llvm: Add support for "-fno-delete-null-pointer-checks"

[manojgupta]

Summary

Support for this option is needed for building Linux kernel.
This is a very frequently requested feature by kernel developers.

More details : https://lkml.org/lkml/2018/4/4/601

GCC option description for -fdelete-null-pointer-checks:
This Assume that programs cannot safely dereference null pointers,
and that no code or data element resides at address zero.

-fno-delete-null-pointer-checks is the inverse of this implying that
null pointer dereferencing is not undefined.

This feature is implemented in LLVM IR in this CL as the function attribute
"null-pointer-is-valid"="true" in IR (Under review at D47894).
The CL updates several passes that assumed null pointer dereferencing is
undefined to not optimize when the "null-pointer-is-valid"="true"
attribute is present.

[xbolva00]

lib/Transforms/InstCombine/InstCombineCalls.cpp

4015

getParent()->getParent()
to
getFunction()

Same below

[efriedma]

Missing LangRef changes.

How did you come up with the set of checks which need to be updated? Quickly grepping through the source, I found you missed at least lib/Analysis/ValueTracking.cpp, include/llvm/IR/CallSite.h, lib/Analysis/LazyValueInfo.cpp, and lib/Analysis/ConstantFolding.cpp .

include/llvm/Analysis/Utils/Local.h

93 ↗

(On Diff #150367)

This needs to be one function which both the address-space check and the function attribute check; that's both easier to understand, and easier to extend in the future.

Maybe also put helpers on LoadInst and StoreInst to extract the appropriate address space and call this function.

[manojgupta]

In D47895#1125388, @efriedma wrote:

Missing LangRef changes.

How did you come up with the set of checks which need to be updated? Quickly grepping through the source, I found you missed at least lib/Analysis/ValueTracking.cpp, include/llvm/IR/CallSite.h, lib/Analysis/LazyValueInfo.cpp, and lib/Analysis/ConstantFolding.cpp .

Thanks Eli,

My interpretation (based on GCC description) is only the analysis/optimizations that assume pointer dereference => non-null and null dereference => undefined need to be fixed. If an analysis can prove non-nullablility based on any criteria except dereference, it should be fine to remove null checks.

I am going to recheck the list of files you suggested and also recheck LLVM overall.
I believe that there are probably more places that I might have missed. Appreciate a lot if you and other reviewers can point me to more optimizations/analysis that should be updated.

[efriedma]

If an analysis can prove non-nullablility based on any criteria except dereference, it should be fine to remove null checks.

Yes, that's right. At least, I think that's the only reasonable way to define the attribute.

I was basically just grepping for constructs which look like "getPointerAddressSpace() == 0"; anything that's doing that probably needs to be fixed because address space 0 doesn't have any other special properties. (Well, actually, that's not completely right: there are special rules for widening loads and stores in address-space 0. But IIRC almost nothing depends on that.)

[manojgupta]

Updated some passes and added more test cases.

[manojgupta]

In D47895#1125388, @efriedma wrote:

Missing LangRef changes.

Eli, Is this the place you are referring to?
https://llvm.org/docs/LangRef.html#attribute-groups

It does not cover much about the internal IR attributes, though I'll be happy to add "null-pointer-is-valid"="true" to the examples here.

[efriedma]

Tests look good, at first glance.

For LangRef, I was referring to https://llvm.org/docs/LangRef.html#function-attributes, yes. (There might be some gaps in the documentation, but ideally that should cover all the function attributes recognized by LLVM transforms and code generation.)

It looks like you still didn't look at all the files I mentioned earlier?

lib/Transforms/IPO/GlobalOpt.cpp

641

This doesn't handle address spaces correctly... at least, not at first glance.

[efriedma]

include/llvm/Analysis/Utils/Local.h

93 ↗

(On Diff #151195)

Not sure I like the default argument here.

[manojgupta]

In D47895#1131374, @efriedma wrote:

Tests look good, at first glance.

For LangRef, I was referring to https://llvm.org/docs/LangRef.html#function-attributes, yes. (There might be some gaps in the documentation, but ideally that should cover all the function attributes recognized by LLVM transforms and code generation.)

Thanks, Will add it there.

It looks like you still didn't look at all the files I mentioned earlier?

I went through those files but many of these addressSpace() == 0 (and != 0) checks are not for null pointers but for disabling/skipping some memory optimizations. And it is not clear to me if moving all of those checks to the new NullPointerIsDefined function makes sense there.

lib/Transforms/IPO/GlobalOpt.cpp

1939

This pass already skips non-zero address space values. I didn't want to bail out here since all of the accesses to a GV might be in functions without null-pointer-is-valid attribute.

[efriedma]

lib/Transforms/IPO/GlobalOpt.cpp

1939

Fine; please add a comment to AllUsesOfValueWillTrapIfNull.

[manojgupta]

Added more test cases, updated LangRef, added a check for address space 0
in GlobalOpt.

[efriedma]

I went through those files but many of these addressSpace() == 0 (and != 0) checks are not for null pointers but for disabling/skipping some memory optimizations. And it is not clear to me if moving all of those checks to the new NullPointerIsDefined function makes sense there.

We should probably add a section to LangRef on address spaces, and what transforms are specifically allowed only in address space 0.

I'm sure we need to handle null-pointer-is-valid in CallSite.h, at least.

docs/LangRef.rst

1467

Stating the ways to spell null pointer in C isn't helpful; this is the LLVM IR reference. A null pointer in IR is just "i8* null". (And the C/C++ notion of a "null pointer" can actually be translated to something which is not i8* null in some situations.)

[manojgupta]

Added checks to CallSite.h and LoopAccessAnalysis.cpp.
Added another test case for atomic loads.
Moved The NullPointerIsDefined function to Function.h.

[manojgupta]

Update LangRef.

[xbolva00]

include/llvm/IR/Function.h

788

Confusing..

nullPointerIsDefined or NullPointerIsDefined?

[manojgupta]

In D47895#1133937, @efriedma wrote:

I went through those files but many of these addressSpace() == 0 (and != 0) checks are not for null pointers but for disabling/skipping some memory optimizations. And it is not clear to me if moving all of those checks to the new NullPointerIsDefined function makes sense there.

We should probably add a section to LangRef on address spaces, and what transforms are specifically allowed only in address space 0.

I'm sure we need to handle null-pointer-is-valid in CallSite.h, at least.

Thanks! I updated CallSite.h and also LoopAccessAnalysis. Had to find another home for NullPointerIsDefined function so moved it to Function.h.
I am in split mind about adding theses checks to BasicAliasAnalysis so need your opinion.

[manojgupta]

include/llvm/IR/Function.h

788

This is part of Function Object so used lowercase to match the current code.

[manojgupta]

Added a comment in GlobalOpt.cpp

[manojgupta]

@efriedma I think I have addressed the changes you requested, can you ptal?

[efriedma]

Please fix lib/Analysis/BasicAliasAnalysis.cpp to allow null pointers to alias other objects. Please fix lib/Analysis/LoopAccessAnalysis.cpp to allow a loop to dereference null. Please fix isGEPKnownNonNull in lib/Analysis/ValueTracking.cpp to allow objects located at null. Please fix ConstantFoldScalarCall in lib/Analysis/ConstantFolding.cpp to allow objects located at null. Please fix Argument::hasNonNullAttr in lib/IR/Function.cpp to allow objects at null.

There are probably other places which need to be fixed, but there's no good way to find them all; we'll just have to stumble over them later.

LangRef needs some work to clarify exactly what properties we assume about address-space zero besides the special properties of null, but I should probably write that myself.

docs/LangRef.rst

1465

Please specifically say "in address-space 0".

1468

undefined isn't a keyword.

[sanjoy]

Drive by comments

You also need to change the inliner to not inline null-pointer-is-dereferenceable into functions that don't have that attribute.

docs/LangRef.rst

1464

This should be called null-pointer-is-dereferenceable or something like that.

1466

Might be worth clarifying if this is just loads or both loads and stores.

1468

What about functions called from this function?

lib/Transforms/Utils/Local.cpp

1907–1909

I don't think we can fold calls to undef either -- the only reason why we can normally do this is because Callee could be null.

[manojgupta]

Made requested changes and added more tests.

[manojgupta]

In D47895#1139800, @sanjoy wrote:

Drive by comments

You also need to change the inliner to not inline null-pointer-is-dereferenceable into functions that don't have that attribute.

Done.
Note that, I am expecting that functions with alwaysinline attribute should still get inlined. If that happens and caller does not have this attribute, then optimizer is free to remove the checks.

In D47895#1139757, @efriedma wrote:

Please fix lib/Analysis/BasicAliasAnalysis.cpp to allow null pointers to alias other objects. Please fix lib/Analysis/LoopAccessAnalysis.cpp to allow a loop to dereference null. Please fix isGEPKnownNonNull in lib/Analysis/ValueTracking.cpp to allow objects located at null. Please fix ConstantFoldScalarCall in lib/Analysis/ConstantFolding.cpp to allow objects located at null. Please fix Argument::hasNonNullAttr in lib/IR/Function.cpp to allow objects at null.

Done.

docs/LangRef.rst

1464

I actually had a typo here. The IR is using "null-pointer-is-valid" so changed to the same name.

1468

If the functions are not inlined, it shouldn't normally matter.
For functions that get inlined, I believe caller convention should be kept i.e. not propagating this attribute from callee to caller when inlining.

lib/IR/ConstantFold.cpp

1504–1505

There does not seem to be a way to find the Function and thereby the attribute here. Any suggestions?

[manojgupta]

Fixed typo in inlining unit test.

[manojgupta]

@efriedma : can you take a look again?
Thanks!

[efriedma]

lib/IR/ConstantFold.cpp

1504–1505

That's challenging... constants are, in general, outside any function, so we don't have any context for this. (More generally, I think ConstantExprs are a terrible idea, but we're basically stuck with them, at least for now.)

I guess in this particular case, we could just ignore the attribute and still get reasonable behavior; even if there's memory mapped at address 0, it probably isn't a GlobalValue. But please add a note here, and in LangRef.

lib/Transforms/IPO/GlobalOpt.cpp

1599

GV->getType() is the wrong type.

[manojgupta]

Fix an issue pointed by efriedma. All tests still pass.

[manojgupta]

lib/Transforms/IPO/GlobalOpt.cpp

1599

Done, Thanks for catching this.

[manojgupta]

Updated LangRef and added comment in ConstantFolding about inability
to query the attribute.

[efriedma]

Looking good. I think I want to look at it one more time when I'm fresh on Monday, and give a bit of time for anyone else to look at it.

docs/LangRef.rst

1469

global variable, not "GlobalVariable" (that's what it's called in other places in the reference).

[manojgupta]

Replace GlobalVariable by global variable.

[manojgupta]

Rebase to master + handle constant folding of intrinsic strip_invariant_group.

[george.burgess.iv]

Swooping in on this admittedly quite late: should the objectsize bits in MemoryBuiltins.cpp be made aware of this?

In particular, the ObjectSizeOffsetVisitor will happily hand you "0 bytes are accessible here" if you hand it null (...though not if you ask it via __builtin_object_size, since that has a gcc-compat hack around NULL, as well). We should probably make the NullIsUnknownSize field we pass into that factor in whether the current Function has this new null-is-ok attribute on it.

...Since it's possible for us to just hand it a ConstantPointerNull without a Function attached, we probably need to plumb this in from callers of llvm::getObjectSize/llvm::lowerObjectSizeCall/...

[manojgupta]

In D47895#1150325, @george.burgess.iv wrote:

Swooping in on this admittedly quite late: should the objectsize bits in MemoryBuiltins.cpp be made aware of this?

In particular, the ObjectSizeOffsetVisitor will happily hand you "0 bytes are accessible here" if you hand it null (...though not if you ask it via __builtin_object_size, since that has a gcc-compat hack around NULL, as well). We should probably make the NullIsUnknownSize field we pass into that factor in whether the current Function has this new null-is-ok attribute on it.

...Since it's possible for us to just hand it a ConstantPointerNull without a Function attached, we probably need to plumb this in from callers of llvm::getObjectSize/llvm::lowerObjectSizeCall/...

I don't know much about __builtin_object_size but I think GCC compatibility is the key here. Does GCC returns different results for __builtin_object_size when "-fno-delete-null-pointer-checks" is specified?

[efriedma]

In D47895#1150952, @manojgupta wrote:

I don't know much about __builtin_object_size but I think GCC compatibility is the key here. Does GCC returns different results for __builtin_object_size when "-fno-delete-null-pointer-checks" is specified?

__builtin_object_size lowers to llvm.objectsize with nullunknown = true, so we essentially treat it like an object anyway; it's not affected. The issue is for other users of llvm::getObjectSize (like alias analysis)

[george.burgess.iv]

What Eli said :)

This can probably be fixed by setting NullIsUnknownSize appropriately in callers of llvm::getObjectSize.

(We'll likely also want to ensure that the objectsize sanitizer in clang sets the nullunknown bit when it lowers to calls of @llvm.objectsize if clang's been handed this flag, but that's a different patch)

[manojgupta]

Handle getObjectSize by passing the ObjectSizeOpts in callers.

[chandlerc]

Adding George explicitly as a reviewer as I think this is now waiting on him.

[george.burgess.iv]

Ah, sorry. I thought I hit submit, but apparently I didn't. :)

Objectsize-related changes look good to me, modulo a few tiny nits. Thanks!

lib/Analysis/InstructionSimplify.cpp

2125 ↗

(On Diff #153985)

s/dyn_cast/cast/, please

(Or

if (auto *Foo = dyn_cast<AllocaInst>(LHS))
  if (isa<AllocaInst>(RHS) || isa<GlobalVariable>(RHS)) {
    // ...

; I'm impartial.)

lib/Transforms/Scalar/DeadStoreElimination.cpp

351 ↗

(On Diff #153985)

const Function *F?

718 ↗

(On Diff #153985)

const Function *F?

[manojgupta]

Made suggested changes.

[george.burgess.iv]

Nit fixes LGTM. Please wait for an official stamp from Eli before committing, since I can’t tell if he got the second look he wanted. (I’m inclined to believe he did, but don’t want to jump the gun)

Thanks for the patch!

[efriedma]

LGTM

[manojgupta]

Thanks everyone, specially Eli for the reviews.

[a.elovikov]

Note that, I am expecting that functions with alwaysinline attribute should still get inlined. If that happens and caller does not have this attribute, then optimizer is free to remove the checks.

Not that I actually hit that, but it was questionable when reading the code - why that way? From LangRef: alwaysinline "indicates that the inliner should attempt to inline this function into callers whenever possible, ignoring any active inlining size threshold for this caller." So there is some freedom by not doing the inlining, even in the presence of the attribute.

Wouldn't it be better not to inline or to add the attribute to the caller?

[manojgupta]

In D47895#1175164, @a.elovikov wrote:

Note that, I am expecting that functions with alwaysinline attribute should still get inlined. If that happens and caller does not have this attribute, then optimizer is free to remove the checks.

Not that I actually hit that, but it was questionable when reading the code - why that way? From LangRef: alwaysinline "indicates that the inliner should attempt to inline this function into callers whenever possible, ignoring any active inlining size threshold for this caller." So there is some freedom by not doing the inlining, even in the presence of the attribute.

Wouldn't it be better not to inline or to add the attribute to the caller?

Thanks for the comments.

Generally clang should add the attribute to all the functions if "-fno-delete-null-pointer-checks" is used so the mismatch should not happen in practice.

As per my understanding, If the "null-pointer-is-valid" is missing on a caller (but present on callee), this probably would happen in LTO where caller was intentionally compiled without "-fno-delete-null-pointer-checks". So adding the attribute to caller is probably not desired.
It was not clear to me if "-fno-delete-null-pointer-checks" mismatch should override always_inline but my inclination was to honor the user/system specified attribute over the compiler option.

I would be happy to change this logic if there is a consensus on how inlining should be handled in case of "null-pointer-isvalid" attribute mismatches.

[lebedev.ri]

In D47895#1175667, @manojgupta wrote:

In D47895#1175164, @a.elovikov wrote:

Note that, I am expecting that functions with alwaysinline attribute should still get inlined. If that happens and caller does not have this attribute, then optimizer is free to remove the checks.

Not that I actually hit that, but it was questionable when reading the code - why that way? From LangRef: alwaysinline "indicates that the inliner should attempt to inline this function into callers whenever possible, ignoring any active inlining size threshold for this caller." So there is some freedom by not doing the inlining, even in the presence of the attribute.

Wouldn't it be better not to inline or to add the attribute to the caller?

Thanks for the comments.

Generally clang should add the attribute to all the functions if "-fno-delete-null-pointer-checks" is used so the mismatch should not happen in practice.

Random uneducated thought - how does it work with multiple translation units, where not all of them have/don't have that flag set?

As per my understanding, If the "null-pointer-is-valid" is missing on a caller (but present on callee), this probably would happen in LTO where caller was intentionally compiled without "-fno-delete-null-pointer-checks". So adding the attribute to caller is probably not desired.
It was not clear to me if "-fno-delete-null-pointer-checks" mismatch should override always_inline but my inclination was to honor the user/system specified attribute over the compiler option.

I would be happy to change this logic if there is a consensus on how inlining should be handled in case of "null-pointer-isvalid" attribute mismatches.

[a.elovikov]

to change this logic if there is a consensus on how inlining should be handled in case of "null-pointer-isvalid" attribute mismatches.

I don't (and probably can't :) insist on changing the logic, but we should probably update the LangRef either in the entry for alwaysinline or in the entry of "null-pointer-isvalid". Otherwise, current transformation, IMO, breaks our own LangRef. Or do I miss something in its wording?

[manojgupta]

Random uneducated thought - how does it work with multiple translation units, where not all of them have/don't have that flag set?

Currently the logic disables inlining of functions with "null-pointer-is-valid" into functions that does not have this attribute.
However, if the callee has always_inline, inlining would still happen.

Here is an example of what GCC does in case of mismatched "fno-delete-null-pointer-checks".
https://godbolt.org/g/78Z2S4

There are 4 cases:
Case 1 : Attribute is on caller
Case 2 : Attribute is on callee
Case 3 : Attribute is on caller, callee has always_inline
Case 4 : Attribute is on callee, callee has always_inline

Inlining happens in all cases except (2). I think clang behavior matches GCC here.

Not sure of Langref changes, @efriedma What do you suggest?

[efriedma]

If the user forces inlining with always_inline, we should probably be conservative and propagate the attribute. If we do that, I don't think we need to say anything about it in LangRef.

[xbolva00]

llvm/trunk/lib/Analysis/InlineCost.cpp

1999 ↗

(On Diff #154716)

Why not put it to functionsHaveCompatibleAttributes?

