]> git.ipfire.org Git - thirdparty/gcc.git/blobdiff - gcc/ipa-modref.c
Correct a function pre/postcondition [PR102403].
[thirdparty/gcc.git] / gcc / ipa-modref.c
index a9797b26b8da2b48012fc06e254746829b2679df..6d49cc1410e87cbab854a848c1db2ee3fe4058c3 100644 (file)
@@ -1,5 +1,5 @@
 /* Search for references that a functions loads or stores.
-   Copyright (C) 2020 Free Software Foundation, Inc.
+   Copyright (C) 2020-2021 Free Software Foundation, Inc.
    Contributed by David Cepelik and Jan Hubicka
 
 This file is part of GCC.
@@ -20,8 +20,7 @@ along with GCC; see the file COPYING3.  If not see
 
 /* Mod/ref pass records summary about loads and stores performed by the
    function.  This is later used by alias analysis to disambiguate memory
-   accesses across function calls.  The summary has a form of decision tree
-   described in ipa-modref-tree.h.
+   accesses across function calls.
 
    This file contains a tree pass and an IPA pass.  Both performs the same
    analysis however tree pass is executed during early and late optimization
@@ -32,8 +31,27 @@ along with GCC; see the file COPYING3.  If not see
    LTO mode differs from the local mode by not recording alias sets but types
    that are translated to alias sets later.  This is necessary in order stream
    the information because the alias sets are rebuild at stream-in time and may
-   not correspond to ones seen during analysis.  For this reason part of analysis
-   is duplicated.  */
+   not correspond to ones seen during analysis.  For this reason part of
+   analysis is duplicated.
+
+   The following information is computed
+     1) load/store access tree described in ipa-modref-tree.h
+       This is used by tree-ssa-alias to disambiguate load/stores
+     2) EAF flags used by points-to analysis (in tree-ssa-structlias).
+       and defined in tree-core.h.
+   and stored to optimization_summaries.
+
+   There are multiple summaries computed and used during the propagation:
+     - summaries holds summaries from analysis to IPA propagation
+       time.
+     - summaries_lto is same as summaries but holds them in a format
+       that can be streamed (as described above).
+     - fnspec_summary holds fnspec strings for call.  This is
+       necessary because gimple_call_fnspec performs additional
+       analysis except for looking callee fndecl.
+     - escape_summary holds escape points for given call edge.
+       That is a vector recording what function parmaeters
+       may escape to a function call (and with what parameter index).  */
 
 #include "config.h"
 #include "system.h"
@@ -61,6 +79,15 @@ along with GCC; see the file COPYING3.  If not see
 #include "ipa-fnsummary.h"
 #include "attr-fnspec.h"
 #include "symtab-clones.h"
+#include "gimple-ssa.h"
+#include "tree-phinodes.h"
+#include "tree-ssa-operands.h"
+#include "ssa-iterators.h"
+#include "stringpool.h"
+#include "tree-ssanames.h"
+
+
+namespace {
 
 /* We record fnspec specifiers for call edges since they depends on actual
    gimple statements.  */
@@ -100,6 +127,80 @@ public:
 
 static fnspec_summaries_t *fnspec_summaries = NULL;
 
+/* Escape summary holds a vector of param indexes that escape to
+   a given call.  */
+struct escape_entry
+{
+  /* Parameter that escapes at a given call.  */
+  unsigned int parm_index;
+  /* Argument it escapes to.  */
+  unsigned int arg;
+  /* Minimal flags known about the argument.  */
+  eaf_flags_t min_flags;
+  /* Does it escape directly or indirectly?  */
+  bool direct;
+};
+
+/* Dump EAF flags.  */
+
+static void
+dump_eaf_flags (FILE *out, int flags, bool newline = true)
+{
+  if (flags & EAF_DIRECT)
+    fprintf (out, " direct");
+  if (flags & EAF_NOCLOBBER)
+    fprintf (out, " noclobber");
+  if (flags & EAF_NOESCAPE)
+    fprintf (out, " noescape");
+  if (flags & EAF_NODIRECTESCAPE)
+    fprintf (out, " nodirectescape");
+  if (flags & EAF_UNUSED)
+    fprintf (out, " unused");
+  if (flags & EAF_NOT_RETURNED)
+    fprintf (out, " not_returned");
+  if (flags & EAF_NOREAD)
+    fprintf (out, " noread");
+  if (newline)
+  fprintf (out, "\n");
+}
+
+struct escape_summary
+{
+  auto_vec <escape_entry> esc;
+  void dump (FILE *out)
+  {
+    for (unsigned int i = 0; i < esc.length (); i++)
+      {
+       fprintf (out, "   parm %i arg %i %s min:",
+                esc[i].parm_index,
+                esc[i].arg,
+                esc[i].direct ? "(direct)" : "(indirect)");
+       dump_eaf_flags (out, esc[i].min_flags, false);
+      }
+    fprintf (out, "\n");
+  }
+};
+
+class escape_summaries_t : public call_summary <escape_summary *>
+{
+public:
+  escape_summaries_t (symbol_table *symtab)
+      : call_summary <escape_summary *> (symtab) {}
+  /* Hook that is called by summary when an edge is duplicated.  */
+  virtual void duplicate (cgraph_edge *,
+                         cgraph_edge *,
+                         escape_summary *src,
+                         escape_summary *dst)
+  {
+    dst->esc = src->esc.copy ();
+  }
+};
+
+static escape_summaries_t *escape_summaries = NULL;
+
+}  /* ANON namespace: GTY annotated summaries can not be anonymous.  */
+
+
 /* Class (from which there is one global instance) that holds modref summaries
    for all analyzed functions.  */
 
@@ -179,12 +280,63 @@ modref_summary::~modref_summary ()
     ggc_delete (stores);
 }
 
-/* Return true if summary is potentially useful for optimization.  */
+/* All flags that are implied by the ECF_CONST functions.  */
+const int implicit_const_eaf_flags = EAF_DIRECT | EAF_NOCLOBBER | EAF_NOESCAPE
+                                    | EAF_NODIRECTESCAPE | EAF_NOREAD;
+/* All flags that are implied by the ECF_PURE function.  */
+const int implicit_pure_eaf_flags = EAF_NOCLOBBER | EAF_NOESCAPE
+                                   | EAF_NODIRECTESCAPE;
+/* All flags implied when we know we can ignore stores (i.e. when handling
+   call to noreturn).  */
+const int ignore_stores_eaf_flags = EAF_DIRECT | EAF_NOCLOBBER | EAF_NOESCAPE
+                                   | EAF_NODIRECTESCAPE;
+
+/* Remove all flags from EAF_FLAGS that are implied by ECF_FLAGS and not
+   useful to track.  If returns_void is true moreover clear
+   EAF_NOT_RETURNED.  */
+static int
+remove_useless_eaf_flags (int eaf_flags, int ecf_flags, bool returns_void)
+{
+  if (ecf_flags & ECF_NOVOPS)
+    return 0;
+  if (ecf_flags & ECF_CONST)
+    eaf_flags &= ~implicit_const_eaf_flags;
+  else if (ecf_flags & ECF_PURE)
+    eaf_flags &= ~implicit_pure_eaf_flags;
+  else if ((ecf_flags & ECF_NORETURN) || returns_void)
+    eaf_flags &= ~EAF_NOT_RETURNED;
+  /* Only NOCLOBBER or DIRECT flags alone are not useful (see comments
+     in tree-ssa-alias.c).  Give up earlier.  */
+  if ((eaf_flags & ~(EAF_DIRECT | EAF_NOCLOBBER)) == 0)
+    return 0;
+  return eaf_flags;
+}
+
+/* Return true if FLAGS holds some useful information.  */
+
+static bool
+eaf_flags_useful_p (vec <eaf_flags_t> &flags, int ecf_flags)
+{
+  for (unsigned i = 0; i < flags.length (); i++)
+    if (remove_useless_eaf_flags (flags[i], ecf_flags, false))
+      return true;
+  return false;
+}
+
+/* Return true if summary is potentially useful for optimization.
+   If CHECK_FLAGS is false assume that arg_flags are useful.  */
 
 bool
-modref_summary::useful_p (int ecf_flags)
+modref_summary::useful_p (int ecf_flags, bool check_flags)
 {
-  if (ecf_flags & (ECF_CONST | ECF_NOVOPS))
+  if (ecf_flags & ECF_NOVOPS)
+    return false;
+  if (arg_flags.length () && !check_flags)
+    return true;
+  if (check_flags && eaf_flags_useful_p (arg_flags, ecf_flags))
+    return true;
+  arg_flags.release ();
+  if (ecf_flags & ECF_CONST)
     return false;
   if (loads && !loads->every_base)
     return true;
@@ -204,12 +356,13 @@ struct GTY(()) modref_summary_lto
      more verbose and thus more likely to hit the limits.  */
   modref_records_lto *loads;
   modref_records_lto *stores;
+  auto_vec<eaf_flags_t> GTY((skip)) arg_flags;
   bool writes_errno;
 
   modref_summary_lto ();
   ~modref_summary_lto ();
   void dump (FILE *);
-  bool useful_p (int ecf_flags);
+  bool useful_p (int ecf_flags, bool check_flags = true);
 };
 
 /* Summary for a single function which this pass produces.  */
@@ -228,12 +381,20 @@ modref_summary_lto::~modref_summary_lto ()
 }
 
 
-/* Return true if lto summary is potentially useful for optimization.  */
+/* Return true if lto summary is potentially useful for optimization.
+   If CHECK_FLAGS is false assume that arg_flags are useful.  */
 
 bool
-modref_summary_lto::useful_p (int ecf_flags)
+modref_summary_lto::useful_p (int ecf_flags, bool check_flags)
 {
-  if (ecf_flags & (ECF_CONST | ECF_NOVOPS))
+  if (ecf_flags & ECF_NOVOPS)
+    return false;
+  if (arg_flags.length () && !check_flags)
+    return true;
+  if (check_flags && eaf_flags_useful_p (arg_flags, ecf_flags))
+    return true;
+  arg_flags.release ();
+  if (ecf_flags & ECF_CONST)
     return false;
   if (loads && !loads->every_base)
     return true;
@@ -265,6 +426,8 @@ dump_access (modref_access_node *a, FILE *out)
       print_dec ((poly_int64_pod)a->size, out, SIGNED);
       fprintf (out, " max_size:");
       print_dec ((poly_int64_pod)a->max_size, out, SIGNED);
+      if (a->adjustments)
+       fprintf (out, " adjusted %i times", a->adjustments);
     }
   fprintf (out, "\n");
 }
@@ -355,6 +518,64 @@ dump_lto_records (modref_records_lto *tt, FILE *out)
     }
 }
 
+/* Dump all escape points of NODE to OUT.  */
+
+static void
+dump_modref_edge_summaries (FILE *out, cgraph_node *node, int depth)
+{
+  int i = 0;
+  if (!escape_summaries)
+    return;
+  for (cgraph_edge *e = node->indirect_calls; e; e = e->next_callee)
+    {
+      class escape_summary *sum = escape_summaries->get (e);
+      if (sum)
+       {
+         fprintf (out, "%*sIndirect call %i in %s escapes:",
+                  depth, "", i, node->dump_name ());
+         sum->dump (out);
+       }
+      i++;
+    }
+  for (cgraph_edge *e = node->callees; e; e = e->next_callee)
+    {
+      if (!e->inline_failed)
+       dump_modref_edge_summaries (out, e->callee, depth + 1);
+      class escape_summary *sum = escape_summaries->get (e);
+      if (sum)
+       {
+         fprintf (out, "%*sCall %s->%s escapes:", depth, "",
+                  node->dump_name (), e->callee->dump_name ());
+         sum->dump (out);
+       }
+      class fnspec_summary *fsum = fnspec_summaries->get (e);
+      if (fsum)
+       {
+         fprintf (out, "%*sCall %s->%s fnspec: %s\n", depth, "",
+                  node->dump_name (), e->callee->dump_name (),
+                  fsum->fnspec);
+       }
+    }
+}
+
+/* Remove all call edge summaries associated with NODE.  */
+
+static void
+remove_modref_edge_summaries (cgraph_node *node)
+{
+  if (!escape_summaries)
+    return;
+  for (cgraph_edge *e = node->indirect_calls; e; e = e->next_callee)
+    escape_summaries->remove (e);
+  for (cgraph_edge *e = node->callees; e; e = e->next_callee)
+    {
+      if (!e->inline_failed)
+       remove_modref_edge_summaries (e->callee);
+      escape_summaries->remove (e);
+      fnspec_summaries->remove (e);
+    }
+}
+
 /* Dump summary.  */
 
 void
@@ -372,6 +593,15 @@ modref_summary::dump (FILE *out)
     }
   if (writes_errno)
     fprintf (out, "  Writes errno\n");
+  if (arg_flags.length ())
+    {
+      for (unsigned int i = 0; i < arg_flags.length (); i++)
+       if (arg_flags[i])
+         {
+           fprintf (out, "  parm %i flags:", i);
+           dump_eaf_flags (out, arg_flags[i]);
+         }
+    }
 }
 
