[HWASan] do not replace lifetime intrinsics with tagged address.

[fmayer]

Summary

Quote from the LLVM Language Reference

If ptr is a stack-allocated object and it points to the first byte of the
object, the object is initially marked as dead. ptr is conservatively
considered as a non-stack-allocated object if the stack coloring algorithm
that is used in the optimization pipeline cannot conclude that ptr is a
stack-allocated object.

By replacing the alloca pointer with the tagged address before this change,
we confused the stack coloring algorithm.

[fmayer]

simplify

[eugenis]

LGTM, nice!

[fmayer]

skip if aarch64 target is not registered

llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

 //===- HWAddressSanitizer.cpp - detector of uninitialized reads -------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 /// \file
 /// This file is a part of HWAddressSanitizer, an address basic correctness
 /// checker based on tagged addressing.
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Transforms/Instrumentation/HWAddressSanitizer.h"
 #include "llvm/ADT/MapVector.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/Analysis/PostDominators.h"
 #include "llvm/Analysis/StackSafetyAnalysis.h"
 #include "llvm/Analysis/ValueTracking.h"
 #include "llvm/BinaryFormat/Dwarf.h"
for (auto *LP : LandingPadVec) {
     IRB.CreateCall(
         HWAsanHandleVfork,
         {readRegister(IRB, (TargetTriple.getArch() == Triple::x86_64) ? "rsp"
                                                                       : "sp")});
   }
   return true;
 }
 
+static bool isLifetimeIntrinsic(Value *V) {
+  auto *II = dyn_cast<IntrinsicInst>(V);
+  return II && II->isLifetimeStartOrEnd();
+}
+
 bool HWAddressSanitizer::instrumentStack(
     memtag::StackInfo &SInfo, Value *StackTag,
     llvm::function_ref<const DominatorTree &()> GetDT,
     llvm::function_ref<const PostDominatorTree &()> GetPDT) {
   // Ideally, we want to calculate tagged stack base pointer, and rewrite all
   // alloca addresses using that. Unfortunately, offsets are not known yet
   // (unless we use ASan-style mega-alloca). Instead we keep the base tag in a
   // temp, shift-OR it into each alloca address and xor with the retag mask.
for (auto &KV : SInfo.AllocasToInstrument) {
     // Replace uses of the alloca with tagged address.
     Value *Tag = getAllocaTag(IRB, StackTag, AI, N);
     Value *AILong = IRB.CreatePointerCast(AI, IntptrTy);
     Value *Replacement = tagPointer(IRB, AI->getType(), AILong, Tag);
     std::string Name =
         AI->hasName() ? AI->getName().str() : "alloca." + itostr(N);
     Replacement->setName(Name + ".hwasan");
 
-    AI->replaceUsesWithIf(Replacement,
-                          [AILong](Use &U) { return U.getUser() != AILong; });
+    size_t Size = memtag::getAllocaSizeInBytes(*AI);
+    size_t AlignedSize = alignTo(Size, Mapping.getObjectAlignment());
+
+    Value *AICast = IRB.CreatePointerCast(AI, Int8PtrTy);
+
+    auto HandleLifetime = [&](IntrinsicInst *II) {
+      // Set the lifetime intrinsic to cover the whole alloca. This reduces the
+      // set of assumptions we need to make about the lifetime. Without this we
+      // would need to ensure that we can track the lifetime pointer to a
+      // constant offset from the alloca, and would still need to change the
+      // size to include the extra alignment we use for the untagging to make
+      // the size consistent.
+      //
+      // The check for standard lifetime below makes sure that we have exactly
+      // one set of start / end in any execution (i.e. the ends are not
+      // reachable from each other), so this will not cause any problems.
+      II->setArgOperand(0, ConstantInt::get(Int64Ty, AlignedSize));
+      II->setArgOperand(1, AICast);
+    };
+    llvm::for_each(Info.LifetimeStart, HandleLifetime);
+    llvm::for_each(Info.LifetimeEnd, HandleLifetime);
+
+    AI->replaceUsesWithIf(Replacement, [AICast, AILong](Use &U) {
+      auto *User = U.getUser();
+      return User != AILong && User != AICast && !isLifetimeIntrinsic(User);
+    });
 
