[BasicAA] Fix zext & sext handling

[njw45]

Summary

There are several unhandled edge cases in BasicAA's GetLinearExpression method. This changes fixes outstanding issues, including zext / sext of a constant with the sign bit set, and the refusal to decompose zexts or sexts of wrapping arithmetic.

[njw45]

wip

[njw45]

wip

[njw45]

wip

[njw45]

wip

[njw45]

wip

[hfinkel]

I think this is moving in the right direction.

lib/Analysis/BasicAliasAnalysis.cpp

205

nsw -> NSW, nuw -> NUW as per the coding convention.

294

And, generally speaking, you should clang-format the patch.

1174

Can you move this into a separate function?

[njw45]

wip

[njw45]

Hi @hfinkel - I've made the fixes you suggested and have added a couple more comments. Thanks -

Nick

[hfinkel]

lib/Analysis/BasicAliasAnalysis.cpp

219

Why do we always zero-extend here? Why not sign extend? There should at least be a comment explaining this.

229

You might want to add "see below" or some other hint to where this happens.

294

this -> This

297

we -> We

[njw45]

wip

[njw45]

Thanks for the review, @hfinkel - I've updated the commit.

[hfinkel]

LGTM, thanks!

[njw45]

Sorry I dropped the ball on this - could you commit it for me as I still
don't have commit access? Thanks -

Nick

[sanjoy]

Some drop-by-comments inline in case you find them useful. I see this patch has been LGTM'ed so feel free to ignore. :)

lib/Analysis/BasicAliasAnalysis.cpp

294

I'm not sure I understand the comment -- this clause looks like it is implementing sext(sext(X,a),b) == sext(X, a + b).

299

Why is the .zextOrSelf(OldWidth) or the .trunc(SmallWidth) needed? Isn't OldWidth always equal to SmallWidth?

985

Do you mean i3? Additions in i8 are modulo 256.

989

Minor: APIntOps::umin may be clearer here.

[hfinkel]

In D6682#151887, @sanjoy wrote:

Some drop-by-comments inline in case you find them useful. I see this patch has been LGTM'ed so feel free to ignore. :)

No, that's not how things work. All comments need to be addressed. Pre- or post-commit.

In any case, this patch needs to be rebased because it no longer applies cleanly to trunk.

[njw45]

[BasicAA] Fix zext & sext handling

There are several unhandled edge cases in BasicAA's GetLinearExpression method. This changes fixes outstanding issues, including zext / sext of a constant with the sign bit set, and the refusal to decompose zexts or sexts of wrapping arithmetic.

[njw45]

@sanjoy - thanks for the review; bugs in this class are rather hard to track down as they only really manifest themselves in later optimisations, so more eyes are definitely appreciated :). I've replied to all your comments in-line - let me know if anything's not clear.

Nick

lib/Analysis/BasicAliasAnalysis.cpp

294

My latest commit adds more comments to make this clearer - does that explain it well enough?

299

This method can call itself recursively, and so the operator width reduces as we look through zexts + sexts, but the offset always stays at the initial width.

985

You're right - and I've added several unit tests prefixed "constantOffsetHeuristic_" to q.bad.ll to explore this behaviour (and to verify that I'm picking the right scales to multiply by in the heuristic).

989

Thanks - code reviews are one of the best ways to discover new utility functions in the codebase :)

[njw45]

Remove dead code left from testing

[njw45]

Hi Sanjoy - have you had a chance to look at this yet? Thanks -

Nick

[sanjoy]

lib/Analysis/BasicAliasAnalysis.cpp

271

Note that currently in the LangRef, shl nsw X, Y is not the same as mul nsw X (1 << Y), the LangRef has a bug in this regard. David has an out of tree patch to fix this http://reviews.llvm.org/D8890 but meanwhile you might want to not propagate nuw and nsw for shifts.

296

Very minor, but I think it will be clearer if you just add an annotation to each branch of the if statement:

if (is<SEXtInst>(V) && ZExtBits == 0) {
  // sext(sext(A)) == sext(A)

etc. instead of a comprehensive meta comment.