[manojgupta]

llvm/trunk/lib/Analysis/InlineCost.cpp

1999 ↗

(On Diff #154716)

I can not not recall why (this change is > 3 years old ) but it does sound like the right thing to do.

docs/LangRef.rst

``norecurse``
     undefined behavior at runtime if the function ever does recurse.
 ``nounwind``
     This function attribute indicates that the function never raises an
     exception. If the function does raise an exception, its runtime
     behavior is undefined. However, functions marked nounwind may still
     trap or generate asynchronous exceptions. Exception handling schemes
     that are recognized by LLVM to handle asynchronous exceptions, such
     as SEH, will still provide their implementation defined semantics.
+``"null-pointer-is-valid"``
+   If ``"null-pointer-is-valid"`` is set to ``"true"``, then ``null`` address
+   in address-space 0 is considered to be a valid address for memory loads and
+   stores. Any analysis or optimization should not treat dereferencing a
+   pointer to ``null`` as undefined behavior in this function.
 ``optforfuzzing``
     This attribute indicates that this function should be optimized
     for maximum fuzzing signal.
 ``optnone``
     This function attribute indicates that most optimization passes will skip
     this function, with the exception of interprocedural optimization passes.
     Code generation defaults to the "fast" instruction selector.
     This attribute cannot be used together with the ``alwaysinline``
     attribute; this attribute is also incompatible

include/llvm/Analysis/BasicAliasAnalysis.h

 /// manner. As one consequence, it is never invalidated due to IR changes.
 /// While it does retain some storage, that is used as an optimization and not
 /// to preserve information from query to query. However it does retain handles
 /// to various other analyses and must be recomputed when those analyses are.
 class BasicAAResult : public AAResultBase<BasicAAResult> {
   friend AAResultBase<BasicAAResult>;
 
   const DataLayout &DL;
+  const Function &F;
   const TargetLibraryInfo &TLI;
   AssumptionCache &AC;
   DominatorTree *DT;
   LoopInfo *LI;
 
 public:
-  BasicAAResult(const DataLayout &DL, const TargetLibraryInfo &TLI,
-                AssumptionCache &AC, DominatorTree *DT = nullptr,
-                LoopInfo *LI = nullptr)
-      : AAResultBase(), DL(DL), TLI(TLI), AC(AC), DT(DT), LI(LI) {}
+  BasicAAResult(const DataLayout &DL, const Function &F,
+                const TargetLibraryInfo &TLI, AssumptionCache &AC,
+                DominatorTree *DT = nullptr, LoopInfo *LI = nullptr)
+      : AAResultBase(), DL(DL), F(F), TLI(TLI), AC(AC), DT(DT), LI(LI) {}
 
   BasicAAResult(const BasicAAResult &Arg)
-      : AAResultBase(Arg), DL(Arg.DL), TLI(Arg.TLI), AC(Arg.AC), DT(Arg.DT),
-        LI(Arg.LI) {}
-  BasicAAResult(BasicAAResult &&Arg)
-      : AAResultBase(std::move(Arg)), DL(Arg.DL), TLI(Arg.TLI), AC(Arg.AC),
+      : AAResultBase(Arg), DL(Arg.DL), F(Arg.F), TLI(Arg.TLI), AC(Arg.AC),
         DT(Arg.DT), LI(Arg.LI) {}
+  BasicAAResult(BasicAAResult &&Arg)
+      : AAResultBase(std::move(Arg)), DL(Arg.DL), F(Arg.F), TLI(Arg.TLI),
+        AC(Arg.AC), DT(Arg.DT), LI(Arg.LI) {}
 
   /// Handle invalidation events in the new pass manager.
-  bool invalidate(Function &F, const PreservedAnalyses &PA,
+  bool invalidate(Function &Fn, const PreservedAnalyses &PA,
                   FunctionAnalysisManager::Invalidator &Inv);
 
   AliasResult alias(const MemoryLocation &LocA, const MemoryLocation &LocB);
 
   ModRefInfo getModRefInfo(ImmutableCallSite CS, const MemoryLocation &Loc);
 
   ModRefInfo getModRefInfo(ImmutableCallSite CS1, ImmutableCallSite CS2);
 
   /// Chases pointers until we find a (constant global) or not.
   bool pointsToConstantMemory(const MemoryLocation &Loc, bool OrLocal);
 
   /// Get the location associated with a pointer argument of a callsite.
   ModRefInfo getArgModRefInfo(ImmutableCallSite CS, unsigned ArgIdx);
 
   /// Returns the behavior when calling the given call site.
   FunctionModRefBehavior getModRefBehavior(ImmutableCallSite CS);
 
   /// Returns the behavior when calling the given function. For use when the
   /// call site is not known.
-  FunctionModRefBehavior getModRefBehavior(const Function *F);
+  FunctionModRefBehavior getModRefBehavior(const Function *Fn);
 
 private:
   // A linear transformation of a Value; this class represents ZExt(SExt(V,
   // SExtBits), ZExtBits) * Scale + Offset.
   struct VariableGEPIndex {
     // An opaque Value - we can't decompose this further.
     const Value *V;
 

include/llvm/IR/CallSite.h

#undef CALLSITE_DELEGATE_SETTER
 
   /// Return true if the return value is known to be not null.
   /// This may be because it has the nonnull attribute, or because at least
   /// one byte is dereferenceable and the pointer is in addrspace(0).
   bool isReturnNonNull() const {
     if (hasRetAttr(Attribute::NonNull))
       return true;
     else if (getDereferenceableBytes(AttributeList::ReturnIndex) > 0 &&
-             getType()->getPointerAddressSpace() == 0)
+             !NullPointerIsDefined(getCaller(),
+                                   getType()->getPointerAddressSpace()))
       return true;
 
     return false;
   }
 
   /// Returns true if this CallSite passes the given Value* as an argument to
   /// the called function.
   bool hasArgument(const Value *Arg) const {

include/llvm/IR/Function.h

/// @}
   ///
   /// Calls \a getMetadata() with \a LLVMContext::MD_dbg and casts the result
   /// to \a DISubprogram.
   DISubprogram *getSubprogram() const;
 
   /// Returns true if we should emit debug info for profiling.
   bool isDebugInfoForProfiling() const;
 
+  /// Check if null pointer dereferencing is considered undefined behavior for
+  /// the function.
+  /// Return value: false => null pointer dereference is undefined.
+  /// Return value: true =>  null pointer dereference is not undefined.
+  bool nullPointerIsDefined() const;
+
 private:
   void allocHungoffUselist();
   template<int Idx> void setHungoffOperand(Constant *C);
 
   /// Shadow Value::setValueSubclassData with a private forwarding method so
   /// that subclasses cannot accidentally use it.
   void setValueSubclassData(unsigned short D) {
     Value::setValueSubclassData(D);
   }
   void setValueSubclassDataBit(unsigned Bit, bool On);
 };
 
+/// Check whether null pointer dereferencing is considered undefined behavior
+/// for a given function or an address space.
+/// Null pointer access in non-zero address space is not considered undefined.
+/// Return value: false => null pointer dereference is undefined.
+/// Return value: true =>  null pointer dereference is not undefined.
+bool NullPointerIsDefined(const Function *F, unsigned AS = 0);
+
 template <>
 struct OperandTraits<Function> : public HungoffOperandTraits<3> {};
 
 DEFINE_TRANSPARENT_OPERAND_ACCESSORS(Function, Value)
 
 } // end namespace llvm
 
 #endif // LLVM_IR_FUNCTION_H

lib/Analysis/BasicAliasAnalysis.cpp

 /// cannot be involved in a cycle.
 const unsigned MaxNumPhiBBsValueReachabilityCheck = 20;
 
 // The max limit of the search depth in DecomposeGEPExpression() and
 // GetUnderlyingObject(), both functions need to use the same search
 // depth otherwise the algorithm in aliasGEP will assert.
 static const unsigned MaxLookupSearchDepth = 6;
 
-bool BasicAAResult::invalidate(Function &F, const PreservedAnalyses &PA,
+bool BasicAAResult::invalidate(Function &Fn, const PreservedAnalyses &PA,
                                FunctionAnalysisManager::Invalidator &Inv) {
   // We don't care if this analysis itself is preserved, it has no state. But
   // we need to check that the analyses it depends on have been. Note that we
   // may be created without handles to some analyses and in that case don't
   // depend on them.
-  if (Inv.invalidate<AssumptionAnalysis>(F, PA) ||
-      (DT && Inv.invalidate<DominatorTreeAnalysis>(F, PA)) ||
-      (LI && Inv.invalidate<LoopAnalysis>(F, PA)))
+  if (Inv.invalidate<AssumptionAnalysis>(Fn, PA) ||
+      (DT && Inv.invalidate<DominatorTreeAnalysis>(Fn, PA)) ||
+      (LI && Inv.invalidate<LoopAnalysis>(Fn, PA)))
     return true;
 
   // Otherwise this analysis result remains valid.
   return false;
 }
 
 //===----------------------------------------------------------------------===//
 // Useful predicates
if (O1 == nullptr)
     O1 = GetUnderlyingObject(V1, DL, MaxLookupSearchDepth);
 
   if (O2 == nullptr)
     O2 = GetUnderlyingObject(V2, DL, MaxLookupSearchDepth);
 
   // Null values in the default address space don't point to any object, so they
   // don't alias any other pointer.
   if (const ConstantPointerNull *CPN = dyn_cast<ConstantPointerNull>(O1))
-    if (CPN->getType()->getAddressSpace() == 0)
+    if (!NullPointerIsDefined(&F, CPN->getType()->getAddressSpace()))
       return NoAlias;
   if (const ConstantPointerNull *CPN = dyn_cast<ConstantPointerNull>(O2))
-    if (CPN->getType()->getAddressSpace() == 0)
+    if (!NullPointerIsDefined(&F, CPN->getType()->getAddressSpace()))
       return NoAlias;
 
   if (O1 != O2) {
     // If V1/V2 point to two different objects, we know that we have no alias.
     if (isIdentifiedObject(O1) && isIdentifiedObject(O2))
       return NoAlias;
 
     // Constant pointers can't alias with non-const isIdentifiedObject objects.

 //===----------------------------------------------------------------------===//
 // BasicAliasAnalysis Pass
 //===----------------------------------------------------------------------===//
 
 AnalysisKey BasicAA::Key;
 
 BasicAAResult BasicAA::run(Function &F, FunctionAnalysisManager &AM) {
   return BasicAAResult(F.getParent()->getDataLayout(),
+                       F,
                        AM.getResult<TargetLibraryAnalysis>(F),
                        AM.getResult<AssumptionAnalysis>(F),
                        &AM.getResult<DominatorTreeAnalysis>(F),
                        AM.getCachedResult<LoopAnalysis>(F));
 }
 
 BasicAAWrapperPass::BasicAAWrapperPass() : FunctionPass(ID) {
     initializeBasicAAWrapperPassPass(*PassRegistry::getPassRegistry());

 }
 
 bool BasicAAWrapperPass::runOnFunction(Function &F) {
   auto &ACT = getAnalysis<AssumptionCacheTracker>();
   auto &TLIWP = getAnalysis<TargetLibraryInfoWrapperPass>();
   auto &DTWP = getAnalysis<DominatorTreeWrapperPass>();
   auto *LIWP = getAnalysisIfAvailable<LoopInfoWrapperPass>();
 
-  Result.reset(new BasicAAResult(F.getParent()->getDataLayout(), TLIWP.getTLI(),
+  Result.reset(new BasicAAResult(F.getParent()->getDataLayout(), F, TLIWP.getTLI(),
                                  ACT.getAssumptionCache(F), &DTWP.getDomTree(),
                                  LIWP ? &LIWP->getLoopInfo() : nullptr));
 
   return false;
 }
 
 void BasicAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const {
   AU.setPreservesAll();
   AU.addRequired<AssumptionCacheTracker>();
   AU.addRequired<DominatorTreeWrapperPass>();
   AU.addRequired<TargetLibraryInfoWrapperPass>();
 }
 
 BasicAAResult llvm::createLegacyPMBasicAAResult(Pass &P, Function &F) {
   return BasicAAResult(
       F.getParent()->getDataLayout(),
+      F,
       P.getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(),
       P.getAnalysis<AssumptionCacheTracker>().getAssumptionCache(F));
 }

lib/Analysis/ConstantFolding.cpp

double getValueAsDouble(ConstantFP *Op) {
   bool unused;
   APFloat APF = Op->getValueAPF();
   APF.convert(APFloat::IEEEdouble(), APFloat::rmNearestTiesToEven, &unused);
   return APF.convertToDouble();
 }
 
 Constant *ConstantFoldScalarCall(StringRef Name, unsigned IntrinsicID, Type *Ty,
                                  ArrayRef<Constant *> Operands,
-                                 const TargetLibraryInfo *TLI) {
+                                 const TargetLibraryInfo *TLI,
+                                 ImmutableCallSite CS) {
   if (Operands.size() == 1) {
     if (isa<UndefValue>(Operands[0])) {
       // cosine(arg) is between -1 and 1. cosine(invalid arg) is NaN
       if (IntrinsicID == Intrinsic::cos)
         return Constant::getNullValue(Ty);
       if (IntrinsicID == Intrinsic::bswap ||
           IntrinsicID == Intrinsic::bitreverse ||
           IntrinsicID == Intrinsic::launder_invariant_group)
         return Operands[0];
     }
 
     if (isa<ConstantPointerNull>(Operands[0]) &&
-        Operands[0]->getType()->getPointerAddressSpace() == 0) {
+        !NullPointerIsDefined(
+            CS.getCaller(), Operands[0]->getType()->getPointerAddressSpace())) {
       // launder(null) == null iff in addrspace 0
       if (IntrinsicID == Intrinsic::launder_invariant_group)
         return Operands[0];
       return nullptr;
     }
 
     if (auto *Op = dyn_cast<ConstantFP>(Operands[0])) {
       if (IntrinsicID == Intrinsic::convert_to_fp16) {
Constant *ConstantFoldScalarCall(StringRef Name, unsigned IntrinsicID, Type *Ty,
   }
 
   return nullptr;
 }
 
 Constant *ConstantFoldVectorCall(StringRef Name, unsigned IntrinsicID,
                                  VectorType *VTy, ArrayRef<Constant *> Operands,
                                  const DataLayout &DL,
-                                 const TargetLibraryInfo *TLI) {
+                                 const TargetLibraryInfo *TLI,
+                                 ImmutableCallSite CS) {
   SmallVector<Constant *, 4> Result(VTy->getNumElements());
   SmallVector<Constant *, 4> Lane(Operands.size());
   Type *Ty = VTy->getElementType();
 
   if (IntrinsicID == Intrinsic::masked_load) {
     auto *SrcPtr = Operands[0];
     auto *Mask = Operands[2];
     auto *Passthru = Operands[3];
for (unsigned J = 0, JE = Operands.size(); J != JE; ++J) {
       Constant *Agg = Operands[J]->getAggregateElement(I);
       if (!Agg)
         return nullptr;
 
       Lane[J] = Agg;
     }
 
     // Use the regular scalar folding to simplify this column.
-    Constant *Folded = ConstantFoldScalarCall(Name, IntrinsicID, Ty, Lane, TLI);
+    Constant *Folded = ConstantFoldScalarCall(Name, IntrinsicID, Ty, Lane, TLI, CS);
     if (!Folded)
       return nullptr;
     Result[I] = Folded;
   }
 
   return ConstantVector::get(Result);
 }
 
 } // end anonymous namespace
 
 Constant *
 llvm::ConstantFoldCall(ImmutableCallSite CS, Function *F,
                        ArrayRef<Constant *> Operands,
                        const TargetLibraryInfo *TLI) {
   if (CS.isNoBuiltin() || CS.isStrictFP())
     return nullptr;
   if (!F->hasName())
     return nullptr;
   StringRef Name = F->getName();
 
   Type *Ty = F->getReturnType();
 
   if (auto *VTy = dyn_cast<VectorType>(Ty))
     return ConstantFoldVectorCall(Name, F->getIntrinsicID(), VTy, Operands,
-                                  F->getParent()->getDataLayout(), TLI);
+                                  F->getParent()->getDataLayout(), TLI, CS);
 
-  return ConstantFoldScalarCall(Name, F->getIntrinsicID(), Ty, Operands, TLI);
+  return ConstantFoldScalarCall(Name, F->getIntrinsicID(), Ty, Operands, TLI, CS);
 }
 
 bool llvm::isMathLibCallNoop(CallSite CS, const TargetLibraryInfo *TLI) {
   // FIXME: Refactor this code; this duplicates logic in LibCallsShrinkWrap
   // (and to some extent ConstantFoldScalarCall).
   if (CS.isNoBuiltin() || CS.isStrictFP())
     return false;
   Function *F = CS.getCalledFunction();

lib/Analysis/InlineCost.cpp

InlineCost llvm::getInlineCost(
   Function *Caller = CS.getCaller();
   if (!functionsHaveCompatibleAttributes(Caller, Callee, CalleeTTI))
     return llvm::InlineCost::getNever();
 
   // Don't inline this call if the caller has the optnone attribute.
   if (Caller->hasFnAttribute(Attribute::OptimizeNone))
     return llvm::InlineCost::getNever();
 
+  // Don't inline a function that treats null pointer as valid into a caller
+  // that does not have this attribute.
+  if (!Caller->nullPointerIsDefined() && Callee->nullPointerIsDefined())
+    return llvm::InlineCost::getNever();
+
   // Don't inline functions which can be interposed at link-time.  Don't inline
   // functions marked noinline or call sites marked noinline.
   // Note: inlining non-exact non-interposable functions is fine, since we know
   // we have *a* correct implementation of the source level function.
   if (Callee->isInterposable() || Callee->hasFnAttribute(Attribute::NoInline) ||
       CS.isNoInline())
     return llvm::InlineCost::getNever();
 

lib/Analysis/LazyValueInfo.cpp

bool LazyValueInfoImpl::solveBlockValueNonLocal(ValueLatticeElement &BBLV,
   ValueLatticeElement Result;  // Start Undefined.
 
   // If this is the entry block, we must be asking about an argument.  The
   // value is overdefined.
   if (BB == &BB->getParent()->getEntryBlock()) {
     assert(isa<Argument>(Val) && "Unknown live-in to the entry block");
     // Before giving up, see if we can prove the pointer non-null local to
     // this particular block.
-    if (Val->getType()->isPointerTy() &&
-        (isKnownNonZero(Val, DL) || isObjectDereferencedInBlock(Val, BB))) {
-      PointerType *PTy = cast<PointerType>(Val->getType());
+    PointerType *PTy = dyn_cast<PointerType>(Val->getType());
+    if (PTy &&
+        (isKnownNonZero(Val, DL) ||
+          (isObjectDereferencedInBlock(Val, BB) &&
+           !NullPointerIsDefined(BB->getParent(), PTy->getAddressSpace())))) {
       Result = ValueLatticeElement::getNot(ConstantPointerNull::get(PTy));
     } else {
       Result = ValueLatticeElement::getOverdefined();
     }
     BBLV = Result;
     return true;
   }
 
for (pred_iterator PI = pred_begin(BB), E = pred_end(BB); PI != E; ++PI) {
 
     // If we hit overdefined, exit early.  The BlockVals entry is already set
     // to overdefined.
     if (Result.isOverdefined()) {
       LLVM_DEBUG(dbgs() << " compute BB '" << BB->getName()
                         << "' - overdefined because of pred (non local).\n");
       // Before giving up, see if we can prove the pointer non-null local to
       // this particular block.
-      if (Val->getType()->isPointerTy() &&
-          isObjectDereferencedInBlock(Val, BB)) {
-        PointerType *PTy = cast<PointerType>(Val->getType());
+      PointerType *PTy = dyn_cast<PointerType>(Val->getType());
+      if (PTy && isObjectDereferencedInBlock(Val, BB) &&
+          !NullPointerIsDefined(BB->getParent(), PTy->getAddressSpace())) {
         Result = ValueLatticeElement::getNot(ConstantPointerNull::get(PTy));
       }
 
       BBLV = Result;
       return true;
     }
   }
 

lib/Analysis/LoopAccessAnalysis.cpp

 /// Checks whether run time pointer checks are needed and builds sets for data
 /// dependence checking.
 class AccessAnalysis {
 public:
   /// Read or write access location.
   typedef PointerIntPair<Value *, 1, bool> MemAccessInfo;
   typedef SmallVector<MemAccessInfo, 8> MemAccessInfoList;
 
-  AccessAnalysis(const DataLayout &Dl, AliasAnalysis *AA, LoopInfo *LI,
-                 MemoryDepChecker::DepCandidates &DA,
+  AccessAnalysis(const DataLayout &Dl, Loop *TheLoop, AliasAnalysis *AA,
+                 LoopInfo *LI, MemoryDepChecker::DepCandidates &DA,
                  PredicatedScalarEvolution &PSE)
-      : DL(Dl), AST(*AA), LI(LI), DepCands(DA), IsRTCheckAnalysisNeeded(false),
-        PSE(PSE) {}
+      : DL(Dl), TheLoop(TheLoop), AST(*AA), LI(LI), DepCands(DA),
+        IsRTCheckAnalysisNeeded(false), PSE(PSE) {}
 
   /// Register a load  and whether it is only read from.
   void addLoad(MemoryLocation &Loc, bool IsReadOnly) {
     Value *Ptr = const_cast<Value*>(Loc.Ptr);
     AST.add(Ptr, MemoryLocation::UnknownSize, Loc.AATags);
     Accesses.insert(MemAccessInfo(Ptr, false));
     if (IsReadOnly)
       ReadOnlyPtr.insert(Ptr);
private:
   /// are needed and build sets of dependency check candidates.
   void processMemAccesses();
 
   /// Set of all accesses.
   PtrAccessSet Accesses;
 
   const DataLayout &DL;
 
+  /// The loop being checked.
+  const Loop *TheLoop;
+
   /// List of accesses that need a further dependence check.
   MemAccessInfoList CheckDeps;
 
   /// Set of pointers that are read only.
   SmallPtrSet<Value*, 16> ReadOnlyPtr;
 
   /// An alias set tracker to partition the access set by underlying object and
   //intrinsic property (such as TBAA metadata).
for (int SetIteration = 0; SetIteration < 2; ++SetIteration) {
           ValueVector TempObjects;
 
           GetUnderlyingObjects(Ptr, TempObjects, DL, LI);
           LLVM_DEBUG(dbgs()
                      << "Underlying objects for pointer " << *Ptr << "\n");
           for (Value *UnderlyingObj : TempObjects) {
             // nullptr never alias, don't join sets for pointer that have "null"
             // in their UnderlyingObjects list.
-            if (isa<ConstantPointerNull>(UnderlyingObj))
+            if (isa<ConstantPointerNull>(UnderlyingObj) &&
+                !NullPointerIsDefined(
+                    TheLoop->getHeader()->getParent(),
+                    UnderlyingObj->getType()->getPointerAddressSpace()))
               continue;
 
             UnderlyingObjToAccessMap::iterator Prev =
                 ObjToLastAccess.find(UnderlyingObj);
             if (Prev != ObjToLastAccess.end())
               DepCands.unionSets(Access, Prev->second);
 
