Index: lib/Transforms/Instrumentation/EfficiencySanitizer.cpp
===================================================================
--- lib/Transforms/Instrumentation/EfficiencySanitizer.cpp
+++ lib/Transforms/Instrumentation/EfficiencySanitizer.cpp
@@ -169,6 +169,20 @@
   bool instrumentLoadOrStore(Instruction *I, const DataLayout &DL);
   bool instrumentMemIntrinsic(MemIntrinsic *MI);
   bool instrumentGetElementPtr(Instruction *I, Module &M);
+  bool insertCounterUpdate(Instruction *I, StructType *StructTy,
+                           unsigned CounterIdx);
+  unsigned getFieldCounterIdx(StructType *StructTy) {
+    return 0;
+  }
+  unsigned getArrayCounterIdx(StructType *StructTy) {
+    return StructTy->getNumElements();
+  }
+  unsigned getStructCounterSize(StructType *StructTy) {
+    // The struct counter array includes:
+    // - one counter for each struct field,
+    // - one counter for the struct access within an array.
+    return (StructTy->getNumElements()/*field*/ + 1/*array*/);
+  }
   bool shouldIgnoreMemoryAccess(Instruction *I);
   int getMemoryAccessFuncIndex(Value *Addr, const DataLayout &DL);
   Value *appToShadow(Value *Shadow, IRBuilder<> &IRB);
@@ -317,12 +331,13 @@
   //   u32 NumFields;
   //   u32 *FieldOffsets;
   //   u32 *FieldSize;
-  //   u64 *FieldCounters;
   //   const char **FieldTypeNames;
+  //   u64 *FieldCounters;
+  //   u64 *ArrayCounter;
   // };
   auto *StructInfoTy =
     StructType::get(Int8PtrTy, Int32Ty, Int32Ty, Int32PtrTy, Int32PtrTy,
-                    Int64PtrTy, Int8PtrPtrTy, nullptr);
+                    Int8PtrPtrTy, Int64PtrTy, Int64PtrTy, nullptr);
   auto *StructInfoPtrTy = StructInfoTy->getPointerTo();
   // This structure should be kept consistent with the CacheFragInfo struct
   // in the runtime library.
@@ -351,11 +366,12 @@
     GlobalVariable *StructCounterName = createPrivateGlobalForString(
         M, CounterNameStr, /*AllowMerging*/true);
 
-    // FieldCounters.
+    // Counters.
     // We create the counter array with StructCounterName and weak linkage
     // so that the structs with the same name and layout from different
     // compilation units will be merged into one.
-    auto *CounterArrayTy = ArrayType::get(Int64Ty, StructTy->getNumElements());
+    auto *CounterArrayTy = ArrayType::get(Int64Ty,
+                                          getStructCounterSize(StructTy));
     GlobalVariable *Counters =
       new GlobalVariable(M, CounterArrayTy, false,
                          GlobalVariable::WeakAnyLinkage,
@@ -403,6 +419,14 @@
     Offsets->setInitializer(ConstantArray::get(OffsetArrayTy, OffsetVec));
     Size->setInitializer(ConstantArray::get(SizeArrayTy, SizeVec));
 
+    Constant *FieldCounterIdx[2];
+    FieldCounterIdx[0] = ConstantInt::get(Int32Ty, 0);
+    FieldCounterIdx[1] = ConstantInt::get(Int32Ty,
+                                          getFieldCounterIdx(StructTy));
+    Constant *ArrayCounterIdx[2];
+    ArrayCounterIdx[0] = ConstantInt::get(Int32Ty, 0);
+    ArrayCounterIdx[1] = ConstantInt::get(Int32Ty,
+                                          getArrayCounterIdx(StructTy));
     Initializers.push_back(
         ConstantStruct::get(
             StructInfoTy,
@@ -411,8 +435,11 @@
             ConstantInt::get(Int32Ty, StructTy->getNumElements()),
             ConstantExpr::getPointerCast(Offsets, Int32PtrTy),
             ConstantExpr::getPointerCast(Size, Int32PtrTy),
-            ConstantExpr::getPointerCast(Counters, Int64PtrTy),
             ConstantExpr::getPointerCast(TypeNames, Int8PtrPtrTy),
+            ConstantExpr::getGetElementPtr(CounterArrayTy, Counters,
+                                           FieldCounterIdx),
+            ConstantExpr::getGetElementPtr(CounterArrayTy, Counters,
+                                           ArrayCounterIdx),
             nullptr));
   }
   // Structs.
