Index: llvm/lib/Analysis/MemoryLocation.cpp
===================================================================
--- llvm/lib/Analysis/MemoryLocation.cpp
+++ llvm/lib/Analysis/MemoryLocation.cpp
@@ -257,10 +257,11 @@
     case LibFunc_memccpy:
       assert((ArgIdx == 0 || ArgIdx == 1) &&
              "Invalid argument index for memccpy");
+      // We only know an upper bound on the number of bytes read/written.
       if (const ConstantInt *LenCI =
               dyn_cast<ConstantInt>(Call->getArgOperand(3)))
-        return MemoryLocation(Arg, LocationSize::precise(LenCI->getZExtValue()),
-                              AATags);
+        return MemoryLocation(
+            Arg, LocationSize::upperBound(LenCI->getZExtValue()), AATags);
       break;
     default:
       break;
Index: llvm/test/Analysis/BasicAA/libfuncs.ll
===================================================================
--- llvm/test/Analysis/BasicAA/libfuncs.ll
+++ llvm/test/Analysis/BasicAA/libfuncs.ll
@@ -110,7 +110,7 @@
 ; CHECK-NEXT: Just Ref:  Ptr: i8* %b        <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: Both ModRef:  Ptr: i8* %res   <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: Both ModRef:  Ptr: i8* %a.gep.1       <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
-; CHECK-NEXT: NoModRef:  Ptr: i8* %a.gep.5  <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
+; CHECK-NEXT: NoModRef:  Ptr: i8* %a.gep.5       <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: Just Ref:  Ptr: i8* %b.gep.1  <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 ; CHECK-NEXT: NoModRef:  Ptr: i8* %b.gep.5  <->  %res = call i8* @memccpy(i8* %a, i8* %b, i32 42, i64 4)
 define i8* @test_memccpy_const_size(i8* noalias %a, i8* noalias %b) {