diff --git a/lib/Transforms/Scalar/ObjCARC.cpp b/lib/Transforms/Scalar/ObjCARC.cpp
index 5095e497d7b..f2cda41c976 100644
--- a/lib/Transforms/Scalar/ObjCARC.cpp
+++ b/lib/Transforms/Scalar/ObjCARC.cpp
@@ -1098,16 +1098,16 @@ static Sequence MergeSeqs(Sequence A, Sequence B, bool TopDown) {
   if (A == S_None || B == S_None)
     return S_None;
 
-  // Note that we can't merge S_CanRelease and S_Use.
   if (A > B) std::swap(A, B);
   if (TopDown) {
     // Choose the side which is further along in the sequence.
-    if (A == S_Retain && (B == S_CanRelease || B == S_Use))
+    if ((A == S_Retain || A == S_CanRelease) &&
+        (B == S_CanRelease || B == S_Use))
       return B;
   } else {
     // Choose the side which is further along in the sequence.
     if ((A == S_Use || A == S_CanRelease) &&
-        (B == S_Release || B == S_Stop || B == S_MovableRelease))
+        (B == S_Use || B == S_Release || B == S_Stop || B == S_MovableRelease))
       return A;
     // If both sides are releases, choose the more conservative one.
     if (A == S_Stop && (B == S_Release || B == S_MovableRelease))
@@ -1186,6 +1186,10 @@ namespace {
 
     PtrState() : RefCount(0), Seq(S_None) {}
 
+    void SetAtLeastOneRefCount()  {
+      if (RefCount == 0) RefCount = 1;
+    }
+
     void IncrementRefCount() {
       if (RefCount != UINT_MAX) ++RefCount;
     }
@@ -1330,6 +1334,12 @@ namespace {
     unsigned GetAllPathCount() const {
       return TopDownPathCount * BottomUpPathCount;
     }
+
+    /// IsVisitedTopDown - Test whether the block for this BBState has been
+    /// visited by the top-down portion of the algorithm.
+    bool isVisitedTopDown() const {
+      return TopDownPathCount != 0;
+    }
   };
 }
 
