Skip promotable allocas to improve performance at -O0

[zaks.anna]

Summary

Currently, the ASan executables built with -O0 are unnecessarily slow. The main reason is that ASan instrumentation pass inserts redundant checks around promotable allocas. These allocas do not get instrumented under -O1 because they get converted to virtual registered by mem2reg. With this patch, ASan instrumentation pass will only instrument non promotable allocas, giving us a speedup of 39% on a collection of benchmarks with -O0. (There is no measurable speedup at -O1.)

Comments/Questions:

• We've initially discussed creating another pass to annotate the uninteresting load and stores. However, the check is simple and having a separate pass seems like an overkill.
• A bunch of ASan llvm tests are written using promotable allocas. I've added volatile stores or marked the existing stores as volatile to make the allocas non-promotable.
• Two of the runtime tests also seem to depend on being run with -O0. With this modification, I am getting the same behavior as when the tests are run with higher optimization levels. I've turned off the mode on those tests since I am not sure if a better fix is available. They fail on comparing values returned by __asan_region_is_poisoned.
• Should "isInterestingAlloca()" be hoisted out of "FunctionStackPoisoner" and used in "isInterestingMemoryAccess"?

[samsonov]

Overall, this looks good.

A bunch of ASan llvm tests are written using promotable allocas. I've added volatile stores or marked the existing stores as volatile to make the allocas non-promotable.

I'm OK with that

Two of the runtime tests also seem to depend on being run with -O0. With this modification, I am getting the same behavior as when the tests are run with higher optimization levels. I've turned off the mode on those tests since I am not sure if a better fix is available. They fail on comparing values returned by __asan_region_is_poisoned.

Now, this part is interesting. Looks like these tests are failing right now, if we increase optimization level from -O0. I'd say, we should better make these tests more robust instead - if we will force the necessary stack layout there on higher optimization levels, they would work fine after landing this patch as well.

Should "isInterestingAlloca()" be hoisted out of "FunctionStackPoisoner" and used in "isInterestingMemoryAccess"?

Yes, I think it's fine to skip instrumenting memory accesses to "uninteresting" allocas that don't have redzones around them.

[kcc]

Dmitry was digging somewhere nearby. Just FYI

[kcc]

With this patch, ASan instrumentation pass will only instrument non promotable allocas, giving us a speedup of 39% on a collection of benchmarks with -O0

I wonder, what if we apply this only to those allocas that are indexed with constants?
I.e. only if we can statically prove the correctness of access.
See also Dmitry's http://reviews.llvm.org/D7583

[dvyukov]

Smart people, while you are here I would like to ask you to look at:
http://reviews.llvm.org/D7583
It is somewhat similar to this change. I want to eliminate
instrumentation of locals within its lifetime (so it is not a
use-after-scope) and that is known to be inbounds (that is, direct
accesses, field accesses and array element accesses with constant
indices; so it is not a out-of-bounds).
By experimentation I found that both isGEPWithNoNotionalOverIndexing
and stripInBoundsConstantOffsets don't do what I want.
isGEPWithNoNotionalOverIndexing does not eliminate enough of
unnecessary instrumentation. While stripInBoundsConstantOffsets
eliminates a bit more than necessary.
Thanks in advance!

[kcc]

Anna, can you repeat your measurements with Dmitry's D7583?
If it gives speedup close to your 39%, we should go this way (but first, implement it properly, of course)

[zaks.anna]

The purpose of this patch is to only remove checks for accesses that are known to be safe. All array accesses are still getting checked. For example, in the following code snippet, only stores/loads to idx will not be checked:
char test_promotable_allocas() {

char r[3];
char a[3];
int idx = 10;
a[10] = 0;
r[idx] = 10;
return a[10] + r[idx];

}

Here is the relevant code from isAllocaPromotable:
else if (const GetElementPtrInst *GEPI = dyn_cast<GetElementPtrInst>(U)) {

if (GEPI->getType() != Type::getInt8PtrTy(U->getContext(), AS))
  return false;
if (!GEPI->hasAllZeroIndices())
  return false;
if (!onlyUsedByLifetimeMarkers(GEPI))
  return false;

On Thu, Feb 19, 2015 at 6:59 PM, Chandler Carruth <[e-mail]> wrote:

I don't really like this approach because it will introduce false negatives. We have even been helped in >debugging "miscompiles" of incorrect code by running asan at -O0 to point out where the stack variables.

