[stack-safety] Check SCEV constraints at memory instructions.

[fmayer]

rebase

[fmayer]

test

[fmayer]

style changes

[eugenis]

This looks nice. Any idea how much does it improve analysis success rate in practice?

Would be great to have a test with some loop, if it works.

llvm/lib/Analysis/StackSafetyAnalysis.cpp

344

It's a little strange to compute type size in a pointer, but SCEV does not care as long as the number of bits is the same, so I guess it is fine.

402–405

move getTypeStoreSize into getTypeSize

[fmayer]

In D113160#3116741, @eugenis wrote:

This looks nice. Any idea how much does it improve analysis success rate in practice?

Would be great to have a test with some loop, if it works.

It doesn't support loops yet, I've been experimenting with isKnownAtEveryIteration without success so far. Will keep trying.

llvm/lib/Analysis/StackSafetyAnalysis.cpp

402–405

The way it is now makes it more obvious that this TypeSize is the same that we use in the getAccessRange call, so I'd prefer to leave it like this. WDYT?

[fmayer]

improve naming

llvm/lib/Analysis/StackSafetyAnalysis.cpp

402–405

I changed the name of getTypeSize to make more explicit what it does.

[fmayer]

fix typo

[fmayer]

rebase

[eugenis]

LGTM but please wait for review from Vitaly, too

[kstoimenov]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

121

Isn't that just a set?

258

If this is an output param, please consider moving it to the end of the argument list.

399

Add the var you are setting in comments like so: /*x=*/false to increase readability. Here and below.

[kstoimenov]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

876

If converted to set this loop could be:

Info->AccessIsUnsafe[A.first].insert(KV.second.AccessIsUnsafe.first, KV.second.AccessIsUnsafe.end);

There is also set::merge in C++ 17, but it will move the elements from the second set I think.

[fmayer]

address comments

llvm/lib/Analysis/StackSafetyAnalysis.cpp

258

There is no output parameter in this. This is just non-const because getSCEV does not take const.

[fmayer]

format

[kstoimenov]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

121

I am not sure what is the ratio of unsafe to safe accesses is, but I would expect that more of them are unsafe, right? In that case it makes more sense to have a set of SafeAccesses to use less memory.

951

Nit: could be !Info.UnsafeAccesses.contains(&I).

[fmayer]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

121

That doesn't work though. What we want is

any(instr is unsafe for alloca for all allocas reachable)

for that we need to keep track of the unsafe instructions for each alloca.

951

No, that doesn't work because it's too new for LLVM code.

Unless otherwise documented, LLVM subprojects are written using standard C++14 code and avoid unnecessary vendor-specific extensions.

[kstoimenov]

LGTM for my comments.

[fmayer]

@vitalybuka friendly ping

[vitalybuka]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

260

Can you replace typeSizeToSCEV with two overloads?

bool isSafeAccess(... Value *AccessSize)

bool isSafeAccess(...TypeSize AccessSize)

319–325

why don't we do this in case if isSafeAccess?

344

auto *IntTy = IntegerType::getIntNTy(SE.getContext(), PointerSize);
  return SE.getConstant(IntTy, TS.getFixedSize());

353

UI -> U

354

I is not needed, it can be retrived from U

367–369

In all 3 cases can you please replace
toCharPtr with getIntNTy, at least for readability not sure if it make a difference for SCEV

399

maybe add for this case a dedicated function US.addUnsaveAccess(I);

466

for consistency
either (i prefer this one):

US.addRange(I, getAccessRange(UI, Ptr, TypeSize);,
                        isSafeAccess(UI, AI, I, typeSizeToSCEV(TypeSize)));

or:

auto AccessRange = getAccessRange(UI, Ptr, TypeSize);
bool Safe = isSafeAccess(UI, AI, I, typeSizeToSCEV(TypeSize));
US.addRange(I, AccessRange, Safe);

[fmayer]

address comments

llvm/lib/Analysis/StackSafetyAnalysis.cpp

260

I think that just adds more complexity, as this way we will need

bool isSafeAccess(... Value *AccessSize)
bool isSafeAccess(... TypeSize AccessSize)

which only do the conversion and call some

isSafeAccess(... SCEV *AccessSize).

Doing the conversion explicitly in the caller seems more readable to me.

319–325

Added this and a test that fails without this. Thanks!

353

Ok.

Although this is called UI in analyzeAllUses.

