[SanitizerBinaryMetadata] Treat constant globals and non-escaping addresses specially

[melver]

Summary

For atomics metadata, we can make data race analysis more efficient by
entirely ignoring functions that include memory accesses but which only
access non-escaping (non-shared) and/or non-mutable memory. Such
functions will not be considered to be covered by "atomics" metadata,
resulting in the following benefits:

1. reduces "covered" metadata; and
2. allows data race analysis to skip such functions.

[dvyukov]

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

365

What if we pretend these are atomic as well?

[melver]

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

365

Marking things as atomic increases binary size. It's better to just not emit any metadata (less space used).

There are plenty function-local objects and if we mark all accesses to them as atomic, we'll end up with larger binaries.

Of course this will only help if all accesses in a function are non-escaping. If there's at least e.g. 1 global access, the function will end up being "covered" with atomics metadata again.

[dvyukov]

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

365

But I think it's highly-likely a function also contains non-local accesses (esp for optimized builds with inlining where functions tend to be larger).
Maybe we should skip functions that contain only atomics accesses and local/non-interesting accesses (contains at least 1 interesting access).

[melver]

Make it more efficient by ignoring both non-shared and non-mutable addresses.

[melver]

PTAL.

Reworked some things to make it more efficient in the presence of constant data accesses.

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

365

Changed it to look for shared+mutable.

So functions that access only non-escaping addresses and constant globals will be excluded entirely.

If a function is already covered by atomics metadata, constant globals will be considered atomic.

However, I think we still shouldn't pretend accesses to non-escaping memory are atomic because we'll increase binary size. Constant accesses should be relatively rare and can easily be optimized.

[dvyukov]

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

365

Why this difference between global consts and non-escaping memory? Doesn't treating global consts as atomics also increase metadata size?
We marked coverage accesses as atomic to avoid "false" positives. But we don't need to do this for global consts.
If for non-escaping accesses it's profitable not mark them as atomics, shouldn't we do the same for global consts as well?

[melver]

Don't pretend constant accesses are atomic if the function is "covered", so save on space.

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

365

Right, I think right now our biggest risk is binary size, so I'll change it to not add unnecessary atomics metadata.

compiler-rt/test/metadata/covered.cpp

 // RUN: %clangxx %s -o %t && %t | FileCheck %s
 // RUN: %clangxx %s -o %t -fexperimental-sanitize-metadata=covered && %t | FileCheck -check-prefix=CHECK-C %s
 // RUN: %clangxx %s -o %t -fexperimental-sanitize-metadata=atomics && %t | FileCheck -check-prefix=CHECK-A %s
 // RUN: %clangxx %s -o %t -fexperimental-sanitize-metadata=uar && %t | FileCheck -check-prefix=CHECK-U %s
 // RUN: %clangxx %s -o %t -fexperimental-sanitize-metadata=covered,atomics && %t | FileCheck -check-prefix=CHECK-CA %s
 // RUN: %clangxx %s -o %t -fexperimental-sanitize-metadata=covered,uar && %t | FileCheck -check-prefix=CHECK-CU %s
 // RUN: %clangxx %s -o %t -fexperimental-sanitize-metadata=atomics,uar && %t | FileCheck -check-prefix=CHECK-AU %s
 // RUN: %clangxx %s -o %t -fexperimental-sanitize-metadata=covered,atomics,uar && %t | FileCheck -check-prefix=CHECK-CAU %s
 
+const int const_global = 42;
+
 __attribute__((noinline, not_tail_called)) void escape(const volatile void *p) {
   static const volatile void *sink;
   sink = p;
 }
 
 // CHECK-NOT: metadata add
 // CHECK: main
 // CHECK-NOT: metadata del
 
 // CHECK-C:      empty: features=0
 // CHECK-A-NOT:  empty:
 // CHECK-U-NOT:  empty:
-// CHECK-CA:     empty: features=1
+// CHECK-CA:     empty: features=0
 // CHECK-CU:     empty: features=0
 // CHECK-AU-NOT: empty:
-// CHECK-CAU:    empty: features=1
+// CHECK-CAU:    empty: features=0
 void empty() {}
 
