Update CaptureTracker so psub does not capture operands if possible

[aqjune]

Summary

This is a patch that shows how llvm.psub intrinsic function (https://reviews.llvm.org/D56598) can make CaptureTracker smarter.

If two pointers p1 and p2 (which are given to llvm.psub call) are both from logical pointers, meaning that neither of them are based on inttoptr cast, CaptureTracker can assume that the call captures neither of its operands.

[lebedev.ri]

Tests missing.

[asbirlea]

I may not be the best to approve this change. Here are some high-level comments though.

include/llvm/Analysis/CaptureTracking.h

64

This is a fairly extensive API change.
If TLI was set to default to nullptr here, will you still need to change all callsites to achieve your goal for psub intrinsics?

lib/Analysis/ValueTracking.cpp

1868

If the only current call to isGuaranteedToBeLogicalPointer sets LI to nullptr, I would remove it from the signature, and pass nullptr to GetUnderlyingObjects.

[aqjune]

Abandon this patch; will a new patch be uploaded later

include/llvm/Analysis/CaptureTracking.h

 
 namespace llvm {
 
   class Value;
   class Use;
   class Instruction;
   class DominatorTree;
   class OrderedBasicBlock;
+  class TargetLibraryInfo;
 
   /// The default value for MaxUsesToExplore argument. It's relatively small to
   /// keep the cost of analysis reasonable for clients like BasicAliasAnalysis,
   /// where the results can't be cached.
   /// TODO: we should probably introduce a caching CaptureTracking analysis and
   /// use it where possible. The caching version can use much higher limit or
   /// don't have this cap at all.
   unsigned constexpr DefaultMaxUsesToExplore = 20;
 
   /// PointerMayBeCaptured - Return true if this pointer value may be captured
   /// by the enclosing function (which is required to exist).  This routine can
   /// be expensive, so consider caching the results.  The boolean ReturnCaptures
   /// specifies whether returning the value (or part of it) from the function
   /// counts as capturing it or not.  The boolean StoreCaptures specified
   /// whether storing the value (or part of it) into memory anywhere
   /// automatically counts as capturing it or not.
   /// MaxUsesToExplore specifies how many uses should the analysis explore for
   /// one value before giving up due too "too many uses".
   bool PointerMayBeCaptured(const Value *V,
                             bool ReturnCaptures,
                             bool StoreCaptures,
+                            const TargetLibraryInfo *TLI,
                             unsigned MaxUsesToExplore = DefaultMaxUsesToExplore);
 
   /// PointerMayBeCapturedBefore - Return true if this pointer value may be
   /// captured by the enclosing function (which is required to exist). If a
   /// DominatorTree is provided, only captures which happen before the given
   /// instruction are considered. This routine can be expensive, so consider
   /// caching the results.  The boolean ReturnCaptures specifies whether
   /// returning the value (or part of it) from the function counts as capturing
   /// it or not.  The boolean StoreCaptures specified whether storing the value
   /// (or part of it) into memory anywhere automatically counts as capturing it
   /// or not. Captures by the provided instruction are considered if the
   /// final parameter is true. An ordered basic block in \p OBB could be used
   /// to speed up capture-tracker queries.
   /// MaxUsesToExplore specifies how many uses should the analysis explore for
   /// one value before giving up due too "too many uses".
   bool PointerMayBeCapturedBefore(const Value *V, bool ReturnCaptures,
                                   bool StoreCaptures, const Instruction *I,
-                                  const DominatorTree *DT, bool IncludeI = false,
+                                  const DominatorTree *DT, const TargetLibraryInfo *TLI,
+                                  bool IncludeI = false,
                                   OrderedBasicBlock *OBB = nullptr,
                                   unsigned MaxUsesToExplore = DefaultMaxUsesToExplore);
 
   /// This callback is used in conjunction with PointerMayBeCaptured. In
   /// addition to the interface here, you'll need to provide your own getters
   /// to see whether anything was captured.
   struct CaptureTracker {
     virtual ~CaptureTracker();
namespace llvm {
   };
 
   /// PointerMayBeCaptured - Visit the value and the values derived from it and
   /// find values which appear to be capturing the pointer value. This feeds
   /// results into and is controlled by the CaptureTracker object.
   /// MaxUsesToExplore specifies how many uses should the analysis explore for
   /// one value before giving up due too "too many uses".
   void PointerMayBeCaptured(const Value *V, CaptureTracker *Tracker,
+                            const TargetLibraryInfo *TLI,
                             unsigned MaxUsesToExplore = DefaultMaxUsesToExplore);
 } // end namespace llvm
 
 #endif

include/llvm/Analysis/ValueTracking.h

return GetPointerBaseWithConstantOffset(const_cast<Value *>(Ptr), Offset,
                                             DL);
   }
 
   /// Returns true if the GEP is based on a pointer to a string (array of
   // \p CharSize integers) and is indexing into this string.
   bool isGEPBasedOnPointerToString(const GEPOperator *GEP,
                                    unsigned CharSize = 8);
 
+  /// Returns true if it is guaranteed that V is not based on a pointer casted
+  // from an integer.
+  bool isGuaranteedToBeLogicalPointer(Value *V, const DataLayout &DL,
+                                      LoopInfo *LI,
+                                      const TargetLibraryInfo *TLI,
+                                      unsigned MaxLookup);
+
   /// Represents offset+length into a ConstantDataArray.
   struct ConstantDataArraySlice {
     /// ConstantDataArray pointer. nullptr indicates a zeroinitializer (a valid
     /// initializer, it just doesn't fit the ConstantDataArray interface).
     const ConstantDataArray *Array;
 
     /// Slice starts at this Offset.
     uint64_t Offset;

include/llvm/Transforms/Utils/Cloning.h

 /// instructions in the caller that need to remain stable.
 ///
 /// If ForwardVarArgsTo is passed, inlining a function with varargs is allowed
 /// and all varargs at the callsite will be passed to any calls to
 /// ForwardVarArgsTo. The caller of InlineFunction has to make sure any varargs
 /// are only used by ForwardVarArgsTo.
 InlineResult InlineFunction(CallInst *C, InlineFunctionInfo &IFI,
                             AAResults *CalleeAAR = nullptr,
-                            bool InsertLifetime = true);
+                            bool InsertLifetime = true,
+                            const TargetLibraryInfo *TLI = nullptr);
 InlineResult InlineFunction(InvokeInst *II, InlineFunctionInfo &IFI,
                             AAResults *CalleeAAR = nullptr,
-                            bool InsertLifetime = true);
+                            bool InsertLifetime = true,
+                            const TargetLibraryInfo *TLI = nullptr);
 InlineResult InlineFunction(CallSite CS, InlineFunctionInfo &IFI,
                             AAResults *CalleeAAR = nullptr,
                             bool InsertLifetime = true,
-                            Function *ForwardVarArgsTo = nullptr);
+                            Function *ForwardVarArgsTo = nullptr,
+                            const TargetLibraryInfo *TLI = nullptr);
 