     for (auto *DDI : Info.DbgVariableIntrinsics) {
       // Prepend "tag_offset, N" to the dwarf expression.
       // Tag offset logically applies to the alloca pointer, and it makes sense
       // to put it at the beginning of the expression.
       SmallVector<uint64_t, 8> NewOps = {dwarf::DW_OP_LLVM_tag_offset,
                                          retagMask(N)};
       for (size_t LocNo = 0; LocNo < DDI->getNumVariableLocationOps(); ++LocNo)
         if (DDI->getVariableLocationOp(LocNo) == AI)
           DDI->setExpression(DIExpression::appendOpsToArg(DDI->getExpression(),
                                                           NewOps, LocNo));
     }
 
-    size_t Size = memtag::getAllocaSizeInBytes(*AI);
-    size_t AlignedSize = alignTo(Size, Mapping.getObjectAlignment());
     auto TagEnd = [&](Instruction *Node) {
       IRB.SetInsertPoint(Node);
       Value *UARTag = getUARTag(IRB, StackTag);
       // When untagging, use the `AlignedSize` because we need to set the tags
       // for the entire alloca to zero. If we used `Size` here, we would
       // keep the last granule tagged, and store zero in the last byte of the
       // last granule, due to how short granules are implemented.
       tagAlloca(IRB, AI, UARTag, AlignedSize);

llvm/test/Instrumentation/HWAddressSanitizer/exception-lifetime.ll

 define void @test() sanitize_hwaddress personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
 entry:
   %x = alloca i32, align 8
   %exn.slot = alloca i8*, align 8
   %ehselector.slot = alloca i32, align 4
   %0 = bitcast i32* %x to i8*
   call void @llvm.lifetime.start.p0i8(i64 8, i8* %0)
   invoke void @mayFail(i32* %x) to label %invoke.cont unwind label %lpad
+; CHECK: [[CAST:%.*]] = bitcast { i32, [12 x i8] }* %x to i32*
+; CHECK: [[TMP1:%.*]] = bitcast i32* {{.*}}[[CAST]] to i8*
 
 invoke.cont:                                      ; preds = %entry
 ; CHECK: invoke.cont:
-; CHECK:  call void @llvm.memset.p0i8.i64(i8* align 1 %31, i8 0, i64 1, i1 false)
-; CHECK:  call void @llvm.lifetime.end.p0i8(i64 8, i8* %28)
+; CHECK:  call void @llvm.memset.p0i8.i64(i8* align 1 %{{.*}}, i8 0, i64 1, i1 false)
+; CHECK:  call void @llvm.lifetime.end.p0i8(i64 16, i8* {{.*}}[[TMP1]])
 ; CHECK:  ret void
 
   %1 = bitcast i32* %x to i8*
   call void @llvm.lifetime.end.p0i8(i64 8, i8* %1)
   ret void
 
 lpad:                                             ; preds = %entry
 ; CHECK: lpad
-; CHECK:  %41 = getelementptr i8, i8* %17, i64 %40
-; CHECK:  call void @llvm.memset.p0i8.i64(i8* align 1 %41, i8 0, i64 1, i1 false)
-; CHECK:  call void @llvm.lifetime.end.p0i8(i64 8, i8* %38)
+; CHECK:  call void @llvm.memset.p0i8.i64(i8* align 1 %{{.*}}, i8 0, i64 1, i1 false)
+; CHECK:  call void @llvm.lifetime.end.p0i8(i64 16, i8* {{.*}}[[TMP1]])
 ; CHECK:  br label %eh.resume
 
   %2 = landingpad { i8*, i32 }
   cleanup
   %3 = extractvalue { i8*, i32 } %2, 0
   store i8* %3, i8** %exn.slot, align 8
   %4 = extractvalue { i8*, i32 } %2, 1
   store i32 %4, i32* %ehselector.slot, align 4

