[AAUnderlyingObjects] Introduce an AA for getting underlying objects of a pointer

[tianshilei1992]

Summary

This patch introduces a new AA AAUnderlyingObjects. It is basically like a wrapper
AA of the function AA::getAssumedUnderlyingObjects, but it can recursively do
query if the underlying object is an indirect access, such as a phi node or a select
instruction.

[jdoerfert]

llvm/include/llvm/Transforms/IPO/Attributor.h

5457

You miss a public interface here, right?

llvm/lib/Transforms/IPO/AttributorAttributes.cpp

11215

If you don't use it elsewhere, just put it in the AA...Impl class below.

11297

PHI and select, not load, at least not yet. Though we could do the PHI + select logic also for loads.

11506

You want to allow function positions, the result is just the function.

[jdoerfert]

llvm/lib/Transforms/IPO/AttributorAttributes.cpp

11290

Inline and remove getAssumedUnderlyingObjects, replaces users with this AA.

[tianshilei1992]

rebase and fix comments

[tianshilei1992]

llvm/include/llvm/Transforms/IPO/Attributor.h

5457

Which one?

[tianshilei1992]

improve code

[jdoerfert]

llvm/include/llvm/Transforms/IPO/Attributor.h

5463

What happend to the other arguments: Scope and CtxI. The former at least, the latter can be useful but makes caching less effective.

[jdoerfert]

The failing test are probably because of the scope (Intra vs Inter). Other comments inlined as well.

llvm/lib/Transforms/IPO/Attributor.cpp

342–343

We should make it easier for users and check the state in the foreach function. Move the debug output to the call below though.

343

352–353

Adjust the rest accordingly. No need for two variables pointing to one thing.

llvm/lib/Transforms/IPO/AttributorAttributes.cpp

8217

11232

I think we should let the user pass this and update for the values the user asked, so potentially twice (intra and inter). We can add smarts to avoid one of them sometimes but I wouldn't for now.

11247

We should put it in Values, this can be recursive.

11252

No need to give up. Just use UO. Since this can only happen if the AA couldn't determine all underlying objects, we could probably also add an assertion instead. If the AA is not able to provide information it should just return the queried value.

11275

We can just call Pred on the associatedValue. It's always correct and conservative.

11289

11298

With the proposed changes above, this can be an assertion as it should always work.

[tianshilei1992]

rebase and fix part of comments

[tianshilei1992]

fix more style

[tianshilei1992]

continue fixing comments

[jdoerfert]

llvm/lib/Transforms/IPO/AttributorAttributes.cpp

11259–11264

Can't we merge this and remove Objects all together?

11289

Scope can be Any. Use Intra for Intra and Inter otherwise. Maybe track what was requested so you don't eagerly compute both?

11317

No need for the local objects, assert the forall call won't fail, it can't.

[tianshilei1992]

llvm/lib/Transforms/IPO/AttributorAttributes.cpp

11289

forallUnderlyingObjects will be called after the execution of AA. We don't know the scope when we create the AA. Maybe we want to have something like the following?

template <AA::ValueScope Scope>
struct AAUnderlyingObjects {
  // ...
};

using AAIntraUnderlyingObjects = AAUnderlyingObjects<AA::Intraprocedural>;
using AAInterUnderlyingObjects = AAUnderlyingObjects<AA::Interprocedural>;
using AAAnyUnderlyingObjects = AAUnderlyingObjects<AA::Any>;

[jdoerfert]

Run test update script please so we can verify nothing broke.

llvm/lib/Transforms/IPO/AttributorAttributes.cpp

11289

Leave it as is for now. Technically you can make it a queryAA and allow users to ask for something and we basically only update after they queried. For now this is fine.

[tianshilei1992]

rebase, fix comments, and fix tests. there will still be one or two test failing.

[tianshilei1992]

llvm/test/Transforms/Attributor/value-simplify-pointer-info.ll

2100

I might want to update the test case first w/o my changes.

[tianshilei1992]

llvm/test/Transforms/Attributor/value-simplify-pointer-info.ll

2100

It looks like the merge of two check lines is indeed introduced in this patch.

[tianshilei1992]

rebase and fix tests

[jdoerfert]

LG

llvm/test/Transforms/Attributor/value-simplify-pointer-info.ll

2100–2118

We know realize it's readnone, that's a good thing.

[tianshilei1992]

fix one leftover

[cmtice]

Just a heads up: This is causing some of our clang tests to fail when run under asan/ubasn. E.g. for llvm/test/Transforms:Attributor/nosync.ll.test, we get

exit status 2
third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1158:26: runtime error: load of value 112, which is not a valid value for type 'bool'

