[BasicAliasAnalysis] Fix computation for arrays > half of address space

[eush]

Summary

This fixes alias analysis rules to support arrays larger than half of
the address space by teaching BasicAliasAnalysis about offset
wraparound.

The problem is that BasicAliasAnalysis reduces all pointer offsets to
APInt with PointerSize bits (by calling adjustToPointerSize), but then
performs arithmetic operations in APInt with MaxPointerSize bits. In the
case when PointerSize is not equal to MaxPointerSize, this leads to all
offsets larger than half of the address space size being treated as
negative integers, and certain heuristics producing incorrect results if
such offsets are involved.

This fixes PR34344 and the test reported on llvm-dev in 118901 [1].

[1]: http://lists.llvm.org/pipermail/llvm-dev/2017-November/118901.html

[eush]

ping

[hfinkel]

lib/Analysis/BasicAliasAnalysis.cpp

1459

You use:

(GEP1BaseOffset.isNonNegative() ? GEP1BaseOffset : GEP1BaseOffset + ASSize)

or it's negation, several times here. Can we add a variable, or lambda function, etc. to make this repetition unnecessary?

1520

Can you please document better what's going on here?

test/Analysis/BasicAA/cs-cs.ll

276

Why did this change?

The change doesn't look wrong, but it's also unrelated to the half-the-address-space issue (AFAIKT, this test has 32-bit pointers), so it will be useful to understand what fixed this.

[eush]

I updated the diff as per the comments.

• [Basicaliasanalysis] Factor out modular arithmetic to reduce repetition
• [BasicAliasAnalysis] Expand the comments on MaxVarOffset

[eush]

test/Analysis/BasicAA/cs-cs.ll

276

This change is caused by the fact that the wraparound semantics implemented in
this diff makes %p and %q MayAlias aliases of each other. The object
pointed to by %q has unknown size, and with wraparound it can very well span
until %p.

Previously, without wraparound, the object could only span until the end of
the address space.

include/llvm/Analysis/BasicAliasAnalysis.h

GetLinearExpression(const Value *V, APInt &Scale, APInt &Offset,
                       unsigned &ZExtBits, unsigned &SExtBits,
                       const DataLayout &DL, unsigned Depth, AssumptionCache *AC,
                       DominatorTree *DT, bool &NSW, bool &NUW);
 
   static bool DecomposeGEPExpression(const Value *V, DecomposedGEP &Decomposed,
       const DataLayout &DL, AssumptionCache *AC, DominatorTree *DT);
 
   static bool isGEPBaseAtNegativeOffset(const GEPOperator *GEPOp,
-      const DecomposedGEP &DecompGEP, const DecomposedGEP &DecompObject,
-      LocationSize ObjectAccessSize);
+                                        const DecomposedGEP &DecompGEP,
+                                        const DecomposedGEP &DecompObject,
+                                        LocationSize ObjectAccessSize,
+                                        APInt ASSize);
 
   /// A Heuristic for aliasGEP that searches for a constant offset
   /// between the variables.
   ///
   /// GetLinearExpression has some limitations, as generally zext(%x + 1)
   /// != zext(%x) + zext(1) if the arithmetic overflows. GetLinearExpression
   /// will therefore conservatively refuse to decompose these expressions.
   /// However, we know that, for all %x, zext(%x) != zext(%x + 1), even if

lib/Analysis/BasicAliasAnalysis.cpp

static AliasResult aliasSameBasePointerGEPs(const GEPOperator *GEP1,
 
   if (EltsDontOverlap(V1Off, V1Size, V2Off, V2Size) ||
       EltsDontOverlap(V2Off, V2Size, V1Off, V1Size))
     return NoAlias;
 
   return MayAlias;
 }
 
+// Return nonnegative result of the modulo operation or LHS if RHS is zero.
+static APInt moduloOrSelf(const APInt &LHS, const APInt &RHS) {
+  if (RHS.isNullValue())
+    return LHS;
+
+  APInt Result = LHS.srem(RHS);
+  return Result.isNegative() ? Result + RHS.abs() : Result;
+}
+
 // If a we have (a) a GEP and (b) a pointer based on an alloca, and the
 // beginning of the object the GEP points would have a negative offset with
 // repsect to the alloca, that means the GEP can not alias pointer (b).
 // Note that the pointer based on the alloca may not be a GEP. For
 // example, it may be the alloca itself.
 // The same applies if (b) is based on a GlobalVariable. Note that just being
 // based on isIdentifiedObject() is not enough - we need an identified object
 // that does not permit access to negative offsets. For example, a negative