[njw45]

Address review comments

[njw45]

Hi @sanjoy - I've revised the patch to incorporate your suggestions. Is it OK now? Thanks -

Nick

lib/Analysis/BasicAliasAnalysis.cpp

271

That's interesting - I've added an early escape for the Shl that sets NSW & NUW to false in the latest version of this patch so they won't be propagated.

296

I've changed this in my latest revision of this patch.

[sanjoy]

LGTM, please check in.

[njw45]

Thanks @sanjoy - however I don't have commit rights to the repo so could you (or @hfinkel) commit it for me? Thanks -

Nick

[sanjoy]

I'll take care of it.

lib/Analysis/BasicAliasAnalysis.cpp

static bool isObjectSize(const Value *V, uint64_t Size,
   return ObjectSize != AliasAnalysis::UnknownSize && ObjectSize == Size;
 }
 
 //===----------------------------------------------------------------------===//
 // GetElementPtr Instruction Decomposition and Analysis
 //===----------------------------------------------------------------------===//
 
 namespace {
-  enum ExtensionKind {
-    EK_NotExtended,
-    EK_SignExt,
-    EK_ZeroExt
-  };
 
   struct VariableGEPIndex {
+    // An opaque Value - we can't decompose this further into Scale * V + Offset
     const Value *V;
-    ExtensionKind Extension;
+
+    // We need to track what extensions we've done as we consider the same Value
+    // with different extensions as different variables in a GEP's linear expression;
+    // e.g.: if V == -1, then sext(x) != zext(x).
+    unsigned ZExtBits;
+    unsigned SExtBits;
+
     int64_t Scale;
 
     bool operator==(const VariableGEPIndex &Other) const {
-      return V == Other.V && Extension == Other.Extension &&
+      return V == Other.V &&
+        ZExtBits == Other.ZExtBits &&
+        SExtBits == Other.SExtBits &&
         Scale == Other.Scale;
     }
 
     bool operator!=(const VariableGEPIndex &Other) const {
       return !operator==(Other);
     }
   };
 }
 
 
 /// GetLinearExpression - Analyze the specified value as a linear expression:
 /// "A*V + B", where A and B are constant integers.  Return the scale and offset
 /// values as APInts and return V as a Value*, and return whether we looked
 /// through any sign or zero extends.  The incoming Value is known to have
 /// IntegerType and it may already be sign or zero extended.
 ///
 /// Note that this looks through extends, so the high bits may not be
 /// represented in the result.
-static Value *GetLinearExpression(Value *V, APInt &Scale, APInt &Offset,
-                                  ExtensionKind &Extension,
+static const Value *GetLinearExpression(const Value *V, APInt &Scale, APInt &Offset,
+                                  unsigned &ZExtBits, unsigned &SExtBits,
                                   const DataLayout &DL, unsigned Depth,
                                   AssumptionTracker *AT,
-                                  DominatorTree *DT) {
+                                  DominatorTree *DT,
+                                  bool &nsw,
+                                  bool &nuw) {
   assert(V->getType()->isIntegerTy() && "Not an integer value");
 
   // Limit our recursion depth.
   if (Depth == 6) {
     Scale = 1;
     Offset = 0;
     return V;
   }
 
-  if (ConstantInt *Const = dyn_cast<ConstantInt>(V)) {
+  if (const ConstantInt *Const = dyn_cast<ConstantInt>(V)) {
     // if it's a constant, just convert it to an offset
     // and remove the variable.
-    Offset += Const->getValue();
+    Offset += Const->getValue().zextOrSelf(Offset.getBitWidth());
     assert(Scale == 0 && "Constant values don't have a scale");
     return V;
   }
 