 // CHECK-C:  normal: features=0
 // CHECK-A:  normal: features=1
 // CHECK-U:  normal: features=2
 // CHECK-CA: normal: features=1
 // CHECK-CU: normal: features=2
 // CHECK-AU: normal: features=3
 // CHECK-CAU:normal: features=3
 void normal() {
   int x;
   escape(&x);
 }
 
+// CHECK-C:      with_const_global: features=0
+// CHECK-A-NOT:  with_const_global:
+// CHECK-U-NOT:  with_const_global:
+// CHECK-CA:     with_const_global: features=0
+// CHECK-CU:     with_const_global: features=0
+// CHECK-AU-NOT: with_const_global:
+// CHECK-CAU:    with_const_global: features=0
+int with_const_global() { return *((const volatile int *)&const_global); }
+
 // CHECK-C:     with_atomic: features=0
 // CHECK-A:     with_atomic: features=1
 // CHECK-U-NOT: with_atomic:
 // CHECK-CA:    with_atomic: features=1
 // CHECK-CU:    with_atomic: features=0
 // CHECK-AU:    with_atomic: features=1
 // CHECK-CAU:   with_atomic: features=1
 int with_atomic(int *p) { return __atomic_load_n(p, __ATOMIC_RELAXED); }

 int ellipsis_with_atomic(int *p, ...) {
   escape(&p);
   return __atomic_load_n(p, __ATOMIC_RELAXED);
 }
 
 #define FUNCTIONS                                                              \
   FN(empty);                                                                   \
   FN(normal);                                                                  \
+  FN(with_const_global);                                                       \
   FN(with_atomic);                                                             \
   FN(with_atomic_escape);                                                      \
   FN(ellipsis);                                                                \
   FN(ellipsis_with_atomic);                                                    \
   /**/
 
 #include "common.h"

llvm/include/llvm/Transforms/Instrumentation/SanitizerBinaryMetadata.h

struct SanitizerBinaryMetadataOptions {
   bool Atomics = false;
   bool UAR = false;
   SanitizerBinaryMetadataOptions() = default;
 };
 
 inline constexpr int kSanitizerBinaryMetadataAtomicsBit = 0;
 inline constexpr int kSanitizerBinaryMetadataUARBit = 1;
 
-inline constexpr uint32_t kSanitizerBinaryMetadataNone = 0;
 inline constexpr uint32_t kSanitizerBinaryMetadataAtomics =
     1 << kSanitizerBinaryMetadataAtomicsBit;
 inline constexpr uint32_t kSanitizerBinaryMetadataUAR =
     1 << kSanitizerBinaryMetadataUARBit;
 
 inline constexpr char kSanitizerBinaryMetadataCoveredSection[] =
     "sanmd_covered";
 inline constexpr char kSanitizerBinaryMetadataAtomicsSection[] =

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

 
 #include "llvm/Transforms/Instrumentation/SanitizerBinaryMetadata.h"
 #include "llvm/ADT/SetVector.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/ADT/Twine.h"
+#include "llvm/Analysis/CaptureTracking.h"
+#include "llvm/Analysis/ValueTracking.h"
 #include "llvm/IR/Constant.h"
 #include "llvm/IR/DerivedTypes.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/GlobalValue.h"
 #include "llvm/IR/GlobalVariable.h"
 #include "llvm/IR/IRBuilder.h"
 #include "llvm/IR/Instruction.h"
 #include "llvm/IR/Instructions.h"

 constexpr int kCtorDtorPriority = 2;
 