@@ -2143,41 +2153,49 @@ ObjCARCOpt::CheckForCFGHazards(const BasicBlock *BB,
       const TerminatorInst *TI = cast<TerminatorInst>(&BB->back());
       bool SomeSuccHasSame = false;
       bool AllSuccsHaveSame = true;
-      for (succ_const_iterator SI(TI), SE(TI, false); SI != SE; ++SI)
-        switch (BBStates[*SI].getPtrBottomUpState(Arg).GetSeq()) {
+      PtrState &S = MyStates.getPtrTopDownState(Arg);
+      for (succ_const_iterator SI(TI), SE(TI, false); SI != SE; ++SI) {
+        PtrState &SuccS = BBStates[*SI].getPtrBottomUpState(Arg);
+        switch (SuccS.GetSeq()) {
         case S_None:
-        case S_CanRelease:
-          MyStates.getPtrTopDownState(Arg).ClearSequenceProgress();
-          SomeSuccHasSame = false;
-          break;
+        case S_CanRelease: {
+          if (!S.RRI.KnownIncremented && !SuccS.RRI.KnownIncremented)
+            S.ClearSequenceProgress();
+          continue;
+        }
         case S_Use:
           SomeSuccHasSame = true;
           break;
         case S_Stop:
         case S_Release:
         case S_MovableRelease:
-          AllSuccsHaveSame = false;
+          if (!S.RRI.KnownIncremented && !SuccS.RRI.KnownIncremented)
+            AllSuccsHaveSame = false;
           break;
         case S_Retain:
           llvm_unreachable("bottom-up pointer in retain state!");
         }
+      }
       // If the state at the other end of any of the successor edges
       // matches the current state, require all edges to match. This
       // guards against loops in the middle of a sequence.
       if (SomeSuccHasSame && !AllSuccsHaveSame)
-        MyStates.getPtrTopDownState(Arg).ClearSequenceProgress();
+        S.ClearSequenceProgress();
     }
     case S_CanRelease: {
       const Value *Arg = I->first;
       const TerminatorInst *TI = cast<TerminatorInst>(&BB->back());
       bool SomeSuccHasSame = false;
       bool AllSuccsHaveSame = true;
-      for (succ_const_iterator SI(TI), SE(TI, false); SI != SE; ++SI)
-        switch (BBStates[*SI].getPtrBottomUpState(Arg).GetSeq()) {
-        case S_None:
-          MyStates.getPtrTopDownState(Arg).ClearSequenceProgress();
-          SomeSuccHasSame = false;
-          break;
+      PtrState &S = MyStates.getPtrTopDownState(Arg);
+      for (succ_const_iterator SI(TI), SE(TI, false); SI != SE; ++SI) {
+        PtrState &SuccS = BBStates[*SI].getPtrBottomUpState(Arg);
+        switch (SuccS.GetSeq()) {
+        case S_None: {
+          if (!S.RRI.KnownIncremented && !SuccS.RRI.KnownIncremented)
+            S.ClearSequenceProgress();
+          continue;
+        }
         case S_CanRelease:
           SomeSuccHasSame = true;
           break;
@@ -2185,16 +2203,18 @@ ObjCARCOpt::CheckForCFGHazards(const BasicBlock *BB,
         case S_Release:
         case S_MovableRelease:
         case S_Use:
-          AllSuccsHaveSame = false;
+          if (!S.RRI.KnownIncremented && !SuccS.RRI.KnownIncremented)
+            AllSuccsHaveSame = false;
           break;
         case S_Retain:
           llvm_unreachable("bottom-up pointer in retain state!");
         }
+      }
       // If the state at the other end of any of the successor edges
       // matches the current state, require all edges to match. This
       // guards against loops in the middle of a sequence.
       if (SomeSuccHasSame && !AllSuccsHaveSame)
-        MyStates.getPtrTopDownState(Arg).ClearSequenceProgress();
+        S.ClearSequenceProgress();
     }
     }
 }
@@ -2218,6 +2238,8 @@ ObjCARCOpt::VisitBottomUp(BasicBlock *BB,
       if (Succ == BB)
         continue;
       DenseMap<const BasicBlock *, BBState>::iterator I = BBStates.find(Succ);
+      // If we haven't seen this node yet, then we've found a CFG cycle.
+      // Be optimistic here; it's CheckForCFGHazards' job detect trouble.
       if (I == BBStates.end())
         continue;
       MyStates.InitFromSucc(I->second);
@@ -2270,6 +2292,7 @@ ObjCARCOpt::VisitBottomUp(BasicBlock *BB,
 
       PtrState &S = MyStates.getPtrBottomUpState(Arg);
       S.DecrementRefCount();
+      S.SetAtLeastOneRefCount();
 
       switch (S.GetSeq()) {
       case S_Stop:
@@ -2316,27 +2339,24 @@ ObjCARCOpt::VisitBottomUp(BasicBlock *BB,
       PtrState &S = MI->second;
       Sequence Seq = S.GetSeq();
 
-      // Check for possible retains and releases.
-      if (CanAlterRefCount(Inst, Ptr, PA, Class)) {
-        // Check for a retain (we're going bottom-up here).
-        S.DecrementRefCount();
-
-        // Check for a release.
-        if (!IsRetain(Class) && Class != IC_RetainBlock)
-          switch (Seq) {
-          case S_Use:
-            S.SetSeq(S_CanRelease);
-            continue;
-          case S_CanRelease:
-          case S_Release:
-          case S_MovableRelease:
-          case S_Stop:
-          case S_None:
-            break;
-          case S_Retain:
-            llvm_unreachable("bottom-up pointer in retain state!");
-          }
-      }
+      // Check for possible releases. Note that we don't have to update
+      // S's RefCount because any reference count modifications would be
+      // done through a different provenance.
+      if (!IsRetain(Class) && Class != IC_RetainBlock &&
+          CanAlterRefCount(Inst, Ptr, PA, Class))
+        switch (Seq) {
+        case S_Use:
+          S.SetSeq(S_CanRelease);
+          continue;
+        case S_CanRelease:
+        case S_Release:
+        case S_MovableRelease:
+        case S_Stop:
+        case S_None:
+          break;
+        case S_Retain:
+          llvm_unreachable("bottom-up pointer in retain state!");
+        }
 