399

Let's hold off of this for now, as that needs some changes (UnknownRange is in StackSafetyLocalAnalysis).

[fmayer]

formatting

[vitalybuka]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

260

please do this to remove SCEV stuff from that long loop

367–369

maybe: can you make toCharPtr same local lambda? or you plan to use it outside?

447

it's going to make instruction safe even if user is not alloca

For consistency isSafeMemIntrinsicAccess will help

[fmayer]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

447

This is consistent with the API this is used in

// Returns true if the instruction can be proven to do only two types of
// memory accesses:
//  (1) live stack locations in-bounds or
//  (2) non-stack locations.

If the user is not alloca, that is (2).

[vitalybuka]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

121

Just noticed:
Why this is in UseInfo and per alloca, and then we merge them latter anyway?
It should be FunctionInfo::UnsafeAccesses?

Then you pass that reference to the set as new arg of analyzeAllUses

447

it's going to make instruction safe even if *user* is not alloca

*user* -> location

isSafeAccess() line 355
return false for !AI

I don't like to have undefined behavior for (2) even if you don't use it now. It's trivial to make it defined either true or false. However if instruction access function argument, we don't know if it a stack of another function. So unsafe (false) seems reasonable choose here. BTW why this is not important for current callers?

[fmayer]

address comments

llvm/lib/Analysis/StackSafetyAnalysis.cpp

121

Can we do this in a separate change? This doesn't really belong here.

447

Good point, if !AI in isSafeAccess we should also return true, for consistency. Then the semantics remain well-defined and the same: "all *stack* accesses done by this instruction are safe.

The callers check findAllocaForValue to make sure this is definitely a stack access before calling stackAccessIsSafe.

[vitalybuka]

llvm/lib/Analysis/StackSafetyAnalysis.cpp

121

sure
in would be nice in follow up patches also to switch from UnsafeAccesses to SaveAccessesOnAlloca
probably we can track two sets:
a. all instructions on any alloca
b. unsafe instructions on any alloca
and then keep (a-b) for result.

447

i don't like this assumption on what user will do
this seems like a goal of this analysis and it should tell without external tricks.

However It should be easier to do after "UnsafeAccesses" followup patch.

llvm/lib/Analysis/StackSafetyAnalysis.cpp

 //===- StackSafetyAnalysis.cpp - Stack memory safety analysis -------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Analysis/StackSafetyAnalysis.h"
 #include "llvm/ADT/APInt.h"
 #include "llvm/ADT/SmallPtrSet.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Analysis/ModuleSummaryAnalysis.h"
+#include "llvm/Analysis/ScalarEvolution.h"
 #include "llvm/Analysis/ScalarEvolutionExpressions.h"
 #include "llvm/Analysis/StackLifetime.h"
 #include "llvm/IR/ConstantRange.h"
 #include "llvm/IR/DerivedTypes.h"
 #include "llvm/IR/GlobalValue.h"
 #include "llvm/IR/InstIterator.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/IntrinsicInst.h"
template <typename CalleeTy> struct CallInfo {
   };
 };
 
 /// Describe uses of address (alloca or parameter) inside of the function.
 template <typename CalleeTy> struct UseInfo {
   // Access range if the address (alloca or parameters).
   // It is allowed to be empty-set when there are no known accesses.
   ConstantRange Range;
-  std::map<const Instruction *, ConstantRange> Accesses;
+  std::set<const Instruction *> UnsafeAccesses;
 
   // List of calls which pass address as an argument.
   // Value is offset range of address from base address (alloca or calling
   // function argument). Range should never set to empty-set, that is an invalid
   // access range that can cause empty-set to be propagated with
   // ConstantRange::add
   using CallsTy = std::map<CallInfo<CalleeTy>, ConstantRange,
                            typename CallInfo<CalleeTy>::Less>;
   CallsTy Calls;
 
