[stack-safety] Allow to determine safe accesses.

[fmayer]

add more tests

[vitalybuka]

fix nits

[vitalybuka]

LGTM if you agree with my changes

llvm/include/llvm/Analysis/StackSafetyAnalysis.h

81

"&I" for consistency

llvm/lib/Analysis/StackSafetyAnalysis.cpp

137

you missed my comment about auto vs tie.

this will work:

std::map<const Instruction *, /*remove const*/ ConstantRange> Accesses;
...
void addRange(const Instruction *I, const ConstantRange &R) {
    auto Ins = Accesses.emplace(I, R);
    if (!Ins.second)
      Ins.first->second = unionNoWrap(Ins.first->second, R);
    updateRange(R);
  }

232–233

for consistency with line above
SmallPtrSet<const Instruction *, 8> SafeAccesses;

[vitalybuka]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

361

I see why you need "break" instead of "return" in these cases.
However I tried to revert this part and no tests failed.

Could you please to add a test-case sensitive to this part of the patch. Please cover at least few of these breaks.

[eugenis]

LGTM with Vitaly's comment about test coverage

llvm/include/llvm/Analysis/StackSafetyAnalysis.h

81

I realized that this header does not define what "safe" means anywhere. Especially important for this method. Could you clarify that this means the access is proven to be inbounds of a live alloca?

llvm/lib/Analysis/StackSafetyAnalysis.cpp

820

"UnsafeAccesses" ?
"AccessIsUnsafe"?

[vitalybuka]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

820

@eugenis suggestion LGTM

[fmayer]

add more tests

[fmayer]

simplify test

[fmayer]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

361

Added tests covering most of the return -> break cases.

[vitalybuka]

LGTM

llvm/lib/Analysis/StackSafetyAnalysis.cpp

820–837

this one is not done

[fmayer]

fix name

[fmayer]

name

llvm/lib/Analysis/StackSafetyAnalysis.cpp

820–837

Sorry, I was sure I did this, but must have messed up the upload somehow.

llvm/include/llvm/Analysis/StackSafetyAnalysis.h

public:
   StackSafetyGlobalInfo();
   StackSafetyGlobalInfo(
       Module *M, std::function<const StackSafetyInfo &(Function &F)> GetSSI,
       const ModuleSummaryIndex *Index);
   StackSafetyGlobalInfo(StackSafetyGlobalInfo &&);
   StackSafetyGlobalInfo &operator=(StackSafetyGlobalInfo &&);
   ~StackSafetyGlobalInfo();
 
+  // Whether we can prove that all accesses to this Alloca are in-range and
+  // during its lifetime.
   bool isSafe(const AllocaInst &AI) const;
+  // Whether we can prove that an instruction only accesses a live alloca in
+  // range.
+  bool accessIsSafe(const Instruction &I) const;
   void print(raw_ostream &O) const;
   void dump() const;
 };
 
 /// StackSafetyInfo wrapper for the new pass manager.
 class StackSafetyAnalysis : public AnalysisInfoMixin<StackSafetyAnalysis> {
   friend AnalysisInfoMixin<StackSafetyAnalysis>;
   static AnalysisKey Key;

llvm/lib/Analysis/StackSafetyAnalysis.cpp

 #include "llvm/IR/ModuleSummaryIndex.h"
 #include "llvm/InitializePasses.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/FormatVariadic.h"
 #include "llvm/Support/raw_ostream.h"
 #include <algorithm>
 #include <memory>
+#include <tuple>
 
 using namespace llvm;
 
 #define DEBUG_TYPE "stack-safety"
 
 STATISTIC(NumAllocaStackSafe, "Number of safe allocas");
 STATISTIC(NumAllocaTotal, "Number of total allocas");
 
template <typename CalleeTy> struct CallInfo {
   };
 };
 
 /// Describe uses of address (alloca or parameter) inside of the function.
 template <typename CalleeTy> struct UseInfo {
   // Access range if the address (alloca or parameters).
   // It is allowed to be empty-set when there are no known accesses.
   ConstantRange Range;
+  std::map<const Instruction *, ConstantRange> Accesses;
 
   // List of calls which pass address as an argument.
   // Value is offset range of address from base address (alloca or calling
   // function argument). Range should never set to empty-set, that is an invalid
   // access range that can cause empty-set to be propagated with
   // ConstantRange::add
   using CallsTy = std::map<CallInfo<CalleeTy>, ConstantRange,
                            typename CallInfo<CalleeTy>::Less>;
   CallsTy Calls;
 
   UseInfo(unsigned PointerSize) : Range{PointerSize, false} {}
 
   void updateRange(const ConstantRange &R) { Range = unionNoWrap(Range, R); }
   void addRange(const Instruction *I, const ConstantRange &R) {
+    auto Ins = Accesses.emplace(I, R);
+    if (!Ins.second)
+      Ins.first->second = unionNoWrap(Ins.first->second, R);
     updateRange(R);
   }
 };
 
 template <typename CalleeTy>
 raw_ostream &operator<<(raw_ostream &OS, const UseInfo<CalleeTy> &U) {
   OS << U.Range;
   for (auto &Call : U.Calls)

 } // namespace
 
 struct StackSafetyInfo::InfoTy {
   FunctionInfo<GlobalValue> Info;
 };
 
 struct StackSafetyGlobalInfo::InfoTy {
   GVToSSI Info;
   SmallPtrSet<const AllocaInst *, 8> SafeAllocas;
+  SmallPtrSet<const Instruction *, 8> SafeAccesses;
 };
 
 namespace {
 
 class StackSafetyLocalAnalysis {
   Function &F;
   const DataLayout &DL;
   ScalarEvolution &SE;
for (const Use &UI : V->uses()) {
         continue;
 
       assert(V == UI.get());
 
       switch (I->getOpcode()) {
       case Instruction::Load: {
         if (AI && !SL.isAliveAfter(AI, I)) {
           US.addRange(I, UnknownRange);
-          return;
+          break;
         }
         US.addRange(I,
                     getAccessRange(UI, Ptr, DL.getTypeStoreSize(I->getType())));
         break;
       }
 
       case Instruction::VAArg:
         // "va-arg" from a pointer is safe.
         break;
       case Instruction::Store: {
         if (V == I->getOperand(0)) {
           // Stored the pointer - conservatively assume it may be unsafe.
           US.addRange(I, UnknownRange);
-          return;
+          break;
         }
         if (AI && !SL.isAliveAfter(AI, I)) {
           US.addRange(I, UnknownRange);
-          return;
+          break;
         }
         US.addRange(
             I, getAccessRange(
                    UI, Ptr, DL.getTypeStoreSize(I->getOperand(0)->getType())));
         break;
       }
 