Chandler, are there specific cases you are worried about here? False negatives are possible at higher optimization levels (and your proposed approach to solve them sounds reasonable); with this patch, I am not trying to get parity with -O1, but just reduce the number of unnecessary checks.

Sorry for the delayed response - I was on vacation late last week.

[kcc]

Indeed, Chandler, I actually don't see why this could lead to false positives? What do we miss?

lib/Transforms/Instrumentation/AddressSanitizer.cpp

803–804

You will now execute all other if statements even if the first one is true. At leats change the following ifs to "else if", or preserve the structure with 'return' and have another function that checks isAllocaPromotable

826

exchange the order of ifs?

[zaks.anna]

I've addressed the outstanding comments:

• Refactored the code to reuse isInterestingAlloca() from within isInterestingMemoryAccess().
• Addressed Kostya's latest comments about "if" re-structuring as well.
• Kuba is helping out by modifying the compiler-rt tests so that they are not sensitive to optimization levels :)

Kostya,
As I've commented on the other thread, I don't think http://reviews.llvm.org/D7583 is currently doing the right thing (skipping "inbounds" geps). Though, I do believe we can achieve optimizations by building on top of this and excluding allocas that only have constant and provably in bounds accesses.

[kcc]

LGTM

[zaks.anna]

Committed in r230724.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

 #include "llvm/Support/Endian.h"
 #include "llvm/Support/SwapByteOrder.h"
 #include "llvm/Transforms/Scalar.h"
 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
 #include "llvm/Transforms/Utils/Cloning.h"
 #include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
+#include "llvm/Transforms/Utils/PromoteMemToReg.h"
 #include <algorithm>
 #include <string>
 #include <system_error>
 
 using namespace llvm;
 
 #define DEBUG_TYPE "asan"
 
"asan-instrumentation-with-call-threshold",
                 "inline checks (-1 means never use callbacks)."),
        cl::Hidden, cl::init(7000));
 static cl::opt<std::string> ClMemoryAccessCallbackPrefix(
        "asan-memory-access-callback-prefix",
        cl::desc("Prefix for memory access callbacks"), cl::Hidden,
        cl::init("__asan_"));
 static cl::opt<bool> ClInstrumentAllocas("asan-instrument-allocas",
        cl::desc("instrument dynamic allocas"), cl::Hidden, cl::init(false));
+static cl::opt<bool> ClSkipPromotableAllocas("asan-skip-promotable-allocas",
+       cl::desc("Do not instrument promotable allocas"),
+       cl::Hidden, cl::init(true));
 
 // These flags allow to change the shadow mapping.
 // The shadow mapping looks like
 //    Shadow = (Mem >> scale) + (1 << offset_log)
 static cl::opt<int> ClMappingScale("asan-mapping-scale",
        cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0));
 
 // Optimization flags. Not user visible, used mostly for testing
AddressSanitizer() : FunctionPass(ID) {
     initializeAddressSanitizerPass(*PassRegistry::getPassRegistry());
   }
   const char *getPassName() const override {
     return "AddressSanitizerFunctionPass";
   }
   void getAnalysisUsage(AnalysisUsage &AU) const override {
     AU.addRequired<DominatorTreeWrapperPass>();
   }
+  uint64_t getAllocaSizeInBytes(AllocaInst *AI) const {
+    Type *Ty = AI->getAllocatedType();
+    uint64_t SizeInBytes = DL->getTypeAllocSize(Ty);
+    return SizeInBytes;
+  }
+  /// Check if we want (and can) handle this alloca.
+  bool isInterestingAlloca(AllocaInst &AI) const;
+  /// If it is an interesting memory access, return the PointerOperand
+  /// and set IsWrite/Alignment. Otherwise return nullptr.
+  Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite,
+                                   unsigned *Alignment) const;
   void instrumentMop(Instruction *I, bool UseCalls);
   void instrumentPointerComparisonOrSubtraction(Instruction *I);
   void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
                          Value *Addr, uint32_t TypeSize, bool IsWrite,
                          Value *SizeArgument, bool UseCalls);
   Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
                            Value *ShadowValue, uint32_t TypeSize);
   Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
   // (1) Left redzone with kAsanAllocaLeftMagic.
   // (2) Partial redzone with the value, computed in runtime by
   //     computePartialRzMagic function.
   // (3) Right redzone with kAsanAllocaRightMagic.
   void handleDynamicAllocaCall(DynamicAllocaCall &AllocaCall);
 