 //  %f0 = getelementptr inbounds %struct, %struct.foo* %alloca, i32 0, i32 0
 //  %f1 = getelementptr inbounds %struct, %struct.foo* %random, i32 0, i32 1
 //
 // Assume %f1 and %f0 alias. Then %f1 would point into the object allocated
 // by %alloca. Since the %f1 GEP is inbounds, that means %random must also
 // point into the same object. But since %f0 points to the beginning of %alloca,
 // the highest %f1 can be is (%alloca + 3). This means %random can not be higher
 // than (%alloca - 1), and so is not inbounds, a contradiction.
-bool BasicAAResult::isGEPBaseAtNegativeOffset(const GEPOperator *GEPOp,
-      const DecomposedGEP &DecompGEP, const DecomposedGEP &DecompObject,
-      LocationSize MaybeObjectAccessSize) {
+bool BasicAAResult::isGEPBaseAtNegativeOffset(
+    const GEPOperator *GEPOp, const DecomposedGEP &DecompGEP,
+    const DecomposedGEP &DecompObject, LocationSize MaybeObjectAccessSize,
+    APInt ASSize) {
   // If the object access size is unknown, or the GEP isn't inbounds, bail.
   if (MaybeObjectAccessSize == LocationSize::unknown() || !GEPOp->isInBounds())
     return false;
 
   const uint64_t ObjectAccessSize = MaybeObjectAccessSize.getValue();
 
   // We need the object to be an alloca or a globalvariable, and want to know
   // the offset of the pointer from the object precisely, so no variable
bool BasicAAResult::isGEPBaseAtNegativeOffset(
   // we can't get exact GEP offset to identify pointer alias. So return
   // false in that case.
   if (!DecompGEP.VarIndices.empty())
     return false;
 
   APInt GEPBaseOffset = DecompGEP.StructOffset;
   GEPBaseOffset += DecompGEP.OtherOffset;
 
+  // Wrap the offsets around zero if negative, to support the case of the
+  // object taking up more than half of its address space.
+  ObjectBaseOffset = moduloOrSelf(ObjectBaseOffset, ASSize);
+  GEPBaseOffset = moduloOrSelf(GEPBaseOffset, ASSize);
+
   return GEPBaseOffset.sge(ObjectBaseOffset + (int64_t)ObjectAccessSize);
 }
 
 /// Provides a bunch of ad-hoc rules to disambiguate a GEP instruction against
 /// another pointer.
 ///
 /// We know that V1 is a GEP, but we don't know anything about V2.
 /// UnderlyingV1 is GetUnderlyingObject(GEP1, DL), UnderlyingV2 is the same for
 /// V2.
 AliasResult
 BasicAAResult::aliasGEP(const GEPOperator *GEP1, LocationSize V1Size,
                         const AAMDNodes &V1AAInfo, const Value *V2,
                         LocationSize V2Size, const AAMDNodes &V2AAInfo,
                         const Value *UnderlyingV1, const Value *UnderlyingV2) {
   DecomposedGEP DecompGEP1, DecompGEP2;
+  unsigned PointerSize =
+      DL.getPointerSizeInBits(GEP1->getPointerAddressSpace());
   unsigned MaxPointerSize = getMaxPointerSize(DL);
   DecompGEP1.StructOffset = DecompGEP1.OtherOffset = APInt(MaxPointerSize, 0);
   DecompGEP2.StructOffset = DecompGEP2.OtherOffset = APInt(MaxPointerSize, 0);
 
   bool GEP1MaxLookupReached =
     DecomposeGEPExpression(GEP1, DecompGEP1, DL, &AC, DT);
   bool GEP2MaxLookupReached =
     DecomposeGEPExpression(V2, DecompGEP2, DL, &AC, DT);
 
