[CodeGen] Don't emit lifetime intrinsics for some local variables

[vitalybuka]

Summary

Current generation of lifetime intrinsics does not handle cases like:

{
  char x;
l1:
  bar(&x, 1);
}
goto l1;

We will get code like this:

  %x = alloca i8, align 1
  call void @llvm.lifetime.start(i64 1, i8* nonnull %x)
  br label %l1
l1:
  %call = call i32 @bar(i8* nonnull %x, i32 1)
  call void @llvm.lifetime.end(i64 1, i8* nonnull %x)
  br label %l1

So the second time bar was called for x which is marked as dead.
Lifetime markers here are misleading so it's better to remove them at all.
This type of bypasses are rare, e.g. code detects just 8 functions building
clang (2329 targets).

PR28267

[vitalybuka]

Rebase on D24695

[eugenis]

lib/CodeGen/VarBypassDetector.h

50 ↗

(On Diff #71721)

rename to smth like StartFunction()?
add some API documentation.

[ahatanak]

Can you add some test cases?

[ahatanak]

It looks like the test case was removed when this patch we rebased.

[vitalybuka]

The patch was split in two and I moved the test into the wrong one. I'll fix this.

[vitalybuka]

recovered test

[vitalybuka]

Test

[ahatanak]

Do we want to remove lifetime intrinsics when we aren't doing the asan-use-after-scope check? Since this isn't a mis-compile caused by inaccurate lifetime intrinsics, I was wondering whether we should do this only when asan-use-after-scope is on to minimize the impact on compile time.

[vitalybuka]

Intrinsics are invalid there, code is generated in such way that variable is being accessed after lifetime.end.
I suspect that optimizer can make invalid code because of this, but I can't reproduce.
So I think it's safer to remove them at all and don't wait for miscompile reports.

Still if performance is greater concern than potential miscompiles, I can limit this only to asan-use-after-scope.

[majnemer]

In D24693#548739, @ahatanak wrote:

Do we want to remove lifetime intrinsics when we aren't doing the asan-use-after-scope check? Since this isn't a mis-compile caused by inaccurate lifetime intrinsics, I was wondering whether we should do this only when asan-use-after-scope is on to minimize the impact on compile time.

This doesn't sound right. Given the example in the description, we are accessing the memory location after end has been called: this seems like a real miscompile. It would appear unsafe to only do this for asan.

[ahatanak]

In D24693#549095, @majnemer wrote:

This doesn't sound right. Given the example in the description, we are accessing the memory location after end has been called: this seems like a real miscompile. It would appear unsafe to only do this for asan.

My impression was that this wasn't a miscompile, but I'm not so sure now. Do you have a concrete example where any of the optimization passes miscompile the code like that shown in PR28267 because of missing or misplaced lifetime intrinsics? I spent some time looking at how StackColoring (which is the primary user of this intrinsic) transforms the code in PR28267, and it didn't look like this would cause any miscompile (it seemed like it was able to compute the lifetime interval for %tmp correctly). I'm not sure whether other optimization passes are handling it correctly though.

[vitalybuka]

Miscompile.
Here assert fails without the patch.

int* p1;
int* p2;

int use2() {
  assert(p1 != p2 || !"reuse");
  return p1 == p2;
}

void f3(int cond) {
  {
    int tmp[1024];
    p1 = tmp;
    goto l2;
  l1:
    int tmp2[1024];
    p2 = tmp2;
    exit(use2());
  }
 l2:
  goto l1;
}

[ahatanak]

Thank you for the great example! I can now see this patch does fix mis-compiles.

There are probably other lifetime bugs you'll see when the code being compiled includes gotos that jump past variable declarations, including the one here: http://lists.llvm.org/pipermail/cfe-dev/2016-July/050066.html. Do you think you can extend the approach taken in this patch to prevent mis-compiles for those too?