 /// Clones a loop \p OrigLoop.  Returns the loop and the blocks in \p
 /// Blocks.
 ///
 /// Updates LoopInfo and DominatorTree assuming the loop is dominated by block
 /// \p LoopDomBB.  Insert the new blocks before block specified in \p Before.
 /// Note: Only innermost loops are supported.
 Loop *cloneLoopWithPreheader(BasicBlock *Before, BasicBlock *LoopDomBB,

lib/Analysis/AliasAnalysis.cpp

if (!isIdentifiedObject(Object) || isa<GlobalValue>(Object) ||
       isa<Constant>(Object))
     return ModRefInfo::ModRef;
 
   const auto *Call = dyn_cast<CallBase>(I);
   if (!Call || Call == Object)
     return ModRefInfo::ModRef;
 
   if (PointerMayBeCapturedBefore(Object, /* ReturnCaptures */ true,
-                                 /* StoreCaptures */ true, I, DT,
+                                 /* StoreCaptures */ true, I, DT, &TLI,
                                  /* include Object */ true,
                                  /* OrderedBasicBlock */ OBB))
     return ModRefInfo::ModRef;
 
   unsigned ArgNo = 0;
   ModRefInfo R = ModRefInfo::NoModRef;
   bool IsMustAlias = true;
   // Set flag only if no May found and all operands processed.

lib/Analysis/BasicAliasAnalysis.cpp

 }
 
 //===----------------------------------------------------------------------===//
 // Useful predicates
 //===----------------------------------------------------------------------===//
 
 /// Returns true if the pointer is to a function-local object that never
 /// escapes from the function.
-static bool isNonEscapingLocalObject(const Value *V) {
+static bool isNonEscapingLocalObject(const Value *V,
+                                     const TargetLibraryInfo *TLI) {
   // If this is a local allocation, check to see if it escapes.
   if (isa<AllocaInst>(V) || isNoAliasCall(V))
     // Set StoreCaptures to True so that we can assume in our callers that the
     // pointer is not the result of a load instruction. Currently
     // PointerMayBeCaptured doesn't have any special analysis for the
     // StoreCaptures=false case; if it did, our callers could be refined to be
     // more precise.
-    return !PointerMayBeCaptured(V, false, /*StoreCaptures=*/true);
+    return !PointerMayBeCaptured(V, false, /*StoreCaptures=*/true, TLI);
 
   // If this is an argument that corresponds to a byval or noalias argument,
   // then it has not escaped before entering the function.  Check if it escapes
   // inside the function.
   if (const Argument *A = dyn_cast<Argument>(V))
     if (A->hasByValAttr() || A->hasNoAliasAttr())
       // Note even if the argument is marked nocapture, we still need to check
       // for copies made inside the function. The nocapture attribute only
       // specifies that there are no copies made that outlive the function.
-      return !PointerMayBeCaptured(V, false, /*StoreCaptures=*/true);
+      return !PointerMayBeCaptured(V, false, /*StoreCaptures=*/true, TLI);
 
   return false;
 }
 
 /// Returns true if the pointer is one which would have been considered an
 /// escape by isNonEscapingLocalObject.
 static bool isEscapeSource(const Value *V) {
   if (isa<CallBase>(V))
ModRefInfo BasicAAResult::getModRefInfo(const CallBase *Call,
   if (auto *AI = dyn_cast<AllocaInst>(Object))
     if (!AI->isStaticAlloca() && isIntrinsicCall(Call, Intrinsic::stackrestore))
       return ModRefInfo::Mod;
 
   // If the pointer is to a locally allocated object that does not escape,
   // then the call can not mod/ref the pointer unless the call takes the pointer
   // as an argument, and itself doesn't capture it.
   if (!isa<Constant>(Object) && Call != Object &&
-      isNonEscapingLocalObject(Object)) {
+      isNonEscapingLocalObject(Object, &TLI)) {
 
     // Optimistically assume that call doesn't touch Object and check this
     // assumption in the following loop.
     ModRefInfo Result = ModRefInfo::NoModRef;
     bool IsMustAlias = true;
 
     unsigned OperandNo = 0;
     for (auto CI = Call->data_operands_begin(), CE = Call->data_operands_end();
if (O1 != O2) {
     // non-escaping local object within the same function, then we know the
     // object couldn't escape to a point where the call could return it.
     //
     // Note that if the pointers are in different functions, there are a
     // variety of complications. A call with a nocapture argument may still
     // temporary store the nocapture argument's value in a temporary memory
     // location if that memory location doesn't escape. Or it may pass a
     // nocapture value to other functions as long as they don't capture it.
-    if (isEscapeSource(O1) && isNonEscapingLocalObject(O2))
+    if (isEscapeSource(O1) && isNonEscapingLocalObject(O2, &TLI))
       return NoAlias;
-    if (isEscapeSource(O2) && isNonEscapingLocalObject(O1))
+    if (isEscapeSource(O2) && isNonEscapingLocalObject(O1, &TLI))
       return NoAlias;
   }
 
   // If the size of one access is larger than the entire object on the other
   // side, then we know such behavior is undefined and can assume no alias.
   bool NullIsValidLocation = NullPointerIsDefined(&F);
   if ((V1Size.isPrecise() && isObjectSmallerThan(O2, V1Size.getValue(), DL, TLI,
                                                  NullIsValidLocation)) ||

lib/Analysis/CaptureTracking.cpp

 /// by the enclosing function (which is required to exist).  This routine can
 /// be expensive, so consider caching the results.  The boolean ReturnCaptures
 /// specifies whether returning the value (or part of it) from the function
 /// counts as capturing it or not.  The boolean StoreCaptures specified whether
 /// storing the value (or part of it) into memory anywhere automatically
 /// counts as capturing it or not.
 bool llvm::PointerMayBeCaptured(const Value *V,
                                 bool ReturnCaptures, bool StoreCaptures,
+                                const TargetLibraryInfo *TLI,
                                 unsigned MaxUsesToExplore) {
   assert(!isa<GlobalValue>(V) &&
          "It doesn't make sense to ask whether a global is captured.");
 
   // TODO: If StoreCaptures is not true, we could do Fancy analysis
   // to determine whether this store is not actually an escape point.
   // In that case, BasicAliasAnalysis should be updated as well to
   // take advantage of this.
   (void)StoreCaptures;
 
   SimpleCaptureTracker SCT(ReturnCaptures);
-  PointerMayBeCaptured(V, &SCT, MaxUsesToExplore);
+  PointerMayBeCaptured(V, &SCT, TLI, MaxUsesToExplore);
   return SCT.Captured;
 }
 