             ObjToLastAccess[UnderlyingObj] = Access;
int64_t llvm::getPtrStride(PredicatedScalarEvolution &PSE, Value *Ptr,
   // cannot wrap per definition. The unit stride requirement is checked later.
   // An getelementptr without an inbounds attribute and unit stride would have
   // to access the pointer value "0" which is undefined behavior in address
   // space 0, therefore we can also vectorize this case.
   bool IsInBoundsGEP = isInBoundsGep(Ptr);
   bool IsNoWrapAddRec = !ShouldCheckWrap ||
     PSE.hasNoOverflow(Ptr, SCEVWrapPredicate::IncrementNUSW) ||
     isNoWrapAddRec(Ptr, AR, PSE, Lp);
-  bool IsInAddressSpaceZero = PtrTy->getAddressSpace() == 0;
-  if (!IsNoWrapAddRec && !IsInBoundsGEP && !IsInAddressSpaceZero) {
+  if (!IsNoWrapAddRec && !IsInBoundsGEP &&
+      NullPointerIsDefined(Lp->getHeader()->getParent(),
+                           PtrTy->getAddressSpace())) {
     if (Assume) {
       PSE.setNoOverflow(Ptr, SCEVWrapPredicate::IncrementNUSW);
       IsNoWrapAddRec = true;
       LLVM_DEBUG(dbgs() << "LAA: Pointer may wrap in the address space:\n"
                         << "LAA:   Pointer: " << *Ptr << "\n"
                         << "LAA:   SCEV: " << *AR << "\n"
                         << "LAA:   Added an overflow assumption\n");
     } else {
int64_t llvm::getPtrStride(PredicatedScalarEvolution &PSE, Value *Ptr,
   int64_t Stride = StepVal / Size;
   int64_t Rem = StepVal % Size;
   if (Rem)
     return 0;
 
   // If the SCEV could wrap but we have an inbounds gep with a unit stride we
   // know we can't "wrap around the address space". In case of address space
   // zero we know that this won't happen without triggering undefined behavior.
-  if (!IsNoWrapAddRec && (IsInBoundsGEP || IsInAddressSpaceZero) &&
-      Stride != 1 && Stride != -1) {
+  if (!IsNoWrapAddRec && Stride != 1 && Stride != -1 &&
+      (IsInBoundsGEP || !NullPointerIsDefined(Lp->getHeader()->getParent(),
+                                              PtrTy->getAddressSpace()))) {
     if (Assume) {
       // We can avoid this case by adding a run-time check.
       LLVM_DEBUG(dbgs() << "LAA: Non unit strided pointer which is not either "
                         << "inbouds or in address space 0 may wrap:\n"
                         << "LAA:   Pointer: " << *Ptr << "\n"
                         << "LAA:   SCEV: " << *AR << "\n"
                         << "LAA:   Added an overflow assumption\n");
       PSE.setNoOverflow(Ptr, SCEVWrapPredicate::IncrementNUSW);
void LoopAccessInfo::analyzeLoop(AliasAnalysis *AA, LoopInfo *LI,
   if (!Stores.size()) {
     LLVM_DEBUG(dbgs() << "LAA: Found a read-only loop!\n");
     CanVecMem = true;
     return;
   }
 
   MemoryDepChecker::DepCandidates DependentAccesses;
   AccessAnalysis Accesses(TheLoop->getHeader()->getModule()->getDataLayout(),
-                          AA, LI, DependentAccesses, *PSE);
+                          TheLoop, AA, LI, DependentAccesses, *PSE);
 
   // Holds the analyzed pointers. We don't want to call GetUnderlyingObjects
   // multiple times on the same object. If the ptr is accessed twice, once
   // for read and once for write, it will only appear once (on the write
   // list). This is okay, since we are going to check for conflicts between
   // writes and between reads and writes, but not between reads and reads.
   ValueSet Seen;
 

lib/Analysis/ValueTracking.cpp

 /// Test whether a GEP's result is known to be non-null.
 ///
 /// Uses properties inherent in a GEP to try to determine whether it is known
 /// to be non-null.
 ///
 /// Currently this routine does not support vector GEPs.
 static bool isGEPKnownNonNull(const GEPOperator *GEP, unsigned Depth,
                               const Query &Q) {
-  if (!GEP->isInBounds() || GEP->getPointerAddressSpace() != 0)
+  const Function *F = nullptr;
+  if (const Instruction *I = dyn_cast<Instruction>(GEP))
+    F = I->getFunction();
+
+  if (!GEP->isInBounds() ||
+      NullPointerIsDefined(F, GEP->getPointerAddressSpace()))
     return false;
 
   // FIXME: Support vector-GEPs.
   assert(GEP->getType()->isPointerTy() && "We only support plain pointer GEP");
 
   // If the base pointer is non-null, we cannot walk to a null address with an
   // inbounds GEP in address space zero.
   if (isKnownNonZero(GEP->getPointerOperand(), Depth, Q))

lib/IR/ConstantFold.cpp

if (const GlobalValue *GV2 = dyn_cast<GlobalValue>(V2)) {
       return areGlobalsPotentiallyEqual(GV, GV2);
     } else if (isa<BlockAddress>(V2)) {
       return ICmpInst::ICMP_NE; // Globals never equal labels.
     } else {
       assert(isa<ConstantPointerNull>(V2) && "Canonicalization guarantee!");
       // GlobalVals can never be null unless they have external weak linkage.
       // We don't try to evaluate aliases here.
       if (!GV->hasExternalWeakLinkage() && !isa<GlobalAlias>(GV) &&
-          GV->getType()->getAddressSpace() == 0)
+          !NullPointerIsDefined(nullptr /* F */,
+                                GV->getType()->getAddressSpace()))
         return ICmpInst::ICMP_NE;
     }
   } else if (const BlockAddress *BA = dyn_cast<BlockAddress>(V1)) {
     if (isa<ConstantExpr>(V2)) {  // Swap as necessary.
       ICmpInst::Predicate SwappedRelation =
         evaluateICmpRelation(V2, V1, isSigned);
       if (SwappedRelation != ICmpInst::BAD_ICMP_PREDICATE)
         return ICmpInst::getSwappedPredicate(SwappedRelation);
if (isa<UndefValue>(C1) || isa<UndefValue>(C2)) {
     return ConstantInt::get(ResultTy, CmpInst::isUnordered(Predicate));
   }
 
   // icmp eq/ne(null,GV) -> false/true
   if (C1->isNullValue()) {
     if (const GlobalValue *GV = dyn_cast<GlobalValue>(C2))
       // Don't try to evaluate aliases.  External weak GV can be null.
       if (!isa<GlobalAlias>(GV) && !GV->hasExternalWeakLinkage() &&
-          GV->getType()->getAddressSpace() == 0) {
+          !NullPointerIsDefined(nullptr /* F */,
+                                GV->getType()->getAddressSpace())) {
         if (pred == ICmpInst::ICMP_EQ)
           return ConstantInt::getFalse(C1->getContext());
         else if (pred == ICmpInst::ICMP_NE)
           return ConstantInt::getTrue(C1->getContext());
       }
   // icmp eq/ne(GV,null) -> false/true
   } else if (C2->isNullValue()) {
     if (const GlobalValue *GV = dyn_cast<GlobalValue>(C1))
       // Don't try to evaluate aliases.  External weak GV can be null.
       if (!isa<GlobalAlias>(GV) && !GV->hasExternalWeakLinkage() &&
-          GV->getType()->getAddressSpace() == 0) {
+          !NullPointerIsDefined(nullptr /* F */,
+                                GV->getType()->getAddressSpace())) {
         if (pred == ICmpInst::ICMP_EQ)
           return ConstantInt::getFalse(C1->getContext());
         else if (pred == ICmpInst::ICMP_NE)
           return ConstantInt::getTrue(C1->getContext());
       }
   }
 
   // If the comparison is a comparison between two i1's, simplify it.

lib/IR/Function.cpp

void Argument::setParent(Function *parent) {
   Parent = parent;
 }
 
 bool Argument::hasNonNullAttr() const {
   if (!getType()->isPointerTy()) return false;
   if (getParent()->hasParamAttribute(getArgNo(), Attribute::NonNull))
     return true;
   else if (getDereferenceableBytes() > 0 &&
-           getType()->getPointerAddressSpace() == 0)
+           !NullPointerIsDefined(getParent(),
+                                 getType()->getPointerAddressSpace()))
     return true;
   return false;
 }
 
 bool Argument::hasByValAttr() const {
   if (!getType()->isPointerTy()) return false;
   return hasAttribute(Attribute::ByVal);
 }
if (MDNode *MD = getMetadata(LLVMContext::MD_section_prefix)) {
     assert(cast<MDString>(MD->getOperand(0))
                ->getString()
                .equals("function_section_prefix") &&
            "Metadata not match");
     return cast<MDString>(MD->getOperand(1))->getString();
   }
   return None;
 }
+
+bool Function::nullPointerIsDefined() const {
+  return getFnAttribute("null-pointer-is-valid")
+          .getValueAsString()
+          .equals("true");
+}
+
+bool llvm::NullPointerIsDefined(const Function *F, unsigned AS) {
+  if (F && F->nullPointerIsDefined())
+    return true;
+
+  if (AS != 0)
+    return true;
+
+  return false;
+}

lib/Transforms/IPO/GlobalOpt.cpp

static GlobalVariable *SRAGlobal(GlobalVariable *GV, const DataLayout &DL) {
   return FirstGlobal != NewGlobals.size() ? NewGlobals[FirstGlobal] : nullptr;
 }
 
 /// Return true if all users of the specified value will trap if the value is
 /// dynamically null.  PHIs keeps track of any phi nodes we've seen to avoid
 /// reprocessing them.
 static bool AllUsesOfValueWillTrapIfNull(const Value *V,
                                         SmallPtrSetImpl<const PHINode*> &PHIs) {
-  for (const User *U : V->users())
+  for (const User *U : V->users()) {
+    if (const Instruction *I = dyn_cast<Instruction>(U)) {
+      // If null pointer is considered valid, then all uses are non-trapping.
+      // Non address-space 0 globals have already been pruned by the caller.
+      if (NullPointerIsDefined(I->getFunction()))
+        return false;
+    }
     if (isa<LoadInst>(U)) {
       // Will trap.
     } else if (const StoreInst *SI = dyn_cast<StoreInst>(U)) {
       if (SI->getOperand(0) == V) {
         //cerr << "NONTRAPPING USE: " << *U;
         return false;  // Storing the value.
       }
     } else if (const CallInst *CI = dyn_cast<CallInst>(U)) {
if (isa<LoadInst>(U)) {
         return false;
     } else if (isa<ICmpInst>(U) &&
                isa<ConstantPointerNull>(U->getOperand(1))) {
       // Ignore icmp X, null
     } else {
       //cerr << "NONTRAPPING USE: " << *U;
       return false;
     }
-
+  }
   return true;
 }
 
 /// Return true if all uses of any loads from GV will trap if the loaded value
 /// is null.  Note that this also permits comparisons of the loaded value
 /// against null, as a special case.
 static bool AllUsesOfLoadedValueWillTrapIfNull(const GlobalVariable *GV) {
   for (const User *U : GV->users())
for (const User *U : GV->users())
     }
   return true;
 }
 
 static bool OptimizeAwayTrappingUsesOfValue(Value *V, Constant *NewV) {
   bool Changed = false;
   for (auto UI = V->user_begin(), E = V->user_end(); UI != E; ) {
     Instruction *I = cast<Instruction>(*UI++);
+    // Uses are non-trapping if null pointer is considered valid.
+    // Non address-space 0 globals are already pruned by the caller.
+    if (NullPointerIsDefined(I->getFunction()))
+      return false;
     if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
       LI->setOperand(0, NewV);
       Changed = true;
     } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
       if (SI->getOperand(1) == V) {
         SI->setOperand(1, NewV);
         Changed = true;
       }
static bool optimizeOnceStoredGlobal(GlobalVariable *GV, Value *StoredOnceVal,
   // Ignore no-op GEPs and bitcasts.
   StoredOnceVal = StoredOnceVal->stripPointerCasts();
 
   // If we are dealing with a pointer global that is initialized to null and
   // only has one (non-null) value stored into it, then we can optimize any
   // users of the loaded value (often calls and loads) that would trap if the
   // value was null.
   if (GV->getInitializer()->getType()->isPointerTy() &&
-      GV->getInitializer()->isNullValue()) {
+      GV->getInitializer()->isNullValue() &&
+      !NullPointerIsDefined(
+          nullptr /* F */,
+          GV->getInitializer()->getType()->getPointerAddressSpace())) {
     if (Constant *SOVC = dyn_cast<Constant>(StoredOnceVal)) {
       if (GV->getInitializer()->getType() != SOVC->getType())
         SOVC = ConstantExpr::getBitCast(SOVC, GV->getInitializer()->getType());
 
       // Optimize away any trapping uses of the loaded value.
       if (OptimizeAwayTrappingUsesOfLoads(GV, SOVC, DL, TLI))
         return true;
     } else if (CallInst *CI = extractMallocCall(StoredOnceVal, TLI)) {
static bool processInternalGlobal(
   //
   // NOTE: It doesn't make sense to promote non-single-value types since we
   // are just replacing static memory to stack memory.
   //
   // If the global is in different address space, don't bring it to stack.
   if (!GS.HasMultipleAccessingFunctions &&
       GS.AccessingFunction &&
       GV->getValueType()->isSingleValueType() &&
       GV->getType()->getAddressSpace() == 0 &&
       !GV->isExternallyInitialized() &&
       allNonInstructionUsersCanBeMadeInstructions(GV) &&
       GS.AccessingFunction->doesNotRecurse() &&
       isPointerValueDeadOnEntryToFunction(GS.AccessingFunction, GV,
                                           LookupDomTree)) {
     const DataLayout &DL = GV->getParent()->getDataLayout();
 
     LLVM_DEBUG(dbgs() << "LOCALIZING GLOBAL: " << *GV << "\n");

lib/Transforms/InstCombine/InstCombineCalls.cpp

if (CalleeF->getCallingConv() != CS.getCallingConv() &&
       // We cannot remove an invoke, because it would change the CFG, just
       // change the callee to a null pointer.
       cast<InvokeInst>(OldCall)->setCalledFunction(
                                     Constant::getNullValue(CalleeF->getType()));
       return nullptr;
     }
   }
 
-  if (isa<ConstantPointerNull>(Callee) || isa<UndefValue>(Callee)) {
+  if ((isa<ConstantPointerNull>(Callee) &&
+       !NullPointerIsDefined(CS.getInstruction()->getFunction())) ||
+      isa<UndefValue>(Callee)) {
     // If CS does not return void then replaceAllUsesWith undef.
     // This allows ValueHandlers and custom metadata to adjust itself.
     if (!CS.getInstruction()->getType()->isVoidTy())
       replaceInstUsesWith(*CS.getInstruction(),
                           UndefValue::get(CS.getInstruction()->getType()));
 
     if (isa<InvokeInst>(CS.getInstruction())) {
       // Can't remove an invoke because we cannot change the CFG.

lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp

if (canReplaceGEPIdxWithZero(IC, GEPI, &MemI, Idx)) {
       return NewGEPI;
     }
   }
 
   return nullptr;
 }
 
 static bool canSimplifyNullStoreOrGEP(StoreInst &SI) {
-  if (SI.getPointerAddressSpace() != 0)
+  if (NullPointerIsDefined(SI.getFunction(), SI.getPointerAddressSpace()))
     return false;
 
   auto *Ptr = SI.getPointerOperand();
   if (GetElementPtrInst *GEPI = dyn_cast<GetElementPtrInst>(Ptr))
     Ptr = GEPI->getOperand(0);
-  return isa<ConstantPointerNull>(Ptr);
+  return (isa<ConstantPointerNull>(Ptr) &&
+          !NullPointerIsDefined(SI.getFunction(), SI.getPointerAddressSpace()));
 }
 
 static bool canSimplifyNullLoadOrGEP(LoadInst &LI, Value *Op) {
   if (GetElementPtrInst *GEPI = dyn_cast<GetElementPtrInst>(Op)) {
     const Value *GEPI0 = GEPI->getOperand(0);
-    if (isa<ConstantPointerNull>(GEPI0) && GEPI->getPointerAddressSpace() == 0)
+    if (isa<ConstantPointerNull>(GEPI0) &&
+        !NullPointerIsDefined(LI.getFunction(), GEPI->getPointerAddressSpace()))
       return true;
   }
   if (isa<UndefValue>(Op) ||
-      (isa<ConstantPointerNull>(Op) && LI.getPointerAddressSpace() == 0))
+      (isa<ConstantPointerNull>(Op) &&
+       !NullPointerIsDefined(LI.getFunction(), LI.getPointerAddressSpace())))
     return true;
   return false;
 }
 
 Instruction *InstCombiner::visitLoadInst(LoadInst &LI) {
   Value *Op = LI.getOperand(0);
 
   // Try to canonicalize the loaded type.
if (SelectInst *SI = dyn_cast<SelectInst>(Op)) {
         V1->setAtomic(LI.getOrdering(), LI.getSyncScopeID());
         V2->setAlignment(Align);
         V2->setAtomic(LI.getOrdering(), LI.getSyncScopeID());
         return SelectInst::Create(SI->getCondition(), V1, V2);
       }
 
       // load (select (cond, null, P)) -> load P
       if (isa<ConstantPointerNull>(SI->getOperand(1)) &&
-          LI.getPointerAddressSpace() == 0) {
+          !NullPointerIsDefined(SI->getFunction(),
+                                LI.getPointerAddressSpace())) {
         LI.setOperand(0, SI->getOperand(2));
         return &LI;
       }
 
       // load (select (cond, P, null)) -> load P
       if (isa<ConstantPointerNull>(SI->getOperand(2)) &&
-          LI.getPointerAddressSpace() == 0) {
+          !NullPointerIsDefined(SI->getFunction(),
+                                LI.getPointerAddressSpace())) {
         LI.setOperand(0, SI->getOperand(1));
         return &LI;
       }
     }
   }
   return nullptr;
 }
 

lib/Transforms/Scalar/SCCP.cpp

void SCCPSolver::visitLoadInst(LoadInst &I) {
   if (IV.isOverdefined()) return;
 
   if (!PtrVal.isConstant() || I.isVolatile())
     return markOverdefined(IV, &I);
 
   Constant *Ptr = PtrVal.getConstant();
 
   // load null is undefined.
-  if (isa<ConstantPointerNull>(Ptr) && I.getPointerAddressSpace() == 0)
+  if (isa<ConstantPointerNull>(Ptr)) {
+    if (NullPointerIsDefined(I.getFunction(), I.getPointerAddressSpace()))
+      return markOverdefined(IV, &I);
+    else
       return;
+  }
 
   // Transform load (constant global) into the value loaded.
   if (auto *GV = dyn_cast<GlobalVariable>(Ptr)) {
     if (!TrackedGlobals.empty()) {
       // If we are tracking this global, merge in the known value for it.
       DenseMap<GlobalVariable*, LatticeVal>::iterator It =
         TrackedGlobals.find(GV);
       if (It != TrackedGlobals.end()) {

lib/Transforms/Utils/Local.cpp

for (Instruction &I : *BB) {
               Changed = true;
               break;
             }
         }
       }
 
       if (auto *CI = dyn_cast<CallInst>(&I)) {
         Value *Callee = CI->getCalledValue();
-        if (isa<ConstantPointerNull>(Callee) || isa<UndefValue>(Callee)) {
+        if ((isa<ConstantPointerNull>(Callee) &&
+             !NullPointerIsDefined(CI->getFunction())) ||
+            isa<UndefValue>(Callee)) {
           changeToUnreachable(CI, /*UseLLVMTrap=*/false, false, DDT);
           Changed = true;
           break;
         }
         if (CI->doesNotReturn()) {
           // If we found a call to a no-return function, insert an unreachable
           // instruction after it.  Make sure there isn't *already* one there
           // though.
for (Instruction &I : *BB) {
       if (auto *SI = dyn_cast<StoreInst>(&I)) {
         // Don't touch volatile stores.
         if (SI->isVolatile()) continue;
 
         Value *Ptr = SI->getOperand(1);
 
         if (isa<UndefValue>(Ptr) ||
             (isa<ConstantPointerNull>(Ptr) &&
-             SI->getPointerAddressSpace() == 0)) {
+             !NullPointerIsDefined(SI->getFunction(),
+                                   SI->getPointerAddressSpace()))) {
           changeToUnreachable(SI, true, false, DDT);
           Changed = true;
           break;
         }
       }
     }
 
     TerminatorInst *Terminator = BB->getTerminator();
     if (auto *II = dyn_cast<InvokeInst>(Terminator)) {
       // Turn invokes that call 'nounwind' functions into ordinary calls.
       Value *Callee = II->getCalledValue();
-      if (isa<ConstantPointerNull>(Callee) || isa<UndefValue>(Callee)) {
+      if ((isa<ConstantPointerNull>(Callee) &&
+           !NullPointerIsDefined(BB->getParent())) ||
+          isa<UndefValue>(Callee)) {
         changeToUnreachable(II, true, false, DDT);
         Changed = true;
       } else if (II->doesNotThrow() && canSimplifyInvokeNoUnwind(&F)) {
         if (II->use_empty() && II->onlyReadsMemory()) {
           // jump to the normal destination branch.
           BasicBlock *NormalDestBB = II->getNormalDest();
           BasicBlock *UnwindDestBB = II->getUnwindDest();
           BranchInst::Create(NormalDestBB, II);

lib/Transforms/Utils/SimplifyCFG.cpp

if (C->isNullValue() || isa<UndefValue>(C)) {
 
     // Look through bitcasts.
     if (BitCastInst *BC = dyn_cast<BitCastInst>(Use))
       return passingValueIsAlwaysUndefined(V, BC);
 