       case Instruction::Ret:
         // Information leak.
         // FIXME: Process parameters correctly. This is a leak only if we return
         // alloca.
         US.addRange(I, UnknownRange);
-        return;
+        break;
 
       case Instruction::Call:
       case Instruction::Invoke: {
         if (I->isLifetimeStartOrEnd())
           break;
 
         if (AI && !SL.isAliveAfter(AI, I)) {
           US.addRange(I, UnknownRange);
-          return;
+          break;
         }
 
         if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
           US.addRange(I, getMemIntrinsicAccessRange(MI, UI, Ptr));
           break;
         }
 
         const auto &CB = cast<CallBase>(*I);
         if (!CB.isArgOperand(&UI)) {
           US.addRange(I, UnknownRange);
-          return;
+          break;
         }
 
         unsigned ArgNo = CB.getArgOperandNo(&UI);
         if (CB.isByValArgument(ArgNo)) {
           US.addRange(I, getAccessRange(
                              UI, Ptr,
                              DL.getTypeStoreSize(CB.getParamByValType(ArgNo))));
           break;
         }
 
         // FIXME: consult devirt?
         // Do not follow aliases, otherwise we could inadvertently follow
         // dso_preemptable aliases or aliases with interposable linkage.
         const GlobalValue *Callee =
             dyn_cast<GlobalValue>(CB.getCalledOperand()->stripPointerCasts());
         if (!Callee) {
           US.addRange(I, UnknownRange);
-          return;
+          break;
         }
 
         assert(isa<Function>(Callee) || isa<GlobalAlias>(Callee));
         ConstantRange Offsets = offsetFrom(UI, Ptr);
         auto Insert =
             US.Calls.emplace(CallInfo<GlobalValue>(Callee, ArgNo), Offsets);
         if (!Insert.second)
           Insert.first->second = Insert.first->second.unionWith(Offsets);
if (!Info) {
     std::map<const GlobalValue *, FunctionInfo<GlobalValue>> Functions;
     for (auto &F : M->functions()) {
       if (!F.isDeclaration()) {
         auto FI = GetSSI(F).getInfo().Info;
         Functions.emplace(&F, std::move(FI));
       }
     }
     Info.reset(new InfoTy{
-        createGlobalStackSafetyInfo(std::move(Functions), Index), {}});
+        createGlobalStackSafetyInfo(std::move(Functions), Index), {}, {}});
+
+    std::map<const Instruction *, bool> UnsafeAccesses;
     for (auto &FnKV : Info->Info) {
       for (auto &KV : FnKV.second.Allocas) {
         ++NumAllocaTotal;
         const AllocaInst *AI = KV.first;
-        if (getStaticAllocaSizeRange(*AI).contains(KV.second.Range)) {
+        auto AIRange = getStaticAllocaSizeRange(*AI);
+        if (AIRange.contains(KV.second.Range)) {
           Info->SafeAllocas.insert(AI);
           ++NumAllocaStackSafe;
         }
+        for (const auto &A : KV.second.Accesses)
+          UnsafeAccesses[A.first] |= !AIRange.contains(A.second);
       }
     }
+
+    for (const auto &KV : UnsafeAccesses)
+      if (!KV.second)
+        Info->SafeAccesses.insert(KV.first);
+
     if (StackSafetyPrint)
       print(errs());
   }
   return *Info;
 }
 
 std::vector<FunctionSummary::ParamAccess>
 StackSafetyInfo::getParamAccesses(ModuleSummaryIndex &Index) const {

 
 StackSafetyGlobalInfo::~StackSafetyGlobalInfo() = default;
 
 bool StackSafetyGlobalInfo::isSafe(const AllocaInst &AI) const {
   const auto &Info = getInfo();
   return Info.SafeAllocas.count(&AI);
 }
 
+bool StackSafetyGlobalInfo::accessIsSafe(const Instruction &I) const {
+  const auto &Info = getInfo();
+  return Info.SafeAccesses.count(&I);
+}
+
 void StackSafetyGlobalInfo::print(raw_ostream &O) const {
   auto &SSI = getInfo().Info;
   if (SSI.empty())
     return;
   const Module &M = *SSI.begin()->first->getParent();
   for (auto &F : M.functions()) {
     if (!F.isDeclaration()) {
       SSI.find(&F)->second.print(O, F.getName(), &F);
-      O << "\n";
+      O << "    safe accesses:"
+        << "\n";
+      for (const auto &I : instructions(F)) {
+        if (accessIsSafe(I)) {
+          O << "     " << I << "\n";
+        }
+      }
       O << "\n";
     }
   }
 }
 
 LLVM_DUMP_METHOD void StackSafetyGlobalInfo::dump() const { print(dbgs()); }
 
 AnalysisKey StackSafetyAnalysis::Key;

llvm/test/Analysis/StackSafetyAnalysis/ipa-alias.ll

 define void @PreemptableAliasCall() #0 {
 ; CHECK-LABEL: @PreemptableAliasCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x1[1]: empty-set, @PreemptableAliasWrite1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x1[1]: full-set, @PreemptableAliasWrite1(arg0, [0,1)){{$}}
 ; LOCAL-NEXT: x2[1]: empty-set, @AliasToPreemptableAliasWrite1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x2[1]: [0,1), @AliasToPreemptableAliasWrite1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x1 = alloca i8
   call void @PreemptableAliasWrite1(i8* %x1)
 
   %x2 = alloca i8
 ; Alias to a preemptable alias is not preemptable
   call void @AliasToPreemptableAliasWrite1(i8* %x2)
   ret void
 }
 
 ; Call to an interposable alias to a non-interposable aliasee
 define void @InterposableAliasCall() #0 {
 ; CHECK-LABEL: @InterposableAliasCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[1]: empty-set, @InterposableAliasWrite1(arg0, [0,1)){{$}}
 ; NOLTO-NEXT: x[1]: full-set, @InterposableAliasWrite1(arg0, [0,1)){{$}}
 ; LTO-NEXT: x[1]: [0,1), @InterposableAliasWrite1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8
 ; ThinLTO can resolve the prevailing implementation for interposable definitions.
   call void @InterposableAliasWrite1(i8* %x)
   ret void
 }
 
 ; Call to a dso_local/non-interposable alias/aliasee
 define void @AliasCall() #0 {
 ; CHECK-LABEL: @AliasCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[1]: empty-set, @AliasWrite1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[1]: [0,1), @AliasWrite1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8
   call void @AliasWrite1(i8* %x)
   ret void
 }
 
