Index: lib/Analysis/ValueTracking.cpp
===================================================================
--- lib/Analysis/ValueTracking.cpp
+++ lib/Analysis/ValueTracking.cpp
@@ -696,7 +696,7 @@
       // the context isn't enough because both the true and false cases could
       // merge before the context instruction we're actually interested in.
       // Instead, we need to ensure that the taken *edge* dominates the context
-      // instruction. 
+      // instruction.
       BasicBlock *BB0 = BI->getSuccessor(0);
       BasicBlockEdge Edge(BI->getParent(), BB0);
       if (!Edge.isSingleEdge() || !Q.DT->dominates(Edge, Q.CxtI->getParent()))
@@ -1793,7 +1793,7 @@
   // Check for pointer simplifications.
   if (V->getType()->isPointerTy()) {
     if (isKnownNonNull(V))
-      return true; 
+      return true;
     if (GEPOperator *GEP = dyn_cast<GEPOperator>(V))
       if (isGEPKnownNonNull(GEP, DL, Depth, Q))
         return true;
@@ -2380,7 +2380,7 @@
   default: break;
   case Instruction::FMul:
     // x*x is always non-negative or a NaN.
-    if (I->getOperand(0) == I->getOperand(1)) 
+    if (I->getOperand(0) == I->getOperand(1))
       return true;
     // Fall through
   case Instruction::FAdd:
@@ -2392,8 +2392,8 @@
   case Instruction::FPTrunc:
     // Widening/narrowing never change sign.
     return CannotBeOrderedLessThanZero(I->getOperand(0), Depth+1);
-  case Instruction::Call: 
-    if (const IntrinsicInst *II = dyn_cast<IntrinsicInst>(I)) 
+  case Instruction::Call:
+    if (const IntrinsicInst *II = dyn_cast<IntrinsicInst>(I))
       switch (II->getIntrinsicID()) {
       default: break;
       case Intrinsic::exp:
@@ -2401,7 +2401,7 @@
       case Intrinsic::fabs:
       case Intrinsic::sqrt:
         return true;
-      case Intrinsic::powi: 
+      case Intrinsic::powi:
         if (ConstantInt *CI = dyn_cast<ConstantInt>(I->getOperand(1))) {
           // powi(x,n) is non-negative if n is even.
           if (CI->getBitWidth() <= 64 && CI->getSExtValue() % 2u == 0)
@@ -2411,12 +2411,12 @@
       case Intrinsic::fma:
       case Intrinsic::fmuladd:
         // x*x+y is non-negative if y is non-negative.
-        return I->getOperand(0) == I->getOperand(1) && 
+        return I->getOperand(0) == I->getOperand(1) &&
                CannotBeOrderedLessThanZero(I->getOperand(2), Depth+1);
       }
     break;
   }
-  return false; 
+  return false;
 }
 
 /// If the specified value can be set by repeating the same byte in memory,
@@ -2945,7 +2945,7 @@
                                            const TargetLibraryInfo *TLI) {
   assert(Offset.isNonNegative() && "offset can't be negative");
   assert(Ty->isSized() && "must be sized");
-  
+
   APInt DerefBytes(Offset.getBitWidth(), 0);
   bool CheckForNonNull = false;
   if (const Argument *A = dyn_cast<Argument>(BV)) {
@@ -2966,7 +2966,7 @@
       DerefBytes = CI->getLimitedValue();
     }
     if (!DerefBytes.getBoolValue()) {
-      if (MDNode *MD = 
+      if (MDNode *MD =
               LI->getMetadata(LLVMContext::MD_dereferenceable_or_null)) {
         ConstantInt *CI = mdconst::extract<ConstantInt>(MD->getOperand(0));
         DerefBytes = CI->getLimitedValue();
@@ -2974,7 +2974,7 @@
       CheckForNonNull = true;
     }
   }
-  
+
   if (DerefBytes.getBoolValue())
     if (DerefBytes.uge(Offset + DL.getTypeStoreSize(Ty)))
       if (!CheckForNonNull || isKnownNonNullAt(BV, CtxI, DT, TLI))
@@ -2991,7 +2991,7 @@
   Type *Ty = VTy->getPointerElementType();
   if (!Ty->isSized())
     return false;
-  
+
   APInt Offset(DL.getTypeStoreSizeInBits(VTy), 0);
   return isDereferenceableFromAttribute(V, Offset, Ty, DL, CtxI, DT, TLI);
 }
@@ -3082,7 +3082,7 @@
     uint64_t LoadSize = DL.getTypeStoreSize(Ty);
     Type *BaseType = Base->getType()->getPointerElementType();
     assert(isPowerOf2_32(Align) && "must be a power of 2!");
-    return (Offset + LoadSize).ule(DL.getTypeAllocSize(BaseType)) && 
+    return (Offset + LoadSize).ule(DL.getTypeAllocSize(BaseType)) &&
            !(Offset & APInt(Offset.getBitWidth(), Align-1));
   }
 
@@ -3187,7 +3187,11 @@
     const LoadInst *LI = cast<LoadInst>(Inst);
     if (!LI->isUnordered() ||
         // Speculative load may create a race that did not exist in the source.
-        LI->getParent()->getParent()->hasFnAttribute(Attribute::SanitizeThread))
+        LI->getParent()->getParent()->hasFnAttribute(Attribute::SanitizeThread)
+        ||
+        // Speculative load may load data from dirty regions.
+        LI->getParent()->getParent()->hasFnAttribute(Attribute::SanitizeAddress)
+        )
       return false;
     const DataLayout &DL = LI->getModule()->getDataLayout();
     return isDereferenceableAndAlignedPointer(
@@ -3283,7 +3287,7 @@
     return !GV->hasExternalWeakLinkage() &&
            GV->getType()->getAddressSpace() == 0;
 
-  // A Load tagged w/nonnull metadata is never null. 
+  // A Load tagged w/nonnull metadata is never null.
   if (const LoadInst *LI = dyn_cast<LoadInst>(V))
     return LI->getMetadata(LLVMContext::MD_nonnull);
 
@@ -3321,7 +3325,7 @@
       const BranchInst *BI = dyn_cast<BranchInst>(CmpU);
       if (!BI)
         continue;
-      
+
       assert(BI->isConditional() && "uses a comparison!");
 
       BasicBlock *NonNullSuccessor = nullptr;
@@ -3785,7 +3789,7 @@
         return {(CmpLHS == FalseVal) ? SPF_ABS : SPF_NABS, SPNB_NA, false};
       }
     }
-    
+
     // Y >s C ? ~Y : ~C == ~Y <s ~C ? ~Y : ~C = SMIN(~Y, ~C)
     if (const auto *C2 = dyn_cast<ConstantInt>(FalseVal)) {
       if (C1->getType() == C2->getType() && ~C1->getValue() == C2->getValue() &&