 /// PointerMayBeCapturedBefore - Return true if this pointer value may be
 /// captured by the enclosing function (which is required to exist). If a
 /// DominatorTree is provided, only captures which happen before the given
 /// instruction are considered. This routine can be expensive, so consider
 /// caching the results.  The boolean ReturnCaptures specifies whether
 /// returning the value (or part of it) from the function counts as capturing
 /// it or not.  The boolean StoreCaptures specified whether storing the value
 /// (or part of it) into memory anywhere automatically counts as capturing it
 /// or not. A ordered basic block \p OBB can be used in order to speed up
 /// queries about relative order among instructions in the same basic block.
 bool llvm::PointerMayBeCapturedBefore(const Value *V, bool ReturnCaptures,
                                       bool StoreCaptures, const Instruction *I,
-                                      const DominatorTree *DT, bool IncludeI,
-                                      OrderedBasicBlock *OBB,
+                                      const DominatorTree *DT,
+                                      const TargetLibraryInfo *TLI,
+                                      bool IncludeI, OrderedBasicBlock *OBB,
                                       unsigned MaxUsesToExplore) {
   assert(!isa<GlobalValue>(V) &&
          "It doesn't make sense to ask whether a global is captured.");
   bool UseNewOBB = OBB == nullptr;
 
   if (!DT)
-    return PointerMayBeCaptured(V, ReturnCaptures, StoreCaptures,
+    return PointerMayBeCaptured(V, ReturnCaptures, StoreCaptures, TLI,
                                 MaxUsesToExplore);
   if (UseNewOBB)
     OBB = new OrderedBasicBlock(I->getParent());
 
   // TODO: See comment in PointerMayBeCaptured regarding what could be done
   // with StoreCaptures.
 
   CapturesBefore CB(ReturnCaptures, I, DT, IncludeI, OBB);
-  PointerMayBeCaptured(V, &CB, MaxUsesToExplore);
+  PointerMayBeCaptured(V, &CB, TLI, MaxUsesToExplore);
 
   if (UseNewOBB)
     delete OBB;
   return CB.Captured;
 }
 
 void llvm::PointerMayBeCaptured(const Value *V, CaptureTracker *Tracker,
+                                const TargetLibraryInfo *TLI,
                                 unsigned MaxUsesToExplore) {
   assert(V->getType()->isPointerTy() && "Capture is for pointers only!");
   SmallVector<const Use *, DefaultMaxUsesToExplore> Worklist;
   SmallSet<const Use *, DefaultMaxUsesToExplore> Visited;
 
   auto AddUses = [&](const Value *V) {
     unsigned Count = 0;
     for (const Use &U : V->uses()) {
       // If there are lots of uses, conservatively say that the value
       // is captured to avoid taking too much compile time.
       if (Count++ >= MaxUsesToExplore)
         return Tracker->tooManyUses();
       if (!Visited.insert(&U).second)
         continue;
       if (!Tracker->shouldExplore(&U))
         continue;
       Worklist.push_back(&U);
     }
   };
   AddUses(V);
 
   while (!Worklist.empty()) {
     const Use *U = Worklist.pop_back_val();
     Instruction *I = cast<Instruction>(U->getUser());
+    const DataLayout &DL = I->getModule()->getDataLayout();
     V = U->get();
 
     switch (I->getOpcode()) {
     case Instruction::Call:
     case Instruction::Invoke: {
       auto *Call = cast<CallBase>(I);
       // Not captured if the callee is readonly, doesn't return a copy through
       // its return value and doesn't unwind (a readonly function can leak bits
case Instruction::Invoke: {
 
       // Volatile operations effectively capture the memory location that they
       // load and store to.
       if (auto *MI = dyn_cast<MemIntrinsic>(Call))
         if (MI->isVolatile())
           if (Tracker->captured(U))
             return;
 
+      // psub intrinsics on logical pointer does not capture address. :)
+      if (auto *II = dyn_cast<IntrinsicInst>(I)) {
+        if (II->getIntrinsicID() == Intrinsic::psub) {
+          Value *AddrToCheck = nullptr;
+          if (II->getArgOperand(0) == V)
+            AddrToCheck = II->getArgOperand(1);
+          else if (II->getArgOperand(1) == V)
+            AddrToCheck = II->getArgOperand(0);
+          else
+            llvm_unreachable("at least one of argument should be Addr");
+          unsigned Depth = 6;
+          if (isGuaranteedToBeLogicalPointer(AddrToCheck, DL, nullptr,
+                                             TLI, Depth))
+            break;
+        }
+      }
       // Not captured if only passed via 'nocapture' arguments.  Note that
       // calling a function pointer does not in itself cause the pointer to
       // be captured.  This is a subtle point considering that (for example)
       // the callee might return its own address.  It is analogous to saying
       // that loading a value from a pointer does not cause the pointer to be
       // captured, even though the loaded value might be the pointer itself
       // (think of self-referential objects).
       for (auto IdxOpPair : enumerate(Call->data_ops())) {

lib/Analysis/InstructionSimplify.cpp

if (Pred == CmpInst::ICMP_EQ || Pred == CmpInst::ICMP_NE) {
     if (isAllocLikeFn(LHS, TLI) &&
         llvm::isKnownNonZero(RHS, DL, 0, nullptr, CxtI, DT))
       MI = LHS;
     else if (isAllocLikeFn(RHS, TLI) &&
              llvm::isKnownNonZero(LHS, DL, 0, nullptr, CxtI, DT))
       MI = RHS;
     // FIXME: We should also fold the compare when the pointer escapes, but the
     // compare dominates the pointer escape
-    if (MI && !PointerMayBeCaptured(MI, true, true))
+    if (MI && !PointerMayBeCaptured(MI, true, true, TLI))
       return ConstantInt::get(GetCompareTy(LHS),
                               CmpInst::isFalseWhenEqual(Pred));
   }
 
   // Otherwise, fail.
   return nullptr;
 }
 

lib/Analysis/ValueTracking.cpp

 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/iterator_range.h"
 #include "llvm/Analysis/AliasAnalysis.h"
 #include "llvm/Analysis/AssumptionCache.h"
 #include "llvm/Analysis/GuardUtils.h"
 #include "llvm/Analysis/InstructionSimplify.h"
 #include "llvm/Analysis/Loads.h"
 #include "llvm/Analysis/LoopInfo.h"
+#include "llvm/Analysis/MemoryBuiltins.h"
 #include "llvm/Analysis/OptimizationRemarkEmitter.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/IR/Argument.h"
 #include "llvm/IR/Attributes.h"
 #include "llvm/IR/BasicBlock.h"
 #include "llvm/IR/CallSite.h"
 #include "llvm/IR/Constant.h"
 #include "llvm/IR/ConstantRange.h"
for (gep_type_iterator GTI = gep_type_begin(GEP), GTE = gep_type_end(GEP);
 
     if (isKnownNonZero(GTI.getOperand(), Depth, Q))
       return true;
   }
 
   return false;
 }
 
+bool llvm::isGuaranteedToBeLogicalPointer(Value *V, const DataLayout &DL, LoopInfo *LI,
+                            const TargetLibraryInfo *TLI, unsigned MaxLookup) {
+  SmallVector<Value *, 4> Objects;
+  GetUnderlyingObjects(V, Objects, DL, LI, MaxLookup);
+  if (Objects.begin() == Objects.end())
+    return false;
+
+  for (auto itr = Objects.begin(); itr != Objects.end(); itr++) {
+    Value *V = *itr;
+    if (isa<AllocaInst>(V))
+      continue;
+    if (isa<GlobalObject>(V))
+      continue;
+    if (TLI && isAllocationFn(V, TLI, true))
+      continue;
+    return false;
+  }
+  return true;
+}
+
 static bool isKnownNonNullFromDominatingCondition(const Value *V,
                                                   const Instruction *CtxI,
                                                   const DominatorTree *DT) {
   assert(V->getType()->isPointerTy() && "V must be pointer type");
   assert(!isa<ConstantData>(V) && "Did not expect ConstantPointerNull");
 
   if (!CtxI || !DT)
     return false;

lib/Target/AMDGPU/AMDGPUPromoteAlloca.cpp

if (ICmpInst *ICmp = dyn_cast<ICmpInst>(UseInst)) {
         return false;
 