       // Check for possible direct uses.
       switch (Seq) {
@@ -2389,14 +2409,18 @@ ObjCARCOpt::VisitTopDown(BasicBlock *BB,
       if (Pred == BB)
         continue;
       DenseMap<const BasicBlock *, BBState>::iterator I = BBStates.find(Pred);
-      if (I == BBStates.end())
+      assert(I != BBStates.end());
+      // If we haven't seen this node yet, then we've found a CFG cycle.
+      // Be optimistic here; it's CheckForCFGHazards' job detect trouble.
+      if (!I->second.isVisitedTopDown())
         continue;
       MyStates.InitFromPred(I->second);
       while (PI != PE) {
         Pred = *PI++;
         if (Pred != BB) {
           I = BBStates.find(Pred);
-          if (I != BBStates.end())
+          assert(I != BBStates.end());
+          if (I->second.isVisitedTopDown())
             MyStates.MergePred(I->second);
         }
       }
@@ -2437,6 +2461,7 @@ ObjCARCOpt::VisitTopDown(BasicBlock *BB,
         S.RRI.Calls.insert(Inst);
       }
 
+      S.SetAtLeastOneRefCount();
       S.IncrementRefCount();
       break;
     }
@@ -2488,13 +2513,11 @@ ObjCARCOpt::VisitTopDown(BasicBlock *BB,
       PtrState &S = MI->second;
       Sequence Seq = S.GetSeq();
 
-      // Check for possible releases.
+      // Check for possible releases. Note that we don't have to update
+      // S's RefCount because any reference count modifications would be
+      // done through a different provenance.
       if (!IsRetain(Class) && Class != IC_RetainBlock &&
-          CanAlterRefCount(Inst, Ptr, PA, Class)) {
-        // Check for a release.
-        S.DecrementRefCount();
-
-        // Check for a release.
+          CanAlterRefCount(Inst, Ptr, PA, Class))
         switch (Seq) {
         case S_Retain:
           S.SetSeq(S_CanRelease);
@@ -2514,7 +2537,6 @@ ObjCARCOpt::VisitTopDown(BasicBlock *BB,
         case S_MovableRelease:
           llvm_unreachable("top-down pointer in release state!");
         }
-      }
 
       // Check for possible direct uses.
       switch (Seq) {
@@ -2818,6 +2840,13 @@ ObjCARCOpt::PerformCodePlacement(DenseMap<const BasicBlock *, BBState>
       RetainsToMove.ReverseInsertPts.clear();
       ReleasesToMove.ReverseInsertPts.clear();
       NewCount = 0;
+    } else {
+      // Determine whether the new insertion points we computed preserve the
+      // balance of retain and release calls through the program.
+      // TODO: If the fully aggressive solution isn't valid, try to find a
+      // less aggressive solution which is.
+      if (NewDelta != 0)
+        goto next_retain;
     }
 
     // Determine whether the original call points are balanced in the retain and
@@ -2828,13 +2857,6 @@ ObjCARCOpt::PerformCodePlacement(DenseMap<const BasicBlock *, BBState>
     if (OldDelta != 0)
       goto next_retain;
 
-    // Determine whether the new insertion points we computed preserve the
-    // balance of retain and release calls through the program.
-    // TODO: If the fully aggressive solution isn't valid, try to find a
-    // less aggressive solution which is.
-    if (NewDelta != 0)
-      goto next_retain;
-
     // Ok, everything checks out and we're all set. Let's move some code!
     Changed = true;
     AnyPairsCompletelyEliminated = NewCount == 0;
diff --git a/test/Transforms/ObjCARC/cfg-hazards.ll b/test/Transforms/ObjCARC/cfg-hazards.ll
index 66a7b1b73da..15194237c4c 100644
--- a/test/Transforms/ObjCARC/cfg-hazards.ll
+++ b/test/Transforms/ObjCARC/cfg-hazards.ll
@@ -7,6 +7,7 @@
 declare void @use_pointer(i8*)
 declare i8* @objc_retain(i8*)
 declare void @objc_release(i8*)
+declare void @callee()
 