llvm/test/Instrumentation/HWAddressSanitizer/stack-coloring.ll

+; Test that storage for allocas with disjoint lifetimes is reused with
+; use-after-scope.
+
+; RUN: opt -S -passes=hwasan %s -hwasan-use-after-scope -o - | \
+; RUN:   llc -no-stack-coloring=false -o - | \
+; RUN:   FileCheck %s --check-prefix=COLOR
+; RUN: opt -S -passes=hwasan -hwasan-use-after-scope %s -o - | \
+; RUN:   llc -no-stack-coloring=true -o - | \
+; RUN:   FileCheck %s --check-prefix=NOCOLOR
+
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64-unknown-linux-android29"
+
+; REQUIRES: aarch64-registered-target
+
+; COLOR: sub  sp, sp, #240
+; NOCOLOR: sub  sp, sp, #368
+
+define i32 @myCall_w2(i32 %in) sanitize_hwaddress {
+entry:
+  %a = alloca [17 x i8*], align 8
+  %a2 = alloca [16 x i8*], align 8
+  %b = bitcast [17 x i8*]* %a to i8*
+  %b2 = bitcast [16 x i8*]* %a2 to i8*
+  call void @llvm.lifetime.start.p0i8(i64 136, i8* %b)
+  %t1 = call i32 @foo(i32 %in, i8* %b)
+  %t2 = call i32 @foo(i32 %in, i8* %b)
+  call void @llvm.lifetime.end.p0i8(i64 136, i8* %b)
+  call void @llvm.lifetime.start.p0i8(i64 128, i8* %b2)
+  %t3 = call i32 @foo(i32 %in, i8* %b2)
+  %t4 = call i32 @foo(i32 %in, i8* %b2)
+  call void @llvm.lifetime.end.p0i8(i64 128, i8* %b2)
+  %t5 = add i32 %t1, %t2
+  %t6 = add i32 %t3, %t4
+  %t7 = add i32 %t5, %t6
+  ret i32 %t7
+}
+
+declare void @llvm.lifetime.start.p0i8(i64, i8* nocapture) nounwind
+
+declare void @llvm.lifetime.end.p0i8(i64, i8* nocapture) nounwind
+
+declare i32 @foo(i32, i8*)

llvm/test/Instrumentation/HWAddressSanitizer/use-after-scope.ll

 ; X86-SCOPE-NEXT:    [[TMP3:%.*]] = call i8 @__hwasan_generate_tag()
 ; X86-SCOPE-NEXT:    [[TMP4:%.*]] = zext i8 [[TMP3]] to i64
 ; X86-SCOPE-NEXT:    [[TMP5:%.*]] = ptrtoint i8* [[TMP2]] to i64
 ; X86-SCOPE-NEXT:    [[TMP6:%.*]] = shl i64 [[TMP4]], 57
 ; X86-SCOPE-NEXT:    [[TMP7:%.*]] = or i64 [[TMP5]], [[TMP6]]
 ; X86-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP7]] to i8*
 ; X86-SCOPE-NEXT:    br label [[TMP8:%.*]]
 ; X86-SCOPE:       8:
-; X86-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; X86-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP2]])
 ; X86-SCOPE-NEXT:    [[TMP9:%.*]] = trunc i64 [[TMP4]] to i8
 ; X86-SCOPE-NEXT:    call void @__hwasan_tag_memory(i8* [[TMP2]], i8 [[TMP9]], i64 16)
 ; X86-SCOPE-NEXT:    [[TMP10:%.*]] = tail call i1 (...) @cond()
 ; X86-SCOPE-NEXT:    call void @__hwasan_tag_memory(i8* [[TMP2]], i8 0, i64 16)
-; X86-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; X86-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 16, i8* nonnull [[TMP2]])
 ; X86-SCOPE-NEXT:    br i1 [[TMP10]], label [[TMP11:%.*]], label [[TMP8]]
 ; X86-SCOPE:       11:
 ; X86-SCOPE-NEXT:    call void @use(i8* nonnull [[ALLOCA_0_HWASAN]])
 ; X86-SCOPE-NEXT:    ret i32 0
 ;
 ; X86-NOSCOPE-LABEL: @standard_lifetime(
 ; X86-NOSCOPE-NEXT:    [[DOTHWASAN_SHADOW:%.*]] = call i8* asm "", "=r,0"(i8* null)
 ; X86-NOSCOPE-NEXT:    [[TMP1:%.*]] = alloca { i8, [15 x i8] }, align 16