   /// \brief Collect Alloca instructions we want (and can) handle.
   void visitAllocaInst(AllocaInst &AI) {
-    if (!isInterestingAlloca(AI)) return;
+    if (!ASan.isInterestingAlloca(AI)) return;
 
     StackAlignment = std::max(StackAlignment, AI.getAlignment());
     if (isDynamicAlloca(AI))
       DynamicAllocaVec.push_back(DynamicAllocaCall(&AI));
     else
       AllocaVec.push_back(&AI);
   }
 
for (auto Ret : RetVec) {
         return false;
     }
     return true;
   }
 
   bool isDynamicAlloca(AllocaInst &AI) const {
     return AI.isArrayAllocation() || !AI.isStaticAlloca();
   }
-
-  // Check if we want (and can) handle this alloca.
-  bool isInterestingAlloca(AllocaInst &AI) const {
-    return (AI.getAllocatedType()->isSized() &&
-            // alloca() may be called with 0 size, ignore it.
-            getAllocaSizeInBytes(&AI) > 0);
-  }
-
-  uint64_t getAllocaSizeInBytes(AllocaInst *AI) const {
-    Type *Ty = AI->getAllocatedType();
-    uint64_t SizeInBytes = ASan.DL->getTypeAllocSize(Ty);
-    return SizeInBytes;
-  }
   /// Finds alloca where the value comes from.
   AllocaInst *findAllocaForValue(Value *V);
   void poisonRedZones(ArrayRef<uint8_t> ShadowBytes, IRBuilder<> &IRB,
                       Value *ShadowBase, bool DoPoison);
   void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison);
 
   void SetShadowToStackAfterReturnInlined(IRBuilder<> &IRB, Value *ShadowBase,
                                           int Size);
IRB.CreateCall3(
         AsanMemset,
         IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
         IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false),
         IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false));
   }
   MI->eraseFromParent();
 }
 
-// If I is an interesting memory access, return the PointerOperand
-// and set IsWrite/Alignment. Otherwise return nullptr.
-static Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite,
-                                        unsigned *Alignment) {
+/// Check if we want (and can) handle this alloca.
+bool AddressSanitizer::isInterestingAlloca(AllocaInst &AI) const {
+  return (AI.getAllocatedType()->isSized() &&
+          // alloca() may be called with 0 size, ignore it.
+          getAllocaSizeInBytes(&AI) > 0 &&
+          // We are only interested in allocas not promotable to registers.
+          // Promotable allocas are common under -O0.
+          (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)));
+}
+
+/// If I is an interesting memory access, return the PointerOperand
+/// and set IsWrite/Alignment. Otherwise return nullptr.
+Value *AddressSanitizer::isInterestingMemoryAccess(Instruction *I,
+                                                   bool *IsWrite,
+                                                   unsigned *Alignment) const {
   // Skip memory accesses inserted by another instrumentation.
   if (I->getMetadata("nosanitize"))
     return nullptr;
+
+  Value *PtrOperand = nullptr;
   if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
     if (!ClInstrumentReads) return nullptr;
     *IsWrite = false;
     *Alignment = LI->getAlignment();
-    return LI->getPointerOperand();
-  }
-  if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
+    PtrOperand = LI->getPointerOperand();
+  } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
     if (!ClInstrumentWrites) return nullptr;
     *IsWrite = true;
     *Alignment = SI->getAlignment();
-    return SI->getPointerOperand();
-  }
-  if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
+    PtrOperand = SI->getPointerOperand();
+  } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
     if (!ClInstrumentAtomics) return nullptr;
     *IsWrite = true;
     *Alignment = 0;
-    return RMW->getPointerOperand();
-  }
-  if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
+    PtrOperand = RMW->getPointerOperand();
+  } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
     if (!ClInstrumentAtomics) return nullptr;
     *IsWrite = true;
     *Alignment = 0;
-    return XCHG->getPointerOperand();
+    PtrOperand = XCHG->getPointerOperand();
   }
-  return nullptr;
+
+  // Treat memory accesses to promotable allocas as non-interesting since they
+  // are not likely to cause memory violations. This greatly speeds up
+  // the instrumented executable at -O0.
+  if (ClSkipPromotableAllocas)
+    if (auto AI = dyn_cast_or_null<AllocaInst>(PtrOperand))
+      return isInterestingAlloca(*AI) ? AI : nullptr;
+
+  return PtrOperand;
 }
 