-  if (BinaryOperator *BOp = dyn_cast<BinaryOperator>(V)) {
-    if (ConstantInt *RHSC = dyn_cast<ConstantInt>(BOp->getOperand(1))) {
+  if (const BinaryOperator *BOp = dyn_cast<BinaryOperator>(V)) {
+    if (const ConstantInt *RHSC = dyn_cast<ConstantInt>(BOp->getOperand(1))) {
+
+      // If we've been called recursively then Offset and Scale will be wider
+      // that the BOp operands. We'll always zext it here as we'll process sign
+      // extensions in the caller.
+      APInt RHS = RHSC->getValue().zextOrSelf(Offset.getBitWidth());
+
       switch (BOp->getOpcode()) {
-      default: break;
+      default:
+        // We don't understand this instruction, so we can't decompose it any
+        // further.
+        Scale = 1;
+        Offset = 0;
+        return V;
       case Instruction::Or:
         // X|C == X+C if all the bits in C are unset in X.  Otherwise we can't
         // analyze it.
         if (!MaskedValueIsZero(BOp->getOperand(0), RHSC->getValue(), &DL, 0,
                                AT, BOp, DT))
           break;
         // FALL THROUGH.
       case Instruction::Add:
-        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
-                                DL, Depth+1, AT, DT);
-        Offset += RHSC->getValue();
-        return V;
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, ZExtBits, SExtBits,
+                                DL, Depth+1, AT, DT, nsw, nuw);
+        Offset += RHS;
+        break;
+      case Instruction::Sub:
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, ZExtBits, SExtBits,
+                                DL, Depth+1, AT, DT, nsw, nuw);
+        Offset -= RHS;
+        break;
       case Instruction::Mul:
-        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
-                                DL, Depth+1, AT, DT);
-        Offset *= RHSC->getValue();
-        Scale *= RHSC->getValue();
-        return V;
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, ZExtBits, SExtBits,
+                                DL, Depth+1, AT, DT, nsw, nuw);
+        Offset *= RHS;
+        Scale *= RHS;
+        break;
       case Instruction::Shl:
-        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
-                                DL, Depth+1, AT, DT);
-        Offset <<= RHSC->getValue().getLimitedValue();
-        Scale <<= RHSC->getValue().getLimitedValue();
-        return V;
+        V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, ZExtBits, SExtBits,
+                                DL, Depth+1, AT, DT, nsw, nuw);
+        Offset <<= RHS.getLimitedValue();
+        Scale <<= RHS.getLimitedValue();
+        break;
       }
+
+      if(isa<OverflowingBinaryOperator>(BOp)) {
+        nuw &= BOp->hasNoUnsignedWrap();
+        nsw &= BOp->hasNoSignedWrap();
+      }
+      return V;
     }
   }
 
   // Since GEP indices are sign extended anyway, we don't care about the high
   // bits of a sign or zero extended value - just scales and offsets.  The
   // extensions have to be consistent though.
-  if ((isa<SExtInst>(V) && Extension != EK_ZeroExt) ||
-      (isa<ZExtInst>(V) && Extension != EK_SignExt)) {
+  if (isa<SExtInst>(V) || isa<ZExtInst>(V)) {
     Value *CastOp = cast<CastInst>(V)->getOperand(0);
     unsigned OldWidth = Scale.getBitWidth();
     unsigned SmallWidth = CastOp->getType()->getPrimitiveSizeInBits();
-    Scale = Scale.trunc(SmallWidth);
-    Offset = Offset.trunc(SmallWidth);
-    Extension = isa<SExtInst>(V) ? EK_SignExt : EK_ZeroExt;
-
-    Value *Result = GetLinearExpression(CastOp, Scale, Offset, Extension,
-                                        DL, Depth+1, AT, DT);
-    Scale = Scale.zext(OldWidth);
-
-    // We have to sign-extend even if Extension == EK_ZeroExt as we can't
-    // decompose a sign extension (i.e. zext(x - 1) != zext(x) - zext(-1)).
-    Offset = Offset.sext(OldWidth);
+    unsigned OldZExtBits = ZExtBits, OldSExtBits = SExtBits;
+    const Value *Result = GetLinearExpression(CastOp, Scale, Offset, ZExtBits, SExtBits,
+                                        DL, Depth+1, AT, DT, nsw, nuw);
+
+    // zext(zext(%x)) == zext(%x), and similiarly for sext, so we don't need
+    // to have consective duplicate ExtensionKinds in the Extensions vector.
+    unsigned ExtendedBy = OldWidth - SmallWidth;
+
+    if(isa<SExtInst>(V) && ZExtBits == 0) {
+      if(nsw) {
+        // we haven't sign-wrapped, so it's valid to decompose sext(%x + c)
+        // into sext(%x) + sext(c). We'll sext the Offset ourselves:
+        Offset = Offset.
+          trunc(SmallWidth).
+          sext(Offset.getBitWidth());
+      } else {
+        // We may have signed-wrapped, so don't decompose sext(%x + c) into sext(%x) + sext(c)
+        Scale = 1;
+        Offset = 0;
+        Result = CastOp;
+        ZExtBits = OldZExtBits;
+        SExtBits = OldSExtBits;
+      }
+      SExtBits += ExtendedBy;
+    } else {
+      if(!nuw) {
+        // We may have unsigned-wrapped, so don't decompose zext(%x + c) into zext(%x) + zext(c)
+        Scale = 1;
+        Offset = 0;
+        Result = CastOp;
+        ZExtBits = OldZExtBits;
+        SExtBits = OldSExtBits;
+      }
+      ZExtBits += ExtendedBy;
+    }
 