#0 0x560ddce60c4b in llvm::Attributor::getAssumedSimplifiedValues(llvm::IRPosition const&, llvm::AbstractAttribute const*, llvm::SmallVectorImpl<llvm::AA::ValueAndContext>&, llvm::AA::ValueScope, bool&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1158:26
#1 0x560ddcf1fda2 in (anonymous namespace)::AAUnderlyingObjectsImpl::updateImpl(llvm::Attributor&)::'lambda'(llvm::SmallSetVector<llvm::Value*, 8u>&, llvm::AA::ValueScope)::operator()(llvm::SmallSetVector<llvm::Value*, 8u>&, llvm::AA::ValueScope) const third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:11235:14
#2 0x560ddcf1f4f1 in (anonymous namespace)::AAUnderlyingObjectsImpl::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:11272:16
#3 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#4 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#5 0x560ddce939de in llvm::AAUnderlyingObjects const& llvm::Attributor::getOrCreateAAFor<llvm::AAUnderlyingObjects>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#6 0x560ddce5a418 in getAAFor<llvm::AAUnderlyingObjects> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1462:12
#7 0x560ddce5a418 in getPotentialCopiesOfMemoryValue<true, llvm::LoadInst> third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:488:24
#8 0x560ddce5a418 in llvm::AA::getPotentiallyLoadedValues(llvm::Attributor&, llvm::LoadInst&, llvm::SmallSetVector<llvm::Value*, 4u>&, llvm::SmallSetVector<llvm::Instruction*, 4u>&, llvm::AbstractAttribute const&, bool&, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:515:10
#9 0x560ddcef9967 in handleLoadInst third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10572:10
#10 0x560ddcef9967 in simplifyInstruction third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10739:14
#11 0x560ddcef9967 in genericValueTraversal third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10796:13
#12 0x560ddcef9967 in (anonymous namespace)::AAPotentialValuesFloating::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10450:5
#13 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#14 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#15 0x560ddce82d0e in llvm::AAPotentialValues const& llvm::Attributor::getOrCreateAAFor<llvm::AAPotentialValues>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#16 0x560ddce60a77 in llvm::Attributor::getAssumedSimplifiedValues(llvm::IRPosition const&, llvm::AbstractAttribute const*, llvm::SmallVectorImpl<llvm::AA::ValueAndContext>&, llvm::AA::ValueScope, bool&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1155:7
#17 0x560ddcebe5bb in operator() third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:2129:12
#18 0x560ddcebe5bb in bool llvm::function_ref<bool (llvm::Instruction&)>::callback_fn<(anonymous namespace)::AAReturnedValuesImpl::updateImpl(llvm::Attributor&)::$_0>(long, llvm::Instruction&) third_party/llvm/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:45:12
#19 0x560ddce66cb5 in operator() third_party/llvm/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:68:12
#20 0x560ddce66cb5 in checkForAllInstructionsImpl(llvm::Attributor*, llvm::DenseMap<unsigned int, llvm::SmallVector<llvm::Instruction*, 8u>*, llvm::DenseMapInfo<unsigned int, void>, llvm::detail::DenseMapPair<unsigned int, llvm::SmallVector<llvm::Instruction*, 8u>*>>&, llvm::function_ref<bool (llvm::Instruction&)>, llvm::AbstractAttribute const*, llvm::AAIsDead const*, llvm::ArrayRef<unsigned int> const&, bool&, bool, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1653:12
#21 0x560ddce66f5a in checkForAllInstructions third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1679:8
#22 0x560ddce66f5a in llvm::Attributor::checkForAllInstructions(llvm::function_ref<bool (llvm::Instruction&)>, llvm::AbstractAttribute const&, llvm::ArrayRef<unsigned int> const&, bool&, bool, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1695:10
#23 0x560ddcebd7a3 in (anonymous namespace)::AAReturnedValuesImpl::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:2145:10
#24 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#25 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#26 0x560ddce95f2e in llvm::AAReturnedValues const& llvm::Attributor::getOrCreateAAFor<llvm::AAReturnedValues>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#27 0x560ddce6683d in getAAFor<llvm::AAReturnedValues> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1462:12
#28 0x560ddce6683d in llvm::Attributor::checkForAllReturnedValues(llvm::function_ref<bool (llvm::Value&)>, llvm::AbstractAttribute const&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1620:7
#29 0x560ddcf05211 in clampReturnedValueStates<llvm::AANoUndef, llvm::BooleanState> third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:396:10
#30 0x560ddcf05211 in (anonymous namespace)::AAReturnedFromReturnedValues<llvm::AANoUndef, (anonymous namespace)::AANoUndefImpl, llvm::BooleanState, false>::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:414:5
#31 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#32 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#33 0x560ddcea2ede in llvm::AANoUndef const& llvm::Attributor::getOrCreateAAFor<llvm::AANoUndef>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#34 0x560ddcf2a82c in getAAFor<llvm::AANoUndef> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1462:12
#35 0x560ddcf2a82c in (anonymous namespace)::AAUndefinedBehaviorImpl::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:3007:15
#36 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#37 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#38 0x560ddce9d2fe in llvm::AAUndefinedBehavior const& llvm::Attributor::getOrCreateAAFor<llvm::AAUndefinedBehavior>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#39 0x560ddce75da4 in getOrCreateAAFor<llvm::AAUndefinedBehavior> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1574:12
#40 0x560ddce75da4 in llvm::Attributor::identifyDefaultAbstractAttributes(llvm::Function&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2935:3
#41 0x560ddce79dbb in runAttributorOnFunctions(llvm::InformationCache&, llvm::SetVector<llvm::Function*, std::__u::vector<llvm::Function*, std::__u::allocator<llvm::Function*>>, llvm::DenseSet<llvm::Function*, llvm::DenseMapInfo<llvm::Function*, void>>>&, llvm::AnalysisGetter&, llvm::CallGraphUpdater&, bool, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:3372:7
#42 0x560ddce792c9 in llvm::AttributorPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:3423:7
#43 0x560ddbd0a6d1 in llvm::detail::PassModel<llvm::Module, llvm::AttributorPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) third_party/llvm/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:17
#44 0x560dded5a873 in llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) third_party/llvm/llvm-project/llvm/include/llvm/IR/PassManager.h:517:40
#45 0x560dd9e41b4d in llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) third_party/llvm/llvm-project/llvm/tools/opt/NewPMDriver.cpp:512:7
#46 0x560dd9e5c422 in main third_party/llvm/llvm-project/llvm/tools/opt/opt.cpp:726:12
#47 0x7f116010d632 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x61632) (BuildId: 280088eab084c30a3992a9bce5c35b44)
#48 0x560dd9d69869 in _start /build/work/ab393f4ac612f9027aae6b1a7226027ba2a2/google3/blaze-out/k8-opt/bin/third_party/grte/v5_src/grte-scratch/BUILD/src/csu/../sysdeps/x86_64/start.S:120

SUMMARY: UndefinedBehaviorSanitizer: invalid-bool-load third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1158:26 in
FileCheck error: '<stdin>' is empty.

I will see if I can get you the actual commands to reproduce this...

[tianshilei1992]

In D141164#4037866, @cmtice wrote:

Just a heads up: This is causing some of our clang tests to fail when run under asan/ubasn. E.g. for llvm/test/Transforms:Attributor/nosync.ll.test, we get

exit status 2
third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1158:26: runtime error: load of value 112, which is not a valid value for type 'bool'

