> Mem2reg works fine on variables whose addresses have not escaped.

The question of pointer provenance is really about trying to formalize a workable definition of "escape." This turns out to be far harder than it looks, because it turns out that converting a pointer to integer necessarily needs to be an escape, and all of a sudden, there are all sorts of hidden places that causes pointers to become integers that you never expected (such as storing a pointer in a stack variable, if memory is untyped).