       // May need to rewrite constant operands.
       WorkList.push_back(ICmp);
     }
 
     if (UseInst->getOpcode() == Instruction::AddrSpaceCast) {
       // Give up if the pointer may be captured.
-      if (PointerMayBeCaptured(UseInst, true, true))
+      if (PointerMayBeCaptured(UseInst, true, true, nullptr))
         return false;
       // Don't collect the users of this.
       WorkList.push_back(User);
       continue;
     }
 
     if (!User->getType()->isPointerTy())
       continue;

lib/Transforms/IPO/FunctionAttrs.cpp

for (Instruction &I : Entry) {
     if (!isGuaranteedToTransferExecutionToSuccessor(&I))
       break;
   }
 
   return Changed;
 }
 
 /// Deduce nocapture attributes for the SCC.
-static bool addArgumentAttrs(const SCCNodeSet &SCCNodes) {
+static bool addArgumentAttrs(const SCCNodeSet &SCCNodes,
+                             const TargetLibraryInfo *TLI) {
   bool Changed = false;
 
   ArgumentGraph AG;
 
   // Check each function in turn, determining which pointer arguments are not
   // captured.
   for (Function *F : SCCNodes) {
     // We can infer and propagate function attributes only when we know that the
for (Function *F : SCCNodes) {
 
     for (Function::arg_iterator A = F->arg_begin(), E = F->arg_end(); A != E;
          ++A) {
       if (!A->getType()->isPointerTy())
         continue;
       bool HasNonLocalUses = false;
       if (!A->hasNoCaptureAttr()) {
         ArgumentUsesTracker Tracker(SCCNodes);
-        PointerMayBeCaptured(&*A, &Tracker);
+        PointerMayBeCaptured(&*A, &Tracker, TLI);
         if (!Tracker.Captured) {
           if (Tracker.Uses.empty()) {
             // If it's trivially not captured, mark it nocapture now.
             A->addAttr(Attribute::NoCapture);
             ++NumNoCapture;
             Changed = true;
           } else {
             // If it's not trivially captured and not trivially not captured,
static bool addArgumentAttrs(const SCCNodeSet &SCCNodes,
 
   return Changed;
 }
 
 /// Tests whether a function is "malloc-like".
 ///
 /// A function is "malloc-like" if it returns either null or a pointer that
 /// doesn't alias any other pointer visible to the caller.
-static bool isFunctionMallocLike(Function *F, const SCCNodeSet &SCCNodes) {
+static bool isFunctionMallocLike(Function *F, const SCCNodeSet &SCCNodes,
+                                 const TargetLibraryInfo *TLI) {
   SmallSetVector<Value *, 8> FlowsToReturn;
   for (BasicBlock &BB : *F)
     if (ReturnInst *Ret = dyn_cast<ReturnInst>(BB.getTerminator()))
       FlowsToReturn.insert(Ret->getReturnValue());
 
   for (unsigned i = 0; i != FlowsToReturn.size(); ++i) {
     Value *RetVal = FlowsToReturn[i];
 
if (Instruction *RVI = dyn_cast<Instruction>(RetVal))
         if (CS.getCalledFunction() && SCCNodes.count(CS.getCalledFunction()))
           break;
         LLVM_FALLTHROUGH;
       }
       default:
         return false; // Did not come from an allocation.
       }
 
-    if (PointerMayBeCaptured(RetVal, false, /*StoreCaptures=*/false))
+    if (PointerMayBeCaptured(RetVal, false, /*StoreCaptures=*/false, TLI))
       return false;
   }
 
   return true;
 }
 
 /// Deduce noalias attributes for the SCC.
-static bool addNoAliasAttrs(const SCCNodeSet &SCCNodes) {
+static bool addNoAliasAttrs(const SCCNodeSet &SCCNodes,
+                            const TargetLibraryInfo *TLI) {
   // Check each function in turn, determining which functions return noalias
   // pointers.
   for (Function *F : SCCNodes) {
     // Already noalias.
     if (F->returnDoesNotAlias())
       continue;
 
     // We can infer and propagate function attributes only when we know that the
     // definition we'll get at link time is *exactly* the definition we see now.
     // For more details, see GlobalValue::mayBeDerefined.
     if (!F->hasExactDefinition())
       return false;
 
     // We annotate noalias return values, which are only applicable to
     // pointer types.
     if (!F->getReturnType()->isPointerTy())
       continue;
 
-    if (!isFunctionMallocLike(F, SCCNodes))
+    if (!isFunctionMallocLike(F, SCCNodes, TLI))
       return false;
   }
 
   bool MadeChange = false;
   for (Function *F : SCCNodes) {
     if (F->returnDoesNotAlias() ||
         !F->getReturnType()->isPointerTy())
       continue;
static bool addNoRecurseAttrs(const SCCNodeSet &SCCNodes) {
   // Every call was to a non-recursive function other than this function, and
   // we have no indirect recursion as the SCC size is one. This function cannot
   // recurse.
   return setDoesNotRecurse(*F);
 }
 
 template <typename AARGetterT>
 static bool deriveAttrsInPostOrder(SCCNodeSet &SCCNodes, AARGetterT &&AARGetter,
-                                   bool HasUnknownCall) {
+                                   bool HasUnknownCall,
+                                   const TargetLibraryInfo *TLI) {
   bool Changed = false;
 
   // Bail if the SCC only contains optnone functions.
   if (SCCNodes.empty())
     return Changed;
 
   Changed |= addArgumentReturnedAttrs(SCCNodes);
   Changed |= addReadAttrs(SCCNodes, AARGetter);
-  Changed |= addArgumentAttrs(SCCNodes);
+  Changed |= addArgumentAttrs(SCCNodes, TLI);
 
