Index: clang/lib/Driver/ToolChains/Clang.cpp
===================================================================
--- clang/lib/Driver/ToolChains/Clang.cpp
+++ clang/lib/Driver/ToolChains/Clang.cpp
@@ -2737,6 +2737,12 @@
   if (C.getDriver().embedBitcodeEnabled() ||
       C.getDriver().embedBitcodeMarkerOnly())
     Args.AddLastArg(CmdArgs, options::OPT_fembed_bitcode_EQ);
+
+  if (const char *AsSecureLogFile = getenv("AS_SECURE_LOG_FILE")) {
+    CmdArgs.push_back("-mllvm");
+    CmdArgs.push_back(Args.MakeArgString(Twine("-as-secure-log-file-name=") +
+                                         AsSecureLogFile));
+  }
 }
 
 static void RenderFloatingPointOptions(const ToolChain &TC, const Driver &D,
Index: clang/test/Driver/AS_SECURE_LOG_FILE.s
===================================================================
--- /dev/null
+++ clang/test/Driver/AS_SECURE_LOG_FILE.s
@@ -0,0 +1,3 @@
+// RUN: env AS_SECURE_LOG_FILE=%t %clang -target x86_64-apple-darwin -c %s -o %t.o -### 2>&1 | FileCheck %s -DLOG_FILE=%t
+// CHECK: "-cc1as"
+// CHECK-SAME: "-mllvm" "-as-secure-log-file-name=[[LOG_FILE]]"
Index: llvm/include/llvm/MC/MCContext.h
===================================================================
--- llvm/include/llvm/MC/MCContext.h
+++ llvm/include/llvm/MC/MCContext.h
@@ -178,7 +178,7 @@
   /// The file name of the log file from the environment variable
   /// AS_SECURE_LOG_FILE.  Which must be set before the .secure_log_unique
   /// directive is used or it is an error.
-  char *SecureLogFile;
+  std::string SecureLogFile;
   /// The stream that gets written to for the .secure_log_unique directive.
   std::unique_ptr<raw_fd_ostream> SecureLog;
   /// Boolean toggled when .secure_log_unique / .secure_log_reset is seen to
@@ -828,7 +828,7 @@
 
   /// @}
 
-  char *getSecureLogFile() { return SecureLogFile; }
+  StringRef getSecureLogFile() { return SecureLogFile; }
   raw_fd_ostream *getSecureLog() { return SecureLog.get(); }
 
   void setSecureLog(std::unique_ptr<raw_fd_ostream> Value) {
Index: llvm/lib/MC/MCContext.cpp
===================================================================
--- llvm/lib/MC/MCContext.cpp
+++ llvm/lib/MC/MCContext.cpp
@@ -59,11 +59,10 @@
 
 using namespace llvm;
 
-static cl::opt<char*>
+static cl::opt<std::string>
 AsSecureLogFileName("as-secure-log-file-name",
         cl::desc("As secure log file name (initialized from "
-                 "AS_SECURE_LOG_FILE env variable)"),
-        cl::init(getenv("AS_SECURE_LOG_FILE")), cl::Hidden);
+                 "AS_SECURE_LOG_FILE env variable)"), cl::Hidden);
 
 static void defaultDiagHandler(const SMDiagnostic &SMD, bool, const SourceMgr &,
                                std::vector<const MDNode *> &) {
Index: llvm/lib/MC/MCParser/DarwinAsmParser.cpp
===================================================================
--- llvm/lib/MC/MCParser/DarwinAsmParser.cpp
+++ llvm/lib/MC/MCParser/DarwinAsmParser.cpp
@@ -767,8 +767,8 @@
     return Error(IDLoc, ".secure_log_unique specified multiple times");
 
   // Get the secure log path.
-  const char *SecureLogFile = getContext().getSecureLogFile();
-  if (!SecureLogFile)
+  StringRef SecureLogFile = getContext().getSecureLogFile();
+  if (SecureLogFile.empty())
     return Error(IDLoc, ".secure_log_unique used but AS_SECURE_LOG_FILE "
                  "environment variable unset.");
 
@@ -776,7 +776,7 @@
   raw_fd_ostream *OS = getContext().getSecureLog();
   if (!OS) {
     std::error_code EC;
-    auto NewOS = std::make_unique<raw_fd_ostream>(StringRef(SecureLogFile), EC,
+    auto NewOS = std::make_unique<raw_fd_ostream>(SecureLogFile, EC,
                                                   sys::fs::OF_Append |
                                                       sys::fs::OF_TextWithCRLF);
     if (EC)
Index: llvm/test/MC/AsmParser/secure_log_unique.s
===================================================================
--- llvm/test/MC/AsmParser/secure_log_unique.s
+++ llvm/test/MC/AsmParser/secure_log_unique.s
@@ -1,6 +1,6 @@
 // RUN: rm -f %t
-// RUN: env AS_SECURE_LOG_FILE=%t llvm-mc -triple x86_64-apple-darwin %s
-// RUN: env AS_SECURE_LOG_FILE=%t llvm-mc -triple x86_64-apple-darwin %s
+// RUN: llvm-mc -as-secure-log-file-name=%t -triple x86_64-apple-darwin %s
+// RUN: llvm-mc -as-secure-log-file-name=%t -triple x86_64-apple-darwin %s
 // RUN: FileCheck --input-file=%t %s
 .secure_log_unique "foobar"