   APInt GEP1BaseOffset = DecompGEP1.StructOffset + DecompGEP1.OtherOffset;
   APInt GEP2BaseOffset = DecompGEP2.StructOffset + DecompGEP2.OtherOffset;
 
   assert(DecompGEP1.Base == UnderlyingV1 && DecompGEP2.Base == UnderlyingV2 &&
          "DecomposeGEPExpression returned a result different from "
          "GetUnderlyingObject");
 
+  // Size of the address space modulo pointer size. Used to implement offset
+  // wraparound.
+  APInt ASSize = PointerSize == MaxPointerSize
+                     ? APInt::getNullValue(MaxPointerSize)
+                     : APInt::getOneBitSet(MaxPointerSize, PointerSize);
+
   // If the GEP's offset relative to its base is such that the base would
   // fall below the start of the object underlying V2, then the GEP and V2
   // cannot alias.
   if (!GEP1MaxLookupReached && !GEP2MaxLookupReached &&
-      isGEPBaseAtNegativeOffset(GEP1, DecompGEP1, DecompGEP2, V2Size))
+      isGEPBaseAtNegativeOffset(GEP1, DecompGEP1, DecompGEP2, V2Size, ASSize))
     return NoAlias;
   // If we have two gep instructions with must-alias or not-alias'ing base
   // pointers, figure out if the indexes to the GEP tell us anything about the
   // derived pointer.
   if (const GEPOperator *GEP2 = dyn_cast<GEPOperator>(V2)) {
     // Check for the GEP base being at a negative offset, this time in the other
     // direction.
     if (!GEP1MaxLookupReached && !GEP2MaxLookupReached &&
-        isGEPBaseAtNegativeOffset(GEP2, DecompGEP2, DecompGEP1, V1Size))
+        isGEPBaseAtNegativeOffset(GEP2, DecompGEP2, DecompGEP1, V1Size, ASSize))
       return NoAlias;
     // Do the base pointers alias?
     AliasResult BaseAlias =
         aliasCheck(UnderlyingV1, LocationSize::unknown(), AAMDNodes(),
                    UnderlyingV2, LocationSize::unknown(), AAMDNodes());
 
     // Check for geps of non-aliasing underlying pointers where the offsets are
     // identical.
BasicAAResult::aliasGEP(const GEPOperator *GEP1, LocationSize V1Size,
   // must aliases the GEP, the end result is a must alias also.
   if (GEP1BaseOffset == 0 && DecompGEP1.VarIndices.empty())
     return MustAlias;
 
   // If there is a constant difference between the pointers, but the difference
   // is less than the size of the associated memory object, then we know
   // that the objects are partially overlapping.  If the difference is
   // greater, we know they do not overlap.
+  //
+  // Factoring in the wraparound, there are two differences between the
+  // pointers: one from GEP1 to V2, and one from V2 back to GEP1 in the same
+  // direction.  Analyze both.
   if (GEP1BaseOffset != 0 && DecompGEP1.VarIndices.empty()) {
-    if (GEP1BaseOffset.sge(0)) {
-      if (V2Size != LocationSize::unknown()) {
-        if (GEP1BaseOffset.ult(V2Size.getValue()))
-          return PartialAlias;
-        return NoAlias;
-      }
+    // True if in both cases concluded NoAlias.
+    bool BothNoAlias = true;
+
+    // Look at the distance between V2 and GEP1 (with wraparound):
+    // +                +
+    // | BaseOffset     |
+    // ---------------->|
+    // |-->V2Size       |-------> V1Size
+    // V2               GEP1
+      if (moduloOrSelf(GEP1BaseOffset, ASSize).ult(V2Size.getValue()))
     } else {
-      // We have the situation where:
-      // +                +
-      // | BaseOffset     |
-      // ---------------->|
-      // |-->V1Size       |-------> V2Size
-      // GEP1             V2
-      // We need to know that V2Size is not unknown, otherwise we might have
-      // stripped a gep with negative index ('gep <ptr>, -1, ...).
-      if (V1Size != LocationSize::unknown() &&
-          V2Size != LocationSize::unknown()) {
-        if ((-GEP1BaseOffset).ult(V1Size.getValue()))
-          return PartialAlias;
-        return NoAlias;
-      }
+      BothNoAlias = false;
+    }
+
+    // Look at the distance between GEP1 and V2 (with wraparound):
+      if (moduloOrSelf(-GEP1BaseOffset, ASSize).ult(V1Size.getValue()))
+    } else {
+      BothNoAlias = false;
     }
+
+    if (BothNoAlias)
+      return NoAlias;
   }
 