     // Load from null is undefined.
     if (LoadInst *LI = dyn_cast<LoadInst>(Use))
       if (!LI->isVolatile())
-        return LI->getPointerAddressSpace() == 0;
+        return !NullPointerIsDefined(LI->getFunction(),
+                                     LI->getPointerAddressSpace());
 
     // Store to null is undefined.
     if (StoreInst *SI = dyn_cast<StoreInst>(Use))
       if (!SI->isVolatile())
-        return SI->getPointerAddressSpace() == 0 &&
+        return (!NullPointerIsDefined(SI->getFunction(),
+                                      SI->getPointerAddressSpace())) &&
                SI->getPointerOperand() == I;
 
     // A call to null is undefined.
     if (auto CS = CallSite(Use))
-      return CS.getCalledValue() == I;
+      return !NullPointerIsDefined(CS->getFunction()) &&
+             CS.getCalledValue() == I;
   }
   return false;
 }
 
 /// If BB has an incoming value that will always trigger undefined behavior
 /// (eg. null pointer dereference), remove the branch leading here.
 static bool removeUndefIntroducingPredecessor(BasicBlock *BB) {
   for (PHINode &PHI : BB->phis())

test/Analysis/MemorySSA/cyclicphi.ll

 ; CHECK:  2 = MemoryPhi({bb26,3},{bb68,1})
 ; CHECK:  MemoryUse(2)
 ; CHECK-NEXT:   %tmp78 = load i64*, i64** %tmp25, align 8
   %tmp78 = load i64*, i64** %tmp25, align 8
   %tmp79 = getelementptr inbounds i64, i64* %tmp78, i64 undef
   br label %bb26
 }
 
+define hidden void @quux_no_null_opt(%struct.hoge *%f) align 2 #0 {
+; CHECK-LABEL: quux_no_null_opt(
+  %tmp = getelementptr inbounds %struct.hoge, %struct.hoge* %f, i64 0, i32 1, i32 0
+  %tmp24 = getelementptr inbounds %struct.hoge, %struct.hoge* %f, i64 0, i32 1
+  %tmp25 = bitcast %struct.widget* %tmp24 to i64**
+  br label %bb26
+
+bb26:                                             ; preds = %bb77, %0
+; CHECK:  3 = MemoryPhi({%0,liveOnEntry},{bb77,2})
+; CHECK-NEXT:   br i1 undef, label %bb68, label %bb77
+  br i1 undef, label %bb68, label %bb77
+
+bb68:                                             ; preds = %bb26
+; CHECK:  MemoryUse(3)
+; CHECK-NEXT:   %tmp69 = load i64, i64* null, align 8
+  %tmp69 = load i64, i64* null, align 8
+; CHECK:  1 = MemoryDef(3)
+; CHECK-NEXT:   store i64 %tmp69, i64* %tmp, align 8
+  store i64 %tmp69, i64* %tmp, align 8
+  br label %bb77
+
+bb77:                                             ; preds = %bb68, %bb26
+; CHECK:  2 = MemoryPhi({bb26,3},{bb68,1})
+; CHECK:  MemoryUse(2)
+; CHECK-NEXT:   %tmp78 = load i64*, i64** %tmp25, align 8
+  %tmp78 = load i64*, i64** %tmp25, align 8
+  %tmp79 = getelementptr inbounds i64, i64* %tmp78, i64 undef
+  br label %bb26
+}
+
 ; CHECK-LABEL: define void @quux_skip
 define void @quux_skip(%struct.hoge* noalias %f, i64* noalias %g) align 2 {
   %tmp = getelementptr inbounds %struct.hoge, %struct.hoge* %f, i64 0, i32 1, i32 0
   %tmp24 = getelementptr inbounds %struct.hoge, %struct.hoge* %f, i64 0, i32 1
   %tmp25 = bitcast %struct.widget* %tmp24 to i64**
   br label %bb26
 
 bb26:                                             ; preds = %bb77, %0
; CHECK-NEXT: store i64 %tmp69, i64* %g, align 8
   store i64 %tmp69, i64* %g, align 8
   br label %bb77
 
 bb77:                                             ; preds = %bb68, %bb26
 ; CHECK: 2 = MemoryPhi({bb26,3},{bb68,1})
 ; CHECK-NEXT: br label %bb26
   br label %bb26
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/CorrelatedValuePropagation/non-null.ll

 ; RUN: opt < %s -correlated-propagation -S | FileCheck %s
 
 define void @test1(i8* %ptr) {
 ; CHECK: test1
   %A = load i8, i8* %ptr
   br label %bb
 bb:
   icmp ne i8* %ptr, null
 ; CHECK-NOT: icmp
   ret void
 }
 
+define void @test1_no_null_opt(i8* %ptr) #0 {
+; CHECK: test1_no_null_opt
+  %A = load i8, i8* %ptr
+  br label %bb
+bb:
+  icmp ne i8* %ptr, null
+; CHECK: icmp ne i8* %ptr, null
+  ret void
+}
+
 define void @test2(i8* %ptr) {
 ; CHECK: test2
   store i8 0, i8* %ptr
   br label %bb
 bb:
   icmp ne i8* %ptr, null
 ; CHECK-NOT: icmp
   ret void
 }
 
+define void @test2_no_null_opt(i8* %ptr) #0 {
+; CHECK: test2_no_null_opt
+  store i8 0, i8* %ptr
+  br label %bb
+bb:
+  icmp ne i8* %ptr, null
+; CHECK: icmp ne i8* %ptr, null
+  ret void
+}
+
 define void @test3() {
 ; CHECK: test3
   %ptr = alloca i8
   br label %bb
 bb:
   icmp ne i8* %ptr, null
 ; CHECK-NOT: icmp
   ret void
 }
 
+;; OK to remove icmp here since ptr is coming from alloca.
+define void @test3_no_null_opt() #0 {
+; CHECK: test3
+  %ptr = alloca i8
+  br label %bb
+bb:
+  icmp ne i8* %ptr, null
+; CHECK-NOT: icmp
+  ret void
+}
+
 declare void @llvm.memcpy.p0i8.p0i8.i32(i8*, i8*, i32, i1)
 define void @test4(i8* %dest, i8* %src) {
 ; CHECK: test4
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 1, i1 false)
   br label %bb
 bb:
   icmp ne i8* %dest, null
   icmp ne i8* %src, null
 ; CHECK-NOT: icmp
   ret void
 }
 
+define void @test4_no_null_opt(i8* %dest, i8* %src) #0 {
+; CHECK: test4_no_null_opt
+  call void @llvm.memcpy.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 1, i1 false)
+  br label %bb
+bb:
+  icmp ne i8* %dest, null
+  icmp ne i8* %src, null
+; CHECK: icmp ne i8* %dest, null
+; CHECK: icmp ne i8* %src, null
+  ret void
+}
+
 declare void @llvm.memmove.p0i8.p0i8.i32(i8*, i8*, i32, i1)
 define void @test5(i8* %dest, i8* %src) {
 ; CHECK: test5
   call void @llvm.memmove.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 1, i1 false)
   br label %bb
 bb:
   icmp ne i8* %dest, null
   icmp ne i8* %src, null
 ; CHECK-NOT: icmp
   ret void
 }
 
+define void @test5_no_null_opt(i8* %dest, i8* %src) #0 {
+; CHECK: test5_no_null_opt
+  call void @llvm.memmove.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 1, i1 false)
+  br label %bb
+bb:
+  icmp ne i8* %dest, null
+  icmp ne i8* %src, null
+; CHECK: icmp ne i8* %dest, null
+; CHECK: icmp ne i8* %src, null
+  ret void
+}
+
 declare void @llvm.memset.p0i8.i32(i8*, i8, i32, i1)
 define void @test6(i8* %dest) {
 ; CHECK: test6
   call void @llvm.memset.p0i8.i32(i8* %dest, i8 255, i32 1, i1 false)
   br label %bb
 bb:
   icmp ne i8* %dest, null
 ; CHECK-NOT: icmp
   ret void
 }
 
+define void @test6_no_null_opt(i8* %dest) #0 {
+; CHECK: test6_no_null_opt
+  call void @llvm.memset.p0i8.i32(i8* %dest, i8 255, i32 1, i1 false)
+  br label %bb
+bb:
+  icmp ne i8* %dest, null
+; CHECK: icmp ne i8* %dest, null
+  ret void
+}
+
 define void @test7(i8* %dest, i8* %src, i32 %len) {
 ; CHECK: test7
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %dest, i8* %src, i32 %len, i1 false)
   br label %bb
 bb:
   %KEEP1 = icmp ne i8* %dest, null
 ; CHECK: KEEP1
   %KEEP2 = icmp ne i8* %src, null
null:
   br label %merge
 
 merge:
   %merged_arg = phi i8* [%another_arg, %null], [%arg1, %non_null]
   call void @test12_helper(i8* %merged_arg)
   ; CHECK: call void @test12_helper(i8* nonnull %merged_arg)
   ret void
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/FunctionAttrs/nonnull.ll

 }
 
 ; CHECK: define nonnull i32* @gep1(
 define i32* @gep1(i32* %p) {
   %q = getelementptr inbounds i32, i32* %p, i32 1
   ret i32* %q
 }
 
+define i32* @gep1_no_null_opt(i32* %p) #0 {
+; Should't be able to derive nonnull based on gep.
+; CHECK: define i32* @gep1_no_null_opt(
+  %q = getelementptr inbounds i32, i32* %p, i32 1
+  ret i32* %q
+}
+
 ; CHECK: define i32 addrspace(3)* @gep2(
 define i32 addrspace(3)* @gep2(i32 addrspace(3)* %p) {
   %q = getelementptr inbounds i32, i32 addrspace(3)* %p, i32 1
   ret i32 addrspace(3)* %q
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GVN/PRE/2018-06-08-pre-load-dbgloc-no-null-opt.ll

+; This test checks if debug loc is propagated to load/store created by GVN/Instcombine.
+; RUN: opt < %s -gvn -S | FileCheck %s --check-prefixes=ALL
+; RUN: opt < %s -gvn -instcombine -S | FileCheck %s --check-prefixes=ALL
+
+; struct node {
+;  int  *v;
+; struct desc *descs;
+; };
+
+; struct desc {
+;  struct node *node;
+; };
+
+; extern int bar(void *v, void* n);
+
+; int test(struct desc *desc)
+; {
+;  void *v, *n;
+;  v = !desc ? ((void *)0) : desc->node->v;  // Line 15
+;  n = &desc->node->descs[0];                // Line 16
+;  return bar(v, n);
+; }
+
+; Line 16, Column 13:
+;   n = &desc->node->descs[0];
+;              ^
+
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64--linux-gnu"
+
+%struct.desc = type { %struct.node* }
+%struct.node = type { i32*, %struct.desc* }
+
+define i32 @test_no_null_opt(%struct.desc* readonly %desc) local_unnamed_addr #0 !dbg !4 {
+entry:
+  %tobool = icmp eq %struct.desc* %desc, null
+  br i1 %tobool, label %cond.end, label %cond.false, !dbg !9
+; ALL: br i1 %tobool, label %entry.cond.end_crit_edge, label %cond.false, !dbg [[LOC_15_6:![0-9]+]]
+; ALL: entry.cond.end_crit_edge:
+; ALL: load %struct.node*, %struct.node** null, align {{[0-9]+}}, !dbg [[LOC_16_13:![0-9]+]]
+
+cond.false:
+  %0 = bitcast %struct.desc* %desc to i8***, !dbg !11
+  %1 = load i8**, i8*** %0, align 8, !dbg !11
+  %2 = load i8*, i8** %1, align 8
+  br label %cond.end, !dbg !9
+
+cond.end:
+; ALL: phi %struct.node* [ %3, %cond.false ], [ %.pre, %entry.cond.end_crit_edge ]
+; ALL: phi i8* [ %2, %cond.false ], [ null, %entry.cond.end_crit_edge ]
+
+  %3 = phi i8* [ %2, %cond.false ], [ null, %entry ], !dbg !9
+  %node2 = getelementptr inbounds %struct.desc, %struct.desc* %desc, i64 0, i32 0
+  %4 = load %struct.node*, %struct.node** %node2, align 8, !dbg !10
+  %descs = getelementptr inbounds %struct.node, %struct.node* %4, i64 0, i32 1
+  %5 = bitcast %struct.desc** %descs to i8**
+  %6 = load i8*, i8** %5, align 8
+  %call = tail call i32 @bar(i8* %3, i8* %6)
+  ret i32 %call
+}
+attributes #0 = { "null-pointer-is-valid"="true" }
+
+declare i32 @bar(i8*, i8*) local_unnamed_addr #1
+!llvm.dbg.cu = !{!0}
+!llvm.module.flags = !{!2, !3}
+
+!0 = distinct !DICompileUnit(language: DW_LANG_C99, file: !1, emissionKind: FullDebug)
+!1 = !DIFile(filename: "test.c", directory: ".")
+!2 = !{i32 2, !"Dwarf Version", i32 4}
+!3 = !{i32 2, !"Debug Info Version", i32 3}
+!4 = distinct !DISubprogram(name: "test_no_null_opt", scope: !1, file: !1, line: 12, type: !5, isLocal: false, isDefinition: true, scopeLine: 13, flags: DIFlagPrototyped, isOptimized: true, unit: !0, retainedNodes: !8)
+!5 = !DISubroutineType(types: !6)
+!6 = !{!7}
+!7 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
+!8 = !{}
+!9 = !DILocation(line: 15, column: 6, scope: !4)
+!10 = !DILocation(line: 16, column: 13, scope: !4)
+!11 = !DILocation(line: 15, column: 34, scope: !4)
+
+;ALL: [[SCOPE:![0-9]+]] = distinct  !DISubprogram(name: "test_no_null_opt",{{.*}}
+;ALL: [[LOC_15_6]] = !DILocation(line: 15, column: 6, scope: [[SCOPE]])
+;ALL: [[LOC_16_13]] = !DILocation(line: 16, column: 13, scope: [[SCOPE]])

test/Transforms/GlobalOpt/MallocSROA-section-no-null-opt.ll

+; RUN: opt -globalopt -S < %s | FileCheck %s
+; CHECK: @Y
+; CHECK: section ".foo"
+
+%struct.xyz = type { double, i32 }
+
+@Y = internal global %struct.xyz* null ,section ".foo"            ; <%struct.xyz**> [#uses=2]
+@numf2s = external global i32                     ; <i32*> [#uses=1]
+
+define void @init_net() #0 {
+; CHECK-LABEL: init_net(
+; CHECK: load i32, i32* @numf2s
+; CHECK: call i8* @malloc
+; CHECK: store %struct.xyz* {{.*}}, %struct.xyz** @Y
+entry:
+  %0 = load i32, i32* @numf2s, align 4                 ; <i32> [#uses=1]
+  %mallocsize2 = shl i32 %0, 4                    ; <i32> [#uses=1]
+  %malloccall3 = tail call i8* @malloc(i32 %mallocsize2)  ; <i8*> [#uses=1]
+  %1 = bitcast i8* %malloccall3 to %struct.xyz*   ; <%struct.xyz*> [#uses=1]
+  store %struct.xyz* %1, %struct.xyz** @Y, align 8
+  ret void
+}
+
+define %struct.xyz* @load_train() #0 {
+; CHECK-LABEL: load_train(
+; CHECK: load %struct.xyz*, %struct.xyz** @Y
+entry:
+  %0 = load %struct.xyz*, %struct.xyz** @Y, align 8             ; <%struct.xyz*> [#uses=0]
+  ret %struct.xyz* %0
+}
+
+declare noalias i8* @malloc(i32)
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-1-no-null-opt.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
-  %struct.foo = type { i32, i32 }
 @X = internal global %struct.foo* null
-; CHECK: @X.f0
-; CHECK: @X.f1
+; CHECK: @X
+; CHECK-NOT: @X.f0
 
-define void @bar(i64 %Size) nounwind noinline {
+define void @bar(i64 %Size) nounwind noinline #0 {
 entry:
   %mallocsize = mul i64 %Size, 8                  ; <i64> [#uses=1]
   %malloccall = tail call i8* @malloc(i64 %mallocsize) ; <i8*> [#uses=1]
   %.sub = bitcast i8* %malloccall to %struct.foo* ; <%struct.foo*> [#uses=1]
   store %struct.foo* %.sub, %struct.foo** @X, align 4
   ret void
 }
 
 declare noalias i8* @malloc(i64)
 
-define i32 @baz() nounwind readonly noinline {
+define i32 @baz() nounwind readonly noinline #0 {
 bb1.thread:
-  %0 = load %struct.foo*, %struct.foo** @X, align 4    
+  %0 = load %struct.foo*, %struct.foo** @X, align 4
   br label %bb1
 
 bb1:    ; preds = %bb1, %bb1.thread
   %i.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %indvar.next, %bb1 ]
   %sum.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %3, %bb1 ]
   %1 = getelementptr %struct.foo, %struct.foo* %0, i32 %i.0.reg2mem.0, i32 0
   %2 = load i32, i32* %1, align 4
-  %3 = add i32 %2, %sum.0.reg2mem.0  
-  %indvar.next = add i32 %i.0.reg2mem.0, 1  
-  %exitcond = icmp eq i32 %indvar.next, 1200    
+  %3 = add i32 %2, %sum.0.reg2mem.0
+  %indvar.next = add i32 %i.0.reg2mem.0, 1
+  %exitcond = icmp eq i32 %indvar.next, 1200
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+attributes #0 = { "null-pointer-is-valid"="true" }
+

test/Transforms/GlobalOpt/heap-sra-1.ll

bb1:    ; preds = %bb1, %bb1.thread
   %indvar.next = add i32 %i.0.reg2mem.0, 1  
   %exitcond = icmp eq i32 %indvar.next, 1200    
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+define void @bam(i64 %Size) nounwind noinline #0 {
+entry:
+  %0 = load %struct.foo*, %struct.foo** @X, align 4
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-2-no-null-opt.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
-  %struct.foo = type { i32, i32 }
 @X = internal global %struct.foo* null    ; <%struct.foo**> [#uses=2]
-; CHECK: @X.f0
-; CHECK: @X.f1
+; CHECK: @X
+; CHECK-NOT: @X.f0
 
-define void @bar(i32 %Size) nounwind noinline {
+define void @bar(i32 %Size) nounwind noinline #0 {
 entry:
   %malloccall = tail call i8* @malloc(i64 8000000) ; <i8*> [#uses=1]
   %0 = bitcast i8* %malloccall to [1000000 x %struct.foo]* ; <[1000000 x %struct.foo]*> [#uses=1]
   %.sub = getelementptr [1000000 x %struct.foo], [1000000 x %struct.foo]* %0, i32 0, i32 0    ; <%struct.foo*> [#uses=1]
   store %struct.foo* %.sub, %struct.foo** @X, align 4
   ret void
 }
 
 declare noalias i8* @malloc(i64)
 
-define i32 @baz() nounwind readonly noinline {
+define i32 @baz() nounwind readonly noinline #0 {
 bb1.thread:
   %0 = load %struct.foo*, %struct.foo** @X, align 4    ; <%struct.foo*> [#uses=1]
   br label %bb1
 
 bb1:    ; preds = %bb1, %bb1.thread
   %i.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %indvar.next, %bb1 ]    ; <i32> [#uses=2]
   %sum.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %3, %bb1 ]    ; <i32> [#uses=1]
   %1 = getelementptr %struct.foo, %struct.foo* %0, i32 %i.0.reg2mem.0, i32 0    ; <i32*> [#uses=1]
   %2 = load i32, i32* %1, align 4    ; <i32> [#uses=1]
   %3 = add i32 %2, %sum.0.reg2mem.0    ; <i32> [#uses=2]
   %indvar.next = add i32 %i.0.reg2mem.0, 1    ; <i32> [#uses=2]
   %exitcond = icmp eq i32 %indvar.next, 1200    ; <i1> [#uses=1]
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-2.ll

bb1:    ; preds = %bb1, %bb1.thread
   %indvar.next = add i32 %i.0.reg2mem.0, 1    ; <i32> [#uses=2]
   %exitcond = icmp eq i32 %indvar.next, 1200    ; <i1> [#uses=1]
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+define void @bam(i64 %Size) nounwind noinline #0 {
+entry:
+        %0 = load %struct.foo*, %struct.foo** @X, align 4
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-3-no-null-opt.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
-  %struct.foo = type { i32, i32 }
 @X = internal global %struct.foo* null
-; CHECK: @X.f0
-; CHECK: @X.f1
+; CHECK: @X
+; CHECK-NOT: @X.f0
 