   // If we have no external nodes participating in the SCC, we can deduce some
   // more precise attributes as well.
   if (!HasUnknownCall) {
-    Changed |= addNoAliasAttrs(SCCNodes);
+    Changed |= addNoAliasAttrs(SCCNodes, TLI);
     Changed |= addNonNullAttrs(SCCNodes);
     Changed |= inferAttrsFromFunctionBodies(SCCNodes);
     Changed |= addNoRecurseAttrs(SCCNodes);
   }
 
   return Changed;
 }
 
 PreservedAnalyses PostOrderFunctionAttrsPass::run(LazyCallGraph::SCC &C,
                                                   CGSCCAnalysisManager &AM,
                                                   LazyCallGraph &CG,
                                                   CGSCCUpdateResult &) {
   FunctionAnalysisManager &FAM =
       AM.getResult<FunctionAnalysisManagerCGSCCProxy>(C, CG).getManager();
-
   // We pass a lambda into functions to wire them up to the analysis manager
   // for getting function analyses.
   auto AARGetter = [&](Function &F) -> AAResults & {
     return FAM.getResult<AAManager>(F);
   };
+  TargetLibraryInfo *TLI = nullptr;
 
   // Fill SCCNodes with the elements of the SCC. Also track whether there are
   // any external or opt-none nodes that will prevent us from optimizing any
   // part of the SCC.
   SCCNodeSet SCCNodes;
   bool HasUnknownCall = false;
   for (LazyCallGraph::Node &N : C) {
     Function &F = N.getFunction();
if (!HasUnknownCall)
       for (Instruction &I : instructions(F))
         if (auto CS = CallSite(&I))
           if (!CS.getCalledFunction()) {
             HasUnknownCall = true;
             break;
           }
 
     SCCNodes.insert(&F);
+    if (!TLI)
+      TLI = &FAM.getResult<TargetLibraryAnalysis>(F);
   }
 
-  if (deriveAttrsInPostOrder(SCCNodes, AARGetter, HasUnknownCall))
+  if (deriveAttrsInPostOrder(SCCNodes, AARGetter, HasUnknownCall, TLI))
     return PreservedAnalyses::none();
 
   return PreservedAnalyses::all();
 }
 
 namespace {
 
 struct PostOrderFunctionAttrsLegacyPass : public CallGraphSCCPass {
   // Pass identification, replacement for typeid
   static char ID;
 
   PostOrderFunctionAttrsLegacyPass() : CallGraphSCCPass(ID) {
     initializePostOrderFunctionAttrsLegacyPassPass(
         *PassRegistry::getPassRegistry());
   }
 
   bool runOnSCC(CallGraphSCC &SCC) override;
 
   void getAnalysisUsage(AnalysisUsage &AU) const override {
     AU.setPreservesCFG();
     AU.addRequired<AssumptionCacheTracker>();
+    AU.addRequired<TargetLibraryInfoWrapperPass>();
     getAAResultsAnalysisUsage(AU);
     CallGraphSCCPass::getAnalysisUsage(AU);
   }
 };
 
 } // end anonymous namespace
 
 char PostOrderFunctionAttrsLegacyPass::ID = 0;
 INITIALIZE_PASS_BEGIN(PostOrderFunctionAttrsLegacyPass, "functionattrs",
                       "Deduce function attributes", false, false)
 INITIALIZE_PASS_DEPENDENCY(AssumptionCacheTracker)
+INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
 INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
 INITIALIZE_PASS_END(PostOrderFunctionAttrsLegacyPass, "functionattrs",
                     "Deduce function attributes", false, false)
 
 Pass *llvm::createPostOrderFunctionAttrsLegacyPass() {
   return new PostOrderFunctionAttrsLegacyPass();
 }
 
 template <typename AARGetterT>
-static bool runImpl(CallGraphSCC &SCC, AARGetterT AARGetter) {
+static bool runImpl(CallGraphSCC &SCC, AARGetterT AARGetter,
+                    const TargetLibraryInfo *TLI) {
 
   // Fill SCCNodes with the elements of the SCC. Used for quickly looking up
   // whether a given CallGraphNode is in this SCC. Also track whether there are
   // any external or opt-none nodes that will prevent us from optimizing any
   // part of the SCC.
   SCCNodeSet SCCNodes;
   bool ExternalNode = false;
   for (CallGraphNode *I : SCC) {
     Function *F = I->getFunction();
     if (!F || F->hasFnAttribute(Attribute::OptimizeNone) ||
         F->hasFnAttribute(Attribute::Naked)) {
       // External node or function we're trying not to optimize - we both avoid
       // transform them and avoid leveraging information they provide.
       ExternalNode = true;
       continue;
     }
 
     SCCNodes.insert(F);
   }
 
-  return deriveAttrsInPostOrder(SCCNodes, AARGetter, ExternalNode);
+  return deriveAttrsInPostOrder(SCCNodes, AARGetter, ExternalNode, TLI);
 }
 
 bool PostOrderFunctionAttrsLegacyPass::runOnSCC(CallGraphSCC &SCC) {
   if (skipSCC(SCC))
     return false;
-  return runImpl(SCC, LegacyAARGetter(*this));
+
+  auto &TLI = getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
+
+  return runImpl(SCC, LegacyAARGetter(*this), &TLI);
 }
 
 namespace {
 
 struct ReversePostOrderFunctionAttrsLegacyPass : public ModulePass {
   // Pass identification, replacement for typeid
   static char ID;
 

lib/Transforms/IPO/Inliner.cpp

 /// InlinedArrayAllocas map keeps track of any allocas that are already
 /// available from other functions inlined into the caller.  If we are able to
 /// inline this call site we attempt to reuse already available allocas or add
 /// any new allocas to the set if not possible.
 static InlineResult InlineCallIfPossible(
     CallSite CS, InlineFunctionInfo &IFI,
     InlinedArrayAllocasTy &InlinedArrayAllocas, int InlineHistory,
     bool InsertLifetime, function_ref<AAResults &(Function &)> &AARGetter,
-    ImportedFunctionsInliningStatistics &ImportedFunctionsStats) {
+    ImportedFunctionsInliningStatistics &ImportedFunctionsStats,
+    const TargetLibraryInfo *TLI) {
   Function *Callee = CS.getCalledFunction();
   Function *Caller = CS.getCaller();
 
   AAResults &AAR = AARGetter(*Callee);
 
   // Try to inline the function.  Get the list of static allocas that were
   // inlined.
-  InlineResult IR = InlineFunction(CS, IFI, &AAR, InsertLifetime);
+  InlineResult IR = InlineFunction(CS, IFI, &AAR, InsertLifetime, nullptr, TLI);
   if (!IR)
     return IR;
 
   if (InlinerFunctionImportStats != InlinerFunctionImportStatsOpts::No)
     ImportedFunctionsStats.recordInline(*Caller, *Callee);
 
   AttributeFuncs::mergeAttributesForInlining(*Caller, *Callee);
 
for (unsigned CSi = 0; CSi != CallSites.size(); ++CSi) {
         DebugLoc DLoc = CS->getDebugLoc();
         BasicBlock *Block = CS.getParent();
 
         // Attempt to inline the function.
         using namespace ore;
 