 ; Call to a bitcasted dso_local/non-interposable alias/aliasee
 define void @BitcastAliasCall() #0 {
 ; CHECK-LABEL: @BitcastAliasCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x1[4]: empty-set, @BitcastAliasWrite1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x1[4]: [0,1), @BitcastAliasWrite1(arg0, [0,1)){{$}}
 ; LOCAL-NEXT: x2[1]: empty-set, @AliasToBitcastAliasWrite1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x2[1]: [0,1), @AliasToBitcastAliasWrite1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x1 = alloca i32
   call void @BitcastAliasWrite1(i32* %x1)
   %x2 = alloca i8
   call void @AliasToBitcastAliasWrite1(i8* %x2)
   ret void
 }
 
 ; The rest is from Inputs/ipa-alias.ll
 
 ; CHECK-LABEL: @Write1{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,1){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:

llvm/test/Analysis/StackSafetyAnalysis/ipa.ll

 
 ; Basic out-of-bounds.
 define void @f1() #0 {
 ; CHECK-LABEL: @f1 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @Write8(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[4]: [0,8), @Write8(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @Write8(i8* %x1)
   ret void
 }
 
 ; Basic in-bounds.
 define void @f2() #0 {
 ; CHECK-LABEL: @f2 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @Write1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[4]: [0,1), @Write1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @Write1(i8* %x1)
   ret void
 }
 
 ; Another basic in-bounds.
 define void @f3() #0 {
 ; CHECK-LABEL: @f3 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @Write4(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[4]: [0,4), @Write4(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @Write4(i8* %x1)
   ret void
 }
 
 ; In-bounds with offset.
 define void @f4() #0 {
 ; CHECK-LABEL: @f4 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @Write1(arg0, [1,2)){{$}}
 ; GLOBAL-NEXT: x[4]: [1,2), @Write1(arg0, [1,2)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 1
   call void @Write1(i8* %x2)
   ret void
 }
 
 ; Out-of-bounds with offset.
 define void @f5() #0 {
 ; CHECK-LABEL: @f5 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: empty-set, @Write4(arg0, [1,2)){{$}}
 ; GLOBAL-NEXT: [1,5), @Write4(arg0, [1,2)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 1
   call void @Write4(i8* %x2)
   ret void
 }
 
 ; External call.
 define void @f6() #0 {
 ; CHECK-LABEL: @f6 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @ExternalCall(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[4]: full-set, @ExternalCall(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @ExternalCall(i8* %x1)
   ret void
 }
 
 ; Call to dso_preemptable function
 define void @PreemptableCall() #0 {
 ; CHECK-LABEL: @PreemptableCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @PreemptableWrite1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[4]: full-set, @PreemptableWrite1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @PreemptableWrite1(i8* %x1)
   ret void
 }
 
 ; Call to function with interposable linkage
 define void @InterposableCall() #0 {
 ; CHECK-LABEL: @InterposableCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @InterposableWrite1(arg0, [0,1)){{$}}
 ; NOLTO-NEXT: x[4]: full-set, @InterposableWrite1(arg0, [0,1)){{$}}
 ; LTO-NEXT: x[4]: [0,1), @InterposableWrite1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @InterposableWrite1(i8* %x1)
   ret void
 }
 
 ; Call to function with private linkage
 define void @PrivateCall() #0 {
 ; CHECK-LABEL: @PrivateCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @PrivateWrite1(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[4]: [0,1), @PrivateWrite1(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @PrivateWrite1(i8* %x1)
   ret void
 }
 
 define private void @PrivateWrite1(i8* %p) #0 {
 ; CHECK-LABEL: @PrivateWrite1{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,1){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   store i8 0, i8* %p, align 1
   ret void
 }
 
 ; Caller returns a dependent value.
 ; FIXME: alloca considered unsafe even if the return value is unused.
 define void @f7() #0 {
 ; CHECK-LABEL: @f7 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[4]: empty-set, @ReturnDependent(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[4]: full-set, @ReturnDependent(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = call i8* @ReturnDependent(i8* %x1)
   ret void
 }
 
 define void @f8left() #0 {
 ; CHECK-LABEL: @f8left dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Rec2(arg0, [2,3)){{$}}
 ; GLOBAL-NEXT: x[8]: [0,4), @Rec2(arg0, [2,3)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 2
 ; 2 + [-2, 2) = [0, 4) => OK
   call void @Rec2(i8* %x2)
   ret void
 }
 
 define void @f8right() #0 {
 ; CHECK-LABEL: @f8right dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Rec2(arg0, [6,7)){{$}}
 ; GLOBAL-NEXT: x[8]: [4,8), @Rec2(arg0, [6,7)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 6
 ; 6 + [-2, 2) = [4, 8) => OK
   call void @Rec2(i8* %x2)
   ret void
 }
 
 define void @f8oobleft() #0 {
 ; CHECK-LABEL: @f8oobleft dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Rec2(arg0, [1,2)){{$}}
 ; GLOBAL-NEXT: x[8]: [-1,3), @Rec2(arg0, [1,2)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 1
 ; 1 + [-2, 2) = [-1, 3) => NOT OK
   call void @Rec2(i8* %x2)
   ret void
 }
 
 define void @f8oobright() #0 {
 ; CHECK-LABEL: @f8oobright dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Rec2(arg0, [7,8)){{$}}
 ; GLOBAL-NEXT: x[8]: [5,9), @Rec2(arg0, [7,8)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 7
 ; 7 + [-2, 2) = [5, 9) => NOT OK
   call void @Rec2(i8* %x2)
   ret void
 }
 
 define void @TwoArguments() #0 {
 ; CHECK-LABEL: @TwoArguments dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Write4_2(arg0, [4,5)), @Write4_2(arg1, [0,1)){{$}}
 ; GLOBAL-NEXT: x[8]: [0,8), @Write4_2(arg0, [4,5)), @Write4_2(arg1, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 4
   call void @Write4_2(i8* %x2, i8* %x1)
   ret void
 }
 
 define void @TwoArgumentsOOBOne() #0 {
 ; CHECK-LABEL: @TwoArgumentsOOBOne dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Write4_2(arg0, [5,6)), @Write4_2(arg1, [0,1)){{$}}
 ; GLOBAL-NEXT: x[8]: [0,9), @Write4_2(arg0, [5,6)), @Write4_2(arg1, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 5
   call void @Write4_2(i8* %x2, i8* %x1)
   ret void
 }
 