-define void @bar(i64 %Size) nounwind noinline {
+define void @bar(i64 %Size) nounwind noinline #0 {
 entry:
   %mallocsize = mul i64 8, %Size ; <i64> [#uses=1]
-; CHECK: mul i64 %Size, 4
+; CHECK: mul i64 8, %Size
   %malloccall = tail call i8* @malloc(i64 %mallocsize) ; <i8*> [#uses=1]
   %.sub = bitcast i8* %malloccall to %struct.foo* ; <%struct.foo*> [#uses=1]
   store %struct.foo* %.sub, %struct.foo** @X, align 4
   ret void
 }
 
 declare noalias i8* @malloc(i64)
 
-define i32 @baz() nounwind readonly noinline {
+define i32 @baz() nounwind readonly noinline #0 {
 bb1.thread:
-  %0 = load %struct.foo*, %struct.foo** @X, align 4    
+; CHECK: load %struct.foo*, %struct.foo** @X, align 4
+  %0 = load %struct.foo*, %struct.foo** @X, align 4
   br label %bb1
 
 bb1:    ; preds = %bb1, %bb1.thread
   %i.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %indvar.next, %bb1 ]
   %sum.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %3, %bb1 ]
   %1 = getelementptr %struct.foo, %struct.foo* %0, i32 %i.0.reg2mem.0, i32 0
   %2 = load i32, i32* %1, align 4
-  %3 = add i32 %2, %sum.0.reg2mem.0  
-  %indvar.next = add i32 %i.0.reg2mem.0, 1  
-  %exitcond = icmp eq i32 %indvar.next, 1200    
+  %3 = add i32 %2, %sum.0.reg2mem.0
+  %indvar.next = add i32 %i.0.reg2mem.0, 1
+  %exitcond = icmp eq i32 %indvar.next, 1200
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-3.ll

bb1:    ; preds = %bb1, %bb1.thread
   %indvar.next = add i32 %i.0.reg2mem.0, 1  
   %exitcond = icmp eq i32 %indvar.next, 1200    
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+define void @bam(i64 %Size) nounwind noinline #0 {
+entry:
+        %0 = load %struct.foo*, %struct.foo** @X, align 4
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-4-no-null-opt.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
-  %struct.foo = type { i32, i32 }
+
 @X = internal global %struct.foo* null
-; CHECK: @X.f0
-; CHECK: @X.f1
+; CHECK: @X
+; CHECK-NOT: @X.f0
 
-define void @bar(i64 %Size) nounwind noinline {
+define void @bar(i64 %Size) nounwind noinline #0 {
 entry:
   %mallocsize = shl i64 %Size, 3                  ; <i64> [#uses=1]
   %malloccall = tail call i8* @malloc(i64 %mallocsize) ; <i8*> [#uses=1]
-; CHECK: mul i64 %Size, 4
+; CHECK: shl i64 %Size, 3
   %.sub = bitcast i8* %malloccall to %struct.foo* ; <%struct.foo*> [#uses=1]
   store %struct.foo* %.sub, %struct.foo** @X, align 4
   ret void
 }
 
 declare noalias i8* @malloc(i64)
 
-define i32 @baz() nounwind readonly noinline {
+define i32 @baz() nounwind readonly noinline #0 {
+; CHECK-LABEL: @baz(
 bb1.thread:
-  %0 = load %struct.foo*, %struct.foo** @X, align 4    
+; CHECK: load %struct.foo*, %struct.foo** @X, align 4
+  %0 = load %struct.foo*, %struct.foo** @X, align 4
   br label %bb1
 
 bb1:    ; preds = %bb1, %bb1.thread
   %i.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %indvar.next, %bb1 ]
   %sum.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %3, %bb1 ]
   %1 = getelementptr %struct.foo, %struct.foo* %0, i32 %i.0.reg2mem.0, i32 0
   %2 = load i32, i32* %1, align 4
-  %3 = add i32 %2, %sum.0.reg2mem.0  
-  %indvar.next = add i32 %i.0.reg2mem.0, 1  
-  %exitcond = icmp eq i32 %indvar.next, 1200    
+; CHECK: load i32, i32* %1, align 4
+  %3 = add i32 %2, %sum.0.reg2mem.0
+  %indvar.next = add i32 %i.0.reg2mem.0, 1
+  %exitcond = icmp eq i32 %indvar.next, 1200
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-4.ll

bb1:    ; preds = %bb1, %bb1.thread
   %indvar.next = add i32 %i.0.reg2mem.0, 1  
   %exitcond = icmp eq i32 %indvar.next, 1200    
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %3
 }
 
+define void @bam(i64 %Size) nounwind noinline #0 {
+entry:
+        %0 = load %struct.foo*, %struct.foo** @X, align 4
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }
+

test/Transforms/GlobalOpt/heap-sra-phi-no-null-opt.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
-; CHECK: tmp.f1 = phi i32*
-; CHECK: tmp.f0 = phi i32*
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
-  %struct.foo = type { i32, i32 }
+
 @X = internal global %struct.foo* null    ; <%struct.foo**> [#uses=2]
+; CHECK: @X
+; CHECK-NOT: @X.f0
 
-define void @bar(i32 %Size) nounwind noinline {
+define void @bar(i32 %Size) nounwind noinline #0 {
+;  CHECK-LABEL: @bar(
 entry:
   %malloccall = tail call i8* @malloc(i64 8000000) ; <i8*> [#uses=1]
   %tmp = bitcast i8* %malloccall to [1000000 x %struct.foo]* ; <[1000000 x %struct.foo]*> [#uses=1]
   %.sub = getelementptr [1000000 x %struct.foo], [1000000 x %struct.foo]* %tmp, i32 0, i32 0    ; <%struct.foo*> [#uses=1]
   store %struct.foo* %.sub, %struct.foo** @X, align 4
   ret void
 }
 
 declare noalias i8* @malloc(i64)
 
-define i32 @baz() nounwind readonly noinline {
+define i32 @baz() nounwind readonly noinline #0 {
+; CHECK-LABEL: @baz(
 bb1.thread:
   %tmpLD1 = load %struct.foo*, %struct.foo** @X, align 4    ; <%struct.foo*> [#uses=1]
+; CHECK: load %struct.foo*, %struct.foo** @X, align 4
   br label %bb1
 
 bb1:    ; preds = %bb1, %bb1.thread
         %tmp = phi %struct.foo* [%tmpLD1, %bb1.thread ], [ %tmpLD2, %bb1 ]    ; <i32> [#uses=2]
+; CHECK: %tmp = phi %struct.foo* [ %tmpLD1, %bb1.thread ], [ %tmpLD2, %bb1 ]
   %i.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %indvar.next, %bb1 ]    ; <i32> [#uses=2]
   %sum.0.reg2mem.0 = phi i32 [ 0, %bb1.thread ], [ %tmp3, %bb1 ]    ; <i32> [#uses=1]
   %tmp1 = getelementptr %struct.foo, %struct.foo* %tmp, i32 %i.0.reg2mem.0, i32 0    ; <i32*> [#uses=1]
   %tmp2 = load i32, i32* %tmp1, align 4    ; <i32> [#uses=1]
+; CHECK: load i32, i32* %tmp1, align 4
   %tmp6 = add i32 %tmp2, %sum.0.reg2mem.0   ; <i32> [#uses=2]
   %tmp4 = getelementptr %struct.foo, %struct.foo* %tmp, i32 %i.0.reg2mem.0, i32 1    ; <i32*> [#uses=1]
         %tmp5 = load i32 , i32 * %tmp4
+;  CHECK: load i32, i32* %tmp4
         %tmp3 = add i32 %tmp5, %tmp6
   %indvar.next = add i32 %i.0.reg2mem.0, 1    ; <i32> [#uses=2]
-        
         %tmpLD2 = load %struct.foo*, %struct.foo** @X, align 4    ; <%struct.foo*> [#uses=1]
+; CHECK: load %struct.foo*, %struct.foo** @X, align 4
 
   %exitcond = icmp eq i32 %indvar.next, 1200    ; <i1> [#uses=1]
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %tmp3
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/heap-sra-phi.ll

%indvar.next = add i32 %i.0.reg2mem.0, 1    ; <i32> [#uses=2]
         %tmpLD2 = load %struct.foo*, %struct.foo** @X, align 4    ; <%struct.foo*> [#uses=1]
 
   %exitcond = icmp eq i32 %indvar.next, 1200    ; <i1> [#uses=1]
   br i1 %exitcond, label %bb2, label %bb1
 
 bb2:    ; preds = %bb1
   ret i32 %tmp3
 }
+
+define void @bam(i64 %Size) nounwind noinline #0 {
+entry:
+        %0 = load %struct.foo*, %struct.foo** @X, align 4
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/load-store-global-no-null-opt.ll

+; RUN: opt < %s -globalopt -S | FileCheck %s
+
+@a = internal global i64* null, align 8
+; CHECK: @a
+
+; PR13968
+define void @qux_no_null_opt() nounwind #0 {
+; CHECK-LABEL: @qux_no_null_opt(
+; CHECK: getelementptr i64*, i64** @a, i32 1
+; CHECK: store i64* inttoptr (i64 1 to i64*), i64** @a
+  %b = bitcast i64** @a to i8*
+  %g = getelementptr i64*, i64** @a, i32 1
+  %cmp = icmp ne i8* null, %b
+  %cmp2 = icmp eq i8* null, %b
+  %cmp3 = icmp eq i64** null, %g
+  store i64* inttoptr (i64 1 to i64*), i64** @a, align 8
+  %l = load i64*, i64** @a, align 8
+  ret void
+}
+
+define i64* @bar() {
+  %X = load i64*, i64** @a, align 8
+  ret i64* %X
+; CHECK-LABEL: @bar(
+; CHECK: load
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/malloc-promote-1-no-null-opt.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
 @G = internal global i32* null          ; <i32**> [#uses=3]
-; CHECK-NOT: global
+; CHECK: global
 
-define void @init() {
+define void @init() #0 {
+; CHECK-LABEL: @init(
+; CHECK: store
+; CHECK: load
         %malloccall = tail call i8* @malloc(i64 4)      ; <i8*> [#uses=1]
         %P = bitcast i8* %malloccall to i32*            ; <i32*> [#uses=1]
         store i32* %P, i32** @G
         %GV = load i32*, i32** @G             ; <i32*> [#uses=1]
         store i32 0, i32* %GV
         ret void
 }
 
 declare noalias i8* @malloc(i64)
 
-define i32 @get() {
+define i32 @get() #0 {
+; CHECK-LABEL: @get(
+; CHECK: load i32*, i32** @G
+; CHECK-NEXT: load i32, i32* %GV
         %GV = load i32*, i32** @G             ; <i32*> [#uses=1]
         %V = load i32, i32* %GV              ; <i32> [#uses=1]
         ret i32 %V
-; CHECK: ret i32 0
+; CHECK: ret i32 %V
 }
 
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/malloc-promote-1.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
-@G = internal global i32* null          ; <i32**> [#uses=3]
+@G = internal global i32* null          ; <i32**> [#uses=4]
 ; CHECK-NOT: global
 
 define void @init() {
         %malloccall = tail call i8* @malloc(i64 4)      ; <i8*> [#uses=1]
         %P = bitcast i8* %malloccall to i32*            ; <i32*> [#uses=1]
         store i32* %P, i32** @G
         %GV = load i32*, i32** @G             ; <i32*> [#uses=1]
         store i32 0, i32* %GV
         ret void
 }
 
 declare noalias i8* @malloc(i64)
 
 define i32 @get() {
         %GV = load i32*, i32** @G             ; <i32*> [#uses=1]
         %V = load i32, i32* %GV              ; <i32> [#uses=1]
         ret i32 %V
 ; CHECK: ret i32 0
 }
 
+define void @foo(i64 %Size) nounwind noinline #0 {
+entry:
+        %0 = load i32*, i32** @G, align 4
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }
+

test/Transforms/GlobalOpt/malloc-promote-2-no-null-opt.ll

 ; RUN: opt < %s -globalopt -S | FileCheck %s
 target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
 @G = internal global i32* null
 
-define void @t() {
+define void @t() #0 {
 ; CHECK: @t()
-; CHECK-NOT: call i8* @malloc
-; CHECK-NEXT: ret void
+; CHECK: call i8* @malloc
+; CHECK: bitcast
+; CHECK: store
+; CHECK: load
+; CHECK: getelementptr
+; CHECK: store
   %malloccall = tail call i8* @malloc(i64 mul (i64 100, i64 4))
   %P = bitcast i8* %malloccall to i32*
   store i32* %P, i32** @G
   %GV = load i32*, i32** @G
   %GVe = getelementptr i32, i32* %GV, i32 40
   store i32 20, i32* %GVe
   ret void
 }
 
 declare noalias i8* @malloc(i64)
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/malloc-promote-2.ll

; CHECK-NEXT: ret void
   store i32* %P, i32** @G
   %GV = load i32*, i32** @G
   %GVe = getelementptr i32, i32* %GV, i32 40
   store i32 20, i32* %GVe
   ret void
 }
 
 declare noalias i8* @malloc(i64)
+
+define void @foo(i64 %Size) nounwind noinline #0 {
+entry:
+        %0 = load i32*, i32** @G, align 4
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/storepointer-compare-no-null-opt.ll

+; RUN: opt < %s -globalopt -S | FileCheck %s
+; CHECK: global
+
+@G = internal global void ()* null              ; <void ()**> [#uses=2]
+
+define internal void @Actual() {
+; CHECK-LABEL: Actual(
+        ret void
+}
+
+define void @init() {
+; CHECK-LABEL: init(
+; CHECK: store void ()* @Actual, void ()** @G
+        store void ()* @Actual, void ()** @G
+        ret void
+}
+
+define void @doit() #0 {
+; CHECK-LABEL: doit(
+        %FP = load void ()*, void ()** @G         ; <void ()*> [#uses=2]
+; CHECK: %FP = load void ()*, void ()** @G
+        %CC = icmp eq void ()* %FP, null                ; <i1> [#uses=1]
+; CHECK: %CC = icmp eq void ()* %FP, null
+        br i1 %CC, label %isNull, label %DoCall
+; CHECK: br i1 %CC, label %isNull, label %DoCall
+
+DoCall:         ; preds = %0
+; CHECK: DoCall:
+; CHECK: call void %FP()
+; CHECK: ret void
+        call void %FP( )
+        ret void
+
+isNull:         ; preds = %0
+; CHECK: isNull:
+; CHECK: ret void
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/GlobalOpt/storepointer-no-null-opt.ll

+; RUN: opt < %s -globalopt -S | FileCheck %s
+
+@G = internal global void ()* null              ; <void ()**> [#uses=2]
+; CHECK: global
+
+define internal void @Actual() {
+; CHECK-LABEL: Actual(
+        ret void
+}
+
+define void @init() {
+; CHECK-LABEL: init(
+; CHECK:  store void ()* @Actual, void ()** @G
+        store void ()* @Actual, void ()** @G
+        ret void
+}
+
+define void @doit() #0 {
+; CHECK-LABEL: doit(
+; CHECK: %FP = load void ()*, void ()** @G
+; CHECK: call void %FP()
+        %FP = load void ()*, void ()** @G         ; <void ()*> [#uses=1]
+        call void %FP( )
+        ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/IPConstantProp/PR26044.ll

 
 define internal i32 @fn1(i32 %p1) {
 entry:
   %tobool = icmp ne i32 %p1, 0
   %cond = select i1 %tobool, i32 %p1, i32 %p1
   ret i32 %cond
 }
 
+define void @fn_no_null_opt() #0 {
+entry:
+  br label %if.end
+
+for.cond1:                                        ; preds = %if.end, %for.end
+  br i1 undef, label %if.end, label %if.end
+
+if.end:                                           ; preds = %lbl, %for.cond1
+  %e.2 = phi i32* [ undef, %entry ], [ null, %for.cond1 ], [ null, %for.cond1 ]
+  %0 = load i32, i32* %e.2, align 4
+  %call = call i32 @fn0(i32 %0)
+  br label %for.cond1
+}
+
+define internal i32 @fn0(i32 %p1) {
+entry:
+  %tobool = icmp ne i32 %p1, 0
+  %cond = select i1 %tobool, i32 %p1, i32 %p1
+  ret i32 %cond
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }
+
 ; CHECK-LABEL: define void @fn2(
 ; CHECK: call i32 @fn1(i32 undef)
 
 ; CHECK-LABEL: define internal i32 @fn1(
 ; CHECK:%[[COND:.*]] = select i1 undef, i32 undef, i32 undef
 ; CHECK: ret i32 %[[COND]]
+
+; CHECK-LABEL: define void @fn_no_null_opt(
+; CHECK: call i32 @fn0(i32 %0)
+
+; CHECK-LABEL: define internal i32 @fn0(
+; CHECK:%[[TOBOOL:.*]] = icmp ne i32 %p1, 0
+; CHECK:%[[COND:.*]] = select i1 %[[TOBOOL]], i32 %p1, i32 %p1
+; CHECK: ret i32 %[[COND]]

test/Transforms/Inline/attributes.ll

 
 define i32 @test_no-use-jump-tables3(i32 %i) "no-jump-tables"="true" {
   %1 = call i32 @no-use-jump-tables_callee1(i32 %i)
   ret i32 %1
 ; CHECK: @test_no-use-jump-tables3(i32 %i) [[NOUSEJUMPTABLES]] {
 ; CHECK-NEXT: ret i32
 }
 
+; Calle with "null-pointer-is-valid"="true" attribute should not be inlined
+; into a caller without this attribute. Exception: alwaysinline callee
+; can still be inlined.
+
+define i32 @null-pointer-is-valid_callee0(i32 %i) "null-pointer-is-valid"="true" {
+  ret i32 %i
+; CHECK: @null-pointer-is-valid_callee0(i32 %i)
+; CHECK-NEXT: ret i32
+}
+
+define i32 @null-pointer-is-valid_callee1(i32 %i) alwaysinline "null-pointer-is-valid"="true" {
+  ret i32 %i
+; CHECK: @null-pointer-is-valid_callee1(i32 %i)
+; CHECK-NEXT: ret i32
+}
+
+define i32 @null-pointer-is-valid_callee2(i32 %i)  {
+  ret i32 %i
+; CHECK: @null-pointer-is-valid_callee2(i32 %i)
+; CHECK-NEXT: ret i32
+}
+
+define i32 @test_null-pointer-is-valid0(i32 %i) {
+  %1 = call i32 @null-pointer-is-valid_callee0(i32 %i)
+  ret i32 %1
+; CHECK: @test_null-pointer-is-valid0(
+; CHECK: call i32 @null-pointer-is-valid_callee0
+; CHECK-NEXT: ret i32
+}
+
+define i32 @test_null-pointer-is-valid1(i32 %i) {
+  %1 = call i32 @null-pointer-is-valid_callee1(i32 %i)
+  ret i32 %1
+; CHECK: @test_null-pointer-is-valid1(
+; CHECK-NEXT: ret i32
+}
+
+define i32 @test_null-pointer-is-valid2(i32 %i) "null-pointer-is-valid"="true" {
+  %1 = call i32 @null-pointer-is-valid_callee2(i32 %i)
+  ret i32 %1
+; CHECK: @test_null-pointer-is-valid2(
+; CHECK-NEXT: ret i32
+}
+
 ; CHECK: attributes [[FPMAD_FALSE]] = { "less-precise-fpmad"="false" }
 ; CHECK: attributes [[FPMAD_TRUE]] = { "less-precise-fpmad"="true" }
 ; CHECK: attributes [[NOIMPLICITFLOAT]] = { noimplicitfloat }
 ; CHECK: attributes [[NOUSEJUMPTABLES]] = { "no-jump-tables"="true" }

test/Transforms/InstCombine/atomic.ll

 ; ordering imposed.
 define i32 @test9() {
 ; CHECK-LABEL: define i32 @test9(
 ; CHECK: store i32 undef, i32* null
   %x = load atomic i32, i32* null unordered, align 4
   ret i32 %x
 }
 
+define i32 @test9_no_null_opt() #0 {
+; CHECK-LABEL: define i32 @test9_no_null_opt(
+; CHECK: load atomic i32, i32* null unordered
+  %x = load atomic i32, i32* null unordered, align 4
+  ret i32 %x
+}
+
 ; FIXME: Could also fold
 define i32 @test10() {
 ; CHECK-LABEL: define i32 @test10(
 ; CHECK: load atomic i32, i32* null monotonic
   %x = load atomic i32, i32* null monotonic, align 4
   ret i32 %x
 }
 
+define i32 @test10_no_null_opt() #0 {
+; CHECK-LABEL: define i32 @test10_no_null_opt(
+; CHECK: load atomic i32, i32* null monotonic
+  %x = load atomic i32, i32* null monotonic, align 4
+  ret i32 %x
+}
+
 ; Would this be legal to fold?  Probably?
 define i32 @test11() {
 ; CHECK-LABEL: define i32 @test11(
 ; CHECK: load atomic i32, i32* null seq_cst
   %x = load atomic i32, i32* null seq_cst, align 4
   ret i32 %x
 }
 
