How can Reg2Mem leave phi nodes?

Hello,

Reg2Mem documentation says that the pass guarantees that "the only
values live across basic blocks are allocas and loads before phi nodes"
so it seems that some phi nodes may remain. I'd like to handle this case
correctly but I cannot come up with any input that actually leaves any
phi nodes. When is it necessary?

Quick scanning of Reg2Mem.cpp suggests that it calls DemotePHIToStack on
every phi node and DemotePHIToStack seems to always destroy the PHINode
it gets. Am I missing something or can I assume there are no phis in
post-reg2mem code?

Regards,
T. Dudziak