     return Result;
   }
 
   Scale = 1;
   Offset = 0;
   return V;
 }
if (!DL) {
       continue;
     }
 
     unsigned AS = GEPOp->getPointerAddressSpace();
     // Walk the indices of the GEP, accumulating them into BaseOff/VarIndices.
     gep_type_iterator GTI = gep_type_begin(GEPOp);
     for (User::const_op_iterator I = GEPOp->op_begin()+1,
          E = GEPOp->op_end(); I != E; ++I) {
-      Value *Index = *I;
+      const Value *Index = *I;
       // Compute the (potentially symbolic) offset in bytes for this index.
       if (StructType *STy = dyn_cast<StructType>(*GTI++)) {
         // For a struct, add the member offset.
         unsigned FieldNo = cast<ConstantInt>(Index)->getZExtValue();
         if (FieldNo == 0) continue;
 
         BaseOffs += DL->getStructLayout(STy)->getElementOffset(FieldNo);
         continue;
       }
 
       // For an array/pointer, add the element offset, explicitly scaled.
-      if (ConstantInt *CIdx = dyn_cast<ConstantInt>(Index)) {
+      if (const ConstantInt *CIdx = dyn_cast<ConstantInt>(Index)) {
         if (CIdx->isZero()) continue;
         BaseOffs += DL->getTypeAllocSize(*GTI)*CIdx->getSExtValue();
         continue;
       }
 
       uint64_t Scale = DL->getTypeAllocSize(*GTI);
-      ExtensionKind Extension = EK_NotExtended;
+      unsigned ZExtBits = 0, SExtBits = 0;
 
       // If the integer type is smaller than the pointer size, it is implicitly
       // sign extended to pointer size.
       unsigned Width = Index->getType()->getIntegerBitWidth();
-      if (DL->getPointerSizeInBits(AS) > Width)
-        Extension = EK_SignExt;
+      unsigned PointerSize = DL->getPointerSizeInBits(AS);
+      if (PointerSize > Width)
+        SExtBits += PointerSize - Width;
 
       // Use GetLinearExpression to decompose the index into a C1*V+C2 form.
       APInt IndexScale(Width, 0), IndexOffset(Width, 0);
-      Index = GetLinearExpression(Index, IndexScale, IndexOffset, Extension,
-                                  *DL, 0, AT, DT);
+      bool nsw = true, nuw = true;
+      Index = GetLinearExpression(Index, IndexScale, IndexOffset, ZExtBits, SExtBits,
+                                  *DL, 0, AT, DT, nsw, nuw);
 
       // The GEP index scale ("Scale") scales C1*V+C2, yielding (C1*V+C2)*Scale.
       // This gives us an aggregate computation of (C1*Scale)*V + C2*Scale.
       BaseOffs += IndexOffset.getSExtValue()*Scale;
       Scale *= IndexScale.getSExtValue();
 
       // If we already had an occurrence of this index variable, merge this
       // scale into it.  For example, we want to handle:
       //   A[x][x] -> x*16 + x*4 -> x*20
       // This also ensures that 'x' only appears in the index list once.
       for (unsigned i = 0, e = VarIndices.size(); i != e; ++i) {
         if (VarIndices[i].V == Index &&
-            VarIndices[i].Extension == Extension) {
+            VarIndices[i].ZExtBits == ZExtBits &&
+            VarIndices[i].SExtBits == SExtBits) {
           Scale += VarIndices[i].Scale;
           VarIndices.erase(VarIndices.begin()+i);
           break;
         }
       }
 