 /* Dump summary.  */
@@ -385,6 +615,15 @@ modref_summary_lto::dump (FILE *out)
   dump_lto_records (stores, out);
   if (writes_errno)
     fprintf (out, "  Writes errno\n");
+  if (arg_flags.length ())
+    {
+      for (unsigned int i = 0; i < arg_flags.length (); i++)
+       if (arg_flags[i])
+         {
+           fprintf (out, "  parm %i flags:", i);
+           dump_eaf_flags (out, arg_flags[i]);
+         }
+    }
 }
 
 /* Get function summary for FUNC if it exists, return NULL otherwise.  */
@@ -402,7 +641,8 @@ get_modref_function_summary (cgraph_node *func)
      function.  */
   enum availability avail;
   func = func->function_or_virtual_thunk_symbol
-            (&avail, cgraph_node::get (current_function_decl));
+                (&avail, current_function_decl ?
+                         cgraph_node::get (current_function_decl) : NULL);
   if (avail <= AVAIL_INTERPOSABLE)
     return NULL;
 
@@ -418,7 +658,7 @@ get_access (ao_ref *ref)
 
   base = ao_ref_base (ref);
   modref_access_node a = {ref->offset, ref->size, ref->max_size,
-                         0, -1, false};
+                         0, -1, false, 0};
   if (TREE_CODE (base) == MEM_REF || TREE_CODE (base) == TARGET_MEM_REF)
     {
       tree memref = base;
@@ -470,7 +710,7 @@ record_access (modref_records *tt, ao_ref *ref)
        fprintf (dump_file, "   - Recording base_set=%i ref_set=%i parm=%i\n",
                base_set, ref_set, a.parm_index);
     }
-  tt->insert (base_set, ref_set, a);
+  tt->insert (base_set, ref_set, a, false);
 }
 
 /* IPA version of record_access_tree.  */
@@ -536,7 +776,7 @@ record_access_lto (modref_records_lto *tt, ao_ref *ref)
               a.parm_index);
     }
 
-  tt->insert (base_type, ref_type, a);
+  tt->insert (base_type, ref_type, a, false);
 }
 
 /* Returns true if and only if we should store the access to EXPR.
@@ -554,12 +794,23 @@ record_access_p (tree expr)
   return true;
 }
 
+/* Return true if ECF flags says that return value can be ignored.  */
+
+static bool
+ignore_retval_p (tree caller, int flags)
+{
+  if ((flags & (ECF_NORETURN | ECF_NOTHROW)) == (ECF_NORETURN | ECF_NOTHROW)
+      || (!opt_for_fn (caller, flag_exceptions) && (flags & ECF_NORETURN)))
+    return true;
+  return false;
+}
+
 /* Return true if ECF flags says that stores can be ignored.  */
 
 static bool
 ignore_stores_p (tree caller, int flags)
 {
-  if (flags & ECF_PURE)
+  if (flags & (ECF_PURE | ECF_CONST | ECF_NOVOPS))
     return true;
   if ((flags & (ECF_NORETURN | ECF_NOTHROW)) == (ECF_NORETURN | ECF_NOTHROW)
       || (!opt_for_fn (caller, flag_exceptions) && (flags & ECF_NORETURN)))
@@ -609,20 +860,19 @@ parm_map_for_arg (gimple *stmt, int i)
 
 /* Merge side effects of call STMT to function with CALLEE_SUMMARY
    int CUR_SUMMARY.  Return true if something changed.
-   If IGNORE_STORES is true, do not merge stores.  */
+   If IGNORE_STORES is true, do not merge stores.
+   If RECORD_ADJUSTMENTS is true cap number of adjustments to
+   a given access to make dataflow finite.  */
 
 bool
 merge_call_side_effects (modref_summary *cur_summary,
                         gimple *stmt, modref_summary *callee_summary,
-                        bool ignore_stores, cgraph_node *callee_node)
+                        bool ignore_stores, cgraph_node *callee_node,
+                        bool record_adjustments)
 {
   auto_vec <modref_parm_map, 32> parm_map;
   bool changed = false;
 
-  if (dump_file)
-    fprintf (dump_file, " - Merging side effects of %s with parm map:",
-            callee_node->dump_name ());
-
   /* We can not safely optimize based on summary of callee if it does
      not always bind to current def: it is possible that memory load
      was optimized out earlier which may not happen in the interposed
@@ -634,7 +884,11 @@ merge_call_side_effects (modref_summary *cur_summary,
       cur_summary->loads->collapse ();
     }
 
-  parm_map.safe_grow_cleared (gimple_call_num_args (stmt));
+  if (dump_file)
+    fprintf (dump_file, " - Merging side effects of %s with parm map:",
+            callee_node->dump_name ());
+
+  parm_map.safe_grow_cleared (gimple_call_num_args (stmt), true);
   for (unsigned i = 0; i < gimple_call_num_args (stmt); i++)
     {
       parm_map[i] = parm_map_for_arg (stmt, i);
@@ -653,11 +907,13 @@ merge_call_side_effects (modref_summary *cur_summary,
     fprintf (dump_file, "\n");
 
   /* Merge with callee's summary.  */
-  changed |= cur_summary->loads->merge (callee_summary->loads, &parm_map);
+  changed |= cur_summary->loads->merge (callee_summary->loads, &parm_map,
+                                       record_adjustments);
   if (!ignore_stores)
     {
       changed |= cur_summary->stores->merge (callee_summary->stores,
-                                            &parm_map);
+                                            &parm_map,
+                                            record_adjustments);
       if (!cur_summary->writes_errno
          && callee_summary->writes_errno)
        {
@@ -692,7 +948,7 @@ get_access_for_fnspec (gcall *call, attr_fnspec &fnspec,
     }
   modref_access_node a = {0, -1, -1,
                          map.parm_offset, map.parm_index,
-                         map.parm_offset_known};
+                         map.parm_offset_known, 0};
   poly_int64 size_hwi;
   if (size
       && poly_int_tree_p (size, &size_hwi)
@@ -795,12 +1051,14 @@ process_fnspec (modref_summary *cur_summary,
              cur_summary->loads->insert (0, 0,
                                          get_access_for_fnspec (call,
                                                                 fnspec, i,
-                                                                map));
+                                                                map),
+                                         false);
            if (cur_summary_lto)
              cur_summary_lto->loads->insert (0, 0,
                                              get_access_for_fnspec (call,
                                                                     fnspec, i,
-                                                                    map));
+                                                                    map),
+                                             false);
          }
     }
   if (ignore_stores)
@@ -828,12 +1086,14 @@ process_fnspec (modref_summary *cur_summary,
              cur_summary->stores->insert (0, 0,
                                           get_access_for_fnspec (call,
                                                                  fnspec, i,
-                                                                 map));
+                                                                 map),
+                                          false);
            if (cur_summary_lto)
              cur_summary_lto->stores->insert (0, 0,
                                               get_access_for_fnspec (call,
                                                                      fnspec, i,
-                                                                     map));
+                                                                     map),
+                                              false);
          }
       if (fnspec.errno_maybe_written_p () && flag_errno_math)
        {
@@ -919,7 +1179,7 @@ analyze_call (modref_summary *cur_summary, modref_summary_lto *cur_summary_lto,
     }
 
   merge_call_side_effects (cur_summary, stmt, callee_summary, ignore_stores,
-                          callee_node);
+                          callee_node, false);
 
   return true;
 }
@@ -1031,11 +1291,13 @@ analyze_stmt (modref_summary *summary, modref_summary_lto *summary_lto,
            && (!fnspec.global_memory_read_p ()
                || !fnspec.global_memory_written_p ()))
          {
-           fnspec_summaries->get_create
-                (cgraph_node::get (current_function_decl)->get_edge (stmt))
-                       ->fnspec = xstrdup (fnspec.get_str ());
-           if (dump_file)
-             fprintf (dump_file, "  Recorded fnspec %s\n", fnspec.get_str ());
+           cgraph_edge *e = cgraph_node::get (current_function_decl)->get_edge (stmt);
+           if (e->callee)
+             {
+               fnspec_summaries->get_create (e)->fnspec = xstrdup (fnspec.get_str ());
+               if (dump_file)
+                 fprintf (dump_file, "  Recorded fnspec %s\n", fnspec.get_str ());
+             }
          }
       }
      return true;
@@ -1061,147 +1323,830 @@ remove_summary (bool lto, bool nolto, bool ipa)
        summaries->remove (fnode);
       if (lto)
        summaries_lto->remove (fnode);
+      remove_modref_edge_summaries (fnode);
     }
   if (dump_file)
     fprintf (dump_file,
             " - modref done with result: not tracked.\n");
 }
 
-/* Analyze function F.  IPA indicates whether we're running in local mode
-   (false) or the IPA mode (true).  */
+/* Return true if OP accesses memory pointed to by SSA_NAME.  */
 
-static void
-analyze_function (function *f, bool ipa)
+bool
+memory_access_to (tree op, tree ssa_name)
 {
-  if (dump_file)
-    fprintf (dump_file, "modref analyzing '%s' (ipa=%i)%s%s\n",
-            function_name (f), ipa,
-            TREE_READONLY (current_function_decl) ? " (const)" : "",
-            DECL_PURE_P (current_function_decl) ? " (pure)" : "");
+  tree base = get_base_address (op);
+  if (!base)
+    return false;
+  if (TREE_CODE (base) != MEM_REF && TREE_CODE (base) != TARGET_MEM_REF)
+    return false;
+  return TREE_OPERAND (base, 0) == ssa_name;
+}
 
-  /* Don't analyze this function if it's compiled with -fno-strict-aliasing.  */
-  if (!flag_ipa_modref)
-    return;
+/* Consider statement val = *arg.
+   return EAF flags of ARG that can be determined from EAF flags of VAL
+   (which are known to be FLAGS).  If IGNORE_STORES is true we can ignore
+   all stores to VAL, i.e. when handling noreturn function.  */
 
-  /* Compute no-LTO summaries when local optimization is going to happen.  */
-  bool nolto = (!ipa || ((!flag_lto || flag_fat_lto_objects) && !in_lto_p)
-               || (in_lto_p && !flag_wpa
-                   && flag_incremental_link != INCREMENTAL_LINK_LTO));
-  /* Compute LTO when LTO streaming is going to happen.  */
-  bool lto = ipa && ((flag_lto && !in_lto_p)
-                    || flag_wpa
-                    || flag_incremental_link == INCREMENTAL_LINK_LTO);
-  cgraph_node *fnode = cgraph_node::get (current_function_decl);
+static int
+deref_flags (int flags, bool ignore_stores)
+{
+  int ret = EAF_NODIRECTESCAPE;
+  /* If argument is unused just account for
+     the read involved in dereference.  */
+  if (flags & EAF_UNUSED)
+    ret |= EAF_DIRECT | EAF_NOCLOBBER | EAF_NOESCAPE | EAF_NOT_RETURNED;
+  else
+    {
+      if ((flags & EAF_NOCLOBBER) || ignore_stores)
+       ret |= EAF_NOCLOBBER;
+      if ((flags & EAF_NOESCAPE) || ignore_stores)
+       ret |= EAF_NOESCAPE;
+      /* If the value dereferenced is not used for another load or store
+        we can still consider ARG as used only directly.
+
+        Consider
+
+        int
+        test (int *a)
+          {
+            return *a!=0;
+          }
+
+       */
+      if ((flags & (EAF_NOREAD | EAF_NOT_RETURNED | EAF_NOESCAPE | EAF_DIRECT))
+         == (EAF_NOREAD | EAF_NOT_RETURNED | EAF_NOESCAPE | EAF_DIRECT)
+         && ((flags & EAF_NOCLOBBER) || ignore_stores))
+       ret |= EAF_DIRECT;
+      if (flags & EAF_NOT_RETURNED)
+       ret |= EAF_NOT_RETURNED;
+    }
+  return ret;
+}
 
