Index: lib/Transforms/IPO/GlobalOpt.cpp
===================================================================
--- lib/Transforms/IPO/GlobalOpt.cpp
+++ lib/Transforms/IPO/GlobalOpt.cpp
@@ -184,8 +184,7 @@
 /// This GV is a pointer root.  Loop over all users of the global and clean up
 /// any that obviously don't assign the global a value that isn't dynamically
 /// allocated.
-static bool CleanupPointerRootUsers(GlobalVariable *GV,
-                                    const TargetLibraryInfo *TLI) {
+static bool CleanupPointerRootUsers(Value *GV, const TargetLibraryInfo *TLI) {
   // A brief explanation of leak checkers.  The goal is to find bugs where
   // pointers are forgotten, causing an accumulating growth in memory
   // usage over time.  The common strategy for leak checkers is to whitelist the
@@ -232,6 +231,8 @@
           Dead.push_back(std::make_pair(I, MTI));
       }
     } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(U)) {
+      if (CE->getOpcode() == Instruction::GetElementPtr)
+        Changed |= CleanupPointerRootUsers(CE, TLI);
       if (CE->use_empty()) {
         CE->destroyConstant();
         Changed = true;
@@ -369,24 +370,6 @@
       !cast<Constant>(U->getOperand(1))->isNullValue())
     return false;
 
-  gep_type_iterator GEPI = gep_type_begin(U), E = gep_type_end(U);
-  ++GEPI; // Skip over the pointer index.
-
-  // For all other level we require that the indices are constant and inrange.
-  // In particular, consider: A[0][i].  We cannot know that the user isn't doing
-  // invalid things like allowing i to index an out-of-range subscript that
-  // accesses A[1]. This can also happen between different members of a struct
-  // in llvm IR.
-  for (; GEPI != E; ++GEPI) {
-    if (GEPI.isStruct())
-      continue;
-
-    ConstantInt *IdxVal = dyn_cast<ConstantInt>(GEPI.getOperand());
-    if (!IdxVal || (GEPI.isBoundedSequential() &&
-                    IdxVal->getZExtValue() >= GEPI.getSequentialNumElements()))
-      return false;
-  }
-
   return llvm::all_of(U->users(),
                       [](User *UU) { return isSafeSROAElementUse(UU); });
 }
@@ -416,12 +399,30 @@
 /// perform this transformation.
 static bool GlobalUsersSafeToSRA(GlobalValue *GV) {
   for (User *U : GV->users()) {
-    // The user of the global must be a GEP Inst or a ConstantExpr GEP.
-    if (!isa<GetElementPtrInst>(U) &&
-        (!isa<ConstantExpr>(U) ||
-        cast<ConstantExpr>(U)->getOpcode() != Instruction::GetElementPtr))
+    if (!isa<ConstantExpr>(U) ||
+        cast<ConstantExpr>(U)->getOpcode() != Instruction::GetElementPtr)
       return false;
 
+    // For the first level of this array value, we require that the indices
+    // are constant and inrange.
+    // In particular, consider: A[0][i].  We cannot know that the user isn't
+    // doing invalid things like allowing i to index an out-of-range
+    // subscript that accesses A[1].
+    if (isa<GetElementPtrInst>(U) && dyn_cast<ArrayType>(GV->getType())) {
+      gep_type_iterator GEPI = gep_type_begin(U), E = gep_type_end(U);
+      ++GEPI; // Skip over the pointer index.
+
+      for (; GEPI != E; ++GEPI) {
+        if (GEPI.isStruct())
+          continue;
+
+        ConstantInt *IdxVal = dyn_cast<ConstantInt>(GEPI.getOperand());
+        if (!IdxVal || (GEPI.isBoundedSequential() &&
+                        IdxVal->getZExtValue() >= GEPI.getSequentialNumElements()))
+          return false;
+      }
+    }
+
     // Check the gep and it's users are safe to SRA
     if (!isSafeSROAGEP(U))
       return false;
Index: test/Transforms/GlobalOpt/globalsra-ptr.ll
===================================================================
--- /dev/null
+++ test/Transforms/GlobalOpt/globalsra-ptr.ll
@@ -0,0 +1,18 @@
+; RUN: opt < %s -globalopt -S | FileCheck %s
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+%struct.Expr = type { [2 x i32], i32* }
+
+@e = internal unnamed_addr global [2 x %struct.Expr] zeroinitializer, align 16
+
+define dso_local i32* @foo(i32 %i) {
+entry:
+  store i32* inttoptr (i64 3 to i32*), i32** getelementptr inbounds ([2 x %struct.Expr], [2 x %struct.Expr]* @e, i64 0, i64 0, i32 1), align 8
+; CHECK-NOT: store i32* inttoptr (i64 3 to i32*), i32** getelementptr inbounds ([2 x %struct.Expr], [2 x %struct.Expr]* @e, i64 0, i64 0, i32 1), align 8
+  %idxprom = sext i32 %i to i64
+  %arrayidx = getelementptr inbounds [2 x %struct.Expr], [2 x %struct.Expr]* @e, i64 0, i64 0, i32 0, i64 %idxprom
+  store i32 2, i32* %arrayidx, align 4
+  ret i32* inttoptr (i64 3 to i32*)
+}
Index: test/Transforms/GlobalOpt/globalsra-struct.ll
===================================================================
--- /dev/null
+++ test/Transforms/GlobalOpt/globalsra-struct.ll
@@ -0,0 +1,23 @@
+; RUN: opt < %s -globalopt -S | FileCheck %s
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+%struct.Expr = type { [2 x i32], i32 }
+
+@e = internal unnamed_addr global %struct.Expr zeroinitializer, align 4
+
+define dso_local i32 @foo(i32 %i) {
+entry:
+ store i32 1, i32* getelementptr inbounds (%struct.Expr, %struct.Expr* @e, i32 0, i32 0, i64 1), align 4
+; Cannot remote the store because of the indexed GEP load below.
+; CHECK: store i32 1
+ store i32 2, i32* getelementptr inbounds (%struct.Expr, %struct.Expr* @e, i32 0, i32 1), align 4
+; This store doesn't conflict with the indexed GEP below
+; CHECK-NOT: store i32 2
+ %idxprom = sext i32 %i to i64
+ %arrayidx = getelementptr inbounds [2 x i32], [2 x i32]* getelementptr inbounds (%struct.Expr, %struct.Expr* @e, i32 0, i32 0), i64 0, i64 %idxprom
+ %0 = load i32, i32* %arrayidx, align 4
+ ret i32 %0
+}
+