 // Pairs of names of initialization callback functions and which section
 // contains the relevant metadata.
 class MetadataInfo {
 public:
   const StringRef FunctionPrefix;
   const StringRef SectionSuffix;
-  const uint32_t FeatureMask;
 
   static const MetadataInfo Covered;
   static const MetadataInfo Atomics;
 
 private:
   // Forbid construction elsewhere.
   explicit constexpr MetadataInfo(StringRef FunctionPrefix,
-                                  StringRef SectionSuffix, uint32_t Feature)
-      : FunctionPrefix(FunctionPrefix), SectionSuffix(SectionSuffix),
-        FeatureMask(Feature) {}
+                                  StringRef SectionSuffix)
+      : FunctionPrefix(FunctionPrefix), SectionSuffix(SectionSuffix) {}
 };
-const MetadataInfo MetadataInfo::Covered{"__sanitizer_metadata_covered",
-                                         kSanitizerBinaryMetadataCoveredSection,
-                                         kSanitizerBinaryMetadataNone};
-const MetadataInfo MetadataInfo::Atomics{"__sanitizer_metadata_atomics",
-                                         kSanitizerBinaryMetadataAtomicsSection,
-                                         kSanitizerBinaryMetadataAtomics};
+const MetadataInfo MetadataInfo::Covered{
+    "__sanitizer_metadata_covered", kSanitizerBinaryMetadataCoveredSection};
+const MetadataInfo MetadataInfo::Atomics{
+    "__sanitizer_metadata_atomics", kSanitizerBinaryMetadataAtomicsSection};
 
 // The only instances of MetadataInfo are the constants above, so a set of
 // them may simply store pointers to them. To deterministically generate code,
 // we need to use a set with stable iteration order, such as SetVector.
 using MetadataInfoSet = SetVector<const MetadataInfo *>;
 
 //===--- Command-line options ---------------------------------------------===//
 
SanitizerBinaryMetadata(Module &M, SanitizerBinaryMetadataOptions Opts)
         TargetTriple(M.getTargetTriple()), IRB(M.getContext()) {
     // FIXME: Make it work with other formats.
     assert(TargetTriple.isOSBinFormatELF() && "ELF only");
   }
 
   bool run();
 
 private:
-  // Return enabled feature mask of per-instruction metadata.
-  uint32_t getEnabledPerInstructionFeature() const {
-    uint32_t FeatureMask = 0;
-    if (Options.Atomics)
-      FeatureMask |= MetadataInfo::Atomics.FeatureMask;
-    return FeatureMask;
-  }
-
   uint32_t getVersion() const {
     uint32_t Version = kVersionBase;
     const auto CM = Mod.getCodeModel();
     if (CM.has_value() && (*CM == CodeModel::Medium || *CM == CodeModel::Large))
       Version |= kVersionPtrSizeRel;
     return Version;
   }
 
private:
 
   // Returns the section start marker name.
   Twine getSectionStart(StringRef SectionSuffix);
 
   // Returns the section end marker name.
   Twine getSectionEnd(StringRef SectionSuffix);
 
   // Returns true if the access to the address should be considered "atomic".
-  bool pretendAtomicAccess(Value *Addr);
+  bool pretendAtomicAccess(const Value *Addr);
 
   Module &Mod;
   const SanitizerBinaryMetadataOptions Options;
   const Triple TargetTriple;
   IRBuilder<> IRB;
 };
 
 bool SanitizerBinaryMetadata::run() {
void SanitizerBinaryMetadata::runOn(Function &F, MetadataInfoSet &MIS) {
   // Don't touch available_externally functions, their actual body is elsewhere.
   if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage)
     return;
 
   MDBuilder MDB(F.getContext());
 
   // The metadata features enabled for this function, stored along covered
   // metadata (if enabled).
-  uint32_t FeatureMask = getEnabledPerInstructionFeature();
+  uint32_t FeatureMask = 0;
   // Don't emit unnecessary covered metadata for all functions to save space.
   bool RequiresCovered = false;
-  // We can only understand if we need to set UAR feature after looking
-  // at the instructions. So we need to check instructions even if FeatureMask
-  // is empty.
-  if (FeatureMask || Options.UAR) {
+
+  if (Options.Atomics || Options.UAR) {
     for (BasicBlock &BB : F)
       for (Instruction &I : BB)
         RequiresCovered |= runOn(I, MIS, MDB, FeatureMask);
   }
 
   if (F.isVarArg())
     FeatureMask &= ~kSanitizerBinaryMetadataUAR;
   if (FeatureMask & kSanitizerBinaryMetadataUAR) {
bool useAfterReturnUnsafe(Instruction &I) {
   // Tail-called functions are not necessary intercepted
   // at runtime because there is no call instruction.
   // So conservatively mark the caller as requiring checking.
   else if (auto *CI = dyn_cast<CallInst>(&I))
     return CI->isTailCall() && !isUARSafeCall(CI);
   return false;
 }
 
