Variable auto-init: fix __block initialization

[jfb]

Summary

Automatic initialization [1] of __block variables was trampling over the block's headers after they'd been initialized, which caused self-init usage to crash, such as here:

typedef struct XYZ { void (^block)(); } *xyz_t;
__attribute__((noinline))
xyz_t create(void (^block)()) {
  xyz_t myself = malloc(sizeof(struct XYZ));
  myself->block = block;
  return myself;
}
int main() {
  __block xyz_t captured = create(^(){ (void)captured; });
}

This type of code shouldn't be broken by variable auto-init, even if it's sketchy.

[1] With -ftrivial-auto-var-init=pattern

rdar://problem/47798396

[rjmccall]

lib/CodeGen/CGDecl.cpp

1611

Why don't you just initialize the payload right here, after we've drilled down to it?

1646

Does this check handle flexible arrays on zero-sized structures properly? I suppose they're always initialized.

1647

Can't you just drill to the byref storage right here and avoid all the other complexity and subtle ordering interactions?

1667

This is a late comment on the main patch, but there's an ASTContext::getAsVariableArrayType method.

[rjmccall]

lib/CodeGen/CGDecl.cpp

1611

I meant to delete this comment before submitting, sorry. I am suggesting the other place.

[jfb]

lib/CodeGen/CGDecl.cpp

1646

You mean something like

void foo(int size) {
  struct Z {};
  Z arr[size];
}

?

1647

We're in the lambda that does the initialization here. The tricky order part is that code that calls the lambda does:

• Block (which was missing the early auto-init)
• Trivial initializer (which has auto-init, then early exit)
• Constant aggregate / constexpr (which might auto-init if it wasn't constant, and then early-exit)
• The other stuff

I don't think here is the right place to do anything... and I'm not sure what you're suggesting.

1667

OK I can do in a separate follow-up.

[rjmccall]

lib/CodeGen/CGDecl.cpp

1647

Escaping __block variables are basically a fixed-layout header followed by storage of the variable's formal type. Anything you do at this point in the function to auto-initialize the header is a waste of time and code size because it is precisely at this point in the function that we perform a bunch of stores to initialize that header. You are mitigating nothing by covering the header. So what I'm saying is that, in this lambda which is meant to initialize the user-exposed storage of a variable, you should just make sure you're pointing at the user-exposed storage of the variable by calling emitBlockByrefAddress(false) (which just does a GEP), and then you can initialize only that.

[jfb]

• Only initialize __block's storage.

[jfb]

lib/CodeGen/CGDecl.cpp

1647

Thanks, I now understand what you meant. It's super simple indeed, sorry I took a while to grok. Updated patch should do this now.

[rjmccall]

lib/CodeGen/CGDecl.cpp

1605

Are these changes still needed?

1644

Thanks, this is what I was looking for.

[jfb]

lib/CodeGen/CGDecl.cpp

1726

Note that we still want this to be pulled out in this way because emitByrefStructureInit emits the call to the initializer (in test_block_self_init the call to create). Were we to leave this as it was before, one of the initializations below would be emitted, but it would be *after* the call.

Similarly, we also want the little dance I added to only initialize once.

[jfb]

lib/CodeGen/CGDecl.cpp

1605

I believe so, see concurrent comment here:
https://reviews.llvm.org/D57797#inline-512702

[rjmccall]

lib/CodeGen/CGDecl.cpp

1726

Oh, that's interesting, I hadn't remembered that. Alright, in that case LGTM, I guess.

...unless you want to refactor this so that emitByrefStructureInit only handles the header initialization and the bit about handling the initializer is handled more cleanly down in the rest of this code.

[jfb]

• Simplify patch greatly.

[jfb]

lib/CodeGen/CGDecl.cpp

1605

Actually I'm wrong, updated patch drops this and the test makes sure the call is after this initialization. Sorry for the confusion. This is much cleaner.

