[ValueTracking] Let isGuaranteedNotToBeUndefOrPoison use canCreateUndefOrPoison

[aqjune]

Summary

This patch adds support more operations.

[nikic]

While you're here, I'd suggest to go through all of Instructions.def and add an entry in the switch for all instructions that have a return value, so we at least know what we're missing. This is what I see:

• udiv, sdiv, urem, srem: If exact not set, recursively check operands. (Division by zero etc is undefined behavior, not poison.)
• shl, lshr, ashr: Apart from exact, these also have the bitwidth case, which could be checked for constant shamt.
• alloca: Never undef/poison. (The pointer, not the content...)
• load: We don't know. (Might want !noundef metadata in the future, if that's useful)
• atomicrmw, cmpxchg: No idea, no familiarity.
• trunc, sext, zext: Check operands, no special cases.
• fptoui, fptosi: These poison on overflow, can't infer anything useful.
• uitofp, sitofp: These stopped poisoning on overflow at some point, just check operands.
• fpext, fptrunc: Presumably just check operand, but I'm not familiar.
• ptrtoint, inttoptr: Check operand.
• addrspacecast: I would assume this is also just "check operand", but with addrspacecasts you never know :)
• call/invoke: Check noundef attribute on return value.
• select: Check operands and FMF.
• extractelement, insertelement, extractvalue, insertvalue: Check operands.
• shufflevalue: Have to take undef lanes into account.

It might make sense to add some of the straightforward cases (like trunc/sext/zext) to this review and leave the rest as TODOs.

llvm/lib/Analysis/ValueTracking.cpp

4825–4826

Should be cast<> rather than dyn_cast<>.

4827

Move this case into the switch? Similar to how you handle FPMathOperator.

4828

Use OpCheck(Opr->getOperand(0)) here?

[aqjune]

For this, canCreatePoison seems to be helpful. I'll add a patch that

• refactors canCreatePoison so it takes an operator
• add a function canCreateUndef

and make this patch invoke canCreateUndef.

[aqjune]

Call canCreateUndef so it does all things about opcode inspection

[jdoerfert]

Only one nit from my side, don't wait for me.

llvm/lib/Analysis/ValueTracking.cpp

4827

Nit: Can we have a comment /* something */ true so I know what true means ?

[aqjune]

Use canCreateUndefOrPoison

[aqjune]

llvm/lib/Analysis/ValueTracking.cpp

4791

Added support for calls with noundef ret attribute since it's a small change

[nikic]

llvm/include/llvm/Analysis/ValueTracking.h

611

paddings -> padding

llvm/lib/Analysis/ValueTracking.cpp

4795

The positioning here is a bit odd, I'd move this below (or inside) the Operator check.

4836

Does this conservative return still make sense? At this point this should only be an optimization (don't bother with dominator checks for const exprs) than something that is needed for correctness.

[aqjune]

Reflect comments

[nikic]

LG

[aqjune]

Remove the ConstExpr check

[jdoerfert]

No objections from me anymore.

llvm/lib/Analysis/ValueTracking.cpp

4785

Personally, I'd keep freeze up top, easy case after all ;). No strong opinion though.

[aqjune]

Since isGuaranteedNotToBeUndefOrPoison now traverses over many ops, there is 0.3% slowdown from ReleaseLTO-O3 in average on CTMark:

+-----------------------------------------------+---------+-------+----------+-------+-------+----------+
|                                               | compile |       |          | link  |       |          |
+-----------------------------------------------+---------+-------+----------+-------+-------+----------+
|                                               | base    |       | slowdown | base  |       | slowdown |
| CTMark/7zip/7zip-benchmark.test               | 89.31   | 89.96 | 0.72%    | 46.73 | 46.93 | 0.43%    |
| CTMark/Bullet/bullet.test                     | 62.76   | 63.13 | 0.59%    | 9.59  |  9.62 | 0.31%    |
| CTMark/ClamAV/clamscan.test                   | 26.91   | 26.95 | 0.13%    | 24.70 | 24.82 | 0.48%    |
| CTMark/SPASS/SPASS.test                       | 26.07   | 26.18 | 0.42%    | 19.60 | 19.72 | 0.60%    |
| CTMark/consumer-typeset/consumer-typeset.test | 19.58   | 19.65 | 0.36%    | 18.41 | 18.49 | 0.44%    |
| CTMark/kimwitu++/kc.test                      | 26.50   | 26.56 | 0.22%    | 14.54 | 14.51 | -0.21%   |
| CTMark/lencod/lencod.test                     | 34.48   | 34.47 | -0.03%   | 38.38 | 38.67 | 0.76%    |
| CTMark/mafft/pairlocalalign.test              | 16.17   | 16.25 | 0.44%    | 8.64  |  8.64 | 0.00%    |
| CTMark/sqlite3/sqlite3.test                   | 24.49   | 24.42 | -0.28%   | 24.43 | 24.52 | 0.36%    |
| CTMark/tramp3d-v4/tramp3d-v4.test             | 49.14   | 49.10 | -0.08%   | 35.64 | 35.85 | 0.59%    |
+-----------------------------------------------+---------+-------+----------+-------+-------+----------+