#0 0x560ddce60c4b in llvm::Attributor::getAssumedSimplifiedValues(llvm::IRPosition const&, llvm::AbstractAttribute const*, llvm::SmallVectorImpl<llvm::AA::ValueAndContext>&, llvm::AA::ValueScope, bool&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1158:26
#1 0x560ddcf1fda2 in (anonymous namespace)::AAUnderlyingObjectsImpl::updateImpl(llvm::Attributor&)::'lambda'(llvm::SmallSetVector<llvm::Value*, 8u>&, llvm::AA::ValueScope)::operator()(llvm::SmallSetVector<llvm::Value*, 8u>&, llvm::AA::ValueScope) const third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:11235:14
#2 0x560ddcf1f4f1 in (anonymous namespace)::AAUnderlyingObjectsImpl::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:11272:16
#3 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#4 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#5 0x560ddce939de in llvm::AAUnderlyingObjects const& llvm::Attributor::getOrCreateAAFor<llvm::AAUnderlyingObjects>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#6 0x560ddce5a418 in getAAFor<llvm::AAUnderlyingObjects> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1462:12
#7 0x560ddce5a418 in getPotentialCopiesOfMemoryValue<true, llvm::LoadInst> third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:488:24
#8 0x560ddce5a418 in llvm::AA::getPotentiallyLoadedValues(llvm::Attributor&, llvm::LoadInst&, llvm::SmallSetVector<llvm::Value*, 4u>&, llvm::SmallSetVector<llvm::Instruction*, 4u>&, llvm::AbstractAttribute const&, bool&, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:515:10
#9 0x560ddcef9967 in handleLoadInst third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10572:10
#10 0x560ddcef9967 in simplifyInstruction third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10739:14
#11 0x560ddcef9967 in genericValueTraversal third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10796:13
#12 0x560ddcef9967 in (anonymous namespace)::AAPotentialValuesFloating::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:10450:5
#13 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#14 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#15 0x560ddce82d0e in llvm::AAPotentialValues const& llvm::Attributor::getOrCreateAAFor<llvm::AAPotentialValues>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#16 0x560ddce60a77 in llvm::Attributor::getAssumedSimplifiedValues(llvm::IRPosition const&, llvm::AbstractAttribute const*, llvm::SmallVectorImpl<llvm::AA::ValueAndContext>&, llvm::AA::ValueScope, bool&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1155:7
#17 0x560ddcebe5bb in operator() third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:2129:12
#18 0x560ddcebe5bb in bool llvm::function_ref<bool (llvm::Instruction&)>::callback_fn<(anonymous namespace)::AAReturnedValuesImpl::updateImpl(llvm::Attributor&)::$_0>(long, llvm::Instruction&) third_party/llvm/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:45:12
#19 0x560ddce66cb5 in operator() third_party/llvm/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:68:12
#20 0x560ddce66cb5 in checkForAllInstructionsImpl(llvm::Attributor*, llvm::DenseMap<unsigned int, llvm::SmallVector<llvm::Instruction*, 8u>*, llvm::DenseMapInfo<unsigned int, void>, llvm::detail::DenseMapPair<unsigned int, llvm::SmallVector<llvm::Instruction*, 8u>*>>&, llvm::function_ref<bool (llvm::Instruction&)>, llvm::AbstractAttribute const*, llvm::AAIsDead const*, llvm::ArrayRef<unsigned int> const&, bool&, bool, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1653:12
#21 0x560ddce66f5a in checkForAllInstructions third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1679:8
#22 0x560ddce66f5a in llvm::Attributor::checkForAllInstructions(llvm::function_ref<bool (llvm::Instruction&)>, llvm::AbstractAttribute const&, llvm::ArrayRef<unsigned int> const&, bool&, bool, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1695:10
#23 0x560ddcebd7a3 in (anonymous namespace)::AAReturnedValuesImpl::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:2145:10
#24 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#25 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#26 0x560ddce95f2e in llvm::AAReturnedValues const& llvm::Attributor::getOrCreateAAFor<llvm::AAReturnedValues>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#27 0x560ddce6683d in getAAFor<llvm::AAReturnedValues> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1462:12
#28 0x560ddce6683d in llvm::Attributor::checkForAllReturnedValues(llvm::function_ref<bool (llvm::Value&)>, llvm::AbstractAttribute const&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1620:7
#29 0x560ddcf05211 in clampReturnedValueStates<llvm::AANoUndef, llvm::BooleanState> third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:396:10
#30 0x560ddcf05211 in (anonymous namespace)::AAReturnedFromReturnedValues<llvm::AANoUndef, (anonymous namespace)::AANoUndefImpl, llvm::BooleanState, false>::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:414:5
#31 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#32 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#33 0x560ddcea2ede in llvm::AANoUndef const& llvm::Attributor::getOrCreateAAFor<llvm::AANoUndef>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#34 0x560ddcf2a82c in getAAFor<llvm::AANoUndef> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1462:12
#35 0x560ddcf2a82c in (anonymous namespace)::AAUndefinedBehaviorImpl::updateImpl(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/AttributorAttributes.cpp:3007:15
#36 0x560ddce5d771 in llvm::AbstractAttribute::update(llvm::Attributor&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:792:16
#37 0x560ddce69fe0 in llvm::Attributor::updateAA(llvm::AbstractAttribute&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2302:13
#38 0x560ddce9d2fe in llvm::AAUndefinedBehavior const& llvm::Attributor::getOrCreateAAFor<llvm::AAUndefinedBehavior>(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1562:7
#39 0x560ddce75da4 in getOrCreateAAFor<llvm::AAUndefinedBehavior> third_party/llvm/llvm-project/llvm/include/llvm/Transforms/IPO/Attributor.h:1574:12
#40 0x560ddce75da4 in llvm::Attributor::identifyDefaultAbstractAttributes(llvm::Function&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:2935:3
#41 0x560ddce79dbb in runAttributorOnFunctions(llvm::InformationCache&, llvm::SetVector<llvm::Function*, std::__u::vector<llvm::Function*, std::__u::allocator<llvm::Function*>>, llvm::DenseSet<llvm::Function*, llvm::DenseMapInfo<llvm::Function*, void>>>&, llvm::AnalysisGetter&, llvm::CallGraphUpdater&, bool, bool) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:3372:7
#42 0x560ddce792c9 in llvm::AttributorPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:3423:7
#43 0x560ddbd0a6d1 in llvm::detail::PassModel<llvm::Module, llvm::AttributorPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) third_party/llvm/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:89:17
#44 0x560dded5a873 in llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) third_party/llvm/llvm-project/llvm/include/llvm/IR/PassManager.h:517:40
#45 0x560dd9e41b4d in llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) third_party/llvm/llvm-project/llvm/tools/opt/NewPMDriver.cpp:512:7
#46 0x560dd9e5c422 in main third_party/llvm/llvm-project/llvm/tools/opt/opt.cpp:726:12
#47 0x7f116010d632 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x61632) (BuildId: 280088eab084c30a3992a9bce5c35b44)
#48 0x560dd9d69869 in _start /build/work/ab393f4ac612f9027aae6b1a7226027ba2a2/google3/blaze-out/k8-opt/bin/third_party/grte/v5_src/grte-scratch/BUILD/src/csu/../sysdeps/x86_64/start.S:120

SUMMARY: UndefinedBehaviorSanitizer: invalid-bool-load third_party/llvm/llvm-project/llvm/lib/Transforms/IPO/Attributor.cpp:1158:26 in
FileCheck error: '<stdin>' is empty.

I will see if I can get you the actual commands to reproduce this...

That would be helpful. Thanks.

[cmtice]

It appears that the actual problem is your use of an uninitialized Boolean, UsedAssumedInformation, which you declare but don't initialize on line 11231 of AttributorAttributes.cpp, then proceed to pass into other functions without initializing it first.

[tianshilei1992]

In D141164#4037982, @cmtice wrote:

It appears that the actual problem is your use of an uninitialized Boolean, UsedAssumedInformation, which you declare but don't initialize on line 11231 of AttributorAttributes.cpp, then proceed to pass into other functions without initializing it first.

They will be written in the callee. It is passed as a reference &.

[cmtice]

It still breaks asan/ubsan builds. I have committed a patch that initializes it it false. That should fix the saniziter issues, and the callees can still overwrite the value as needed.

[tianshilei1992]

In D141164#4038081, @cmtice wrote:

It still breaks asan/ubsan builds. I have committed a patch that initializes it it false. That should fix the saniziter issues, and the callees can still overwrite the value as needed.

okay, thanks.

llvm/include/llvm/Transforms/IPO/Attributor.h

 inline bool operator!=(const RangeTy &A, const RangeTy &B) { return !(A == B); }
 
 /// Return the initial value of \p Obj with type \p Ty if that is a constant.
 Constant *getInitialValueForObj(Value &Obj, Type &Ty,
                                 const TargetLibraryInfo *TLI,
                                 const DataLayout &DL,
                                 RangeTy *RangePtr = nullptr);
 
-/// Collect all potential underlying objects of \p Ptr at position \p CtxI in
-/// \p Objects. Assumed information is used and dependences onto \p QueryingAA
-/// are added appropriately.
-///
-/// \returns True if \p Objects contains all assumed underlying objects, and
-///          false if something went wrong and the objects could not be
-///          determined.
-bool getAssumedUnderlyingObjects(
-    Attributor &A, const Value &Ptr, SmallSetVector<Value *, 8> &Objects,
-    const AbstractAttribute &QueryingAA, const Instruction *CtxI,
-    bool &UsedAssumedInformation, AA::ValueScope VS = AA::Interprocedural,
-    SmallPtrSetImpl<Value *> *SeenObjects = nullptr);
-
 /// Collect all potential values \p LI could read into \p PotentialValues. That
 /// is, the only values read by \p LI are assumed to be known and all are in
 /// \p PotentialValues. \p PotentialValueOrigins will contain all the
 /// instructions that might have put a potential value into \p PotentialValues.
 /// Dependences onto \p QueryingAA are properly tracked, \p
 /// UsedAssumedInformation will inform the caller if assumed information was
 /// used.
 ///
struct AAAssumptionInfo
   static bool classof(const AbstractAttribute *AA) {
     return (AA->getIdAddr() == &ID);
   }
 
   /// Unique ID (due to the unique address)
   static const char ID;
 };
 