 define void @TwoArgumentsOOBOther() #0 {
 ; CHECK-LABEL: @TwoArgumentsOOBOther dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Write4_2(arg0, [4,5)), @Write4_2(arg1, [-1,0)){{$}}
 ; GLOBAL-NEXT: x[8]: [-1,8), @Write4_2(arg0, [4,5)), @Write4_2(arg1, [-1,0)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x0 = bitcast i64* %x to i8*
   %x1 = getelementptr i8, i8* %x0, i64 -1
   %x2 = getelementptr i8, i8* %x0, i64 4
   call void @Write4_2(i8* %x2, i8* %x1)
   ret void
 }
 
 define void @TwoArgumentsOOBBoth() #0 {
 ; CHECK-LABEL: @TwoArgumentsOOBBoth dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Write4_2(arg0, [5,6)), @Write4_2(arg1, [-1,0)){{$}}
 ; GLOBAL-NEXT: x[8]: [-1,9), @Write4_2(arg0, [5,6)), @Write4_2(arg1, [-1,0)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x0 = bitcast i64* %x to i8*
   %x1 = getelementptr i8, i8* %x0, i64 -1
   %x2 = getelementptr i8, i8* %x0, i64 5
   call void @Write4_2(i8* %x2, i8* %x1)
   ret void
 }
 
 define i32 @TestRecursiveNoOffset(i32* %p, i32 %size) #0 {
 ; CHECK-LABEL: @TestRecursiveNoOffset dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; LOCAL-NEXT: p[]: empty-set, @RecursiveNoOffset(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: p[]: full-set, @RecursiveNoOffset(arg0, [0,1)){{$}}
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: sum[4]: [0,4), @RecursiveNoOffset(arg2, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i32 0, i32* %sum, align 4
+; GLOBAL-NEXT: %1 = load i32, i32* %sum, align 4
 ; CHECK-EMPTY:
 entry:
   %sum = alloca i32, align 4
   %0 = bitcast i32* %sum to i8*
   store i32 0, i32* %sum, align 4
   call void @RecursiveNoOffset(i32* %p, i32 %size, i32* %sum)
   %1 = load i32, i32* %sum, align 4
   ret i32 %1
 }
 
 define void @TestRecursiveWithOffset(i32 %size) #0 {
 ; CHECK-LABEL: @TestRecursiveWithOffset dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: sum[64]: empty-set, @RecursiveWithOffset(arg1, [0,1)){{$}}
 ; GLOBAL-NEXT: sum[64]: full-set, @RecursiveWithOffset(arg1, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %sum = alloca i32, i64 16, align 4
   call void @RecursiveWithOffset(i32 %size, i32* %sum)
   ret void
 }
 
 ; FIXME: IPA should detect that access is safe
 define void @TestUpdateArg() #0 {
 ; CHECK-LABEL: @TestUpdateArg dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[16]: empty-set, @WriteAndReturn8(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[16]: full-set, @WriteAndReturn8(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, i64 16, align 4
   %0 = call i8* @WriteAndReturn8(i8* %x)
   ret void
 }
 
 define void @TestCrossModuleOnce() #0 {
 ; CHECK-DAG: @TestCrossModuleOnce dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: y[1]: empty-set, @Write1SameModule(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: y[1]: [0,1), @Write1SameModule(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %y = alloca i8, align 4
   call void @Write1SameModule(i8* %y)
   ret void
 }
 
 define void @TestCrossModuleTwice() #0 {
 ; CHECK-DAG: @TestCrossModuleTwice dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: z[1]: empty-set, @Write1DiffModule(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: z[1]: [0,1), @Write1DiffModule(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %z = alloca i8, align 4
   call void @Write1DiffModule(i8* %z)
   ret void
 }
 
 define void @TestCrossModuleConflict() #0 {
 ; CHECK-DAG: @TestCrossModuleConflict dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[1]: empty-set, @Write1Private(arg0, [0,1)){{$}}
 ; GLOBAL-NEXT: x[1]: [-1,0), @Write1Private(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, align 4
   call void @Write1Private(i8* %x)
   ret void
 }
 
 ; FIXME: LTO should match NOLTO
 define void @TestCrossModuleWeak() #0 {
 ; CHECK-DAG: @TestCrossModuleWeak dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[1]: empty-set, @Write1Weak(arg0, [0,1)){{$}}
 ; NOLTO-NEXT: x[1]: [1,2), @Write1Weak(arg0, [0,1)){{$}}
 ; LTO-NEXT: x[1]: full-set, @Write1Weak(arg0, [0,1)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, align 4
   call void @Write1Weak(i8* %x)
   ret void
 }
 
 define private dso_local void @Private(i8* %p) #0 {

 }
 
 ; The rest is from Inputs/ipa.ll
 
 ; CHECK-LABEL: @Write1{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,1){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @Write4{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,4){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @Write4_2{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,4){{$}}
 ; CHECK-NEXT: q[]: [0,4){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @Write8{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,8){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @WriteAndReturn8{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: full-set{{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @PreemptableWrite1 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,1){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @InterposableWrite1 interposable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [0,1){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @ReturnDependent{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: full-set{{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @Rec0{{$}}
 ; CHECK-NEXT: args uses:
 ; LOCAL-NEXT: p[]: empty-set, @Write4(arg0, [2,3)){{$}}
 ; GLOBAL-NEXT: p[]: [2,6)
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @Rec1{{$}}
 ; CHECK-NEXT: args uses:
 ; LOCAL-NEXT: p[]: empty-set, @Rec0(arg0, [1,2)){{$}}
 ; GLOBAL-NEXT: p[]: [3,7)
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @Rec2{{$}}
 ; CHECK-NEXT: args uses:
 ; LOCAL-NEXT: p[]: empty-set, @Rec1(arg0, [-5,-4)){{$}}
 ; GLOBAL-NEXT: p[]: [-2,2)
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @RecursiveNoOffset{{$}}
 ; CHECK-NEXT: args uses:
 ; LOCAL-NEXT: p[]: [0,4), @RecursiveNoOffset(arg0, [4,5)){{$}}
 ; GLOBAL-NEXT: p[]: full-set, @RecursiveNoOffset(arg0, [4,5)){{$}}
 ; CHECK-NEXT: acc[]: [0,4), @RecursiveNoOffset(arg2, [0,1)){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @RecursiveWithOffset{{$}}
 ; CHECK-NEXT: args uses:
 ; LOCAL-NEXT: acc[]: [0,4), @RecursiveWithOffset(arg1, [4,5)){{$}}
 ; GLOBAL-NEXT: acc[]: full-set, @RecursiveWithOffset(arg1, [4,5)){{$}}
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; CHECK-LABEL: @ReturnAlloca
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[8]: full-set
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 
 ; INDEX-LABEL: ^0 = module:
 ; INDEX-DAG: name: "ReturnDependent"{{.*}} guid = [[ReturnDependent:[-0-9]+]]
 ; INDEX-DAG: name: "Private"{{.*}} guid = [[Private:[-0-9]+]]
 ; INDEX-DAG: name: "TwoArgumentsOOBOther"{{.*}} guid = [[TwoArgumentsOOBOther:[-0-9]+]]
 ; INDEX-DAG: name: "Rec2"{{.*}} guid = [[Rec2:[-0-9]+]]
 ; INDEX-DAG: name: "f1"{{.*}} guid = [[f1:[-0-9]+]]