 ; CHECK: define void @test0(
 ; CHECK:   call i8* @objc_retain(
@@ -83,4 +84,314 @@ for.end:                                          ; preds = %for.body
   ret void
 }
 
+; Delete nested retain+release pairs around loops.
+
+;      CHECK: define void @test3(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   call void @objc_release(i8* %a)
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test3(i8* %a) nounwind {
+entry:
+  %outer = call i8* @objc_retain(i8* %a) nounwind
+  %inner = call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  call void @callee()
+  store i8 0, i8* %a
+  br i1 undef, label %loop, label %exit
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test4(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   call void @objc_release(i8* %a)
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test4(i8* %a) nounwind {
+entry:
+  %outer = call i8* @objc_retain(i8* %a) nounwind
+  %inner = call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  br label %more
+
+more:
+  call void @callee()
+  call void @callee()
+  store i8 0, i8* %a
+  br i1 undef, label %loop, label %exit
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test5(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   call void @callee()
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   call void @use_pointer(i8* %a)
+; CHECK-NEXT:   call void @objc_release(i8* %a)
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test5(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  call void @callee()
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  br label %more
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @use_pointer(i8* %a)
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test6(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   call void @use_pointer(i8* %a)
+; CHECK-NEXT:   call void @objc_release(i8* %a)
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test6(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  call void @callee()
+  br label %more
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @use_pointer(i8* %a)
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test7(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   call void @callee()
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   call void @objc_release(i8* %a)
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test7(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  call void @callee()
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  call void @use_pointer(i8* %a)
+  br label %more
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test8(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   call void @objc_release(i8* %a)
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test8(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  call void @callee()
+  call void @use_pointer(i8* %a)
+  br label %more
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test9(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test9(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  call void @use_pointer(i8* %a)
+  br label %more
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test10(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test10(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  call void @callee()
+  br label %more
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+;      CHECK: define void @test11(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test11(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  br label %more
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Don't delete anything if they're not balanced.
+
+;      CHECK: define void @test12(i8* %a) nounwind {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   %outer = tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   %inner = tail call i8* @objc_retain(i8* %a) nounwind
+; CHECK-NEXT:   br label %loop
+;  CHECK-NOT:   @objc_
+;      CHECK: exit:
+; CHECK-NEXT: call void @objc_release(i8* %a) nounwind
+; CHECK-NEXT: call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+define void @test12(i8* %a) nounwind {
+entry:
+  %outer = tail call i8* @objc_retain(i8* %a) nounwind
+  %inner = tail call i8* @objc_retain(i8* %a) nounwind
+  br label %loop
+
+loop:
+  br i1 undef, label %true, label %more
+
+true:
+  ret void
+
+more:
+  br i1 undef, label %exit, label %loop
+
+exit:
+  call void @objc_release(i8* %a) nounwind
+  call void @objc_release(i8* %a) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
 !0 = metadata !{}
diff --git a/test/Transforms/ObjCARC/nested.ll b/test/Transforms/ObjCARC/nested.ll
new file mode 100644
index 00000000000..9eada8a2ddb
--- /dev/null
+++ b/test/Transforms/ObjCARC/nested.ll
@@ -0,0 +1,620 @@
+; RUN: opt -objc-arc -S < %s | FileCheck %s
+
+%struct.__objcFastEnumerationState = type { i64, i8**, i64*, [5 x i64] }
+
+@"\01L_OBJC_METH_VAR_NAME_" = internal global [43 x i8] c"countByEnumeratingWithState:objects:count:\00", section "__TEXT,__objc_methname,cstring_literals", align 1
+@"\01L_OBJC_SELECTOR_REFERENCES_" = internal global i8* getelementptr inbounds ([43 x i8]* @"\01L_OBJC_METH_VAR_NAME_", i64 0, i64 0), section "__DATA, __objc_selrefs, literal_pointers, no_dead_strip"
+@g = common global i8* null, align 8
+@"\01L_OBJC_IMAGE_INFO" = internal constant [2 x i32] [i32 0, i32 16], section "__DATA, __objc_imageinfo, regular, no_dead_strip"
+
+declare void @callee()
+declare i8* @returner()
+declare i8* @objc_retainAutoreleasedReturnValue(i8*)
+declare i8* @objc_retain(i8*)
+declare void @objc_enumerationMutation(i8*)
+declare void @llvm.memset.p0i8.i64(i8* nocapture, i8, i64, i32, i1) nounwind
+declare i8* @objc_msgSend(i8*, i8*, ...) nonlazybind
+declare void @use(i8*)
+declare void @objc_release(i8*)
+
+!0 = metadata !{}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test0(