Also, rather than removing the intrinsics altogether, have you considered making changes to IRGen to insert them to different locations or insert extra lifetime.starts? In your example, if I insert lifetime.start for "tmp" at the beginning of label "l1", it doesn't assert. I made the same changes for the example I sent to cfe-dev, but it didn't work because DSE removed the store to "i" (if I disable DSE, I see the expected result).

[vitalybuka]

In D24693#550119, @ahatanak wrote:

Thank you for the great example! I can now see this patch does fix mis-compiles.

There are probably other lifetime bugs you'll see when the code being compiled includes gotos that jump past variable declarations, including the one here: http://lists.llvm.org/pipermail/cfe-dev/2016-July/050066.html. Do you think you can extend the approach taken in this patch to prevent mis-compiles for those too?

This probably can be extended to this case, but I'd prefer to do this in separate patch later.

Also, rather than removing the intrinsics altogether, have you considered making changes to IRGen to insert them to different locations or insert extra lifetime.starts?

I can see how to insert starts, e.g. on every label which bypass declaration, but I am not sure where to put ends.
Probably it's possible, but patch will be significantly more complicated. I'd prefer to do so only when needed.
This is infrequent usecase, so it's probably not worth of additional complexity.

[ahatanak]

In D24693#551050, @vitalybuka wrote:

I can see how to insert starts, e.g. on every label which bypass declaration, but I am not sure where to put ends.
Probably it's possible, but patch will be significantly more complicated. I'd prefer to do so only when needed.
This is infrequent usecase, so it's probably not worth of additional complexity.

I think the right long term solution is to have IRGen emit tighter lifetime ranges, but I don't have a solution that I know would always work correctly. That might require rethinking the design of lifetime intrinsics.

[rsmith]

Before we start with heroics here, we should consider whether the LLVM intrinsics are actually specified the right way. The current specification does the wrong thing for even trivial cases, such as a variable declared within a loop, so there's some impedance mismatch between the specification and how Clang uses the intrinsics, even with this patch applied. Can we get some clarity on how these intrinsics are *actually* supposed to work? (Is it permitted to have multiple start+end regions for the same alloca, or do we need to suppress them inside loops too? What happens if we have multiple starts but no ends?)

[vitalybuka]

My assumption is that "start" makes access valid, and "end" makes access invalid, up to the next "start".
I see no problems with loops and multiple regions, as soon as access is happening between "start" and "end". Loops always call "start" for nested alloca on each iteration and call "end" on iteration cleanup. And this makes sense as it's a new variable every iteration, just stored in the same alloca. For my application I assume that variable is accessible right after the first start, and invalid after the first "end". So no problems with multiple starts.
I see no cases other then this "goto" issues where clang behaves differently.

This patch addresses issues were the last intrinsic before access was "end":
call start, ... call end, ...access
or only the end: entry, ... call end, ... access

[vitalybuka]

rebase

[eugenis]

In D24693#553474, @vitalybuka wrote:

My assumption is that "start" makes access valid, and "end" makes access invalid, up to the next "start".

That's also my understanding, but LangRef does not say anything about llvm.lifetime.start cancelling the effects of llvm.lifetime.end.

llvm.lifetime.end:
Any stores into the memory object following this intrinsic may be removed as dead.

[rsmith]

I'm concerned about the complexity of this approach; it's hard for me to be confident that BuildScopeInformation is correct and will remain correct in the presence of future changes to the AST, and if it's not, we'll potentially silently miscompile.

A simpler but less precise approach would be to disable lifetime markers for all variables for which it is possible to jump into their scope (that is, in C++, variables of suitably-trivial types with no explicit initializer, and in C, variables of non-variably-modified type) whose scopes contain any kind of label. I'd have a lot more confidence that such an approach would be -- and would remain -- correct.

I'd also like to see some tests for indirectbrs (computed goto) since they're the case where we would have the most trouble producing the correct set of lifetime markers.