llvm/test/Analysis/StackSafetyAnalysis/local.ll

 ; RUN: opt -S -passes="print<stack-safety-local>" -disable-output < %s 2>&1 | FileCheck %s --check-prefixes=CHECK,LOCAL
 ; RUN: opt -S -passes="print-stack-safety" -disable-output < %s 2>&1 | FileCheck %s --check-prefixes=CHECK,GLOBAL
 
 target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 @sink = global i8* null, align 8
 
 declare void @llvm.memset.p0i8.i32(i8* %dest, i8 %val, i32 %len, i1 %isvolatile)
 declare void @llvm.memcpy.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 %len, i1 %isvolatile)
 declare void @llvm.memmove.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 %len, i1 %isvolatile)
 declare void @llvm.memset.p0i8.i64(i8* %dest, i8 %val, i64 %len, i1 %isvolatile)
 
+declare void @unknown_call(i8* %dest)
+
 ; Address leaked.
 define void @LeakAddress() {
 ; CHECK-LABEL: @LeakAddress dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   store i8* %x1, i8** @sink, align 8
   ret void
 }
 
 define void @StoreInBounds() {
 ; CHECK-LABEL: @StoreInBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,1){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i8 0, i8* %x1, align 1
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   store i8 0, i8* %x1, align 1
   ret void
 }
 
 define void @StoreInBounds2() {
 ; CHECK-LABEL: @StoreInBounds2 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i32 0, i32* %x, align 4
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   store i32 0, i32* %x, align 4
   ret void
 }
 
 define void @StoreInBounds3() {
 ; CHECK-LABEL: @StoreInBounds3 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [2,3){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i8 0, i8* %x2, align 1
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 2
   store i8 0, i8* %x2, align 1
   ret void
 }
 
 ; FIXME: ScalarEvolution does not look through ptrtoint/inttoptr.
 define void @StoreInBounds4() {
 ; CHECK-LABEL: @StoreInBounds4 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = ptrtoint i32* %x to i64
   %x2 = add i64 %x1, 2
   %x3 = inttoptr i64 %x2 to i8*
   store i8 0, i8* %x3, align 1
   ret void
 }
 
 define dso_local void @WriteMinMax(i8* %p) {
 ; CHECK-LABEL: @WriteMinMax{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: full-set
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %p1 = getelementptr i8, i8* %p, i64 9223372036854775805
   store i8 0, i8* %p1, align 1
   %p2 = getelementptr i8, i8* %p, i64 -9223372036854775805
   store i8 0, i8* %p2, align 1
   ret void
 }
 
 define dso_local void @WriteMax(i8* %p) {
 ; CHECK-LABEL: @WriteMax{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: [-9223372036854775807,9223372036854775806)
 ; CHECK-NEXT: allocas uses:
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   call void @llvm.memset.p0i8.i64(i8* %p, i8 1, i64 9223372036854775806, i1 0)
   %p2 = getelementptr i8, i8* %p, i64 -9223372036854775807
   call void @llvm.memset.p0i8.i64(i8* %p2, i8 1, i64 9223372036854775806, i1 0)
   ret void
 }
 
 define void @StoreOutOfBounds() {
 ; CHECK-LABEL: @StoreOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [2,6){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 2
   %x3 = bitcast i8* %x2 to i32*
   store i32 0, i32* %x3, align 1
   ret void
 }
 
 ; There is no difference in load vs store handling.
 define void @LoadInBounds() {
 ; CHECK-LABEL: @LoadInBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,1){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: %v = load i8, i8* %x1, align 1
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %v = load i8, i8* %x1, align 1
   ret void
 }
 
 define void @LoadOutOfBounds() {
 ; CHECK-LABEL: @LoadOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [2,6){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 2
   %x3 = bitcast i8* %x2 to i32*
   %v = load i32, i32* %x3, align 1
   ret void
 }
 
 ; Leak through ret.
 define i8* @Ret() {
 ; CHECK-LABEL: @Ret dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 2
   ret i8* %x2
 }
 
 declare void @Foo(i16* %p)
 
 define void @DirectCall() {
 ; CHECK-LABEL: @DirectCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[8]: empty-set, @Foo(arg0, [2,3)){{$}}
 ; GLOBAL-NEXT: x[8]: full-set, @Foo(arg0, [2,3)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i16*
   %x2 = getelementptr i16, i16* %x1, i64 1
   call void @Foo(i16* %x2);
   ret void
 }
 
 ; Indirect calls can not be analyzed (yet).
 ; FIXME: %p[]: full-set looks invalid
 define void @IndirectCall(void (i8*)* %p) {
 ; CHECK-LABEL: @IndirectCall dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: full-set{{$}}
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void %p(i8* %x1);
   ret void
 }
 
 define void @NonConstantOffset(i1 zeroext %z) {
 ; CHECK-LABEL: @NonConstantOffset dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; FIXME: SCEV can't look through selects.
 ; CHECK-NEXT: x[4]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i8 0, i8* %x2, align 1
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %idx = select i1 %z, i64 1, i64 2
   %x2 = getelementptr i8, i8* %x1, i64 %idx
   store i8 0, i8* %x2, align 1
   ret void
 }
 
 define void @NegativeOffset() {
 ; CHECK-LABEL: @NegativeOffset dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[40]: [-1600000000000,-1599999999996){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, i32 10, align 4
   %x2 = getelementptr i32, i32* %x, i64 -400000000000
   store i32 0, i32* %x2, align 1
   ret void
 }
 
 define void @PossiblyNegativeOffset(i16 %z) {
 ; CHECK-LABEL: @PossiblyNegativeOffset dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[40]: [-131072,131072){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, i32 10, align 4
   %x2 = getelementptr i32, i32* %x, i16 %z
   store i32 0, i32* %x2, align 1
   ret void
 }
 
 define void @NonConstantOffsetOOB(i1 zeroext %z) {
 ; CHECK-LABEL: @NonConstantOffsetOOB dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,6){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %idx = select i1 %z, i64 1, i64 4
   %x2 = getelementptr i8, i8* %x1, i64 %idx
   store i8 0, i8* %x2, align 1
   ret void
 }
 
 define void @ArrayAlloca() {
 ; CHECK-LABEL: @ArrayAlloca dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[40]: [36,40){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i32 0, i32* %x3, align 1
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, i32 10, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 36
   %x3 = bitcast i8* %x2 to i32*
   store i32 0, i32* %x3, align 1
   ret void
 }
 
 define void @ArrayAllocaOOB() {
 ; CHECK-LABEL: @ArrayAllocaOOB dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[40]: [37,41){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, i32 10, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 37
   %x3 = bitcast i8* %x2 to i32*
   store i32 0, i32* %x3, align 1
   ret void
 }
 
 define void @DynamicAllocaUnused(i64 %size) {
 ; CHECK-LABEL: @DynamicAllocaUnused dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[0]: empty-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, i64 %size, align 16
   ret void
 }
 