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test0(i8* %a) nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %0 = call i8* @objc_retain(i8* %a) nounwind
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %1 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp2 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp2, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  %stateitems.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 1
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call, %forcoll.loopinit ], [ %call6, %forcoll.refetch ]
+  %tmp7 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp7, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ 0, %forcoll.loopbody.outer ], [ %4, %forcoll.notmutated ]
+  %mutationsptr3 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr3, align 8
+  %2 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %2, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %1)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %stateitems = load i8*** %stateitems.ptr, align 8
+  %currentitem.ptr = getelementptr i8** %stateitems, i64 %forcoll.index
+  %3 = load i8** %currentitem.ptr, align 8
+  call void @use(i8* %3)
+  %4 = add i64 %forcoll.index, 1
+  %exitcond = icmp eq i64 %4, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp5 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call6 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp5, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %5 = icmp eq i64 %call6, 0
+  br i1 %5, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %1) nounwind
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test2(
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test2() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %call = call i8* @returner()
+  %0 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call) nounwind
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %1 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp2 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call3 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp2, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call3, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  %stateitems.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 1
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call3, %forcoll.loopinit ], [ %call7, %forcoll.refetch ]
+  %tmp8 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp8, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ 0, %forcoll.loopbody.outer ], [ %4, %forcoll.notmutated ]
+  %mutationsptr4 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr4, align 8
+  %2 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %2, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %1)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %stateitems = load i8*** %stateitems.ptr, align 8
+  %currentitem.ptr = getelementptr i8** %stateitems, i64 %forcoll.index
+  %3 = load i8** %currentitem.ptr, align 8
+  call void @use(i8* %3)
+  %4 = add i64 %forcoll.index, 1
+  %exitcond = icmp eq i64 %4, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp6 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call7 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp6, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %5 = icmp eq i64 %call7, 0
+  br i1 %5, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %1) nounwind
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test4(
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test4() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %tmp = load i8** @g, align 8
+  %0 = call i8* @objc_retain(i8* %tmp) nounwind
+  %tmp2 = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp2, i8 0, i64 64, i32 8, i1 false)
+  %1 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp4 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp4, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  %stateitems.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 1
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call, %forcoll.loopinit ], [ %call8, %forcoll.refetch ]
+  %tmp9 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp9, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ 0, %forcoll.loopbody.outer ], [ %4, %forcoll.notmutated ]
+  %mutationsptr5 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr5, align 8
+  %2 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %2, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %1)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %stateitems = load i8*** %stateitems.ptr, align 8
+  %currentitem.ptr = getelementptr i8** %stateitems, i64 %forcoll.index
+  %3 = load i8** %currentitem.ptr, align 8
+  call void @use(i8* %3)
+  %4 = add i64 %forcoll.index, 1
+  %exitcond = icmp eq i64 %4, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp7 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call8 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp7, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %5 = icmp eq i64 %call8, 0
+  br i1 %5, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %1) nounwind
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test5(
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test5() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %call = call i8* @returner()
+  %0 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call) nounwind
+  call void @callee()
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %1 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp2 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call3 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp2, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call3, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  %stateitems.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 1