On the other hand, for ASan's purposes, we really want a precise set of markers here. If we can determine the set of variables brought into scope by each goto/computed goto/switch branch that we emit, we can split the edge or (for an unsplittable edge) insert a conditional branch into the destination block to call the lifetime start intrinsic. This would require CodeGen to track the set of live variables and store it for each such branch and branch target so that we can refer to it when fixing up the relevant edge, but that doesn't seem prohibitively expensive, and it would avoid any cost in the common case of a function containing no branches and no branch targets.

[rsmith]

OK, so it seems like all the other approaches we discussed have problems too. Let's move forward with this for now.

Is there some reasonable base set of functionality between this and JumpDiagnostics that could be factored out and shared?

lib/CodeGen/VarBypassDetector.cpp

45 ↗

(On Diff #72909)

Drop the BuildScopeInformation - here and in other documentation comments.

50–51 ↗

(On Diff #72909)

Comment seems to not be relevant in this copy of the code; we don't have any special case for block literals here.

82–86 ↗

(On Diff #72909)

This looks unreachable (our only callers are the recursive call below -- which already checked for these -- and cases that cannot have a labelled statement). If we did reach it, we'd do the wrong thing, because we'd have created an independent scope rather than reusing the parent's scope (x: int n; would not introduce a new scope into the parent for n). Maybe replace this case with llvm_unreachable, or move the while (true) loop below up to the top of this function and delete these cases.

Do we have the same issue in JumpDiagnostics?

105–108 ↗

(On Diff #72909)

Combine these two into a single if (auto *SC = dyn_cast<SwitchCase>(SubStmt)) case.

129 ↗

(On Diff #72909)

Maybe pass in S.second instead of GS here so that the callee doesn't need to look it up again.

lib/CodeGen/VarBypassDetector.h

39 ↗

(On Diff #72909)

We should do /something/ about these. We could track the set of address-taken labels when we walk the function, and assume that each indirect goto can jump to each address-taken label, or more simply just conservatively say that all variables are bypassed in a function that contains an indirect goto.

[vitalybuka]

• updated comments
• indirect jumps
• optimized Detect()

[vitalybuka]

• fixed comment
• added test for indirect jumps

[vitalybuka]

Please take a look. Meanwhile, I will investigate performance footprint.

In D24693#559781, @rsmith wrote:

Is there some reasonable base set of functionality between this and JumpDiagnostics that could be factored out and shared?

I tried to do so from beginning but seems common part is only recursive traversal of AST. Sharing this will likely make both classes less readable.
In my taste it would be easier to maintain them separately.

lib/CodeGen/VarBypassDetector.cpp

50–51 ↗

(On Diff #72909)

I read this comment as explanation of "origParentScope : independentParentScope" and it's still needed and relevant.

82–86 ↗

(On Diff #72909)

Done here, but can't do for JumpDiagnostics. there are various BuildScopeInformation which can have label as child.

[vitalybuka]

Slowdown from this function is below: 0.05% and it's mostly just traversing AST.

cfe/trunk/lib/CodeGen/CGDecl.cpp

if (NRVO) {
       address.getPointer()->setName(D.getName());
 
       // Don't emit lifetime markers for MSVC catch parameters. The lifetime of
       // the catch parameter starts in the catchpad instruction, and we can't
       // insert code in those basic blocks.
       bool IsMSCatchParam =
           D.isExceptionVariable() && getTarget().getCXXABI().isMicrosoft();
 
-      // Emit a lifetime intrinsic if meaningful.  There's no point
-      // in doing this if we don't have a valid insertion point (?).
+      // Emit a lifetime intrinsic if meaningful. There's no point in doing this
+      // if we don't have a valid insertion point (?).
       if (HaveInsertPoint() && !IsMSCatchParam) {
+        // goto or switch-case statements can break lifetime into several
+        // regions which need more efforts to handle them correctly. PR28267
+        // This is rare case, but it's better just omit intrinsics than have
+        // them incorrectly placed.
+        if (!Bypasses.IsBypassed(&D)) {
           uint64_t size = CGM.getDataLayout().getTypeAllocSize(allocaTy);
           emission.SizeForLifetimeMarkers =
               EmitLifetimeStart(size, address.getPointer());
+        }
       } else {
         assert(!emission.useLifetimeMarkers());
       }
     }
   } else {
     EnsureInsertPoint();
 