+/// An abstract attribute for getting all assumption underlying objects.
+struct AAUnderlyingObjects : AbstractAttribute {
+  AAUnderlyingObjects(const IRPosition &IRP) : AbstractAttribute(IRP) {}
+
+  /// Create an abstract attribute biew for the position \p IRP.
+  static AAUnderlyingObjects &createForPosition(const IRPosition &IRP,
+                                                Attributor &A);
+
+  /// See AbstractAttribute::getName()
+  const std::string getName() const override { return "AAUnderlyingObjects"; }
+
+  /// See AbstractAttribute::getIdAddr()
+  const char *getIdAddr() const override { return &ID; }
+
+  /// This function should return true if the type of the \p AA is
+  /// AAUnderlyingObjects.
+  static bool classof(const AbstractAttribute *AA) {
+    return (AA->getIdAddr() == &ID);
+  }
+
+  /// Unique ID (due to the unique address)
+  static const char ID;
+
+  /// Check \p Pred on all underlying objects in \p Scope collected so far.
+  ///
+  /// This method will evaluate \p Pred on all underlying objects in \p Scope
+  /// collected so far and return true if \p Pred holds on all of them.
+  virtual bool
+  forallUnderlyingObjects(function_ref<bool(Value &)> Pred,
+                          AA::ValueScope Scope = AA::Interprocedural) const = 0;
+};
+
 raw_ostream &operator<<(raw_ostream &, const AAPointerInfo::Access &);
 
 /// Run options, used by the pass manager.
 enum AttributorRunOption {
   NONE = 0,
   MODULE = 1 << 0,
   CGSCC = 1 << 1,
   ALL = MODULE | CGSCC
 };
 
 } // end namespace llvm
 
 #endif // LLVM_TRANSFORMS_IPO_ATTRIBUTOR_H

llvm/lib/Transforms/IPO/Attributor.cpp

 static bool getPotentialCopiesOfMemoryValue(
     Attributor &A, Ty &I, SmallSetVector<Value *, 4> &PotentialCopies,
     SmallSetVector<Instruction *, 4> &PotentialValueOrigins,
     const AbstractAttribute &QueryingAA, bool &UsedAssumedInformation,
     bool OnlyExact) {
   LLVM_DEBUG(dbgs() << "Trying to determine the potential copies of " << I
                     << " (only exact: " << OnlyExact << ")\n";);
 
   Value &Ptr = *I.getPointerOperand();
-  SmallSetVector<Value *, 8> Objects;
-  if (!AA::getAssumedUnderlyingObjects(A, Ptr, Objects, QueryingAA, &I,
-                                       UsedAssumedInformation)) {
-    LLVM_DEBUG(
-        dbgs() << "Underlying objects stored into could not be determined\n";);
-    return false;
-  }
-
   // Containers to remember the pointer infos and new copies while we are not
   // sure that we can find all of them. If we abort we want to avoid spurious
   // dependences and potential copies in the provided container.
   SmallVector<const AAPointerInfo *> PIs;
   SmallVector<Value *> NewCopies;
   SmallVector<Instruction *> NewCopyOrigins;
 
   const auto *TLI =
       A.getInfoCache().getTargetLibraryInfoForFunction(*I.getFunction());
-  LLVM_DEBUG(dbgs() << "Visit " << Objects.size() << " objects:\n");
-  for (Value *Obj : Objects) {
-    LLVM_DEBUG(dbgs() << "Visit underlying object " << *Obj << "\n");
-    if (isa<UndefValue>(Obj))
-      continue;
-    if (isa<ConstantPointerNull>(Obj)) {
+
+  auto Pred = [&](Value &Obj) {
+    LLVM_DEBUG(dbgs() << "Visit underlying object " << Obj << "\n");
+    if (isa<UndefValue>(&Obj))
+      return true;
+    if (isa<ConstantPointerNull>(&Obj)) {
       // A null pointer access can be undefined but any offset from null may
       // be OK. We do not try to optimize the latter.
       if (!NullPointerIsDefined(I.getFunction(),
                                 Ptr.getType()->getPointerAddressSpace()) &&
           A.getAssumedSimplified(Ptr, QueryingAA, UsedAssumedInformation,
-                                 AA::Interprocedural) == Obj)
-        continue;
+                                 AA::Interprocedural) == &Obj)
+        return true;
       LLVM_DEBUG(
           dbgs() << "Underlying object is a valid nullptr, giving up.\n";);
       return false;
     }
     // TODO: Use assumed noalias return.
-    if (!isa<AllocaInst>(Obj) && !isa<GlobalVariable>(Obj) &&
-        !(IsLoad ? isAllocationFn(Obj, TLI) : isNoAliasCall(Obj))) {
-      LLVM_DEBUG(dbgs() << "Underlying object is not supported yet: " << *Obj
+    if (!isa<AllocaInst>(&Obj) && !isa<GlobalVariable>(&Obj) &&
+        !(IsLoad ? isAllocationFn(&Obj, TLI) : isNoAliasCall(&Obj))) {
+      LLVM_DEBUG(dbgs() << "Underlying object is not supported yet: " << Obj
                         << "\n";);
       return false;
     }
-    if (auto *GV = dyn_cast<GlobalVariable>(Obj))
+    if (auto *GV = dyn_cast<GlobalVariable>(&Obj))
       if (!GV->hasLocalLinkage() &&
           !(GV->isConstant() && GV->hasInitializer())) {
         LLVM_DEBUG(dbgs() << "Underlying object is global with external "
                              "linkage, not supported yet: "
-                          << *Obj << "\n";);
+                          << Obj << "\n";);
         return false;
       }
 
     bool NullOnly = true;
     bool NullRequired = false;
     auto CheckForNullOnlyAndUndef = [&](std::optional<Value *> V,
                                         bool IsExact) {
       if (!V || *V == nullptr)
auto CheckAccess = [&](const AAPointerInfo::Access &Acc, bool IsExact) {
       return true;
     };
 
     // If the value has been written to we don't need the initial value of the
     // object.
     bool HasBeenWrittenTo = false;
 
     AA::RangeTy Range;
-    auto &PI = A.getAAFor<AAPointerInfo>(QueryingAA, IRPosition::value(*Obj),
+    auto &PI = A.getAAFor<AAPointerInfo>(QueryingAA, IRPosition::value(Obj),
                                          DepClassTy::NONE);
     if (!PI.forallInterferingAccesses(A, QueryingAA, I, CheckAccess,
                                       HasBeenWrittenTo, Range)) {
       LLVM_DEBUG(
           dbgs()
           << "Failed to verify all interfering accesses for underlying object: "
-          << *Obj << "\n");
+          << Obj << "\n");
       return false;
     }
 
     if (IsLoad && !HasBeenWrittenTo && !Range.isUnassigned()) {
       const DataLayout &DL = A.getDataLayout();
       Value *InitialValue =
-          AA::getInitialValueForObj(*Obj, *I.getType(), TLI, DL, &Range);
+          AA::getInitialValueForObj(Obj, *I.getType(), TLI, DL, &Range);
       if (!InitialValue) {
         LLVM_DEBUG(dbgs() << "Could not determine required initial value of "
                              "underlying object, abort!\n");
         return false;
       }
       CheckForNullOnlyAndUndef(InitialValue, /* IsExact */ true);
       if (NullRequired && !NullOnly) {
         LLVM_DEBUG(dbgs() << "Non exact access but initial value that is not "
                              "null or undef, abort!\n");
         return false;
       }
 
       NewCopies.push_back(InitialValue);
       NewCopyOrigins.push_back(nullptr);
     }
 
     PIs.push_back(&PI);
+
+    return true;
+  };
+
+  const auto &AAUO = A.getAAFor<AAUnderlyingObjects>(
+      QueryingAA, IRPosition::value(Ptr), DepClassTy::OPTIONAL);
+  if (!AAUO.forallUnderlyingObjects(Pred)) {
+    LLVM_DEBUG(
+        dbgs() << "Underlying objects stored into could not be determined\n";);
+    return false;
   }
 