@@ -689,40 +716,43 @@
     return false;
   }
   Type *SourceTy = GepInst->getSourceElementType();
+  StructType *StructTy;
+  ConstantInt *Idx;
+  // Check if GEP calculates address from a struct array.
+  if (isa<StructType>(SourceTy)) {
+    StructTy = cast<StructType>(SourceTy);
+    Idx = dyn_cast<ConstantInt>(GepInst->getOperand(1));
+    if ((Idx == nullptr || Idx->getSExtValue() != 0) &&
+        !shouldIgnoreStructType(StructTy) && StructTyMap.count(StructTy) != 0)
+      Res |= insertCounterUpdate(I, StructTy, getArrayCounterIdx(StructTy));
+  }
   // Iterate all (except the first and the last) idx within each GEP instruction
   // for possible nested struct field address calculation.
   for (unsigned i = 1; i < GepInst->getNumIndices(); ++i) {
     SmallVector<Value *, 8> IdxVec(GepInst->idx_begin(),
                                    GepInst->idx_begin() + i);
-    StructType *StructTy = dyn_cast<StructType>(
-        GetElementPtrInst::getIndexedType(SourceTy, IdxVec));
-    if (StructTy == nullptr || shouldIgnoreStructType(StructTy) ||
-        StructTyMap.count(StructTy) == 0)
-      continue;
-    // Get the StructTy's subfield index.
-    ConstantInt *Idx = dyn_cast<ConstantInt>(GepInst->getOperand(i+1));
-    if (Idx == nullptr || Idx->getZExtValue() > StructTy->getNumElements())
-      continue;
-    GlobalVariable *CounterArray = StructTyMap[StructTy];
-    if (CounterArray == nullptr)
-      return false;
-    IRBuilder<> IRB(I);
-    Constant *Indices[2];
-    // Xref http://llvm.org/docs/LangRef.html#i-getelementptr and
-    // http://llvm.org/docs/GetElementPtr.html.
-    // The first index of the GEP instruction steps through the first operand,
-    // i.e., the array itself.
-    Indices[0] = ConstantInt::get(IRB.getInt32Ty(), 0);
-    // The second index is the index within the array.
-    Indices[1] = ConstantInt::get(IRB.getInt32Ty(), Idx->getZExtValue());
-    Constant *Counter =
-        ConstantExpr::getGetElementPtr(
-            ArrayType::get(IRB.getInt64Ty(), StructTy->getNumElements()),
-            CounterArray, Indices);
-    Value *Load = IRB.CreateLoad(Counter);
-    IRB.CreateStore(IRB.CreateAdd(Load, ConstantInt::get(IRB.getInt64Ty(), 1)),
-                    Counter);
-    Res = true;
+    Type *Ty = GetElementPtrInst::getIndexedType(SourceTy, IdxVec);
+    unsigned CounterIdx = 0;
+    if (isa<ArrayType>(Ty)) {
+      ArrayType *ArrayTy = cast<ArrayType>(Ty);
+      StructTy = dyn_cast<StructType>(ArrayTy->getElementType());
+      if (shouldIgnoreStructType(StructTy) || StructTyMap.count(StructTy) == 0)
+        continue;
+      // The last counter for struct array access.
+      CounterIdx = getArrayCounterIdx(StructTy);
+    } else if (isa<StructType>(Ty)) {
+      StructTy = cast<StructType>(Ty);
+      if (shouldIgnoreStructType(StructTy) || StructTyMap.count(StructTy) == 0)
+        continue;
+      // Get the StructTy's subfield index.