 static bool isPointerOperand(Value *V) {
   return V->getType()->isPointerTy() || isa<PtrToIntInst>(V);
 }
 
 // This is a rough heuristic; it may cause both false positives and
 // false negatives. The proper implementation requires cooperation with
void FunctionStackPoisoner::poisonStack() {
   Instruction *InsBefore = AllocaVec[0];
   IRBuilder<> IRB(InsBefore);
   IRB.SetCurrentDebugLocation(EntryDebugLocation);
 
   SmallVector<ASanStackVariableDescription, 16> SVD;
   SVD.reserve(AllocaVec.size());
   for (AllocaInst *AI : AllocaVec) {
     ASanStackVariableDescription D = { AI->getName().data(),
-                                   getAllocaSizeInBytes(AI),
+                                   ASan.getAllocaSizeInBytes(AI),
                                    AI->getAlignment(), AI, 0};
     SVD.push_back(D);
   }
   // Minimal header size (left redzone) is 4 pointers,
   // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms.
   size_t MinHeaderSize = ASan.LongSize / 2;
   ASanStackFrameLayout L;
   ComputeASanStackFrameLayout(SVD, 1UL << Mapping.Scale, MinHeaderSize, &L);

 //     could be poisoned by previous llvm.lifetime.end instruction, as the
 //     variable may go in and out of scope several times, e.g. in loops).
 // (3) if we poisoned at least one %alloca in a function,
 //     unpoison the whole stack frame at function exit.
 
 AllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) {
   if (AllocaInst *AI = dyn_cast<AllocaInst>(V))
     // We're intested only in allocas we can handle.
-    return isInterestingAlloca(*AI) ? AI : nullptr;
+    return ASan.isInterestingAlloca(*AI) ? AI : nullptr;
   // See if we've already calculated (or started to calculate) alloca for a
   // given value.
   AllocaForValueMapTy::iterator I = AllocaForValue.find(V);
   if (I != AllocaForValue.end())
     return I->second;
   // Store 0 while we're calculating alloca for value V to avoid
   // infinite recursion if the value references itself.
   AllocaForValue[V] = nullptr;

test/Instrumentation/AddressSanitizer/debug_info.ll

 ; RUN: opt < %s -asan -asan-module -asan-use-after-return=0 -S | FileCheck %s
 
 ; Checks that llvm.dbg.declare instructions are updated 
 ; accordingly as we merge allocas.
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 define i32 @_Z3zzzi(i32 %p) nounwind uwtable sanitize_address {
 entry:
   %p.addr = alloca i32, align 4
   %r = alloca i32, align 4
-  store i32 %p, i32* %p.addr, align 4
+  store volatile i32 %p, i32* %p.addr, align 4
   call void @llvm.dbg.declare(metadata i32* %p.addr, metadata !10, metadata !{!"0x102"}), !dbg !11
   call void @llvm.dbg.declare(metadata i32* %r, metadata !12, metadata !{!"0x102"}), !dbg !14
   %0 = load i32* %p.addr, align 4, !dbg !14
   %add = add nsw i32 %0, 1, !dbg !14
-  store i32 %add, i32* %r, align 4, !dbg !14
+  store volatile i32 %add, i32* %r, align 4, !dbg !14
   %1 = load i32* %r, align 4, !dbg !15
   ret i32 %1, !dbg !15
 }
 
