Index: clang/tools/clang-fuzzer/cxx_loop_proto.proto
===================================================================
--- clang/tools/clang-fuzzer/cxx_loop_proto.proto
+++ clang/tools/clang-fuzzer/cxx_loop_proto.proto
@@ -74,7 +74,8 @@
 }
 
 message LoopFunction {
-  required StatementSeq statements = 1;
+  required StatementSeq inner_statements = 1;
+  required StatementSeq outer_statements = 2;
 }
 
 package clang_fuzzer;
Index: clang/tools/clang-fuzzer/proto-to-cxx/loop_proto_to_cxx.cpp
===================================================================
--- clang/tools/clang-fuzzer/proto-to-cxx/loop_proto_to_cxx.cpp
+++ clang/tools/clang-fuzzer/proto-to-cxx/loop_proto_to_cxx.cpp
@@ -28,6 +28,8 @@
 
 namespace clang_fuzzer {
 
+static bool inner_loop;
+
 // Forward decls.
 std::ostream &operator<<(std::ostream &os, const BinaryOp &x);
 std::ostream &operator<<(std::ostream &os, const StatementSeq &x);
@@ -37,13 +39,14 @@
   return os << "(" << x.val() << ")";
 }
 std::ostream &operator<<(std::ostream &os, const VarRef &x) {
+  std::string var = inner_loop ? "i" : "j";
   switch (x.arr()) {
     case VarRef::ARR_A:
-      return os << "a[i]";
+      return os << "a[" << var << "]";
     case VarRef::ARR_B:
-      return os << "b[i]";
+      return os << "b[" << var << "]";
     case VarRef::ARR_C:
-      return os << "c[i]";
+      return os << "c[" << var << "]";
   }
 }
 std::ostream &operator<<(std::ostream &os, const Rvalue &x) {
@@ -109,9 +112,13 @@
   return os;
 }
 std::ostream &operator<<(std::ostream &os, const LoopFunction &x) {
-  return os << "void foo(int *a, int *b, int *__restrict__ c, size_t s) {\n"
-            << "for (int i=0; i<s; i++){\n"
-            << x.statements() << "}\n}\n";
+  inner_loop = true;
+  os << "void foo(int *a, int *b, int *__restrict__ c, size_t s) {\n"
+     << "for (int i=0; i<s; i++){\n"
+     << "for (int j=0; j<s; j++){\n"
+     << x.inner_statements() << "}\n";
+  inner_loop = false;
+  return os << x.outer_statements() << "}\n}\n";
 }
 
 // ---------------------------------
Index: clang/tools/clang-fuzzer/proto-to-llvm/loop_proto_to_llvm.cpp
===================================================================
--- clang/tools/clang-fuzzer/proto-to-llvm/loop_proto_to_llvm.cpp
+++ clang/tools/clang-fuzzer/proto-to-llvm/loop_proto_to_llvm.cpp
@@ -30,17 +30,20 @@
 std::string StateSeqToString(std::ostream &os, const StatementSeq &x);
 
 // Counter variable to generate new LLVM IR variable names and wrapper function
-std::string get_var() {
+static std::string get_var() {
   static int ctr = 0;
   return "%var" + std::to_string(ctr++);
 }
 
+static bool inner_loop = false;
+
 // Proto to LLVM.
 
 std::string ConstToString(const Const &x) {
   return std::to_string(x.val());
 }
 std::string VarRefToString(std::ostream &os, const VarRef &x) {
+  std::string var = inner_loop ? "inner" : "outer";
   std::string arr;
   switch(x.arr()) {
   case VarRef::ARR_A:
@@ -54,7 +57,8 @@
     break;
   }
   std::string ptr_var = get_var();
-  os << ptr_var << " = getelementptr inbounds i32, i32* " << arr << ", i64 %ct\n";
+  os << ptr_var << " = getelementptr inbounds i32, i32* " << arr
+     << ", i64 %" << var << "_ct\n";
   return ptr_var;
 }
 std::string RvalueToString(std::ostream &os, const Rvalue &x) {
@@ -120,27 +124,37 @@
   for (auto &st : x.statements()) {
     os << st;
   }
+  inner_loop = true;
   return os;
 }
 std::ostream &operator<<(std::ostream &os, const LoopFunction &x) {
-  return os << "target triple = \"x86_64-unknown-linux-gnu\"\n"
-            << "define void @foo(i32* %a, i32* %b, i32* %c, i64 %s) {\n"
-            << "%1 = icmp sgt i64 %s, 0\n"
-            << "br i1 %1, label %start, label %end\n"
-            << "start:\n"
-            << "br label %loop\n"
-            << "end:\n"
-            << "ret void\n"
-            << "loop:\n"
-            << " %ct   = phi i64 [ %ctnew, %loop ], [ 0, %start ]\n"
-            << x.statements()
-            << "%ctnew = add i64 %ct, 1\n"
-            << "%j = icmp eq i64 %ctnew, %s\n"
-            << "br i1 %j, label %end, label %loop, !llvm.loop !0\n}\n"
-            << "!0 = distinct !{!0, !1, !2}\n"
-            << "!1 = !{!\"llvm.loop.vectorize.enable\", i1 true}\n"
-            << "!2 = !{!\"llvm.loop.vectorize.width\", i32 " << kArraySize
-            << "}\n";
+  os << "target triple = \"x86_64-pc-linux-gnu\"\n"
+     << "define void @foo(i32* %a, i32* %b, i32* noalias %c, i64 %s) {\n"
+     << "%cmp = icmp sgt i64 %s, 0\n"
+     << "br i1 %cmp, label %outer_loop_start, label %end\n"
+     << "outer_loop_start:\n"
+     << "br label %inner_loop_start\n"
+     << "inner_loop_start:\n"
+     << "%outer_ct = phi i64 [%o_ct_new, %outer_loop], [0, %outer_loop_start]\n"
+     << "br label %inner_loop\n"
+     << "end:\n"
+     << "ret void\n"
+     << "outer_loop:\n"
+     << x.outer_statements()
+     << "%o_ct_new = add nuw nsw i64 %outer_ct, 1\n"
+     << "%jmp_outer = icmp eq i64 %o_ct_new, %s\n"
+     << "br i1 %jmp_outer, label %end, label %inner_loop_start\n"
+     << "inner_loop:\n"
+     << "%inner_ct = phi i64 [0, %inner_loop_start], [%i_ct_new, %inner_loop]\n"
+     << x.inner_statements()
+     << "%i_ct_new = add nuw nsw i64 %inner_ct, 1\n"
+     << "%jmp_inner = icmp eq i64 %i_ct_new, %s\n"
+     << "br i1 %jmp_inner, label %outer_loop, label %inner_loop, !llvm.loop !0\n"
+     << "}\n"
+     << "!0 = distinct !{!0, !1, !2}\n"
+     << "!1 = !{!\"llvm.loop.vectorize.enable\", i1 true}\n"
+     << "!2 = !{!\"llvm.loop.vectorize.width\", i32 " << kArraySize << "}\n";
+  return os;
 }
 
 // ---------------------------------