   if (!DecompGEP1.VarIndices.empty()) {
     APInt Modulo(MaxPointerSize, 0);
+    APInt MaxVarOffset(MaxPointerSize, 0);
     bool AllPositive = true;
     for (unsigned i = 0, e = DecompGEP1.VarIndices.size(); i != e; ++i) {
 
       // Try to distinguish something like &A[i][1] against &A[42][0].
       // Grab the least significant bit set in any of the scales. We
       // don't need std::abs here (even if the scale's negative) as we'll
       // be ^'ing Modulo with itself later.
       Modulo |= DecompGEP1.VarIndices[i].Scale;
for (unsigned i = 0, e = DecompGEP1.VarIndices.size(); i != e; ++i) {
         SignKnownOne &= !IsZExt;
 
         // If the variable begins with a zero then we know it's
         // positive, regardless of whether the value is signed or
         // unsigned.
         APInt Scale = DecompGEP1.VarIndices[i].Scale;
         AllPositive =
             (SignKnownZero && Scale.sge(0)) || (SignKnownOne && Scale.slt(0));
+
+        // Compute maximum offset for this index by setting all unknown bits
+        // to one if the Value is positive, and to zero if the Value is
+        // negative to obtain the maximum absolute value, and multiplying it by Scale.
+        // Accumulate the offsets in MaxVarOffset.
+        MaxVarOffset += (SignKnownZero ? ~Known.Zero : Known.One)
+                            .sextOrSelf(MaxPointerSize) *
+                        Scale.sextOrSelf(MaxPointerSize);
       }
     }
 
     Modulo = Modulo ^ (Modulo & (Modulo - 1));
 
     // We can compute the difference between the two addresses
     // mod Modulo. Check whether that difference guarantees that the
     // two locations do not alias.
     APInt ModOffset = GEP1BaseOffset & (Modulo - 1);
     if (V1Size != LocationSize::unknown() &&
         V2Size != LocationSize::unknown() && ModOffset.uge(V2Size.getValue()) &&
         (Modulo - ModOffset).uge(V1Size.getValue()))
       return NoAlias;
 
     // If we know all the variables are positive, then GEP1 >= GEP1BasePtr.
-    // If GEP1BasePtr > V2 (GEP1BaseOffset > 0) then we know the pointers
-    // don't alias if V2Size can fit in the gap between V2 and GEP1BasePtr.
-    if (AllPositive && GEP1BaseOffset.sgt(0) &&
+    // If V2Size can fit in the gap between V2 and GEP1BasePtr (with optional
+    // wraparound), and V1 can fit in the gap between GEP1 and V2 (with
+    // optional wraparound), then we know the pointers don't alias.
+    if (AllPositive && V1Size != LocationSize::unknown() &&
         V2Size != LocationSize::unknown() &&
-        GEP1BaseOffset.uge(V2Size.getValue()))
+        moduloOrSelf(GEP1BaseOffset, ASSize).uge(V2Size.getValue()) &&
+        moduloOrSelf(-GEP1BaseOffset, ASSize)
+            .uge(MaxVarOffset.uadd_sat(
+                APInt(MaxPointerSize, V1Size.getValue()))))
       return NoAlias;
 
     if (constantOffsetHeuristic(DecompGEP1.VarIndices, V1Size, V2Size,
                                 GEP1BaseOffset, &AC, DT))
       return NoAlias;
   }
 
