereferenceable_or_null attribute.
 
 define void @more_bytes_and_not_null(i32* dereferenceable_or_null(8) %ptr) {
 ; CHECK-LABEL: @more_bytes_and_not_null(i32* dereferenceable_or_null(8) %ptr)
+; ATTRIBUTOR-LABEL: @more_bytes_and_not_null(i32* nocapture nofree nonnull readonly dereferenceable(16) %ptr)
   %arrayidx3 = getelementptr i32, i32* %ptr, i64 3
   %arrayidx1 = getelementptr i32, i32* %ptr, i64 1
   %arrayidx0 = getelementptr i32, i32* %ptr, i64 0
   %arrayidx2 = getelementptr i32, i32* %ptr, i64 2
   %t3 = load i32, i32* %arrayidx3
   %t1 = load i32, i32* %arrayidx1
   %t2 = load i32, i32* %arrayidx2
   %t0 = load i32, i32* %arrayidx0
   ret void
 }
 
 ; But don't pessimize existing dereferenceable attribute.
 
 define void @better_bytes(i32* dereferenceable(100) %ptr) {
 ; CHECK-LABEL: @better_bytes(i32* dereferenceable(100) %ptr)
+; ATTRIBUTOR-LABEL: @better_bytes(i32* nocapture nofree nonnull readonly dereferenceable(100) %ptr)
   %arrayidx3 = getelementptr i32, i32* %ptr, i64 3
   %arrayidx1 = getelementptr i32, i32* %ptr, i64 1
   %arrayidx0 = getelementptr i32, i32* %ptr, i64 0
   %arrayidx2 = getelementptr i32, i32* %ptr, i64 2
   %t3 = load i32, i32* %arrayidx3
   %t1 = load i32, i32* %arrayidx1
   %t2 = load i32, i32* %arrayidx2
   %t0 = load i32, i32* %arrayidx0
   ret void
 }
 
 define void @bitcast(i32* %arg) {
 ; CHECK-LABEL: @bitcast(i32* %arg)
+; ATTRIBUTOR-LABEL: @bitcast(i32* nocapture nofree nonnull readonly dereferenceable(8) %arg)
   %ptr = bitcast i32* %arg to float*
   %arrayidx0 = getelementptr float, float* %ptr, i64 0
   %arrayidx1 = getelementptr float, float* %ptr, i64 1
   %t0 = load float, float* %arrayidx0
   %t1 = load float, float* %arrayidx1
   ret void
 }
 
 define void @bitcast_different_sizes(double* %arg1, i8* %arg2) {
 ; CHECK-LABEL: @bitcast_different_sizes(double* %arg1, i8* %arg2)
+; ATTRIBUTOR-LABEL: @bitcast_different_sizes(double* nocapture nofree nonnull readonly dereferenceable(12) %arg1, i8* nocapture nofree nonnull readonly dereferenceable(16) %arg2)
   %ptr1 = bitcast double* %arg1 to float*
   %a10 = getelementptr float, float* %ptr1, i64 0
   %a11 = getelementptr float, float* %ptr1, i64 1
   %a12 = getelementptr float, float* %ptr1, i64 2
   %ld10 = load float, float* %a10
   %ld11 = load float, float* %a11
   %ld12 = load float, float* %a12
 
   %ptr2 = bitcast i8* %arg2 to i64*
   %a20 = getelementptr i64, i64* %ptr2, i64 0
   %a21 = getelementptr i64, i64* %ptr2, i64 1
   %ld20 = load i64, i64* %a20
   %ld21 = load i64, i64* %a21
   ret void
 }
 
 define void @negative_offset(i32* %arg) {
 ; CHECK-LABEL: @negative_offset(i32* %arg)
+; ATTRIBUTOR-LABEL: @negative_offset(i32* nocapture nofree nonnull readonly dereferenceable(4) %arg)
   %ptr = bitcast i32* %arg to float*
   %arrayidx0 = getelementptr float, float* %ptr, i64 0
   %arrayidx1 = getelementptr float, float* %ptr, i64 -1
   %t0 = load float, float* %arrayidx0
   %t1 = load float, float* %arrayidx1
   ret void
 }
 
 define void @stores(i32* %arg) {
 ; CHECK-LABEL: @stores(i32* %arg)
+; ATTRIBUTOR-LABEL: @stores(i32* nocapture nofree nonnull writeonly dereferenceable(8) %arg)
   %ptr = bitcast i32* %arg to float*
   %arrayidx0 = getelementptr float, float* %ptr, i64 0
   %arrayidx1 = getelementptr float, float* %ptr, i64 1
   store float 1.0, float* %arrayidx0
   store float 2.0, float* %arrayidx1
   ret void
 }
 
 define void @load_store(i32* %arg) {
 ; CHECK-LABEL: @load_store(i32* %arg)
+; ATTRIBUTOR-LABEL: @load_store(i32* nocapture nofree nonnull dereferenceable(8) %arg)
   %ptr = bitcast i32* %arg to float*
   %arrayidx0 = getelementptr float, float* %ptr, i64 0
   %arrayidx1 = getelementptr float, float* %ptr, i64 1
   %t1 = load float, float* %arrayidx0
   store float 2.0, float* %arrayidx1
   ret void
 }
+
+define void @different_size1(i32* %arg) {
+; CHECK-LABEL: @different_size1(i32* %arg)
+; ATTRIBUTOR-LABEL: @different_size1(i32* nocapture nofree nonnull writeonly dereferenceable(8) %arg)
+  %arg-cast = bitcast i32* %arg to double*
+  store double 0.000000e+00, double* %arg-cast
+  store i32 0, i32* %arg
+  ret void
+}
+
+define void @different_size2(i32* %arg) {
+; CHECK-LABEL: @different_size2(i32* %arg)
+; ATTRIBUTOR-LABEL: @different_size2(i32* nocapture nofree nonnull writeonly dereferenceable(8) %arg)
+  store i32 0, i32* %arg
+  %arg-cast = bitcast i32* %arg to double*
+  store double 0.000000e+00, double* %arg-cast
+  ret void
+}