 ;   CHECK: define i32 @_Z3zzzi
 ;   CHECK: entry:
 ; Verify that llvm.dbg.declare calls are in the entry basic block.
 ;   CHECK-NOT: %entry

test/Instrumentation/AddressSanitizer/do-not-instrument-promotable-allocas.ll

+; RUN: opt < %s -asan -asan-module -asan-instrument-allocas=1 -S | FileCheck %s --check-prefix=CHECK
+
+target datalayout = "e-m:o-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-apple-macosx10.10.0"
+
+define i32 @test_promotable_allocas() sanitize_address {
+entry:
+; CHECK: %0 = alloca i32, align 4
+; CHECK: store i32 0, i32* %0, align 4
+; CHECK: %1 = load i32* %0, align 4
+; CHECK: ret i32 %1
+
+; CHECK-NOT: __asan_stack_malloc_0
+; CHECK-NOT: icmp
+; CHECK-NOT: call void @__asan_report_store4
+
+  %0 = alloca i32, align 4
+  store i32 0, i32* %0, align 4
+  %1 = load i32* %0, align 4
+  ret i32 %1
+}

test/Instrumentation/AddressSanitizer/instrument-dynamic-allocas.ll

 define void @foo(i32 %len) sanitize_address {
 entry:
 ; CHECK-ALLOCA: store i32 -892679478
 ; CHECK-ALLOCA: store i32 -875836469
 ; CHECK-NOALLOCA-NOT: store i32 -892679478
 ; CHECK-NOALLOCA-NOT: store i32 -875836469
   %0 = alloca i32, align 4
   %1 = alloca i8*
-  store i32 %len, i32* %0, align 4
+  store volatile i32 %len, i32* %0, align 4
   %2 = load i32* %0, align 4
   %3 = zext i32 %2 to i64
   %4 = alloca i8, i64 %3, align 32
+  store volatile i8 0, i8* %4
   ret void
 }
 

test/Instrumentation/AddressSanitizer/lifetime-uar.ll

 entry:
   %retval = alloca i32, align 4
   %c = alloca i8, align 1
 
   call void @llvm.lifetime.start(i64 1, i8* %c)
   ; Memory is unpoisoned at llvm.lifetime.start
   ; CHECK: call void @__asan_unpoison_stack_memory(i64 %{{[^ ]+}}, i64 1)
 
-  store i32 0, i32* %retval
-  store i8 0, i8* %c, align 1
+  store volatile i32 0, i32* %retval
+  store volatile i8 0, i8* %c, align 1
 
   call void @llvm.lifetime.end(i64 1, i8* %c)
   ; Memory is poisoned at llvm.lifetime.end
   ; CHECK: call void @__asan_poison_stack_memory(i64 %{{[^ ]+}}, i64 1)
 
   ; No need to unpoison memory at function exit in UAR mode.
   ; CHECK-NOT: @__asan_unpoison_stack_memory
   ; CHECK: ret void
 
   ret i32 0
 }
 

test/Instrumentation/AddressSanitizer/lifetime.ll

 ; Test hanlding of llvm.lifetime intrinsics.
 ; RUN: opt < %s -asan -asan-module -asan-check-lifetime -asan-use-after-return=0 -S | FileCheck %s
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 declare void @llvm.lifetime.start(i64, i8* nocapture) nounwind
 declare void @llvm.lifetime.end(i64, i8* nocapture) nounwind
 
 define void @lifetime_no_size() sanitize_address {
 entry:
   %i = alloca i32, align 4
   %i.ptr = bitcast i32* %i to i8*
   call void @llvm.lifetime.start(i64 -1, i8* %i.ptr)
+  store volatile i8 0, i8* %i.ptr
   call void @llvm.lifetime.end(i64 -1, i8* %i.ptr)
 