+      Idx = dyn_cast<ConstantInt>(GepInst->getOperand(i+1));
+      if (Idx == nullptr || Idx->getSExtValu() < 0)
+        continue;
+      CounterIdx = getFieldCounterIdx(StructTy) + Idx->getSExtValue();
+      if (CounterIdx >= StructTy->getNumElements())
+        continue;
+    }
+    Res |= insertCounterUpdate(I, StructTy, CounterIdx);
   }
   if (Res)
     ++NumInstrumentedGEPs;
@@ -731,6 +761,31 @@
   return Res;
 }
 
+bool EfficiencySanitizer::insertCounterUpdate(Instruction *I,
+                                              StructType *StructTy,
+                                              unsigned CounterIdx) {
+  GlobalVariable *CounterArray = StructTyMap[StructTy];
+  if (CounterArray == nullptr)
+    return false;
+  IRBuilder<> IRB(I);
+  Constant *Indices[2];
+  // Xref http://llvm.org/docs/LangRef.html#i-getelementptr and
+  // http://llvm.org/docs/GetElementPtr.html.
+  // The first index of the GEP instruction steps through the first operand,
+  // i.e., the array itself.
+  Indices[0] = ConstantInt::get(IRB.getInt32Ty(), 0);
+  // The second index is the index within the array.
+  Indices[1] = ConstantInt::get(IRB.getInt32Ty(), CounterIdx);
+  Constant *Counter =
+    ConstantExpr::getGetElementPtr(
+        ArrayType::get(IRB.getInt64Ty(), getStructCounterSize(StructTy)),
+        CounterArray, Indices);
+  Value *Load = IRB.CreateLoad(Counter);
+  IRB.CreateStore(IRB.CreateAdd(Load, ConstantInt::get(IRB.getInt64Ty(), 1)),
+                  Counter);
+  return true;
+}
+
 int EfficiencySanitizer::getMemoryAccessFuncIndex(Value *Addr,
                                                   const DataLayout &DL) {
   Type *OrigPtrTy = Addr->getType();
Index: test/Instrumentation/EfficiencySanitizer/struct_field_count_basic.ll
===================================================================
--- test/Instrumentation/EfficiencySanitizer/struct_field_count_basic.ll
+++ test/Instrumentation/EfficiencySanitizer/struct_field_count_basic.ll
@@ -10,20 +10,20 @@
 
 ; CHECK:        @0 = private unnamed_addr constant [8 x i8] c"<stdin>\00", align 1
 ; CHECK-NEXT:   @1 = private unnamed_addr constant [17 x i8] c"struct.A#2#11#11\00", align 1
-; CHECK-NEXT:   @"struct.A#2#11#11" = weak global [2 x i64] zeroinitializer
+; CHECK-NEXT:   @"struct.A#2#11#11" = weak global [3 x i64] zeroinitializer
 ; CHECK-NEXT:   @2 = internal constant [2 x i8*] [i8* getelementptr inbounds ([4 x i8], [4 x i8]* @5, i32 0, i32 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @6, i32 0, i32 0)]
 ; CHECK-NEXT:   @3 = internal constant [2 x i32] [i32 0, i32 4]
 ; CHECK-NEXT:   @4 = internal constant [2 x i32] [i32 4, i32 4]
 ; CHECK-NEXT:   @5 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @6 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @7 = private unnamed_addr constant [12 x i8] c"union.U#1#3\00", align 1
-; CHECK-NEXT:   @"union.U#1#3" = weak global [1 x i64] zeroinitializer
+; CHECK-NEXT:   @"union.U#1#3" = weak global [2 x i64] zeroinitializer
 ; CHECK-NEXT:   @8 = internal constant [1 x i8*] [i8* getelementptr inbounds ([7 x i8], [7 x i8]* @11, i32 0, i32 0)]
 ; CHECK-NEXT:   @9 = internal constant [1 x i32] zeroinitializer
 ; CHECK-NEXT:   @10 = internal constant [1 x i32] [i32 8]
 ; CHECK-NEXT:   @11 = private unnamed_addr constant [7 x i8] c"double\00", align 1
 ; CHECK-NEXT:   @12 = private unnamed_addr constant [20 x i8] c"struct.C#3#14#13#13\00", align 1
-; CHECK-NEXT:   @"struct.C#3#14#13#13" = weak global [3 x i64] zeroinitializer
+; CHECK-NEXT:   @"struct.C#3#14#13#13" = weak global [4 x i64] zeroinitializer
 ; CHECK-NEXT:   @13 = internal constant [3 x i8*] [i8* getelementptr inbounds ([33 x i8], [33 x i8]* @16, i32 0, i32 0), i8* getelementptr inbounds ([30 x i8], [30 x i8]* @17, i32 0, i32 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @18, i32 0, i32 0)]
 ; CHECK-NEXT:   @14 = internal constant [3 x i32] [i32 0, i32 8, i32 16]
 ; CHECK-NEXT:   @15 = internal constant [3 x i32] [i32 8, i32 8, i32 10]
@@ -31,20 +31,20 @@
 ; CHECK-NEXT:   @17 = private unnamed_addr constant [30 x i8] c"%union.anon = type { double }\00", align 1
 ; CHECK-NEXT:   @18 = private unnamed_addr constant [10 x i8] c"[10 x i8]\00", align 1
 ; CHECK-NEXT:   @19 = private unnamed_addr constant [20 x i8] c"struct.anon#2#11#11\00", align 1