1646

Just to circle back, the above code lowers to:

%struct.Z = type { i8 }

@__const._Z3fooi.arr = private unnamed_addr constant %struct.Z { i8 -86 }, align 1

; Function Attrs: noinline nounwind optnone ssp uwtable
define void @_Z3fooi(i32 %size) #0 {
entry:
  %size.addr = alloca i32, align 4
  %saved_stack = alloca i8*, align 8
  %__vla_expr0 = alloca i64, align 8
  store i32 %size, i32* %size.addr, align 4
  %0 = load i32, i32* %size.addr, align 4
  %1 = zext i32 %0 to i64
  %2 = call i8* @llvm.stacksave()
  store i8* %2, i8** %saved_stack, align 8
  %vla = alloca %struct.Z, i64 %1, align 16
  store i64 %1, i64* %__vla_expr0, align 8
  %vla.iszerosized = icmp eq i64 %1, 0
  br i1 %vla.iszerosized, label %vla-init.cont, label %vla-setup.loop

vla-setup.loop:                                   ; preds = %entry
  %vla.begin = bitcast %struct.Z* %vla to i8*
  %vla.end = getelementptr inbounds i8, i8* %vla.begin, i64 %1
  br label %vla-init.loop

vla-init.loop:                                    ; preds = %vla-init.loop, %vla-setup.loop
  %vla.cur = phi i8* [ %vla.begin, %vla-setup.loop ], [ %vla.next, %vla-init.loop ]
  call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 %vla.cur, i8* align 1 getelementptr inbounds (%struct.Z, %struct.Z* @__const._Z3fooi.arr, i32 0, i32 0), i64 1, i1 false)
  %vla.next = getelementptr inbounds i8, i8* %vla.cur, i64 1
  %vla-init.isdone = icmp eq i8* %vla.next, %vla.end
  br i1 %vla-init.isdone, label %vla-init.cont, label %vla-init.loop

vla-init.cont:                                    ; preds = %vla-init.loop, %entry
  %3 = load i8*, i8** %saved_stack, align 8
  call void @llvm.stackrestore(i8* %3)
  ret void
}

So yes it's handled.

1667

https://reviews.llvm.org/rC353490

1726

As noted above, I was wrong here.

[jfb]

• Remove whitespace changes.

[rjmccall]

SGTM, thanks!

lib/CodeGen/CGDecl.cpp

void CodeGenFunction::EmitAutoVarInit(const AutoVarEmission &emission) {
 
   // If we are at an unreachable point, we don't need to emit the initializer
   // unless it contains a label.
   if (!HaveInsertPoint()) {
     if (!Init || !ContainsLabel(Init)) return;
     EnsureInsertPoint();
   }
 
-  // Initialize the structure of a __block variable.
-  if (emission.IsEscapingByRef)
-    emitByrefStructureInit(emission);
-
   // Initialize the variable here if it doesn't have a initializer and it is a
   // C struct that is non-trivial to initialize or an array containing such a
   // struct.
-  if (!Init &&
-      type.isNonTrivialToPrimitiveDefaultInitialize() ==
+  if (!Init && type.isNonTrivialToPrimitiveDefaultInitialize() ==
                    QualType::PDIK_Struct) {
     LValue Dst = MakeAddrLValue(emission.getAllocatedAddress(), type);
-    if (emission.IsEscapingByRef)
+    if (emission.IsEscapingByRef) {
+      emitByrefStructureInit(emission);
       drillIntoBlockVariable(*this, Dst, &D);
+    }
     defaultInitNonTrivialCStructVar(Dst);
     return;
   }
 
   // Check whether this is a byref variable that's potentially
   // captured and moved by its own initializer.  If so, we'll need to
   // emit the initializer first, then copy into the variable.
   bool capturedByInit =
       Init && emission.IsEscapingByRef && isCapturedBy(D, Init);
 
   Address Loc =
       capturedByInit ? emission.Addr : emission.getObjectAddress(*this);
 