-  modref_summary *summary = NULL;
-  modref_summary_lto *summary_lto = NULL;
+namespace {
 
-  /* Initialize the summary.
-     If we run in local mode there is possibly pre-existing summary from
-     IPA pass.  Dump it so it is easy to compare if mod-ref info has
-     improved.  */
-  if (!ipa)
+/* Description of an escape point.  */
+
+struct escape_point
+{
+  /* Value escapes to this call.  */
+  gcall *call;
+  /* Argument it escapes to.  */
+  int arg;
+  /* Flags already known about the argument (this can save us from recording
+     esape points if local analysis did good job already).  */
+  eaf_flags_t min_flags;
+  /* Does value escape directly or indiretly?  */
+  bool direct;
+};
+
+class modref_lattice
+{
+public:
+  /* EAF flags of the SSA name.  */
+  eaf_flags_t flags;
+  /* DFS bookkkeeping: we don't do real dataflow yet.  */
+  bool known;
+  bool open;
+
+  /* When doing IPA analysis we can not merge in callee escape points;
+     Only remember them and do the merging at IPA propagation time.  */
+  vec <escape_point, va_heap, vl_ptr> escape_points;
+
+  void init ();
+  void release ();
+  bool merge (const modref_lattice &with);
+  bool merge (int flags);
+  bool merge_deref (const modref_lattice &with, bool ignore_stores);
+  bool merge_direct_load ();
+  bool merge_direct_store ();
+  bool add_escape_point (gcall *call, int arg, int min_flags, bool diret);
+  void dump (FILE *out, int indent = 0) const;
+};
+
+/* Lattices are saved to vectors, so keep them PODs.  */
+void
+modref_lattice::init ()
+{
+  /* All flags we track.  */
+  int f = EAF_DIRECT | EAF_NOCLOBBER | EAF_NOESCAPE | EAF_UNUSED
+         | EAF_NODIRECTESCAPE | EAF_NOT_RETURNED | EAF_NOREAD;
+  flags = f;
+  /* Check that eaf_flags_t is wide enough to hold all flags.  */
+  gcc_checking_assert (f == flags);
+  open = true;
+  known = false;
+}
+
+/* Release memory.  */
+void
+modref_lattice::release ()
+{
+  escape_points.release ();
+}
+
+/* Dump lattice to OUT; indent with INDENT spaces.  */
+
+void
+modref_lattice::dump (FILE *out, int indent) const
+{
+  dump_eaf_flags (out, flags);
+  if (escape_points.length ())
     {
-      if (!optimization_summaries)
-       optimization_summaries = modref_summaries::create_ggc (symtab);
-      else /* Remove existing summary if we are re-running the pass.  */
+      fprintf (out, "%*sEscapes:\n", indent, "");
+      for (unsigned int i = 0; i < escape_points.length (); i++)
        {
-         if (dump_file
-             && (summary
-                 = optimization_summaries->get (cgraph_node::get (f->decl)))
-                != NULL
-             && summary->loads)
-           {
-             fprintf (dump_file, "Past summary:\n");
-             optimization_summaries->get
-                (cgraph_node::get (f->decl))->dump (dump_file);
-           }
-         optimization_summaries->remove (cgraph_node::get (f->decl));
+         fprintf (out, "%*s  Arg %i (%s) min flags", indent, "",
+                  escape_points[i].arg,
+                  escape_points[i].direct ? "direct" : "indirect");
+         dump_eaf_flags (out, escape_points[i].min_flags, false);
+         fprintf (out, " in call ");
+         print_gimple_stmt (out, escape_points[i].call, 0);
        }
-      summary = optimization_summaries->get_create (cgraph_node::get (f->decl));
-      gcc_checking_assert (nolto && !lto);
     }
-  /* In IPA mode we analyze every function precisely once.  Assert that.  */
-  else
-    {
-      if (nolto)
-       {
-         if (!summaries)
-           summaries = modref_summaries::create_ggc (symtab);
-         else
-           summaries->remove (cgraph_node::get (f->decl));
-         summary = summaries->get_create (cgraph_node::get (f->decl));
-       }
-      if (lto)
-       {
-         if (!summaries_lto)
-           summaries_lto = modref_summaries_lto::create_ggc (symtab);
-         else
-           summaries_lto->remove (cgraph_node::get (f->decl));
-         summary_lto = summaries_lto->get_create (cgraph_node::get (f->decl));
-       }
-      if (!fnspec_summaries)
-       fnspec_summaries = new fnspec_summaries_t (symtab);
-     }
+}
 
+/* Add escape point CALL, ARG, MIN_FLAGS, DIRECT.  Return false if such escape
+   point exists.  */
 
-  /* Create and initialize summary for F.
-     Note that summaries may be already allocated from previous
-     run of the pass.  */
-  if (nolto)
-    {
-      gcc_assert (!summary->loads);
-      summary->loads = modref_records::create_ggc (param_modref_max_bases,
-                                                  param_modref_max_refs,
-                                                  param_modref_max_accesses);
-      gcc_assert (!summary->stores);
-      summary->stores = modref_records::create_ggc (param_modref_max_bases,
-                                                   param_modref_max_refs,
-                                                   param_modref_max_accesses);
-      summary->writes_errno = false;
-    }
-  if (lto)
+bool
+modref_lattice::add_escape_point (gcall *call, int arg, int min_flags,
+                                 bool direct)
+{
+  escape_point *ep;
+  unsigned int i;
+
+  /* If we already determined flags to be bad enough,
+     we do not need to record.  */
+  if ((flags & min_flags) == flags || (min_flags & EAF_UNUSED))
+    return false;
+
+  FOR_EACH_VEC_ELT (escape_points, i, ep)
+    if (ep->call == call && ep->arg == arg && ep->direct == direct)
+      {
+       if ((ep->min_flags & min_flags) == min_flags)
+         return false;
+       ep->min_flags &= min_flags;
+       return true;
+      }
+  /* Give up if max escape points is met.  */
+  if ((int)escape_points.length () > param_modref_max_escape_points)
     {
-      gcc_assert (!summary_lto->loads);
-      summary_lto->loads = modref_records_lto::create_ggc
-                                (param_modref_max_bases,
-                                 param_modref_max_refs,
-                                 param_modref_max_accesses);
-      gcc_assert (!summary_lto->stores);
-      summary_lto->stores = modref_records_lto::create_ggc
-                                (param_modref_max_bases,
-                                 param_modref_max_refs,
-                                 param_modref_max_accesses);
-      summary_lto->writes_errno = false;
+      if (dump_file)
+       fprintf (dump_file, "--param modref-max-escape-points limit reached\n");
+      merge (0);
+      return true;
     }
-  int ecf_flags = flags_from_decl_or_type (current_function_decl);
-  auto_vec <gimple *, 32> recursive_calls;
+  escape_point new_ep = {call, arg, min_flags, direct};
+  escape_points.safe_push (new_ep);
+  return true;
+}
 
-  /* Analyze each statement in each basic block of the function.  If the
-     statement cannot be analyzed (for any reason), the entire function cannot
-     be analyzed by modref.  */
-  basic_block bb;
-  FOR_EACH_BB_FN (bb, f)
-    {
-      gimple_stmt_iterator si;
-      for (si = gsi_after_labels (bb); !gsi_end_p (si); gsi_next (&si))
-       {
-         if (!analyze_stmt (summary, summary_lto,
-                            gsi_stmt (si), ipa, &recursive_calls)
-             || ((!summary || !summary->useful_p (ecf_flags))
-                 && (!summary_lto || !summary_lto->useful_p (ecf_flags))))
-           {
-             remove_summary (lto, nolto, ipa);
-             return;
-           }
-       }
+/* Merge in flags from F.  */
+bool
+modref_lattice::merge (int f)
+{
+  if (f & EAF_UNUSED)
+    return false;
+  /* Noescape implies that value also does not escape directly.
+     Fnspec machinery does set both so compensate for this.  */
+  if (f & EAF_NOESCAPE)
+    f |= EAF_NODIRECTESCAPE;
+  if ((flags & f) != flags)
+    {
+      flags &= f;
+      /* Prune obvoiusly useless flags;
+        We do not have ECF_FLAGS handy which is not big problem since
+        we will do final flags cleanup before producing summary.
+        Merging should be fast so it can work well with dataflow.  */
+      flags = remove_useless_eaf_flags (flags, 0, false);
+      if (!flags)
+       escape_points.release ();
+      return true;
     }
+  return false;
+}
 
