diff --git a/llvm/lib/Target/AMDGPU/AMDGPUPropagateAttributes.cpp b/llvm/lib/Target/AMDGPU/AMDGPUPropagateAttributes.cpp
--- a/llvm/lib/Target/AMDGPU/AMDGPUPropagateAttributes.cpp
+++ b/llvm/lib/Target/AMDGPU/AMDGPUPropagateAttributes.cpp
@@ -36,6 +36,8 @@
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Transforms/Utils/Cloning.h"
 
+#include <iostream>
+
 #define DEBUG_TYPE "amdgpu-propagate-attributes"
 
 using namespace llvm;
@@ -241,15 +243,28 @@
         continue;
 
       const FnProperties CalleeProps(*TM, F);
-      SmallVector<std::pair<CallBase *, Function *>, 32> ToReplace;
+      SmallVector<std::pair<Use *, Function *>, 32> ToReplace;
       SmallSet<CallBase *, 32> Visited;
 
-      for (User *U : F.users()) {
+      for (Use &OriginalUse : F.uses()) {
+        // If the user is a constant expression, look for an enclosing call.
+        User *U = OriginalUse.getUser();
+        while(isa<ConstantExpr>(U)) {
+          // TODO: I'd like to assert that there's only one user, but it seems
+          // the constexpr cast in propagate-attributes-bitcast-function.ll has
+          // zero users, so this preserves existing behavior. However, this
+          // causes the instruction cast below to fail anyway. Why isn't it
+          // used by the call instruction? How can I clean this up?
+          if(!U->hasOneUser())
+            break;
+          //assert(U->hasOneUser());
+          U = *U->users().begin();
+        }
         Instruction *I = dyn_cast<Instruction>(U);
         if (!I)
           continue;
         CallBase *CI = dyn_cast<CallBase>(I);
-        if (!CI)
+        if (!CI || CI->getCalledOperand()->stripPointerCasts() != &F)
           continue;
         Function *Caller = CI->getCaller();
         if (!Caller || !Visited.insert(CI).second)
@@ -285,7 +300,7 @@
           NewRoots.insert(NewF);
         }
 
-        ToReplace.push_back(std::make_pair(CI, NewF));
+        ToReplace.push_back(std::make_pair(&OriginalUse, NewF));
         Replaced.insert(&F);
 
         Changed = true;
@@ -293,7 +308,10 @@
 
       while (!ToReplace.empty()) {
         auto R = ToReplace.pop_back_val();
-        R.first->setCalledFunction(R.second);
+        // TODO: Is there something else I need to do here? Making this change
+        // causes an assert when cleaning up the module:
+        // Assertion failed: (I != Map.end() && "Constant not found in constant table!")
+        R.first->set(R.second);
       }
     }
   } while (!NewRoots.empty());
diff --git a/llvm/test/CodeGen/AMDGPU/propagate-attributes-function-pointer-argument.ll b/llvm/test/CodeGen/AMDGPU/propagate-attributes-function-pointer-argument.ll
new file mode 100644
--- /dev/null
+++ b/llvm/test/CodeGen/AMDGPU/propagate-attributes-function-pointer-argument.ll
@@ -0,0 +1,44 @@
+; This is a regression test for a bug in the AMDGPU Propagate Attributes pass
+; where a call instruction's callee could be replaced with a function pointer
+; passed to the original call instruction as an argument.
+;
+; Example:
+; `call void @f(void ()* @g)`
+; could become
+; `call void @g(void ()* @g.1)`
+; which is invalid IR.
+
+; RUN: opt -S -mtriple=amdgcn-amd-amdhsa -amdgpu-propagate-attributes-late %s | FileCheck %s
+
+; CHECK: define amdgpu_kernel void @thiswasabug() #0
+; CHECK: call void @f(void ()* @g.1)
+; CHECK: call void @g()
+; CHECK: call i8* bitcast (i32* ()* @h to i8* ()*)()
+define amdgpu_kernel void @thiswasabug() #0 {
+    call void @f(void ()* @g)
+    call void @g()
+    call i8* bitcast (i32* ()* @h to i8* ()*)()
+    ret void
+}
+
+define private void @f(void ()* nocapture %0) #0 {
+    ret void
+}
+
+; In order to expose this bug, it is necessary that `g` have one of the
+; propagated attributes, so that a clone and substitution would take place if g
+; were actually the function being called.
+; CHECK-DAG: define private void @g.1() #1
+; CHECK-DAG: define internal void @g() #2
+define private void @g() #1 {
+    ret void
+}
+
+; CHECK-DAG: define internal i32* @h() #2
+define private i32* @h() #1 {
+    %1 = alloca i32
+    ret i32* %1
+}
+
+attributes #0 = { noinline }
+attributes #1 = { noinline "amdgpu-waves-per-eu"="1,10" }