+define i32 @test11_no_null_opt() #0 {
+; CHECK-LABEL: define i32 @test11_no_null_opt(
+; CHECK: load atomic i32, i32* null seq_cst
+  %x = load atomic i32, i32* null seq_cst, align 4
+  ret i32 %x
+}
+
 ; An unordered access to null is still unreachable.  There's no
 ; ordering imposed.
 define i32 @test12() {
 ; CHECK-LABEL: define i32 @test12(
 ; CHECK: store atomic i32 undef, i32* null
   store atomic i32 0, i32* null unordered, align 4
   ret i32 0
 }
 
+define i32 @test12_no_null_opt() #0 {
+; CHECK-LABEL: define i32 @test12_no_null_opt(
+; CHECK: store atomic i32 0, i32* null unordered
+  store atomic i32 0, i32* null unordered, align 4
+  ret i32 0
+}
+
 ; FIXME: Could also fold
 define i32 @test13() {
 ; CHECK-LABEL: define i32 @test13(
 ; CHECK: store atomic i32 0, i32* null monotonic
   store atomic i32 0, i32* null monotonic, align 4
   ret i32 0
 }
 
+define i32 @test13_no_null_opt() #0 {
+; CHECK-LABEL: define i32 @test13_no_null_opt(
+; CHECK: store atomic i32 0, i32* null monotonic
+  store atomic i32 0, i32* null monotonic, align 4
+  ret i32 0
+}
+
 ; Would this be legal to fold?  Probably?
 define i32 @test14() {
 ; CHECK-LABEL: define i32 @test14(
 ; CHECK: store atomic i32 0, i32* null seq_cst
   store atomic i32 0, i32* null seq_cst, align 4
   ret i32 0
 }
 
+define i32 @test14_no_null_opt() #0 {
+; CHECK-LABEL: define i32 @test14_no_null_opt(
+; CHECK: store atomic i32 0, i32* null seq_cst
+  store atomic i32 0, i32* null seq_cst, align 4
+  ret i32 0
+}
+
 @a = external global i32
 @b = external global i32
 
 define i32 @test15(i1 %cnd) {
 ; CHECK-LABEL: define i32 @test15(
 ; CHECK: load atomic i32, i32* @a unordered, align 4
 ; CHECK: load atomic i32, i32* @b unordered, align 4
   %addr = select i1 %cnd, i32* @a, i32* @b

 define void @no_atomic_vector_store(<2 x float> %p, i8* %p2) {
 ; CHECK-LABEL: @no_atomic_vector_store
 ; CHECK: store atomic i64 %1, i64* %2 unordered, align 8
   %1 = bitcast <2 x float> %p to i64
   %2 = bitcast i8* %p2 to i64*
   store atomic i64 %1, i64* %2 unordered, align 8
   ret void
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/InstCombine/invariant.group.ll

 ; RUN: opt -instcombine -S < %s | FileCheck %s
 
 ; CHECK-LABEL: define i8* @simplifyNullLaunder()
 define i8* @simplifyNullLaunder() {
 ; CHECK-NEXT: ret i8* null
   %b2 = call i8* @llvm.launder.invariant.group.p0i8(i8* null)
   ret i8* %b2
 }
 
+; CHECK-LABEL: define i8* @simplifyNullLaunderNoNullOpt()
+define i8* @simplifyNullLaunderNoNullOpt() #0 {
+; CHECK-NEXT: call i8* @llvm.launder.invariant.group.p0i8(i8* null)
+  %b2 = call i8* @llvm.launder.invariant.group.p0i8(i8* null)
+  ret i8* %b2
+}
+
 ; CHECK-LABEL: define i8 addrspace(42)* @dontsimplifyNullLaunderForDifferentAddrspace()
 define i8 addrspace(42)* @dontsimplifyNullLaunderForDifferentAddrspace() {
 ; CHECK: %b2 = call i8 addrspace(42)* @llvm.launder.invariant.group.p42i8(i8 addrspace(42)* null)
 ; CHECK: ret i8 addrspace(42)* %b2
   %b2 = call i8 addrspace(42)* @llvm.launder.invariant.group.p42i8(i8 addrspace(42)* null)
   ret i8 addrspace(42)* %b2
 }
 

 ; CHECK-NEXT: ret i8 addrspace(42)* undef
   %b2 = call i8 addrspace(42)* @llvm.launder.invariant.group.p42i8(i8 addrspace(42)* undef)
   ret i8 addrspace(42)* %b2
 }
 
 
 declare i8* @llvm.launder.invariant.group.p0i8(i8*)
 declare i8 addrspace(42)* @llvm.launder.invariant.group.p42i8(i8 addrspace(42)*)
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/InstCombine/invoke.ll

 lpad:
   %1 = landingpad { i8*, i32 }
           filter [0 x i8*] zeroinitializer
   %2 = extractvalue { i8*, i32 } %1, 0
   tail call void @__cxa_call_unexpected(i8* %2) noreturn nounwind
   unreachable
 }
 
+; CHECK-LABEL: @f2_no_null_opt(
+define i64 @f2_no_null_opt() nounwind uwtable ssp #0 personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
+entry:
+; CHECK: invoke noalias i8* null()
+  %call = invoke noalias i8* null()
+          to label %invoke.cont unwind label %lpad
+
+invoke.cont:
+; CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %call, i1 false, i1 false)
+  %0 = tail call i64 @llvm.objectsize.i64(i8* %call, i1 false)
+  ret i64 %0
+
+lpad:
+  %1 = landingpad { i8*, i32 }
+          filter [0 x i8*] zeroinitializer
+  %2 = extractvalue { i8*, i32 } %1, 0
+  tail call void @__cxa_call_unexpected(i8* %2) noreturn nounwind
+  unreachable
+}
+attributes #0 = { "null-pointer-is-valid"="true" }
+
 ; CHECK-LABEL: @f3(
 define void @f3() nounwind uwtable ssp personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
 ; CHECK: invoke void @llvm.donothing()
   %call = invoke noalias i8* @_Znwm(i64 13)
           to label %invoke.cont unwind label %lpad
 
 invoke.cont:
   ret void
 
 lpad:
   %1 = landingpad { i8*, i32 }
           filter [0 x i8*] zeroinitializer
   %2 = extractvalue { i8*, i32 } %1, 0
   tail call void @__cxa_call_unexpected(i8* %2) noreturn nounwind
   unreachable
 }

test/Transforms/InstCombine/lifetime-no-null-opt.ll

+; RUN: opt < %s -instcombine -S | FileCheck %s
+
+declare void @llvm.dbg.declare(metadata, metadata, metadata)
+declare void @llvm.lifetime.start.p0i8(i64, i8* nocapture)
+declare void @llvm.lifetime.end.p0i8(i64, i8* nocapture)
+declare void @foo(i8* nocapture, i8* nocapture)
+
+define void @bar(i1 %flag) #0 !dbg !4 {
+entry:
+; CHECK-LABEL: @bar(
+; CHECK: %[[T:[^ ]+]] = getelementptr inbounds [1 x i8], [1 x i8]* %text
+; CHECK: %[[B:[^ ]+]] = getelementptr inbounds [1 x i8], [1 x i8]* %buff
+; CHECK: if:
+; CHECK-NEXT: br label %bb2
+; CHECK: bb2:
+; CHECK-NEXT: br label %bb3
+; CHECK: bb3:
+; CHECK-NEXT: call void @llvm.dbg.declare
+; CHECK-NEXT: br label %fin
+; CHECK: call void @llvm.lifetime.start.p0i8(i64 1, i8* %[[T]])
+; CHECK-NEXT: call void @llvm.lifetime.start.p0i8(i64 1, i8* %[[B]])
+; CHECK-NEXT: call void @foo(i8* %[[B]], i8* %[[T]])
+; CHECK-NEXT: call void @llvm.lifetime.end.p0i8(i64 1, i8* %[[B]])
+; CHECK-NEXT: call void @llvm.lifetime.end.p0i8(i64 1, i8* %[[T]])
+  %text = alloca [1 x i8], align 1
+  %buff = alloca [1 x i8], align 1
+  %0 = getelementptr inbounds [1 x i8], [1 x i8]* %text, i64 0, i64 0
+  %1 = getelementptr inbounds [1 x i8], [1 x i8]* %buff, i64 0, i64 0
+  br i1 %flag, label %if, label %else
+
+if:
+  call void @llvm.lifetime.start.p0i8(i64 1, i8* %0)
+  call void @llvm.lifetime.start.p0i8(i64 1, i8* %1)
+  call void @llvm.lifetime.end.p0i8(i64 1, i8* %1)
+  call void @llvm.lifetime.end.p0i8(i64 1, i8* %0)
+  br label %bb2
+
+bb2:
+  call void @llvm.lifetime.start.p0i8(i64 1, i8* %0)
+  call void @llvm.lifetime.start.p0i8(i64 1, i8* %1)
+  call void @llvm.lifetime.end.p0i8(i64 1, i8* %0)
+  call void @llvm.lifetime.end.p0i8(i64 1, i8* %1)
+  br label %bb3
+
+bb3:
+  call void @llvm.lifetime.start.p0i8(i64 1, i8* %0)
+  call void @llvm.dbg.declare(metadata [1 x i8]* %text, metadata !14, metadata !25), !dbg !26
+  call void @llvm.lifetime.end.p0i8(i64 1, i8* %0)
+  br label %fin
+
+else:
+  call void @llvm.lifetime.start.p0i8(i64 1, i8* %0)
+  call void @llvm.lifetime.start.p0i8(i64 1, i8* %1)
+  call void @foo(i8* %1, i8* %0)
+  call void @llvm.lifetime.end.p0i8(i64 1, i8* %1)
+  call void @llvm.lifetime.end.p0i8(i64 1, i8* %0)
+  br  label %fin
+
+fin:
+  ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }
+
+!llvm.dbg.cu = !{!0}
+!llvm.module.flags = !{!22, !23}
+!llvm.ident = !{!24}
+
+!0 = distinct !DICompileUnit(language: DW_LANG_C_plus_plus, file: !1, producer: "clang version 3.8.0 (trunk 248826) (llvm/trunk 248827)", isOptimized: true, runtimeVersion: 0, emissionKind: FullDebug, enums: !2)
+!1 = !DIFile(filename: "test.cpp", directory: "/home/user")
+!2 = !{}
+!4 = distinct !DISubprogram(name: "bar", linkageName: "bar", scope: !1, file: !1, line: 2, type: !5, isLocal: false, isDefinition: true, scopeLine: 2, flags: DIFlagPrototyped, isOptimized: true, unit: !0, retainedNodes: !8)
+!5 = !DISubroutineType(types: !6)
+!6 = !{null, !7}
+!7 = !DIBasicType(name: "bool", size: 8, align: 8, encoding: DW_ATE_boolean)
+!8 = !{!9, !11, !12, !14, !21}
+!9 = !DILocalVariable(name: "Size", arg: 1, scope: !4, file: !1, line: 2, type: !10)
+!10 = !DIBasicType(name: "int", size: 32, align: 32, encoding: DW_ATE_signed)
+!11 = !DILocalVariable(name: "flag", arg: 2, scope: !4, file: !1, line: 2, type: !7)
+!12 = !DILocalVariable(name: "i", scope: !13, file: !1, line: 3, type: !10)
+!13 = distinct !DILexicalBlock(scope: !4, file: !1, line: 3, column: 3)
+!14 = !DILocalVariable(name: "text", scope: !15, file: !1, line: 4, type: !17)
+!15 = distinct !DILexicalBlock(scope: !16, file: !1, line: 3, column: 30)
+!16 = distinct !DILexicalBlock(scope: !13, file: !1, line: 3, column: 3)
+!17 = !DICompositeType(tag: DW_TAG_array_type, baseType: !18, size: 8, align: 8, elements: !19)
+!18 = !DIBasicType(name: "char", size: 8, align: 8, encoding: DW_ATE_signed_char)
+!19 = !{!20}
+!20 = !DISubrange(count: 1)
+!21 = !DILocalVariable(name: "buff", scope: !15, file: !1, line: 5, type: !17)
+!22 = !{i32 2, !"Dwarf Version", i32 4}
+!23 = !{i32 2, !"Debug Info Version", i32 3}
+!24 = !{!"clang version 3.8.0 (trunk 248826) (llvm/trunk 248827)"}
+!25 = !DIExpression()
+!26 = !DILocation(line: 4, column: 10, scope: !15)

test/Transforms/InstCombine/load.ll

 ; CHECK-LABEL: @test7(
 ; CHECK-NOT: load
 define i32 @test7(i32 %X) {
   %V = getelementptr i32, i32* null, i32 %X    ; <i32*> [#uses=1]
   %R = load i32, i32* %V    ; <i32> [#uses=1]
   ret i32 %R
 }
 
+; CHECK-LABEL: @test7_no_null_opt(
+; CHECK: %V = getelementptr i32, i32* null
+; CHECK: %R = load i32, i32* %V
+define i32 @test7_no_null_opt(i32 %X) #0 {
+        %V = getelementptr i32, i32* null, i32 %X               ; <i32*> [#uses=1]
+        %R = load i32, i32* %V          ; <i32> [#uses=1]
+        ret i32 %R
+}
+attributes #0 = { "null-pointer-is-valid"="true" }
+
 ; CHECK-LABEL: @test8(
 ; CHECK-NOT: load
 define i32 @test8(i32* %P) {
   store i32 1, i32* %P
   %X = load i32, i32* %P    ; <i32> [#uses=1]
   ret i32 %X
 }
 

test/Transforms/InstCombine/memcpy-addrspace.ll

entry:
   call void @llvm.memcpy.p0i8.p2i8.i64(i8* align 4 %0, i8 addrspace(2)* align 4 bitcast ([8 x i32] addrspace(2)* @test.data to i8 addrspace(2)*), i64 32, i1 false)
   %arrayidx = getelementptr inbounds [8 x i32], [8 x i32]* %data, i64 0, i64 %x
   %1 = call i32 @foo(i32* %arrayidx)
   %arrayidx1 = getelementptr inbounds i32, i32 addrspace(1)* %out, i64 %x
   store i32 %1, i32 addrspace(1)* %arrayidx1, align 4
   ret void
 }
 
+; CHECK-LABEL: test_call_no_null_opt
+; CHECK: alloca
+; CHECK: call void @llvm.memcpy.p0i8.p2i8.i64
+; CHECK-NOT: addrspacecast
+; CHECK: call i32 @foo(i32* %{{.*}})
+define void @test_call_no_null_opt(i32 addrspace(1)* %out, i64 %x) #0 {
+entry:
+  %data = alloca [8 x i32], align 4
+  %0 = bitcast [8 x i32]* %data to i8*
+  call void @llvm.memcpy.p0i8.p2i8.i64(i8* align 4 %0, i8 addrspace(2)* align 4 bitcast ([8 x i32] addrspace(2)* @test.data to i8 addrspace(2)*), i64 32, i1 false)
+  %arrayidx = getelementptr inbounds [8 x i32], [8 x i32]* %data, i64 0, i64 %x
+  %1 = call i32 @foo(i32* %arrayidx)
+  %arrayidx1 = getelementptr inbounds i32, i32 addrspace(1)* %out, i64 %x
+  store i32 %1, i32 addrspace(1)* %arrayidx1, align 4
+  ret void
+}
+
 ; CHECK-LABEL: test_load_and_call
 ; CHECK: alloca
 ; CHECK: call void @llvm.memcpy.p0i8.p2i8.i64
 ; CHECK: load i32, i32* %{{.*}}
 ; CHECK: call i32 @foo(i32* nonnull %{{.*}})
 ; CHECK-NOT: addrspacecast
 ; CHECK-NOT: load i32, i32 addrspace(2)*
 define void @test_load_and_call(i32 addrspace(1)* %out, i64 %x, i64 %y) {
 entry:
   %data = alloca [8 x i32], align 4
   %0 = bitcast [8 x i32]* %data to i8*
   call void @llvm.memcpy.p0i8.p2i8.i64(i8* align 4 %0, i8 addrspace(2)* align 4 bitcast ([8 x i32] addrspace(2)* @test.data to i8 addrspace(2)*), i64 32, i1 false)
   %arrayidx = getelementptr inbounds [8 x i32], [8 x i32]* %data, i64 0, i64 %x
   %1 = load i32, i32* %arrayidx, align 4
   %arrayidx1 = getelementptr inbounds i32, i32 addrspace(1)* %out, i64 %x
   store i32 %1, i32 addrspace(1)* %arrayidx1, align 4
   %2 = call i32 @foo(i32* %arrayidx)
   %arrayidx2 = getelementptr inbounds i32, i32 addrspace(1)* %out, i64 %y
   store i32 %2, i32 addrspace(1)* %arrayidx2, align 4
   ret void
 }
 
+; CHECK-LABEL: test_load_and_call_no_null_opt
+; CHECK: alloca
+; CHECK: call void @llvm.memcpy.p0i8.p2i8.i64
+; CHECK: load i32, i32* %{{.*}}
+; CHECK: call i32 @foo(i32* %{{.*}})
+; CHECK-NOT: addrspacecast
+; CHECK-NOT: load i32, i32 addrspace(2)*
+define void @test_load_and_call_no_null_opt(i32 addrspace(1)* %out, i64 %x, i64 %y) #0 {
+entry:
+  %data = alloca [8 x i32], align 4
+  %0 = bitcast [8 x i32]* %data to i8*
+  call void @llvm.memcpy.p0i8.p2i8.i64(i8* align 4 %0, i8 addrspace(2)* align 4 bitcast ([8 x i32] addrspace(2)* @test.data to i8 addrspace(2)*), i64 32, i1 false)
+  %arrayidx = getelementptr inbounds [8 x i32], [8 x i32]* %data, i64 0, i64 %x
+  %1 = load i32, i32* %arrayidx, align 4
+  %arrayidx1 = getelementptr inbounds i32, i32 addrspace(1)* %out, i64 %x
+  store i32 %1, i32 addrspace(1)* %arrayidx1, align 4
+  %2 = call i32 @foo(i32* %arrayidx)
+  %arrayidx2 = getelementptr inbounds i32, i32 addrspace(1)* %out, i64 %y
+  store i32 %2, i32 addrspace(1)* %arrayidx2, align 4
+  ret void
+}
 
 declare void @llvm.memcpy.p0i8.p2i8.i64(i8* nocapture writeonly, i8 addrspace(2)* nocapture readonly, i64, i1)
 declare i32 @foo(i32* %x)
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/InstCombine/memcpy-from-global.ll

 ; use @G instead of %A
 ; CHECK-NEXT: call void @llvm.memcpy.p0i8.p0i8.i64(i8* nonnull align 8 %{{.*}}, i8* align 16 getelementptr inbounds (%T, %T* @G, i64 0, i32 0)
   call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 4 %a, i8* align 4 bitcast (%T* @G to i8*), i64 124, i1 false)
   call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 4 %b, i8* align 4 %a, i64 124, i1 false)
   call void @bar(i8* %b)
   ret void
 }
 
+define void @test2_no_null_opt() #0 {
+  %A = alloca %T
+  %B = alloca %T
+  %a = bitcast %T* %A to i8*
+  %b = bitcast %T* %B to i8*
+
+; CHECK-LABEL: @test2_no_null_opt(
+
+; %A alloca is deleted
+; CHECK-NEXT: alloca [124 x i8]
+; CHECK-NEXT: getelementptr inbounds [124 x i8], [124 x i8]*
+
+; use @G instead of %A
+; CHECK-NEXT: call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 8 %{{.*}}, i8* align 16 getelementptr inbounds (%T, %T* @G, i64 0, i32 0)
+  call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 4 %a, i8* align 4 bitcast (%T* @G to i8*), i64 124, i1 false)
+  call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 4 %b, i8* align 4 %a, i64 124, i1 false)
+  call void @bar(i8* %b)
+  ret void
+}
+
 define void @test2_addrspacecast() {
   %A = alloca %T
   %B = alloca %T
   %a = addrspacecast %T* %A to i8 addrspace(1)*
   %b = addrspacecast %T* %B to i8 addrspace(1)*
 
 ; CHECK-LABEL: @test2_addrspacecast(
 

 entry:
   %cc = alloca [3 x i8], align 1
   %cc.0..sroa_idx = getelementptr inbounds [3 x i8], [3 x i8]* %cc, i64 0, i64 0
   %arraydecay = getelementptr inbounds [3 x i8], [3 x i8]* %cc, i32 0, i32 0
   call void @llvm.memcpy.p0i8.p0i8.i64(i8* %arraydecay, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @_ZL3KKK, i32 0, i32 0), i64 3, i1 false)
   call void @llvm.memcpy.p0i8.p0i8.i64(i8* getelementptr inbounds ([1000000 x i8], [1000000 x i8]* @bbb, i32 0, i32 0), i8* %arraydecay, i64 3, i1 false)
   ret void
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/InstCombine/select.ll

 ; CHECK-NEXT:    [[V:%.*]] = load i32, i32 addrspace(1)* [[P2]], align 4
 ; CHECK-NEXT:    ret i32 [[V]]
 ;
   %P2 = select i1 %C, i32 addrspace(1)* null, i32 addrspace(1)* %P
   %V = load i32, i32 addrspace(1)* %P2
   ret i32 %V
 }
 