-; CHECK-NEXT:   @"struct.anon#2#11#11" = weak global [2 x i64] zeroinitializer
+; CHECK-NEXT:   @"struct.anon#2#11#11" = weak global [3 x i64] zeroinitializer
 ; CHECK-NEXT:   @20 = internal constant [2 x i8*] [i8* getelementptr inbounds ([4 x i8], [4 x i8]* @23, i32 0, i32 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @24, i32 0, i32 0)]
 ; CHECK-NEXT:   @21 = internal constant [2 x i32] [i32 0, i32 4]
 ; CHECK-NEXT:   @22 = internal constant [2 x i32] [i32 4, i32 4]
 ; CHECK-NEXT:   @23 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @24 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @25 = private unnamed_addr constant [15 x i8] c"union.anon#1#3\00", align 1
-; CHECK-NEXT:   @"union.anon#1#3" = weak global [1 x i64] zeroinitializer
+; CHECK-NEXT:   @"union.anon#1#3" = weak global [2 x i64] zeroinitializer
 ; CHECK-NEXT:   @26 = internal constant [1 x i8*] [i8* getelementptr inbounds ([7 x i8], [7 x i8]* @29, i32 0, i32 0)]
 ; CHECK-NEXT:   @27 = internal constant [1 x i32] zeroinitializer
 ; CHECK-NEXT:   @28 = internal constant [1 x i32] [i32 8]
 ; CHECK-NEXT:   @29 = private unnamed_addr constant [7 x i8] c"double\00", align 1
-; CHECK-NEXT:   @30 = internal global [5 x { i8*, i32, i32, i32*, i32*, i64*, i8** }] [{ i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([17 x i8], [17 x i8]* @1, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @3, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @4, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @2, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([12 x i8], [12 x i8]* @7, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @9, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @10, i32 0, i32 0), i64* getelementptr inbounds ([1 x i64], [1 x i64]* @"union.U#1#3", i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @8, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @12, i32 0, i32 0), i32 32, i32 3, i32* getelementptr inbounds ([3 x i32], [3 x i32]* @14, i32 0, i32 0), i32* getelementptr inbounds ([3 x i32], [3 x i32]* @15, i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0), i8** getelementptr inbounds ([3 x i8*], [3 x i8*]* @13, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @19, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @21, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @22, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @20, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([15 x i8], [15 x i8]* @25, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @27, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @28, i32 0, i32 0), i64* getelementptr inbounds ([1 x i64], [1 x i64]* @"union.anon#1#3", i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @26, i32 0, i32 0) }]
-; CHECK-NEXT:   @31 = internal constant { i8*, i32, { i8*, i32, i32, i32*, i32*, i64*, i8** }* } { i8* getelementptr inbounds ([8 x i8], [8 x i8]* @0, i32 0, i32 0), i32 5, { i8*, i32, i32, i32*, i32*, i64*, i8** }* getelementptr inbounds ([5 x { i8*, i32, i32, i32*, i32*, i64*, i8** }], [5 x { i8*, i32, i32, i32*, i32*, i64*, i8** }]* @30, i32 0, i32 0) }
+; CHECK-NEXT:   @30 = internal global [5 x { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }] [{ i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([17 x i8], [17 x i8]* @1, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @3, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @4, i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @2, i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 2) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([12 x i8], [12 x i8]* @7, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @9, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @10, i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @8, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.U#1#3", i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.U#1#3", i32 0, i32 1) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @12, i32 0, i32 0), i32 32, i32 3, i32* getelementptr inbounds ([3 x i32], [3 x i32]* @14, i32 0, i32 0), i32* getelementptr inbounds ([3 x i32], [3 x i32]* @15, i32 0, i32 0), i8** getelementptr inbounds ([3 x i8*], [3 x i8*]* @13, i32 0, i32 