         InlineResult IR = InlineCallIfPossible(
             CS, InlineInfo, InlinedArrayAllocas, InlineHistoryID,
-            InsertLifetime, AARGetter, ImportedFunctionsStats);
+            InsertLifetime, AARGetter, ImportedFunctionsStats, &TLI);
         if (!IR) {
           setInlineRemark(CS, std::string(IR) + "; " + inlineCostStr(*OIC));
           ORE.emit([&]() {
             return OptimizationRemarkMissed(DEBUG_TYPE, "NotInlined", DLoc,
                                             Block)
                    << NV("Callee", Callee) << " will not be inlined into "
                    << NV("Caller", Caller) << ": " << NV("Reason", IR.message);
           });

lib/Transforms/IPO/PartialInlining.cpp

 };
 
 struct PartialInlinerImpl {
 
   PartialInlinerImpl(
       std::function<AssumptionCache &(Function &)> *GetAC,
       std::function<TargetTransformInfo &(Function &)> *GTTI,
       Optional<function_ref<BlockFrequencyInfo &(Function &)>> GBFI,
-      ProfileSummaryInfo *ProfSI)
-      : GetAssumptionCache(GetAC), GetTTI(GTTI), GetBFI(GBFI), PSI(ProfSI) {}
+      ProfileSummaryInfo *ProfSI, const TargetLibraryInfo *TLI)
+      : GetAssumptionCache(GetAC), GetTTI(GTTI), GetBFI(GBFI), PSI(ProfSI),
+        TLI(TLI) {}
 
   bool run(Module &M);
   // Main part of the transformation that calls helper functions to find
   // outlining candidates, clone & outline the function, and attempt to
   // partially inline the resulting function. Returns true if
   // inlining was successful, false otherwise.  Also returns the outline
   // function (only if we partially inlined early returns) as there is a
   // possibility to further "peel" early return statements that were left in the
struct PartialInlinerImpl {
   };
 
 private:
   int NumPartialInlining = 0;
   std::function<AssumptionCache &(Function &)> *GetAssumptionCache;
   std::function<TargetTransformInfo &(Function &)> *GetTTI;
   Optional<function_ref<BlockFrequencyInfo &(Function &)>> GetBFI;
   ProfileSummaryInfo *PSI;
+  const TargetLibraryInfo *TLI;
 
   // Return the frequency of the OutlininingBB relative to F's entry point.
   // The result is no larger than 1 and is represented using BP.
   // (Note that the outlined region's 'head' block can only have incoming
   // edges from the guarding entry blocks).
   BranchProbability getOutliningCallBBRelativeFreq(FunctionCloner &Cloner);
 
   // Return true if the callee of CS should be partially inlined with
struct PartialInlinerLegacyPass : public ModulePass {
   PartialInlinerLegacyPass() : ModulePass(ID) {
     initializePartialInlinerLegacyPassPass(*PassRegistry::getPassRegistry());
   }
 
   void getAnalysisUsage(AnalysisUsage &AU) const override {
     AU.addRequired<AssumptionCacheTracker>();
     AU.addRequired<ProfileSummaryInfoWrapperPass>();
     AU.addRequired<TargetTransformInfoWrapperPass>();
+    AU.addRequired<TargetLibraryInfoWrapperPass>();
   }
 
   bool runOnModule(Module &M) override {
     if (skipModule(M))
       return false;
 
     AssumptionCacheTracker *ACT = &getAnalysis<AssumptionCacheTracker>();
     TargetTransformInfoWrapperPass *TTIWP =
         &getAnalysis<TargetTransformInfoWrapperPass>();
     ProfileSummaryInfo *PSI =
         &getAnalysis<ProfileSummaryInfoWrapperPass>().getPSI();
+    auto &TLI = getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
     std::function<AssumptionCache &(Function &)> GetAssumptionCache =
         [&ACT](Function &F) -> AssumptionCache & {
       return ACT->getAssumptionCache(F);
     };
 
     std::function<TargetTransformInfo &(Function &)> GetTTI =
         [&TTIWP](Function &F) -> TargetTransformInfo & {
       return TTIWP->getTTI(F);
     };
 
-    return PartialInlinerImpl(&GetAssumptionCache, &GetTTI, NoneType::None, PSI)
+    return PartialInlinerImpl(&GetAssumptionCache, &GetTTI, NoneType::None, PSI, &TLI)
         .run(M);
   }
 };
 
 } // end anonymous namespace
 
 std::unique_ptr<FunctionOutliningMultiRegionInfo>
 PartialInlinerImpl::computeOutliningColdRegionsInfo(Function *F,
for (User *User : Users) {
     OR << ore::NV("Callee", Cloner.OrigFunc) << " partially inlined into "
        << ore::NV("Caller", CS.getCaller());
 
     InlineFunctionInfo IFI(nullptr, GetAssumptionCache, PSI);
     // We can only forward varargs when we outlined a single region, else we
     // bail on vararg functions.
     if (!InlineFunction(CS, IFI, nullptr, true,
                         (Cloner.ClonedOI ? Cloner.OutlinedFunctions.back().first
-                                         : nullptr)))
+                                         : nullptr), TLI))
       continue;
 
     CallerORE.emit(OR);
 
     // Now update the entry count:
     if (CalleeEntryCountV && CallSiteToProfCountMap.count(User)) {
       uint64_t CallSiteCount = CallSiteToProfCountMap[User];
       CalleeEntryCountV -= std::min(CalleeEntryCountV, CallSiteCount);

 
 char PartialInlinerLegacyPass::ID = 0;
 
 INITIALIZE_PASS_BEGIN(PartialInlinerLegacyPass, "partial-inliner",
                       "Partial Inliner", false, false)
 INITIALIZE_PASS_DEPENDENCY(AssumptionCacheTracker)
 INITIALIZE_PASS_DEPENDENCY(ProfileSummaryInfoWrapperPass)
 INITIALIZE_PASS_DEPENDENCY(TargetTransformInfoWrapperPass)
+INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
 INITIALIZE_PASS_END(PartialInlinerLegacyPass, "partial-inliner",
                     "Partial Inliner", false, false)
 
 ModulePass *llvm::createPartialInliningPass() {
   return new PartialInlinerLegacyPass();
 }
 
 PreservedAnalyses PartialInlinerPass::run(Module &M,
PreservedAnalyses PartialInlinerPass::run(Module &M,
 
   std::function<TargetTransformInfo &(Function &)> GetTTI =
       [&FAM](Function &F) -> TargetTransformInfo & {
     return FAM.getResult<TargetIRAnalysis>(F);
   };
 
   ProfileSummaryInfo *PSI = &AM.getResult<ProfileSummaryAnalysis>(M);
 
-  if (PartialInlinerImpl(&GetAssumptionCache, &GetTTI, {GetBFI}, PSI)
+  auto &TLI = AM.getResult<TargetLibraryAnalysis>(M);
+  if (PartialInlinerImpl(&GetAssumptionCache, &GetTTI, {GetBFI}, PSI, &TLI)
           .run(M))
     return PreservedAnalyses::none();
   return PreservedAnalyses::all();
 }

lib/Transforms/Instrumentation/ThreadSanitizer.cpp

 
  private:
   void initializeCallbacks(Module &M);
   bool instrumentLoadOrStore(Instruction *I, const DataLayout &DL);
   bool instrumentAtomic(Instruction *I, const DataLayout &DL);
   bool instrumentMemIntrinsic(Instruction *I);
   void chooseInstructionsToInstrument(SmallVectorImpl<Instruction *> &Local,
                                       SmallVectorImpl<Instruction *> &All,
-                                      const DataLayout &DL);
+                                      const DataLayout &DL,
+                                      const TargetLibraryInfo *TLI);
   bool addrPointsToConstantData(Value *Addr);
   int getMemoryAccessFuncIndex(Value *Addr, const DataLayout &DL);
   void InsertRuntimeIgnores(Function &F);
 