-  /* In non-IPA mode we need to perform iterative datafow on recursive calls.
-     This needs to be done after all other side effects are computed.  */
-  if (!ipa)
+/* Merge in WITH.  Return true if anyting changed.  */
+
+bool
+modref_lattice::merge (const modref_lattice &with)
+{
+  if (!with.known)
+    return merge (0);
+
+  bool changed = merge (with.flags);
+
+  if (!flags)
+    return changed;
+  for (unsigned int i = 0; i < with.escape_points.length (); i++)
+    changed |= add_escape_point (with.escape_points[i].call,
+                                with.escape_points[i].arg,
+                                with.escape_points[i].min_flags,
+                                with.escape_points[i].direct);
+  return changed;
+}
+
+/* Merge in deref of WITH.  If IGNORE_STORES is true do not consider
+   stores.  Return true if anyting changed.  */
+
+bool
+modref_lattice::merge_deref (const modref_lattice &with, bool ignore_stores)
+{
+  if (!with.known)
+    return merge (0);
+
+  bool changed = merge (deref_flags (with.flags, ignore_stores));
+
+  if (!flags)
+    return changed;
+  for (unsigned int i = 0; i < with.escape_points.length (); i++)
+    {
+      int min_flags = with.escape_points[i].min_flags;
+
+      if (with.escape_points[i].direct)
+       min_flags = deref_flags (min_flags, ignore_stores);
+      else if (ignore_stores)
+       min_flags |= ignore_stores_eaf_flags;
+      changed |= add_escape_point (with.escape_points[i].call,
+                                  with.escape_points[i].arg,
+                                  min_flags,
+                                  false);
+    }
+  return changed;
+}
+
+/* Merge in flags for direct load.  */
+
+bool
+modref_lattice::merge_direct_load ()
+{
+  return merge (~(EAF_UNUSED | EAF_NOREAD));
+}
+
+/* Merge in flags for direct store.  */
+
+bool
+modref_lattice::merge_direct_store ()
+{
+  return merge (~(EAF_UNUSED | EAF_NOCLOBBER));
+}
+
+}  /* ANON namespace.  */
+
+static void analyze_ssa_name_flags (tree name,
+                                   vec<modref_lattice> &lattice,
+                                   int depth, bool ipa);
+
+/* Call statements may return their parameters.  Consider argument number
+   ARG of USE_STMT and determine flags that can needs to be cleared
+   in case pointer possibly indirectly references from ARG I is returned.
+   LATTICE, DEPTH and ipa are same as in analyze_ssa_name_flags.  */
+
+static void
+merge_call_lhs_flags (gcall *call, int arg, int index, bool deref,
+                     vec<modref_lattice> &lattice,
+                     int depth, bool ipa)
+{
+  /* If there is no return value, no flags are affected.  */
+  if (!gimple_call_lhs (call))
+    return;
+
+  /* If we know that function returns given argument and it is not ARG
+     we can still be happy.  */
+  int flags = gimple_call_return_flags (call);
+  if ((flags & ERF_RETURNS_ARG)
+      && (flags & ERF_RETURN_ARG_MASK) != arg)
+    return;
+
+  if (gimple_call_arg_flags (call, arg) & (EAF_NOT_RETURNED | EAF_UNUSED))
+    return;
+
+  /* If return value is SSA name determine its flags.  */
+  if (TREE_CODE (gimple_call_lhs (call)) == SSA_NAME)
+    {
+      tree lhs = gimple_call_lhs (call);
+      analyze_ssa_name_flags (lhs, lattice, depth + 1, ipa);
+      if (deref)
+       lattice[index].merge_deref (lattice[SSA_NAME_VERSION (lhs)], false);
+      else
+       lattice[index].merge (lattice[SSA_NAME_VERSION (lhs)]);
+    }
+  /* In the case of memory store we can do nothing.  */
+  else
+    lattice[index].merge (0);
+}
+
+/* Analyze EAF flags for SSA name NAME and store result to LATTICE.
+   LATTICE is an array of modref_lattices.
+   DEPTH is a recursion depth used to make debug output prettier.
+   If IPA is true we analyze for IPA propagation (and thus call escape points
+   are processed later)  */
+
+static void
+analyze_ssa_name_flags (tree name, vec<modref_lattice> &lattice, int depth,
+                       bool ipa)
+{
+  imm_use_iterator ui;
+  gimple *use_stmt;
+  int index = SSA_NAME_VERSION (name);
+
+  /* See if value is already computed.  */
+  if (lattice[index].known)
+   return;
+  if (lattice[index].open)
+    {
+      if (dump_file)
+       fprintf (dump_file,
+                "%*sGiving up on a cycle in SSA graph\n", depth * 4, "");
+      return;
+    }
+  if (depth == param_modref_max_depth)
+    {
+      if (dump_file)
+       fprintf (dump_file,
+                "%*sGiving up on max depth\n", depth * 4, "");
+      return;
+    }
+  /* Recursion guard.  */
+  lattice[index].init ();
+
+  if (dump_file)
+    {
+      fprintf (dump_file,
+              "%*sAnalyzing flags of ssa name: ", depth * 4, "");
+      print_generic_expr (dump_file, name);
+      fprintf (dump_file, "\n");
+    }
+
+  FOR_EACH_IMM_USE_STMT (use_stmt, ui, name)
+    {
+      if (lattice[index].flags == 0)
+       break;
+      if (is_gimple_debug (use_stmt))
+       continue;
+      if (dump_file)
+       {
+         fprintf (dump_file, "%*s  Analyzing stmt: ", depth * 4, "");
+         print_gimple_stmt (dump_file, use_stmt, 0);
+       }
+      /* If we see a direct non-debug use, clear unused bit.
+        All dereferneces should be accounted below using deref_flags.  */
+      lattice[index].merge (~EAF_UNUSED);
+
+      /* Gimple return may load the return value.
+        Returning name counts as an use by tree-ssa-structalias.c  */
+      if (greturn *ret = dyn_cast <greturn *> (use_stmt))
+       {
+         if (gimple_return_retval (ret) == name)
+           lattice[index].merge (~(EAF_UNUSED | EAF_NOT_RETURNED));
+         else if (memory_access_to (gimple_return_retval (ret), name))
+           {
+             lattice[index].merge_direct_load ();
+             lattice[index].merge (~(EAF_UNUSED | EAF_NOT_RETURNED));
+           }
+       }
+      /* Account for LHS store, arg loads and flags from callee function.  */
+      else if (gcall *call = dyn_cast <gcall *> (use_stmt))
+       {
+         tree callee = gimple_call_fndecl (call);
+
+         /* IPA PTA internally it treats calling a function as "writing" to
+            the argument space of all functions the function pointer points to
+            (PR101949).  We can not drop EAF_NOCLOBBER only when ipa-pta
+            is on since that would allow propagation of this from -fno-ipa-pta
+            to -fipa-pta functions.  */
+         if (gimple_call_fn (use_stmt) == name)
+           lattice[index].merge (~(EAF_NOCLOBBER | EAF_UNUSED));
+
+         /* Recursion would require bit of propagation; give up for now.  */
+         if (callee && !ipa && recursive_call_p (current_function_decl,
+                                                 callee))
+           lattice[index].merge (0);
+         else
+           {
+             int ecf_flags = gimple_call_flags (call);
+             bool ignore_stores = ignore_stores_p (current_function_decl,
+                                                   ecf_flags);
+             bool ignore_retval = ignore_retval_p (current_function_decl,
+                                                   ecf_flags);
+
+             /* Handle *name = func (...).  */
+             if (gimple_call_lhs (call)
+                 && memory_access_to (gimple_call_lhs (call), name))
+               {
+                 lattice[index].merge_direct_store ();
+                 /* Return slot optimization passes address of
+                    LHS to callee via hidden parameter and this
+                    may make LHS to escape.  See PR 98499.  */
+                 if (gimple_call_return_slot_opt_p (call)
+                     && TREE_ADDRESSABLE (TREE_TYPE (gimple_call_lhs (call))))
+                   lattice[index].merge (EAF_NOREAD | EAF_DIRECT);
+               }
+
+             /* We do not track accesses to the static chain (we could)
+                so give up.  */
+             if (gimple_call_chain (call)
+                 && (gimple_call_chain (call) == name))
+               lattice[index].merge (0);
+
+             /* Process internal functions and right away.  */
+             bool record_ipa = ipa && !gimple_call_internal_p (call);
+
+             /* Handle all function parameters.  */
+             for (unsigned i = 0;
+                  i < gimple_call_num_args (call) && lattice[index].flags; i++)
+               /* Name is directly passed to the callee.  */
+               if (gimple_call_arg (call, i) == name)
+                 {
+                   if (!(ecf_flags & (ECF_CONST | ECF_NOVOPS)))
+                     {
+                       int call_flags = gimple_call_arg_flags (call, i)
+                                        | EAF_NOT_RETURNED;
+                       if (ignore_stores)
+                         call_flags |= ignore_stores_eaf_flags;
+
+                       if (!record_ipa)
+                         lattice[index].merge (call_flags);
+                       else
+                         lattice[index].add_escape_point (call, i,
+                                                          call_flags, true);
+                     }
+                   if (!ignore_retval)
+                     merge_call_lhs_flags (call, i, index, false,
+                                           lattice, depth, ipa);
+                 }
+               /* Name is dereferenced and passed to a callee.  */
+               else if (memory_access_to (gimple_call_arg (call, i), name))
+                 {
+                   if (ecf_flags & (ECF_CONST | ECF_NOVOPS))
+                     lattice[index].merge_direct_load ();
+                   else
+                     {
+                       int call_flags = deref_flags
+                          (gimple_call_arg_flags (call, i)
+                           | EAF_NOT_RETURNED, ignore_stores);
+                       if (!record_ipa)
+                         lattice[index].merge (call_flags);
+                       else
+                         lattice[index].add_escape_point (call, i,
+                                                          call_flags, false);
+                     }
+                   if (!ignore_retval)
+                     merge_call_lhs_flags (call, i, index, true,
+                                           lattice, depth, ipa);
+                 }
+           }
+       }
+      else if (gimple_assign_load_p (use_stmt))
+       {
+         gassign *assign = as_a <gassign *> (use_stmt);
+         /* Memory to memory copy.  */
+         if (gimple_store_p (assign))
+           {
+             /* Handle *lhs = *name.
+
+                We do not track memory locations, so assume that value
+                is used arbitrarily.  */
+             if (memory_access_to (gimple_assign_rhs1 (assign), name))
+               lattice[index].merge (0);
+             /* Handle *name = *exp.  */
+             else if (memory_access_to (gimple_assign_lhs (assign), name))
+               lattice[index].merge_direct_store ();
+           }
+         /* Handle lhs = *name.  */
+         else if (memory_access_to (gimple_assign_rhs1 (assign), name))
+           {
+             tree lhs = gimple_assign_lhs (assign);
+             analyze_ssa_name_flags (lhs, lattice, depth + 1, ipa);
+             lattice[index].merge_deref (lattice[SSA_NAME_VERSION (lhs)],
+                                         false);
+           }
+       }
+      else if (gimple_store_p (use_stmt))
+       {
+         gassign *assign = dyn_cast <gassign *> (use_stmt);
+
+         /* Handle *lhs = name.  */
+         if (assign && gimple_assign_rhs1 (assign) == name)
+           {
+             if (dump_file)
+               fprintf (dump_file, "%*s  ssa name saved to memory\n",
+                        depth * 4, "");
+             lattice[index].merge (0);
+           }
+         /* Handle *name = exp.  */
+         else if (assign
+                  && memory_access_to (gimple_assign_lhs (assign), name))
+           {
+             /* In general we can not ignore clobbers because they are
+                barriers for code motion, however after inlining it is safe to
+                do because local optimization passes do not consider clobbers
+                from other functions.  Similar logic is in ipa-pure-const.c.  */
+             if (!cfun->after_inlining || !gimple_clobber_p (assign))
+               lattice[index].merge_direct_store ();
+           }
+         /* ASM statements etc.  */
+         else if (!assign)
+           {
+             if (dump_file)
+               fprintf (dump_file, "%*s  Unhandled store\n",
+                        depth * 4, "");
+             lattice[index].merge (0);
+           }
+       }
+      else if (gassign *assign = dyn_cast <gassign *> (use_stmt))
+       {
+         enum tree_code code = gimple_assign_rhs_code (assign);
+
+         /* See if operation is a merge as considered by
+            tree-ssa-structalias.c:find_func_aliases.  */
+         if (!truth_value_p (code)
+             && code != POINTER_DIFF_EXPR
+             && (code != POINTER_PLUS_EXPR
+                 || gimple_assign_rhs1 (assign) == name))
+           {
+             tree lhs = gimple_assign_lhs (assign);
+             analyze_ssa_name_flags (lhs, lattice, depth + 1, ipa);
+             lattice[index].merge (lattice[SSA_NAME_VERSION (lhs)]);
+           }
+       }
+      else if (gphi *phi = dyn_cast <gphi *> (use_stmt))
+       {
+         tree result = gimple_phi_result (phi);
+         analyze_ssa_name_flags (result, lattice, depth + 1, ipa);
+         lattice[index].merge (lattice[SSA_NAME_VERSION (result)]);
+       }
+      /* Conditions are not considered escape points
+        by tree-ssa-structalias.  */
+      else if (gimple_code (use_stmt) == GIMPLE_COND)
+       ;
+      else
+       {
+         if (dump_file)
+           fprintf (dump_file, "%*s  Unhandled stmt\n", depth * 4, "");
+         lattice[index].merge (0);
+       }
+
+      if (dump_file)
+       {
+         fprintf (dump_file, "%*s  current flags of ", depth * 4, "");
+         print_generic_expr (dump_file, name);
+         lattice[index].dump (dump_file, depth * 4 + 4);
+       }
+    }
+  if (dump_file)
+    {
+      fprintf (dump_file, "%*sflags of ssa name ", depth * 4, "");
+      print_generic_expr (dump_file, name);
+      lattice[index].dump (dump_file, depth * 4 + 2);
+    }
+  lattice[index].open = false;
+  lattice[index].known = true;
+}
+
+/* Determine EAF flags for function parameters.  */
+
+static void
+analyze_parms (modref_summary *summary, modref_summary_lto *summary_lto,
+              bool ipa)
+{
+  unsigned int parm_index = 0;
+  unsigned int count = 0;
+  int ecf_flags = flags_from_decl_or_type (current_function_decl);
+
+  /* For novops functions we have nothing to gain by EAF flags.  */
+  if (ecf_flags & ECF_NOVOPS)
+    return;
+
+  for (tree parm = DECL_ARGUMENTS (current_function_decl); parm;
+       parm = TREE_CHAIN (parm))
+    count++;
+
+  if (!count)
+    return;
+
+  auto_vec<modref_lattice> lattice;
+  lattice.safe_grow_cleared (num_ssa_names, true);
+
+  for (tree parm = DECL_ARGUMENTS (current_function_decl); parm; parm_index++,
+       parm = TREE_CHAIN (parm))
+    {
+      tree name = ssa_default_def (cfun, parm);
+      if (!name || has_zero_uses (name))
+       {
+         /* We do not track non-SSA parameters,
+            but we want to track unused gimple_regs.  */
+         if (!is_gimple_reg (parm))
+           continue;
+         if (summary)
+           {
+             if (parm_index >= summary->arg_flags.length ())
+               summary->arg_flags.safe_grow_cleared (count, true);
+             summary->arg_flags[parm_index] = EAF_UNUSED;
+           }
+         else if (summary_lto)
+           {
+             if (parm_index >= summary_lto->arg_flags.length ())
+               summary_lto->arg_flags.safe_grow_cleared (count, true);
+             summary_lto->arg_flags[parm_index] = EAF_UNUSED;
+           }
+         continue;
+       }
+      analyze_ssa_name_flags (name, lattice, 0, ipa);
+      int flags = lattice[SSA_NAME_VERSION (name)].flags;
+
+      /* Eliminate useless flags so we do not end up storing unnecessary
+        summaries.  */
+
+      flags = remove_useless_eaf_flags
+                (flags, ecf_flags,
+                 VOID_TYPE_P (TREE_TYPE (TREE_TYPE (current_function_decl))));
+
+      if (flags)
+       {
+         if (summary)
+           {
+             if (parm_index >= summary->arg_flags.length ())
+               summary->arg_flags.safe_grow_cleared (count, true);
+             summary->arg_flags[parm_index] = flags;
+           }
+         else if (summary_lto)
+           {
+             if (parm_index >= summary_lto->arg_flags.length ())
+               summary_lto->arg_flags.safe_grow_cleared (count, true);
+             summary_lto->arg_flags[parm_index] = flags;
+           }
+         if (lattice[SSA_NAME_VERSION (name)].escape_points.length ())
+           {
+             escape_point *ep;
+             unsigned int ip;
+             cgraph_node *node = cgraph_node::get (current_function_decl);
+
+             gcc_checking_assert (ipa);
+             FOR_EACH_VEC_ELT
+                 (lattice[SSA_NAME_VERSION (name)].escape_points, ip, ep)
+               if ((ep->min_flags & flags) != flags)
+                 {
+                   cgraph_edge *e = node->get_edge (ep->call);
+                   struct escape_entry ee = {parm_index, ep->arg,
+                                             ep->min_flags, ep->direct};
+
+                   escape_summaries->get_create (e)->esc.safe_push (ee);
+                 }
+           }
+       }
+    }
+  if (ipa)
+    for (unsigned int i = 0; i < num_ssa_names; i++)
+      lattice[i].release ();
+}
+
+/* Analyze function F.  IPA indicates whether we're running in local mode
+   (false) or the IPA mode (true).  */
+
+static void
+analyze_function (function *f, bool ipa)
+{
+  if (dump_file)
+    fprintf (dump_file, "modref analyzing '%s' (ipa=%i)%s%s\n",
+            function_name (f), ipa,
+            TREE_READONLY (current_function_decl) ? " (const)" : "",
+            DECL_PURE_P (current_function_decl) ? " (pure)" : "");
+
+  /* Don't analyze this function if it's compiled with -fno-strict-aliasing.  */
+  if (!flag_ipa_modref)
+    return;
+
+  /* Compute no-LTO summaries when local optimization is going to happen.  */
+  bool nolto = (!ipa || ((!flag_lto || flag_fat_lto_objects) && !in_lto_p)
+               || (in_lto_p && !flag_wpa
+                   && flag_incremental_link != INCREMENTAL_LINK_LTO));
+  /* Compute LTO when LTO streaming is going to happen.  */
+  bool lto = ipa && ((flag_lto && !in_lto_p)
+                    || flag_wpa
+                    || flag_incremental_link == INCREMENTAL_LINK_LTO);
+  cgraph_node *fnode = cgraph_node::get (current_function_decl);
+
+  modref_summary *summary = NULL;
+  modref_summary_lto *summary_lto = NULL;
+
+  /* Initialize the summary.
+     If we run in local mode there is possibly pre-existing summary from
+     IPA pass.  Dump it so it is easy to compare if mod-ref info has
+     improved.  */
+  if (!ipa)
+    {
+      if (!optimization_summaries)
+       optimization_summaries = modref_summaries::create_ggc (symtab);
+      else /* Remove existing summary if we are re-running the pass.  */
+       {
+         if (dump_file
+             && (summary
+                 = optimization_summaries->get (cgraph_node::get (f->decl)))
+                != NULL
+             && summary->loads)
+           {
+             fprintf (dump_file, "Past summary:\n");
+             optimization_summaries->get
+                (cgraph_node::get (f->decl))->dump (dump_file);
+           }
+         optimization_summaries->remove (cgraph_node::get (f->decl));
+       }
+      summary = optimization_summaries->get_create (cgraph_node::get (f->decl));
+      gcc_checking_assert (nolto && !lto);
+    }
+  /* In IPA mode we analyze every function precisely once.  Assert that.  */
+  else
+    {
+      if (nolto)
+       {
+         if (!summaries)
+           summaries = modref_summaries::create_ggc (symtab);
+         else
+           summaries->remove (cgraph_node::get (f->decl));
+         summary = summaries->get_create (cgraph_node::get (f->decl));
+       }
+      if (lto)
+       {
+         if (!summaries_lto)
+           summaries_lto = modref_summaries_lto::create_ggc (symtab);
+         else
+           summaries_lto->remove (cgraph_node::get (f->decl));
+         summary_lto = summaries_lto->get_create (cgraph_node::get (f->decl));
+       }
+      if (!fnspec_summaries)
+       fnspec_summaries = new fnspec_summaries_t (symtab);
+      if (!escape_summaries)
+       escape_summaries = new escape_summaries_t (symtab);
+     }
+
+
+  /* Create and initialize summary for F.
+     Note that summaries may be already allocated from previous
+     run of the pass.  */
+  if (nolto)
+    {
+      gcc_assert (!summary->loads);
+      summary->loads = modref_records::create_ggc (param_modref_max_bases,
+                                                  param_modref_max_refs,
+                                                  param_modref_max_accesses);
+      gcc_assert (!summary->stores);
+      summary->stores = modref_records::create_ggc (param_modref_max_bases,
+                                                   param_modref_max_refs,
+                                                   param_modref_max_accesses);
+      summary->writes_errno = false;
+    }
+  if (lto)
+    {
+      gcc_assert (!summary_lto->loads);
+      summary_lto->loads = modref_records_lto::create_ggc
+                                (param_modref_max_bases,
+                                 param_modref_max_refs,
+                                 param_modref_max_accesses);
+      gcc_assert (!summary_lto->stores);
+      summary_lto->stores = modref_records_lto::create_ggc
+                                (param_modref_max_bases,
+                                 param_modref_max_refs,
+                                 param_modref_max_accesses);
+      summary_lto->writes_errno = false;
+    }
+
+  analyze_parms (summary, summary_lto, ipa);
+
+  int ecf_flags = flags_from_decl_or_type (current_function_decl);
+  auto_vec <gimple *, 32> recursive_calls;
+
+  /* Analyze each statement in each basic block of the function.  If the
+     statement cannot be analyzed (for any reason), the entire function cannot
+     be analyzed by modref.  */
+  basic_block bb;
+  FOR_EACH_BB_FN (bb, f)
+    {
+      gimple_stmt_iterator si;
+      for (si = gsi_start_nondebug_after_labels_bb (bb);
+          !gsi_end_p (si); gsi_next_nondebug (&si))
+       {
+         if (!analyze_stmt (summary, summary_lto,
+                            gsi_stmt (si), ipa, &recursive_calls)
+             || ((!summary || !summary->useful_p (ecf_flags, false))
+                 && (!summary_lto
+                     || !summary_lto->useful_p (ecf_flags, false))))
+           {
+             collapse_loads (summary, summary_lto);
+             collapse_stores (summary, summary_lto);
+             break;
+           }
+       }
+    }
+
+  /* In non-IPA mode we need to perform iterative datafow on recursive calls.
+     This needs to be done after all other side effects are computed.  */
+  if (!ipa)
     {
       bool changed = true;
+      bool first = true;
       while (changed)
        {
          changed = false;
@@ -1212,13 +2157,14 @@ analyze_function (function *f, bool ipa)
                           ignore_stores_p (current_function_decl,
                                            gimple_call_flags
                                                 (recursive_calls[i])),
-                          fnode);
-             if (!summary->useful_p (ecf_flags))
+                          fnode, !first);
+             if (!summary->useful_p (ecf_flags, false))
                {
                  remove_summary (lto, nolto, ipa);
                  return;
                }
            }
+         first = false;
        }
     }
   if (summary && !summary->useful_p (ecf_flags))
@@ -1234,6 +2180,8 @@ analyze_function (function *f, bool ipa)
       summaries_lto->remove (fnode);
       summary_lto = NULL;
     }
+  if (ipa && !summary && !summary_lto)
+    remove_modref_edge_summaries (fnode);
 