 ; AARCH64-SCOPE-NEXT:    [[TMP21:%.*]] = call i8 @__hwasan_generate_tag()
 ; AARCH64-SCOPE-NEXT:    [[TMP22:%.*]] = zext i8 [[TMP21]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP23:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP24:%.*]] = shl i64 [[TMP22]], 56
 ; AARCH64-SCOPE-NEXT:    [[TMP25:%.*]] = or i64 [[TMP23]], [[TMP24]]
 ; AARCH64-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP25]] to i8*
 ; AARCH64-SCOPE-NEXT:    br label [[TMP26:%.*]]
 ; AARCH64-SCOPE:       26:
-; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SCOPE-NEXT:    [[TMP27:%.*]] = trunc i64 [[TMP22]] to i8
 ; AARCH64-SCOPE-NEXT:    [[TMP28:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP29:%.*]] = lshr i64 [[TMP28]], 4
 ; AARCH64-SCOPE-NEXT:    [[TMP30:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP29]]
 ; AARCH64-SCOPE-NEXT:    call void @llvm.memset.p0i8.i64(i8* align 1 [[TMP30]], i8 [[TMP27]], i64 1, i1 false)
 ; AARCH64-SCOPE-NEXT:    [[TMP31:%.*]] = tail call i1 (...) @cond()
 ; AARCH64-SCOPE-NEXT:    [[TMP32:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP33:%.*]] = lshr i64 [[TMP32]], 4
 ; AARCH64-SCOPE-NEXT:    [[TMP34:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP33]]
 ; AARCH64-SCOPE-NEXT:    call void @llvm.memset.p0i8.i64(i8* align 1 [[TMP34]], i8 0, i64 1, i1 false)
-; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SCOPE-NEXT:    br i1 [[TMP31]], label [[TMP35:%.*]], label [[TMP26]]
 ; AARCH64-SCOPE:       35:
 ; AARCH64-SCOPE-NEXT:    call void @use(i8* nonnull [[ALLOCA_0_HWASAN]])
 ; AARCH64-SCOPE-NEXT:    ret i32 0
 ;
 ; AARCH64-NOSCOPE-LABEL: @standard_lifetime(
 ; AARCH64-NOSCOPE-NEXT:    [[TMP1:%.*]] = call i8* @llvm.thread.pointer()
 ; AARCH64-NOSCOPE-NEXT:    [[TMP2:%.*]] = getelementptr i8, i8* [[TMP1]], i32 48

 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP21:%.*]] = call i8 @__hwasan_generate_tag()
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP22:%.*]] = zext i8 [[TMP21]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP23:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP24:%.*]] = shl i64 [[TMP22]], 56
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP25:%.*]] = or i64 [[TMP23]], [[TMP24]]
 ; AARCH64-SHORT-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP25]] to i8*
 ; AARCH64-SHORT-SCOPE-NEXT:    br label [[TMP26:%.*]]
 ; AARCH64-SHORT-SCOPE:       26:
-; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP27:%.*]] = trunc i64 [[TMP22]] to i8
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP28:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP29:%.*]] = lshr i64 [[TMP28]], 4
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP30:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP29]]
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP31:%.*]] = getelementptr i8, i8* [[TMP30]], i32 0
 ; AARCH64-SHORT-SCOPE-NEXT:    store i8 1, i8* [[TMP31]], align 1
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP32:%.*]] = getelementptr i8, i8* [[TMP20]], i32 15
 ; AARCH64-SHORT-SCOPE-NEXT:    store i8 [[TMP27]], i8* [[TMP32]], align 1
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP33:%.*]] = tail call i1 (...) @cond()
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP34:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP35:%.*]] = lshr i64 [[TMP34]], 4
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP36:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP35]]
 ; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.memset.p0i8.i64(i8* align 1 [[TMP36]], i8 0, i64 1, i1 false)
-; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SHORT-SCOPE-NEXT:    br i1 [[TMP33]], label [[TMP37:%.*]], label [[TMP26]]
 ; AARCH64-SHORT-SCOPE:       37:
 ; AARCH64-SHORT-SCOPE-NEXT:    call void @use(i8* nonnull [[ALLOCA_0_HWASAN]])
 ; AARCH64-SHORT-SCOPE-NEXT:    ret i32 0
 ;
 ; AARCH64-SHORT-NOSCOPE-LABEL: @standard_lifetime(
 ; AARCH64-SHORT-NOSCOPE-NEXT:    [[TMP1:%.*]] = call i8* @llvm.thread.pointer()
 ; AARCH64-SHORT-NOSCOPE-NEXT:    [[TMP2:%.*]] = getelementptr i8, i8* [[TMP1]], i32 48