-bool SanitizerBinaryMetadata::pretendAtomicAccess(Value *Addr) {
-  assert(Addr && "Expected non-null Addr");
+bool SanitizerBinaryMetadata::pretendAtomicAccess(const Value *Addr) {
+  if (!Addr)
+    return false;
 
   Addr = Addr->stripInBoundsOffsets();
   auto *GV = dyn_cast<GlobalVariable>(Addr);
   if (!GV)
     return false;
 
+  // Some compiler-generated accesses are known racy, to avoid false positives
+  // in data-race analysis pretend they're atomic.
   if (GV->hasSection()) {
     const auto OF = Triple(Mod.getTargetTriple()).getObjectFormat();
     const auto ProfSec =
         getInstrProfSectionName(IPSK_cnts, OF, /*AddSegmentInfo=*/false);
     if (GV->getSection().endswith(ProfSec))
       return true;
   }
-
   if (GV->getName().startswith("__llvm_gcov") ||
       GV->getName().startswith("__llvm_gcda"))
     return true;
 
   return false;
 }
 
+// Returns true if the memory at `Addr` may be shared with other threads.
+bool maybeSharedMutable(const Value *Addr) {
+  // By default assume memory may be shared.
+  if (!Addr)
+    return true;
+
+  if (isa<AllocaInst>(getUnderlyingObject(Addr)) &&
+      !PointerMayBeCaptured(Addr, true, true))
+    return false; // Object is on stack but does not escape.
+
+  Addr = Addr->stripInBoundsOffsets();
+  if (auto *GV = dyn_cast<GlobalVariable>(Addr)) {
+    if (GV->isConstant())
+      return false; // Shared, but not mutable.
+  }
+
+  return true;
+}
+
 bool SanitizerBinaryMetadata::runOn(Instruction &I, MetadataInfoSet &MIS,
                                     MDBuilder &MDB, uint32_t &FeatureMask) {
   SmallVector<const MetadataInfo *, 1> InstMetadata;
   bool RequiresCovered = false;
 
+  // Only call if at least 1 type of metadata is requested.
+  assert(Options.UAR || Options.Atomics);
+
   if (Options.UAR && !(FeatureMask & kSanitizerBinaryMetadataUAR)) {
     if (useAfterReturnUnsafe(I))
       FeatureMask |= kSanitizerBinaryMetadataUAR;
   }
 
-  if (Options.Atomics && I.mayReadOrWriteMemory()) {
-    auto SSID = getAtomicSyncScopeID(&I);
-    bool IsAtomic = SSID.has_value() && *SSID != SyncScope::SingleThread;
-
-    if (!IsAtomic) {
-      // Check to pretend some compiler-generated accesses are atomic, to avoid
-      // false positives in data-race analysis.
-      Value *Addr = nullptr;
-      if (auto *SI = dyn_cast<StoreInst>(&I))
-        Addr = SI->getPointerOperand();
-      else if (auto *LI = dyn_cast<LoadInst>(&I))
-        Addr = LI->getPointerOperand();
-      if (Addr)
-        IsAtomic = pretendAtomicAccess(Addr);
-    }
+  if (Options.Atomics) {
+    const Value *Addr = nullptr;
 
-    if (IsAtomic) {
+    if (I.mayReadOrWriteMemory() && maybeSharedMutable(Addr)) {
+      auto SSID = getAtomicSyncScopeID(&I);
+      if ((SSID.has_value() && *SSID != SyncScope::SingleThread) ||
+          pretendAtomicAccess(Addr)) {
         NumMetadataAtomics++;
         InstMetadata.push_back(&MetadataInfo::Atomics);
       }
+      FeatureMask |= kSanitizerBinaryMetadataAtomics;
       RequiresCovered = true;
     }
+  }
 