 ; Dynamic alloca with unknown size.
 define void @DynamicAlloca(i64 %size) {
 ; CHECK-LABEL: @DynamicAlloca dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[0]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, i64 %size, align 16
   store i32 0, i32* %x, align 1
   ret void
 }
 
 ; Dynamic alloca with limited size.
 ; FIXME: could be proved safe. Implement.
 define void @DynamicAllocaFiniteSizeRange(i1 zeroext %z) {
 ; CHECK-LABEL: @DynamicAllocaFiniteSizeRange dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[0]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %size = select i1 %z, i64 3, i64 5
   %x = alloca i32, i64 %size, align 16
   store i32 0, i32* %x, align 1
   ret void
 }
 
 define signext i8 @SimpleLoop() {
 ; CHECK-LABEL: @SimpleLoop dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[10]: [0,10){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: %1 = load volatile i8, i8* %p.09, align 1
 ; CHECK-EMPTY:
 entry:
   %x = alloca [10 x i8], align 1
   %0 = getelementptr inbounds [10 x i8], [10 x i8]* %x, i64 0, i64 0
   %lftr.limit = getelementptr inbounds [10 x i8], [10 x i8]* %x, i64 0, i64 10
   br label %for.body
 
 for.body:

 }
 
 ; OOB in a loop.
 define signext i8 @SimpleLoopOOB() {
 ; CHECK-LABEL: @SimpleLoopOOB dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[10]: [0,11){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca [10 x i8], align 1
   %0 = getelementptr inbounds [10 x i8], [10 x i8]* %x, i64 0, i64 0
  ; 11 iterations
   %lftr.limit = getelementptr inbounds [10 x i8], [10 x i8]* %x, i64 0, i64 11
   br label %for.body
 
for.cond.cleanup:
   ret i8 %add
 }
 
 define dso_local void @SizeCheck(i32 %sz) {
 ; CHECK-LABEL: @SizeCheck{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x1[128]: [0,4294967295){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x1 = alloca [128 x i8], align 16
   %x1.sub = getelementptr inbounds [128 x i8], [128 x i8]* %x1, i64 0, i64 0
   %cmp = icmp slt i32 %sz, 129
   br i1 %cmp, label %if.then, label %if.end
 
 if.then:
   call void @llvm.memset.p0i8.i32(i8* nonnull align 16 %x1.sub, i8 0, i32 %sz, i1 false)
   br label %if.end
 
 if.end:
   ret void
 }
 
 ; FIXME: scalable allocas are considered to be of size zero, and scalable accesses to be full-range.
 ; This effectively disables safety analysis for scalable allocations.
 define void @Scalable(<vscale x 4 x i32>* %p, <vscale x 4 x i32>* %unused, <vscale x 4 x i32> %v) {
 ; CHECK-LABEL: @Scalable dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT:   p[]: full-set
 ; CHECK-NEXT:   unused[]: empty-set
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT:   x[0]: [0,1){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca <vscale x 4 x i32>, align 4
   %x1 = bitcast <vscale x 4 x i32>* %x to i8*
   store i8 0, i8* %x1, align 1
   store <vscale x 4 x i32> %v, <vscale x 4 x i32>* %p, align 4
   ret void
 }
 
 %zerosize_type = type {}
 
 define void @ZeroSize(%zerosize_type *%p)  {
 ; CHECK-LABEL: @ZeroSize dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT:   p[]: empty-set
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT:   x[0]: empty-set
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store %zerosize_type undef, %zerosize_type* %x, align 4
 ; CHECK-EMPTY:
 entry:
   %x = alloca %zerosize_type, align 4
   store %zerosize_type undef, %zerosize_type* %x, align 4
   store %zerosize_type undef, %zerosize_type* undef, align 4
   %val = load %zerosize_type, %zerosize_type* %p, align 4
   ret void
 }
 
 define void @OperandBundle() {
 ; CHECK-LABEL: @OperandBundle dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT:   a[4]: full-set
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %a = alloca i32, align 4
   call void @LeakAddress() ["unknown"(i32* %a)]
   ret void
 }
 
 define void @ByVal(i16* byval(i16) %p) {
   ; CHECK-LABEL: @ByVal dso_preemptable{{$}}
   ; CHECK-NEXT: args uses:
   ; CHECK-NEXT: allocas uses:
+  ; GLOBAL-NEXT: safe accesses:
   ; CHECK-EMPTY:
 entry:
   ret void
 }
 
 define void @TestByVal() {
 ; CHECK-LABEL: @TestByVal dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[2]: [0,2)
 ; CHECK-NEXT: y[8]: [0,2)
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @ByVal(i16* byval(i16) %x)
+; GLOBAL-NEXT: call void @ByVal(i16* byval(i16) %y1)
 ; CHECK-EMPTY:
 entry:
   %x = alloca i16, align 4
   call void @ByVal(i16* byval(i16) %x)
 