   // Only if we were successful collection all potential copies we record
   // dependences (on non-fix AAPointerInfo AAs). We also only then modify the
   // given PotentialCopies container.
   for (const auto *PI : PIs) {
     if (!PI->getState().isAtFixpoint())
       UsedAssumedInformation = true;

llvm/lib/Transforms/IPO/AttributorAttributes.cpp

 PIPE_OPERATOR(AAUndefinedBehavior)
 PIPE_OPERATOR(AAPotentialConstantValues)
 PIPE_OPERATOR(AAPotentialValues)
 PIPE_OPERATOR(AANoUndef)
 PIPE_OPERATOR(AACallEdges)
 PIPE_OPERATOR(AAFunctionReachability)
 PIPE_OPERATOR(AAPointerInfo)
 PIPE_OPERATOR(AAAssumptionInfo)
+PIPE_OPERATOR(AAUnderlyingObjects)
 
 #undef PIPE_OPERATOR
 
 template <>
 ChangeStatus clampStateAndIndicateChange<DerefState>(DerefState &S,
                                                      const DerefState &R) {
   ChangeStatus CS0 =
       clampStateAndIndicateChange(S.DerefBytesState, R.DerefBytesState);
static Value *constructPointer(Type *ResTy, Type *PtrElemTy, Value *Ptr,
   // Ensure the result has the requested type.
   Ptr = IRB.CreatePointerBitCastOrAddrSpaceCast(Ptr, ResTy,
                                                 Ptr->getName() + ".cast");
 
   LLVM_DEBUG(dbgs() << "Constructed pointer: " << *Ptr << "\n");
   return Ptr;
 }
 
-bool AA::getAssumedUnderlyingObjects(Attributor &A, const Value &Ptr,
-                                     SmallSetVector<Value *, 8> &Objects,
-                                     const AbstractAttribute &QueryingAA,
-                                     const Instruction *CtxI,
-                                     bool &UsedAssumedInformation,
-                                     AA::ValueScope S,
-                                     SmallPtrSetImpl<Value *> *SeenObjects) {
-  SmallPtrSet<Value *, 8> LocalSeenObjects;
-  if (!SeenObjects)
-    SeenObjects = &LocalSeenObjects;
-
-  SmallVector<AA::ValueAndContext> Values;
-  if (!A.getAssumedSimplifiedValues(IRPosition::value(Ptr), &QueryingAA, Values,
-                                    S, UsedAssumedInformation)) {
-    Objects.insert(const_cast<Value *>(&Ptr));
-    return true;
-  }
-
-  for (auto &VAC : Values) {
-    Value *UO = getUnderlyingObject(VAC.getValue());
-    if (UO && UO != VAC.getValue() && SeenObjects->insert(UO).second) {
-      if (!getAssumedUnderlyingObjects(A, *UO, Objects, QueryingAA,
-                                       VAC.getCtxI(), UsedAssumedInformation, S,
-                                       SeenObjects))
-        return false;
-      continue;
-    }
-    Objects.insert(VAC.getValue());
-  }
-  return true;
-}
-
 static const Value *
 stripAndAccumulateOffsets(Attributor &A, const AbstractAttribute &QueryingAA,
                           const Value *Val, const DataLayout &DL, APInt &Offset,
                           bool GetMinOffset, bool AllowNonInbounds,
                           bool UseAssumed = false) {
 
   auto AttributorAnalysis = [&](Value &V, APInt &ROffset) -> bool {
     const IRPosition &Pos = IRPosition::value(V);

 
 void AAMemoryLocationImpl::categorizePtrValue(
     Attributor &A, const Instruction &I, const Value &Ptr,
     AAMemoryLocation::StateType &State, bool &Changed) {
   LLVM_DEBUG(dbgs() << "[AAMemoryLocation] Categorize pointer locations for "
                     << Ptr << " ["
                     << getMemoryLocationsAsStr(State.getAssumed()) << "]\n");
 
-  SmallSetVector<Value *, 8> Objects;
-  bool UsedAssumedInformation = false;
-  if (!AA::getAssumedUnderlyingObjects(A, Ptr, Objects, *this, &I,
-                                       UsedAssumedInformation,
-                                       AA::Intraprocedural)) {
-    LLVM_DEBUG(
-        dbgs() << "[AAMemoryLocation] Pointer locations not categorized\n");
-    updateStateAndAccessesMap(State, NO_UNKOWN_MEM, &I, nullptr, Changed,
-                              getAccessKindFromInst(&I));
-    return;
-  }
-
-  for (Value *Obj : Objects) {
+  auto Pred = [&](Value &Obj) {
     // TODO: recognize the TBAA used for constant accesses.
     MemoryLocationsKind MLK = NO_LOCATIONS;
-    if (isa<UndefValue>(Obj))
-      continue;
-    if (isa<Argument>(Obj)) {
+    if (isa<UndefValue>(&Obj))
+      return true;
+    if (isa<Argument>(&Obj)) {
       // TODO: For now we do not treat byval arguments as local copies performed
       // on the call edge, though, we should. To make that happen we need to
       // teach various passes, e.g., DSE, about the copy effect of a byval. That
       // would also allow us to mark functions only accessing byval arguments as
       // readnone again, arguably their accesses have no effect outside of the
       // function, like accesses to allocas.
       MLK = NO_ARGUMENT_MEM;
-    } else if (auto *GV = dyn_cast<GlobalValue>(Obj)) {
+    } else if (auto *GV = dyn_cast<GlobalValue>(&Obj)) {
       // Reading constant memory is not treated as a read "effect" by the
       // function attr pass so we won't neither. Constants defined by TBAA are
       // similar. (We know we do not write it because it is constant.)
       if (auto *GVar = dyn_cast<GlobalVariable>(GV))
         if (GVar->isConstant())
-          continue;
+          return true;
 
       if (GV->hasLocalLinkage())
         MLK = NO_GLOBAL_INTERNAL_MEM;
       else
         MLK = NO_GLOBAL_EXTERNAL_MEM;
-    } else if (isa<ConstantPointerNull>(Obj) &&
+    } else if (isa<ConstantPointerNull>(&Obj) &&
                !NullPointerIsDefined(getAssociatedFunction(),
                                      Ptr.getType()->getPointerAddressSpace())) {
-      continue;
-    } else if (isa<AllocaInst>(Obj)) {
+      return true;
+    } else if (isa<AllocaInst>(&Obj)) {
       MLK = NO_LOCAL_MEM;
-    } else if (const auto *CB = dyn_cast<CallBase>(Obj)) {
+    } else if (const auto *CB = dyn_cast<CallBase>(&Obj)) {
       const auto &NoAliasAA = A.getAAFor<AANoAlias>(
           *this, IRPosition::callsite_returned(*CB), DepClassTy::OPTIONAL);
       if (NoAliasAA.isAssumedNoAlias())
         MLK = NO_MALLOCED_MEM;
       else
         MLK = NO_UNKOWN_MEM;
     } else {
       MLK = NO_UNKOWN_MEM;
     }
 
     assert(MLK != NO_LOCATIONS && "No location specified!");
     LLVM_DEBUG(dbgs() << "[AAMemoryLocation] Ptr value can be categorized: "
-                      << *Obj << " -> " << getMemoryLocationsAsStr(MLK)
-                      << "\n");
-    updateStateAndAccessesMap(getState(), MLK, &I, Obj, Changed,
+                      << Obj << " -> " << getMemoryLocationsAsStr(MLK) << "\n");
+    updateStateAndAccessesMap(getState(), MLK, &I, &Obj, Changed,
+                              getAccessKindFromInst(&I));
+
+    return true;
+  };
+
+  const auto &AA = A.getAAFor<AAUnderlyingObjects>(
+      *this, IRPosition::value(Ptr), DepClassTy::OPTIONAL);
+  if (!AA.forallUnderlyingObjects(Pred, AA::Intraprocedural)) {
+    LLVM_DEBUG(
+        dbgs() << "[AAMemoryLocation] Pointer locations not categorized\n");
+    updateStateAndAccessesMap(State, NO_UNKOWN_MEM, &I, nullptr, Changed,
                               getAccessKindFromInst(&I));
+    return;
   }
 