   // Statically, we can see that the base objects are the same, but the

test/Analysis/BasicAA/cs-cs.ll

entry:
   call void @an_inaccessiblememonly_func()
   call void @an_inaccessibleorargmemonly_func(i8* %q)
   call void @an_argmemonly_func(i8* %q)
   ret void
 
 ; CHECK-LABEL: Function: test8
 ; CHECK: NoModRef:  Ptr: i8* %p <->  call void @an_inaccessiblememonly_func()
 ; CHECK: NoModRef:  Ptr: i8* %q <->  call void @an_inaccessiblememonly_func()
-; CHECK: NoModRef:  Ptr: i8* %p <->  call void @an_inaccessibleorargmemonly_func(i8* %q)
+; CHECK: Both ModRef:  Ptr: i8* %p <->  call void @an_inaccessibleorargmemonly_func(i8* %q)
 ; CHECK: Both ModRef (MustAlias):  Ptr: i8* %q <->  call void @an_inaccessibleorargmemonly_func(i8* %q)
-; CHECK: NoModRef:  Ptr: i8* %p <->  call void @an_argmemonly_func(i8* %q)
+; CHECK: Both ModRef:  Ptr: i8* %p <->  call void @an_argmemonly_func(i8* %q)
 ; CHECK: Both ModRef (MustAlias):  Ptr: i8* %q <->  call void @an_argmemonly_func(i8* %q)
 ; CHECK: Just Ref: call void @a_readonly_func(i8* %p) <-> call void @an_inaccessiblememonly_func()
 ; CHECK: Just Ref: call void @a_readonly_func(i8* %p) <-> call void @an_inaccessibleorargmemonly_func(i8* %q)
 ; CHECK: Just Ref: call void @a_readonly_func(i8* %p) <-> call void @an_argmemonly_func(i8* %q)
 ; CHECK: Both ModRef: call void @an_inaccessiblememonly_func() <-> call void @a_readonly_func(i8* %p)
 ; CHECK: Both ModRef: call void @an_inaccessiblememonly_func() <-> call void @a_writeonly_func(i8* %q)
 ; CHECK: Both ModRef: call void @an_inaccessiblememonly_func() <-> call void @an_inaccessiblememonly_func()
 ; CHECK: Both ModRef: call void @an_inaccessiblememonly_func() <-> call void @an_inaccessibleorargmemonly_func(i8* %q)
entry:
   call void @an_inaccessibleorargmemonly_func(i8* %q) #8 [ "unknown"() ]
   call void @an_argmemonly_func(i8* %q) #9 [ "unknown"() ]
   ret void
 