   if (dump_file)
     {
@@ -1242,6 +2190,7 @@ analyze_function (function *f, bool ipa)
        summary->dump (dump_file);
       if (summary_lto)
        summary_lto->dump (dump_file);
+      dump_modref_edge_summaries (dump_file, fnode, 2);
     }
 }
 
@@ -1329,6 +2278,8 @@ modref_summaries::duplicate (cgraph_node *, cgraph_node *dst,
                         src_data->loads->max_accesses);
   dst_data->loads->copy_from (src_data->loads);
   dst_data->writes_errno = src_data->writes_errno;
+  if (src_data->arg_flags.length ())
+    dst_data->arg_flags = src_data->arg_flags.copy ();
 }
 
 /* Called when new clone is inserted to callgraph late.  */
@@ -1352,6 +2303,8 @@ modref_summaries_lto::duplicate (cgraph_node *, cgraph_node *,
                         src_data->loads->max_accesses);
   dst_data->loads->copy_from (src_data->loads);
   dst_data->writes_errno = src_data->writes_errno;
+  if (src_data->arg_flags.length ())
+    dst_data->arg_flags = src_data->arg_flags.copy ();
 }
 
 namespace
@@ -1493,9 +2446,9 @@ read_modref_records (lto_input_block *ib, struct data_in *data_in,
       if (nolto_ret)
        nolto_base_node = (*nolto_ret)->insert_base (base_tree
                                                     ? get_alias_set (base_tree)
-                                                    : 0);
+                                                    : 0, 0);
       if (lto_ret)
-       lto_base_node = (*lto_ret)->insert_base (base_tree);
+       lto_base_node = (*lto_ret)->insert_base (base_tree, 0);
       size_t every_ref = streamer_read_uhwi (ib);
       size_t nref = streamer_read_uhwi (ib);
 
@@ -1562,18 +2515,61 @@ read_modref_records (lto_input_block *ib, struct data_in *data_in,
                    }
                }
              modref_access_node a = {offset, size, max_size, parm_offset,
-                                     parm_index, parm_offset_known};
+                                     parm_index, parm_offset_known, false};
              if (nolto_ref_node)
-               nolto_ref_node->insert_access (a, max_accesses);
+               nolto_ref_node->insert_access (a, max_accesses, false);
              if (lto_ref_node)
-               lto_ref_node->insert_access (a, max_accesses);
+               lto_ref_node->insert_access (a, max_accesses, false);
            }
        }
     }
-  if (lto_ret)
-    (*lto_ret)->cleanup ();
-  if (nolto_ret)
-    (*nolto_ret)->cleanup ();
+  if (lto_ret)
+    (*lto_ret)->cleanup ();
+  if (nolto_ret)
+    (*nolto_ret)->cleanup ();
+}
+
+/* Write ESUM to BP.  */
+
+static void
+modref_write_escape_summary (struct bitpack_d *bp, escape_summary *esum)
+{
+  if (!esum)
+    {
+      bp_pack_var_len_unsigned (bp, 0);
+      return;
+    }
+  bp_pack_var_len_unsigned (bp, esum->esc.length ());
+  unsigned int i;
+  escape_entry *ee;
+  FOR_EACH_VEC_ELT (esum->esc, i, ee)
+    {
+      bp_pack_var_len_unsigned (bp, ee->parm_index);
+      bp_pack_var_len_unsigned (bp, ee->arg);
+      bp_pack_var_len_unsigned (bp, ee->min_flags);
+      bp_pack_value (bp, ee->direct, 1);
+    }
+}
+
+/* Read escape summary for E from BP.  */
+
+static void
+modref_read_escape_summary (struct bitpack_d *bp, cgraph_edge *e)
+{
+  unsigned int n = bp_unpack_var_len_unsigned (bp);
+  if (!n)
+    return;
+  escape_summary *esum = escape_summaries->get_create (e);
+  esum->esc.reserve_exact (n);
+  for (unsigned int i = 0; i < n; i++)
+    {
+      escape_entry ee;
+      ee.parm_index = bp_unpack_var_len_unsigned (bp);
+      ee.arg = bp_unpack_var_len_unsigned (bp);
+      ee.min_flags = bp_unpack_var_len_unsigned (bp);
+      ee.direct = bp_unpack_value (bp, 1);
+      esum->esc.quick_push (ee);
+    }
 }
 
 /* Callback for write_summary.  */
@@ -1622,6 +2618,10 @@ modref_write ()
 
          streamer_write_uhwi (ob, lto_symtab_encoder_encode (encoder, cnode));
 
+         streamer_write_uhwi (ob, r->arg_flags.length ());
+         for (unsigned int i = 0; i < r->arg_flags.length (); i++)
+           streamer_write_uhwi (ob, r->arg_flags[i]);
+
          write_modref_records (r->loads, ob);
          write_modref_records (r->stores, ob);
 