 ; X86-SCOPE-NEXT:    [[TMP3:%.*]] = call i8 @__hwasan_generate_tag()
 ; X86-SCOPE-NEXT:    [[TMP4:%.*]] = zext i8 [[TMP3]] to i64
 ; X86-SCOPE-NEXT:    [[TMP5:%.*]] = ptrtoint i8* [[TMP2]] to i64
 ; X86-SCOPE-NEXT:    [[TMP6:%.*]] = shl i64 [[TMP4]], 57
 ; X86-SCOPE-NEXT:    [[TMP7:%.*]] = or i64 [[TMP5]], [[TMP6]]
 ; X86-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP7]] to i8*
 ; X86-SCOPE-NEXT:    br label [[TMP8:%.*]]
 ; X86-SCOPE:       8:
-; X86-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; X86-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP2]])
 ; X86-SCOPE-NEXT:    [[TMP9:%.*]] = trunc i64 [[TMP4]] to i8
 ; X86-SCOPE-NEXT:    call void @__hwasan_tag_memory(i8* [[TMP2]], i8 [[TMP9]], i64 16)
 ; X86-SCOPE-NEXT:    [[TMP10:%.*]] = tail call i1 (...) @cond()
 ; X86-SCOPE-NEXT:    call void @__hwasan_tag_memory(i8* [[TMP2]], i8 0, i64 16)
-; X86-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; X86-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 16, i8* nonnull [[TMP2]])
 ; X86-SCOPE-NEXT:    br i1 [[TMP10]], label [[TMP11:%.*]], label [[TMP8]]
 ; X86-SCOPE:       11:
 ; X86-SCOPE-NEXT:    call void @use(i8* nonnull [[ALLOCA_0_HWASAN]])
 ; X86-SCOPE-NEXT:    ret i32 0
 ;
 ; X86-NOSCOPE-LABEL: @standard_lifetime_optnone(
 ; X86-NOSCOPE-NEXT:    [[DOTHWASAN_SHADOW:%.*]] = call i8* asm "", "=r,0"(i8* null)
 ; X86-NOSCOPE-NEXT:    [[TMP1:%.*]] = alloca { i8, [15 x i8] }, align 16

 ; AARCH64-SCOPE-NEXT:    [[TMP21:%.*]] = call i8 @__hwasan_generate_tag()
 ; AARCH64-SCOPE-NEXT:    [[TMP22:%.*]] = zext i8 [[TMP21]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP23:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP24:%.*]] = shl i64 [[TMP22]], 56
 ; AARCH64-SCOPE-NEXT:    [[TMP25:%.*]] = or i64 [[TMP23]], [[TMP24]]
 ; AARCH64-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP25]] to i8*
 ; AARCH64-SCOPE-NEXT:    br label [[TMP26:%.*]]
 ; AARCH64-SCOPE:       26:
-; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SCOPE-NEXT:    [[TMP27:%.*]] = trunc i64 [[TMP22]] to i8
 ; AARCH64-SCOPE-NEXT:    [[TMP28:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP29:%.*]] = lshr i64 [[TMP28]], 4
 ; AARCH64-SCOPE-NEXT:    [[TMP30:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP29]]
 ; AARCH64-SCOPE-NEXT:    call void @llvm.memset.p0i8.i64(i8* align 1 [[TMP30]], i8 [[TMP27]], i64 1, i1 false)
 ; AARCH64-SCOPE-NEXT:    [[TMP31:%.*]] = tail call i1 (...) @cond()
 ; AARCH64-SCOPE-NEXT:    [[TMP32:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP33:%.*]] = lshr i64 [[TMP32]], 4
 ; AARCH64-SCOPE-NEXT:    [[TMP34:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP33]]
 ; AARCH64-SCOPE-NEXT:    call void @llvm.memset.p0i8.i64(i8* align 1 [[TMP34]], i8 0, i64 1, i1 false)
-; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SCOPE-NEXT:    br i1 [[TMP31]], label [[TMP35:%.*]], label [[TMP26]]
 ; AARCH64-SCOPE:       35:
 ; AARCH64-SCOPE-NEXT:    call void @use(i8* nonnull [[ALLOCA_0_HWASAN]])
 ; AARCH64-SCOPE-NEXT:    ret i32 0
 ;
 ; AARCH64-NOSCOPE-LABEL: @standard_lifetime_optnone(
 ; AARCH64-NOSCOPE-NEXT:    [[TMP1:%.*]] = call i8* @llvm.thread.pointer()
 ; AARCH64-NOSCOPE-NEXT:    [[TMP2:%.*]] = getelementptr i8, i8* [[TMP1]], i32 48