 ; Check that lifetime with no size are ignored.
 ; CHECK-LABEL: define void @lifetime_no_size()
 ; CHECK-NOT: @__asan_poison_stack_memory
 ; CHECK-NOT: @__asan_unpoison_stack_memory
 ; CHECK: ret void
   ret void
 }
 
 ; Generic case of lifetime analysis.
 define void @lifetime() sanitize_address {
   ; CHECK-LABEL: define void @lifetime()
 
   ; Regular variable lifetime intrinsics.
   %i = alloca i32, align 4
   %i.ptr = bitcast i32* %i to i8*
   call void @llvm.lifetime.start(i64 3, i8* %i.ptr)
+  store volatile i8 0, i8* %i.ptr
   ; Memory is unpoisoned at llvm.lifetime.start
   ; CHECK: %[[VAR:[^ ]*]] = ptrtoint i32* %{{[^ ]+}} to i64
   ; CHECK-NEXT: call void @__asan_unpoison_stack_memory(i64 %[[VAR]], i64 3)
   call void @llvm.lifetime.end(i64 4, i8* %i.ptr)
   call void @llvm.lifetime.end(i64 2, i8* %i.ptr)
   ; Memory is poisoned at every call to llvm.lifetime.end
   ; CHECK: call void @__asan_poison_stack_memory(i64 %{{[^ ]+}}, i64 4)
   ; CHECK: call void @__asan_poison_stack_memory(i64 %{{[^ ]+}}, i64 2)
 
   ; Lifetime intrinsics for array.
   %arr = alloca [10 x i32], align 16
   %arr.ptr = bitcast [10 x i32]* %arr to i8*
   call void @llvm.lifetime.start(i64 40, i8* %arr.ptr)
+  store volatile i8 0, i8* %arr.ptr
   ; CHECK: call void @__asan_unpoison_stack_memory(i64 %{{[^ ]+}}, i64 40)
   call void @llvm.lifetime.end(i64 40, i8* %arr.ptr)
   ; CHECK: call void @__asan_poison_stack_memory(i64 %{{[^ ]+}}, i64 40)
 
   ; One more lifetime start/end for the same variable %i.
   call void @llvm.lifetime.start(i64 4, i8* %i.ptr)
+  store volatile i8 0, i8* %i.ptr
   ; CHECK: call void @__asan_unpoison_stack_memory(i64 %{{[^ ]+}}, i64 4)
   call void @llvm.lifetime.end(i64 4, i8* %i.ptr)
   ; CHECK: call void @__asan_poison_stack_memory(i64 %{{[^ ]+}}, i64 4)
 
   ; Memory is unpoisoned at function exit (only once).
   ; CHECK: call void @__asan_unpoison_stack_memory(i64 %{{[^ ]+}}, i64 {{.*}})
   ; CHECK-NOT: @__asan_unpoison_stack_memory
   ; CHECK: ret void
   ret void
 }
 
 ; Check that arguments of lifetime may come from phi nodes.
 define void @phi_args(i1 %x) sanitize_address {
   ; CHECK-LABEL: define void @phi_args(i1 %x)
 
 entry:
   %i = alloca i64, align 4
   %i.ptr = bitcast i64* %i to i8*
   call void @llvm.lifetime.start(i64 8, i8* %i.ptr)
+  store volatile i8 0, i8* %i.ptr
   ; CHECK: __asan_unpoison_stack_memory
   br i1 %x, label %bb0, label %bb1
 
 bb0:
   %i.ptr2 = bitcast i64* %i to i8*
   br label %bb1
 
 bb1:
   %i.phi = phi i8* [ %i.ptr, %entry ], [ %i.ptr2, %bb0 ]
   call void @llvm.lifetime.end(i64 8, i8* %i.phi)
   ; CHECK: __asan_poison_stack_memory
   ; CHECK: ret void
   ret void
 }

test/Instrumentation/AddressSanitizer/stack_dynamic_alloca.ll

 ; CHECK: %MyAlloca = alloca i8, i64
 ; CHECK: [[ALLOCA:%[0-9]+]] = ptrtoint i8* %MyAlloca
 