   UseInfo(unsigned PointerSize) : Range{PointerSize, false} {}
 
   void updateRange(const ConstantRange &R) { Range = unionNoWrap(Range, R); }
-  void addRange(const Instruction *I, const ConstantRange &R) {
-    auto Ins = Accesses.emplace(I, R);
-    if (!Ins.second)
-      Ins.first->second = unionNoWrap(Ins.first->second, R);
+  void addRange(const Instruction *I, const ConstantRange &R, bool IsSafe) {
+    if (!IsSafe)
+      UnsafeAccesses.insert(I);
     updateRange(R);
   }
 };
 
 template <typename CalleeTy>
 raw_ostream &operator<<(raw_ostream &OS, const UseInfo<CalleeTy> &U) {
   OS << U.Range;
   for (auto &Call : U.Calls)

 
 struct StackSafetyInfo::InfoTy {
   FunctionInfo<GlobalValue> Info;
 };
 
 struct StackSafetyGlobalInfo::InfoTy {
   GVToSSI Info;
   SmallPtrSet<const AllocaInst *, 8> SafeAllocas;
-  std::map<const Instruction *, bool> AccessIsUnsafe;
+  std::set<const Instruction *> UnsafeAccesses;
 };
 
 namespace {
 
 class StackSafetyLocalAnalysis {
   Function &F;
   const DataLayout &DL;
   ScalarEvolution &SE;
   unsigned PointerSize = 0;
 
   const ConstantRange UnknownRange;
 
   ConstantRange offsetFrom(Value *Addr, Value *Base);
   ConstantRange getAccessRange(Value *Addr, Value *Base,
                                const ConstantRange &SizeRange);
   ConstantRange getAccessRange(Value *Addr, Value *Base, TypeSize Size);
   ConstantRange getMemIntrinsicAccessRange(const MemIntrinsic *MI, const Use &U,
                                            Value *Base);
 
   void analyzeAllUses(Value *Ptr, UseInfo<GlobalValue> &AS,
                       const StackLifetime &SL);
 
+  const SCEV *toCharPtr(const SCEV *V);
+  const SCEV *typeSizeToSCEV(TypeSize TS);
+  bool isSafeAccess(const Use &UI, AllocaInst *AI, const Instruction *I,
+                    const SCEV *AccessSize);
+
 public:
   StackSafetyLocalAnalysis(Function &F, ScalarEvolution &SE)
       : F(F), DL(F.getParent()->getDataLayout()), SE(SE),
         PointerSize(DL.getPointerSizeInBits()),
         UnknownRange(PointerSize, true) {}
 
   // Run the transformation on the associated function.
   FunctionInfo<GlobalValue> run();
ConstantRange StackSafetyLocalAnalysis::getAccessRange(Value *Addr, Value *Base,
   if (APSize.isNegative())
     return UnknownRange;
   return getAccessRange(Addr, Base,
                         ConstantRange(APInt::getZero(PointerSize), APSize));
 }
 
 ConstantRange StackSafetyLocalAnalysis::getMemIntrinsicAccessRange(
     const MemIntrinsic *MI, const Use &U, Value *Base) {
   if (const auto *MTI = dyn_cast<MemTransferInst>(MI)) {
     if (MTI->getRawSource() != U && MTI->getRawDest() != U)
       return ConstantRange::getEmpty(PointerSize);
   } else {
     if (MI->getRawDest() != U)
       return ConstantRange::getEmpty(PointerSize);
   }
 
   auto *CalculationTy = IntegerType::getIntNTy(SE.getContext(), PointerSize);
   if (!SE.isSCEVable(MI->getLength()->getType()))
     return UnknownRange;
 
   const SCEV *Expr =
       SE.getTruncateOrZeroExtend(SE.getSCEV(MI->getLength()), CalculationTy);
   ConstantRange Sizes = SE.getSignedRange(Expr);
   if (Sizes.getUpper().isNegative() || isUnsafe(Sizes))
     return UnknownRange;
   Sizes = Sizes.sextOrTrunc(PointerSize);
   ConstantRange SizeRange(APInt::getZero(PointerSize), Sizes.getUpper() - 1);
   return getAccessRange(U, Base, SizeRange);
 }
 