   // Attach MD_pcsections to instruction.
   if (!InstMetadata.empty()) {
     MIS.insert(InstMetadata.begin(), InstMetadata.end());
     SmallVector<MDBuilder::PCSection, 1> Sections;
     for (const auto &MI : InstMetadata)
       Sections.push_back({getSectionName(MI->SectionSuffix), {}});
     I.setMetadata(LLVMContext::MD_pcsections, MDB.createPCSections(Sections));

llvm/test/Instrumentation/SanitizerBinaryMetadata/pretend-atomic-access.ll

-; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --function-signature
 ; RUN: opt < %s -passes='module(sanmd-module)' -sanitizer-metadata-atomics -S | FileCheck %s
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 @__profc_test_gep = private global [1 x i64] zeroinitializer, section "__llvm_prf_cnts", align 8
 @__profc_test_bitcast = private global [2 x i64] zeroinitializer, section "__llvm_prf_cnts", align 8
 @__profc_test_bitcast_foo = private global [1 x i64] zeroinitializer, section "__llvm_prf_cnts", align 8
 
 @__llvm_gcov_ctr = internal global [1 x i64] zeroinitializer
 @__llvm_gcov_ctr.1 = internal global [1 x i64] zeroinitializer
 @__llvm_gcov_global_state_pred = internal global i32 0
 @__llvm_gcda_foo = internal global i32 0
 
-define i32 @test_gep() sanitize_thread {
-; CHECK-LABEL: @test_gep(
+define i32 @test_gep() {
+; CHECK-LABEL: define {{[^@]+}}@test_gep() !pcsections !0 {
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[PGOCOUNT:%.*]] = load i64, ptr @__profc_test_gep, align 8, !pcsections !2
 ; CHECK-NEXT:    [[TMP0:%.*]] = add i64 [[PGOCOUNT]], 1
 ; CHECK-NEXT:    store i64 [[TMP0]], ptr @__profc_test_gep, align 8, !pcsections !2
 ; CHECK-NEXT:    [[GCOVCOUNT:%.*]] = load i64, ptr @__llvm_gcov_ctr, align 8, !pcsections !2
 ; CHECK-NEXT:    [[TMP1:%.*]] = add i64 [[GCOVCOUNT]], 1
 ; CHECK-NEXT:    store i64 [[TMP1]], ptr @__llvm_gcov_ctr, align 8, !pcsections !2
 ; CHECK-NEXT:    [[GCOVCOUNT_1:%.*]] = load i64, ptr @__llvm_gcov_ctr.1, align 8, !pcsections !2
entry:
 
   %gcovcount.1 = load i64, ptr @__llvm_gcov_ctr.1
   %2 = add i64 %gcovcount.1, 1
   store i64 %2, ptr @__llvm_gcov_ctr.1
 
   ret i32 1
 }
 
-define i32 @test_bitcast() sanitize_thread {
-; CHECK-LABEL: @test_bitcast(
+define i32 @test_bitcast() {
+; CHECK-LABEL: define {{[^@]+}}@test_bitcast() !pcsections !0 {
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[TMP0:%.*]] = load <2 x i64>, ptr @__profc_test_bitcast, align 8, !pcsections !2
 ; CHECK-NEXT:    [[DOTPROMOTED5:%.*]] = load i64, ptr @__profc_test_bitcast_foo, align 8, !pcsections !2
 ; CHECK-NEXT:    [[TMP1:%.*]] = add i64 [[DOTPROMOTED5]], 10
 ; CHECK-NEXT:    [[TMP2:%.*]] = add <2 x i64> [[TMP0]], <i64 1, i64 10>
 ; CHECK-NEXT:    store <2 x i64> [[TMP2]], ptr @__profc_test_bitcast, align 8, !pcsections !2
 ; CHECK-NEXT:    store i64 [[TMP1]], ptr @__profc_test_bitcast_foo, align 8, !pcsections !2
 ; CHECK-NEXT:    ret i32 undef
 ;
 entry:
   %0 = load <2 x i64>, ptr @__profc_test_bitcast, align 8
   %.promoted5 = load i64, ptr @__profc_test_bitcast_foo, align 8
   %1 = add i64 %.promoted5, 10
   %2 = add <2 x i64> %0, <i64 1, i64 10>
   store <2 x i64> %2, ptr @__profc_test_bitcast, align 8
   store i64 %1, ptr @__profc_test_bitcast_foo, align 8
   ret i32 undef
 }
 