   LLVM_DEBUG(
       dbgs() << "[AAMemoryLocation] Accessed locations with pointer locations: "
              << getMemoryLocationsAsStr(State.getAssumed()) << "\n");
 }
 
 void AAMemoryLocationImpl::categorizeArgumentPointerLocations(

 
 AACallGraphNode *AACallEdgeIterator::operator*() const {
   return static_cast<AACallGraphNode *>(const_cast<AACallEdges *>(
       &A.getOrCreateAAFor<AACallEdges>(IRPosition::function(**I))));
 }
 
 void AttributorCallGraph::print() { llvm::WriteGraph(outs(), this); }
 
+/// ------------------------ UnderlyingObjects ---------------------------------
+
+namespace {
+struct AAUnderlyingObjectsImpl
+    : StateWrapper<BooleanState, AAUnderlyingObjects> {
+  using BaseTy = StateWrapper<BooleanState, AAUnderlyingObjects>;
+  AAUnderlyingObjectsImpl(const IRPosition &IRP, Attributor &A) : BaseTy(IRP) {}
+
+  /// See AbstractAttribute::getAsStr().
+  const std::string getAsStr() const override {
+    return std::string("UnderlyingObjects ") +
+           (isValidState()
+                ? (std::string("inter #") +
+                   std::to_string(InterAssumedUnderlyingObjects.size()) +
+                   " objs" + std::string(", intra #") +
+                   std::to_string(IntraAssumedUnderlyingObjects.size()) +
+                   " objs")
+                : "<invalid>");
+  }
+
+  /// See AbstractAttribute::trackStatistics()
+  void trackStatistics() const override {}
+
+  /// See AbstractAttribute::updateImpl(...).
+  ChangeStatus updateImpl(Attributor &A) override {
+    auto &Ptr = getAssociatedValue();
+
+    auto DoUpdate = [&](SmallSetVector<Value *, 8> &UnderlyingObjects,
+                        AA::ValueScope Scope) {
+      bool UsedAssumedInformation;
+      SmallPtrSet<Value *, 8> SeenObjects;
+      SmallVector<AA::ValueAndContext> Values;
+
+      if (!A.getAssumedSimplifiedValues(IRPosition::value(Ptr), *this, Values,
+                                        Scope, UsedAssumedInformation))
+        return UnderlyingObjects.insert(&Ptr);
+
+      bool Changed = false;
+
+      for (unsigned I = 0; I < Values.size(); ++I) {
+        auto &VAC = Values[I];
+        auto *Obj = VAC.getValue();
+        Value *UO = getUnderlyingObject(Obj);
+        if (UO && UO != VAC.getValue() && SeenObjects.insert(UO).second) {
+          const auto &OtherAA = A.getAAFor<AAUnderlyingObjects>(
+              *this, IRPosition::value(*UO), DepClassTy::OPTIONAL);
+          auto Pred = [&Values](Value &V) {
+            Values.emplace_back(V, nullptr);
+            return true;
+          };
+
+          if (!OtherAA.forallUnderlyingObjects(Pred, Scope))
+            llvm_unreachable(
+                "The forall call should not return false at this position");
+
+          continue;
+        }
+
+        if (isa<SelectInst>(Obj) || isa<PHINode>(Obj)) {
+          Changed |= handleIndirect(A, *Obj, UnderlyingObjects, Scope);
+          continue;
+        }
+
+        Changed |= UnderlyingObjects.insert(Obj);
+      }
+
+      return Changed;
+    };
+
+    bool Changed = false;
+    Changed |= DoUpdate(IntraAssumedUnderlyingObjects, AA::Intraprocedural);
+    Changed |= DoUpdate(InterAssumedUnderlyingObjects, AA::Interprocedural);
+
+    return Changed ? ChangeStatus::CHANGED : ChangeStatus::UNCHANGED;
+  }
+
+  bool forallUnderlyingObjects(
+      function_ref<bool(Value &)> Pred,
+      AA::ValueScope Scope = AA::Interprocedural) const override {
+    if (!isValidState())
+      return Pred(getAssociatedValue());
+
+    auto &AssumedUnderlyingObjects = Scope == AA::Intraprocedural
+                                         ? IntraAssumedUnderlyingObjects
+                                         : InterAssumedUnderlyingObjects;
+    for (Value *Obj : AssumedUnderlyingObjects)
+      if (!Pred(*Obj))
+        return false;
+
+    return true;
+  }
+
+private:
+  /// Handle the case where the value is not the actual underlying value, such
+  /// as a phi node or a select instruction.
+  bool handleIndirect(Attributor &A, Value &V,
+                      SmallSetVector<Value *, 8> &UnderlyingObjects,
+                      AA::ValueScope Scope) {
+    bool Changed = false;
+    const auto &AA = A.getAAFor<AAUnderlyingObjects>(
+        *this, IRPosition::value(V), DepClassTy::OPTIONAL);
+    auto Pred = [&](Value &V) {
+      Changed |= UnderlyingObjects.insert(&V);
+      return true;
+    };
+    if (!AA.forallUnderlyingObjects(Pred, Scope))
+      llvm_unreachable(
+          "The forall call should not return false at this position");
+    return Changed;
+  }
+
+  /// All the underlying objects collected so far via intra procedural scope.
+  SmallSetVector<Value *, 8> IntraAssumedUnderlyingObjects;
+  /// All the underlying objects collected so far via inter procedural scope.
+  SmallSetVector<Value *, 8> InterAssumedUnderlyingObjects;
+};
+
+struct AAUnderlyingObjectsFloating final : AAUnderlyingObjectsImpl {
+  AAUnderlyingObjectsFloating(const IRPosition &IRP, Attributor &A)
+      : AAUnderlyingObjectsImpl(IRP, A) {}
+};
+
+struct AAUnderlyingObjectsArgument final : AAUnderlyingObjectsImpl {
+  AAUnderlyingObjectsArgument(const IRPosition &IRP, Attributor &A)
+      : AAUnderlyingObjectsImpl(IRP, A) {}
+};
+
+struct AAUnderlyingObjectsCallSite final : AAUnderlyingObjectsImpl {
+  AAUnderlyingObjectsCallSite(const IRPosition &IRP, Attributor &A)
+      : AAUnderlyingObjectsImpl(IRP, A) {}
+};
+
+struct AAUnderlyingObjectsCallSiteArgument final : AAUnderlyingObjectsImpl {
+  AAUnderlyingObjectsCallSiteArgument(const IRPosition &IRP, Attributor &A)
+      : AAUnderlyingObjectsImpl(IRP, A) {}
+};
+
+struct AAUnderlyingObjectsReturned final : AAUnderlyingObjectsImpl {
+  AAUnderlyingObjectsReturned(const IRPosition &IRP, Attributor &A)
+      : AAUnderlyingObjectsImpl(IRP, A) {}
+};
+
+struct AAUnderlyingObjectsCallSiteReturned final : AAUnderlyingObjectsImpl {
+  AAUnderlyingObjectsCallSiteReturned(const IRPosition &IRP, Attributor &A)
+      : AAUnderlyingObjectsImpl(IRP, A) {}
+};
+
+struct AAUnderlyingObjectsFunction final : AAUnderlyingObjectsImpl {
+  AAUnderlyingObjectsFunction(const IRPosition &IRP, Attributor &A)
+      : AAUnderlyingObjectsImpl(IRP, A) {}
+};
+}
+
 const char AAReturnedValues::ID = 0;
 const char AANoUnwind::ID = 0;
 const char AANoSync::ID = 0;
 const char AANoFree::ID = 0;
 const char AANonNull::ID = 0;
 const char AANoRecurse::ID = 0;
 const char AAWillReturn::ID = 0;
 const char AAUndefinedBehavior::ID = 0;

 const char AAValueConstantRange::ID = 0;
 const char AAPotentialConstantValues::ID = 0;
 const char AAPotentialValues::ID = 0;
 const char AANoUndef::ID = 0;
 const char AACallEdges::ID = 0;
 const char AAFunctionReachability::ID = 0;
 const char AAPointerInfo::ID = 0;
 const char AAAssumptionInfo::ID = 0;
+const char AAUnderlyingObjects::ID = 0;
 
 // Macro magic to create the static generator function for attributes that
 // follow the naming scheme.
 