+;; It may be legal to load from a null address with null pointer valid attribute.
+define i32 @test16_no_null_opt(i1 %C, i32* %P) #0 {
+; CHECK-LABEL: @test16_no_null_opt(
+; CHECK-NEXT:    [[P2:%.*]] = select i1 [[C:%.*]], i32* [[P:%.*]], i32* null
+; CHECK-NEXT:    [[V:%.*]] = load i32, i32* [[P2]], align 4
+; CHECK-NEXT:    ret i32 [[V]]
+;
+  %P2 = select i1 %C, i32* %P, i32* null
+  %V = load i32, i32* %P2
+  ret i32 %V
+}
+
+define i32 @test16_no_null_opt_2(i1 %C, i32* %P) #0 {
+; CHECK-LABEL: @test16_no_null_opt_2(
+; CHECK-NEXT:    [[P2:%.*]] = select i1 [[C:%.*]], i32* null, i32* [[P:%.*]]
+; CHECK-NEXT:    [[V:%.*]] = load i32, i32* [[P2]], align 4
+; CHECK-NEXT:    ret i32 [[V]]
+;
+  %P2 = select i1 %C, i32* null, i32* %P
+  %V = load i32, i32* %P2
+  ret i32 %V
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }
+
 define i1 @test17(i32* %X, i1 %C) {
 ; CHECK-LABEL: @test17(
 ; CHECK-NEXT:    [[RV1:%.*]] = icmp eq i32* [[X:%.*]], null
 ; CHECK-NEXT:    [[NOT_C:%.*]] = xor i1 [[C:%.*]], true
 ; CHECK-NEXT:    [[RV:%.*]] = or i1 [[RV1]], [[NOT_C]]
 ; CHECK-NEXT:    ret i1 [[RV]]
 ;
   %R = select i1 %C, i32* %X, i32* null

test/Transforms/InstCombine/store.ll

 define void @store_at_gep_off_null(i64 %offset) {
 ; CHECK-LABEL: @store_at_gep_off_null
 ; CHECK: store i32 undef, i32* %ptr
    %ptr = getelementptr i32, i32 *null, i64 %offset
    store i32 24, i32* %ptr
    ret void
 }
 
+define void @store_at_gep_off_no_null_opt(i64 %offset) #0 {
+   %ptr = getelementptr i32, i32 *null, i64 %offset
+   store i32 24, i32* %ptr
+   ret void
+; CHECK-LABEL: @store_at_gep_off_no_null_opt(i64 %offset)
+; CHECK-NEXT: %ptr = getelementptr i32, i32* null, i64 %offset
+; CHECK-NEXT: store i32 24, i32* %ptr
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }
+
 ;; Simple sinking tests
 
 ; "if then else"
 define i32 @test3(i1 %C) {
   %A = alloca i32
         br i1 %C, label %Cond, label %Cond2
 
 Cond:

test/Transforms/InstCombine/strcpy_chk-64.ll

 ; RUN: opt < %s -instcombine -S | FileCheck %s
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
 target triple = "x86_64-apple-darwin10.0.0"
 
 define void @func(i8* %i) nounwind ssp {
 ; CHECK-LABEL: @func(
 ; CHECK: @__strcpy_chk(i8* nonnull %arraydecay, i8* %i, i64 32)
 entry:
   %s = alloca [32 x i8], align 16
   %arraydecay = getelementptr inbounds [32 x i8], [32 x i8]* %s, i32 0, i32 0
   %call = call i8* @__strcpy_chk(i8* %arraydecay, i8* %i, i64 32)
   call void @func2(i8* %arraydecay)
   ret void
 }
 
+define void @func_no_null_opt(i8* %i) nounwind ssp #0 {
+; CHECK-LABEL: @func_no_null_opt(
+; CHECK: @__strcpy_chk(i8* %arraydecay, i8* %i, i64 32)
+entry:
+  %s = alloca [32 x i8], align 16
+  %arraydecay = getelementptr inbounds [32 x i8], [32 x i8]* %s, i32 0, i32 0
+  %call = call i8* @__strcpy_chk(i8* %arraydecay, i8* %i, i64 32)
+  call void @func2(i8* %arraydecay)
+  ret void
+}
+
 declare i8* @__strcpy_chk(i8*, i8*, i64) nounwind
 
 declare void @func2(i8*)
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/InstCombine/strlen-1.ll

 ; CHECK-NEXT:    [[HELLO_L:%.*]] = call i32 @strlen(i8* nonnull [[HELLO_P]])
 ; CHECK-NEXT:    ret i32 [[HELLO_L]]
 ;
   %hello_p = getelementptr inbounds [7 x i8], [7 x i8]* @null_hello, i32 0, i32 %x
   %hello_l = call i32 @strlen(i8* %hello_p)
   ret i32 %hello_l
 }
 
+define i32 @test_no_simplify2_no_null_opt(i32 %x) #0 {
+; CHECK-LABEL: @test_no_simplify2_no_null_opt(
+; CHECK-NEXT:    [[HELLO_P:%.*]] = getelementptr inbounds [7 x i8], [7 x i8]* @null_hello, i32 0, i32 %x
+; CHECK-NEXT:    [[HELLO_L:%.*]] = call i32 @strlen(i8* [[HELLO_P]])
+; CHECK-NEXT:    ret i32 [[HELLO_L]]
+;
+  %hello_p = getelementptr inbounds [7 x i8], [7 x i8]* @null_hello, i32 0, i32 %x
+  %hello_l = call i32 @strlen(i8* %hello_p)
+  ret i32 %hello_l
+}
+
 ; strlen(@null_hello_mid + (x & 15)) should not be simplified to a sub instruction.
 
 define i32 @test_no_simplify3(i32 %x) {
 ; CHECK-LABEL: @test_no_simplify3(
 ; CHECK-NEXT:    [[AND:%.*]] = and i32 %x, 15
 ; CHECK-NEXT:    [[HELLO_P:%.*]] = getelementptr inbounds [13 x i8], [13 x i8]* @null_hello_mid, i32 0, i32 [[AND]]
 ; CHECK-NEXT:    [[HELLO_L:%.*]] = call i32 @strlen(i8* nonnull [[HELLO_P]])
 ; CHECK-NEXT:    ret i32 [[HELLO_L]]
 ;
   %and = and i32 %x, 15
   %hello_p = getelementptr inbounds [13 x i8], [13 x i8]* @null_hello_mid, i32 0, i32 %and
   %hello_l = call i32 @strlen(i8* %hello_p)
   ret i32 %hello_l
 }
 
+define i32 @test_no_simplify3_on_null_opt(i32 %x) #0 {
+; CHECK-LABEL: @test_no_simplify3_on_null_opt(
+; CHECK-NEXT:    [[AND:%.*]] = and i32 %x, 15
+; CHECK-NEXT:    [[HELLO_P:%.*]] = getelementptr inbounds [13 x i8], [13 x i8]* @null_hello_mid, i32 0, i32 [[AND]]
+; CHECK-NEXT:    [[HELLO_L:%.*]] = call i32 @strlen(i8* [[HELLO_P]])
+; CHECK-NEXT:    ret i32 [[HELLO_L]]
+;
+  %and = and i32 %x, 15
+  %hello_p = getelementptr inbounds [13 x i8], [13 x i8]* @null_hello_mid, i32 0, i32 %and
+  %hello_l = call i32 @strlen(i8* %hello_p)
+  ret i32 %hello_l
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/InstCombine/wcslen-1.ll

 ; CHECK-NEXT:    [[HELLO_L:%.*]] = call i64 @wcslen(i32* nonnull [[HELLO_P]])
 ; CHECK-NEXT:    ret i64 [[HELLO_L]]
 ;
   %hello_p = getelementptr inbounds [7 x i32], [7 x i32]* @null_hello, i32 0, i32 %x
   %hello_l = call i64 @wcslen(i32* %hello_p)
   ret i64 %hello_l
 }
 
+define i64 @test_no_simplify2_no_null_opt(i32 %x) #0 {
+; CHECK-LABEL: @test_no_simplify2_no_null_opt(
+; CHECK-NEXT:    [[TMP1:%.*]] = sext i32 [[X:%.*]] to i64
+; CHECK-NEXT:    [[HELLO_P:%.*]] = getelementptr inbounds [7 x i32], [7 x i32]* @null_hello, i64 0, i64 [[TMP1]]
+; CHECK-NEXT:    [[HELLO_L:%.*]] = call i64 @wcslen(i32* [[HELLO_P]])
+; CHECK-NEXT:    ret i64 [[HELLO_L]]
+;
+  %hello_p = getelementptr inbounds [7 x i32], [7 x i32]* @null_hello, i32 0, i32 %x
+  %hello_l = call i64 @wcslen(i32* %hello_p)
+  ret i64 %hello_l
+}
+
 ; wcslen(@null_hello_mid + (x & 15)) should not be simplified to a sub instruction.
 
 define i64 @test_no_simplify3(i32 %x) {
 ; CHECK-LABEL: @test_no_simplify3(
 ; CHECK-NEXT:    [[AND:%.*]] = and i32 [[X:%.*]], 15
 ; CHECK-NEXT:    [[TMP1:%.*]] = zext i32 [[AND]] to i64
 ; CHECK-NEXT:    [[HELLO_P:%.*]] = getelementptr inbounds [13 x i32], [13 x i32]* @null_hello_mid, i64 0, i64 [[TMP1]]
 ; CHECK-NEXT:    [[HELLO_L:%.*]] = call i64 @wcslen(i32* nonnull [[HELLO_P]])
 ; CHECK-NEXT:    ret i64 [[HELLO_L]]
 ;
   %and = and i32 %x, 15
   %hello_p = getelementptr inbounds [13 x i32], [13 x i32]* @null_hello_mid, i32 0, i32 %and
   %hello_l = call i64 @wcslen(i32* %hello_p)
   ret i64 %hello_l
 }
 
+define i64 @test_no_simplify3_no_null_opt(i32 %x) #0 {
+; CHECK-LABEL: @test_no_simplify3_no_null_opt(
+; CHECK-NEXT:    [[AND:%.*]] = and i32 [[X:%.*]], 15
+; CHECK-NEXT:    [[TMP1:%.*]] = zext i32 [[AND]] to i64
+; CHECK-NEXT:    [[HELLO_P:%.*]] = getelementptr inbounds [13 x i32], [13 x i32]* @null_hello_mid, i64 0, i64 [[TMP1]]
+; CHECK-NEXT:    [[HELLO_L:%.*]] = call i64 @wcslen(i32* [[HELLO_P]])
+; CHECK-NEXT:    ret i64 [[HELLO_L]]
+;
+  %and = and i32 %x, 15
+  %hello_p = getelementptr inbounds [13 x i32], [13 x i32]* @null_hello_mid, i32 0, i32 %and
+  %hello_l = call i64 @wcslen(i32* %hello_p)
+  ret i64 %hello_l
+}
+
 @str16 = constant [1 x i16] [i16 0]
 
 define i64 @test_no_simplify4() {
 ; CHECK-LABEL: @test_no_simplify4(
 ; CHECK-NEXT:    [[L:%.*]] = call i64 @wcslen(i32* bitcast ([1 x i16]* @str16 to i32*))
 ; CHECK-NEXT:    ret i64 [[L]]
 ;
   %l = call i64 @wcslen(i32* bitcast ([1 x i16]* @str16 to i32*))
   ret i64 %l
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/InstSimplify/compare.ll

 ; CHECK-LABEL: @gep13(
 ; We can prove this GEP is non-null because it is inbounds.
   %x = getelementptr inbounds i8, i8* %ptr, i32 1
   %cmp = icmp eq i8* %x, null
   ret i1 %cmp
 ; CHECK-NEXT: ret i1 false
 }
 
+define i1 @gep13_no_null_opt(i8* %ptr) #0 {
+; We can't prove this GEP is non-null.
+; CHECK-LABEL: @gep13_no_null_opt(
+; CHECK: getelementptr
+; CHECK: icmp
+; CHECK: ret
+  %x = getelementptr inbounds i8, i8* %ptr, i32 1
+  %cmp = icmp eq i8* %x, null
+  ret i1 %cmp
+}
+
 define i1 @gep14({ {}, i8 }* %ptr) {
 ; CHECK-LABEL: @gep14(
 ; We can't simplify this because the offset of one in the GEP actually doesn't
 ; move the pointer.
   %x = getelementptr inbounds { {}, i8 }, { {}, i8 }* %ptr, i32 0, i32 1
   %cmp = icmp eq i8* %x, null
   ret i1 %cmp
 ; CHECK-NOT: ret i1 false
 }
 
 define i1 @gep15({ {}, [4 x {i8, i8}]}* %ptr, i32 %y) {
 ; CHECK-LABEL: @gep15(
 ; We can prove this GEP is non-null even though there is a user value, as we
 ; would necessarily violate inbounds on one side or the other.
   %x = getelementptr inbounds { {}, [4 x {i8, i8}]}, { {}, [4 x {i8, i8}]}* %ptr, i32 0, i32 1, i32 %y, i32 1
   %cmp = icmp eq i8* %x, null
   ret i1 %cmp
 ; CHECK-NEXT: ret i1 false
 }
 
+define i1 @gep15_no_null_opt({ {}, [4 x {i8, i8}]}* %ptr, i32 %y) #0 {
+; We can't prove this GEP is non-null.
+; CHECK-LABEL: @gep15_no_null_opt(
+; CHECK: getelementptr
+; CHECK: icmp
+; CHECK: ret
+  %x = getelementptr inbounds { {}, [4 x {i8, i8}]}, { {}, [4 x {i8, i8}]}* %ptr, i32 0, i32 1, i32 %y, i32 1
+  %cmp = icmp eq i8* %x, null
+  ret i1 %cmp
+}
+
 define i1 @gep16(i8* %ptr, i32 %a) {
 ; CHECK-LABEL: @gep16(
 ; We can prove this GEP is non-null because it is inbounds and because we know
 ; %b is non-zero even though we don't know its value.
   %b = or i32 %a, 1
   %x = getelementptr inbounds i8, i8* %ptr, i32 %b
   %cmp = icmp eq i8* %x, null
   ret i1 %cmp
 ; CHECK-NEXT: ret i1 false
 }
 
+define i1 @gep16_no_null_opt(i8* %ptr, i32 %a) #0 {
+; We can't prove this GEP is non-null.
+; CHECK-LABEL: @gep16_no_null_opt(
+; CHECK getelementptr inbounds i8, i8* %ptr, i32 %b
+; CHECK: %cmp = icmp eq i8* %x, null
+; CHECK-NEXT: ret i1 %cmp
+  %b = or i32 %a, 1
+  %x = getelementptr inbounds i8, i8* %ptr, i32 %b
+  %cmp = icmp eq i8* %x, null
+  ret i1 %cmp
+}
+
 define i1 @gep17() {
 ; CHECK-LABEL: @gep17(
   %alloca = alloca i32, align 4
   %bc = bitcast i32* %alloca to [4 x i8]*
   %gep1 = getelementptr inbounds i32, i32* %alloca, i32 1
   %pti1 = ptrtoint i32* %gep1 to i32
   %gep2 = getelementptr inbounds [4 x i8], [4 x i8]* %bc, i32 0, i32 1
   %pti2 = ptrtoint i8* %gep2 to i32
define i1 @alloca_compare(i64 %idx) {
   %sv = alloca { i32, i32, [124 x i32] }
   %1 = getelementptr inbounds { i32, i32, [124 x i32] }, { i32, i32, [124 x i32] }* %sv, i32 0, i32 2, i64 %idx
   %2 = icmp eq i32* %1, null
   ret i1 %2
   ; CHECK: alloca_compare
   ; CHECK: ret i1 false
 }
 
+define i1 @alloca_compare_no_null_opt(i64 %idx) #0 {
+; CHECK-LABEL: alloca_compare_no_null_opt(
+; CHECK: %sv = alloca { i32, i32, [124 x i32] }
+; CHECK: %cmp = getelementptr inbounds { i32, i32, [124 x i32] }, { i32, i32, [124 x i32] }* %sv, i32 0, i32 2, i64 %idx
+; CHECK: %X = icmp eq i32* %cmp, null
+; CHECK: ret i1 %X
+  %sv = alloca { i32, i32, [124 x i32] }
+  %cmp = getelementptr inbounds { i32, i32, [124 x i32] }, { i32, i32, [124 x i32] }* %sv, i32 0, i32 2, i64 %idx
+  %X = icmp eq i32* %cmp, null
+  ret i1 %X
+}
 ; PR12075
 define i1 @infinite_gep() {
   ret i1 1
 
 unreachableblock:
   %X = getelementptr i32, i32 *%X, i32 1
   %Y = icmp eq i32* %X, null
   ret i1 %Y

 ; is non-null.
   %strs = alloca [1000 x [1001 x i8]], align 16
   %x = getelementptr inbounds [1000 x [1001 x i8]], [1000 x [1001 x i8]]* %strs, i64 0, i64 %a, i64 %b
   %cmp = icmp eq i8* %x, null
   ret i1 %cmp
 ; CHECK-NEXT: ret i1 false
 }
 
+define i1 @alloca_gep_no_null_opt(i64 %a, i64 %b) #0 {
+; CHECK-LABEL: @alloca_gep_no_null_opt(
+; We can't prove this GEP is non-null.
+; CHECK: alloca
+; CHECK: getelementptr
+; CHECK: icmp
+; CHECK: ret
+  %strs = alloca [1000 x [1001 x i8]], align 16
+  %x = getelementptr inbounds [1000 x [1001 x i8]], [1000 x [1001 x i8]]* %strs, i64 0, i64 %a, i64 %b
+  %cmp = icmp eq i8* %x, null
+  ret i1 %cmp
+}
+
 define i1 @non_inbounds_gep_compare(i64* %a) {
 ; CHECK-LABEL: @non_inbounds_gep_compare(
 ; Equality compares with non-inbounds GEPs can be folded.
   %x = getelementptr i64, i64* %a, i64 42
   %y = getelementptr inbounds i64, i64* %x, i64 -42
   %z = getelementptr i64, i64* %a, i64 -42
   %w = getelementptr inbounds i64, i64* %z, i64 42
   %cmp = icmp eq i64* %y, %w

 
 define i1 @nonnull_arg(i32* nonnull %i) {
   %cmp = icmp eq i32* %i, null
   ret i1 %cmp
 ; CHECK-LABEL: @nonnull_arg
 ; CHECK: ret i1 false
 }
 
+define i1 @nonnull_arg_no_null_opt(i32* nonnull %i) #0 {
+  %cmp = icmp eq i32* %i, null
+  ret i1 %cmp
+; CHECK-LABEL: @nonnull_arg_no_null_opt
+; CHECK: ret i1 false
+}
+
 define i1 @nonnull_deref_arg(i32* dereferenceable(4) %i) {
   %cmp = icmp eq i32* %i, null
   ret i1 %cmp
 ; CHECK-LABEL: @nonnull_deref_arg
 ; CHECK: ret i1 false
 }
 
+define i1 @nonnull_deref_arg_no_null_opt(i32* dereferenceable(4) %i) #0 {
+  %cmp = icmp eq i32* %i, null
+  ret i1 %cmp
+; CHECK-LABEL: @nonnull_deref_arg_no_null_opt
+; CHECK-NEXT: icmp
+; CHECK: ret
+}
 define i1 @nonnull_deref_as_arg(i32 addrspace(1)* dereferenceable(4) %i) {
   %cmp = icmp eq i32 addrspace(1)* %i, null
   ret i1 %cmp
 ; CHECK-LABEL: @nonnull_deref_as_arg
 ; CHECK: icmp
 ; CHECK: ret
 }
 

 define i1 @returns_nonnull_deref() {
   %call = call dereferenceable(4) i32* @returns_nonnull_deref_helper()
   %cmp = icmp eq i32* %call, null
   ret i1 %cmp
 ; CHECK-LABEL: @returns_nonnull_deref
 ; CHECK: ret i1 false
 }
 
+define i1 @returns_nonnull_deref_no_null_opt () #0 {
+  %call = call dereferenceable(4) i32* @returns_nonnull_deref_helper()
+  %cmp = icmp eq i32* %call, null
+  ret i1 %cmp
+; CHECK-LABEL: @returns_nonnull_deref_no_null_opt
+; CHECK: icmp
+; CHECK: ret
+}
+
 declare dereferenceable(4) i32 addrspace(1)* @returns_nonnull_deref_as_helper()
 define i1 @returns_nonnull_as_deref() {
   %call = call dereferenceable(4) i32 addrspace(1)* @returns_nonnull_deref_as_helper()
   %cmp = icmp eq i32 addrspace(1)* %call, null
   ret i1 %cmp
 ; CHECK-LABEL: @returns_nonnull_as_deref
 ; CHECK: icmp
 ; CHECK: ret

 
 define i1 @constant_fold_null_inttoptr() {
 ; CHECK-LABEL: @constant_fold_null_inttoptr(
 ; CHECK-NEXT:    ret i1 false
 ;
   %x = icmp eq i32* null, inttoptr (i64 32 to i32*)
   ret i1 %x
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/LoopIdiom/pr28196.ll

for.body:                                         ; preds = %for.body, %for.body.preheader
   %indvars.iv.next = add nsw i32 %indvars.iv, 1
   %exitcond = icmp ne i32 %indvars.iv.next, 6
   br i1 %exitcond, label %for.body, label %for.body.preheader
 }
 