0), i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0), i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @19, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @21, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @22, i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @20, i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 2) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([15 x i8], [15 x i8]* @25, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @27, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @28, i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @26, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.anon#1#3", i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.anon#1#3", i32 0, i32 1) }]
+; CHECK-NEXT:   @31 = internal constant { i8*, i32, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* } { i8* getelementptr inbounds ([8 x i8], [8 x i8]* @0, i32 0, i32 0), i32 5, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* getelementptr inbounds ([5 x { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }], [5 x { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }]* @30, i32 0, i32 0) }
 
 define i32 @main() {
 entry:
@@ -83,50 +83,65 @@
 ; CHECK-NEXT:   %u = alloca %union.U, align 8
 ; CHECK-NEXT:   %c = alloca [2 x %struct.C], align 16
 ; CHECK-NEXT:   %k = alloca %struct.A*, align 8
-; CHECK-NEXT:   %0 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   %0 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
 ; CHECK-NEXT:   %1 = add i64 %0, 1
-; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
 ; CHECK-NEXT:   %x = getelementptr inbounds %struct.A, %struct.A* %a, i32 0, i32 0
-; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
 ; CHECK-NEXT:   %3 = add i64 %2, 1
-; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
 ; CHECK-NEXT:   %y = getelementptr inbounds %struct.A, %struct.A* %a, i32 0, i32 1
 ; CHECK-NEXT:   %f = bitcast %union.U* %u to float*
 ; CHECK-NEXT:   %d = bitcast %union.U* %u to double*
-; CHECK-NEXT:   %arrayidx = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
-; CHECK-NEXT:   %4 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %4 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %5 = add i64 %4, 1
-; CHECK-NEXT:   store i64 %5, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
-; CHECK-NEXT:   %cs = getelementptr inbounds %struct.C, %struct.C* %arrayidx, i32 0, i32 0
-; CHECK-NEXT:   %6 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   store i64 %5, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %arrayidx = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
+; CHECK-NEXT:   %6 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
 ; CHECK-NEXT:   %7 = add i64 %6, 1
-; CHECK-NEXT:   store i64 %7, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   store i64 %7, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %cs = getelementptr inbounds %struct.C, %struct.C* %arrayidx, i32 0, i32 0
+; CHECK-NEXT:   %8 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   %9 = add i64 %8, 1
+; CHECK-NEXT:   store i64 %9, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
 ; CHECK-NEXT:   %x1 = getelementptr inbounds %struct.anon, %struct.anon* %cs, i32 0, i32 0
+; CHECK-NEXT:   %10 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %11 = add i64 %10, 1
+; CHECK-NEXT:   store i64 %11, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx2 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 1
-; CHECK-NEXT:   %8 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
-; CHECK-NEXT:   %9 = add i64 %8, 1
-; CHECK-NEXT:   store i64 %9, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %12 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %13 = add i64 %12, 1
+; CHECK-NEXT:   store i64 %13, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
 ; CHECK-NEXT:   %cs3 = getelementptr inbounds %struct.C, %struct.C* %arrayidx2, i32 0, i32 0
-; CHECK-NEXT:   %10 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
-; CHECK-NEXT:   %11 = add i64 %10, 1
-; CHECK-NEXT:   store i64 %11, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   %14 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   %15 = add i64 %14, 1
+; CHECK-NEXT:   store i64 %15, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