 #define SWITCH_PK_INV(CLASS, PK, POS_NAME)                                     \
   case IRPosition::PK:                                                         \
     llvm_unreachable("Cannot create " #CLASS " for a " POS_NAME " position!");
 

 CREATE_VALUE_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAPotentialConstantValues)
 CREATE_VALUE_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAPotentialValues)
 CREATE_VALUE_ABSTRACT_ATTRIBUTE_FOR_POSITION(AANoUndef)
 CREATE_VALUE_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAPointerInfo)
 
 CREATE_ALL_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAValueSimplify)
 CREATE_ALL_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAIsDead)
 CREATE_ALL_ABSTRACT_ATTRIBUTE_FOR_POSITION(AANoFree)
+CREATE_ALL_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAUnderlyingObjects)
 
 CREATE_FUNCTION_ONLY_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAHeapToStack)
 CREATE_FUNCTION_ONLY_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAReachability)
 CREATE_FUNCTION_ONLY_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAUndefinedBehavior)
 CREATE_FUNCTION_ONLY_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAFunctionReachability)
 
 CREATE_NON_RET_ABSTRACT_ATTRIBUTE_FOR_POSITION(AAMemoryBehavior)
 
 #undef CREATE_FUNCTION_ONLY_ABSTRACT_ATTRIBUTE_FOR_POSITION
 #undef CREATE_FUNCTION_ABSTRACT_ATTRIBUTE_FOR_POSITION
 #undef CREATE_NON_RET_ABSTRACT_ATTRIBUTE_FOR_POSITION
 #undef CREATE_VALUE_ABSTRACT_ATTRIBUTE_FOR_POSITION
 #undef CREATE_ALL_ABSTRACT_ATTRIBUTE_FOR_POSITION
 #undef SWITCH_PK_CREATE
 #undef SWITCH_PK_INV

llvm/test/Transforms/Attributor/ArgumentPromotion/chained.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --function-signature --check-attributes --check-globals
-; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=7 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
+; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=9 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
 ; RUN: opt -aa-pipeline=basic-aa -passes=attributor-cgscc -attributor-manifest-internal  -attributor-annotate-decl-cs -S < %s | FileCheck %s --check-prefixes=CHECK,CGSCC
 
 @G1 = constant i32 0
 @G2 = constant ptr @G1
 
 ;.
 ; CHECK: @[[G1:[a-zA-Z0-9_$"\\.-]+]] = constant i32 0
 ; CHECK: @[[G2:[a-zA-Z0-9_$"\\.-]+]] = constant ptr @G1

llvm/test/Transforms/Attributor/ArgumentPromotion/crash.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --function-signature --check-attributes --check-globals
-; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=3 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
+; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=4 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
 ; RUN: opt -aa-pipeline=basic-aa -passes=attributor-cgscc -attributor-manifest-internal  -attributor-annotate-decl-cs -S < %s | FileCheck %s --check-prefixes=CHECK,CGSCC
 
 %S = type { ptr }
 
 ; Inlining should nuke the invoke (and any inlined calls) here even with
 ; argument promotion running along with it.
 define void @zot() personality ptr @wibble {
 ; TUNIT: Function Attrs: nofree norecurse noreturn nosync nounwind willreturn memory(none)

llvm/test/Transforms/Attributor/IPConstantProp/PR26044.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --function-signature --check-attributes --check-globals
-; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=11 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
+; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=12 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
 ; RUN: opt -aa-pipeline=basic-aa -passes=attributor-cgscc -attributor-manifest-internal  -attributor-annotate-decl-cs -S < %s | FileCheck %s --check-prefixes=CHECK,CGSCC
 target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 define void @fn2(ptr %P, i1 %C) {
 ;
 ; TUNIT: Function Attrs: nofree norecurse nosync nounwind memory(argmem: readwrite)
 ; TUNIT-LABEL: define {{[^@]+}}@fn2

llvm/test/Transforms/Attributor/call-simplify-pointer-info.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --function-signature --check-attributes --check-globals
-; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=7 -S < %s | FileCheck %s --check-prefixes=TUNIT
+; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=2 -S < %s | FileCheck %s --check-prefixes=TUNIT
 ; RUN: opt -aa-pipeline=basic-aa -passes=attributor-cgscc -attributor-manifest-internal  -attributor-annotate-decl-cs -S < %s | FileCheck %s --check-prefixes=CGSCC
 ;
 
 define internal i8 @read_arg(i8* %p) {
 ; CGSCC: Function Attrs: nofree norecurse nosync nounwind willreturn memory(argmem: read)
 ; CGSCC-LABEL: define {{[^@]+}}@read_arg
 ; CGSCC-SAME: (i8* nocapture nofree noundef nonnull readonly dereferenceable(1022) [[P:%.*]]) #[[ATTR0:[0-9]+]] {
 ; CGSCC-NEXT:  entry:

llvm/test/Transforms/Attributor/depgraph.ll

 ;
 
 ; GRAPH:      [AAIsDead] for CtxI '  %2 = load i32, ptr %0, align 4' at position {fn:checkAndAdvance [checkAndAdvance@-1]} with state Live[#BB 4/4][#TBEP 0][#KDE 1]
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AAPotentialValues] for CtxI '  %3 = icmp eq i32 %2, 0' at position {flt: [@-1]} with state set-state(< {  %3 = icmp eq i32 %2, 0[3], } >)
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AAPotentialValues] for CtxI '  %2 = load i32, ptr %0, align 4' at position {flt: [@-1]} with state set-state(< {  %2 = load i32, ptr %0, align 4[3], } >)
 ; GRAPH-EMPTY:
+; GRAPH-NEXT: [AAUnderlyingObjects] for CtxI '  %2 = load i32, ptr %0, align 4' at position {arg: [@0]} with state UnderlyingObjects inter #1 objs, intra #1 objs
+; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AAPotentialValues] for CtxI '  %2 = load i32, ptr %0, align 4' at position {arg: [@0]} with state set-state(< {ptr %0[3], } >)
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AAPotentialValues] for CtxI <<null inst>> at position {flt: [@-1]} with state set-state(< {i32 0[3], } >)
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AANoReturn] for CtxI '  %6 = call ptr @checkAndAdvance(ptr %5)' at position {cs: [@-1]} with state may-return
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AANoReturn] for CtxI '  %2 = load i32, ptr %0, align 4' at position {fn:checkAndAdvance [checkAndAdvance@-1]} with state may-return
 ; GRAPH-EMPTY:

