diff --git a/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp b/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp
--- a/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp
@@ -2150,7 +2150,9 @@
 
   // Skip if GEP source element type is scalable. The type alloc size is unknown
   // at compile-time.
-  if (GEP.getNumIndices() == 1 && !IsGEPSrcEleScalable) {
+  // Also skip for non-inbounds GEPs, because the optimization inside is not
+  // correct for regular GEPs.
+  if (GEP.getNumIndices() == 1 && !IsGEPSrcEleScalable && GEP.isInBounds()) {
     unsigned AS = GEP.getPointerAddressSpace();
     if (GEP.getOperand(1)->getType()->getScalarSizeInBits() ==
         DL.getIndexSizeInBits(AS)) {
@@ -2173,7 +2175,6 @@
       }
 
       if (Matched) {
-        // Canonicalize (gep i8* X, (ptrtoint Y)-(ptrtoint X))
         // to (bitcast Y)
         Value *Y;
         if (match(V, m_Sub(m_PtrToInt(m_Value(Y)),
diff --git a/llvm/test/Other/regr-gep-provenance.ll b/llvm/test/Other/regr-gep-provenance.ll
new file mode 100644
--- /dev/null
+++ b/llvm/test/Other/regr-gep-provenance.ll
@@ -0,0 +1,32 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt < %s -S -O3 -o - | FileCheck %s
+
+; This test verifies that we do not optimize GEPs in a way that would lose pointer provenance (e.g.
+; by optimizing a series of operations that result in `null` into a `null` (which does not have
+; any provenance in particular)
+
+define i8 @apple(i8* %x) unnamed_addr #0 {
+; CHECK-LABEL: @apple(
+; CHECK-NEXT:    [[E:%.*]] = load i8, i8* [[X:%.*]], align 1
+; CHECK-NEXT:    ret i8 [[E]]
+;
+  %a = ptrtoint i8* %x to i64
+  %b = sub i64 0, %a
+  %c = getelementptr i8, i8* %x, i64 %b
+  %d = getelementptr i8, i8* %c, i64 %a
+  %e = load i8, i8* %d, align 1
+  ret i8 %e
+}
+
+define i8* @banana(i8* %b) {
+; CHECK-LABEL: @banana(
+; CHECK-NEXT:    [[B_PTR:%.*]] = ptrtoint i8* [[B:%.*]] to i64
+; CHECK-NEXT:    [[SUB:%.*]] = sub i64 0, [[B_PTR]]
+; CHECK-NEXT:    [[GEP:%.*]] = getelementptr i8, i8* [[B]], i64 [[SUB]]
+; CHECK-NEXT:    ret i8* [[GEP]]
+;
+  %b_ptr = ptrtoint i8* %b to i64
+  %sub = sub i64 0, %b_ptr
+  %gep = getelementptr i8, i8* %b, i64 %sub
+  ret i8* %gep
+}