@@ -1636,6 +2636,8 @@ modref_write ()
                  bp_pack_value (&bp, sum != NULL, 1);
                  if (sum)
                    bp_pack_string (ob, &bp, sum->fnspec, true);
+                 class escape_summary *esum = escape_summaries->get (e);
+                 modref_write_escape_summary (&bp,esum);
                }
              for (cgraph_edge *e = cnode->callees; e; e = e->next_callee)
                {
@@ -1643,6 +2645,8 @@ modref_write ()
                  bp_pack_value (&bp, sum != NULL, 1);
                  if (sum)
                    bp_pack_string (ob, &bp, sum->fnspec, true);
+                 class escape_summary *esum = escape_summaries->get (e);
+                 modref_write_escape_summary (&bp,esum);
                }
            }
          streamer_write_bitpack (&bp);
@@ -1700,6 +2704,19 @@ read_section (struct lto_file_decl_data *file_data, const char *data,
                                  && !modref_sum->stores));
       gcc_assert (!modref_sum_lto || (!modref_sum_lto->loads
                                      && !modref_sum_lto->stores));
+      unsigned int args = streamer_read_uhwi (&ib);
+      if (args && modref_sum)
+       modref_sum->arg_flags.reserve_exact (args);
+      if (args && modref_sum_lto)
+       modref_sum_lto->arg_flags.reserve_exact (args);
+      for (unsigned int i = 0; i < args; i++)
+       {
+         eaf_flags_t flags = streamer_read_uhwi (&ib);
+         if (modref_sum)
+           modref_sum->arg_flags.quick_push (flags);
+         if (modref_sum_lto)
+           modref_sum_lto->arg_flags.quick_push (flags);
+       }
       read_modref_records (&ib, data_in,
                           modref_sum ? &modref_sum->loads : NULL,
                           modref_sum_lto ? &modref_sum_lto->loads : NULL);
@@ -1723,6 +2740,7 @@ read_section (struct lto_file_decl_data *file_data, const char *data,
                  class fnspec_summary *sum = fnspec_summaries->get_create (e);
                  sum->fnspec = xstrdup (bp_unpack_string (data_in, &bp));
                }
+             modref_read_escape_summary (&bp, e);
            }
          for (cgraph_edge *e = node->callees; e; e = e->next_callee)
            {
@@ -1731,6 +2749,7 @@ read_section (struct lto_file_decl_data *file_data, const char *data,
                  class fnspec_summary *sum = fnspec_summaries->get_create (e);
                  sum->fnspec = xstrdup (bp_unpack_string (data_in, &bp));
                }
+             modref_read_escape_summary (&bp, e);
            }
        }
       if (dump_file)
@@ -1741,6 +2760,7 @@ read_section (struct lto_file_decl_data *file_data, const char *data,
            modref_sum->dump (dump_file);
          if (modref_sum_lto)
            modref_sum_lto->dump (dump_file);
+         dump_modref_edge_summaries (dump_file, node, 4);
        }
     }
 
@@ -1771,6 +2791,8 @@ modref_read (void)
        summaries = modref_summaries::create_ggc (symtab);
       if (!fnspec_summaries)
        fnspec_summaries = new fnspec_summaries_t (symtab);
+      if (!escape_summaries)
+       escape_summaries = new escape_summaries_t (symtab);
     }
 
   while ((file_data = file_data_vec[j++]))
@@ -1790,6 +2812,34 @@ modref_read (void)
     }
 }
 
+/* Recompute arg_flags for param adjustments in INFO.  */
+
+static void
+remap_arg_flags (auto_vec <eaf_flags_t> &arg_flags, clone_info *info)
+{
+  auto_vec<eaf_flags_t> old = arg_flags.copy ();
+  int max = -1;
+  size_t i;
+  ipa_adjusted_param *p;
+
+  arg_flags.release ();
+
+  FOR_EACH_VEC_SAFE_ELT (info->param_adjustments->m_adj_params, i, p)
+    {
+      int o = info->param_adjustments->get_original_index (i);
+      if (o >= 0 && (int)old.length () > o && old[o])
+       max = i;
+    }
+  if (max >= 0)
+    arg_flags.safe_grow_cleared (max + 1, true);
+  FOR_EACH_VEC_SAFE_ELT (info->param_adjustments->m_adj_params, i, p)
+    {
+      int o = info->param_adjustments->get_original_index (i);
+      if (o >= 0 && (int)old.length () > o && old[o])
+       arg_flags[i] = old[o];
+    }
+}
+
 /* If signature changed, update the summary.  */
 
 static void
@@ -1809,7 +2859,10 @@ update_signature (struct cgraph_node *node)
     {
       fprintf (dump_file, "Updating summary for %s from:\n",
               node->dump_name ());
-      r->dump (dump_file);
+      if (r)
+       r->dump (dump_file);
+      if (r_lto)
+       r_lto->dump (dump_file);
     }
 
   size_t i, max = 0;
@@ -1837,11 +2890,15 @@ update_signature (struct cgraph_node *node)
     {
       r->loads->remap_params (&map);
       r->stores->remap_params (&map);
+      if (r->arg_flags.length ())
+       remap_arg_flags (r->arg_flags, info);
     }
   if (r_lto)
     {
       r_lto->loads->remap_params (&map);
       r_lto->stores->remap_params (&map);
+      if (r_lto->arg_flags.length ())
+       remap_arg_flags (r_lto->arg_flags, info);
     }
   if (dump_file)
     {
@@ -1944,7 +3001,7 @@ compute_parm_map (cgraph_edge *callee_edge, vec<modref_parm_map> *parm_map)
   class ipa_edge_args *args;
   if (ipa_node_params_sum
       && !callee_edge->call_stmt_cannot_inline_p
-      && (args = IPA_EDGE_REF (callee_edge)) != NULL)
+      && (args = ipa_edge_args_sum->get (callee_edge)) != NULL)
     {
       int i, count = ipa_get_cs_argument_count (args);
       class ipa_node_params *caller_parms_info, *callee_pi;
@@ -1954,12 +3011,13 @@ compute_parm_map (cgraph_edge *callee_edge, vec<modref_parm_map> *parm_map)
         = callee_edge->callee->function_or_virtual_thunk_symbol
                              (NULL, callee_edge->caller);
 
-      caller_parms_info = IPA_NODE_REF (callee_edge->caller->inlined_to
-                                       ? callee_edge->caller->inlined_to
-                                       : callee_edge->caller);
-      callee_pi = IPA_NODE_REF (callee);
+      caller_parms_info
+       = ipa_node_params_sum->get (callee_edge->caller->inlined_to
+                                   ? callee_edge->caller->inlined_to
+                                   : callee_edge->caller);
+      callee_pi = ipa_node_params_sum->get (callee);
 
-      (*parm_map).safe_grow_cleared (count);
+      (*parm_map).safe_grow_cleared (count, true);
 
       for (i = 0; i < count; i++)
        {
@@ -2009,7 +3067,7 @@ compute_parm_map (cgraph_edge *callee_edge, vec<modref_parm_map> *parm_map)
                (!(ipa_get_jf_ancestor_offset (jf) & (BITS_PER_UNIT - 1)));
              (*parm_map)[i].parm_offset
                 = ipa_get_jf_ancestor_offset (jf) >> LOG2_BITS_PER_UNIT;
-           }
+           }
          else
            (*parm_map)[i].parm_index = -1;
        }
@@ -2025,6 +3083,70 @@ compute_parm_map (cgraph_edge *callee_edge, vec<modref_parm_map> *parm_map)
   return false;
 }
 
+/* Map used to translate escape infos.  */
+
+struct escape_map
+{
+  int parm_index;
+  bool direct;
+};
+
+/* Update escape map fo E.  */
+
+static void
+update_escape_summary_1 (cgraph_edge *e,
+                        vec <vec <escape_map>> &map,
+                        bool ignore_stores)
+{
+  escape_summary *sum = escape_summaries->get (e);
+  if (!sum)
+    return;
+  auto_vec <escape_entry> old = sum->esc.copy ();
+  sum->esc.release ();
+
+  unsigned int i;
+  escape_entry *ee;
+  FOR_EACH_VEC_ELT (old, i, ee)
+    {
+      unsigned int j;
+      struct escape_map *em;
+      if (ee->parm_index >= map.length ())
+       continue;
+      FOR_EACH_VEC_ELT (map[ee->parm_index], j, em)
+       {
+         int min_flags = ee->min_flags;
+         if (ee->direct && !em->direct)
+           min_flags = deref_flags (min_flags, ignore_stores);
+         struct escape_entry entry = {em->parm_index, ee->arg,
+                                      ee->min_flags,
+                                      ee->direct & em->direct};
+         sum->esc.safe_push (entry);
+       }
+    }
+  if (!sum->esc.length ())
+    escape_summaries->remove (e);
+}
+
+/* Update escape map fo NODE.  */
+
+static void
+update_escape_summary (cgraph_node *node,
+                      vec <vec <escape_map>> &map,
+                      bool ignore_stores)
+{
+  if (!escape_summaries)
+    return;
+  for (cgraph_edge *e = node->indirect_calls; e; e = e->next_callee)
+    update_escape_summary_1 (e, map, ignore_stores);
+  for (cgraph_edge *e = node->callees; e; e = e->next_callee)
+    {
+      if (!e->inline_failed)
+       update_escape_summary (e->callee, map, ignore_stores);
+      else
+       update_escape_summary_1 (e, map, ignore_stores);
+    }
+}
+
 /* Call EDGE was inlined; merge summary from callee to the caller.  */
 
 void
@@ -2045,6 +3167,7 @@ ipa_merge_modref_summary_after_inlining (cgraph_edge *edge)
        summaries->remove (edge->callee);
       if (summaries_lto)
        summaries_lto->remove (edge->callee);
+      remove_modref_edge_summaries (edge->callee);
       return;
     }
 
@@ -2053,26 +3176,21 @@ ipa_merge_modref_summary_after_inlining (cgraph_edge *edge)
   class modref_summary_lto *callee_info_lto
                 = summaries_lto ? summaries_lto->get (edge->callee) : NULL;
   int flags = flags_from_decl_or_type (edge->callee->decl);
+  bool ignore_stores = ignore_stores_p (edge->caller->decl, flags);
 
   if (!callee_info && to_info)
     {
-      if (ignore_stores_p (edge->caller->decl, flags))
+      if (!(flags & (ECF_CONST | ECF_NOVOPS)))
        to_info->loads->collapse ();
-      else
-       {
-         summaries->remove (to);
-         to_info = NULL;
-       }
+      if (!ignore_stores)
+       to_info->stores->collapse ();
     }
   if (!callee_info_lto && to_info_lto)
     {
-      if (ignore_stores_p (edge->caller->decl, flags))
+      if (!(flags & (ECF_CONST | ECF_NOVOPS)))
        to_info_lto->loads->collapse ();
-      else
-       {
-         summaries_lto->remove (to);
-         to_info_lto = NULL;
-       }
+      if (!ignore_stores)
+       to_info_lto->stores->collapse ();
     }
   if (callee_info || callee_info_lto)
     {
@@ -2080,18 +3198,84 @@ ipa_merge_modref_summary_after_inlining (cgraph_edge *edge)
 
       compute_parm_map (edge, &parm_map);
 