+const SCEV *StackSafetyLocalAnalysis::typeSizeToSCEV(TypeSize TS) {
+  if (TS.isScalable())
+    return SE.getCouldNotCompute();
+  auto *PtrTy = IntegerType::getInt8PtrTy(SE.getContext());
+  return SE.getConstant(PtrTy, TS.getFixedSize());
+}
+
+const SCEV *StackSafetyLocalAnalysis::toCharPtr(const SCEV *V) {
+  auto *PtrTy = IntegerType::getInt8PtrTy(SE.getContext());
+  return SE.getTruncateOrZeroExtend(V, PtrTy);
+}
+
+bool StackSafetyLocalAnalysis::isSafeAccess(const Use &UI, AllocaInst *AI,
+                                            const Instruction *I,
+                                            const SCEV *AccessSize) {
+  if (!AI || isa<SCEVCouldNotCompute>(AccessSize))
+    return false;
+
+  const SCEV *AddrExp = toCharPtr(SE.getSCEV(UI.get()));
+  const SCEV *BaseExp = toCharPtr(SE.getSCEV(AI));
+  const SCEV *Diff = SE.getMinusSCEV(AddrExp, BaseExp);
+  if (isa<SCEVCouldNotCompute>(Diff))
+    return false;
+
+  auto Size = getStaticAllocaSizeRange(*AI);
+
+  const SCEV *Min = toCharPtr(SE.getConstant(Size.getLower()));
+  const SCEV *Max = SE.getMinusSCEV(toCharPtr(SE.getConstant(Size.getUpper())),
+                                    toCharPtr(AccessSize));
+  return SE.evaluatePredicateAt(ICmpInst::Predicate::ICMP_SGE, Diff, Min, I)
+             .getValueOr(false) &&
+         SE.evaluatePredicateAt(ICmpInst::Predicate::ICMP_SLE, Diff, Max, I)
+             .getValueOr(false);
+}
+
 /// The function analyzes all local uses of Ptr (alloca or argument) and
 /// calculates local access range and all function calls where it was used.
 void StackSafetyLocalAnalysis::analyzeAllUses(Value *Ptr,
                                               UseInfo<GlobalValue> &US,
                                               const StackLifetime &SL) {
   SmallPtrSet<const Value *, 16> Visited;
   SmallVector<const Value *, 8> WorkList;
   WorkList.push_back(Ptr);
-  const AllocaInst *AI = dyn_cast<AllocaInst>(Ptr);
+  AllocaInst *AI = dyn_cast<AllocaInst>(Ptr);
 
   // A DFS search through all uses of the alloca in bitcasts/PHI/GEPs/etc.
   while (!WorkList.empty()) {
     const Value *V = WorkList.pop_back_val();
     for (const Use &UI : V->uses()) {
       const auto *I = cast<Instruction>(UI.getUser());
       if (!SL.isReachable(I))
         continue;
 
       assert(V == UI.get());
 
       switch (I->getOpcode()) {
       case Instruction::Load: {
         if (AI && !SL.isAliveAfter(AI, I)) {
-          US.addRange(I, UnknownRange);
+          US.addRange(I, UnknownRange, /*IsSafe=*/false);
           break;
         }
-        US.addRange(I,
-                    getAccessRange(UI, Ptr, DL.getTypeStoreSize(I->getType())));
+        auto TypeSize = DL.getTypeStoreSize(I->getType());
+        auto AccessRange = getAccessRange(UI, Ptr, TypeSize);
+        US.addRange(I, AccessRange,
+                    isSafeAccess(UI, AI, I, typeSizeToSCEV(TypeSize)));
         break;
       }
 
       case Instruction::VAArg:
         // "va-arg" from a pointer is safe.
         break;
       case Instruction::Store: {
         if (V == I->getOperand(0)) {
           // Stored the pointer - conservatively assume it may be unsafe.
-          US.addRange(I, UnknownRange);
+          US.addRange(I, UnknownRange, /*IsSafe=*/false);
           break;
         }
         if (AI && !SL.isAliveAfter(AI, I)) {
-          US.addRange(I, UnknownRange);
+          US.addRange(I, UnknownRange, /*IsSafe=*/false);
           break;
         }
-        US.addRange(
-            I, getAccessRange(
-                   UI, Ptr, DL.getTypeStoreSize(I->getOperand(0)->getType())));
+        auto TypeSize = DL.getTypeStoreSize(I->getOperand(0)->getType());
+        auto AccessRange = getAccessRange(UI, Ptr, TypeSize);
+        US.addRange(I, AccessRange,
+                    isSafeAccess(UI, AI, I, typeSizeToSCEV(TypeSize)));
         break;
       }
 
       case Instruction::Ret:
         // Information leak.
         // FIXME: Process parameters correctly. This is a leak only if we return
         // alloca.
-        US.addRange(I, UnknownRange);
+        US.addRange(I, UnknownRange, /*IsSafe=*/false);
         break;
 
       case Instruction::Call:
       case Instruction::Invoke: {
         if (I->isLifetimeStartOrEnd())
           break;
 