       // Make sure that we have a scale that makes sense for this target's
       // pointer size.
-      if (unsigned ShiftBits = 64 - DL->getPointerSizeInBits(AS)) {
+      if (unsigned ShiftBits = 64 - PointerSize) {
         Scale <<= ShiftBits;
         Scale = (int64_t)Scale >> ShiftBits;
       }
 
       if (Scale) {
-        VariableGEPIndex Entry = {Index, Extension,
+        VariableGEPIndex Entry = {Index, ZExtBits, SExtBits,
                                   static_cast<int64_t>(Scale)};
         VarIndices.push_back(Entry);
       }
     }
 
     // Analyze the base pointer next.
     V = GEPOp->getOperand(0);
   } while (--MaxLookup);
if (const GEPOperator *GEP2 = dyn_cast<GEPOperator>(V2)) {
     if ((BaseAlias == MayAlias) && V1Size == V2Size) {
       // Do the base pointers alias assuming type and size.
       AliasResult PreciseBaseAlias = aliasCheck(UnderlyingV1, V1Size,
                                                 V1AAInfo, UnderlyingV2,
                                                 V2Size, V2AAInfo);
       if (PreciseBaseAlias == NoAlias) {
         // See if the computed offset from the common pointer tells us about the
         // relation of the resulting pointer.
         int64_t GEP2BaseOffset;
         bool GEP2MaxLookupReached;
         SmallVector<VariableGEPIndex, 4> GEP2VariableIndices;
         const Value *GEP2BasePtr =
           DecomposeGEPExpression(GEP2, GEP2BaseOffset, GEP2VariableIndices,
                                  GEP2MaxLookupReached, DL, AT, DT);
         const Value *GEP1BasePtr =
           DecomposeGEPExpression(GEP1, GEP1BaseOffset, GEP1VariableIndices,
                                  GEP1MaxLookupReached, DL, AT, DT);
         // DecomposeGEPExpression and GetUnderlyingObject should return the
         // same result except when DecomposeGEPExpression has no DataLayout.
         if (GEP1BasePtr != UnderlyingV1 || GEP2BasePtr != UnderlyingV2) {
           assert(!DL &&
for (unsigned i = 0, e = GEP1VariableIndices.size(); i != e; ++i) {
         bool SignKnownZero, SignKnownOne;
         ComputeSignBit(
           const_cast<Value *>(V),
           SignKnownZero, SignKnownOne,
           DL, 0, AT, nullptr, DT);
 
         // Zero-extension widens the variable, and so forces the sign
         // bit to zero.
-        bool IsZExt = GEP1VariableIndices[i].Extension == EK_ZeroExt;
+        bool IsZExt =  GEP1VariableIndices[i].ZExtBits > 0 || isa<ZExtInst>(V);
         SignKnownZero |= IsZExt;
         SignKnownOne &= !IsZExt;
 
         // If the variable begins with a zero then we know it's
         // positive, regardless of whether the value is signed or
         // unsigned.
         int64_t Scale = GEP1VariableIndices[i].Scale;
         AllPositive =
if (V1Size != UnknownSize && V2Size != UnknownSize &&
         ModOffset >= V2Size && V1Size <= Modulo - ModOffset)
       return NoAlias;
 