-define void @test_load() sanitize_thread {
-; CHECK-LABEL: @test_load(
+define void @test_load() {
+; CHECK-LABEL: define {{[^@]+}}@test_load() !pcsections !0 {
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[TMP0:%.*]] = load i32, ptr @__llvm_gcov_global_state_pred, align 4, !pcsections !2
 ; CHECK-NEXT:    store i32 1, ptr @__llvm_gcov_global_state_pred, align 4, !pcsections !2
 ; CHECK-NEXT:    [[TMP1:%.*]] = load i32, ptr @__llvm_gcda_foo, align 4, !pcsections !2
 ; CHECK-NEXT:    store i32 1, ptr @__llvm_gcda_foo, align 4, !pcsections !2
 ; CHECK-NEXT:    ret void
 ;
 entry:
   %0 = load i32, ptr @__llvm_gcov_global_state_pred
   store i32 1, ptr @__llvm_gcov_global_state_pred
 
   %1 = load i32, ptr @__llvm_gcda_foo
   store i32 1, ptr @__llvm_gcda_foo
 
   ret void
 }

llvm/test/Instrumentation/SanitizerBinaryMetadata/shared-mutable.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --function-signature
+; RUN: opt < %s -passes='module(sanmd-module)' -sanitizer-metadata-atomics -S | FileCheck %s
+
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare void @escape(ptr)
+
+@sink = global ptr null, align 4
+@const_global = external constant i32
+@non_const_global = global i32 0, align 4
+@const_global_array = external constant [10 x i32]
+
+define i32 @notcaptured() {
+; CHECK-LABEL: define {{[^@]+}}@notcaptured() {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[PTR:%.*]] = alloca i32, align 4
+; CHECK-NEXT:    store i32 42, ptr [[PTR]], align 4
+; CHECK-NEXT:    [[TMP:%.*]] = load i32, ptr [[PTR]], align 4
+; CHECK-NEXT:    ret i32 [[TMP]]
+;
+entry:
+  %ptr = alloca i32, align 4
+  store i32 42, ptr %ptr, align 4
+  %tmp = load i32, ptr %ptr, align 4
+  ret i32 %tmp
+}
+
+define void @captured0() {
+; CHECK-LABEL: define {{[^@]+}}@captured0() !pcsections !0 {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[PTR:%.*]] = alloca i32, align 4
+; CHECK-NEXT:    call void @escape(ptr [[PTR]])
+; CHECK-NEXT:    store i32 42, ptr [[PTR]], align 4
+; CHECK-NEXT:    ret void
+;
+entry:
+  %ptr = alloca i32, align 4
+  ; escapes due to call
+  call void @escape(ptr %ptr)
+  store i32 42, ptr %ptr, align 4
+  ret void
+}
+
+define void @captured1() {
+; CHECK-LABEL: define {{[^@]+}}@captured1() !pcsections !0 {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[PTR:%.*]] = alloca i32, align 4
+; CHECK-NEXT:    store ptr [[PTR]], ptr @sink, align 8
+; CHECK-NEXT:    store i32 42, ptr [[PTR]], align 4
+; CHECK-NEXT:    ret void
+;
+entry:
+  %ptr = alloca i32, align 4
+  ; escapes due to store into global
+  store ptr %ptr, ptr @sink, align 8
+  store i32 42, ptr %ptr, align 4
+  ret void
+}
+
+define void @captured2() {
+; CHECK-LABEL: define {{[^@]+}}@captured2() !pcsections !0 {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[PTR:%.*]] = alloca i32, align 4
+; CHECK-NEXT:    [[TMP:%.*]] = alloca ptr, align 8
+; CHECK-NEXT:    store ptr [[PTR]], ptr [[TMP]], align 8
+; CHECK-NEXT:    [[TMP0:%.*]] = load ptr, ptr [[TMP]], align 8
+; CHECK-NEXT:    store ptr [[TMP0]], ptr @sink, align 8
+; CHECK-NEXT:    store i32 42, ptr [[PTR]], align 4
+; CHECK-NEXT:    ret void
+;
+entry:
+  %ptr = alloca i32, align 4
+  %tmp = alloca ptr, align 8
+  ; transitive escape
+  store ptr %ptr, ptr %tmp, align 8
+  %0 = load ptr, ptr %tmp, align 8
+  store ptr %0, ptr @sink, align 8
+  store i32 42, ptr %ptr, align 4
+  ret void
+}
+
+define i32 @read_from_const_global() {
+; CHECK-LABEL: define {{[^@]+}}@read_from_const_global() {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[TMP0:%.*]] = load i32, ptr @const_global, align 4
+; CHECK-NEXT:    ret i32 [[TMP0]]
+;
+entry:
+  %0 = load i32, ptr @const_global, align 4
+  ret i32 %0
+}
+
+define i32 @read_from_non_const_global() {
+; CHECK-LABEL: define {{[^@]+}}@read_from_non_const_global() !pcsections !0 {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[TMP0:%.*]] = load i32, ptr @non_const_global, align 4
+; CHECK-NEXT:    ret i32 [[TMP0]]
+;
+entry:
+  %0 = load i32, ptr @non_const_global, align 4
+  ret i32 %0
+}
+
+define i32 @read_from_const_global_array(i32 %idx) {
+; CHECK-LABEL: define {{[^@]+}}@read_from_const_global_array
+; CHECK-SAME: (i32 [[IDX:%.*]]) {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[IDXPROM:%.*]] = sext i32 [[IDX]] to i64
+; CHECK-NEXT:    [[ARRAYIDX:%.*]] = getelementptr inbounds [10 x i32], ptr @const_global_array, i64 0, i64 [[IDXPROM]]
+; CHECK-NEXT:    [[TMP0:%.*]] = load i32, ptr [[ARRAYIDX]], align 4
+; CHECK-NEXT:    ret i32 [[TMP0]]
+;
+entry:
+  %idxprom = sext i32 %idx to i64
+  %arrayidx = getelementptr inbounds [10 x i32], ptr @const_global_array, i64 0, i64 %idxprom
+  %0 = load i32, ptr %arrayidx, align 4
+  ret i32 %0
+}
+
+define i32 @notcaptured_and_global_access() {
+; CHECK-LABEL: define {{[^@]+}}@notcaptured_and_global_access() !pcsections !0 {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[PTR:%.*]] = alloca i32, align 4
+; CHECK-NEXT:    [[A:%.*]] = load i32, ptr @non_const_global, align 4
+; CHECK-NEXT:    store i32 [[A]], ptr [[PTR]], align 4
+; CHECK-NEXT:    [[B:%.*]] = load i32, ptr [[PTR]], align 4
+; CHECK-NEXT:    ret i32 [[B]]
+;
+entry:
+  %ptr = alloca i32, align 4
+  %a = load i32, ptr @non_const_global, align 4
+  store i32 %a, ptr %ptr, align 4
+  %b = load i32, ptr %ptr, align 4
+  ret i32 %b
+}
+
+define i32 @notcaptured_and_const_global_access() {
+; CHECK-LABEL: define {{[^@]+}}@notcaptured_and_const_global_access() {
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[PTR:%.*]] = alloca i32, align 4
+; CHECK-NEXT:    [[A:%.*]] = load i32, ptr @const_global, align 4
+; CHECK-NEXT:    store i32 [[A]], ptr [[PTR]], align 4
+; CHECK-NEXT:    [[B:%.*]] = load i32, ptr [[PTR]], align 4
+; CHECK-NEXT:    ret i32 [[B]]
+;
+entry:
+  %ptr = alloca i32, align 4
+  %a = load i32, ptr @const_global, align 4
+  store i32 %a, ptr %ptr, align 4
+  %b = load i32, ptr %ptr, align 4
+  ret i32 %b
+}