   Type *IntptrTy;
   IntegerType *OrdTy;
   // Callbacks to run-time library are computed in doInitialization.
   Function *TsanFuncEntry;

 // after the classic compiler optimizations.
 // E.g. two reads from the same temp should be eliminated by CSE,
 // two writes should be eliminated by DSE, etc.
 //
 // 'Local' is a vector of insns within the same BB (no calls between).
 // 'All' is a vector of insns that will be instrumented.
 void ThreadSanitizer::chooseInstructionsToInstrument(
     SmallVectorImpl<Instruction *> &Local, SmallVectorImpl<Instruction *> &All,
-    const DataLayout &DL) {
+    const DataLayout &DL, const TargetLibraryInfo *TLI) {
   SmallPtrSet<Value*, 8> WriteTargets;
   // Iterate from the end.
   for (Instruction *I : reverse(Local)) {
     if (StoreInst *Store = dyn_cast<StoreInst>(I)) {
       Value *Addr = Store->getPointerOperand();
       if (!shouldInstrumentReadWriteFromAddress(I->getModule(), Addr))
         continue;
       WriteTargets.insert(Addr);
if (StoreInst *Store = dyn_cast<StoreInst>(I)) {
         // Addr points to some constant data -- it can not race with any writes.
         continue;
       }
     }
     Value *Addr = isa<StoreInst>(*I)
         ? cast<StoreInst>(I)->getPointerOperand()
         : cast<LoadInst>(I)->getPointerOperand();
     if (isa<AllocaInst>(GetUnderlyingObject(Addr, DL)) &&
-        !PointerMayBeCaptured(Addr, true, true)) {
+        !PointerMayBeCaptured(Addr, true, true, TLI)) {
       // The variable is addressable but not captured, so it cannot be
       // referenced from a different thread and participate in a data race
       // (see llvm/Analysis/CaptureTracking.h for details).
       NumOmittedNonCaptured++;
       continue;
     }
     All.push_back(I);
   }
for (auto &Inst : BB) {
         LocalLoadsAndStores.push_back(&Inst);
       else if (isa<CallInst>(Inst) || isa<InvokeInst>(Inst)) {
         if (CallInst *CI = dyn_cast<CallInst>(&Inst))
           maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI);
         if (isa<MemIntrinsic>(Inst))
           MemIntrinCalls.push_back(&Inst);
         HasCalls = true;
         chooseInstructionsToInstrument(LocalLoadsAndStores, AllLoadsAndStores,
-                                       DL);
+                                       DL, TLI);
       }
     }
-    chooseInstructionsToInstrument(LocalLoadsAndStores, AllLoadsAndStores, DL);
+    chooseInstructionsToInstrument(LocalLoadsAndStores, AllLoadsAndStores,
+                                   DL, TLI);
   }
 
   // We have collected all loads and stores.
   // FIXME: many of these accesses do not need to be checked for races
   // (e.g. variables that do not escape, etc).
 
   // Instrument memory accesses only if we want to report bugs in the function.
   if (ClInstrumentMemoryAccesses && SanitizeFunction)

lib/Transforms/Scalar/DeadStoreElimination.cpp

static bool handleEndBlock(BasicBlock &BB, AliasAnalysis *AA,
   // Find all of the alloca'd pointers in the entry block.
   BasicBlock &Entry = BB.getParent()->front();
   for (Instruction &I : Entry) {
     if (isa<AllocaInst>(&I))
       DeadStackObjects.insert(&I);
 
     // Okay, so these are dead heap objects, but if the pointer never escapes
     // then it's leaked by this function anyways.
-    else if (isAllocLikeFn(&I, TLI) && !PointerMayBeCaptured(&I, true, true))
+    else if (isAllocLikeFn(&I, TLI) &&
+             !PointerMayBeCaptured(&I, true, true, TLI))
       DeadStackObjects.insert(&I);
   }
 
   // Treat byval or inalloca arguments the same, stores to them are dead at the
   // end of the function.
   for (Argument &AI : BB.getParent()->args())
     if (AI.hasByValOrInAllocaAttr())
       DeadStackObjects.insert(&AI);
while (InstDep.isDef() || InstDep.isClobber()) {
         const Value* Underlying = GetUnderlyingObject(DepLoc.Ptr, DL);
         bool IsStoreDeadOnUnwind = isa<AllocaInst>(Underlying);
         if (!IsStoreDeadOnUnwind) {
             // We're looking for a call to an allocation function
             // where the allocation doesn't escape before the last
             // throwing instruction; PointerMayBeCaptured
             // reasonably fast approximation.
             IsStoreDeadOnUnwind = isAllocLikeFn(Underlying, TLI) &&
-                !PointerMayBeCaptured(Underlying, false, true);
+                !PointerMayBeCaptured(Underlying, false, true, TLI);
         }
         if (!IsStoreDeadOnUnwind)
           break;
       }
 
       // If we find a write that is a) removable (i.e., non-volatile), b) is
       // completely obliterated by the store to 'Loc', and c) which we know that
       // 'Inst' doesn't load from, then we can remove it.

lib/Transforms/Scalar/LICM.cpp

bool isKnownNonEscaping(Value *Object, const TargetLibraryInfo *TLI) {
   // that:
   //   1) Object can't be escaped by this function.  This is what
   //      PointerMayBeCaptured checks.
   //   2) Object can't have been captured at definition site.  For this, we
   //      need to know the return value is noalias.  At the moment, we use a
   //      weaker condition and handle only AllocLikeFunctions (which are
   //      known to be noalias).  TODO
   return isAllocLikeFn(Object, TLI) &&
-    !PointerMayBeCaptured(Object, true, true);
+    !PointerMayBeCaptured(Object, true, true, TLI);
 }
 
 } // namespace
 
 /// Try to promote memory values to scalars by sinking stores out of the
 /// loop and moving loads to before the loop.  We do this by looping over
 /// the stores in the loop, looking for stores to Must pointers which are
 /// loop invariant.
bool llvm::promoteLoopAccessesToScalars(
   // memory model.
   if (!SafeToInsertStore) {
     if (IsKnownThreadLocalObject)
       SafeToInsertStore = true;
     else {
       Value *Object = GetUnderlyingObject(SomePtr, MDL);
       SafeToInsertStore =
           (isAllocLikeFn(Object, TLI) || isa<AllocaInst>(Object)) &&
-          !PointerMayBeCaptured(Object, true, true);
+          !PointerMayBeCaptured(Object, true, true, TLI);
     }
   }
 