     if (!DidCallStackSave) {

cfe/trunk/lib/CodeGen/CMakeLists.txt

add_clang_library(clangCodeGen
   CoverageMappingGen.cpp
   ItaniumCXXABI.cpp
   MicrosoftCXXABI.cpp
   ModuleBuilder.cpp
   ObjectFilePCHContainerOperations.cpp
   SanitizerMetadata.cpp
   SwiftCallingConv.cpp
   TargetInfo.cpp
+  VarBypassDetector.cpp
 
   DEPENDS
   ${codegen_deps}
 
   LINK_LIBS
   clangAnalysis
   clangAST
   clangAnalysis
   clangBasic
   clangFrontend
   clangLex
   )

cfe/trunk/lib/CodeGen/CodeGenFunction.h

 
 #include "CGBuilder.h"
 #include "CGDebugInfo.h"
 #include "CGLoopInfo.h"
 #include "CGValue.h"
 #include "CodeGenModule.h"
 #include "CodeGenPGO.h"
 #include "EHScopeStack.h"
+#include "VarBypassDetector.h"
 #include "clang/AST/CharUnits.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/ExprOpenMP.h"
 #include "clang/AST/Type.h"
 #include "clang/Basic/ABI.h"
 #include "clang/Basic/CapturedStmt.h"
 #include "clang/Basic/OpenMPKinds.h"
public:
 
   CodeGenModule &CGM;  // Per-module state.
   const TargetInfo &Target;
 
   typedef std::pair<llvm::Value *, llvm::Value *> ComplexPairTy;
   LoopInfoStack LoopStack;
   CGBuilderTy Builder;
 
+  // Stores variables for which we can't generate correct lifetime markers
+  // because of jumps.
+  VarBypassDetector Bypasses;
+
   /// \brief CGBuilder insert helper. This function is called after an
   /// instruction is created using Builder.
   void InsertHelper(llvm::Instruction *I, const llvm::Twine &Name,
                     llvm::BasicBlock *BB,
                     llvm::BasicBlock::iterator InsertPt) const;
 
   /// CurFuncDecl - Holds the Decl for the current outermost
   /// non-closure context.

cfe/trunk/lib/CodeGen/CodeGenFunction.cpp

void CodeGenFunction::GenerateCode(GlobalDecl GD, llvm::Function *Fn,
   SourceLocation Loc = FD->getLocation();
 
   // If this is a function specialization then use the pattern body
   // as the location for the function.
   if (const FunctionDecl *SpecDecl = FD->getTemplateInstantiationPattern())
     if (SpecDecl->hasBody(SpecDecl))
       Loc = SpecDecl->getLocation();
 
+  Stmt *Body = FD->getBody();
+
+  // Initialize helper which will detect jumps which can cause invalid lifetime
+  // markers.
+  if (Body && ShouldEmitLifetimeMarkers)
+    Bypasses.Init(Body);
+
   // Emit the standard function prologue.
   StartFunction(GD, ResTy, Fn, FnInfo, Args, Loc, BodyRange.getBegin());
 
   // Generate the body of the function.
   PGO.assignRegionCounters(GD, CurFn);
   if (isa<CXXDestructorDecl>(FD))
     EmitDestructorBody(Args);
   else if (isa<CXXConstructorDecl>(FD))
else if (isa<CXXConversionDecl>(FD) &&
     // clones the body of the function call operator (but is actually static).
     EmitLambdaStaticInvokeFunction(cast<CXXMethodDecl>(FD));
   } else if (FD->isDefaulted() && isa<CXXMethodDecl>(FD) &&
              (cast<CXXMethodDecl>(FD)->isCopyAssignmentOperator() ||
               cast<CXXMethodDecl>(FD)->isMoveAssignmentOperator())) {
     // Implicit copy-assignment gets the same special treatment as implicit
     // copy-constructors.
     emitImplicitAssignmentOperatorBody(Args);
-  } else if (Stmt *Body = FD->getBody()) {
+  } else if (Body) {
     EmitFunctionBody(Args, Body);
   } else
     llvm_unreachable("no definition for emitted function");
 