 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP21:%.*]] = call i8 @__hwasan_generate_tag()
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP22:%.*]] = zext i8 [[TMP21]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP23:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP24:%.*]] = shl i64 [[TMP22]], 56
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP25:%.*]] = or i64 [[TMP23]], [[TMP24]]
 ; AARCH64-SHORT-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP25]] to i8*
 ; AARCH64-SHORT-SCOPE-NEXT:    br label [[TMP26:%.*]]
 ; AARCH64-SHORT-SCOPE:       26:
-; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP27:%.*]] = trunc i64 [[TMP22]] to i8
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP28:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP29:%.*]] = lshr i64 [[TMP28]], 4
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP30:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP29]]
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP31:%.*]] = getelementptr i8, i8* [[TMP30]], i32 0
 ; AARCH64-SHORT-SCOPE-NEXT:    store i8 1, i8* [[TMP31]], align 1
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP32:%.*]] = getelementptr i8, i8* [[TMP20]], i32 15
 ; AARCH64-SHORT-SCOPE-NEXT:    store i8 [[TMP27]], i8* [[TMP32]], align 1
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP33:%.*]] = tail call i1 (...) @cond()
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP34:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP35:%.*]] = lshr i64 [[TMP34]], 4
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP36:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP35]]
 ; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.memset.p0i8.i64(i8* align 1 [[TMP36]], i8 0, i64 1, i1 false)
-; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.end.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SHORT-SCOPE-NEXT:    br i1 [[TMP33]], label [[TMP37:%.*]], label [[TMP26]]
 ; AARCH64-SHORT-SCOPE:       37:
 ; AARCH64-SHORT-SCOPE-NEXT:    call void @use(i8* nonnull [[ALLOCA_0_HWASAN]])
 ; AARCH64-SHORT-SCOPE-NEXT:    ret i32 0
 ;
 ; AARCH64-SHORT-NOSCOPE-LABEL: @standard_lifetime_optnone(
 ; AARCH64-SHORT-NOSCOPE-NEXT:    [[TMP1:%.*]] = call i8* @llvm.thread.pointer()
 ; AARCH64-SHORT-NOSCOPE-NEXT:    [[TMP2:%.*]] = getelementptr i8, i8* [[TMP1]], i32 48

 ; X86-SCOPE-NEXT:    [[TMP1:%.*]] = alloca { i8, [15 x i8] }, align 16
 ; X86-SCOPE-NEXT:    [[TMP2:%.*]] = bitcast { i8, [15 x i8] }* [[TMP1]] to i8*
 ; X86-SCOPE-NEXT:    [[TMP3:%.*]] = call i8 @__hwasan_generate_tag()
 ; X86-SCOPE-NEXT:    [[TMP4:%.*]] = zext i8 [[TMP3]] to i64
 ; X86-SCOPE-NEXT:    [[TMP5:%.*]] = ptrtoint i8* [[TMP2]] to i64
 ; X86-SCOPE-NEXT:    [[TMP6:%.*]] = shl i64 [[TMP4]], 57
 ; X86-SCOPE-NEXT:    [[TMP7:%.*]] = or i64 [[TMP5]], [[TMP6]]
 ; X86-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP7]] to i8*
-; X86-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; X86-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP2]])
 ; X86-SCOPE-NEXT:    [[TMP8:%.*]] = trunc i64 [[TMP4]] to i8
 ; X86-SCOPE-NEXT:    call void @__hwasan_tag_memory(i8* [[TMP2]], i8 [[TMP8]], i64 16)
 ; X86-SCOPE-NEXT:    [[TMP9:%.*]] = tail call i1 (...) @cond()
 ; X86-SCOPE-NEXT:    br i1 [[TMP9]], label [[TMP10:%.*]], label [[TMP11:%.*]]
 ; X86-SCOPE:       10:
 ; X86-SCOPE-NEXT:    call void @use(i8* nonnull [[ALLOCA_0_HWASAN]])
 ; X86-SCOPE-NEXT:    call void @__hwasan_tag_memory(i8* [[TMP2]], i8 0, i64 16)
 ; X86-SCOPE-NEXT:    ret i32 0