     // If we know all the variables are positive, then GEP1 >= GEP1BasePtr.
     // If GEP1BasePtr > V2 (GEP1BaseOffset > 0) then we know the pointers
     // don't alias if V2Size can fit in the gap between V2 and GEP1BasePtr.
     if (AllPositive && GEP1BaseOffset > 0 && V2Size <= (uint64_t) GEP1BaseOffset)
       return NoAlias;
+
+    // GetLinearExpression has some limitations, as generally zext(%x + 1)
+    // != zext(%x) + zext(1) if the arithmetic overflows. GetLinearExpression
+    // will therefore conservatively refuse to decompose these expressions.
+    // However, we know that, for all %x, zext(%x) != zext(%x + 1), even if
+    // the addition overflows.
+    if (GEP1VariableIndices.size() == 2
+    && V1Size != UnknownSize
+    && V2Size != UnknownSize)
+    {
+      VariableGEPIndex
+        &Var0 = GEP1VariableIndices[0],
+        &Var1 = GEP1VariableIndices[1];
+
+      if (Var0.ZExtBits == Var1.ZExtBits
+      && Var0.SExtBits == Var1.SExtBits
+      && Var0.Scale == -Var1.Scale)
+      {
+        unsigned Width = Var1.V->getType()->getIntegerBitWidth();
+
+        // We'll strip off the Extensions of Var0 and Var1 and do another round
+        // of GetLinearExpression decomposition. In the example above, if Var0 is
+        // zext(%x + 1) we should get V1 == %x and V1Offset == 1.
+
+        APInt V0Scale(Width, 0), V0Offset(Width, 0), V1Scale(Width, 0), V1Offset(Width, 0);
+        bool nsw = true, nuw = true;
+        unsigned V0ZExtBits = 0, V0SExtBits = 0, V1ZExtBits = 0, V1SExtBits = 0;
+        const Value *V0 = GetLinearExpression(Var0.V, V0Scale, V0Offset, V0ZExtBits, V0SExtBits,
+                                *DL, 0, AT, DT, nsw, nuw);
+        nsw = true, nuw = true;
+        const Value *V1 = GetLinearExpression(Var1.V, V1Scale, V1Offset, V1ZExtBits, V1SExtBits,
+                                *DL, 0, AT, DT, nsw, nuw);
+
+        if (isValueEqualInPotentialCycles(V0, V1)
+        && V0Scale == V1Scale
+        && V0ZExtBits == V1ZExtBits
+        && V0SExtBits == V1SExtBits)
+        {
+          // We have a hit - Var0 and Var1 only differ by a constant offset!
+
+          // If we've been sext'ed then zext'd the maximum difference between Var0 and Var1
+          // is possible to calculate, but we're just interested in the absolute minumum
+          // difference between the two. The minimum distance may occur due to wrapping;
+          // consider "add i8 %i, 5": if %i == 7 then 7 + 5 mod 8 == 4, and so the minimum
+          // distance between %i and %i + 5 is 3.
+          APInt
+            MinDiff = V0Offset - V1Offset,
+            Wrapped = APInt::getMaxValue(Width) - MinDiff + APInt(Width, 1);
+          if (Wrapped.ule(MinDiff))
+            MinDiff = Wrapped;
+          uint64_t MinDiffBytes = MinDiff.getZExtValue() * std::abs(Var0.Scale);
+
+          // We can't definitely say whether GEP1 is before or after V2 due to wrapping
+          // arithmetic (i.e. for some values of GEP1 and V2 GEP1 < V2, and for other
+          // values GEP1 > V2). We'll therefore only declare NoAlias if both V1Size and
+          // V2Size can fit in the MinDiffBytes gap.
+          if (V1Size + std::abs(GEP1BaseOffset) <= MinDiffBytes
+          && V2Size + std::abs(GEP1BaseOffset) <= MinDiffBytes)
+            return NoAlias;
+        }
+      }
+    }
   }
 
   // Statically, we can see that the base objects are the same, but the
   // pointers have dynamic offsets which we can't resolve. And none of our
   // little tricks above worked.
   //
   // TODO: Returning PartialAlias instead of MayAlias is a mild hack; the
   // practical effect of this is protecting TBAA in the case of dynamic
BasicAliasAnalysis::aliasCheck(const Value *V1, uint64_t V1Size,
 
   // Strip off any casts if they exist.
   V1 = V1->stripPointerCasts();
   V2 = V2->stripPointerCasts();
 