   // C++11 [stmt.return]p2:
   //   Flowing off the end of a function [...] results in undefined behavior in
   //   a value-returning function.
   // C11 6.9.1p12:

cfe/trunk/lib/CodeGen/VarBypassDetector.h

+//===--- VarBypassDetector.cpp - Bypass jumps detector ------------*- C++ -*-=//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file contains VarBypassDetector class, which is used to detect
+// local variable declarations which can be bypassed by jumps.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_LIB_CODEGEN_VARBYPASSDETECTOR_H
+#define LLVM_CLANG_LIB_CODEGEN_VARBYPASSDETECTOR_H
+
+#include "llvm/ADT/DenseMap.h"
+#include "llvm/ADT/DenseSet.h"
+#include "llvm/ADT/SmallVector.h"
+
+namespace clang {
+
+class Decl;
+class Stmt;
+class VarDecl;
+
+namespace CodeGen {
+
+/// The class detects jumps which bypass local variables declaration:
+///    goto L;
+///    int a;
+///  L:
+///
+/// This is simplified version of JumpScopeChecker. Primary differences:
+///  * Detects only jumps into the scope local variables.
+///  * Does not detect jumps out of the scope of local variables.
+///  * Not limited to variables with initializers, JumpScopeChecker is limited.
+class VarBypassDetector {
+  // Scope information. Contains a parent scope and related variable
+  // declaration.
+  llvm::SmallVector<std::pair<unsigned, const VarDecl *>, 48> Scopes;
+  // List of jumps with scopes.
+  llvm::SmallVector<std::pair<const Stmt *, unsigned>, 16> FromScopes;
+  // Lookup map to find scope for destinations.
+  llvm::DenseMap<const Stmt *, unsigned> ToScopes;
+  // Set of variables which were bypassed by some jump.
+  llvm::DenseSet<const VarDecl *> Bypasses;
+  // If true assume that all variables are being bypassed.
+  bool AlwaysBypassed = false;
+
+public:
+  void Init(const Stmt *Body);
+
+  /// Returns true if the variable declaration was by bypassed by any goto or
+  /// switch statement.
+  bool IsBypassed(const VarDecl *D) const {
+    return AlwaysBypassed || Bypasses.find(D) != Bypasses.end();
+  }
+
+private:
+  bool BuildScopeInformation(const Decl *D, unsigned &ParentScope);
+  bool BuildScopeInformation(const Stmt *S, unsigned &origParentScope);
+  void Detect();
+  void Detect(unsigned From, unsigned To);
+};
+}
+}
+
+#endif

