Index: llvm/trunk/lib/Transforms/Scalar/TailRecursionElimination.cpp
===================================================================
--- llvm/trunk/lib/Transforms/Scalar/TailRecursionElimination.cpp
+++ llvm/trunk/lib/Transforms/Scalar/TailRecursionElimination.cpp
@@ -204,6 +204,15 @@
     }
   }
 
+  // If any byval or inalloca args are captured, exit. They are also allocated
+  // in our stack frame.
+  for (Argument &Arg : F.args()) {
+    if (Arg.hasByValOrInAllocaAttr())
+      PointerMayBeCaptured(&Arg, &ACT);
+    if (ACT.Captured)
+      return false;
+  }
+
   // Second pass, change any tail recursive calls to loops.
   //
   // FIXME: The code generator produces really bad code when an 'escaping
Index: llvm/trunk/lib/Transforms/Utils/InlineFunction.cpp
===================================================================
--- llvm/trunk/lib/Transforms/Utils/InlineFunction.cpp
+++ llvm/trunk/lib/Transforms/Utils/InlineFunction.cpp
@@ -586,15 +586,8 @@
       if (CS.isByValArgument(ArgNo)) {
         ActualArg = HandleByValArgument(ActualArg, TheCall, CalledFunc, IFI,
                                         CalledFunc->getParamAlignment(ArgNo+1));
- 
-        // Calls that we inline may use the new alloca, so we need to clear
-        // their 'tail' flags if HandleByValArgument introduced a new alloca and
-        // the callee has calls.
-        if (ActualArg != *AI) {
-          MustClearTailCallFlags = true;
+        if (ActualArg != *AI)
           ByValInit.push_back(std::make_pair(ActualArg, (Value*) *AI));
-        }
-
       }
 
       VMap[I] = ActualArg;
Index: llvm/trunk/test/Transforms/Inline/2010-05-31-ByvalTailcall.ll
===================================================================
--- llvm/trunk/test/Transforms/Inline/2010-05-31-ByvalTailcall.ll
+++ llvm/trunk/test/Transforms/Inline/2010-05-31-ByvalTailcall.ll
@@ -1,25 +0,0 @@
-; RUN: opt < %s -tailcallelim -inline -instcombine -dse -S | FileCheck %s
-; PR7272
-
-; When inlining through a byval call site, the inliner creates allocas which may
-; be used by inlined calls, so any inlined calls need to have their 'tail' flags
-; cleared.  If not then you can get nastiness like with this testcase, where the
-; (inlined) call to 'ext' in 'foo' was being passed an uninitialized value.
-
-target datalayout = "e-p:32:32:32-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-f32:32:32-f64:32:64-v64:64:64-v128:128:128-a0:0:64-f80:32:32-n8:16:32"
-target triple = "i386-pc-linux-gnu"
-
-declare void @ext(i32*)
-
-define void @bar(i32* byval %x) {
-  call void @ext(i32* %x)
-  ret void
-}
-
-define void @foo(i32* %x) {
-; CHECK-LABEL: define void @foo(
-; CHECK: llvm.lifetime.start
-; CHECK: store i32 %2, i32* %x
-  call void @bar(i32* byval %x)
-  ret void
-}
Index: llvm/trunk/test/Transforms/Inline/byval-tail-call.ll
===================================================================
--- llvm/trunk/test/Transforms/Inline/byval-tail-call.ll
+++ llvm/trunk/test/Transforms/Inline/byval-tail-call.ll
@@ -0,0 +1,38 @@
+; RUN: opt < %s -tailcallelim -inline -instcombine -dse -S | FileCheck %s
+; PR7272
+
+; Calls that capture byval parameters cannot be marked as tail calls. Other
+; tails that don't capture byval parameters can still be tail calls.
+
+target datalayout = "e-p:32:32:32-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-f32:32:32-f64:32:64-v64:64:64-v128:128:128-a0:0:64-f80:32:32-n8:16:32"
+target triple = "i386-pc-linux-gnu"
+
+declare void @ext(i32*)
+
+define void @bar(i32* byval %x) {
+  call void @ext(i32* %x)
+  ret void
+}
+
+define void @foo(i32* %x) {
+; CHECK-LABEL: define void @foo(
+; CHECK: llvm.lifetime.start
+; CHECK: store i32 %2, i32* %x
+  call void @bar(i32* byval %x)
+  ret void
+}
+
+define internal void @qux(i32* byval %x) {
+  call void @ext(i32* %x)
+  tail call void @ext(i32* null)
+  ret void
+}
+define void @frob(i32* %x) {
+; CHECK-LABEL: define void @frob(
+; CHECK: alloca i32
+; CHECK: {{^ *}}call void @ext(
+; CHECK: tail call void @ext(i32* null)
+; CHECK: ret void
+  tail call void @qux(i32* byval %x)
+  ret void
+}
Index: llvm/trunk/test/Transforms/TailCallElim/basic.ll
===================================================================
--- llvm/trunk/test/Transforms/TailCallElim/basic.ll
+++ llvm/trunk/test/Transforms/TailCallElim/basic.ll
@@ -143,3 +143,11 @@
   call void @noarg()
   ret i32* null
 }
+
+; Don't tail call if a byval arg is captured.
+define void @test9(i32* byval %a) {
+; CHECK-LABEL: define void @test9(
+; CHECK: {{^ *}}call void @use(
+  call void @use(i32* %a)
+  ret void
+}