 ; CHECK: phi i64 [ [[FAKE_STACK]], %[[FAKE_STACK_BB]] ], [ [[ALLOCA]], %[[NO_FAKE_STACK_BB]] ]
 
 ; CHECK: ret void
 
   %XXX = alloca [20 x i8], align 1
+  %arr.ptr = bitcast [20 x i8]* %XXX to i8*
+  store volatile i8 0, i8* %arr.ptr
   ret void
 }
 
 ; Test that dynamic alloca is not used for functions with inline assembly.
 define void @Func2() sanitize_address {
 entry:
 ; CHECK-LABEL: Func2
 ; CHECK: alloca [96 x i8]
 ; CHECK: ret void
 
   %XXX = alloca [20 x i8], align 1
+  %arr.ptr = bitcast [20 x i8]* %XXX to i8*
+  store volatile i8 0, i8* %arr.ptr
   call void asm sideeffect "mov %%rbx, %%rcx", "~{dirflag},~{fpsr},~{flags}"() nounwind
   ret void
 }

test/Instrumentation/AddressSanitizer/stack_layout.ll

 ; CHECK-STATIC: alloca [192 x i8]
 ; CHECK-DYNAMIC: alloca i8, i64 192
 
 ; CHECK-NOT: alloca
 ; CHECK: ret void
   %XXX = alloca [10 x i8], align 1
   %YYY = alloca [20 x i8], align 1
   %ZZZ = alloca [30 x i8], align 1
+  %arr1.ptr = bitcast [10 x i8]* %XXX to i8*
+  store volatile i8 0, i8* %arr1.ptr
+  %arr2.ptr = bitcast [20 x i8]* %YYY to i8*
+  store volatile i8 0, i8* %arr2.ptr
+  %arr3.ptr = bitcast [30 x i8]* %ZZZ to i8*
+  store volatile i8 0, i8* %arr3.ptr
   ret void
 }
 
 define void @Func2() sanitize_address {
 entry:
 ; CHECK-LABEL: Func2
 
 ; CHECK-STATIC: alloca [864 x i8]
 ; CHECK-DYNAMIC: alloca i8, i64 864
 
 ; CHECK-NOT: alloca
 ; CHECK: ret void
   %AAA = alloca [5 x i8], align 1
   %BBB = alloca [55 x i8], align 1
   %CCC = alloca [555 x i8], align 1
+  %arr1.ptr = bitcast [5 x i8]* %AAA to i8*
+  store volatile i8 0, i8* %arr1.ptr
+  %arr2.ptr = bitcast [55 x i8]* %BBB to i8*
+  store volatile i8 0, i8* %arr2.ptr
+  %arr3.ptr = bitcast [555 x i8]* %CCC to i8*
+  store volatile i8 0, i8* %arr3.ptr
   ret void
 }
 
 ; Check that we reorder vars according to alignment and handle large alignments.
 define void @Func3() sanitize_address {
 entry:
 ; CHECK-LABEL: Func3
 
 ; CHECK-STATIC: alloca [768 x i8]
 ; CHECK-DYNAMIC: alloca i8, i64 768
 
 ; CHECK-NOT: alloca
 ; CHECK: ret void
   %AAA = alloca [128 x i8], align 16
   %BBB = alloca [128 x i8], align 64
   %CCC = alloca [128 x i8], align 256
+  %arr1.ptr = bitcast [128 x i8]* %AAA to i8*
+  store volatile i8 0, i8* %arr1.ptr
+  %arr2.ptr = bitcast [128 x i8]* %BBB to i8*
+  store volatile i8 0, i8* %arr2.ptr
+  %arr3.ptr = bitcast [128 x i8]* %CCC to i8*
+  store volatile i8 0, i8* %arr3.ptr
   ret void
 }