 ; CHECK: Just Ref:  Ptr: i8* %p        <->  call void @a_readonly_func(i8* %p) #6 [ "unknown"() ]
 ; CHECK: Just Ref:  Ptr: i8* %q        <->  call void @a_readonly_func(i8* %p) #6 [ "unknown"() ]
 ; CHECK: NoModRef:  Ptr: i8* %p        <->  call void @an_inaccessiblememonly_func() #7 [ "unknown"() ]
 ; CHECK: NoModRef:  Ptr: i8* %q        <->  call void @an_inaccessiblememonly_func() #7 [ "unknown"() ]
-; CHECK: NoModRef:  Ptr: i8* %p        <->  call void @an_inaccessibleorargmemonly_func(i8* %q) #8 [ "unknown"() ]
+; CHECK: Both ModRef:  Ptr: i8* %p        <->  call void @an_inaccessibleorargmemonly_func(i8* %q) #8 [ "unknown"() ]
 ; CHECK: Both ModRef (MustAlias):  Ptr: i8* %q     <->  call void @an_inaccessibleorargmemonly_func(i8* %q) #8 [ "unknown"() ]
-; CHECK: NoModRef:  Ptr: i8* %p        <->  call void @an_argmemonly_func(i8* %q) #9 [ "unknown"() ]
+; CHECK: Both ModRef:  Ptr: i8* %p        <->  call void @an_argmemonly_func(i8* %q) #9 [ "unknown"() ]
 ; CHECK: Both ModRef (MustAlias):  Ptr: i8* %q     <->  call void @an_argmemonly_func(i8* %q) #9 [ "unknown"() ]
 ; CHECK: Just Ref:   call void @a_readonly_func(i8* %p) #6 [ "unknown"() ] <->   call void @an_inaccessiblememonly_func() #7 [ "unknown"() ]
 ; CHECK: Just Ref:   call void @a_readonly_func(i8* %p) #6 [ "unknown"() ] <->   call void @an_inaccessibleorargmemonly_func(i8* %q) #8 [ "unknown"() ]
 ; CHECK: Just Ref:   call void @a_readonly_func(i8* %p) #6 [ "unknown"() ] <->   call void @an_argmemonly_func(i8* %q) #9 [ "unknown"() ]
 ; CHECK: Both ModRef:   call void @an_inaccessiblememonly_func() #7 [ "unknown"() ] <->   call void @a_readonly_func(i8* %p) #6 [ "unknown"() ]
 ; CHECK: Both ModRef:   call void @an_inaccessiblememonly_func() #7 [ "unknown"() ] <->   call void @an_inaccessibleorargmemonly_func(i8* %q) #8 [ "unknown"() ]
 ; CHECK: NoModRef:   call void @an_inaccessiblememonly_func() #7 [ "unknown"() ] <->   call void @an_argmemonly_func(i8* %q) #9 [ "unknown"() ]
 ; CHECK: Both ModRef:   call void @an_inaccessibleorargmemonly_func(i8* %q) #8 [ "unknown"() ] <->   call void @a_readonly_func(i8* %p) #6 [ "unknown"() ]