 ; CHECK-LABEL: define void @test1(
 ; CHECK: call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 4 null, i8* align 4 inttoptr (i64 4 to i8*), i64 24, i1 false)
 ; CHECK-NOT: store
+
+define void @test1_no_null_opt() #0 {
+entry:
+  br label %for.body.preheader
+
+for.body.preheader:                               ; preds = %for.cond
+  br label %for.body
+
+for.body:                                         ; preds = %for.body, %for.body.preheader
+  %indvars.iv = phi i32 [ 0, %for.body.preheader ], [ %indvars.iv.next, %for.body ]
+  %add.ptr3 = getelementptr inbounds i32, i32* null, i32 %indvars.iv
+  %add.ptr4 = getelementptr inbounds i32, i32* %add.ptr3, i32 1
+  %0 = load i32, i32* %add.ptr4, align 4
+  store i32 %0, i32* %add.ptr3, align 4
+  %indvars.iv.next = add nsw i32 %indvars.iv, 1
+  %exitcond = icmp ne i32 %indvars.iv.next, 6
+  br i1 %exitcond, label %for.body, label %for.body.preheader
+}
+
+; CHECK-LABEL: define void @test1_no_null_opt(
+; CHECK-NOT: call void @llvm.memcpy
+; CHECK: getelementptr
+; CHECK: getelementptr
+; CHECK: load
+; CHECK: store
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/LoopVersioning/lcssa.ll

bb3.loopexit:
   store i8* %_tmp28.lcssa, i8** %ls1.20
   store i8 %_tmp15.lcssa, i8* %cse3.22
   store i8* %_tmp30.lcssa, i8** %ls2.21
   br label %bb3
 
 bb3:
   ret void
 }
+
+define void @fill_no_null_opt(i8** %ls1.20, i8** %ls2.21, i8* %cse3.22) #0 {
+; CHECK-LABEL: fill_no_null_opt(
+; CHECK: bb1.lver.check:
+; CHECK: %lver.safe = or i1 %memcheck.conflict, %{{.*}}
+; CHECK:  br i1 %lver.safe, label %bb1.ph.lver.orig, label %bb1.ph
+bb1.ph:
+  %ls1.20.promoted = load i8*, i8** %ls1.20
+  %ls2.21.promoted = load i8*, i8** %ls2.21
+  br label %bb1
+
+bb1:
+  %_tmp302 = phi i8* [ %ls2.21.promoted, %bb1.ph ], [ %_tmp30, %bb1 ]
+  %_tmp281 = phi i8* [ %ls1.20.promoted, %bb1.ph ], [ %_tmp28, %bb1 ]
+  %_tmp14 = getelementptr i8, i8* %_tmp281, i16 -1
+  %_tmp15 = load i8, i8* %_tmp14
+  %add = add i8 %_tmp15, 1
+  store i8 %add, i8* %_tmp281
+  store i8 %add, i8* %_tmp302
+  %_tmp28 = getelementptr i8, i8* %_tmp281, i16 1
+  %_tmp30 = getelementptr i8, i8* %_tmp302, i16 1
+  br i1 false, label %bb1, label %bb3.loopexit
+
+bb3.loopexit:
+  %_tmp30.lcssa = phi i8* [ %_tmp30, %bb1 ]
+  %_tmp15.lcssa = phi i8 [ %_tmp15, %bb1 ]
+  %_tmp28.lcssa = phi i8* [ %_tmp28, %bb1 ]
+  store i8* %_tmp28.lcssa, i8** %ls1.20
+  store i8 %_tmp15.lcssa, i8* %cse3.22
+  store i8* %_tmp30.lcssa, i8** %ls2.21
+  br label %bb3
+
+bb3:
+  ret void
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/SimplifyCFG/UnreachableEliminate.ll

  br label %bb2
 
 bb2:
   %ptr.2 = phi i8* [ %ptr, %bb3 ], [ null, %bb1 ]
   store i8 2, i8* %ptr.2, align 8
   ret void
 }
 
+define void @test5_no_null_opt(i1 %cond, i8* %ptr) #0 {
+
+; CHECK-LABEL: test5_no_null_opt
+; CHECK: entry:
+; CHECK: %[[SEL:.*]] = select i1 %cond, i8* null, i8* %ptr
+; CHECK: store i8 2, i8* %[[SEL]]
+
+entry:
+  br i1 %cond, label %bb1, label %bb3
+
+bb3:
+ br label %bb2
+
+bb1:
+ br label %bb2
+
+bb2:
+  %ptr.2 = phi i8* [ %ptr, %bb3 ], [ null, %bb1 ]
+  store i8 2, i8* %ptr.2, align 8
+  ret void
+}
+
 ; CHECK-LABEL: test6
 ; CHECK: entry:
 ; CHECK-NOT: select
 ; CHECK:  store i8 2, i8* %ptr
 ; CHECK:  ret
 
 define void @test6(i1 %cond, i8* %ptr) {
 entry:
   br i1 %cond, label %bb1, label %bb2
 
 bb1:
   br label %bb2
 
 bb2:
   %ptr.2 = phi i8* [ %ptr, %entry ], [ null, %bb1 ]
   store i8 2, i8* %ptr.2, align 8
   ret void
 }
 
+; CHECK-LABEL: test6_no_null_opt
+; CHECK: entry:
+; CHECK: %[[SEL:.*]] = select i1 %cond, i8* null, i8* %ptr
+; CHECK: store i8 2, i8* %[[SEL]]
+
+define void @test6_no_null_opt(i1 %cond, i8* %ptr) #0 {
+entry:
+  br i1 %cond, label %bb1, label %bb2
+
+bb1:
+  br label %bb2
+
+bb2:
+  %ptr.2 = phi i8* [ %ptr, %entry ], [ null, %bb1 ]
+  store i8 2, i8* %ptr.2, align 8
+  ret void
+}
+
+
 define i32 @test7(i1 %X) {
 entry:
   br i1 %X, label %if, label %else
 
 if:
   call void undef()
   br label %else
 

 
 else:
   %phi = phi void ()* [ %Y, %entry ], [ null, %if ]
   call void %phi()
   ret void
 }
 ; CHECK-LABEL: define void @test8(
 ; CHECK: call void %Y(
+
+define void @test8_no_null_opt(i1 %X, void ()* %Y) #0 {
+entry:
+  br i1 %X, label %if, label %else
+
+if:
+  br label %else
+
+else:
+  %phi = phi void ()* [ %Y, %entry ], [ null, %if ]
+  call void %phi()
+  ret void
+}
+attributes #0 = { "null-pointer-is-valid"="true" }
+
+; CHECK-LABEL: define void @test8_no_null_opt(
+; CHECK: %[[SEL:.*]] = select i1 %X, void ()* null, void ()* %Y
+; CHECK: call void %[[SEL]]

test/Transforms/SimplifyCFG/invoke.ll

 lpad:
   %0 = landingpad { i8*, i32 }
           filter [0 x i8*] zeroinitializer
   %1 = extractvalue { i8*, i32 } %0, 0
   tail call void @__cxa_call_unexpected(i8* %1) noreturn nounwind
   unreachable
 }
 
+; CHECK-LABEL: @f2_no_null_opt(
+define i8* @f2_no_null_opt() nounwind uwtable ssp #0 personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
+entry:
+; CHECK: invoke noalias i8* null()
+  %call = invoke noalias i8* null()
+          to label %invoke.cont unwind label %lpad
+
+; CHECK: invoke.cont:
+; CHECK: ret i8* %call
+invoke.cont:
+  ret i8* %call
+
+lpad:
+  %0 = landingpad { i8*, i32 }
+          filter [0 x i8*] zeroinitializer
+  %1 = extractvalue { i8*, i32 } %0, 0
+  tail call void @__cxa_call_unexpected(i8* %1) noreturn nounwind
+; CHECK: unreachable
+  unreachable
+}
+
 ; CHECK-LABEL: @f3(
 define i32 @f3() nounwind uwtable ssp personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
 ; CHECK-NEXT: entry
 entry:
 ; CHECK-NEXT: ret i32 3
   %call = invoke i32 @read_only()
           to label %invoke.cont unwind label %lpad
 

 
 lpad:
 ; CHECK-NOT: phi
   %tmp = phi i8* [ null, %invoke.cont1 ], [ null, %entry ]
   landingpad { i8*, i32 }
           cleanup
   ret void
 }
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/SimplifyCFG/phi-undef-loadstore.ll

 
 ; CHECK-LABEL: @test1(
 ; CHECK: if.else:
 ; CHECK: br label %if.end7
 
 ; CHECK: phi i32* [ %a, %if.then ], [ %c, %if.else ]
 }
 
+define i32 @test1_no_null_opt(i32* %a, i32 %b, i32* %c, i32 %d) nounwind #0 {
+entry:
+  %tobool = icmp eq i32 %b, 0
+  br i1 %tobool, label %if.else, label %if.then
+
+if.then:                                          ; preds = %entry
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.else:                                          ; preds = %entry
+  %tobool3 = icmp eq i32 %d, 0
+  br i1 %tobool3, label %if.end7, label %if.then4
+
+if.then4:                                         ; preds = %if.else
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.end7:                                          ; preds = %if.else, %if.then4, %if.then
+  %x.0 = phi i32* [ %a, %if.then ], [ %c, %if.then4 ], [ null, %if.else ]
+  %tmp9 = load i32, i32* %x.0
+  ret i32 %tmp9
+
+; CHECK-LABEL: @test1_no_null_opt(
+; CHECK: if.then:
+; CHECK: if.else:
+; CHECK: if.then4:
+; CHECK: br label %if.end7
+; CHECK: if.end7:
+; CHECK-NEXT: phi i32* [ %a, %if.then ], [ %c, %if.then4 ], [ null, %if.else ]
+}
+
 define i32 @test2(i32* %a, i32 %b, i32* %c, i32 %d) nounwind {
 entry:
   %tobool = icmp eq i32 %b, 0
   br i1 %tobool, label %if.else, label %if.then
 
 if.then:                                          ; preds = %entry
   tail call void @bar() nounwind
   br label %if.end7
if.end7:                                          ; preds = %if.else, %if.then4, %if.then
   ret i32 %tmp9
 ; CHECK-LABEL: @test2(
 ; CHECK: if.else:
 ; CHECK: unreachable
 
 ; CHECK-NOT: phi
 }
 
+define i32 @test2_no_null_opt(i32* %a, i32 %b, i32* %c, i32 %d) nounwind #0 {
+entry:
+  %tobool = icmp eq i32 %b, 0
+  br i1 %tobool, label %if.else, label %if.then
+
+if.then:                                          ; preds = %entry
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.else:                                          ; preds = %entry
+  %tobool3 = icmp eq i32 %d, 0
+  br i1 %tobool3, label %if.end7, label %if.then4
+
+if.then4:                                         ; preds = %if.else
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.end7:                                          ; preds = %if.else, %if.then4, %if.then
+  %x.0 = phi i32* [ %a, %if.then ], [ null, %if.then4 ], [ null, %if.else ]
+  %tmp9 = load i32, i32* %x.0
+  ret i32 %tmp9
+; CHECK-LABEL: @test2_no_null_opt(
+; CHECK: if.then:
+; CHECK: if.else:
+; CHECK: if.then4:
+; CHECK: if.end7:
+; CHECK-NEXT: phi i32* [ %a, %if.then ], [ null, %if.then4 ], [ null, %if.else ]
+}
+
 define i32 @test3(i32* %a, i32 %b, i32* %c, i32 %d) nounwind {
 entry:
   %tobool = icmp eq i32 %b, 0
   br i1 %tobool, label %if.else, label %if.then
 
 if.then:                                          ; preds = %entry
   tail call void @bar() nounwind
   br label %if.end7
if.end7:                                          ; preds = %if.else, %if.then4, %if.then
   tail call void @bar() nounwind
   %tmp9 = load i32, i32* %x.0
   ret i32 %tmp9
 ; CHECK-LABEL: @test3(
 ; CHECK: if.end7:
 ; CHECK: phi i32* [ %a, %if.then ], [ null, %if.then4 ], [ null, %if.else ]
 }
 
+define i32 @test3_no_null_opt(i32* %a, i32 %b, i32* %c, i32 %d) nounwind #0 {
+entry:
+  %tobool = icmp eq i32 %b, 0
+  br i1 %tobool, label %if.else, label %if.then
+
+if.then:                                          ; preds = %entry
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.else:                                          ; preds = %entry
+  %tobool3 = icmp eq i32 %d, 0
+  br i1 %tobool3, label %if.end7, label %if.then4
+
+if.then4:                                         ; preds = %if.else
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.end7:                                          ; preds = %if.else, %if.then4, %if.then
+  %x.0 = phi i32* [ %a, %if.then ], [ null, %if.then4 ], [ null, %if.else ]
+  tail call void @bar() nounwind
+  %tmp9 = load i32, i32* %x.0
+  ret i32 %tmp9
+; CHECK-LABEL: @test3_no_null_opt(
+; CHECK: if.then:
+; CHECK: if.else:
+; CHECK: if.then4:
+; CHECK: if.end7:
+; CHECK-NEXT: phi i32* [ %a, %if.then ], [ null, %if.then4 ], [ null, %if.else ]
+}
+
 define i32 @test4(i32* %a, i32 %b, i32* %c, i32 %d) nounwind {
 entry:
   %tobool = icmp eq i32 %b, 0
   br i1 %tobool, label %if.else, label %if.then
 
 if.then:                                          ; preds = %entry
   tail call void @bar() nounwind
   br label %if.end7
if.end7:                                          ; preds = %if.else, %if.then4, %if.then
   %gep = getelementptr i32, i32* %x.0, i32 10
   %tmp9 = load i32, i32* %gep
   %tmp10 = or i32 %tmp9, 1
   store i32 %tmp10, i32* %gep
   ret i32 %tmp9
 ; CHECK-LABEL: @test4(
 ; CHECK-NOT: phi
 }
+
+define i32 @test4_no_null_opt(i32* %a, i32 %b, i32* %c, i32 %d) nounwind #0 {
+entry:
+  %tobool = icmp eq i32 %b, 0
+  br i1 %tobool, label %if.else, label %if.then
+
+if.then:                                          ; preds = %entry
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.else:                                          ; preds = %entry
+  %tobool3 = icmp eq i32 %d, 0
+  br i1 %tobool3, label %if.end7, label %if.then4
+
+if.then4:                                         ; preds = %if.else
+  tail call void @bar() nounwind
+  br label %if.end7
+
+if.end7:                                          ; preds = %if.else, %if.then4, %if.then
+  %x.0 = phi i32* [ %a, %if.then ], [ null, %if.then4 ], [ null, %if.else ]
+  %gep = getelementptr i32, i32* %x.0, i32 10
+  %tmp9 = load i32, i32* %gep
+  %tmp10 = or i32 %tmp9, 1
+  store i32 %tmp10, i32* %gep
+  ret i32 %tmp9
+; CHECK-LABEL: @test4_no_null_opt(
+; CHECK: if.then:
+; CHECK: if.else:
+; CHECK: if.then4:
+; CHECK: if.end7:
+; CHECK-NEXT: phi i32* [ %a, %if.then ], [ null, %if.then4 ], [ null, %if.else ]
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }

test/Transforms/SimplifyCFG/trap-no-null-opt-debugloc.ll

+; RUN: opt -S -simplifycfg < %s | FileCheck %s
+define void @foo() nounwind ssp #0 !dbg !0 {
+; CHECK: store i32 42, i32* null
+; CHECK-NOT: call void @llvm.trap()
+; CHECK: ret void
+  store i32 42, i32* null, !dbg !5
+  ret void, !dbg !7
+}
+
+attributes #0 = { "null-pointer-is-valid"="true" }
+
+!llvm.dbg.cu = !{!2}
+!llvm.module.flags = !{!10}
+
+!0 = distinct !DISubprogram(name: "foo", line: 3, isLocal: false, isDefinition: true, virtualIndex: 6, isOptimized: false, unit: !2, file: !8, scope: !1, type: !3)
+!1 = !DIFile(filename: "foo.c", directory: "/private/tmp")
+!2 = distinct !DICompileUnit(language: DW_LANG_C99, producer: "Apple clang version 3.0 (tags/Apple/clang-206.1) (based on LLVM 3.0svn)", isOptimized: true, emissionKind: FullDebug, file: !8, enums: !{}, retainedTypes: !{})
+!3 = !DISubroutineType(types: !4)
+!4 = !{null}
+!5 = !DILocation(line: 4, column: 2, scope: !6)
+!6 = distinct !DILexicalBlock(line: 3, column: 12, file: !8, scope: !0)
+!7 = !DILocation(line: 5, column: 1, scope: !6)
+!8 = !DIFile(filename: "foo.c", directory: "/private/tmp")
+!10 = !{i32 1, !"Debug Info Version", i32 3}

test/Transforms/SimplifyCFG/trapping-load-unreachable.ll

bb:             ; preds = %entry
         
         br label %return
 return:         ; preds = %entry
         ret void
 ; CHECK-LABEL: @test1(
 ; CHECK: load volatile
 }
 
+define void @test1_no_null_opt(i32 %x) nounwind #0 {
+entry:
+        %0 = icmp eq i32 %x, 0          ; <i1> [#uses=1]
+        br i1 %0, label %bb, label %return
+
+bb:             ; preds = %entry
+        %1 = load volatile i32, i32* null
+        unreachable
+
+        br label %return
+return:         ; preds = %entry
+        ret void
+; CHECK-LABEL: @test1_no_null_opt(
+; CHECK: load volatile
+; CHECK: unreachable
+}
+
 ; rdar://7958343
 define void @test2() nounwind {
 entry:
         store i32 4,i32* null
         ret void
-        
 ; CHECK-LABEL: @test2(
 ; CHECK: call void @llvm.trap
 ; CHECK: unreachable
 }
 
+define void @test2_no_null_opt() nounwind #0 {
+entry:
+        store i32 4,i32* null
+        ret void
+; CHECK-LABEL: @test2_no_null_opt(
+; CHECK: store i32 4, i32* null
+; CHECK-NOT: call void @llvm.trap
+; CHECK: ret
+}
+
 ; PR7369
 define void @test3() nounwind {
 entry:
         store volatile i32 4, i32* null
         ret void
 
 ; CHECK-LABEL: @test3(
 ; CHECK: store volatile i32 4, i32* null
 ; CHECK: ret
 }
 
+define void @test3_no_null_opt() nounwind #0 {
+entry:
+        store volatile i32 4, i32* null
+        ret void
+
+; CHECK-LABEL: @test3_no_null_opt(
+; CHECK: store volatile i32 4, i32* null
+; CHECK: ret
+}
+
 ; Check store before unreachable.
 define void @test4(i1 %C, i32* %P) {
 ; CHECK-LABEL: @test4(
 ; CHECK: entry:
 ; CHECK-NEXT: br i1 %C
 entry:
   br i1 %C, label %T, label %F
 T:
entry:
   br i1 %C, label %T, label %F
 T:
   atomicrmw volatile xchg i32* %P, i32 0 seq_cst
   unreachable
 F:
   ret void
 }
 
+attributes #0 = { "null-pointer-is-valid"="true" }

unittests/Analysis/AliasAnalysisTest.cpp

protected:
   AliasAnalysisTest() : M("AliasAnalysisTest", C), TLI(TLII) {}
 
   AAResults &getAAResults(Function &F) {
     // Reset the Function AA results first to clear out any references.
     AAR.reset(new AAResults(TLI));
 
     // Build the various AA results and register them.
     AC.reset(new AssumptionCache(F));
-    BAR.reset(new BasicAAResult(M.getDataLayout(), TLI, *AC));
+    BAR.reset(new BasicAAResult(M.getDataLayout(), F, TLI, *AC));
     AAR->addAAResult(*BAR);
 
     return *AAR;
   }
 };
 
 TEST_F(AliasAnalysisTest, getModRefInfo) {
   // Setup function.

unittests/Analysis/MemorySSA.cpp

struct TestAnalyses {
     BasicAAResult BAA;
     // We need to defer MSSA construction until AA is *entirely* set up, which
     // requires calling addAAResult. Hence, we just use a pointer here.
     std::unique_ptr<MemorySSA> MSSA;
     MemorySSAWalker *Walker;
 
     TestAnalyses(MemorySSATest &Test)
         : DT(*Test.F), AC(*Test.F), AA(Test.TLI),
-          BAA(Test.DL, Test.TLI, AC, &DT) {
+          BAA(Test.DL, *Test.F, Test.TLI, AC, &DT) {
       AA.addAAResult(BAA);
       MSSA = make_unique<MemorySSA>(*Test.F, &AA, &DT);
       Walker = MSSA->getWalker();
     }
   };
 
   std::unique_ptr<TestAnalyses> Analyses;