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call3, %forcoll.loopinit ], [ %call7, %forcoll.refetch ]
+  %tmp8 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp8, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ 0, %forcoll.loopbody.outer ], [ %4, %forcoll.notmutated ]
+  %mutationsptr4 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr4, align 8
+  %2 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %2, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %1)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %stateitems = load i8*** %stateitems.ptr, align 8
+  %currentitem.ptr = getelementptr i8** %stateitems, i64 %forcoll.index
+  %3 = load i8** %currentitem.ptr, align 8
+  call void @use(i8* %3)
+  %4 = add i64 %forcoll.index, 1
+  %exitcond = icmp eq i64 %4, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp6 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call7 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp6, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %5 = icmp eq i64 %call7, 0
+  br i1 %5, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %1) nounwind
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test6(
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test6() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %call = call i8* @returner()
+  %0 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call) nounwind
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %1 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp2 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call3 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp2, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call3, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  %stateitems.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 1
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call3, %forcoll.loopinit ], [ %call7, %forcoll.refetch ]
+  %tmp8 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp8, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ 0, %forcoll.loopbody.outer ], [ %4, %forcoll.notmutated ]
+  %mutationsptr4 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr4, align 8
+  %2 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %2, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %1)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %stateitems = load i8*** %stateitems.ptr, align 8
+  %currentitem.ptr = getelementptr i8** %stateitems, i64 %forcoll.index
+  %3 = load i8** %currentitem.ptr, align 8
+  call void @use(i8* %3)
+  %4 = add i64 %forcoll.index, 1
+  %exitcond = icmp eq i64 %4, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp6 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call7 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp6, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %5 = icmp eq i64 %call7, 0
+  br i1 %5, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %1) nounwind
+  call void @callee()
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test7(
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test7() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %call = call i8* @returner()
+  %0 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call) nounwind
+  call void @callee()
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %1 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp2 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call3 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp2, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call3, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  %stateitems.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 1
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call3, %forcoll.loopinit ], [ %call7, %forcoll.refetch ]
+  %tmp8 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp8, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ 0, %forcoll.loopbody.outer ], [ %4, %forcoll.notmutated ]
+  %mutationsptr4 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr4, align 8
+  %2 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %2, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %1)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %stateitems = load i8*** %stateitems.ptr, align 8
+  %currentitem.ptr = getelementptr i8** %stateitems, i64 %forcoll.index
+  %3 = load i8** %currentitem.ptr, align 8
+  call void @use(i8* %3)
+  %4 = add i64 %forcoll.index, 1
+  %exitcond = icmp eq i64 %4, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp6 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call7 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp6, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %5 = icmp eq i64 %call7, 0
+  br i1 %5, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %1) nounwind
+  call void @callee()
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test8(
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test8() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %call = call i8* @returner()
+  %0 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call) nounwind
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %1 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp2 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call3 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp2, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call3, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  %stateitems.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 1
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call3, %forcoll.loopinit ], [ %call7, %forcoll.refetch ]
+  %tmp8 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp8, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ 0, %forcoll.loopbody.outer ], [ %4, %forcoll.next ]
+  %mutationsptr4 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr4, align 8