cfe/trunk/lib/CodeGen/VarBypassDetector.cpp

+//===--- VarBypassDetector.h - Bypass jumps detector --------------*- C++ -*-=//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#include "VarBypassDetector.h"
+
+#include "clang/AST/Decl.h"
+#include "clang/AST/Expr.h"
+#include "clang/AST/Stmt.h"
+
+using namespace clang;
+using namespace CodeGen;
+
+/// Clear the object and pre-process for the given statement, usually function
+/// body statement.
+void VarBypassDetector::Init(const Stmt *Body) {
+  FromScopes.clear();
+  ToScopes.clear();
+  Bypasses.clear();
+  Scopes = {{~0U, nullptr}};
+  unsigned ParentScope = 0;
+  AlwaysBypassed = !BuildScopeInformation(Body, ParentScope);
+  if (!AlwaysBypassed)
+    Detect();
+}
+
+/// Build scope information for a declaration that is part of a DeclStmt.
+/// Returns false if we failed to build scope information and can't tell for
+/// which vars are being bypassed.
+bool VarBypassDetector::BuildScopeInformation(const Decl *D,
+                                              unsigned &ParentScope) {
+  const VarDecl *VD = dyn_cast<VarDecl>(D);
+  if (VD && VD->hasLocalStorage()) {
+    Scopes.push_back({ParentScope, VD});
+    ParentScope = Scopes.size() - 1;
+  }
+
+  if (const VarDecl *VD = dyn_cast<VarDecl>(D))
+    if (const Expr *Init = VD->getInit())
+      return BuildScopeInformation(Init, ParentScope);
+
+  return true;
+}
+
+/// Walk through the statements, adding any labels or gotos to
+/// LabelAndGotoScopes and recursively walking the AST as needed.
+/// Returns false if we failed to build scope information and can't tell for
+/// which vars are being bypassed.
+bool VarBypassDetector::BuildScopeInformation(const Stmt *S,
+                                              unsigned &origParentScope) {
+  // If this is a statement, rather than an expression, scopes within it don't
+  // propagate out into the enclosing scope. Otherwise we have to worry about
+  // block literals, which have the lifetime of their enclosing statement.
+  unsigned independentParentScope = origParentScope;
+  unsigned &ParentScope =
+      ((isa<Expr>(S) && !isa<StmtExpr>(S)) ? origParentScope
+                                           : independentParentScope);
+
+  unsigned StmtsToSkip = 0u;
+
+  switch (S->getStmtClass()) {
+  case Stmt::IndirectGotoStmtClass:
+    return false;
+
+  case Stmt::SwitchStmtClass:
+    if (const Stmt *Init = cast<SwitchStmt>(S)->getInit()) {
+      if (!BuildScopeInformation(Init, ParentScope))
+        return false;
+      ++StmtsToSkip;
+    }
+    if (const VarDecl *Var = cast<SwitchStmt>(S)->getConditionVariable()) {
+      if (!BuildScopeInformation(Var, ParentScope))
+        return false;
+      ++StmtsToSkip;
+    }
+  // Fall through
+
+  case Stmt::GotoStmtClass:
+    FromScopes.push_back({S, ParentScope});
+    break;
+
+  case Stmt::DeclStmtClass: {
+    const DeclStmt *DS = cast<DeclStmt>(S);
+    for (auto *I : DS->decls())
+      if (!BuildScopeInformation(I, origParentScope))
+        return false;
+    return true;
+  }
+
+  case Stmt::CaseStmtClass:
+  case Stmt::DefaultStmtClass:
+  case Stmt::LabelStmtClass:
+    llvm_unreachable("the loop bellow handles labels and cases");
+    break;
+
+  default:
+    break;
+  }
+
+  for (const Stmt *SubStmt : S->children()) {
+    if (!SubStmt)
+      continue;
+    if (StmtsToSkip) {
+      --StmtsToSkip;
+      continue;
+    }
+
+    // Cases, labels, and defaults aren't "scope parents".  It's also
+    // important to handle these iteratively instead of recursively in
+    // order to avoid blowing out the stack.
+    while (true) {
+      const Stmt *Next;
+      if (const SwitchCase *SC = dyn_cast<SwitchCase>(SubStmt))
+        Next = SC->getSubStmt();
+      else if (const LabelStmt *LS = dyn_cast<LabelStmt>(SubStmt))
+        Next = LS->getSubStmt();
+      else
+        break;
+
+      ToScopes[SubStmt] = ParentScope;
+      SubStmt = Next;
+    }
+
+    // Recursively walk the AST.
+    if (!BuildScopeInformation(SubStmt, ParentScope))
+      return false;
+  }
+  return true;
+}
+
+/// Checks each jump and stores each variable declaration they bypass.
+void VarBypassDetector::Detect() {
+  for (const auto &S : FromScopes) {
+    const Stmt *St = S.first;
+    unsigned from = S.second;
+    if (const GotoStmt *GS = dyn_cast<GotoStmt>(St)) {
+      if (const LabelStmt *LS = GS->getLabel()->getStmt())
+        Detect(from, ToScopes[LS]);
+    } else if (const SwitchStmt *SS = dyn_cast<SwitchStmt>(St)) {
+      for (const SwitchCase *SC = SS->getSwitchCaseList(); SC;
+           SC = SC->getNextSwitchCase()) {
+        Detect(from, ToScopes[SC]);
+      }
+    } else {
+      llvm_unreachable("goto or switch was expected");
+    }
+  }
+}
+
+/// Checks the jump and stores each variable declaration it bypasses.
+void VarBypassDetector::Detect(unsigned From, unsigned To) {
+  while (From != To) {
+    if (From < To) {
+      assert(Scopes[To].first < To);
+      const auto &ScopeTo = Scopes[To];
+      To = ScopeTo.first;
+      Bypasses.insert(ScopeTo.second);
+    } else {
+      assert(Scopes[From].first < From);
+      From = Scopes[From].first;
+    }
+  }
+}