-      if (!ignore_stores_p (edge->caller->decl, flags))
+      if (!ignore_stores)
        {
          if (to_info && callee_info)
-           to_info->stores->merge (callee_info->stores, &parm_map);
+           to_info->stores->merge (callee_info->stores, &parm_map, false);
          if (to_info_lto && callee_info_lto)
-           to_info_lto->stores->merge (callee_info_lto->stores, &parm_map);
+           to_info_lto->stores->merge (callee_info_lto->stores, &parm_map,
+                                       false);
+       }
+      if (!(flags & (ECF_CONST | ECF_NOVOPS)))
+       {
+         if (to_info && callee_info)
+           to_info->loads->merge (callee_info->loads, &parm_map, false);
+         if (to_info_lto && callee_info_lto)
+           to_info_lto->loads->merge (callee_info_lto->loads, &parm_map,
+                                      false);
        }
-      if (to_info && callee_info)
-       to_info->loads->merge (callee_info->loads, &parm_map);
-      if (to_info_lto && callee_info_lto)
-       to_info_lto->loads->merge (callee_info_lto->loads, &parm_map);
     }
+
+  /* Now merge escape summaries.
+     For every escape to the callee we need to merge calle flags
+     and remap calees escapes.  */
+  class escape_summary *sum = escape_summaries->get (edge);
+  int max_escape = -1;
+  escape_entry *ee;
+  unsigned int i;
+
+  if (sum && !(flags & (ECF_CONST | ECF_NOVOPS)))
+    FOR_EACH_VEC_ELT (sum->esc, i, ee)
+      if ((int)ee->arg > max_escape)
+       max_escape = ee->arg;
+
+  auto_vec <vec <struct escape_map>, 32> emap (max_escape + 1);
+  emap.safe_grow (max_escape + 1, true);
+  for (i = 0; (int)i < max_escape + 1; i++)
+    emap[i] = vNULL;
+
+  if (sum && !(flags & (ECF_CONST | ECF_NOVOPS)))
+    FOR_EACH_VEC_ELT (sum->esc, i, ee)
+      {
+       bool needed = false;
+       if (to_info && to_info->arg_flags.length () > ee->parm_index)
+         {
+           int flags = callee_info
+                       && callee_info->arg_flags.length () > ee->arg
+                       ? callee_info->arg_flags[ee->arg] : 0;
+           if (!ee->direct)
+             flags = deref_flags (flags, ignore_stores);
+           else if (ignore_stores)
+             flags |= ignore_stores_eaf_flags;
+           flags |= ee->min_flags;
+           to_info->arg_flags[ee->parm_index] &= flags;
+           if (to_info->arg_flags[ee->parm_index])
+             needed = true;
+         }
+       if (to_info_lto && to_info_lto->arg_flags.length () > ee->parm_index)
+         {
+           int flags = callee_info_lto
+                       && callee_info_lto->arg_flags.length () > ee->arg
+                       ? callee_info_lto->arg_flags[ee->arg] : 0;
+           if (!ee->direct)
+             flags = deref_flags (flags, ignore_stores);
+           else if (ignore_stores)
+             flags |= ignore_stores_eaf_flags;
+           flags |= ee->min_flags;
+           to_info_lto->arg_flags[ee->parm_index] &= flags;
+           if (to_info_lto->arg_flags[ee->parm_index])
+             needed = true;
+         }
+       struct escape_map entry = {ee->parm_index, ee->direct};
+       if (needed)
+         emap[ee->arg].safe_push (entry);
+      }
+  update_escape_summary (edge->callee, emap, ignore_stores);
+  for (i = 0; (int)i < max_escape + 1; i++)
+    emap[i].release ();
+  if (sum)
+    escape_summaries->remove (edge);
+
   if (summaries)
     {
       if (to_info && !to_info->useful_p (flags))
@@ -2100,6 +3284,7 @@ ipa_merge_modref_summary_after_inlining (cgraph_edge *edge)
            fprintf (dump_file, "Removed mod-ref summary for %s\n",
                     to->dump_name ());
          summaries->remove (to);
+         to_info = NULL;
        }
       else if (to_info && dump_file)
        {
@@ -2126,10 +3311,13 @@ ipa_merge_modref_summary_after_inlining (cgraph_edge *edge)
            fprintf (dump_file, "Updated mod-ref summary for %s\n",
                     to->dump_name ());
          to_info_lto->dump (dump_file);
+         to_info_lto = NULL;
        }
       if (callee_info_lto)
        summaries_lto->remove (edge->callee);
     }
+  if (!to_info && !to_info_lto)
+    remove_modref_edge_summaries (to);
   return;
 }
 
@@ -2162,8 +3350,8 @@ get_access_for_fnspec (cgraph_edge *e, attr_fnspec &fnspec,
     {
       cgraph_node *node = e->caller->inlined_to
                          ? e->caller->inlined_to : e->caller;
-      class ipa_node_params *caller_parms_info = IPA_NODE_REF (node);
-      class ipa_edge_args *args = IPA_EDGE_REF (e);
+      ipa_node_params *caller_parms_info = ipa_node_params_sum->get (node);
+      ipa_edge_args *args = ipa_edge_args_sum->get (e);
       struct ipa_jump_func *jf = ipa_get_ith_jump_func (args, size_arg);
 
       if (jf)
@@ -2174,7 +3362,7 @@ get_access_for_fnspec (cgraph_edge *e, attr_fnspec &fnspec,
     size = TYPE_SIZE_UNIT (get_parm_type (e->callee->decl, i));
   modref_access_node a = {0, -1, -1,
                          map.parm_offset, map.parm_index,
-                         map.parm_offset_known};
+                         map.parm_offset_known, 0};
   poly_int64 size_hwi;
   if (size
       && poly_int_tree_p (size, &size_hwi)
@@ -2193,13 +3381,10 @@ get_access_for_fnspec (cgraph_edge *e, attr_fnspec &fnspec,
 static bool
 propagate_unknown_call (cgraph_node *node,
                        cgraph_edge *e, int ecf_flags,
-                       modref_summary **cur_summary_ptr,
-                       modref_summary_lto **cur_summary_lto_ptr)
+                       modref_summary *cur_summary,
+                       modref_summary_lto *cur_summary_lto)
 {
   bool changed = false;
-  modref_summary *cur_summary = cur_summary_ptr ? *cur_summary_ptr : NULL;
-  modref_summary_lto *cur_summary_lto = cur_summary_lto_ptr
-                                       ? *cur_summary_lto_ptr : NULL;
   class fnspec_summary *fnspec_sum = fnspec_summaries->get (e);
   auto_vec <modref_parm_map, 32> parm_map;
   if (fnspec_sum
@@ -2230,10 +3415,10 @@ propagate_unknown_call (cgraph_node *node,
                }
              if (cur_summary)
                changed |= cur_summary->loads->insert
-                 (0, 0, get_access_for_fnspec (e, fnspec, i, map));
+                 (0, 0, get_access_for_fnspec (e, fnspec, i, map), false);
              if (cur_summary_lto)
                changed |= cur_summary_lto->loads->insert
-                 (0, 0, get_access_for_fnspec (e, fnspec, i, map));
+                 (0, 0, get_access_for_fnspec (e, fnspec, i, map), false);
            }
        }
       if (ignore_stores_p (node->decl, ecf_flags))
@@ -2260,10 +3445,10 @@ propagate_unknown_call (cgraph_node *node,
                }
              if (cur_summary)
                changed |= cur_summary->stores->insert
-                 (0, 0, get_access_for_fnspec (e, fnspec, i, map));
+                 (0, 0, get_access_for_fnspec (e, fnspec, i, map), false);
              if (cur_summary_lto)
                changed |= cur_summary_lto->stores->insert
-                 (0, 0, get_access_for_fnspec (e, fnspec, i, map));
+                 (0, 0, get_access_for_fnspec (e, fnspec, i, map), false);
            }
        }
       if (fnspec.errno_maybe_written_p () && flag_errno_math)
@@ -2281,31 +3466,48 @@ propagate_unknown_call (cgraph_node *node,
        }
       return changed;
     }
-  if (ignore_stores_p (node->decl, ecf_flags))
+  if (dump_file)
+    fprintf (dump_file, "      collapsing loads\n");
+  changed |= collapse_loads (cur_summary, cur_summary_lto);
+  if (!ignore_stores_p (node->decl, ecf_flags))
     {
       if (dump_file)
-       fprintf (dump_file, "      collapsing loads\n");
-      return collapse_loads (cur_summary, cur_summary_lto);
+       fprintf (dump_file, "      collapsing stores\n");
+      changed |= collapse_stores (cur_summary, cur_summary_lto);
+    }
+  return changed;
+}
+
+/* Maybe remove summaies of NODE pointed to by CUR_SUMMARY_PTR
+   and CUR_SUMMARY_LTO_PTR if they are useless according to ECF_FLAGS.  */
+
+static void
+remove_useless_summaries (cgraph_node *node,
+                         modref_summary **cur_summary_ptr,
+                         modref_summary_lto **cur_summary_lto_ptr,
+                         int ecf_flags)
+{
+  if (*cur_summary_ptr && !(*cur_summary_ptr)->useful_p (ecf_flags, false))
+    {
+      optimization_summaries->remove (node);
+      *cur_summary_ptr = NULL;
+    }
+  if (*cur_summary_lto_ptr
+      && !(*cur_summary_lto_ptr)->useful_p (ecf_flags, false))
+    {
+      summaries_lto->remove (node);
+      *cur_summary_lto_ptr = NULL;
     }
-  if (optimization_summaries)
-    optimization_summaries->remove (node);
-  if (summaries_lto)
-    summaries_lto->remove (node);
-  if (cur_summary_ptr)
-    *cur_summary_ptr = NULL;
-  if (cur_summary_lto_ptr)
-    *cur_summary_lto_ptr = NULL;
-  if (dump_file)
-    fprintf (dump_file, "    Giving up\n");
-  return true;
 }
 
-/* Perform iterative dataflow on SCC component starting in COMPONENT_NODE.  */
+/* Perform iterative dataflow on SCC component starting in COMPONENT_NODE
+   and propagate loads/stores.  */
 
 static void
 modref_propagate_in_scc (cgraph_node *component_node)
 {
   bool changed = true;
+  bool first = true;
   int iteration = 0;
 
   while (changed)
@@ -2325,6 +3527,8 @@ modref_propagate_in_scc (cgraph_node *component_node)
          if (!cur_summary && !cur_summary_lto)
            continue;
 
+         int cur_ecf_flags = flags_from_decl_or_type (node->decl);
+
          if (dump_file)
            fprintf (dump_file, "  Processing %s%s%s\n",
                     cur->dump_name (),
@@ -2338,11 +3542,17 @@ modref_propagate_in_scc (cgraph_node *component_node)
              if (dump_file)
                fprintf (dump_file, "    Indirect call"
                         "collapsing loads\n");
-             changed |= propagate_unknown_call
+             if (propagate_unknown_call
                           (node, e, e->indirect_info->ecf_flags,
-                           &cur_summary, &cur_summary_lto);
-             if (!cur_summary && !cur_summary_lto)
-               break;
+                           cur_summary, cur_summary_lto))
+               {
+                 changed = true;
+                 remove_useless_summaries (node, &cur_summary,
+                                           &cur_summary_lto,
+                                           cur_ecf_flags);
+                 if (!cur_summary && !cur_summary_lto)
+                   break;
+               }
            }
 
          if (!cur_summary && !cur_summary_lto)
@@ -2386,7 +3596,7 @@ modref_propagate_in_scc (cgraph_node *component_node)
                             " or not available\n");
                  changed |= propagate_unknown_call
                               (node, callee_edge, flags,
-                               &cur_summary, &cur_summary_lto);
+                               cur_summary, cur_summary_lto);
                  if (!cur_summary && !cur_summary_lto)
                    break;
                  continue;
@@ -2402,9 +3612,7 @@ modref_propagate_in_scc (cgraph_node *component_node)
                    fprintf (dump_file, "      No call target summary\n");
                  changed |= propagate_unknown_call
                               (node, callee_edge, flags,
-                               &cur_summary, NULL);
-                 if (!cur_summary && !cur_summary_lto)
-                   break;
+                               cur_summary, NULL);
                }
              if (cur_summary_lto
                  && !(callee_summary_lto = summaries_lto->get (callee)))
@@ -2413,9 +3621,7 @@ modref_propagate_in_scc (cgraph_node *component_node)
                    fprintf (dump_file, "      No call target summary\n");
                  changed |= propagate_unknown_call
                               (node, callee_edge, flags,
-                               NULL, &cur_summary_lto);
-                 if (!cur_summary && !cur_summary_lto)
-                   break;
+                               NULL, cur_summary_lto);
                }
 