The solution for this doesn't seem trivial. Fixing existing undef/poison-related bugs might introduce more calls to this function, which will bring more slowdown.
What would be the right direction to address this issue?

llvm/lib/Analysis/ValueTracking.cpp

4785

Since constants and noundefs (after relevant patches are landed) are/will be very common, locating those checks at the top seemed beneficial.
I saw slight degradation from compilation time from this patch - maybe a single isa<> might be super cheap so it won't make affect the result, but wanted to make things optimal :)

[aqjune]

Unlike load/stores, the instructions we're targetting are likely to be changed by many transformations, maintaining a cache for the analysis result should be costly?
One possible approach that I can come up with is to reduce MaxDepth & add !noundef.

[nikic]

In D83926#2161062, @aqjune wrote:

Since isGuaranteedNotToBeUndefOrPoison now traverses over many ops, there is 0.3% slowdown from ReleaseLTO-O3 in average on CTMark:
...
The solution for this doesn't seem trivial. Fixing existing undef/poison-related bugs might introduce more calls to this function, which will bring more slowdown.
What would be the right direction to address this issue?

I'm not seeing any measurable impact from this change in terms of instructions retired: https://llvm-compile-time-tracker.com/compare.php?from=ef66e3d086308800d7947a385c2ae09d3f55a695&to=081c25553185740fde7d93d2a32ef4e87ae480aa&stat=instructions Most likely the difference you see is within noise for wall time measurements, which tends to be high.

Maybe it will become a problem in the future if this functions sees heavier usage, but I don't think compile-time is a big concern right now.

[aqjune]

Okay, thank you for the info!

[RKSimon]

@aqjune Please can you take a look at https://bugs.llvm.org/show_bug.cgi?id=46831 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24278) - it seems related to this patch

[aqjune]

Oops, I'll have a look

[fhahn]

In D83926#2171797, @aqjune wrote:

Oops, I'll have a look

I also looked into this a day ago or so.

The problem seems to be that containsConstantExpression/containsUndefElement are called on non ConstantDataVector/ConstantVector, which segfaults. I will put up a patch soon.

[aqjune]

@fhahn Yes, C was like <4 x i64*> getelementptr (i64, i64* null, <4 x i64> <i64 0, i64 0, i64 0, i64 -128>).

Thank you for the info..! I'm fine if you are making the patch.

llvm/include/llvm/Analysis/ValueTracking.h

 //===- llvm/Analysis/ValueTracking.h - Walk computations --------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
class Value;
   /// (e.g. sdiv I, 0), canCreatePoison returns false.
   ///
   /// canCreatePoison returns true if Op can create poison from non-poison
   /// operands.
   bool canCreateUndefOrPoison(const Operator *Op);
   bool canCreatePoison(const Operator *Op);
 
   /// Return true if this function can prove that V is never undef value
-  /// or poison value.
+  /// or poison value. If V is an aggregate value or vector, check whether all
+  /// elements (except paddings) are not undef or poison.
   /// Note that this is different from canCreateUndefOrPoison because the
   /// function assumes Op's operands are not poison/undef.
   ///
   /// If CtxI and DT are specified this method performs flow-sensitive analysis
   /// and returns true if it is guaranteed to be never undef or poison
   /// immediately before the CtxI.
   bool isGuaranteedNotToBeUndefOrPoison(const Value *V,
                                         const Instruction *CtxI = nullptr,

llvm/lib/Analysis/ValueTracking.cpp

 //===- ValueTracking.cpp - Walk computations to compute properties --------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
bool llvm::isGuaranteedNotToBeUndefOrPoison(const Value *V,
                                             const DominatorTree *DT,
                                             unsigned Depth) {
   if (Depth >= MaxDepth)
     return false;
 
   // If the value is a freeze instruction, then it can never
   // be undef or poison.
   if (isa<FreezeInst>(V))
     return true;
-  // TODO: Some instructions are guaranteed to return neither undef
-  // nor poison if their arguments are not poison/undef.
 
-  if (auto *A = dyn_cast<Argument>(V)) {
-    // NoUndef does not guarantee that paddings are not undef.
+  if (const auto *A = dyn_cast<Argument>(V)) {
     if (A->hasAttribute(Attribute::NoUndef))
       return true;
   }
 
+  if (const auto *CB = dyn_cast<CallBase>(V)) {
+    if (CB->hasRetAttr(Attribute::NoUndef))
+      return true;
+  }
+
   if (auto *C = dyn_cast<Constant>(V)) {
-    // TODO: We can analyze ConstExpr by opcode to determine if there is any
-    //       possibility of poison.
-    if (isa<UndefValue>(C) || isa<ConstantExpr>(C))
+    if (isa<UndefValue>(C))
       return false;
 
     if (isa<ConstantInt>(C) || isa<GlobalVariable>(C) || isa<ConstantFP>(V) ||
         isa<ConstantPointerNull>(C) || isa<Function>(C))
       return true;
 
     if (C->getType()->isVectorTy())
       return !C->containsUndefElement() && !C->containsConstantExpression();
-
-    // TODO: Recursively analyze aggregates or other constants.
-    return false;
   }
 
   // Strip cast operations from a pointer value.
   // Note that stripPointerCastsSameRepresentation can strip off getelementptr
   // inbounds with zero offset. To guarantee that the result isn't poison, the
   // stripped pointer is checked as it has to be pointing into an allocated
   // object or be null `null` to ensure `inbounds` getelement pointers with a
   // zero offset could not produce poison.
   // It can strip off addrspacecast that do not change bit representation as
   // well. We believe that such addrspacecast is equivalent to no-op.
   auto *StrippedV = V->stripPointerCastsSameRepresentation();
   if (isa<AllocaInst>(StrippedV) || isa<GlobalVariable>(StrippedV) ||
       isa<Function>(StrippedV) || isa<ConstantPointerNull>(StrippedV))
     return true;
 
   auto OpCheck = [&](const Value *V) {
     return isGuaranteedNotToBeUndefOrPoison(V, CtxI, DT, Depth + 1);
   };
 
-  if (auto *I = dyn_cast<Instruction>(V)) {
-    switch (I->getOpcode()) {
-    case Instruction::GetElementPtr: {
-      auto *GEPI = dyn_cast<GetElementPtrInst>(I);
-      if (!GEPI->isInBounds() && llvm::all_of(GEPI->operands(), OpCheck))
-        return true;
-      break;
-    }
-    case Instruction::FCmp: {
-      auto *FI = dyn_cast<FCmpInst>(I);
-      if (FI->getFastMathFlags().none() &&
-          llvm::all_of(FI->operands(), OpCheck))
-        return true;
-      break;
-    }
-    case Instruction::BitCast:
-    case Instruction::PHI:
-    case Instruction::ICmp:
-      if (llvm::all_of(I->operands(), OpCheck))
-        return true;
-      break;
-    default:
-      break;
-    }
+  if (auto *Opr = dyn_cast<Operator>(V)) {
+    if (canCreateUndefOrPoison(Opr))
+      return false;
+
+    if (all_of(Opr->operands(), OpCheck))
 
+  // Conservatively return false
+  if (isa<ConstantExpr>(V))
+    return false;
+
+  if (auto *I = dyn_cast<Instruction>(V)) {
     if (programUndefinedIfPoison(I) && I->getType()->isIntegerTy(1))
       // Note: once we have an agreement that poison is a value-wise concept,
       // we can remove the isIntegerTy(1) constraint.
       return true;
   }
 
   // CxtI may be null or a cloned instruction.
   if (!CtxI || !CtxI->getParent() || !DT)

llvm/test/Transforms/DivRemPairs/PowerPC/div-expanded-rem-pair.ll

 ; CHECK-LABEL: @srem_of_srem_unexpanded(
 ; CHECK-NEXT:    [[T0:%.*]] = mul nsw i32 [[Z:%.*]], [[Y:%.*]]
 ; CHECK-NEXT:    [[X_FROZEN:%.*]] = freeze i32 [[X:%.*]]
 ; CHECK-NEXT:    [[T0_FROZEN:%.*]] = freeze i32 [[T0]]
 ; CHECK-NEXT:    [[T1:%.*]] = sdiv i32 [[X_FROZEN]], [[T0_FROZEN]]
 ; CHECK-NEXT:    [[T2:%.*]] = mul nsw i32 [[T0]], [[T1]]
 ; CHECK-NEXT:    [[TMP1:%.*]] = mul i32 [[T1]], [[T0_FROZEN]]
 ; CHECK-NEXT:    [[T3_DECOMPOSED:%.*]] = sub i32 [[X_FROZEN]], [[TMP1]]
-; CHECK-NEXT:    [[T3_DECOMPOSED_FROZEN:%.*]] = freeze i32 [[T3_DECOMPOSED]]
 ; CHECK-NEXT:    [[Y_FROZEN:%.*]] = freeze i32 [[Y]]
-; CHECK-NEXT:    [[T4:%.*]] = sdiv i32 [[T3_DECOMPOSED_FROZEN]], [[Y_FROZEN]]
+; CHECK-NEXT:    [[T4:%.*]] = sdiv i32 [[T3_DECOMPOSED]], [[Y_FROZEN]]
 ; CHECK-NEXT:    [[T5:%.*]] = mul nsw i32 [[T4]], [[Y]]
 ; CHECK-NEXT:    [[TMP2:%.*]] = mul i32 [[T4]], [[Y_FROZEN]]
-; CHECK-NEXT:    [[T6_DECOMPOSED:%.*]] = sub i32 [[T3_DECOMPOSED_FROZEN]], [[TMP2]]
+; CHECK-NEXT:    [[T6_DECOMPOSED:%.*]] = sub i32 [[T3_DECOMPOSED]], [[TMP2]]
 ; CHECK-NEXT:    ret i32 [[T6_DECOMPOSED]]
 ;
   %t0 = mul nsw i32 %Z, %Y
   %t1 = sdiv i32 %X, %t0
   %t2 = mul nsw i32 %t0, %t1
   %t3 = srem i32 %X, %t0
   %t4 = sdiv i32 %t3, %Y
   %t5 = mul nsw i32 %t4, %Y

llvm/test/Transforms/DivRemPairs/PowerPC/div-rem-pairs.ll

 ; CHECK-LABEL: @srem_of_srem_unexpanded(
 ; CHECK-NEXT:    [[T0:%.*]] = mul nsw i32 [[Z:%.*]], [[Y:%.*]]
 ; CHECK-NEXT:    [[X_FROZEN:%.*]] = freeze i32 [[X:%.*]]
 ; CHECK-NEXT:    [[T0_FROZEN:%.*]] = freeze i32 [[T0]]
 ; CHECK-NEXT:    [[T1:%.*]] = sdiv i32 [[X_FROZEN]], [[T0_FROZEN]]
 ; CHECK-NEXT:    [[T2:%.*]] = mul nsw i32 [[T0]], [[T1]]
 ; CHECK-NEXT:    [[TMP1:%.*]] = mul i32 [[T1]], [[T0_FROZEN]]
 ; CHECK-NEXT:    [[T3_DECOMPOSED:%.*]] = sub i32 [[X_FROZEN]], [[TMP1]]
-; CHECK-NEXT:    [[T3_DECOMPOSED_FROZEN:%.*]] = freeze i32 [[T3_DECOMPOSED]]
 ; CHECK-NEXT:    [[Y_FROZEN:%.*]] = freeze i32 [[Y]]
-; CHECK-NEXT:    [[T4:%.*]] = sdiv i32 [[T3_DECOMPOSED_FROZEN]], [[Y_FROZEN]]
+; CHECK-NEXT:    [[T4:%.*]] = sdiv i32 [[T3_DECOMPOSED]], [[Y_FROZEN]]
 ; CHECK-NEXT:    [[T5:%.*]] = mul nsw i32 [[T4]], [[Y]]
 ; CHECK-NEXT:    [[TMP2:%.*]] = mul i32 [[T4]], [[Y_FROZEN]]
-; CHECK-NEXT:    [[T6_DECOMPOSED:%.*]] = sub i32 [[T3_DECOMPOSED_FROZEN]], [[TMP2]]
+; CHECK-NEXT:    [[T6_DECOMPOSED:%.*]] = sub i32 [[T3_DECOMPOSED]], [[TMP2]]
 ; CHECK-NEXT:    ret i32 [[T6_DECOMPOSED]]
 ;
   %t0 = mul nsw i32 %Z, %Y
   %t1 = sdiv i32 %X, %t0
   %t2 = mul nsw i32 %t0, %t1
   %t3 = srem i32 %X, %t0
   %t4 = sdiv i32 %t3, %Y
   %t5 = mul nsw i32 %t4, %Y

llvm/test/Transforms/InstSimplify/freeze-noundef.ll

 ; CHECK-NEXT:    [[C:%.*]] = icmp eq i8 [[X:%.*]], [[Y:%.*]]
 ; CHECK-NEXT:    ret i1 [[C]]
 ;
   %c = icmp eq i8 %x, %y
   %f = freeze i1 %c
   ret i1 %f
 }
 