+  %2 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %2, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %1)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %stateitems = load i8*** %stateitems.ptr, align 8
+  %currentitem.ptr = getelementptr i8** %stateitems, i64 %forcoll.index
+  %3 = load i8** %currentitem.ptr, align 8
+  %tobool = icmp eq i8* %3, null
+  br i1 %tobool, label %forcoll.next, label %if.then
+
+if.then:
+  call void @callee()
+  br label %forcoll.next
+
+forcoll.next:
+  %4 = add i64 %forcoll.index, 1
+  %exitcond = icmp eq i64 %4, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp6 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call7 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %1, i8* %tmp6, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %5 = icmp eq i64 %call7, 0
+  br i1 %5, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %1) nounwind
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test9(
+; CHECK: call i8* @objc_retain
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test9() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %call = call i8* @returner()
+  %0 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call) nounwind
+  %call1 = call i8* @returner()
+  %1 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call1) nounwind
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %2 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp3 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call4 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %2, i8* %tmp3, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call4, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call4, %forcoll.loopinit ], [ %call7, %forcoll.refetch ]
+  %tmp9 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp9, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ %phitmp, %forcoll.notmutated.forcoll.loopbody_crit_edge ], [ 1, %forcoll.loopbody.outer ]
+  %mutationsptr5 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr5, align 8
+  %3 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %3, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %2)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %exitcond = icmp eq i64 %forcoll.index, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.notmutated.forcoll.loopbody_crit_edge
+
+forcoll.notmutated.forcoll.loopbody_crit_edge:
+  %phitmp = add i64 %forcoll.index, 1
+  br label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp6 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call7 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %2, i8* %tmp6, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %4 = icmp eq i64 %call7, 0
+  br i1 %4, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %2) nounwind
+  call void @objc_release(i8* %1) nounwind, !clang.imprecise_release !0
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}
+
+; Delete a nested retain+release pair.
+
+; CHECK: define void @test10(
+; CHECK: call i8* @objc_retain
+; CHECK: call i8* @objc_retain
+; CHECK-NOT: @objc_retain
+; CHECK: }
+define void @test10() nounwind {
+entry:
+  %state.ptr = alloca %struct.__objcFastEnumerationState, align 8
+  %items.ptr = alloca [16 x i8*], align 8
+  %call = call i8* @returner()
+  %0 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call) nounwind
+  %call1 = call i8* @returner()
+  %1 = call i8* @objc_retainAutoreleasedReturnValue(i8* %call1) nounwind
+  call void @callee()
+  %tmp = bitcast %struct.__objcFastEnumerationState* %state.ptr to i8*
+  call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 8, i1 false)
+  %2 = call i8* @objc_retain(i8* %0) nounwind
+  %tmp3 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call4 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %2, i8* %tmp3, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %iszero = icmp eq i64 %call4, 0
+  br i1 %iszero, label %forcoll.empty, label %forcoll.loopinit
+
+forcoll.loopinit:
+  %mutationsptr.ptr = getelementptr inbounds %struct.__objcFastEnumerationState* %state.ptr, i64 0, i32 2
+  %mutationsptr = load i64** %mutationsptr.ptr, align 8
+  %forcoll.initial-mutations = load i64* %mutationsptr, align 8
+  br label %forcoll.loopbody.outer
+
+forcoll.loopbody.outer:
+  %forcoll.count.ph = phi i64 [ %call4, %forcoll.loopinit ], [ %call7, %forcoll.refetch ]
+  %tmp9 = icmp ugt i64 %forcoll.count.ph, 1
+  %umax = select i1 %tmp9, i64 %forcoll.count.ph, i64 1
+  br label %forcoll.loopbody
+
+forcoll.loopbody:
+  %forcoll.index = phi i64 [ %phitmp, %forcoll.notmutated.forcoll.loopbody_crit_edge ], [ 1, %forcoll.loopbody.outer ]
+  %mutationsptr5 = load i64** %mutationsptr.ptr, align 8
+  %statemutations = load i64* %mutationsptr5, align 8
+  %3 = icmp eq i64 %statemutations, %forcoll.initial-mutations
+  br i1 %3, label %forcoll.notmutated, label %forcoll.mutated
+
+forcoll.mutated:
+  call void @objc_enumerationMutation(i8* %2)
+  br label %forcoll.notmutated
+
+forcoll.notmutated:
+  %exitcond = icmp eq i64 %forcoll.index, %umax
+  br i1 %exitcond, label %forcoll.refetch, label %forcoll.notmutated.forcoll.loopbody_crit_edge
+
+forcoll.notmutated.forcoll.loopbody_crit_edge:
+  %phitmp = add i64 %forcoll.index, 1
+  br label %forcoll.loopbody
+
+forcoll.refetch:
+  %tmp6 = load i8** @"\01L_OBJC_SELECTOR_REFERENCES_", align 8
+  %call7 = call i64 bitcast (i8* (i8*, i8*, ...)* @objc_msgSend to i64 (i8*, i8*, %struct.__objcFastEnumerationState*, [16 x i8*]*, i64)*)(i8* %2, i8* %tmp6, %struct.__objcFastEnumerationState* %state.ptr, [16 x i8*]* %items.ptr, i64 16)
+  %4 = icmp eq i64 %call7, 0
+  br i1 %4, label %forcoll.empty, label %forcoll.loopbody.outer
+
+forcoll.empty:
+  call void @objc_release(i8* %2) nounwind
+  call void @objc_release(i8* %1) nounwind, !clang.imprecise_release !0
+  call void @objc_release(i8* %0) nounwind, !clang.imprecise_release !0
+  ret void
+}