   // If we've still failed to prove we can sink the store, give up.
   if (!SafeToInsertStore)
     return false;
 
   // Otherwise, this is safe to promote, lets do it!

lib/Transforms/Scalar/PlaceSafepoints.cpp

InsertSafepointPoll(Instruction *InsertBefore,
   else
     Before--;
 
   After++;
   assert(After != OrigBB->end() && "must have successor");
 
   // Do the actual inlining
   InlineFunctionInfo IFI;
-  bool InlineStatus = InlineFunction(PollCall, IFI);
+  bool InlineStatus = InlineFunction(PollCall, IFI, nullptr, true, &TLI);
   assert(InlineStatus && "inline must succeed");
   (void)InlineStatus; // suppress warning in release-asserts
 
   // Check post-conditions
   assert(IFI.StaticAllocas.empty() && "can't have allocs");
 
   std::vector<CallInst *> Calls; // new calls
   DenseSet<BasicBlock *> BBs;    // new BBs + insertee

lib/Transforms/Utils/InlineFunction.cpp

 
 static cl::opt<bool>
 PreserveAlignmentAssumptions("preserve-alignment-assumptions-during-inlining",
   cl::init(true), cl::Hidden,
   cl::desc("Convert align attributes to assumptions during inlining."));
 
 llvm::InlineResult llvm::InlineFunction(CallInst *CI, InlineFunctionInfo &IFI,
                                         AAResults *CalleeAAR,
-                                        bool InsertLifetime) {
-  return InlineFunction(CallSite(CI), IFI, CalleeAAR, InsertLifetime);
+                                        bool InsertLifetime,
+                                        const TargetLibraryInfo *TLI) {
+  return InlineFunction(CallSite(CI), IFI, CalleeAAR, InsertLifetime, nullptr,
+                        TLI);
 }
 
 llvm::InlineResult llvm::InlineFunction(InvokeInst *II, InlineFunctionInfo &IFI,
                                         AAResults *CalleeAAR,
-                                        bool InsertLifetime) {
-  return InlineFunction(CallSite(II), IFI, CalleeAAR, InsertLifetime);
+                                        bool InsertLifetime,
+                                        const TargetLibraryInfo *TLI) {
+  return InlineFunction(CallSite(II), IFI, CalleeAAR, InsertLifetime, nullptr,
+                        TLI);
 }
 
 namespace {
 
   /// A class for recording information about inlining a landing pad.
   class LandingPadInliningInfo {
     /// Destination of the invoke's unwind.
     BasicBlock *OuterResumeDest;
static void CloneAliasScopeMetadata(CallSite CS, ValueToValueMapTy &VMap) {
   }
 }
 
 /// If the inlined function has noalias arguments,
 /// then add new alias scopes for each noalias argument, tag the mapped noalias
 /// parameters with noalias metadata specifying the new scope, and tag all
 /// non-derived loads, stores and memory intrinsics with the new alias scopes.
 static void AddAliasScopeMetadata(CallSite CS, ValueToValueMapTy &VMap,
-                                  const DataLayout &DL, AAResults *CalleeAAR) {
+                                  const DataLayout &DL, AAResults *CalleeAAR,
+                                  const TargetLibraryInfo *TLI) {
   if (!EnableNoAliasConversion)
     return;
 
   const Function *CalledFunc = CS.getCalledFunction();
   SmallVector<const Argument *, 4> NoAliasArgs;
 
   for (const Argument &Arg : CalledFunc->args())
     if (Arg.hasNoAliasAttr() && !Arg.use_empty())
if (const Instruction *I = dyn_cast<Instruction>(VMI->first)) {
                                  // It might be tempting to skip the
                                  // PointerMayBeCapturedBefore check if
                                  // A->hasNoCaptureAttr() is true, but this is
                                  // incorrect because nocapture only guarantees
                                  // that no copies outlive the function, not
                                  // that the value cannot be locally captured.
                                  !PointerMayBeCapturedBefore(A,
                                    /* ReturnCaptures */ false,
-                                   /* StoreCaptures */ false, I, &DT)))
+                                   /* StoreCaptures */ false, I, &DT, TLI)))
           NoAliases.push_back(NewScopes[A]);
       }
 
       if (!NoAliases.empty())
         NI->setMetadata(LLVMContext::MD_noalias,
                         MDNode::concatenate(
                             NI->getMetadata(LLVMContext::MD_noalias),
                             MDNode::get(CalledFunc->getContext(), NoAliases)));

 ///
 /// Note that this only does one level of inlining.  For example, if the
 /// instruction 'call B' is inlined, and 'B' calls 'C', then the call to 'C' now
 /// exists in the instruction stream.  Similarly this will inline a recursive
 /// function by one level.
 llvm::InlineResult llvm::InlineFunction(CallSite CS, InlineFunctionInfo &IFI,
                                         AAResults *CalleeAAR,
                                         bool InsertLifetime,
-                                        Function *ForwardVarArgsTo) {
+                                        Function *ForwardVarArgsTo,
+                                        const TargetLibraryInfo *TLI) {
   Instruction *TheCall = CS.getInstruction();
   assert(TheCall->getParent() && TheCall->getFunction()
          && "Instruction not in function!");
 
   // If IFI has any state in it, zap it before we fill it in.
   IFI.reset();
 
   Function *CalledFunc = CS.getCalledFunction();
Function::iterator FirstNewBlock;
     // instructions inlined from a function whose DISubprogram is not null.
     fixupLineNumbers(Caller, FirstNewBlock, TheCall,
                      CalledFunc->getSubprogram() != nullptr);
 
     // Clone existing noalias metadata if necessary.
     CloneAliasScopeMetadata(CS, VMap);
 
     // Add noalias metadata if necessary.
-    AddAliasScopeMetadata(CS, VMap, DL, CalleeAAR);
+    AddAliasScopeMetadata(CS, VMap, DL, CalleeAAR, TLI);
 
     // Propagate llvm.mem.parallel_loop_access if necessary.
     PropagateParallelLoopAccessMetadata(CS, VMap);
 
     // Register any cloned assumptions.
     if (IFI.GetAssumptionCache)
       for (BasicBlock &NewBlock :
            make_range(FirstNewBlock->getIterator(), Caller->end()))

lib/Transforms/Utils/SimplifyLibCalls.cpp

if (!InnerCallee)
     return false;
 
   LibFunc Func;
   if (!TLI->getLibFunc(*InnerCallee, Func) || !TLI->has(Func) ||
       Func != LibFunc_fopen)
     return false;
 
   inferLibFuncAttributes(*CI->getCalledFunction(), *TLI);
-  if (PointerMayBeCaptured(File, true, true))
+  if (PointerMayBeCaptured(File, true, true, TLI))
     return false;
 
   return true;
 }
 
 static bool isOnlyUsedInComparisonWithZero(Value *V) {
   for (User *U : V->users()) {
     if (ICmpInst *IC = dyn_cast<ICmpInst>(U))