-; TODO: should look into binary operations
 define i1 @or(i1 noundef %x, i1 noundef %x2) {
 ; CHECK-LABEL: @or(
 ; CHECK-NEXT:    [[Y:%.*]] = or i1 [[X:%.*]], [[X2:%.*]]
-; CHECK-NEXT:    [[Z:%.*]] = freeze i1 [[Y]]
-; CHECK-NEXT:    ret i1 [[Z]]
+; CHECK-NEXT:    ret i1 [[Y]]
 ;
   %y = or i1 %x, %x2
   %z = freeze i1 %y
   ret i1 %z
 }
 
 define i1 @or2(i1 noundef %x, i1 %x2) {
 ; CHECK-LABEL: @or2(
 ; CHECK-NEXT:    [[Y:%.*]] = or i1 [[X:%.*]], [[X2:%.*]]
 ; CHECK-NEXT:    [[Z:%.*]] = freeze i1 [[Y]]
 ; CHECK-NEXT:    ret i1 [[Z]]
 ;
   %y = or i1 %x, %x2
   %z = freeze i1 %y
   ret i1 %z
 }
 
-; TODO: should look into binary operations
 define i8 @add(i8 noundef %x) {
 ; CHECK-LABEL: @add(
 ; CHECK-NEXT:    [[Y:%.*]] = add i8 [[X:%.*]], 1
-; CHECK-NEXT:    [[Z:%.*]] = freeze i8 [[Y]]
-; CHECK-NEXT:    ret i8 [[Z]]
+; CHECK-NEXT:    ret i8 [[Y]]
 ;
   %y = add i8 %x, 1
   %z = freeze i8 %y
   ret i8 %z
 }
 
 define i8 @addnsw(i8 noundef %x) {
 ; CHECK-LABEL: @addnsw(
;
   %y = freeze {i8, i32} %x
   ret {i8, i32} %y
 }
 
 ; TODO: should look into extract operations
 define i32 @extract({i8, i32} noundef %x) {
 ; CHECK-LABEL: @extract(
 ; CHECK-NEXT:    [[Y:%.*]] = extractvalue { i8, i32 } [[X:%.*]], 1
-; CHECK-NEXT:    [[Z:%.*]] = freeze i32 [[Y]]
-; CHECK-NEXT:    ret i32 [[Z]]
+; CHECK-NEXT:    ret i32 [[Y]]
 ;
   %y = extractvalue {i8, i32} %x, 1
   %z = freeze i32 %y
   ret i32 %z
 }
 
-; TODO: should look into extract operations
 define i32 @extract2({i8, {i8, i32}} noundef %x) {
 ; CHECK-LABEL: @extract2(
 ; CHECK-NEXT:    [[Y:%.*]] = extractvalue { i8, { i8, i32 } } [[X:%.*]], 1
 ; CHECK-NEXT:    [[Z:%.*]] = extractvalue { i8, i32 } [[Y]], 1
-; CHECK-NEXT:    [[W:%.*]] = freeze i32 [[Z]]
-; CHECK-NEXT:    ret i32 [[W]]
+; CHECK-NEXT:    ret i32 [[Z]]
 ;
   %y = extractvalue {i8, {i8, i32}} %x, 1
   %z = extractvalue {i8, i32} %y, 1
   %w = freeze i32 %z
   ret i32 %w
 }

llvm/test/Transforms/InstSimplify/freeze.ll

 }
 
 @g = external global i16, align 1
 
 ; Negative test
 
 define float @constant_expr() {
 ; CHECK-LABEL: @constant_expr(
-; CHECK-NEXT:    [[R:%.*]] = freeze float bitcast (i32 ptrtoint (i16* @g to i32) to float)
-; CHECK-NEXT:    ret float [[R]]
+; CHECK-NEXT:    ret float bitcast (i32 ptrtoint (i16* @g to i32) to float)
 ;
   %r = freeze float bitcast (i32 ptrtoint (i16* @g to i32) to float)
   ret float %r
 }
 