         if (AI && !SL.isAliveAfter(AI, I)) {
-          US.addRange(I, UnknownRange);
+          US.addRange(I, UnknownRange, /*IsSafe=*/false);
           break;
         }
-
         if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
-          US.addRange(I, getMemIntrinsicAccessRange(MI, UI, Ptr));
+          auto AccessRange = getMemIntrinsicAccessRange(MI, UI, Ptr);
+          US.addRange(I, AccessRange,
+                      isSafeAccess(UI, AI, I, SE.getSCEV(MI->getLength())));
           break;
         }
 
         const auto &CB = cast<CallBase>(*I);
         if (CB.getReturnedArgOperand() == V) {
           if (Visited.insert(I).second)
             WorkList.push_back(cast<const Instruction>(I));
         }
 
         if (!CB.isArgOperand(&UI)) {
-          US.addRange(I, UnknownRange);
+          US.addRange(I, UnknownRange, /*IsSafe=*/false);
           break;
         }
 
         unsigned ArgNo = CB.getArgOperandNo(&UI);
         if (CB.isByValArgument(ArgNo)) {
-          US.addRange(I, getAccessRange(
-                             UI, Ptr,
-                             DL.getTypeStoreSize(CB.getParamByValType(ArgNo))));
+          auto TypeSize = DL.getTypeStoreSize(CB.getParamByValType(ArgNo));
+          auto AccessRange = getAccessRange(UI, Ptr, TypeSize);
+          US.addRange(I, AccessRange,
+                      isSafeAccess(UI, AI, I, typeSizeToSCEV(TypeSize)));
           break;
         }
 
         // FIXME: consult devirt?
         // Do not follow aliases, otherwise we could inadvertently follow
         // dso_preemptable aliases or aliases with interposable linkage.
         const GlobalValue *Callee =
             dyn_cast<GlobalValue>(CB.getCalledOperand()->stripPointerCasts());
         if (!Callee) {
-          US.addRange(I, UnknownRange);
+          US.addRange(I, UnknownRange, /*IsSafe=*/false);
           break;
         }
 
         assert(isa<Function>(Callee) || isa<GlobalAlias>(Callee));
         ConstantRange Offsets = offsetFrom(UI, Ptr);
         auto Insert =
             US.Calls.emplace(CallInfo<GlobalValue>(Callee, ArgNo), Offsets);
         if (!Insert.second)
for (auto &FnKV : Info->Info) {
       for (auto &KV : FnKV.second.Allocas) {
         ++NumAllocaTotal;
         const AllocaInst *AI = KV.first;
         auto AIRange = getStaticAllocaSizeRange(*AI);
         if (AIRange.contains(KV.second.Range)) {
           Info->SafeAllocas.insert(AI);
           ++NumAllocaStackSafe;
         }
-        for (const auto &A : KV.second.Accesses)
-          Info->AccessIsUnsafe[A.first] |= !AIRange.contains(A.second);
+        Info->UnsafeAccesses.insert(KV.second.UnsafeAccesses.begin(),
+        KV.second.UnsafeAccesses.end());
       }
     }
 
     if (StackSafetyPrint)
       print(errs());
   }
   return *Info;
 }

 
 bool StackSafetyGlobalInfo::isSafe(const AllocaInst &AI) const {
   const auto &Info = getInfo();
   return Info.SafeAllocas.count(&AI);
 }
 
 bool StackSafetyGlobalInfo::stackAccessIsSafe(const Instruction &I) const {
   const auto &Info = getInfo();
-  auto It = Info.AccessIsUnsafe.find(&I);
-  if (It == Info.AccessIsUnsafe.end()) {
-    return true;
-  }
-  return !It->second;
+  return Info.UnsafeAccesses.find(&I) == Info.UnsafeAccesses.end();
 }
 
 void StackSafetyGlobalInfo::print(raw_ostream &O) const {
   auto &SSI = getInfo().Info;
   if (SSI.empty())
     return;
   const Module &M = *SSI.begin()->first->getParent();
   for (auto &F : M.functions()) {

llvm/test/Analysis/StackSafetyAnalysis/local.ll

 ; CHECK-EMPTY:
 entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   store i8 0, i8* %x1, align 1
   ret void
 }
 