   // Note: constexpr already initializes everything correctly.
   LangOptions::TrivialAutoVarInitKind trivialAutoVarInit =
       (D.isConstexpr()
            ? LangOptions::TrivialAutoVarInitKind::Uninitialized
            : (D.getAttr<UninitializedAttr>()
                   ? LangOptions::TrivialAutoVarInitKind::Uninitialized
                   : getContext().getLangOpts().getTrivialAutoVarInit()));
 
-  auto initializeWhatIsTechnicallyUninitialized = [&]() {
+  bool trivialInitializationDone = false;
+  auto initializeWhatIsTechnicallyUninitialized = [&](Address Loc) {
     if (trivialAutoVarInit ==
         LangOptions::TrivialAutoVarInitKind::Uninitialized)
       return;
+    if (trivialInitializationDone)
+      return;
+    trivialInitializationDone = true;
+
+    // Only initialize a __block's storage: we always initialize the header.
+    if (emission.IsEscapingByRef)
+      Loc = emitBlockByrefAddress(Loc, &D, /*follow=*/false);
 
     CharUnits Size = getContext().getTypeSizeInChars(type);
     if (!Size.isZero()) {
       switch (trivialAutoVarInit) {
       case LangOptions::TrivialAutoVarInitKind::Uninitialized:
         llvm_unreachable("Uninitialized handled above");
       case LangOptions::TrivialAutoVarInitKind::Zero:
         emitStoresForZeroInit(CGM, D, Loc, isVolatile, Builder);
         break;
       case LangOptions::TrivialAutoVarInitKind::Pattern:
         emitStoresForPatternInit(CGM, D, Loc, isVolatile, Builder);
         break;
       }
       return;
     }
 
     // VLAs look zero-sized to getTypeInfo. We can't emit constant stores to
     // them, so emit a memcpy with the VLA size to initialize each element.
     // Technically zero-sized or negative-sized VLAs are undefined, and UBSan
     // will catch that code, but there exists code which generates zero-sized
     // VLAs. Be nice and initialize whatever they requested.
     const VariableArrayType *VlaType =
         dyn_cast_or_null<VariableArrayType>(getContext().getAsArrayType(type));
     if (!VlaType)
       return;
     auto VlaSize = getVLASize(VlaType);
     auto SizeVal = VlaSize.NumElts;
     CharUnits EltSize = getContext().getTypeSizeInChars(VlaSize.Type);
     switch (trivialAutoVarInit) {
     case LangOptions::TrivialAutoVarInitKind::Uninitialized:
       llvm_unreachable("Uninitialized handled above");
case LangOptions::TrivialAutoVarInitKind::Pattern: {
       llvm::Value *Done = Builder.CreateICmpEQ(Next, End, "vla-init.isdone");
       Builder.CreateCondBr(Done, ContBB, LoopBB);
       Cur->addIncoming(Next, LoopBB);
       EmitBlock(ContBB);
     } break;
     }
   };
 
+  // Initialize the structure of a __block variable.
+  if (emission.IsEscapingByRef) {
+    initializeWhatIsTechnicallyUninitialized(Loc);
+    emitByrefStructureInit(emission);
+  }
+
   if (isTrivialInitializer(Init)) {
-    initializeWhatIsTechnicallyUninitialized();
+    initializeWhatIsTechnicallyUninitialized(Loc);
     return;
   }
 
   llvm::Constant *constant = nullptr;
   if (emission.IsConstantAggregate || D.isConstexpr()) {
     assert(!capturedByInit && "constant init contains a capturing block?");
     constant = ConstantEmitter(*this).tryEmitAbstractForInitializer(D);
     if (constant && trivialAutoVarInit !=
                         LangOptions::TrivialAutoVarInitKind::Uninitialized)
       constant = replaceUndef(constant);
   }
 
   if (!constant) {
-    initializeWhatIsTechnicallyUninitialized();
+    initializeWhatIsTechnicallyUninitialized(Loc);
     LValue lv = MakeAddrLValue(Loc, type);
     lv.setNonGC(true);
     return EmitExprAsInit(Init, &D, lv, capturedByInit);
   }
 
   if (!emission.IsConstantAggregate) {
     // For simple scalar/complex initialization, store the value directly.
     LValue lv = MakeAddrLValue(Loc, type);

test/CodeGenCXX/trivial-auto-var-init.cpp

 // ZERO: store i32 0, i32* %block
 // PATTERN-LABEL: test_block(
 // PATTERN: store i32 -1431655766, i32* %block
 void test_block() {
   __block int block;
   used(block);
 }
 
+// Using the variable being initialized is typically UB in C, but for blocks we
+// can be nice: they imply extra book-keeping and we can do the auto-init before
+// any of said book-keeping.
+//
+// UNINIT-LABEL:  test_block_self_init(
+// ZERO-LABEL:    test_block_self_init(
+// ZERO:          %captured = alloca %struct.__block_byref_captured, align 8
+// ZERO-NEXT:     %block = alloca <{ i8*, i32, i32, i8*, %struct.__block_descriptor*, i8* }>, align 8
+// ZERO-NEXT:     %captured1 = getelementptr inbounds %struct.__block_byref_captured, %struct.__block_byref_captured* %captured, i32 0, i32 4
+// ZERO-NEXT:     store %struct.XYZ* null, %struct.XYZ** %captured1, align 8
+// PATTERN-LABEL: test_block_self_init(
+// PATTERN:       %captured = alloca %struct.__block_byref_captured, align 8
+// PATTERN-NEXT:  %block = alloca <{ i8*, i32, i32, i8*, %struct.__block_descriptor*, i8* }>, align 8
+// PATTERN-NEXT:  %captured1 = getelementptr inbounds %struct.__block_byref_captured, %struct.__block_byref_captured* %captured, i32 0, i32 4
+// PATTERN-NEXT:  store %struct.XYZ* inttoptr (i64 -6148914691236517206 to %struct.XYZ*), %struct.XYZ** %captured1, align 8
+void test_block_self_init() {
+  using Block = void (^)();
+  typedef struct XYZ {
+    Block block;
+  } * xyz_t;
+  extern xyz_t create(Block block);
+  __block xyz_t captured = create(^() {
+    (void)captured;
+  });
+}
+
 // This type of code is currently not handled by zero / pattern initialization.
 // The test will break when that is fixed.
 // UNINIT-LABEL:  test_goto_unreachable_value(
 // ZERO-LABEL:    test_goto_unreachable_value(
 // ZERO-NOT: store {{.*}}%oops
 // PATTERN-LABEL: test_goto_unreachable_value(
 // PATTERN-NOT: store {{.*}}%oops
 void test_goto_unreachable_value() {

test/CodeGenObjC/arc-blocks.m

void test4(void) {
   id test4_source(void);
   void test4_helper(void (^)(void));
   __block id var = test4_source();
   test4_helper(^{ var = 0; });
 
   // CHECK-LABEL:    define void @test4()
   // CHECK:      [[VAR:%.*]] = alloca [[BYREF_T:%.*]],
   // CHECK-NEXT: [[BLOCK:%.*]] = alloca [[BLOCK_T:<{.*}>]],
+  // CHECK:      [[SLOT:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 6
   // CHECK:      [[T0:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 2
   // 0x02000000 - has copy/dispose helpers strong
   // CHECK-NEXT: store i32 838860800, i32* [[T0]]
-  // CHECK:      [[SLOT:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 6
-  // CHECK-NEXT: [[T0:%.*]] = call i8* @test4_source()
+  // CHECK:      [[T0:%.*]] = call i8* @test4_source()
   // CHECK-NEXT: [[T1:%.*]] = call i8* @llvm.objc.retainAutoreleasedReturnValue(i8* [[T0]])
   // CHECK-NEXT: store i8* [[T1]], i8** [[SLOT]]
   // CHECK-NEXT: [[SLOT:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 6
   // 0x42800000 - has signature, copy/dispose helpers, as well as BLOCK_HAS_EXTENDED_LAYOUT
   // CHECK:      store i32 -1040187392,
   // CHECK:      [[T0:%.*]] = bitcast [[BYREF_T]]* [[VAR]] to i8*
   // CHECK-NEXT: store i8* [[T0]], i8**
   // CHECK:      call void @test4_helper(
void test6(void) {
   __block __weak id var = test6_source();
   test6_helper(^{ var = 0; });
 
   // CHECK-LABEL:    define void @test6()
   // CHECK:      [[VAR:%.*]] = alloca [[BYREF_T:%.*]],
   // CHECK-NEXT: [[BLOCK:%.*]] = alloca [[BLOCK_T:<{.*}>]],
   // CHECK-NEXT: [[VARPTR1:%.*]] = bitcast [[BYREF_T]]* [[VAR]] to i8*
   // CHECK-NEXT: call void @llvm.lifetime.start.p0i8(i64 48, i8* [[VARPTR1]])
+  // CHECK:      [[SLOT:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 6
   // CHECK:      [[T0:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 2
   // 0x02000000 - has copy/dispose helpers weak
   // CHECK-NEXT: store i32 1107296256, i32* [[T0]]
-  // CHECK:      [[SLOT:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 6
-  // CHECK-NEXT: [[T0:%.*]] = call i8* @test6_source()
+  // CHECK:      [[T0:%.*]] = call i8* @test6_source()
   // CHECK-NEXT: [[T1:%.*]] = call i8* @llvm.objc.retainAutoreleasedReturnValue(i8* [[T0]])
   // CHECK-NEXT: call i8* @llvm.objc.initWeak(i8** [[SLOT]], i8* [[T1]])
   // CHECK-NEXT: call void @llvm.objc.release(i8* [[T1]])
   // CHECK-NEXT: [[SLOT:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[VAR]], i32 0, i32 6
   // 0x42800000 - has signature, copy/dispose helpers, as well as BLOCK_HAS_EXTENDED_LAYOUT
   // CHECK:      store i32 -1040187392,
   // CHECK: %[[BLOCK_DESCRIPTOR:.*]] = getelementptr inbounds <{ i8*, i32, i32, i8*, %[[STRUCT_BLOCK_DESCRIPTOR]]*, i8* }>, <{ i8*, i32, i32, i8*, %[[STRUCT_BLOCK_DESCRIPTOR]]*, i8* }>* %{{.*}}, i32 0, i32 4
   // CHECK: store %[[STRUCT_BLOCK_DESCRIPTOR]]* bitcast ({ i64, i64, i8*, i8*, i8*, i64 }* @[[BLOCK_DESCRIPTOR_TMP9]] to %[[STRUCT_BLOCK_DESCRIPTOR]]*), %[[STRUCT_BLOCK_DESCRIPTOR]]** %[[BLOCK_DESCRIPTOR]], align 8
   // CHECK:      [[T0:%.*]] = bitcast [[BYREF_T]]* [[VAR]] to i8*
   // CHECK-NEXT: store i8* [[T0]], i8**
   // CHECK:      call void @test6_helper(
   // CHECK:      [[T0:%.*]] = bitcast [[BYREF_T]]* [[VAR]] to i8*
   // CHECK-NEXT: call void @_Block_object_dispose(i8* [[T0]], i32 8)
   // CHECK-NEXT: call void @llvm.objc.destroyWeak(i8** [[SLOT]])
   // CHECK-NEXT: [[VARPTR2:%.*]] = bitcast [[BYREF_T]]* [[VAR]] to i8*
   // CHECK-NEXT: call void @llvm.lifetime.end.p0i8(i64 48, i8* [[VARPTR2]])

 // Test that we correctly assign to __block variables when the
 // assignment captures the variable.
 void test10b(void) {
   __block void (^block)(void);
   block = ^{ block(); };
 
   // CHECK-LABEL:    define void @test10b()
   // CHECK:      [[BYREF:%.*]] = alloca [[BYREF_T:%.*]],
+  // CHECK:      [[T0:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[BYREF]], i32 0, i32 6
 
   // Zero-initialize.
-  // CHECK:      [[T0:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[BYREF]], i32 0, i32 6
-  // CHECK-NEXT: store void ()* null, void ()** [[T0]], align 8
+  // CHECK:      store void ()* null, void ()** [[T0]], align 8
 
   // CHECK-NEXT: [[SLOT:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[BYREF]], i32 0, i32 6
 
   // The assignment.
   // CHECK:      [[T0:%.*]] = bitcast void ()* {{%.*}} to i8*
   // CHECK-NEXT: [[T1:%.*]] = call i8* @llvm.objc.retainBlock(i8* [[T0]])
   // CHECK-NEXT: [[T2:%.*]] = bitcast i8* [[T1]] to void ()*
   // CHECK-NEXT: [[T3:%.*]] = getelementptr inbounds [[BYREF_T]], [[BYREF_T]]* [[BYREF]], i32 0, i32 1

test/CodeGenObjC/blocks-2.m

 
 // <rdar://problem/8224178>: cleanup __block variables on EH path
 // CHECK: define void @{{.*}}test1
 void test1() {
   extern void test1_help(void (^x)(void));
 
   // CHECK:      [[N:%.*]] = alloca [[N_T:%.*]], align 8
   // CHECK:      [[T0:%.*]] = getelementptr inbounds [[N_T]], [[N_T]]* [[N]], i32 0, i32 4
-  // CHECK-NEXT: store double 1.000000e+{{0?}}01, double* [[T0]], align 8
+  // CHECK:      store double 1.000000e+{{0?}}01, double* [[T0]], align 8
   __block double n = 10;
 
   // CHECK:      invoke void @{{.*}}test1_help
   test1_help(^{ n = 20; });
 
   // CHECK:      [[T1:%.*]] = bitcast [[N_T]]* [[N]] to i8*
   // CHECK-NEXT: call void @_Block_object_dispose(i8* [[T1]], i32 8)
   // CHECK-NEXT: ret void
 
   // CHECK:      landingpad { i8*, i32 }
   // CHECK-NEXT:   cleanup
   // CHECK:      [[T1:%.*]] = bitcast [[N_T]]* [[N]] to i8*
   // CHECK-NEXT: call void @_Block_object_dispose(i8* [[T1]], i32 8)
   // CHECK:      resume { i8*, i32 }
 }

test/CodeGenObjC/blocks.m

 @interface Test2 -(void) destroy; @end
 void test2(Test2 *x) {
   extern void test2_helper(void (^)(void));
   // CHECK-LABEL:    define void @test2(
   // CHECK:      [[X:%.*]] = alloca [[TEST2:%.*]]*,
   // CHECK-NEXT: [[WEAKX:%.*]] = alloca [[WEAK_T:%.*]],
   // CHECK-NEXT: [[BLOCK:%.*]] = alloca [[BLOCK_T:<{.*}>]],
   // CHECK-NEXT: store [[TEST2]]*
+  // CHECK-NEXT: [[T6:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 6
 
   // isa=1 for weak byrefs.
   // CHECK-NEXT: [[T0:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 0
   // CHECK-NEXT: store i8* inttoptr (i32 1 to i8*), i8** [[T0]]
 
   // Forwarding.
   // CHECK-NEXT: [[T1:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 1
   // CHECK-NEXT: store [[WEAK_T]]* [[WEAKX]], [[WEAK_T]]** [[T1]]
 
   // Flags.  This is just BLOCK_HAS_COPY_DISPOSE BLOCK_BYREF_LAYOUT_UNRETAINED
   // CHECK-NEXT: [[T2:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 2
   // CHECK-NEXT: store i32 1375731712, i32* [[T2]]
 
   // Size.
   // CHECK-NEXT: [[T3:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 3
   // CHECK-NEXT: store i32 28, i32* [[T3]]
 
   // Copy and dispose helpers.
   // CHECK-NEXT: [[T4:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 4
   // CHECK-NEXT: store i8* bitcast (void (i8*, i8*)* @__Block_byref_object_copy_{{.*}} to i8*), i8** [[T4]]
   // CHECK-NEXT: [[T5:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 5
   // CHECK-NEXT: store i8* bitcast (void (i8*)* @__Block_byref_object_dispose_{{.*}} to i8*), i8** [[T5]]
 
   // Actually capture the value.
-  // CHECK-NEXT: [[T6:%.*]] = getelementptr inbounds [[WEAK_T]], [[WEAK_T]]* [[WEAKX]], i32 0, i32 6
   // CHECK-NEXT: [[CAPTURE:%.*]] = load [[TEST2]]*, [[TEST2]]** [[X]]
   // CHECK-NEXT: store [[TEST2]]* [[CAPTURE]], [[TEST2]]** [[T6]]
 
   // Then we initialize the block, blah blah blah.
   // CHECK:      call void @test2_helper(
 
   // Finally, kill the variable with BLOCK_FIELD_IS_BYREF.
   // CHECK:      [[T0:%.*]] = bitcast [[WEAK_T]]* [[WEAKX]] to i8*

test/CodeGenObjCXX/arc-blocks.mm

namespace test0 {
   };
 
   void foo() {
     __block A v;
     ^{ (void)v; };
   }
   // CHECK-LABEL:    define void @_ZN5test03fooEv() 
   // CHECK:      [[V:%.*]] = alloca [[BYREF_A:%.*]], align 8
+  // CHECK:      [[V1:%.*]] = getelementptr inbounds [[BYREF_A]], [[BYREF_A]]* [[V]], i32 0, i32 7
   // CHECK:      [[T0:%.*]] = getelementptr inbounds [[BYREF_A]], [[BYREF_A]]* [[V]], i32 0, i32 4
   // CHECK-NEXT: store i8* bitcast (void (i8*, i8*)* [[COPY_HELPER:@.*]] to i8*), i8** [[T0]]
   // CHECK-NEXT: [[T0:%.*]] = getelementptr inbounds [[BYREF_A]], [[BYREF_A]]* [[V]], i32 0, i32 5
   // CHECK-NEXT: store i8* bitcast (void (i8*)* [[DISPOSE_HELPER:@.*]] to i8*), i8** [[T0]]
   // CHECK-NEXT: [[T0:%.*]] = getelementptr inbounds [[BYREF_A]], [[BYREF_A]]* [[V]], i32 0, i32 6
   // CHECK-NEXT: store i8* getelementptr inbounds ([3 x i8], [3 x i8]* [[LAYOUT0]], i32 0, i32 0), i8** [[T0]]
-  // CHECK-NEXT: [[T0:%.*]] = getelementptr inbounds [[BYREF_A]], [[BYREF_A]]* [[V]], i32 0, i32 7
-  // CHECK-NEXT: call void @_ZN5test01AC1Ev([[A]]* [[T0]])
+  // CHECK-NEXT: call void @_ZN5test01AC1Ev([[A]]* [[V1]])
   // CHECK-NEXT: [[T0:%.*]] = getelementptr inbounds [[BYREF_A]], [[BYREF_A]]* [[V]], i32 0, i32 7
   // CHECK: bitcast [[BYREF_A]]* [[V]] to i8*
   // CHECK: [[T1:%.*]] = bitcast [[BYREF_A]]* [[V]] to i8*
   // CHECK-NEXT: call void @_Block_object_dispose(i8* [[T1]], i32 8)
   // CHECK-NEXT: call void @_ZN5test01AD1Ev([[A]]* [[T0]])
   // CHECK-NEXT: ret void
 
   // CHECK:    define internal void [[COPY_HELPER]](