   %y = alloca i64, align 4
   %y1 = bitcast i64* %y to i16*
   call void @ByVal(i16* byval(i16) %y1)
 
   ret void
 }
 
 declare void @ByValArray([100000 x i64]* byval([100000 x i64]) %p)
 
 define void @TestByValArray() {
 ; CHECK-LABEL: @TestByValArray dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: z[800000]: [500000,1300000)
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %z = alloca [100000 x i64], align 4
   %z1 = bitcast [100000 x i64]* %z to i8*
   %z2 = getelementptr i8, i8* %z1, i64 500000
   %z3 = bitcast i8* %z2 to [100000 x i64]*
   call void @ByValArray([100000 x i64]* byval([100000 x i64]) %z3)
   ret void
 }
 
 define dso_local i8 @LoadMinInt64(i8* %p) {
   ; CHECK-LABEL: @LoadMinInt64{{$}}
   ; CHECK-NEXT: args uses:
   ; CHECK-NEXT: p[]: [-9223372036854775808,-9223372036854775807){{$}}
   ; CHECK-NEXT: allocas uses:
+  ; GLOBAL-NEXT: safe accesses:
   ; CHECK-EMPTY:
   %p2 = getelementptr i8, i8* %p, i64 -9223372036854775808
   %v = load i8, i8* %p2, align 1
   ret i8 %v
 }
 
 define void @Overflow() {
 ; CHECK-LABEL: @Overflow dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; LOCAL-NEXT: x[1]: empty-set, @LoadMinInt64(arg0, [-9223372036854775808,-9223372036854775807)){{$}}
 ; GLOBAL-NEXT: x[1]: full-set, @LoadMinInt64(arg0, [-9223372036854775808,-9223372036854775807)){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, align 4
   %x2 = getelementptr i8, i8* %x, i64 -9223372036854775808
   %v = call i8 @LoadMinInt64(i8* %x2)
   ret void
 }
 
 define void @DeadBlock(i64* %p) {
 ; CHECK-LABEL: @DeadBlock dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: p[]: empty-set{{$}}
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[1]: empty-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, align 4
   br label %end
 
 dead:
   store i8 5, i8* %x
   store i64 -5, i64* %p
   br label %end
 
 end:
   ret void
 }
 
 define void @LifeNotStarted() {
 ; CHECK-LABEL: @LifeNotStarted dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK: x[1]: full-set{{$}}
 ; CHECK: y[1]: full-set{{$}}
 ; CHECK: z[1]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, align 4
   %y = alloca i8, align 4
   %z = alloca i8, align 4
 
   store i8 5, i8* %x
   %n = load i8, i8* %y
   call void @llvm.memset.p0i8.i32(i8* nonnull %z, i8 0, i32 1, i1 false)
 
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %x)
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %y)
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %z)
 
   ret void
 }
 
 define void @LifeOK() {
 ; CHECK-LABEL: @LifeOK dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK: x[1]: [0,1){{$}}
 ; CHECK: y[1]: [0,1){{$}}
 ; CHECK: z[1]: [0,1){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i8 5, i8* %x
+; GLOBAL-NEXT: %n = load i8, i8* %y
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* nonnull %z, i8 0, i32 1, i1 false)
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, align 4
   %y = alloca i8, align 4
   %z = alloca i8, align 4
 
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %x)
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %y)
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %z)
 
   store i8 5, i8* %x
   %n = load i8, i8* %y
   call void @llvm.memset.p0i8.i32(i8* nonnull %z, i8 0, i32 1, i1 false)
 
   ret void
 }
 
 define void @LifeEnded() {
 ; CHECK-LABEL: @LifeEnded dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK: x[1]: full-set{{$}}
 ; CHECK: y[1]: full-set{{$}}
 ; CHECK: z[1]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i8, align 4
   %y = alloca i8, align 4
   %z = alloca i8, align 4
 
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %x)
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %y)
   call void @llvm.lifetime.start.p0i8(i64 1, i8* %z)
 
   call void @llvm.lifetime.end.p0i8(i64 1, i8* %x)
   call void @llvm.lifetime.end.p0i8(i64 1, i8* %y)
   call void @llvm.lifetime.end.p0i8(i64 1, i8* %z)
 
   store i8 5, i8* %x
   %n = load i8, i8* %y
   call void @llvm.memset.p0i8.i32(i8* nonnull %z, i8 0, i32 1, i1 false)
 
   ret void
 }
 
+define void @TwoAllocasOK() {
+; CHECK-LABEL: @TwoAllocasOK
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: [0,1){{$}}
+; CHECK: y[1]: [0,1){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memcpy.p0i8.p0i8.i32(i8* %y, i8* %x, i32 1, i1 false)
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  %y = alloca i8, align 4
+  call void @llvm.memcpy.p0i8.p0i8.i32(i8* %y, i8* %x, i32 1, i1 false)
+  ret void
+}
+
+define void @TwoAllocasOOBDest() {
+; CHECK-LABEL: @TwoAllocasOOBDest
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: [0,4){{$}}
+; CHECK: y[1]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  %y = alloca i8, align 4
+  call void @llvm.memcpy.p0i8.p0i8.i32(i8* %y, i8* %x, i32 4, i1 false)
+  ret void
+}
+
+define void @TwoAllocasOOBSource() {
+; CHECK-LABEL: @TwoAllocasOOBSource
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: [0,4){{$}}
+; CHECK: y[1]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  %y = alloca i8, align 4
+  call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x, i8* %y, i32 4, i1 false)
+  ret void
+}
+
+define void @TwoAllocasOOBBoth() {
+; CHECK-LABEL: @TwoAllocasOOBBoth
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: [0,5){{$}}
+; CHECK: y[1]: [0,5){{$}}
+; GLOBAL-NEXT: safe accesses:
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  %y = alloca i8, align 4
+  call void @llvm.memcpy.p0i8.p0i8.i32(i8* %y, i8* %x, i32 5, i1 false)
+  ret void
+}
+
+define void @MixedAccesses() {
+; CHECK-LABEL: @MixedAccesses
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: [0,5){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 5, i1 false)
+  call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+  ret void
+}
+
+define void @MixedAccesses2() {
+; CHECK-LABEL: @MixedAccesses2
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: [0,8){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: load i32, i32* %a, align 4
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %a1 = bitcast i32* %a to i64*
+  %n1 = load i64, i64* %a1, align 4
+  %n2 = load i32, i32* %a, align 4
+  ret void
+}
+
+define void @MixedAccesses3(void (i8*)* %func) {
+; CHECK-LABEL: @MixedAccesses3
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: func[]: full-set
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: load i32, i32* %a, align 4
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  %n2 = load i32, i32* %a, align 4
+  call void %func(i8* %x)
+  ret void
+}
+
+define void @MixedAccesses4() {
+; CHECK-LABEL: @MixedAccesses4
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: full-set{{$}}
+; CHECK: a1[8]: [0,8){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: load i32, i32* %a, align 4
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %a1 = alloca i32*, align 4
+  %n2 = load i32, i32* %a, align 4
+  store i32* %a, i32** %a1
+  ret void
+}
+
+define i32* @MixedAccesses5(i1 %x, i32* %y) {
+; CHECK-LABEL: @MixedAccesses5
+; CHECK-NEXT: args uses:
+; CHECK: y[]: full-set
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: load i32, i32* %a, align 4
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  br i1 %x, label %tlabel, label %flabel
+flabel:
+  %n = load i32, i32* %a, align 4
+  ret i32* %y
+tlabel:
+  ret i32* %a
+}
+
+define void @DoubleLifetime() {
+; CHECK-LABEL: @DoubleLifetime
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* %x)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* %x)
+  call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 true)
+
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* %x)
+  call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* %x)
+  ret void
+}
+
+define void @DoubleLifetime2() {
+; CHECK-LABEL: @DoubleLifetime2
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* %x)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* %x)
+  %n = load i32, i32* %a
+
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* %x)
+  call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* %x)
+  ret void
+}
+
+define void @DoubleLifetime3() {
+; CHECK-LABEL: @DoubleLifetime3
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* %x)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* %x)
+  store i32 5, i32* %a
+
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* %x)
+  call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* %x)
+  ret void
+}
+
+define void @DoubleLifetime4() {
+; CHECK-LABEL: @DoubleLifetime4
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK: a[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+; CHECK-EMPTY:
+entry:
+  %a = alloca i32, align 4
+  %x = bitcast i32* %a to i8*
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* %x)
+  call void @llvm.memset.p0i8.i32(i8* %x, i8 1, i32 4, i1 false)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* %x)
+  call void @unknown_call(i8* %x)
+  ret void
+}
+
 declare void @llvm.lifetime.start.p0i8(i64, i8* nocapture)
 declare void @llvm.lifetime.end.p0i8(i64, i8* nocapture)