cfe/trunk/test/CodeGen/lifetime2.c

-// RUN: %clang -S -emit-llvm -o - -O2 %s | FileCheck %s -check-prefix=O2
-// RUN: %clang -S -emit-llvm -o - -O0 %s | FileCheck %s -check-prefix=O0
+// RUN: %clang -S -emit-llvm -o - -O2 %s | FileCheck %s -check-prefixes=CHECK,O2
+// RUN: %clang -S -emit-llvm -o - -O0 %s | FileCheck %s -check-prefixes=CHECK,O0
 
 extern int bar(char *A, int n);
 
+// CHECK-LABEL: @foo
 // O0-NOT: @llvm.lifetime.start
 int foo (int n) {
   if (n) {
 // O2: @llvm.lifetime.start
     char A[100];
     return bar(A, 1);
   } else {
 // O2: @llvm.lifetime.start
     char A[100];
     return bar(A, 2);
   }
 }
+
+// CHECK-LABEL: @no_goto_bypass
+void no_goto_bypass() {
+  // O2: @llvm.lifetime.start(i64 1
+  char x;
+l1:
+  bar(&x, 1);
+  // O2: @llvm.lifetime.start(i64 5
+  // O2: @llvm.lifetime.end(i64 5
+  char y[5];
+  bar(y, 5);
+  goto l1;
+  // Infinite loop
+  // O2-NOT: @llvm.lifetime.end(i64 1
+}
+
+// CHECK-LABEL: @goto_bypass
+void goto_bypass() {
+  {
+    // O2-NOT: @llvm.lifetime.start(i64 1
+    // O2-NOT: @llvm.lifetime.end(i64 1
+    char x;
+  l1:
+    bar(&x, 1);
+  }
+  goto l1;
+}
+
+// CHECK-LABEL: @no_switch_bypass
+void no_switch_bypass(int n) {
+  switch (n) {
+  case 1: {
+    // O2: @llvm.lifetime.start(i64 1
+    // O2: @llvm.lifetime.end(i64 1
+    char x;
+    bar(&x, 1);
+    break;
+  }
+  case 2:
+    n = n;
+    // O2: @llvm.lifetime.start(i64 5
+    // O2: @llvm.lifetime.end(i64 5
+    char y[5];
+    bar(y, 5);
+    break;
+  }
+}
+
+// CHECK-LABEL: @switch_bypass
+void switch_bypass(int n) {
+  switch (n) {
+  case 1:
+    n = n;
+    // O2-NOT: @llvm.lifetime.start(i64 1
+    // O2-NOT: @llvm.lifetime.end(i64 1
+    char x;
+    bar(&x, 1);
+    break;
+  case 2:
+    bar(&x, 1);
+    break;
+  }
+}
+
+// CHECK-LABEL: @indirect_jump
+void indirect_jump(int n) {
+  char x;
+  // O2-NOT: @llvm.lifetime
+  void *T[] = {&&L};
+  goto *T[n];
+L:
+  bar(&x, 1);
+}