Index: llvm/lib/Analysis/MemoryLocation.cpp
===================================================================
--- llvm/lib/Analysis/MemoryLocation.cpp
+++ llvm/lib/Analysis/MemoryLocation.cpp
@@ -257,6 +257,9 @@
     case LibFunc_memccpy:
       assert((ArgIdx == 0 || ArgIdx == 1) &&
              "Invalid argument index for memccpy");
+      if (ArgIdx == 0)
+        // It is not known how many bytes are written to the dest arg.
+        break;
       if (const ConstantInt *LenCI =
               dyn_cast<ConstantInt>(Call->getArgOperand(3)))
         return MemoryLocation(Arg, LocationSize::precise(LenCI->getZExtValue()),
Index: llvm/test/Analysis/BasicAA/libfuncs.ll
===================================================================
--- llvm/test/Analysis/BasicAA/libfuncs.ll
+++ llvm/test/Analysis/BasicAA/libfuncs.ll
@@ -110,7 +110,7 @@
 ; CHECK-NEXT: Just Ref:  Ptr: i8* %b        <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: Both ModRef:  Ptr: i8* %res   <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: Both ModRef:  Ptr: i8* %a.gep.1       <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
-; CHECK-NEXT: NoModRef:  Ptr: i8* %a.gep.5  <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
+; CHECK-NEXT: Both ModRef:  Ptr: i8* %a.gep.5       <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: Just Ref:  Ptr: i8* %b.gep.1  <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: NoModRef:  Ptr: i8* %b.gep.5  <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 define i8* @test_memccpy_const_size(i8* noalias %a, i8* noalias %b) {