 ; AARCH64-SCOPE-NEXT:    [[TMP19:%.*]] = alloca { i8, [15 x i8] }, align 16
 ; AARCH64-SCOPE-NEXT:    [[TMP20:%.*]] = bitcast { i8, [15 x i8] }* [[TMP19]] to i8*
 ; AARCH64-SCOPE-NEXT:    [[TMP21:%.*]] = call i8 @__hwasan_generate_tag()
 ; AARCH64-SCOPE-NEXT:    [[TMP22:%.*]] = zext i8 [[TMP21]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP23:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP24:%.*]] = shl i64 [[TMP22]], 56
 ; AARCH64-SCOPE-NEXT:    [[TMP25:%.*]] = or i64 [[TMP23]], [[TMP24]]
 ; AARCH64-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP25]] to i8*
-; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SCOPE-NEXT:    [[TMP26:%.*]] = trunc i64 [[TMP22]] to i8
 ; AARCH64-SCOPE-NEXT:    [[TMP27:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SCOPE-NEXT:    [[TMP28:%.*]] = lshr i64 [[TMP27]], 4
 ; AARCH64-SCOPE-NEXT:    [[TMP29:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP28]]
 ; AARCH64-SCOPE-NEXT:    call void @llvm.memset.p0i8.i64(i8* align 1 [[TMP29]], i8 [[TMP26]], i64 1, i1 false)
 ; AARCH64-SCOPE-NEXT:    [[TMP30:%.*]] = tail call i1 (...) @cond()
 ; AARCH64-SCOPE-NEXT:    br i1 [[TMP30]], label [[TMP31:%.*]], label [[TMP35:%.*]]
 ; AARCH64-SCOPE:       31:

 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP19:%.*]] = alloca { i8, [15 x i8] }, align 16
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP20:%.*]] = bitcast { i8, [15 x i8] }* [[TMP19]] to i8*
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP21:%.*]] = call i8 @__hwasan_generate_tag()
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP22:%.*]] = zext i8 [[TMP21]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP23:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP24:%.*]] = shl i64 [[TMP22]], 56
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP25:%.*]] = or i64 [[TMP23]], [[TMP24]]
 ; AARCH64-SHORT-SCOPE-NEXT:    [[ALLOCA_0_HWASAN:%.*]] = inttoptr i64 [[TMP25]] to i8*
-; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull [[ALLOCA_0_HWASAN]])
+; AARCH64-SHORT-SCOPE-NEXT:    call void @llvm.lifetime.start.p0i8(i64 16, i8* nonnull [[TMP20]])
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP26:%.*]] = trunc i64 [[TMP22]] to i8
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP27:%.*]] = ptrtoint i8* [[TMP20]] to i64
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP28:%.*]] = lshr i64 [[TMP27]], 4
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP29:%.*]] = getelementptr i8, i8* [[TMP18]], i64 [[TMP28]]
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP30:%.*]] = getelementptr i8, i8* [[TMP29]], i32 0
 ; AARCH64-SHORT-SCOPE-NEXT:    store i8 1, i8* [[TMP30]], align 1
 ; AARCH64-SHORT-SCOPE-NEXT:    [[TMP31:%.*]] = getelementptr i8, i8* [[TMP20]], i32 15
 ; AARCH64-SHORT-SCOPE-NEXT:    store i8 [[TMP26]], i8* [[TMP31]], align 1