 ; GRAPH-NEXT: [AAAssumptionInfo] for CtxI '  %6 = call ptr @checkAndAdvance(ptr %5)' at position {cs: [@-1]} with state Known [], Assumed []
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AANoAlias] for CtxI '  %6 = call ptr @checkAndAdvance(ptr %5)' at position {cs_arg: [@0]} with state may-alias
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AANoAlias] for CtxI '  %5 = getelementptr inbounds i32, ptr %0, i64 4' at position {flt: [@-1]} with state may-alias
 ; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AANoFree] for CtxI '  %6 = call ptr @checkAndAdvance(ptr %5)' at position {cs_arg: [@0]} with state nofree
 ; GRAPH-EMPTY:
+; GRAPH-NEXT: [AAUnderlyingObjects] for CtxI '  %5 = getelementptr inbounds i32, ptr %0, i64 4' at position {flt: [@-1]} with state UnderlyingObjects inter #1 objs, intra #1 objs
+; GRAPH-EMPTY:
 ; GRAPH-NEXT: [AADereferenceable] for CtxI '  %5 = getelementptr inbounds i32, ptr %0, i64 4' at position {flt: [@-1]} with state unknown-dereferenceable
 
 ; GRAPH-NOT: update
 
 ;
 ; Check for .dot file
 ;
 ; DOT-DAG: Node[[Node0:0x[a-z0-9]+]] [shape=record,label="{[AAIsDead]

llvm/test/Transforms/Attributor/value-simplify-gpu.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --function-signature --check-attributes --check-globals
-; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=6 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
+; RUN: opt -aa-pipeline=basic-aa -passes=attributor -attributor-manifest-internal  -attributor-max-iterations-verify -attributor-annotate-decl-cs -attributor-max-iterations=7 -S < %s | FileCheck %s --check-prefixes=CHECK,TUNIT
 ; RUN: opt -aa-pipeline=basic-aa -passes=attributor-cgscc -attributor-manifest-internal  -attributor-annotate-decl-cs -S < %s | FileCheck %s --check-prefixes=CHECK,CGSCC
 
 target triple = "amdgcn-amd-amdhsa"
 
 %struct.ident_t = type { i32, i32, i32, i32, ptr }
 @ReachableKernel = internal addrspace(3) global i32 3, align 4
 @UnreachableKernel = internal addrspace(3) global i32 42, align 4
 @ReachableKernelAS0 = internal global i32 7, align 4

llvm/test/Transforms/Attributor/value-simplify-pointer-info.ll

 ; CHECK-SAME: () #[[ATTR4]] {
 ; CHECK-NEXT:    ret i32 0
 ;
   %l = load i32, i32* @Gstatic_int3
   ret i32 %l
 }
 
 define i8 @phi_store() {
-; TUNIT: Function Attrs: nofree norecurse nosync nounwind willreturn
-; TUNIT-LABEL: define {{[^@]+}}@phi_store
-; TUNIT-SAME: () #[[ATTR3]] {
-; TUNIT-NEXT:  entry:
-; TUNIT-NEXT:    [[A:%.*]] = alloca i16, align 2
-; TUNIT-NEXT:    [[B:%.*]] = bitcast i16* [[A]] to i8*
-; TUNIT-NEXT:    br label [[LOOP:%.*]]
-; TUNIT:       loop:
-; TUNIT-NEXT:    [[P:%.*]] = phi i8* [ [[B]], [[ENTRY:%.*]] ], [ [[G:%.*]], [[LOOP]] ]
-; TUNIT-NEXT:    [[I:%.*]] = phi i8 [ 0, [[ENTRY]] ], [ [[O:%.*]], [[LOOP]] ]
-; TUNIT-NEXT:    store i8 1, i8* [[P]], align 1
-; TUNIT-NEXT:    [[G]] = getelementptr i8, i8* [[P]], i64 1
-; TUNIT-NEXT:    [[O]] = add nsw i8 [[I]], 1
-; TUNIT-NEXT:    [[C:%.*]] = icmp eq i8 [[O]], 2
-; TUNIT-NEXT:    br i1 [[C]], label [[END:%.*]], label [[LOOP]]
-; TUNIT:       end:
-; TUNIT-NEXT:    [[S:%.*]] = getelementptr i8, i8* [[B]], i64 1
-; TUNIT-NEXT:    [[L:%.*]] = load i8, i8* [[S]], align 1
-; TUNIT-NEXT:    ret i8 [[L]]
-;
-; CGSCC: Function Attrs: nofree norecurse nosync nounwind willreturn
-; CGSCC-LABEL: define {{[^@]+}}@phi_store
-; CGSCC-SAME: () #[[ATTR5]] {
-; CGSCC-NEXT:  entry:
-; CGSCC-NEXT:    [[A:%.*]] = alloca i16, align 2
-; CGSCC-NEXT:    [[B:%.*]] = bitcast i16* [[A]] to i8*
-; CGSCC-NEXT:    br label [[LOOP:%.*]]
-; CGSCC:       loop:
-; CGSCC-NEXT:    [[P:%.*]] = phi i8* [ [[B]], [[ENTRY:%.*]] ], [ [[G:%.*]], [[LOOP]] ]
-; CGSCC-NEXT:    [[I:%.*]] = phi i8 [ 0, [[ENTRY]] ], [ [[O:%.*]], [[LOOP]] ]
-; CGSCC-NEXT:    store i8 1, i8* [[P]], align 1
-; CGSCC-NEXT:    [[G]] = getelementptr i8, i8* [[P]], i64 1
-; CGSCC-NEXT:    [[O]] = add nsw i8 [[I]], 1
-; CGSCC-NEXT:    [[C:%.*]] = icmp eq i8 [[O]], 2
-; CGSCC-NEXT:    br i1 [[C]], label [[END:%.*]], label [[LOOP]]
-; CGSCC:       end:
-; CGSCC-NEXT:    [[S:%.*]] = getelementptr i8, i8* [[B]], i64 1
-; CGSCC-NEXT:    [[L:%.*]] = load i8, i8* [[S]], align 1
-; CGSCC-NEXT:    ret i8 [[L]]
+; CHECK: Function Attrs: nofree norecurse nosync nounwind willreturn memory(none)
+; CHECK-LABEL: define {{[^@]+}}@phi_store
+; CHECK-SAME: () #[[ATTR4]] {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[A:%.*]] = alloca i16, align 2
+; CHECK-NEXT:    [[B:%.*]] = bitcast i16* [[A]] to i8*
+; CHECK-NEXT:    br label [[LOOP:%.*]]
+; CHECK:       loop:
+; CHECK-NEXT:    [[P:%.*]] = phi i8* [ [[B]], [[ENTRY:%.*]] ], [ [[G:%.*]], [[LOOP]] ]
+; CHECK-NEXT:    [[I:%.*]] = phi i8 [ 0, [[ENTRY]] ], [ [[O:%.*]], [[LOOP]] ]
+; CHECK-NEXT:    store i8 1, i8* [[P]], align 1
+; CHECK-NEXT:    [[G]] = getelementptr i8, i8* [[P]], i64 1
+; CHECK-NEXT:    [[O]] = add nsw i8 [[I]], 1
+; CHECK-NEXT:    [[C:%.*]] = icmp eq i8 [[O]], 2
+; CHECK-NEXT:    br i1 [[C]], label [[END:%.*]], label [[LOOP]]
+; CHECK:       end:
+; CHECK-NEXT:    [[S:%.*]] = getelementptr i8, i8* [[B]], i64 1
+; CHECK-NEXT:    [[L:%.*]] = load i8, i8* [[S]], align 1
+; CHECK-NEXT:    ret i8 [[L]]
 ;
 entry:
   %a = alloca i16
   %b = bitcast i16* %a to i8*
   br label %loop
 loop:
   %p = phi i8* [%b, %entry], [%g, %loop]
   %i = phi i8 [0, %entry], [%o, %loop]