+define i8* @constant_expr2() {
+; CHECK-LABEL: @constant_expr2(
+; CHECK-NEXT:    ret i8* bitcast (i16* @g to i8*)
+;
+  %r = freeze i8* bitcast (i16* @g to i8*)
+  ret i8* %r
+}
+
+define i32* @constant_expr3() {
+; CHECK-LABEL: @constant_expr3(
+; CHECK-NEXT:    ret i32* getelementptr (i32, i32* @glb, i64 3)
+;
+  %r = freeze i32* getelementptr (i32, i32* @glb, i64 3)
+  ret i32* %r
+}
+
 ; Negative test
 
 define <2 x i31> @vector_element_constant_expr() {
 ; CHECK-LABEL: @vector_element_constant_expr(
 ; CHECK-NEXT:    [[R:%.*]] = freeze <2 x i31> <i31 34, i31 ptrtoint (i16* @g to i31)>
 ; CHECK-NEXT:    ret <2 x i31> [[R]]
 ;
   %r = freeze <2 x i31> <i31 34, i31 ptrtoint (i16* @g to i31)>
   ret <2 x i31> %r
 }
 
 define void @alloca() {
 ; CHECK-LABEL: @alloca(
-; CHECK-NEXT:    [[P:%.*]] = alloca i8
+; CHECK-NEXT:    [[P:%.*]] = alloca i8, align 1
 ; CHECK-NEXT:    call void @f3(i8* [[P]])
 ; CHECK-NEXT:    ret void
 ;
   %p = alloca i8
   %y = freeze i8* %p
   call void @f3(i8* %y)
   ret void
 }
 
 define i8* @gep() {
 ; CHECK-LABEL: @gep(
-; CHECK-NEXT:    [[P:%.*]] = alloca [4 x i8]
+; CHECK-NEXT:    [[P:%.*]] = alloca [4 x i8], align 1
 ; CHECK-NEXT:    [[Q:%.*]] = getelementptr [4 x i8], [4 x i8]* [[P]], i32 0, i32 6
 ; CHECK-NEXT:    ret i8* [[Q]]
 ;
   %p = alloca [4 x i8]
   %q = getelementptr [4 x i8], [4 x i8]* %p, i32 0, i32 6
   %q2 = freeze i8* %q
   ret i8* %q2
 }
 
 define i8* @gep_noopt(i32 %arg) {
 ; CHECK-LABEL: @gep_noopt(
 ; CHECK-NEXT:    [[Q:%.*]] = getelementptr [4 x i8], [4 x i8]* null, i32 0, i32 [[ARG:%.*]]
 ; CHECK-NEXT:    [[Q2:%.*]] = freeze i8* [[Q]]
 ; CHECK-NEXT:    ret i8* [[Q2]]
 ;
   %q = getelementptr [4 x i8], [4 x i8]* null, i32 0, i32 %arg
   %q2 = freeze i8* %q
   ret i8* %q2
 }
 
 define i8* @gep_inbounds() {
 ; CHECK-LABEL: @gep_inbounds(
-; CHECK-NEXT:    [[P:%.*]] = alloca [4 x i8]
+; CHECK-NEXT:    [[P:%.*]] = alloca [4 x i8], align 1
 ; CHECK-NEXT:    [[Q:%.*]] = getelementptr inbounds [4 x i8], [4 x i8]* [[P]], i32 0, i32 0
 ; CHECK-NEXT:    ret i8* [[Q]]
 ;
   %p = alloca [4 x i8]
   %q = getelementptr inbounds [4 x i8], [4 x i8]* %p, i32 0, i32 0
   %q2 = freeze i8* %q
   ret i8* %q2
 }
 
 define i8* @gep_inbounds_noopt(i32 %arg) {
 ; CHECK-LABEL: @gep_inbounds_noopt(
-; CHECK-NEXT:    [[P:%.*]] = alloca [4 x i8]
+; CHECK-NEXT:    [[P:%.*]] = alloca [4 x i8], align 1
 ; CHECK-NEXT:    [[Q:%.*]] = getelementptr inbounds [4 x i8], [4 x i8]* [[P]], i32 0, i32 [[ARG:%.*]]
 ; CHECK-NEXT:    [[Q2:%.*]] = freeze i8* [[Q]]
 ; CHECK-NEXT:    ret i8* [[Q2]]
 ;
   %p = alloca [4 x i8]
   %q = getelementptr inbounds [4 x i8], [4 x i8]* %p, i32 0, i32 %arg
   %q2 = freeze i8* %q
   ret i8* %q2