 ; CHECK-NEXT:   %y4 = getelementptr inbounds %struct.anon, %struct.anon* %cs3, i32 0, i32 1
+; CHECK-NEXT:   %16 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %17 = add i64 %16, 1
+; CHECK-NEXT:   store i64 %17, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx5 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
-; CHECK-NEXT:   %12 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
-; CHECK-NEXT:   %13 = add i64 %12, 1
-; CHECK-NEXT:   store i64 %13, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %18 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %19 = add i64 %18, 1
+; CHECK-NEXT:   store i64 %19, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
 ; CHECK-NEXT:   %cu = getelementptr inbounds %struct.C, %struct.C* %arrayidx5, i32 0, i32 1
 ; CHECK-NEXT:   %f6 = bitcast %union.anon* %cu to float*
+; CHECK-NEXT:   %20 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %21 = add i64 %20, 1
+; CHECK-NEXT:   store i64 %21, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx7 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 1
-; CHECK-NEXT:   %14 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
-; CHECK-NEXT:   %15 = add i64 %14, 1
-; CHECK-NEXT:   store i64 %15, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %22 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %23 = add i64 %22, 1
+; CHECK-NEXT:   store i64 %23, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
 ; CHECK-NEXT:   %cu8 = getelementptr inbounds %struct.C, %struct.C* %arrayidx7, i32 0, i32 1
 ; CHECK-NEXT:   %d9 = bitcast %union.anon* %cu8 to double*
+; CHECK-NEXT:   %24 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %25 = add i64 %24, 1
+; CHECK-NEXT:   store i64 %25, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx10 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
-; CHECK-NEXT:   %16 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
-; CHECK-NEXT:   %17 = add i64 %16, 1
-; CHECK-NEXT:   store i64 %17, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
+; CHECK-NEXT:   %26 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
+; CHECK-NEXT:   %27 = add i64 %26, 1
+; CHECK-NEXT:   store i64 %27, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
 ; CHECK-NEXT:   %c11 = getelementptr inbounds %struct.C, %struct.C* %arrayidx10, i32 0, i32 2
 ; CHECK-NEXT:   %arrayidx12 = getelementptr inbounds [10 x i8], [10 x i8]* %c11, i64 0, i64 2
 ; CHECK-NEXT:   %k1 = load %struct.A*, %struct.A** %k, align 8
@@ -137,6 +152,6 @@
 ; Top-level:
 
 ; CHECK: define internal void @esan.module_ctor()
-; CHECK: call void @__esan_init(i32 1, i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i64*, i8** }* }* @31 to i8*))
+; CHECK: call void @__esan_init(i32 1, i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* }* @31 to i8*))
 ; CHECK: define internal void @esan.module_dtor()
-; CHECK: call void @__esan_exit(i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i64*, i8** }* }* @31 to i8*))
+; CHECK: call void @__esan_exit(i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* }* @31 to i8*))
Index: test/Instrumentation/EfficiencySanitizer/struct_field_gep.ll
===================================================================
--- test/Instrumentation/EfficiencySanitizer/struct_field_gep.ll
+++ test/Instrumentation/EfficiencySanitizer/struct_field_gep.ll
@@ -28,11 +28,14 @@
   ret i32* %arrayidx
 }
 
-; CHECK:        %0 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
+; CHECK:        %0 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 3)
 ; CHECK-NEXT:   %1 = add i64 %0, 1
-; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
-; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
+; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 3)
+; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
 ; CHECK-NEXT:   %3 = add i64 %2, 1
-; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
+; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
+; CHECK-NEXT:   %4 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
+; CHECK-NEXT:   %5 = add i64 %4, 1
+; CHECK-NEXT:   store i64 %5, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
 ; CHECK-NEXT:   %arrayidx = getelementptr inbounds %struct.ST, %struct.ST* %s, i64 1, i32 2, i32 1, i64 5, i64 13
 ; CHECK-NEXT:   ret i32* %arrayidx