              /* We can not safely optimize based on summary of callee if it
@@ -2439,11 +3645,12 @@ modref_propagate_in_scc (cgraph_node *component_node)
              if (callee_summary)
                {
                  changed |= cur_summary->loads->merge
-                                 (callee_summary->loads, &parm_map);
+                                 (callee_summary->loads, &parm_map, !first);
                  if (!ignore_stores)
                    {
                      changed |= cur_summary->stores->merge
-                                     (callee_summary->stores, &parm_map);
+                                     (callee_summary->stores, &parm_map,
+                                      !first);
                      if (!cur_summary->writes_errno
                          && callee_summary->writes_errno)
                        {
@@ -2455,11 +3662,13 @@ modref_propagate_in_scc (cgraph_node *component_node)
              if (callee_summary_lto)
                {
                  changed |= cur_summary_lto->loads->merge
-                                 (callee_summary_lto->loads, &parm_map);
+                                 (callee_summary_lto->loads, &parm_map,
+                                  !first);
                  if (!ignore_stores)
                    {
                      changed |= cur_summary_lto->stores->merge
-                                     (callee_summary_lto->stores, &parm_map);
+                                     (callee_summary_lto->stores, &parm_map,
+                                      !first);
                      if (!cur_summary_lto->writes_errno
                          && callee_summary_lto->writes_errno)
                        {
@@ -2468,52 +3677,260 @@ modref_propagate_in_scc (cgraph_node *component_node)
                        }
                    }
                }
+             if (changed)
+               remove_useless_summaries (node, &cur_summary,
+                                         &cur_summary_lto,
+                                         cur_ecf_flags);
+             if (!cur_summary && !cur_summary_lto)
+               break;
              if (dump_file && changed)
                {
                  if (cur_summary)
                    cur_summary->dump (dump_file);
                  if (cur_summary_lto)
                    cur_summary_lto->dump (dump_file);
+                 dump_modref_edge_summaries (dump_file, node, 4);
                }
            }
        }
       iteration++;
+      first = false;
     }
   if (dump_file)
+    fprintf (dump_file,
+            "Propagation finished in %i iterations\n", iteration);
+}
+
+/* Dump results of propagation in SCC rooted in COMPONENT_NODE.  */
+
+static void
+modref_propagate_dump_scc (cgraph_node *component_node)
+{
+  for (struct cgraph_node *cur = component_node; cur;
+       cur = ((struct ipa_dfs_info *) cur->aux)->next_cycle)
+    if (!cur->inlined_to)
+      {
+       modref_summary *cur_summary = optimization_summaries
+                                     ? optimization_summaries->get (cur)
+                                     : NULL;
+       modref_summary_lto *cur_summary_lto = summaries_lto
+                                             ? summaries_lto->get (cur)
+                                             : NULL;
+
+       fprintf (dump_file, "Propagated modref for %s%s%s\n",
+                cur->dump_name (),
+                TREE_READONLY (cur->decl) ? " (const)" : "",
+                DECL_PURE_P (cur->decl) ? " (pure)" : "");
+       if (optimization_summaries)
+         {
+           if (cur_summary)
+             cur_summary->dump (dump_file);
+           else
+             fprintf (dump_file, "  Not tracked\n");
+         }
+       if (summaries_lto)
+         {
+           if (cur_summary_lto)
+             cur_summary_lto->dump (dump_file);
+           else
+             fprintf (dump_file, "  Not tracked (lto)\n");
+         }
+      }
+}
+
+/* Process escapes in SUM and merge SUMMARY to CUR_SUMMARY
+   and SUMMARY_LTO to CUR_SUMMARY_LTO.
+   Return true if something changed.  */
+
+static bool
+modref_merge_call_site_flags (escape_summary *sum,
+                             modref_summary *cur_summary,
+                             modref_summary_lto *cur_summary_lto,
+                             modref_summary *summary,
+                             modref_summary_lto *summary_lto,
+                             tree caller,
+                             int ecf_flags)
+{
+  escape_entry *ee;
+  unsigned int i;
+  bool changed = false;
+  bool ignore_stores = ignore_stores_p (caller, ecf_flags);
+
+  /* If we have no useful info to propagate.  */
+  if ((!cur_summary || !cur_summary->arg_flags.length ())
+      && (!cur_summary_lto || !cur_summary_lto->arg_flags.length ()))
+    return false;
+
+  FOR_EACH_VEC_ELT (sum->esc, i, ee)
     {
-      fprintf (dump_file,
-              "Propagation finished in %i iterations\n", iteration);
+      int flags = 0;
+      int flags_lto = 0;
+
+      if (summary && ee->arg < summary->arg_flags.length ())
+       flags = summary->arg_flags[ee->arg];
+      if (summary_lto
+         && ee->arg < summary_lto->arg_flags.length ())
+       flags_lto = summary_lto->arg_flags[ee->arg];
+      if (!ee->direct)
+       {
+         flags = deref_flags (flags, ignore_stores);
+         flags_lto = deref_flags (flags_lto, ignore_stores);
+       }
+      else if (ignore_stores)
+       {
+         flags |= ignore_stores_eaf_flags;
+         flags_lto |= ignore_stores_eaf_flags;
+       }
+      /* Returning the value is already accounted to at local propagation.  */
+      flags |= ee->min_flags | EAF_NOT_RETURNED;
+      flags_lto |= ee->min_flags | EAF_NOT_RETURNED;
+      /* Noescape implies that value also does not escape directly.
+        Fnspec machinery does set both so compensate for this.  */
+      if (flags & EAF_NOESCAPE)
+       flags |= EAF_NODIRECTESCAPE;
+      if (flags_lto & EAF_NOESCAPE)
+       flags_lto |= EAF_NODIRECTESCAPE;
+      if (!(flags & EAF_UNUSED)
+         && cur_summary && ee->parm_index < cur_summary->arg_flags.length ())
+       {
+         int f = cur_summary->arg_flags[ee->parm_index];
+         if ((f & flags) != f)
+           {
+             f = remove_useless_eaf_flags
+                        (f & flags, ecf_flags,
+                         VOID_TYPE_P (TREE_TYPE (TREE_TYPE (caller))));
+             cur_summary->arg_flags[ee->parm_index] = f;
+             changed = true;
+           }
+       }
+      if (!(flags_lto & EAF_UNUSED)
+         && cur_summary_lto
+         && ee->parm_index < cur_summary_lto->arg_flags.length ())
+       {
+         int f = cur_summary_lto->arg_flags[ee->parm_index];
+         if ((f & flags_lto) != f)
+           {
+             f = remove_useless_eaf_flags
+                        (f & flags_lto, ecf_flags,
+                         VOID_TYPE_P (TREE_TYPE (TREE_TYPE (caller))));
+             cur_summary_lto->arg_flags[ee->parm_index] = f;
+             changed = true;
+           }
+       }
+    }
+  return changed;
+}
+
+/* Perform iterative dataflow on SCC component starting in COMPONENT_NODE
+   and propagate arg flags.  */
+
+static void
+modref_propagate_flags_in_scc (cgraph_node *component_node)
+{
+  bool changed = true;
+  int iteration = 0;
+
+  while (changed)
+    {
+      changed = false;
       for (struct cgraph_node *cur = component_node; cur;
           cur = ((struct ipa_dfs_info *) cur->aux)->next_cycle)
-       if (!cur->inlined_to)
-         {
-           modref_summary *cur_summary = optimization_summaries
-                                         ? optimization_summaries->get (cur)
-                                         : NULL;
-           modref_summary_lto *cur_summary_lto = summaries_lto
-                                                 ? summaries_lto->get (cur)
-                                                 : NULL;
-
-           fprintf (dump_file, "Propagated modref for %s%s%s\n",
+       {
+         cgraph_node *node = cur->inlined_to ? cur->inlined_to : cur;
+         modref_summary *cur_summary = optimization_summaries
+                                       ? optimization_summaries->get (node)
+                                       : NULL;
+         modref_summary_lto *cur_summary_lto = summaries_lto
+                                               ? summaries_lto->get (node)
+                                               : NULL;
+
+         if (!cur_summary && !cur_summary_lto)
+           continue;
+
+         if (dump_file)
+           fprintf (dump_file, "  Processing %s%s%s\n",
                     cur->dump_name (),
                     TREE_READONLY (cur->decl) ? " (const)" : "",
                     DECL_PURE_P (cur->decl) ? " (pure)" : "");
-           if (optimization_summaries)
-             {
-               if (cur_summary)
-                 cur_summary->dump (dump_file);
-               else
-                 fprintf (dump_file, "  Not tracked\n");
-             }
-           if (summaries_lto)
-             {
-               if (cur_summary_lto)
-                 cur_summary_lto->dump (dump_file);
-               else
-                 fprintf (dump_file, "  Not tracked (lto)\n");
-             }
-         }
-   }
+
+         for (cgraph_edge *e = cur->indirect_calls; e; e = e->next_callee)
+           {
+             escape_summary *sum = escape_summaries->get (e);
+
+             if (!sum || (e->indirect_info->ecf_flags
+                          & (ECF_CONST | ECF_NOVOPS)))
+               continue;
+
+             changed |= modref_merge_call_site_flags
+                               (sum, cur_summary, cur_summary_lto,
+                                NULL, NULL,
+                                node->decl, e->indirect_info->ecf_flags);
+           }
+
+         if (!cur_summary && !cur_summary_lto)
+           continue;
+
+         for (cgraph_edge *callee_edge = cur->callees; callee_edge;
+              callee_edge = callee_edge->next_callee)
+           {
+             int ecf_flags = flags_from_decl_or_type
+                                (callee_edge->callee->decl);
+             modref_summary *callee_summary = NULL;
+             modref_summary_lto *callee_summary_lto = NULL;
+             struct cgraph_node *callee;
+
+             if (ecf_flags & (ECF_CONST | ECF_NOVOPS)
+                 || !callee_edge->inline_failed)
+               continue;
+             /* Get the callee and its summary.  */
+             enum availability avail;
+             callee = callee_edge->callee->function_or_virtual_thunk_symbol
+                        (&avail, cur);
+
+             /* It is not necessary to re-process calls outside of the
+                SCC component.  */
+             if (iteration > 0
+                 && (!callee->aux
+                     || ((struct ipa_dfs_info *)cur->aux)->scc_no
+                         != ((struct ipa_dfs_info *)callee->aux)->scc_no))
+               continue;
+
+             escape_summary *sum = escape_summaries->get (callee_edge);
+             if (!sum)
+               continue;
+
+             if (dump_file)
+               fprintf (dump_file, "    Call to %s\n",
+                        callee_edge->callee->dump_name ());
+
+             if (avail <= AVAIL_INTERPOSABLE
+                 || callee_edge->call_stmt_cannot_inline_p)
+               ;
+             else
+               {
+                 if (cur_summary)
+                   callee_summary = optimization_summaries->get (callee);
+                 if (cur_summary_lto)
+                   callee_summary_lto = summaries_lto->get (callee);
+               }
+             changed |= modref_merge_call_site_flags
+                               (sum, cur_summary, cur_summary_lto,
+                                callee_summary, callee_summary_lto,
+                                node->decl, ecf_flags);
+             if (dump_file && changed)
+               {
+                 if (cur_summary)
+                   cur_summary->dump (dump_file);
+                 if (cur_summary_lto)
+                   cur_summary_lto->dump (dump_file);
+               }
+           }
+       }
+      iteration++;
+    }
+  if (dump_file)
+    fprintf (dump_file,
+            "Propagation of flags finished in %i iterations\n", iteration);
 }
 
 /* Run the IPA pass.  This will take a function's summaries and calls and
@@ -2549,6 +3966,9 @@ pass_ipa_modref::execute (function *)
        fprintf (dump_file, "\n\nStart of SCC component\n");
 
       modref_propagate_in_scc (component_node);
+      modref_propagate_flags_in_scc (component_node);
+      if (dump_file)
+       modref_propagate_dump_scc (component_node);
     }
   cgraph_node *node;
   FOR_EACH_FUNCTION (node)
@@ -2559,6 +3979,8 @@ pass_ipa_modref::execute (function *)
   free (order);
   delete fnspec_summaries;
   fnspec_summaries = NULL;
+  delete escape_summaries;
+  escape_summaries = NULL;
   return 0;
 }
 
@@ -2570,15 +3992,17 @@ ipa_modref_c_finalize ()
   if (optimization_summaries)
     ggc_delete (optimization_summaries);
   optimization_summaries = NULL;
-  gcc_checking_assert (!summaries);
+  gcc_checking_assert (!summaries
+                      || flag_incremental_link == INCREMENTAL_LINK_LTO);
   if (summaries_lto)
-    {
-      ggc_delete (summaries_lto);
-      summaries_lto = NULL;
-    }
+    ggc_delete (summaries_lto);
+  summaries_lto = NULL;
   if (fnspec_summaries)
     delete fnspec_summaries;
   fnspec_summaries = NULL;
+  if (escape_summaries)
+    delete escape_summaries;
+  escape_summaries = NULL;
 }
 
 #include "gt-ipa-modref.h"