   // Are we checking for alias of the same value?
   // Because we look 'through' phi nodes we could look at "Value" pointers from
   // different iterations. We must therefore make sure that this is not the
-  // case. The function isValueEqualInPotentialCycles ensures that this cannot
+  // case. The function inPotentialCycle ensures that this cannot
   // happen by looking at the visited phi nodes and making sure they cannot
   // reach the value.
   if (isValueEqualInPotentialCycles(V1, V2))
     return MustAlias;
 
   if (!V1->getType()->isPointerTy() || !V2->getType()->isPointerTy())
     return NoAlias;  // Scalars cannot alias each other
 

 void BasicAliasAnalysis::GetIndexDifference(
     SmallVectorImpl<VariableGEPIndex> &Dest,
     const SmallVectorImpl<VariableGEPIndex> &Src) {
   if (Src.empty())
     return;
 
   for (unsigned i = 0, e = Src.size(); i != e; ++i) {
     const Value *V = Src[i].V;
-    ExtensionKind Extension = Src[i].Extension;
+    unsigned ZExtBits = Src[i].ZExtBits, SExtBits = Src[i].SExtBits;
     int64_t Scale = Src[i].Scale;
 
     // Find V in Dest.  This is N^2, but pointer indices almost never have more
     // than a few variable indexes.
     for (unsigned j = 0, e = Dest.size(); j != e; ++j) {
       if (!isValueEqualInPotentialCycles(Dest[j].V, V) ||
-          Dest[j].Extension != Extension)
+          Dest[j].ZExtBits != ZExtBits ||
+          Dest[j].SExtBits != SExtBits)
         continue;
 
       // If we found it, subtract off Scale V's from the entry in Dest.  If it
       // goes to zero, remove the entry.
       if (Dest[j].Scale != Scale)
         Dest[j].Scale -= Scale;
       else
         Dest.erase(Dest.begin() + j);
       Scale = 0;
       break;
     }
 
     // If we didn't consume this entry, add it to the end of the Dest list.
     if (Scale) {
-      VariableGEPIndex Entry = { V, Extension, -Scale };
+      VariableGEPIndex Entry = { V, ZExtBits, SExtBits, -Scale };
       Dest.push_back(Entry);
     }
   }
 }

test/Analysis/BasicAA/q.bad.ll

+; RUN: opt < %s -basicaa -aa-eval -print-all-alias-modref-info -disable-output 2>&1 | FileCheck %s
+target datalayout = "e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv7--linux-gnueabi"
+
+; CHECK-LABEL: based_on_pr18068
+; CHECK: NoAlias: i8* %a, i8* %b
+; CHECK: NoAlias: i8* %a, i8* %c
+define void @based_on_pr18068(i32 %loaded, i8* %mem) {
+  %loaded.64 = zext i32 %loaded to i64
+  %add1 = add i32 %loaded, -1 ; unsigned wraps unless %loaded == 0
+  %add1.64 = zext i32 %add1 to i64 ; is zext(%loaded) always != zext(%loaded - 1)? Yes -> NoAlias
+  %sub1 = sub i32 %loaded, 1 ; unsigned wraps iff %loaded == 0
+  %sub1.64 = zext i32 %sub1 to i64 ; is zext(%loaded) always != zext(%loaded - 1)? Yes -> NoAlias
+  %a = getelementptr inbounds i8* %mem, i64 %loaded.64
+  %b = getelementptr inbounds i8* %mem, i64 %add1.64
+  %c = getelementptr inbounds i8* %mem, i64 %sub1.64
+  ret void
+}
+
+; CHECK-LABEL: test_path_dependence
+; CHECK: PartialAlias: i8* %a, i8* %b
+; CHECK: MustAlias: i8* %a, i8* %c
+; CHECK: PartialAlias: i8* %a, i8* %d
+define void @test_path_dependence(i32 %p, i8* %mem) {
+  %p.minus1 = add i32 %p, -1 ; this will always unsigned-wrap, unless %p == 0
+  %p.minus1.64 = zext i32 %p.minus1 to i64
+  %p.64.again = add i64 %p.minus1.64, 1 ; either %p (if we wrapped) or 4294967296 (if we didn't)
+
+  %p.nsw.nuw.minus1 = sub nsw nuw i32 %p, 1 ; as nuw we know %p >= 1, and as nsw %p <=   2147483647
+  %p.nsw.nuw.minus1.64 = zext i32 %p.nsw.nuw.minus1 to i64
+  %p.nsw.nuw.64.again = add nsw nuw i64 %p.nsw.nuw.minus1.64, 1 ; ...so always exactly %p
+
+  %p.nsw.minus1 = sub nsw i32 %p, 1 ; only nsw, so can only guarantee %p != 0x10000000
+  %p.nsw.minus1.64 = zext i32 %p.nsw.minus1 to i64 ; when %p > 0x10000000 (ie <= 0 as a signed number) then the zext will make this a huge positive number
+  %p.nsw.64.again = add nsw i64 %p.nsw.minus1.64, 1 ; ...and so this is very much != %p
+
+  %p.64 = zext i32 %p to i64
+  %a = getelementptr inbounds i8* %mem, i64 %p.64
+  %b = getelementptr inbounds i8* %mem, i64 %p.64.again
+  %c = getelementptr inbounds i8* %mem, i64 %p.nsw.nuw.64.again
+  %d = getelementptr inbounds i8* %mem, i64 %p.nsw.64.again
+  ret void
+}
+
+; CHECK-LABEL: test_zext_sext_255
+; CHECK: NoAlias: i8* %a, i8* %b
+define void @test_zext_sext_255(i8* %mem) {
+  %zext.255 = zext i8 255 to i16 ; 0x00FF
+  %sext.255 = sext i8 255 to i16 ; 0xFFFF
+  %zext.sext.255 = zext i16 %sext.255 to i32 ; 0x0000FFFF
+  %sext.zext.255 = sext i16 %zext.255 to i32 ; 0x000000FF
+  %zext.zext.sext.255 = zext i32 %zext.sext.255 to i64
+  %zext.sext.zext.255 = zext i32 %sext.zext.255 to i64
+  %a = getelementptr inbounds i8* %mem, i64 %zext.zext.sext.255
+  %b = getelementptr inbounds i8* %mem, i64 %zext.sext.zext.255
+  ret void
+}
+
+; CHECK-LABEL: test_zext_sext_num
+; CHECK: PartialAlias: i8* %a, i8* %b
+; %a and %b NoAlias if %num == 255 (see @test_zext_sext_255), but %a and %b NoAlias for other values of %num (e.g. 0)
+define void @test_zext_sext_num(i8* %mem, i8 %num) {
+  %zext.num = zext i8 %num to i16
+  %sext.num = sext i8 %num to i16
+  %zext.sext.num = zext i16 %sext.num to i32
+  %sext.zext.num = sext i16 %zext.num to i32
+  %zext.zext.sext.num = zext i32 %zext.sext.num to i64
+  %zext.sext.zext.num = zext i32 %sext.zext.num to i64
+  %a = getelementptr inbounds i8* %mem, i64 %zext.zext.sext.num
+  %b = getelementptr inbounds i8* %mem, i64 %zext.sext.zext.num
+  ret void
+}
+
+; CHECK-LABEL: test_zext_sext_amounts
+; CHECK: PartialAlias: i8* %a, i8* %b
+; %a and %b only PartialAlias as, although they're both zext(sext(%num)) they'll extend the sign by a different
+; number of bits before zext-ing the remainder.
+define void @test_zext_sext_amounts(i8* %mem, i8 %num) {
+  %sext.1 = sext i8 %num to i16
+  %sext.zext.1 = zext i16 %sext.1 to i64
+  %sext.2 = sext i8 %num to i32
+  %sext.zext.2 = zext i32 %sext.2 to i64
+  %a = getelementptr inbounds i8* %mem, i64 %sext.zext.1
+  %b = getelementptr inbounds i8* %mem, i64 %sext.zext.2
+  ret void
+}
+
+; CHECK-LABEL: uncompressStream
+; CHECK: MustAlias:  i8* %a, i8* %b
+; CHECK: NoAlias:  i8* %a, i8* %c
+define void @uncompressStream(i8* %mem) {
+  %zext.255 = zext i8 255 to i32
+  %sext.255 = sext i8 255 to i32
+  %a = getelementptr inbounds i8* %mem, i32 255
+  %b = getelementptr inbounds i8* %mem, i32 %zext.255
+  %c = getelementptr inbounds i8* %mem, i32 %sext.255
+  ret void
+}