llvm/test/Analysis/StackSafetyAnalysis/memintrin.ll

 ; RUN: opt -S -passes="print<stack-safety-local>" -disable-output < %s 2>&1 | FileCheck %s
-; RUN: opt -S -passes="print-stack-safety" -disable-output < %s 2>&1 | FileCheck %s
+; RUN: opt -S -passes="print-stack-safety" -disable-output < %s 2>&1 | FileCheck %s --check-prefixes=CHECK,GLOBAL
 
 target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 declare void @llvm.memset.p0i8.i64(i8* %dest, i8 %val, i64 %len, i1 %isvolatile)
 declare void @llvm.memset.p0i8.i32(i8* %dest, i8 %val, i32 %len, i1 %isvolatile)
 declare void @llvm.memcpy.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 %len, i1 %isvolatile)
 declare void @llvm.memmove.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 %len, i1 %isvolatile)
 
 define void @MemsetInBounds() {
 ; CHECK-LABEL: MemsetInBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 4, i1 false)
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 4, i1 false)
   ret void
 }
 
 ; Volatile does not matter for access bounds.
 define void @VolatileMemsetInBounds() {
 ; CHECK-LABEL: VolatileMemsetInBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 4, i1 true)
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 4, i1 true)
   ret void
 }
 
 define void @MemsetOutOfBounds() {
 ; CHECK-LABEL: MemsetOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,5){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 5, i1 false)
   ret void
 }
 
 define void @MemsetNonConst(i32 %size) {
 ; CHECK-LABEL: MemsetNonConst dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,4294967295){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 %size, i1 false)
   ret void
 }
 
 ; FIXME: memintrinsics should look at size range when possible
 ; Right now we refuse any non-constant size.
 define void @MemsetNonConstInBounds(i1 zeroext %z) {
 ; CHECK-LABEL: MemsetNonConstInBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,7){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %size = select i1 %z, i32 3, i32 4
   call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 %size, i1 false)
   ret void
 }
 
 define void @MemsetNonConstSize() {
 ; CHECK-LABEL: MemsetNonConstSize dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,4294967295){{$}}
 ; CHECK-NEXT: y[4]: empty-set{{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %y = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %xint = ptrtoint i32* %x to i32
   %yint = ptrtoint i32* %y to i32
   %d = sub i32 %xint, %yint
   call void @llvm.memset.p0i8.i32(i8* %x1, i8 42, i32 %d, i1 false)
   ret void
 }
 
 define void @MemcpyInBounds() {
 ; CHECK-LABEL: MemcpyInBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,4){{$}}
 ; CHECK-NEXT: y[4]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %y1, i32 4, i1 false)
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %y = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %y1 = bitcast i32* %y to i8*
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %y1, i32 4, i1 false)
   ret void
 }
 
 define void @MemcpySrcOutOfBounds() {
 ; CHECK-LABEL: MemcpySrcOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[8]: [0,5){{$}}
 ; CHECK-NEXT: y[4]: [0,5){{$}}
+; GLOBAL-NEXT: safe accesses
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %y = alloca i32, align 4
   %x1 = bitcast i64* %x to i8*
   %y1 = bitcast i32* %y to i8*
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %y1, i32 5, i1 false)
   ret void
 }
 
 define void @MemcpyDstOutOfBounds() {
 ; CHECK-LABEL: MemcpyDstOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,5){{$}}
 ; CHECK-NEXT: y[8]: [0,5){{$}}
+; GLOBAL-NEXT: safe accesses
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %y = alloca i64, align 4
   %x1 = bitcast i32* %x to i8*
   %y1 = bitcast i64* %y to i8*
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %y1, i32 5, i1 false)
   ret void
 }
 
 define void @MemcpyBothOutOfBounds() {
 ; CHECK-LABEL: MemcpyBothOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,9){{$}}
 ; CHECK-NEXT: y[8]: [0,9){{$}}
+; GLOBAL-NEXT: safe accesses
 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %y = alloca i64, align 4
   %x1 = bitcast i32* %x to i8*
   %y1 = bitcast i64* %y to i8*
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %y1, i32 9, i1 false)
   ret void
 }
 
 define void @MemcpySelfInBounds() {
 ; CHECK-LABEL: MemcpySelfInBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[8]: [0,8){{$}}
+; GLOBAL-NEXT: safe accesses
+; GLOBAL-NEXT: call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %x2, i32 3, i1 false)
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 5
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %x2, i32 3, i1 false)
   ret void
 }
 
 define void @MemcpySelfSrcOutOfBounds() {
 ; CHECK-LABEL: MemcpySelfSrcOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[8]: [0,9){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 5
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x1, i8* %x2, i32 4, i1 false)
   ret void
 }
 
 define void @MemcpySelfDstOutOfBounds() {
 ; CHECK-LABEL: MemcpySelfDstOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[8]: [0,9){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 5
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %x2, i8* %x1, i32 4, i1 false)
   ret void
 }
 
 define void @MemmoveSelfBothOutOfBounds() {
 ; CHECK-LABEL: MemmoveSelfBothOutOfBounds dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[8]: [0,14){{$}}
+; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY:
 entry:
   %x = alloca i64, align 4
   %x1 = bitcast i64* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 5
   call void @llvm.memmove.p0i8.p0i8.i32(i8* %x1, i8* %x2, i32 9, i1 false)
   ret void
 }