test/Analysis/BasicAA/huge-array.ll

+; RUN: opt < %s -basicaa -gvn -S | FileCheck %s
+
+target datalayout = "p:8:8"
+
+; CHECK-LABEL: @func8.noalias()
+; CHECK: store i16 4, i16* %e
+; CHECK-NEXT: store i16 3, i16* %f
+; CHECK-NEXT: ret i16 4
+define i16 @func8.noalias() {
+  %a = alloca [130 x i8]
+  %c = getelementptr [130 x i8], [130 x i8]* %a, i8 0, i8 -128
+  %d = getelementptr [130 x i8], [130 x i8]* %a, i8 0, i8 126
+  %e = bitcast i8* %c to i16*
+  %f = bitcast i8* %d to i16*
+  store i16 4, i16* %e
+  store i16 3, i16* %f
+  %x = load i16, i16* %e
+  ret i16 %x
+}
+
+; CHECK-LABEL: @func8.alias()
+; CHECK: store i16 4, i16* %e
+; CHECK-NEXT: store i16 3, i16* %f
+; CHECK-NEXT: [[x:%.+]] = load i16, i16* %e
+define i16 @func8.alias() {
+  %a = alloca [130 x i8]
+  %c = getelementptr [130 x i8], [130 x i8]* %a, i8 0, i8 -128
+  %d = getelementptr [130 x i8], [130 x i8]* %a, i8 0, i8 127
+  %e = bitcast i8* %c to i16*
+  %f = bitcast i8* %d to i16*
+  store i16 4, i16* %e
+  store i16 3, i16* %f
+  %x = load i16, i16* %e
+  ret i16 %x
+}
+
+; CHECK-LABEL: @func16.noalias()
+; CHECK: store i32 4, i32* %e
+; CHECK-NEXT: store i32 3, i32* %f
+; CHECK-NEXT: ret i32 4
+define i32 @func16.noalias() {
+  %a = alloca [66 x i16]
+  %b = call [66 x i16]* @get16([66 x i16]* %a)
+  %c = getelementptr inbounds [66 x i16], [66 x i16]* %a, i8 0, i8 62
+  %d = getelementptr inbounds [66 x i16], [66 x i16]* %b, i8 0, i8 64
+  %e = bitcast i16* %c to i32*
+  %f = bitcast i16* %d to i32*
+  store i32 4, i32* %e
+  store i32 3, i32* %f
+  %x = load i32, i32* %e
+  ret i32 %x
+}
+
+; CHECK-LABEL: @func16.alias()
+; CHECK: store i32 4, i32* %e
+; CHECK-NEXT: store i32 3, i32* %f
+; CHECK-NEXT: [[x:%.+]] = load i32, i32* %e
+define i32 @func16.alias() {
+  %a = alloca [66 x i16]
+  %b = call [66 x i16]* @get16([66 x i16]* %a)
+  %c = getelementptr inbounds [66 x i16], [66 x i16]* %a, i8 0, i8 63
+  %d = getelementptr inbounds [66 x i16], [66 x i16]* %b, i8 0, i8 64
+  %e = bitcast i16* %c to i32*
+  %f = bitcast i16* %d to i32*
+  store i32 4, i32* %e
+  store i32 3, i32* %f
+  %x = load i32, i32* %e
+  ret i32 %x
+}
+
+; CHECK-LABEL: @func16.alias1()
+; CHECK: store i32 4, i32* %e
+; CHECK-NEXT: store i32 3, i32* %f
+; CHECK-NEXT: [[x:%.+]] = load i32, i32* %e
+define i32 @func16.alias1() {
+  %a = alloca [66 x i16]
+  %b = call [66 x i16]* @get16([66 x i16]* %a)
+  %c = getelementptr inbounds [66 x i16], [66 x i16]* %a, i8 0, i8 64
+  %d = getelementptr inbounds [66 x i16], [66 x i16]* %b, i8 0, i8 62
+  %e = bitcast i16* %c to i32*
+  %f = bitcast i16* %d to i32*
+  store i32 4, i32* %e
+  store i32 3, i32* %f
+  %x = load i32, i32* %e
+  ret i32 %x
+}
+
+; CHECK-LABEL: @func16.alias2()
+; CHECK: store i32 4, i32* %e
+; CHECK-NEXT: store i32 3, i32* %f
+; CHECK-NEXT: [[x:%.+]] = load i32, i32* %e
+define i32 @func16.alias2() {
+  %a = alloca [66 x i16]
+  %b = call [66 x i16]* @get16([66 x i16]* %a)
+  %c = getelementptr inbounds [66 x i16], [66 x i16]* %a, i8 0, i8 64
+  %d = getelementptr inbounds [66 x i16], [66 x i16]* %b, i8 0, i8 63
+  %e = bitcast i16* %c to i32*
+  %f = bitcast i16* %d to i32*
+  store i32 4, i32* %e
+  store i32 3, i32* %f
+  %x = load i32, i32* %e
+  ret i32 %x
+}
+
+declare [66 x i16]* @get16([66 x i16]*)

test/Analysis/BasicAA/pr34344.ll

+; RUN: opt < %s -basicaa -gvn -S | FileCheck %s --implicit-check-not=undef
+
+target datalayout = "p:8:8"
+
+%ty = type i8
+%arrty = type [130 x %ty]
+
+define void @foo()  {
+entry:
+  %array = alloca %arrty, align 1
+  br label %for.body
+
+for.body:                                         ; preds = %entry, %for.body
+  %i = phi %ty [ 0, %entry ], [ %inc, %for.body ]
+  %idx = zext %ty %i to i16
+  %addr = getelementptr inbounds %arrty, %arrty* %array, i16 0, i16 %idx
+  store %ty %i, %ty* %addr, align 1
+  %inc = add nuw %ty %i, 1
+  %exitcond = icmp ne %ty %inc, 130
+  br i1 %exitcond, label %for.body, label %for.cond.cleanup
+
+for.cond.cleanup:                                 ; preds = %for.body
+  %addr2 = getelementptr inbounds %arrty, %arrty* %array, i16 0, i16 129
+  %0 = load %ty, %ty* %addr2, align 1
+  tail call void @bar(%ty %0)
+  ret void
+}
+
+declare void @bar(%ty)