+define void @StoreInBoundsCond(i64 %i) {
+; CHECK-LABEL: @StoreInBoundsCond dso_preemptable{{$}}
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK-NEXT: x[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i8 0, i8* %x2, align 1
+; CHECK-EMPTY:
+entry:
+  %x = alloca i32, align 4
+  %x1 = bitcast i32* %x to i8*
+  %c1 = icmp sge i64 %i, 0
+  %c2 = icmp slt i64 %i, 4
+  br i1 %c1, label %c1.true, label %false
+
+c1.true:
+  br i1 %c2, label %c2.true, label %false
+
+c2.true:
+  %x2 = getelementptr i8, i8* %x1, i64 %i
+  store i8 0, i8* %x2, align 1
+  br label %false
+
+false:
+  ret void
+}
+
+define void @StoreInBoundsMinMax(i64 %i) {
+; CHECK-LABEL: @StoreInBoundsMinMax dso_preemptable{{$}}
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK-NEXT: x[4]: [0,4){{$}}
+; GLOBAL-NEXT: safe accesses:
+; GLOBAL-NEXT: store i8 0, i8* %x2, align 1
+; CHECK-EMPTY:
+entry:
+  %x = alloca i32, align 4
+  %x1 = bitcast i32* %x to i8*
+  %c1 = icmp sge i64 %i, 0
+  %i1 = select i1 %c1, i64 %i, i64 0
+  %c2 = icmp slt i64 %i1, 3
+  %i2 = select i1 %c2, i64 %i1, i64 3
+  %x2 = getelementptr i8, i8* %x1, i64 %i2
+  store i8 0, i8* %x2, align 1
+  ret void
+}
+
 define void @StoreInBounds2() {
 ; CHECK-LABEL: @StoreInBounds2 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; CHECK-NEXT: x[4]: [0,4){{$}}
 ; GLOBAL-NEXT: safe accesses:
 ; GLOBAL-NEXT: store i32 0, i32* %x, align 4
 ; CHECK-EMPTY:
entry:
   %x = alloca i32, align 4
   %x1 = bitcast i32* %x to i8*
   %x2 = getelementptr i8, i8* %x1, i64 2
   %x3 = bitcast i8* %x2 to i32*
   store i32 0, i32* %x3, align 1
   ret void
 }
 
+define void @StoreOutOfBoundsCond(i64 %i) {
+; CHECK-LABEL: @StoreOutOfBoundsCond dso_preemptable{{$}}
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK-NEXT: x[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; CHECK-EMPTY:
+entry:
+  %x = alloca i32, align 4
+  %x1 = bitcast i32* %x to i8*
+  %c1 = icmp sge i64 %i, 0
+  %c2 = icmp slt i64 %i, 5
+  br i1 %c1, label %c1.true, label %false
+
+c1.true:
+  br i1 %c2, label %c2.true, label %false
+
+c2.true:
+  %x2 = getelementptr i8, i8* %x1, i64 %i
+  store i8 0, i8* %x2, align 1
+  br label %false
+
+false:
+  ret void
+}
+
+define void @StoreOutOfBoundsCond2(i64 %i) {
+; CHECK-LABEL: @StoreOutOfBoundsCond2 dso_preemptable{{$}}
+; CHECK-NEXT: args uses:
+; CHECK-NEXT: allocas uses:
+; CHECK-NEXT: x[4]: full-set{{$}}
+; GLOBAL-NEXT: safe accesses:
+; CHECK-EMPTY:
+entry:
+  %x = alloca i32, align 4
+  %x1 = bitcast i32* %x to i8*
+  %c2 = icmp slt i64 %i, 5
+  br i1 %c2, label %c2.true, label %false
+
+c2.true:
+  %x2 = getelementptr i8, i8* %x1, i64 %i
+  store i8 0, i8* %x2, align 1
+  br label %false
+
+false:
+  ret void
+}
+
 define void @StoreOutOfBounds2() {
 ; CHECK-LABEL: @StoreOutOfBounds2 dso_preemptable{{$}}
 ; CHECK-NEXT: args uses:
 ; CHECK-NEXT: allocas uses:
 ; GLOBAL-NEXT: x[4]: full-set, @retptr(arg0, [2,3)){{$}}
 ; LOCAL-NEXT: x[4]: [2,6), @retptr(arg0, [2,3)){{$}}
 ; GLOBAL-NEXT: safe accesses:
 ; CHECK-EMPTY: