Introduce allocsize with arbitrary expressions

[george.burgess.iv]

Summary

Note: I'm not thrilled with the compromises this patch makes; it's more here to show an approach we can take to get allocsize to support arbitrary expressions in LLVM. If we decide that the changes made are acceptable, I'll tidy this up and request a more in-depth review.

This patch introduces a more general version of the allocsize attribute proposed in D14933. It would allow code like the following to be lowered to LLVM:

// Allocates an ObjectHeader, with N bytes of space for an Object after it. Returns a pointer
// right after the header.
Object *object_malloc(int N) __attribute__((alloc_size_ex(N + sizeof(ObjectHeader), sizeof(ObjectHeader)));

Object *checked_malloc(int N) {
	Object *O = object_malloc(N);
	if (__builtin_sizeof(O, 0) < N)
		__builtin_trap();
	return O;
}

The resulting LLVM IR would look something like (simplified; clang would probably throw in allocas, etc.):

declare i8* @object_malloc(i32 %N) allocsize({i32, i32}(i32)* @__object_malloc_alloc_size_fn, [0])

; Assuming sizeof(ObjectHeader) == 8
define private {i32, i32} @__object_malloc_alloc_size_fn(i32 %N) unnamed_addr {
	%1 = add i32 %N, 8
	%2 = insertelement {i32, i32} {i32 0, i32 8}, i32 %N, 0
	ret {i32, i32} %2
}

define i8* @checked_malloc(i32 %N) {
	%1 = call i8* @object_malloc(i32 %N)
	%2 = call i32 @llvm.objectsize.i32.p0i8(i8* %1)
	%3 = icmp lt %2, %N
	br i1 %3, label %Trap, label %Return
Trap:
	call void @llvm.trap()
	unreachable
Return:
	ret i8* %1
}

@llvm.compiler.used = appending global [1 x {i32, i32}(i32)*] [
	@__object_malloc_alloc_size_fn
]

This design buys us moderately low-overhead support for allocsize with arbitrary expressions, and doesn’t unreasonably impact code size. (read: Ideally, @__object_malloc_alloc_size_fn should be discarded by the linker, so the only issue we have is that allocation functions tagged with different allocsize functions can’t be deduped. In practice, this probably isn’t an issue, because if two functions return different looking results, they probably don’t have identical bodies.)

The implementation of it, however, is not ideal. It requires the following:

• Attributes must become mutable, which makes relative ordering unstable across RAUWs, and breaks uniquing a bit.
• Attributes aren’t Users, so an external mechanism is needed to handle the lifetime of e.g. @__object_malloc_alloc_size_fn from above. @llvm.compiler.used is the current suggestion.
  • N.B. AssertingVH can't be used with ^, because Functions are deleted before Attributes. So we wait to assert(false) on deletion until the user actually tries to use the Attribute. This is a great place for subtle bugs to creep in unnoticed. This can be fixed by having a IsBeingDeleted member in LLVMContextImpl that's only true when LLVMContextImpl is being destructed, but... ew.
• Type safety isn't ideal; Attribute::PseudoCall has a Constant * instead of a Function * for Fn because BitcodeReader hands us a non-Function placeholder. Fixing it probably involves duplicating a lot of methods.
• Custom trivial call folding had to be added, because we never *actually* call e.g. @__object_malloc_alloc_size_fn in the code. In some cases, it's correct to emit this call; in others, it’s incorrect. Namely, when the allocsize function has side-effects/can trap/...
• And more!

Any suggestions for how to better solve these problems are highly appreciated. The best overall solution seems to be handling most/all of this in Clang alone. We lose the (probably substantial) benefits of inlining/general optimizations, which makes alloc_size_ex less helpful, but doing so would almost certainly be a less error-prone approach.

docs/HowToUseAttributes.rst

 attributes --- e.g. command line options.  The old way of handling attributes
 consisted of representing them as a bit mask of values.  This bit mask was
 stored in a "list" structure that was reference counted.  The advantage of this
 was that attributes could be manipulated with 'or's and 'and's.  The
 disadvantage of this was that there was limited room for expansion, and
 virtually no support for attribute-value pairs other than alignment.
 
 In the new scheme, an ``Attribute`` object represents a single attribute that's
-uniqued.  You use the ``Attribute::get`` methods to create a new ``Attribute``
-object.  An attribute can be a single "enum" value (the enum being the
-``Attribute::AttrKind`` enum), a string representing a target-dependent
-attribute, or an attribute-value pair.  Some examples:
+uniqued on a best-effort basis.  You use the ``Attribute::get`` methods to
+create a new ``Attribute`` object.  An attribute can be a single "enum" value
+(the enum being the ``Attribute::AttrKind`` enum), a string representing a
+target-dependent attribute, or an attribute-value pair.  Some examples:
 
 * Target-independent: ``noinline``, ``zext``
 * Target-dependent: ``"no-sse"``, ``"thumb2"``
 * Attribute-value pair: ``"cpu" = "cortex-a8"``, ``align = 4``
 
 Note: for an attribute value pair, we expect a target-dependent attribute to
 have a string for the value.
 
+Kinds of Attributes
+===================
+There are four kinds of ``Attribute`` objects that exist:
+
+* Enum attributes: ``noinline``
+* Integer attributes: ``dereferenceable(8)``
+* String attributes: ``"cpu" = "cortex-a8"``
+* Pseudo-call attributes: ``allocsize({i32, i32}(i32)* @malloc_getsize, [0])``
+
+The first three are relatively straightforward; they are all entirely
+immutable, and guaranteed to be uniqued.  The fourth kind, however, is a bit
+different.  Pseudo-call attributes allow the user to RAUW the function behind
+the attribute, under the assumption that ``F1.replaceAllUsesWith(F2)`` doesn't
+change the semantics of the attribute.  Notably, this makes such attributes
+mutable, and can mess up ordering if you're e.g. using an ``Attribute`` as a key
+in a ``std::map``.
+
+For this reason, it is *not* recommended that you count on the relative ordering 
+of multiple ``Attribute``s remaining identical across operations that may
+RAUW Functions.
+
 ``Attribute``
 =============
 An ``Attribute`` object is designed to be passed around by value.
 
 Because attributes are no longer represented as a bit mask, you will need to
 convert any code which does treat them as a bit mask to use the new query
 methods on the Attribute class.
 

docs/LangRef.rst

.. code-block:: llvm
     define void @f() alwaysinline optsize { ... }
     define void @f() optsize { ... }
 
 ``alignstack(<n>)``
     This attribute indicates that, when emitting the prologue and
     epilogue, the backend should forcibly align the stack pointer.
     Specify the desired alignment, which must be a power of two, in
     parentheses.
+``allocsize(<n>[, <m>])``
+    This attribute indicates that the annotated function will always return at
+    least a given number of bytes (or null). Its arguments are base-0 parameter
+    numbers; if one argument is provided, then it's assumed that at least
+    ``CallSite.Args[n]`` bytes will be available at the returned pointer. If two
+    are provided, then it's assumed that ``CallSite.Args[n] * CallSite.Args[m]``
+    bytes are available. The referenced parameters must be integer types. No
+    assumptions are made about the contents of the returned block of memory.
 ``alwaysinline``
     This attribute indicates that the inliner should attempt to inline
     this function into callers whenever possible, ignoring any active
     inlining size threshold for this caller.
 ``builtin``
     This indicates that the callee function at a call site should be
     recognized as a built-in function, even though the function's declaration
     uses the ``nobuiltin`` attribute. This is only valid at call sites for

include/llvm/Analysis/ConstantFolding.h

 /// ConstantFoldLoadThroughGEPIndices - Given a constant and getelementptr
 /// indices (with an *implied* zero pointer index that is not in the list),
 /// return the constant value being addressed by a virtual load, or null if
 /// something is funny and we can't decide.
 Constant *ConstantFoldLoadThroughGEPIndices(Constant *C,
                                             ArrayRef<Constant*> Indices);
 
 /// canConstantFoldCallTo - Return true if its even possible to fold a call to
-/// the specified function.
+/// the specified function using `ConstantFoldCall`
 bool canConstantFoldCallTo(const Function *F);
 
 /// ConstantFoldCall - Attempt to constant fold a call to the specified function
 /// with the specified arguments, returning null if unsuccessful.
 Constant *ConstantFoldCall(Function *F, ArrayRef<Constant *> Operands,
                            const TargetLibraryInfo *TLI = nullptr);
-}
 
+/// \brief Given a user-supplied Function and arguments, try to fold the
+/// Function to a constant. This is a *very* simple fold; it does not support
+/// Functions with more than one basic block, nor does it support memory
+/// operations (loads, stores, ...).
+///
+/// Returns null if it's unsuccessful.
+Constant *constantFoldUserFunction(const Function *Fn,
+                                   ArrayRef<Constant *> Args,
+                                   const DataLayout &DL,
+                                   const TargetLibraryInfo *TLI = nullptr);
+}
 #endif

include/llvm/Bitcode/LLVMBitCodes.h

enum AttributeKindCodes {
     ATTR_KIND_DEREFERENCEABLE_OR_NULL = 42,
     ATTR_KIND_CONVERGENT = 43,
     ATTR_KIND_SAFESTACK = 44,
     ATTR_KIND_ARGMEMONLY = 45,
     ATTR_KIND_SWIFT_SELF = 46,
     ATTR_KIND_SWIFT_ERROR = 47,
     ATTR_KIND_NO_RECURSE = 48,
     ATTR_KIND_INACCESSIBLEMEM_ONLY = 49,
-    ATTR_KIND_INACCESSIBLEMEM_OR_ARGMEMONLY = 50
+    ATTR_KIND_INACCESSIBLEMEM_OR_ARGMEMONLY = 50,
+    ATTR_KIND_ALLOC_SIZE = 51
   };
 
   enum ComdatSelectionKindCodes {
     COMDAT_SELECTION_KIND_ANY = 1,
     COMDAT_SELECTION_KIND_EXACT_MATCH = 2,
     COMDAT_SELECTION_KIND_LARGEST = 3,
     COMDAT_SELECTION_KIND_NO_DUPLICATES = 4,
     COMDAT_SELECTION_KIND_SAME_SIZE = 5,
   };
 
 } // End bitc namespace
 } // End llvm namespace
 
 #endif

include/llvm/IR/Attributes.h

 ///
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_IR_ATTRIBUTES_H
 #define LLVM_IR_ATTRIBUTES_H
 
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/FoldingSet.h"
+#include "llvm/IR/ValueHandle.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/PointerLikeTypeTraits.h"
 #include <bitset>
 #include <cassert>
 #include <map>
 #include <string>
 
 namespace llvm {
 
 class AttrBuilder;
 class AttributeImpl;
 class AttributeSetImpl;
 class AttributeSetNode;
 class Constant;
 template<typename T> struct DenseMapInfo;
-class Function;
 class LLVMContext;
 class Type;
 
 //===----------------------------------------------------------------------===//
 /// \class
 /// \brief Functions, function parameters, and return types can have attributes
 /// to indicate how they should be treated by optimizations and code
 /// generation. This class represents one of those attributes. It's light-weight
 /// and should be passed around by-value.
 class Attribute {
 public:
+  /// A pseudo-call encoded in an attribute.
+  struct PseudoCall {
+    // FIXME: If this patch goes in, this should be made private, etc.
+    Constant *Fn;
+    ArrayRef<unsigned> Args;
+
+    PseudoCall(): Fn(nullptr) {}
+    PseudoCall(Constant *Fn, ArrayRef<unsigned> Args) : Fn(Fn), Args(Args) {
+      assert(Fn && "Can't accept a null Function");
+    }
+
+    // FIXME: These should be refactored, too.
+    bool hasPlaceholderFunction() const;
+    Function *mustGetCalledFunction() const;
+  };
+
   /// This enumeration lists the attributes that can be associated with
   /// parameters, function results, or the function itself.
   ///
   /// Note: The `uwtable' attribute is about the ABI or the user mandating an
   /// entry in the unwind table. The `nounwind' attribute is about an exception
   /// passing by the function.
   ///
   /// In a theoretical system that uses tables for profiling and SjLj for
enum AttrKind {
     #include "llvm/IR/Attributes.inc"
     EndAttrKinds           ///< Sentinal value useful for loops
   };
 
 private:
   AttributeImpl *pImpl;
   Attribute(AttributeImpl *A) : pImpl(A) {}
 
+  bool deepEqual(Attribute Other) const;
+
 public:
   Attribute() : pImpl(nullptr) {}
 
   //===--------------------------------------------------------------------===//
   // Attribute Construction
   //===--------------------------------------------------------------------===//
 
   /// \brief Return a uniquified Attribute object.
   static Attribute get(LLVMContext &Context, AttrKind Kind, uint64_t Val = 0);
+  static Attribute get(LLVMContext &Context, AttrKind Kind,
+                       const PseudoCall &Val);
   static Attribute get(LLVMContext &Context, StringRef Kind,
                        StringRef Val = StringRef());
 
   /// \brief Return a uniquified Attribute object that has the specific
   /// alignment set.
   static Attribute getWithAlignment(LLVMContext &Context, uint64_t Align);
   static Attribute getWithStackAlignment(LLVMContext &Context, uint64_t Align);
   static Attribute getWithDereferenceableBytes(LLVMContext &Context,
                                               uint64_t Bytes);
   static Attribute getWithDereferenceableOrNullBytes(LLVMContext &Context,
                                                      uint64_t Bytes);
+  static Attribute getWithAllocSize(LLVMContext &Context,
+                                    const PseudoCall &Val);
 
   //===--------------------------------------------------------------------===//
   // Attribute Accessors
   //===--------------------------------------------------------------------===//
 
   /// \brief Return true if the attribute is an Attribute::AttrKind type.
   bool isEnumAttribute() const;
 
   /// \brief Return true if the attribute is an integer attribute.
   bool isIntAttribute() const;
 
+  /// \brief Return true if the attribute is a GlobalValue attribute
+  bool isPseudoCallAttribute() const;
+
   /// \brief Return true if the attribute is a string (target-dependent)
   /// attribute.
   bool isStringAttribute() const;
 
+  /// \brief Return true if this Attribute will never change.
+  bool isImmutable() const { return !isPseudoCallAttribute(); }
+
   /// \brief Return true if the attribute is present.
   bool hasAttribute(AttrKind Val) const;
 
   /// \brief Return true if the target-dependent attribute is present.
   bool hasAttribute(StringRef Val) const;
 
+  /// \brief Return true if the attribute's kind is of type AttrKind
+  bool hasEnumKind() const { return !hasStringKind(); }
+
+  /// \brief Return true if the attribute's kind is a string
+  bool hasStringKind() const { return isStringAttribute(); }
+
   /// \brief Return the attribute's kind as an enum (Attribute::AttrKind). This
   /// requires the attribute to be an enum or alignment attribute.
   Attribute::AttrKind getKindAsEnum() const;
 
   /// \brief Return the attribute's value as an integer. This requires that the
   /// attribute be an alignment attribute.
   uint64_t getValueAsInt() const;
 
+  /// \brief Gets the value as a pseudo-call instruction. The ArrayRef will live
+  /// as long as the attribute backing it lives (which is to say, for the life
+  /// of the Module).
+  PseudoCall getValueAsPseudoCall() const;
+
   /// \brief Return the attribute's kind as a string. This requires the
   /// attribute to be a string attribute.
   StringRef getKindAsString() const;
 
   /// \brief Return the attribute's value as a string. This requires the
   /// attribute to be a string attribute.
   StringRef getValueAsString() const;
 
   /// \brief Returns the alignment field of an attribute as a byte alignment
   /// value.
   unsigned getAlignment() const;
 
   /// \brief Returns the stack alignment field of an attribute as a byte
   /// alignment value.
   unsigned getStackAlignment() const;
 
   /// \brief Returns the number of dereferenceable bytes from the
   /// dereferenceable attribute.
   uint64_t getDereferenceableBytes() const;
 
   /// \brief Returns the number of dereferenceable_or_null bytes from the
   /// dereferenceable_or_null attribute.
   uint64_t getDereferenceableOrNullBytes() const;
 
+  /// \brief Returns the Function + arg numbers given to the allocsize
+  /// attribute. The array ref lives as long as `this` does.
+  PseudoCall getAllocSizeArgs() const;
+
   /// \brief The Attribute is converted to a string of equivalent mnemonic. This
   /// is, presumably, for writing out the mnemonics for the assembly writer.
   std::string getAsString(bool InAttrGrp = false) const;
 
   /// \brief Equality and non-equality operators.
-  bool operator==(Attribute A) const { return pImpl == A.pImpl; }
-  bool operator!=(Attribute A) const { return pImpl != A.pImpl; }
+  bool operator!=(Attribute A) const { return !operator==(A); }
+  bool operator==(Attribute A) const {
+    return pImpl == A.pImpl || deepEqual(A);
+  }
 
   /// \brief Less-than operator. Useful for sorting the attributes list.
   bool operator<(Attribute A) const;
 
   void Profile(FoldingSetNodeID &ID) const {
     ID.AddPointer(pImpl);
   }
 };
AttributeSet addDereferenceableAttr(LLVMContext &C, unsigned Index,
                                       uint64_t Bytes) const;
 
   /// \brief Add the dereferenceable_or_null attribute to the attribute set at
   /// the given index. Because attribute sets are immutable, this returns a new
   /// set.
   AttributeSet addDereferenceableOrNullAttr(LLVMContext &C, unsigned Index,
                                             uint64_t Bytes) const;
 
+  /// \brief Add the allocsize attribute to the attribute set at the given
+  /// index. Because attribute sets are immutable, this returns a new set.
+  AttributeSet addAllocSizeAttr(LLVMContext &C, unsigned Index,
+                                const Attribute::PseudoCall &Args);
+
   //===--------------------------------------------------------------------===//
   // AttributeSet Accessors
   //===--------------------------------------------------------------------===//
 
   /// \brief Retrieve the LLVM context.
   LLVMContext &getContext() const;
 
   /// \brief The attributes for the specified index are returned.
public:
 
   /// \brief Get the number of dereferenceable bytes (or zero if unknown).
   uint64_t getDereferenceableBytes(unsigned Index) const;
 
   /// \brief Get the number of dereferenceable_or_null bytes (or zero if
   /// unknown).
   uint64_t getDereferenceableOrNullBytes(unsigned Index) const;
 
+  /// \brief Get the allocsize function (or a default-constructed
+  /// Attribute::PseudoCall if unknown).
+  Attribute::PseudoCall getAllocSizeArgs(unsigned Index) const;
+
   /// \brief Return the attributes at the index as a string.
   std::string getAsString(unsigned Index, bool InAttrGrp = false) const;
 
   typedef ArrayRef<Attribute>::iterator iterator;
 
   iterator begin(unsigned Slot) const;
   iterator end(unsigned Slot) const;
 

 /// equality, presence of attributes, etc.
 class AttrBuilder {
   std::bitset<Attribute::EndAttrKinds> Attrs;
   std::map<std::string, std::string> TargetDepAttrs;
   uint64_t Alignment;
   uint64_t StackAlignment;
   uint64_t DerefBytes;
   uint64_t DerefOrNullBytes;
+  TrackingVH<Constant> AllocSizeFn;
+  SmallVector<unsigned, 2> AllocSizeArgNos;
 
 public:
   AttrBuilder()
       : Attrs(0), Alignment(0), StackAlignment(0), DerefBytes(0),
         DerefOrNullBytes(0) {}
   explicit AttrBuilder(uint64_t Val)
       : Attrs(0), Alignment(0), StackAlignment(0), DerefBytes(0),
         DerefOrNullBytes(0) {
     addRawValue(Val);
   }
   AttrBuilder(const Attribute &A)
       : Attrs(0), Alignment(0), StackAlignment(0), DerefBytes(0),
         DerefOrNullBytes(0) {
     addAttribute(A);
   }
+
   AttrBuilder(AttributeSet AS, unsigned Idx);
 
   void clear();
 
   /// \brief Add an attribute to the builder.
   AttrBuilder &addAttribute(Attribute::AttrKind Val);
 
   /// \brief Add the Attribute object to the builder.
public:
   /// \brief Retrieve the number of dereferenceable bytes, if the
   /// dereferenceable attribute exists (zero is returned otherwise).
   uint64_t getDereferenceableBytes() const { return DerefBytes; }
 
   /// \brief Retrieve the number of dereferenceable_or_null bytes, if the
   /// dereferenceable_or_null attribute exists (zero is returned otherwise).
   uint64_t getDereferenceableOrNullBytes() const { return DerefOrNullBytes; }
 
+  /// \brief Retrieve the allocsize function, if the allocsize attribute exists
+  /// (A default-constructed Attribute::PseudoCall is returned otherwise).
+  Attribute::PseudoCall getAllocSizeArgs() const;
+
   /// \brief This turns an int alignment (which must be a power of 2) into the
   /// form used internally in Attribute.
   AttrBuilder &addAlignmentAttr(unsigned Align);
 
   /// \brief This turns an int stack alignment (which must be a power of 2) into
   /// the form used internally in Attribute.
   AttrBuilder &addStackAlignmentAttr(unsigned Align);
 
   /// \brief This turns the number of dereferenceable bytes into the form used
   /// internally in Attribute.
   AttrBuilder &addDereferenceableAttr(uint64_t Bytes);
 
   /// \brief This turns the number of dereferenceable_or_null bytes into the
   /// form used internally in Attribute.
   AttrBuilder &addDereferenceableOrNullAttr(uint64_t Bytes);
 
+  /// \brief This turns the given Function into the form used internally in
+  /// Attribute.
+  AttrBuilder &addAllocSizeAttr(const Attribute::PseudoCall &Args);
+
   /// \brief Return true if the builder contains no target-independent
   /// attributes.
   bool empty() const { return Attrs.none(); }
 
   // Iterators for target-dependent attributes.
   typedef std::pair<std::string, std::string>                td_type;
   typedef std::map<std::string, std::string>::iterator       td_iterator;
   typedef std::map<std::string, std::string>::const_iterator td_const_iterator;

include/llvm/IR/Attributes.td

 class StrBoolAttr<string S> : Attr<S>;
 
 /// Target-independent enum attributes.
 
 /// Alignment of parameter (5 bits) stored as log2 of alignment with +1 bias.
 /// 0 means unaligned (different from align(1)).
 def Alignment : EnumAttr<"align">;
 
+/// The result of the function is guaranteed to point to a number of bytes that
+/// we can determine if we know the value of the function's arguments.
+def AllocSize : EnumAttr<"allocsize">;
+
 /// inline=always.
 def AlwaysInline : EnumAttr<"alwaysinline">;
 
 /// Function can access memory only using pointers based on its arguments.
 def ArgMemOnly : EnumAttr<"argmemonly">;
 
 /// Callee is recognized as a builtin, despite nobuiltin attribute on its
 /// declaration.

lib/Analysis/ConstantFolding.cpp

static Constant *SymbolicallyEvaluateGEP(Type *SrcTy, ArrayRef<Constant *> Ops,
   // If we ended up indexing a member with a type that doesn't match
   // the type of what the original indices indexed, add a cast.
   if (Ty != ResultElementTy)
     C = FoldBitCast(C, ResultTy, DL);
 
   return C;
 }
 
+/// Constant fold an instruction using the given operands, rather than the
+/// operands listed in the Instruction. Any non-Value operands (e.g. the indices
+/// in an insertvalue instruction) will be taken from the Instruction.
+static Constant *foldNonMemoryInstructionWithOperands(
+    const Instruction &Inst, ArrayRef<Constant *> Operands,
+    const DataLayout &DL, const TargetLibraryInfo *TLI) {
+  if (auto *Cmp = dyn_cast<CmpInst>(&Inst))
+    return ConstantFoldCompareInstOperands(Cmp->getPredicate(), Operands[0],
+                                           Operands[1], DL, TLI);
+
+  if (auto *IVI = dyn_cast<InsertValueInst>(&Inst))
+    return ConstantExpr::getInsertValue(Operands[0], Operands[1],
+                                        IVI->getIndices(), IVI->getType());
 
+  if (auto *EVI = dyn_cast<ExtractValueInst>(&Inst))
+    return ConstantExpr::getExtractValue(Operands[0], EVI->getIndices());
+
+  return ConstantFoldInstOperands(Inst.getOpcode(), Inst.getType(), Operands,
+                                  DL, TLI);
+}
 
 //===----------------------------------------------------------------------===//
 // Constant Folding public APIs
 //===----------------------------------------------------------------------===//
 
+/// Given a user-supplied Function and arguments, try to fold the Function to a
+/// constant. This is a *very* trivial fold; it does not support Functions with
+/// more than one basic block, nor does it support anything that the constant
+/// folder doesn't support.
+Constant *llvm::constantFoldUserFunction(const Function *Fn,
+                                         ArrayRef<Constant *> Args,
+                                         const DataLayout &DL,
+                                         const TargetLibraryInfo *TLI) {
+  assert(!Fn->getReturnType()->isVoidTy() && "Trying to fold a void function?");
+  assert(std::none_of(Args.begin(), Args.end(), [](Value *P) { return !P; }));
+
+  // Functions with zero blocks (naturally) can't be folded, and functions
+  // with more than one block are not supported due to their potential
+  // complexity. The goal is to try and fold very simple functions, not make
+  // LLVM's own flavor of constexpr.
+  if (Fn->empty() || std::next(Fn->begin()) != Fn->end())
+    return nullptr;
+
+  // Don't allocate for the body, because many of our attempts will presumably
+  // stop early on in the function (e.g. when we spot an alloca/load/store/...)
+  SmallDenseMap<const Value *, Constant *, 8> ValueMap(Args.size());
+
+  unsigned I = 0;
+  for (const Argument &A : Fn->getArgumentList()) {
+    assert(A.getType() == Args[I]->getType());
+    ValueMap[&A] = Args[I++];
+  }
+
+  SmallVector<Constant *, 8> Operands;
+  for (const Instruction &Inst : Fn->getEntryBlock()) {
+    // Fast path: Stores/loads aren't supported, and allocas are generally put
+    // really early in functions, so give up if we see one.
+    if (isa<AllocaInst>(Inst))
+      return nullptr;
+
+    Operands.resize(Inst.getNumOperands());
+    unsigned I = 0;
+    for (Value *V : Inst.operands()) {
+      if (Constant *C = dyn_cast<Constant>(V)) {
+        // Functions are fine if they're used as the operand of a call
+        // operation, because we may be able to fold them (e.g. math intrinsics,
+        // ...). Otherwise, global values aren't allowed.
+        if (isa<GlobalValue>(C) &&
+            !(isa<CallInst>(Inst) && isa<Function>(C) && I == 0))
+          return nullptr;
+        Operands[I++] = C;
+        continue;
+      }
+
+      auto Result = ValueMap.find(V);
+      assert(Result != ValueMap.end());
+      Operands[I++] = Result->second;
+    }
+
+    if (isa<ReturnInst>(Inst))
+      return Operands[0];
+
+    Constant *Result =
+        foldNonMemoryInstructionWithOperands(Inst, Operands, DL, TLI);
+
+    // ConstantExprs are returned if we can't fold something to a single
+    // constant value. That's technically a failure, so we should bail out early
+    // instead of building an everlasting tree of ConstantExprs that ends up
+    // being thrown away.
+    if (!Result || isa<ConstantExpr>(Result))
+      return nullptr;
+    ValueMap[&Inst] = Result;
+  }
+
+  llvm_unreachable("Encountered a function without a return instruction");
+}
+
 /// Try to constant fold the specified instruction.
 /// If successful, the constant result is returned, if not, null is returned.
 /// Note that this fails if not all of the operands are constant.  Otherwise,
 /// this function can only fail when attempting to fold instructions like loads
 /// and stores, which have no constant expression form.
 Constant *llvm::ConstantFoldInstruction(Instruction *I, const DataLayout &DL,
                                         const TargetLibraryInfo *TLI) {
   // Handle PHI nodes quickly here...
for (User::op_iterator i = I->op_begin(), e = I->op_end(); i != e; ++i) {
 
     // Fold the Instruction's operands.
     if (ConstantExpr *NewCE = dyn_cast<ConstantExpr>(Op))
       Op = ConstantFoldConstantExpression(NewCE, DL, TLI);
 
     Ops.push_back(Op);
   }
 
-  if (const CmpInst *CI = dyn_cast<CmpInst>(I))
-    return ConstantFoldCompareInstOperands(CI->getPredicate(), Ops[0], Ops[1],
-                                           DL, TLI);
-
   if (const LoadInst *LI = dyn_cast<LoadInst>(I))
     return ConstantFoldLoadInst(LI, DL);
 
-  if (InsertValueInst *IVI = dyn_cast<InsertValueInst>(I)) {
-    return ConstantExpr::getInsertValue(
-                                cast<Constant>(IVI->getAggregateOperand()),
-                                cast<Constant>(IVI->getInsertedValueOperand()),
-                                IVI->getIndices());
-  }
-
-  if (ExtractValueInst *EVI = dyn_cast<ExtractValueInst>(I)) {
-    return ConstantExpr::getExtractValue(
-                                    cast<Constant>(EVI->getAggregateOperand()),
-                                    EVI->getIndices());
-  }
-
-  return ConstantFoldInstOperands(I->getOpcode(), I->getType(), Ops, DL, TLI);
+  return foldNonMemoryInstructionWithOperands(*I, Ops, DL, TLI);
 }
 
 static Constant *
 ConstantFoldConstantExpressionImpl(const ConstantExpr *CE, const DataLayout &DL,
                                    const TargetLibraryInfo *TLI,
                                    SmallPtrSetImpl<ConstantExpr *> &FoldedOps) {
   SmallVector<Constant *, 8> Ops;
   for (User::const_op_iterator i = CE->op_begin(), e = CE->op_end(); i != e;

lib/Analysis/MemoryBuiltins.cpp

 // This family of functions identifies calls to builtin functions that allocate
 // or free memory.
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Analysis/MemoryBuiltins.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/Statistic.h"
+#include "llvm/Analysis/ConstantFolding.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Analysis/ValueTracking.h"
 #include "llvm/IR/DataLayout.h"
 #include "llvm/IR/GlobalVariable.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/Intrinsics.h"
 #include "llvm/IR/Metadata.h"
 #include "llvm/IR/Module.h"

 struct AllocFnsTy {
   LibFunc::Func Func;
   AllocType AllocTy;
   unsigned char NumParams;
   // First and Second size parameters (or -1 if unused)
   signed char FstParam, SndParam;
 };
 
+constexpr static AllocType AllocSizeAllocTy = MallocLike;
+
 // FIXME: certain users need more information. E.g., SimplifyLibCalls needs to
 // know which functions are nounwind, noalias, nocapture parameters, etc.
 static const AllocFnsTy AllocationFnData[] = {
   {LibFunc::malloc,              MallocLike,  1, 0,  -1},
   {LibFunc::valloc,              MallocLike,  1, 0,  -1},
   {LibFunc::Znwj,                OpNewLike,   1, 0,  -1}, // new(unsigned int)
   {LibFunc::ZnwjRKSt9nothrow_t,  MallocLike,  2, 0,  -1}, // new(unsigned int, nothrow)
   {LibFunc::Znwm,                OpNewLike,   1, 0,  -1}, // new(unsigned long)
static const AllocFnsTy AllocationFnData[] = {
   {LibFunc::calloc,              CallocLike,  2, 0,   1},
   {LibFunc::realloc,             ReallocLike, 2, 1,  -1},
   {LibFunc::reallocf,            ReallocLike, 2, 1,  -1},
   {LibFunc::strdup,              StrDupLike,  1, -1, -1},
   {LibFunc::strndup,             StrDupLike,  2, 1,  -1}
   // TODO: Handle "int posix_memalign(void **, size_t, size_t)"
 };
 
-
-static Function *getCalledFunction(const Value *V, bool LookThroughBitCast) {
-  if (LookThroughBitCast)
-    V = V->stripPointerCasts();
-
-  CallSite CS(const_cast<Value*>(V));
-  if (!CS.getInstruction())
+static Function *getCalledFunction(CallSite CS) {
+  if (!CS.getInstruction() || isa<IntrinsicInst>(CS.getInstruction()))
     return nullptr;
 
   if (CS.isNoBuiltin())
     return nullptr;
 
   Function *Callee = CS.getCalledFunction();
   if (!Callee || !Callee->isDeclaration())
     return nullptr;
   return Callee;
 }
 
-/// \brief Returns the allocation data for the given value if it is a call to a
-/// known allocation function, and NULL otherwise.
-static const AllocFnsTy *getAllocationData(const Value *V, AllocType AllocTy,
-                                           const TargetLibraryInfo *TLI,
-                                           bool LookThroughBitCast = false) {
-  // Skip intrinsics
-  if (isa<IntrinsicInst>(V))
+static Function *getCalledFunction(const Value *V,
+                                   bool LookThroughBitCast = true) {
+  if (LookThroughBitCast)
+    V = V->stripPointerCasts();
+  return getCalledFunction(CallSite(const_cast<Value*>(V)));
+}
+
+static Optional<Attribute::PseudoCall>
+getAllocSizeArgs(const Function *Callee) {
+  if (!Callee->hasFnAttribute(Attribute::AllocSize))
+    return None;
+  Attribute Attr = Callee->getFnAttribute(Attribute::AllocSize);
+  return Attr.getAllocSizeArgs();
+}
+
+static Constant *
+foldBytesComputedByAllocSizeFunction(CallSite CS, const DataLayout &DL,
+                                     const TargetLibraryInfo *TLI) {
+
+  Function *Fn = getCalledFunction(CS);
+  if (!Fn)
+    return nullptr;
+
+  Optional<Attribute::PseudoCall> MaybeAllocSizeArgs = getAllocSizeArgs(Fn);
+  if (!MaybeAllocSizeArgs)
+    return nullptr;
+
+  const Attribute::PseudoCall &Call = *MaybeAllocSizeArgs;
+  SmallVector<Constant *, 8> Args;
+  for (unsigned ArgNo : Call.Args) {
+    auto *C = dyn_cast<Constant>(CS.getArgument(ArgNo));
+    if (!C)
+      return nullptr;
+    Args.push_back(C);
+  }
+
+  return constantFoldUserFunction(Call.mustGetCalledFunction(), Args, DL, TLI);
+}
+
+static std::pair<APInt, APInt> unpackAllocSizeResult(Constant *C) {
+  auto *Size = cast<ConstantInt>(C->getAggregateElement(0u));
+  auto *Offset = cast<ConstantInt>(C->getAggregateElement(1));
+  return std::make_pair(Size->getValue(), Offset->getValue());
+}
+
+static std::pair<Value *, Value *> unpackAllocSizeResult(Value *V) {
+  return std::make_pair(ExtractValueInst::Create(V, {0}),
+                        ExtractValueInst::Create(V, {1}));
+}
+
+static Value *
+getBytesReturnedByAllocSizeFunction(CallSite CS, const DataLayout &DL,
+                                    bool RequireConstant = false) {
+  Function *Fn = getCalledFunction(CS);
+  if (!Fn)
     return nullptr;
 
-  Function *Callee = getCalledFunction(V, LookThroughBitCast);
-  if (!Callee)
+  Optional<Attribute::PseudoCall> MaybeAllocSizeArgs = getAllocSizeArgs(Fn);
+  if (!MaybeAllocSizeArgs)
     return nullptr;
 
+  const Attribute::PseudoCall &Call = *MaybeAllocSizeArgs;
+  SmallVector<Value *, 8> Args(Call.mustGetCalledFunction()->arg_size());
+  unsigned I = 0;
+  for (unsigned ArgNo : Call.Args)
+    Args[I++] = CS.getArgument(ArgNo);
+
+  return CallInst::Create(Call.Fn, Args);
+}
+
+/// \brief Returns the allocation data for the given value if it's either a call
+/// to a known allocation function
+static const AllocFnsTy *
+getKnownAllocationData(const Function *Callee, AllocType AllocTy,
+                       const TargetLibraryInfo *TLI) {
   // Make sure that the function is available.
   StringRef FnName = Callee->getName();
   LibFunc::Func TLIFn;
   if (!TLI || !TLI->getLibFunc(FnName, TLIFn) || !TLI->has(TLIFn))
     return nullptr;
 
   const AllocFnsTy *FnData =
       std::find_if(std::begin(AllocationFnData), std::end(AllocationFnData),
-                   [TLIFn](const AllocFnsTy &Fn) { return Fn.Func == TLIFn; });
+                   [TLIFn](const AllocFnsTy &P) { return P.Func== TLIFn; });
 
   if (FnData == std::end(AllocationFnData))
     return nullptr;
 
   if ((FnData->AllocTy & AllocTy) != FnData->AllocTy)
     return nullptr;
 
   // Check function prototype.
   int FstParam = FnData->FstParam;
   int SndParam = FnData->SndParam;
   FunctionType *FTy = Callee->getFunctionType();
 
   if (FTy->getReturnType() == Type::getInt8PtrTy(FTy->getContext()) &&
       FTy->getNumParams() == FnData->NumParams &&
       (FstParam < 0 ||
        (FTy->getParamType(FstParam)->isIntegerTy(32) ||
         FTy->getParamType(FstParam)->isIntegerTy(64))) &&
       (SndParam < 0 ||
        FTy->getParamType(SndParam)->isIntegerTy(32) ||
        FTy->getParamType(SndParam)->isIntegerTy(64)))
     return FnData;
   return nullptr;
 }
 
+static const AllocFnsTy *
+getKnownAllocationData(const Value *V, AllocType AllocTy,
+                       const TargetLibraryInfo *TLI,
+                       bool LookThroughBitCast = false) {
+  const Function *Callee = getCalledFunction(V, LookThroughBitCast);
+  return Callee ? getKnownAllocationData(Callee, AllocTy, TLI) : nullptr;
+}
+
 static bool hasNoAliasAttr(const Value *V, bool LookThroughBitCast) {
   ImmutableCallSite CS(LookThroughBitCast ? V->stripPointerCasts() : V);
   return CS && CS.hasFnAttr(Attribute::NoAlias);
 }
 
+static bool isAllocFunctionOfType(const Value *V, AllocType Ty,
+                                  const TargetLibraryInfo *TLI,
+                                  bool LookThroughBitCast = true) {
+  const Function *Callee = getCalledFunction(V, LookThroughBitCast);
+  if (!Callee)
+    return false;
+
+  if ((AllocSizeAllocTy & Ty) == AllocSizeAllocTy && getAllocSizeArgs(Callee))
+    return true;
+  return getKnownAllocationData(Callee, Ty, TLI);
+}
 
 /// \brief Tests if a value is a call or invoke to a library function that
 /// allocates or reallocates memory (either malloc, calloc, realloc, or strdup
 /// like).
 bool llvm::isAllocationFn(const Value *V, const TargetLibraryInfo *TLI,
                           bool LookThroughBitCast) {
-  return getAllocationData(V, AnyAlloc, TLI, LookThroughBitCast);
+  return isAllocFunctionOfType(V, AnyAlloc, TLI, LookThroughBitCast);
 }
 
 /// \brief Tests if a value is a call or invoke to a function that returns a
 /// NoAlias pointer (including malloc/calloc/realloc/strdup-like functions).
 bool llvm::isNoAliasFn(const Value *V, const TargetLibraryInfo *TLI,
                        bool LookThroughBitCast) {
   // it's safe to consider realloc as noalias since accessing the original
-  // pointer is undefined behavior
+  // pointer is undefined behavior.
+  // FIXME: Should we include allocsize functions in this?
   return isAllocationFn(V, TLI, LookThroughBitCast) ||
          hasNoAliasAttr(V, LookThroughBitCast);
 }
 
 /// \brief Tests if a value is a call or invoke to a library function that
 /// allocates uninitialized memory (such as malloc).
 bool llvm::isMallocLikeFn(const Value *V, const TargetLibraryInfo *TLI,
                           bool LookThroughBitCast) {
-  return getAllocationData(V, MallocLike, TLI, LookThroughBitCast);
+  return isAllocFunctionOfType(V, MallocLike, TLI, LookThroughBitCast);
 }
 
 /// \brief Tests if a value is a call or invoke to a library function that
 /// allocates zero-filled memory (such as calloc).
 bool llvm::isCallocLikeFn(const Value *V, const TargetLibraryInfo *TLI,
                           bool LookThroughBitCast) {
-  return getAllocationData(V, CallocLike, TLI, LookThroughBitCast);
+  return isAllocFunctionOfType(V, CallocLike, TLI, LookThroughBitCast);
 }
 
 /// \brief Tests if a value is a call or invoke to a library function that
 /// allocates memory (either malloc, calloc, or strdup like).
 bool llvm::isAllocLikeFn(const Value *V, const TargetLibraryInfo *TLI,
                          bool LookThroughBitCast) {
-  return getAllocationData(V, AllocLike, TLI, LookThroughBitCast);
+  return isAllocFunctionOfType(V, AllocLike, TLI, LookThroughBitCast);
 }
 
 /// extractMallocCall - Returns the corresponding CallInst if the instruction
 /// is a malloc call.  Since CallInst::CreateMalloc() only creates calls, we
 /// ignore InvokeInst here.
 const CallInst *llvm::extractMallocCall(const Value *I,
                                         const TargetLibraryInfo *TLI) {
   return isMallocLikeFn(I, TLI) ? dyn_cast<CallInst>(I) : nullptr;
if (!A.hasByValOrInAllocaAttr()) {
     return unknown();
   }
   PointerType *PT = cast<PointerType>(A.getType());
   APInt Size(IntTyBits, DL.getTypeAllocSize(PT->getElementType()));
   return std::make_pair(align(Size, A.getParamAlignment()), Zero);
 }
 
 SizeOffsetType ObjectSizeOffsetVisitor::visitCallSite(CallSite CS) {
-  const AllocFnsTy *FnData = getAllocationData(CS.getInstruction(), AnyAlloc,
-                                               TLI);
-  if (!FnData)
+  const AllocFnsTy *FnData = getKnownAllocationData(CS.getInstruction(), AnyAlloc, TLI);
+  if (!FnData) {
+    if (Constant *Res = foldBytesComputedByAllocSizeFunction(CS, DL, TLI)) {
+      std::pair<APInt, APInt> Unpacked = unpackAllocSizeResult(Res);
+      // If the user calculated a negative value, or the offset is greater than
+      // the size of the block of memory we're being handed back, bail out.
+      if (Unpacked.first.isNonNegative() && Unpacked.second.isNonNegative() &&
+          Unpacked.first.uge(Unpacked.second))
+        return Unpacked;
+    }
     return unknown();
+  }
 
   // handle strdup-like functions separately
   if (FnData->AllocTy == StrDupLike) {
     APInt Size(IntTyBits, GetStringLength(CS.getArgument(0)));
     if (!Size)
       return unknown();
 
     // strndup limits strlen
     if (FnData->FstParam > 0) {
-      ConstantInt *Arg= dyn_cast<ConstantInt>(CS.getArgument(FnData->FstParam));
+      ConstantInt *Arg =
+          dyn_cast<ConstantInt>(CS.getArgument(FnData->FstParam));
       if (!Arg)
         return unknown();
 
       APInt MaxSize = Arg->getValue().zextOrSelf(IntTyBits);
       if (Size.ugt(MaxSize))
         Size = MaxSize + 1;
     }
     return std::make_pair(Size, Zero);
SizeOffsetEvalType ObjectSizeOffsetEvaluator::visitAllocaInst(AllocaInst &I) {
   Value *ArraySize = I.getArraySize();
   Value *Size = ConstantInt::get(ArraySize->getType(),
                                  DL.getTypeAllocSize(I.getAllocatedType()));
   Size = Builder.CreateMul(Size, ArraySize);
   return std::make_pair(Size, Zero);
 }
 
 SizeOffsetEvalType ObjectSizeOffsetEvaluator::visitCallSite(CallSite CS) {
-  const AllocFnsTy *FnData = getAllocationData(CS.getInstruction(), AnyAlloc,
-                                               TLI);
-  if (!FnData)
-    return unknown();
+  const AllocFnsTy *FnData = getKnownAllocationData(CS, AnyAlloc, TLI);
+  if (!FnData) {
+    // FIXME: Because we're running user code here, do we want to add a guard
+    // for if it returns a negative value? Or should we just let it crash and
+    // let the user figure it out?
+    Value *Res = getBytesReturnedByAllocSizeFunction(CS, DL, TLI);
+    return Res ? unpackAllocSizeResult(Res) : unknown();
+  }
 
   // handle strdup-like functions separately
   if (FnData->AllocTy == StrDupLike) {
     // TODO
     return unknown();
   }
 
   Value *FirstArg = CS.getArgument(FnData->FstParam);

lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(cxx_fast_tlscc);
 
   KEYWORD(cc);
   KEYWORD(c);
 
   KEYWORD(attributes);
 
   KEYWORD(alwaysinline);
+  KEYWORD(allocsize);
   KEYWORD(argmemonly);
   KEYWORD(builtin);
   KEYWORD(byval);
   KEYWORD(inalloca);
   KEYWORD(cold);
   KEYWORD(convergent);
   KEYWORD(dereferenceable);
   KEYWORD(dereferenceable_or_null);

lib/AsmParser/LLParser.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_LIB_ASMPARSER_LLPARSER_H
 #define LLVM_LIB_ASMPARSER_LLPARSER_H
 
 #include "LLLexer.h"
 #include "llvm/ADT/DenseMap.h"
+#include "llvm/ADT/Optional.h"
 #include "llvm/ADT/StringMap.h"
 #include "llvm/IR/Attributes.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/Operator.h"
 #include "llvm/IR/Type.h"
 #include "llvm/IR/ValueHandle.h"
 #include <map>
private:
     bool ParseOptionalAlignment(unsigned &Alignment);
     bool ParseOptionalDerefAttrBytes(lltok::Kind AttrKind, uint64_t &Bytes);
     bool ParseScopeAndOrdering(bool isAtomic, SynchronizationScope &Scope,
                                AtomicOrdering &Ordering);
     bool ParseOrdering(AtomicOrdering &Ordering);
     bool ParseOptionalStackAlignment(unsigned &Alignment);
     bool ParseOptionalCommaAlign(unsigned &Alignment, bool &AteExtraComma);
     bool ParseOptionalCommaInAlloca(bool &IsInAlloca);
-    bool ParseIndexList(SmallVectorImpl<unsigned> &Indices,bool &AteExtraComma);
+    bool parseAllocSizeArguments(Function *&Fn,
+                                 SmallVectorImpl<unsigned> &Params);
+    bool ParseIndexList(SmallVectorImpl<unsigned> &Indices,
+                        bool &AteExtraComma);
     bool ParseIndexList(SmallVectorImpl<unsigned> &Indices) {
       bool AteExtraComma;
       if (ParseIndexList(Indices, AteExtraComma)) return true;
       if (AteExtraComma)
         return TokError("expected index");
       return false;
     }
 

lib/AsmParser/LLParser.cpp

 //===-- LLParser.cpp - Parser Class ---------------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines the parser class for .ll files.
 //
 //===----------------------------------------------------------------------===//
 
 #include "LLParser.h"
 #include "llvm/ADT/SmallPtrSet.h"
 #include "llvm/ADT/STLExtras.h"
+#include "llvm/ADT/StringExtras.h"
 #include "llvm/AsmParser/SlotMapping.h"
 #include "llvm/IR/AutoUpgrade.h"
 #include "llvm/IR/CallingConv.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DebugInfo.h"
 #include "llvm/IR/DebugInfoMetadata.h"
 #include "llvm/IR/DerivedTypes.h"
 #include "llvm/IR/InlineAsm.h"
case lltok::kw_alignstack: {
           return true;
       } else {
         if (ParseOptionalStackAlignment(Alignment))
           return true;
       }
       B.addStackAlignmentAttr(Alignment);
       continue;
     }
+    case lltok::kw_allocsize: {
+      // inAttrGrp doesn't matter; we only support allocsize(a, [b, c, ...])
+      Function *Fn;
+      SmallVector<unsigned, 4> ArgNos;
+      if (parseAllocSizeArguments(Fn, ArgNos))
+        return true;
+      B.addAllocSizeAttr({Fn, ArgNos});
+      continue;
+    }
     case lltok::kw_alwaysinline: B.addAttribute(Attribute::AlwaysInline); break;
     case lltok::kw_argmemonly: B.addAttribute(Attribute::ArgMemOnly); break;
     case lltok::kw_builtin: B.addAttribute(Attribute::Builtin); break;
     case lltok::kw_cold: B.addAttribute(Attribute::Cold); break;
     case lltok::kw_convergent: B.addAttribute(Attribute::Convergent); break;
     case lltok::kw_inaccessiblememonly:
       B.addAttribute(Attribute::InaccessibleMemOnly); break;
     case lltok::kw_inaccessiblemem_or_argmemonly:
if (Lex.getKind() != lltok::kw_align)
       return Error(Lex.getLoc(), "expected metadata or 'align'");
 
     if (ParseOptionalAlignment(Alignment)) return true;
   }
 
   return false;
 }
 
+bool LLParser::parseAllocSizeArguments(Function *&Fn,
+                                       SmallVectorImpl<unsigned> &Params) {
+  Lex.Lex();
+
+  LocTy CurrentLoc = Lex.getLoc();
+  if (!EatIfPresent(lltok::lparen))
+    return Error(CurrentLoc, "expected '('");
+
+  CurrentLoc = Lex.getLoc();
+  Constant *Val;
+  if (ParseGlobalTypeAndValue(Val))
+    return true;
+
+  Fn = dyn_cast<Function>(Val);
+  if (!Fn)
+    return Error(CurrentLoc, "expected function");
+
+  Params.clear();
+
+  CurrentLoc = Lex.getLoc();
+  bool AteComma = EatIfPresent(lltok::comma);
+  if (AteComma) {
+    CurrentLoc = Lex.getLoc();
+    if (!EatIfPresent(lltok::lsquare))
+      return Error(CurrentLoc, "expected '['");
+
+    // Consume the arg list.
+    while (!EatIfPresent(lltok::rsquare)) {
+      CurrentLoc = Lex.getLoc();
+      if (!Params.empty() && !EatIfPresent(lltok::comma))
+        return Error(CurrentLoc, "expected ',' or ']'");
+
+      unsigned ArgNo;
+      if (ParseUInt32(ArgNo))
+        return true;
+      Params.push_back(ArgNo);
+    }
+  }
+
+  if (!EatIfPresent(lltok::rparen))
+    return Error(CurrentLoc, "expected ')'");
+  return false;
+}
+
 /// ParseScopeAndOrdering
 ///   if isAtomic: ::= 'singlethread'? AtomicOrdering
 ///   else: ::=
 ///
 /// This sets Scope and Ordering to the parsed values.
 bool LLParser::ParseScopeAndOrdering(bool isAtomic, SynchronizationScope &Scope,
                                      AtomicOrdering &Ordering) {
   if (!isAtomic)

lib/AsmParser/LLToken.h

enum Kind {
     kw_preserve_mostcc, kw_preserve_allcc,
     kw_ghccc,
     kw_x86_intrcc,
     kw_hhvmcc, kw_hhvm_ccc,
     kw_cxx_fast_tlscc,
 
     // Attributes:
     kw_attributes,
+    kw_allocsize,
     kw_alwaysinline,
     kw_argmemonly,
     kw_sanitize_address,
     kw_builtin,
     kw_byval,
     kw_inalloca,
     kw_cold,
     kw_convergent,

lib/Bitcode/Reader/BitcodeReader.cpp

class BitcodeReaderValueList {
   LLVMContext &Context;
 public:
   BitcodeReaderValueList(LLVMContext &C) : Context(C) {}
   ~BitcodeReaderValueList() {
     assert(ResolveConstants.empty() && "Constants not resolved?");
   }
 
   // vector compatibility methods
+  using ConstIterator = decltype(ValuePtrs.cbegin());
+  ConstIterator begin() const { return ValuePtrs.cbegin(); }
+  ConstIterator end() const { return ValuePtrs.cend(); }
+
   unsigned size() const { return ValuePtrs.size(); }
   void resize(unsigned N) { ValuePtrs.resize(N); }
   void push_back(Value *V) { ValuePtrs.emplace_back(V); }
 
   void clear() {
     assert(ResolveConstants.empty() && "Constants not resolved?");
     ValuePtrs.clear();
   }
class BitcodeReader : public GVMaterializer {
   bool SeenModuleValuesRecord = false;
 
   std::vector<Type*> TypeList;
   BitcodeReaderValueList ValueList;
   BitcodeReaderMetadataList MetadataList;
   std::vector<Comdat *> ComdatList;
   SmallVector<Instruction *, 64> InstructionList;
 
+  /// A sort of cursor into ValueList, used when we're parsing module constants.
+  /// It's needed because we may have forward references in Attributes, so we
+  /// can't just use the size of the value list as an indicator for where
+  /// the constants need to go.
+  /// FIXME: This could be done better. Fix it if we want this patch to go in.
+  unsigned ValueListIndex = 0;
+
   std::vector<std::pair<GlobalVariable*, unsigned> > GlobalInits;
   std::vector<std::pair<GlobalAlias*, unsigned> > AliasInits;
   std::vector<std::pair<Function*, unsigned> > FunctionPrefixes;
   std::vector<std::pair<Function*, unsigned> > FunctionPrologues;
   std::vector<std::pair<Function*, unsigned> > FunctionPersonalityFns;
 
   SmallVector<Instruction*, 64> InstsWithTBAATag;
 
private:
   std::error_code parseAttributeGroupBlock();
   std::error_code parseTypeTable();
   std::error_code parseTypeTableBody();
   std::error_code parseOperandBundleTags();
 
   ErrorOr<Value *> recordValue(SmallVectorImpl<uint64_t> &Record,
                                unsigned NameIndex, Triple &TT);
   std::error_code parseValueSymbolTable(uint64_t Offset = 0);
-  std::error_code parseConstants();
+  std::error_code parseConstants(size_t StartAt = size_t(-1));
   std::error_code rememberAndSkipFunctionBodies();
   std::error_code rememberAndSkipFunctionBody();
   /// Save the positions of the Metadata blocks and skip parsing the blocks.
   std::error_code rememberAndSkipMetadata();
   std::error_code parseFunctionBody(Function *F);
   std::error_code globalCleanup();
   std::error_code resolveGlobalAndAliasInits();
   std::error_code parseMetadata(bool ModuleLevel = false);
static Attribute::AttrKind getAttrFromCode(uint64_t Code) {
   case bitc::ATTR_KIND_NON_LAZY_BIND:
     return Attribute::NonLazyBind;
   case bitc::ATTR_KIND_NON_NULL:
     return Attribute::NonNull;
   case bitc::ATTR_KIND_DEREFERENCEABLE:
     return Attribute::Dereferenceable;
   case bitc::ATTR_KIND_DEREFERENCEABLE_OR_NULL:
     return Attribute::DereferenceableOrNull;
+  case bitc::ATTR_KIND_ALLOC_SIZE:
+    return Attribute::AllocSize;
   case bitc::ATTR_KIND_NO_RED_ZONE:
     return Attribute::NoRedZone;
   case bitc::ATTR_KIND_NO_RETURN:
     return Attribute::NoReturn;
   case bitc::ATTR_KIND_NO_UNWIND:
     return Attribute::NoUnwind;
   case bitc::ATTR_KIND_OPTIMIZE_FOR_SIZE:
     return Attribute::OptimizeForSize;
case bitc::PARAMATTR_GRP_CODE_ENTRY: { // ENTRY: [grpid, idx, a0, a1, ...]
           if (Kind == Attribute::Alignment)
             B.addAlignmentAttr(Record[++i]);
           else if (Kind == Attribute::StackAlignment)
             B.addStackAlignmentAttr(Record[++i]);
           else if (Kind == Attribute::Dereferenceable)
             B.addDereferenceableAttr(Record[++i]);
           else if (Kind == Attribute::DereferenceableOrNull)
             B.addDereferenceableOrNullAttr(Record[++i]);
-        } else {                     // String attribute
-          assert((Record[i] == 3 || Record[i] == 4) &&
-                 "Invalid attribute group entry");
+        } else if (Record[i] == 3 || Record[i] == 4) { // String attribute
           bool HasValue = (Record[i++] == 4);
           SmallString<64> KindStr;
           SmallString<64> ValStr;
 
           while (Record[i] != 0 && i != e)
             KindStr += Record[i++];
           assert(Record[i] == 0 && "Kind string not null terminated");
 
           if (HasValue) {
             // Has a value associated with it.
             ++i; // Skip the '0' that terminates the "kind" string.
             while (Record[i] != 0 && i != e)
               ValStr += Record[i++];
             assert(Record[i] == 0 && "Value string not null terminated");
           }
 
           B.addAttribute(KindStr.str(), ValStr.str());
+        } else {
+          assert(Record[i] == 5 && "Invalid attribute group entry");
+          Attribute::AttrKind Kind;
+          if (std::error_code EC = parseAttrKind(Record[++i], &Kind))
+            return EC;
+
+          assert(Kind == Attribute::AllocSize && "Unexpected attribute kind");
+
+          Type *Ty = getTypeByID(Record[++i]);
+          assert(Ty && "Types should exist by now.");
+          Constant *Fn = ValueList.getConstantFwdRef(Record[++i], Ty);
+          uint64_t NumArgNos = Record[++i];
+          SmallVector<unsigned, 4> ArgNos(NumArgNos);
+          for (unsigned &ArgNo : ArgNos)
+            ArgNo = Record[++i];
+          B.addAllocSizeAttr({Fn, ArgNos});
         }
       }
 
       MAttributeGroups[GrpID] = AttributeSet::get(Context, Idx, B);
       break;
     }
     }
   }

 static APInt readWideAPInt(ArrayRef<uint64_t> Vals, unsigned TypeBits) {
   SmallVector<uint64_t, 8> Words(Vals.size());
   std::transform(Vals.begin(), Vals.end(), Words.begin(),
                  BitcodeReader::decodeSignRotatedValue);
 
   return APInt(TypeBits, Words);
 }
 
-std::error_code BitcodeReader::parseConstants() {
+std::error_code BitcodeReader::parseConstants(size_t StartAt) {
   if (Stream.EnterSubBlock(bitc::CONSTANTS_BLOCK_ID))
     return error("Invalid record");
 
   SmallVector<uint64_t, 64> Record;
 
   // Read all the records for this value table.
   Type *CurTy = Type::getInt32Ty(Context);
-  unsigned NextCstNo = ValueList.size();
+  if (StartAt == size_t(-1))
+    StartAt = ValueList.size();
+  unsigned NextCstNo = StartAt;
   while (1) {
     BitstreamEntry Entry = Stream.advanceSkippingSubblocks();
 
     switch (Entry.Kind) {
     case BitstreamEntry::SubBlock: // Handled for us already.
     case BitstreamEntry::Error:
       return error("Malformed block");
     case BitstreamEntry::EndBlock:
case bitc::CST_CODE_BLOCKADDRESS:{
           FwdBBs[BBID] = BasicBlock::Create(Context);
         BB = FwdBBs[BBID];
       }
       V = BlockAddress::get(Fn, BB);
       break;
     }
     }
 
-    ValueList.assignValue(V, NextCstNo);
-    ++NextCstNo;
+    assert((NextCstNo >= ValueList.size() ||
+            !ValueList[NextCstNo] ||
+            isa<ConstantPlaceHolder>(ValueList[NextCstNo])) &&
+           "We're about to overwrite an actual constant?");
+    ValueList.assignValue(V, NextCstNo++);
   }
 }
 
 std::error_code BitcodeReader::parseUseLists() {
   if (Stream.EnterSubBlock(bitc::USELIST_BLOCK_ID))
     return error("Invalid record");
 
   // Read all the records.
std::error_code BitcodeReader::rememberAndSkipFunctionBody() {
   return std::error_code();
 }
 
 std::error_code BitcodeReader::globalCleanup() {
   // Patch the initializers for globals and aliases up.
   resolveGlobalAndAliasInits();
   if (!GlobalInits.empty() || !AliasInits.empty())
     return error("Malformed global initializer set");
   
   // Look for intrinsic functions which need to be upgraded at some point
   for (Function &F : *TheModule) {
     Function *NewFn;
     if (UpgradeIntrinsicFunction(&F, NewFn))
       UpgradedIntrinsics[&F] = NewFn;
   }
 
   // Look for global variables which need to be renamed.
case BitstreamEntry::SubBlock:
           // We must have had a VST forward declaration record, which caused
           // the parser to jump to and parse the VST earlier.
           assert(VSTOffset > 0);
           if (Stream.SkipBlock())
             return error("Invalid record");
         }
         break;
       case bitc::CONSTANTS_BLOCK_ID:
-        if (std::error_code EC = parseConstants())
+        if (std::error_code EC = parseConstants(ValueListIndex))
           return EC;
         if (std::error_code EC = resolveGlobalAndAliasInits())
           return EC;
         break;
       case bitc::METADATA_BLOCK_ID:
         if (ShouldLazyLoadMetadata && !IsMetadataMaterialized) {
           if (std::error_code EC = rememberAndSkipMetadata())
             return EC;
case bitc::MODULE_CODE_GLOBALVAR: {
       NewGV->setVisibility(Visibility);
       NewGV->setUnnamedAddr(UnnamedAddr);
 
       if (Record.size() > 10)
         NewGV->setDLLStorageClass(getDecodedDLLStorageClass(Record[10]));
       else
         upgradeDLLImportExportLinkage(NewGV, RawLinkage);
 
-      ValueList.push_back(NewGV);
+      ValueList.assignValue(NewGV, ValueListIndex++);
 
       // Remember which value to use for the global initializer.
       if (unsigned InitID = Record[2])
         GlobalInits.push_back(std::make_pair(NewGV, InitID-1));
 
       if (Record.size() > 11) {
         if (unsigned ComdatID = Record[11]) {
           if (ComdatID > ComdatList.size())
case bitc::MODULE_CODE_FUNCTION: {
       }
 
       if (Record.size() > 13 && Record[13] != 0)
         FunctionPrefixes.push_back(std::make_pair(Func, Record[13]-1));
 
       if (Record.size() > 14 && Record[14] != 0)
         FunctionPersonalityFns.push_back(std::make_pair(Func, Record[14] - 1));
 
-      ValueList.push_back(Func);
+      ValueList.assignValue(Func, ValueListIndex++);
 
       // If this is a function with a body, remember the prototype we are
       // creating now, so that we can match up the body with them later.
       if (!isProto) {
         Func->setIsMaterializable(true);
         FunctionsWithBodies.push_back(Func);
         DeferredFunctionInfo[Func] = 0;
       }
case bitc::MODULE_CODE_ALIAS_OLD: {
       if (OpNum != Record.size())
         NewGA->setDLLStorageClass(getDecodedDLLStorageClass(Record[OpNum++]));
       else
         upgradeDLLImportExportLinkage(NewGA, Linkage);
       if (OpNum != Record.size())
         NewGA->setThreadLocalMode(getDecodedThreadLocalMode(Record[OpNum++]));
       if (OpNum != Record.size())
         NewGA->setUnnamedAddr(Record[OpNum++]);
-      ValueList.push_back(NewGA);
+      ValueList.assignValue(NewGA, ValueListIndex++);
       AliasInits.push_back(std::make_pair(NewGA, Val));
       break;
     }
     /// MODULE_CODE_PURGEVALS: [numvals]
     case bitc::MODULE_CODE_PURGEVALS:
       // Trim down the value list to the specified size.
       if (Record.size() < 1 || Record[0] > ValueList.size())
         return error("Invalid record");

lib/Bitcode/Writer/BitcodeWriter.cpp

static void WriteStringRecord(unsigned Code, StringRef Str,
   // Emit the finished record.
   Stream.EmitRecord(Code, Vals, AbbrevToUse);
 }
 
 static uint64_t getAttrKindEncoding(Attribute::AttrKind Kind) {
   switch (Kind) {
   case Attribute::Alignment:
     return bitc::ATTR_KIND_ALIGNMENT;
+  case Attribute::AllocSize:
+    return bitc::ATTR_KIND_ALLOC_SIZE;
   case Attribute::AlwaysInline:
     return bitc::ATTR_KIND_ALWAYS_INLINE;
   case Attribute::ArgMemOnly:
     return bitc::ATTR_KIND_ARGMEMONLY;
   case Attribute::Builtin:
     return bitc::ATTR_KIND_BUILTIN;
   case Attribute::ByVal:
     return bitc::ATTR_KIND_BY_VAL;
for (unsigned i = 0, e = AS.getNumSlots(); i != e; ++i) {
         Attribute Attr = *I;
         if (Attr.isEnumAttribute()) {
           Record.push_back(0);
           Record.push_back(getAttrKindEncoding(Attr.getKindAsEnum()));
         } else if (Attr.isIntAttribute()) {
           Record.push_back(1);
           Record.push_back(getAttrKindEncoding(Attr.getKindAsEnum()));
           Record.push_back(Attr.getValueAsInt());
-        } else {
+        } else if (Attr.isStringAttribute()) {
           StringRef Kind = Attr.getKindAsString();
           StringRef Val = Attr.getValueAsString();
 
           Record.push_back(Val.empty() ? 3 : 4);
           Record.append(Kind.begin(), Kind.end());
           Record.push_back(0);
           if (!Val.empty()) {
             Record.append(Val.begin(), Val.end());
             Record.push_back(0);
           }
+        } else {
+          assert(Attr.isPseudoCallAttribute() && "Unknown attribute type");
+          Attribute::PseudoCall Call = Attr.getValueAsPseudoCall();
+          assert(!Call.hasPlaceholderFunction() &&
+                 "Placeholder in the bitcode writer?!");
+
+          Record.push_back(5);
+          Record.push_back(getAttrKindEncoding(Attr.getKindAsEnum()));
+          Record.push_back(VE.getTypeID(Call.Fn->getType()));
+          Record.push_back(VE.getValueID(Call.Fn));
+          Record.push_back(Call.Args.size());
+          Record.append(Call.Args.begin(), Call.Args.end());
         }
       }
 
       Stream.EmitRecord(bitc::PARAMATTR_GRP_CODE_ENTRY, Record);
       Record.clear();
     }
   }
 
static void WriteModule(const Module *M, BitstreamWriter &Stream,
   Stream.EmitRecord(bitc::MODULE_CODE_VERSION, Vals);
 
   // Analyze the module, enumerating globals, functions, etc.
   ValueEnumerator VE(*M, ShouldPreserveUseListOrder);
 
   // Emit blockinfo, which defines the standard abbreviations etc.
   WriteBlockInfo(VE, Stream);
 
+  // Emit information describing all of the types in the module.
+  WriteTypeTable(VE, Stream);
+
   // Emit information about attribute groups.
   WriteAttributeGroupTable(VE, Stream);
 
   // Emit information about parameter attributes.
   WriteAttributeTable(VE, Stream);
 
-  // Emit information describing all of the types in the module.
-  WriteTypeTable(VE, Stream);
-
   writeComdats(VE, Stream);
 
   // Emit top-level description of module, including target triple, inline asm,
   // descriptors for global variables, and function prototype info.
   uint64_t VSTOffsetPlaceholder = WriteModuleInfo(M, VE, Stream);
 
   // Emit constants.
   WriteModuleConstants(VE, Stream);

lib/IR/AttributeImpl.h

 /// LLVMContextImpl for creating and managing attributes.
 ///
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_LIB_IR_ATTRIBUTEIMPL_H
 #define LLVM_LIB_IR_ATTRIBUTEIMPL_H
 
 #include "llvm/ADT/FoldingSet.h"
+#include "llvm/ADT/Optional.h"
 #include "llvm/IR/Attributes.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/ValueHandle.h"
 #include "llvm/Support/TrailingObjects.h"
 #include <string>
 
 namespace llvm {
 
 class Constant;
 class LLVMContext;
 
 //===----------------------------------------------------------------------===//
 /// \class
 /// \brief This class represents a single, uniqued attribute. That attribute
 /// could be a single enum, a tuple, or a string.
 class AttributeImpl : public FoldingSetNode {
   unsigned char KindID; ///< Holds the AttrEntryKind of the attribute
 
   // AttributesImpl is uniqued, these should not be publicly available.
   void operator=(const AttributeImpl &) = delete;
   AttributeImpl(const AttributeImpl &) = delete;
 
 protected:
   enum AttrEntryKind {
     EnumAttrEntry,
     IntAttrEntry,
+    PseudoCallEntry,
     StringAttrEntry
   };
 
   AttributeImpl(AttrEntryKind KindID) : KindID(KindID) {}
 
 public:
   virtual ~AttributeImpl();
 
   bool isEnumAttribute() const { return KindID == EnumAttrEntry; }
   bool isIntAttribute() const { return KindID == IntAttrEntry; }
+  bool isPseudoCallAttribute() const { return KindID == PseudoCallEntry; }
   bool isStringAttribute() const { return KindID == StringAttrEntry; }
 
+  bool hasEnumKind() const { return !hasStringKind(); }
+  bool hasStringKind() const { return isStringAttribute(); }
+
   bool hasAttribute(Attribute::AttrKind A) const;
   bool hasAttribute(StringRef Kind) const;
 
   Attribute::AttrKind getKindAsEnum() const;
   uint64_t getValueAsInt() const;
+  Attribute::PseudoCall getValueAsPseudoCall() const;
 
   StringRef getKindAsString() const;
   StringRef getValueAsString() const;
 
   /// \brief Used when sorting the attributes.
   bool operator<(const AttributeImpl &AI) const;
 
   void Profile(FoldingSetNodeID &ID) const {
     if (isEnumAttribute())
-      Profile(ID, getKindAsEnum(), 0);
+      ID.AddInteger(getKindAsEnum());
     else if (isIntAttribute())
       Profile(ID, getKindAsEnum(), getValueAsInt());
-    else
+    else if (isStringAttribute())
       Profile(ID, getKindAsString(), getValueAsString());
+    else
+      Profile(ID, getKindAsEnum(), getValueAsPseudoCall());
   }
   static void Profile(FoldingSetNodeID &ID, Attribute::AttrKind Kind,
                       uint64_t Val) {
     ID.AddInteger(Kind);
-    if (Val) ID.AddInteger(Val);
+    if (Val)
+      ID.AddInteger(Val);
+  }
+  static void Profile(FoldingSetNodeID &ID, Attribute::AttrKind Kind,
+                      const Attribute::PseudoCall &Call) {
+    ID.AddInteger(Kind);
+    ID.AddPointer(Call.Fn);
+    for (unsigned I : Call.Args)
+      ID.AddInteger(I);
   }
   static void Profile(FoldingSetNodeID &ID, StringRef Kind, StringRef Values) {
     ID.AddString(Kind);
-    if (!Values.empty()) ID.AddString(Values);
+    if (!Values.empty())
+      ID.AddString(Values);
   }
 
   // FIXME: Remove this!
   static uint64_t getAttrMask(Attribute::AttrKind Val);
 };
 
 //===----------------------------------------------------------------------===//
 /// \class

 public:
   StringAttributeImpl(StringRef Kind, StringRef Val = StringRef())
       : AttributeImpl(StringAttrEntry), Kind(Kind), Val(Val) {}
 
   StringRef getStringKind() const { return Kind; }
   StringRef getStringValue() const { return Val; }
 };
 
+class PseudoCallAttributeImpl : public EnumAttributeImpl, CallbackVH {
+  std::vector<unsigned> Args;
+  /// Is no longer accessible through the AttrsSet field in LLVMContextImpl
+  bool IsDefunct;
+
+  void anchor() override;
+
+  bool repositionInAttrsSet(LLVMContextImpl &, Function *NewPtr);
+  void noteChanged(Value *V);
+  void deleted() override { noteChanged(nullptr); }
+  void allUsesReplacedWith(Value *V) override {
+    assert(isa<Constant>(V) &&
+           "Pseudo-call function replaced with non-constant?");
+    noteChanged(V);
+  }
+
+  bool isInvalid() const { return getValPtr() == nullptr; }
+  Constant *getFn() const {
+    assert(!isInvalid() && "Invalid access of PseudoCallAttribute");
+    return cast<Constant>(getValPtr());
+  }
+
+public:
+  PseudoCallAttributeImpl(Attribute::AttrKind Kind,
+                          const Attribute::PseudoCall &Call)
+      : EnumAttributeImpl(PseudoCallEntry, Kind), CallbackVH(Call.Fn),
+        Args(Call.Args.begin(), Call.Args.end()), IsDefunct(false) {
+    assert(Kind == Attribute::AllocSize && "Wrong kind for value attribute!");
+    assert(Call.Fn && "Pseudo-call function may not be null.");
+    assert((isa<FunctionType>(Call.Fn->getType()) ||
+            (Call.Fn->getType()->isPointerTy() &&
+             isa<FunctionType>(Call.Fn->getType()->getPointerElementType()))) &&
+           "Pseudo-call function isn't a Function or function pointer?");
+  }
+
+  Attribute::PseudoCall getValue() const { return {getFn(), Args}; }
+};
+
 //===----------------------------------------------------------------------===//
 /// \class
 /// \brief This class represents a group of attributes that apply to one
 /// element: function, return type, or parameter.
 class AttributeSetNode final
     : public FoldingSetNode,
       private TrailingObjects<AttributeSetNode, Attribute> {
   friend TrailingObjects;
public:
 
   Attribute getAttribute(Attribute::AttrKind Kind) const;
   Attribute getAttribute(StringRef Kind) const;
 
   unsigned getAlignment() const;
   unsigned getStackAlignment() const;
   uint64_t getDereferenceableBytes() const;
   uint64_t getDereferenceableOrNullBytes() const;
+  Attribute::PseudoCall getAllocSizeArgs() const;
   std::string getAsString(bool InAttrGrp) const;
 
   typedef const Attribute *iterator;
   iterator begin() const { return getTrailingObjects<Attribute>(); }
   iterator end() const { return begin() + NumAttrs; }
 
   void Profile(FoldingSetNodeID &ID) const {
     Profile(ID, makeArrayRef(begin(), end()));
#endif
   typedef AttributeSetNode::iterator iterator;
   iterator begin(unsigned Slot) const { return getSlotNode(Slot)->begin(); }
   iterator end(unsigned Slot) const { return getSlotNode(Slot)->end(); }
 
   void Profile(FoldingSetNodeID &ID) const {
     Profile(ID, makeArrayRef(getNode(0), getNumAttributes()));
   }
   static void Profile(FoldingSetNodeID &ID,
-                      ArrayRef<std::pair<unsigned, AttributeSetNode*> > Nodes) {
+                      ArrayRef<std::pair<unsigned, AttributeSetNode *>> Nodes) {
     for (unsigned i = 0, e = Nodes.size(); i != e; ++i) {
       ID.AddInteger(Nodes[i].first);
       ID.AddPointer(Nodes[i].second);
     }
   }
 
   // FIXME: This atrocity is temporary.
   uint64_t Raw(unsigned Index) const;
 
   void dump() const;
 };
 
 } // end llvm namespace
 
 #endif

lib/IR/Attributes.cpp

 //===----------------------------------------------------------------------===//
 
 #include "llvm/IR/Attributes.h"
 #include "llvm/IR/Function.h"
 #include "AttributeImpl.h"
 #include "LLVMContextImpl.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/StringExtras.h"
+#include "llvm/IR/IRPrintingPasses.h"
 #include "llvm/IR/Type.h"
 #include "llvm/Support/Atomic.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/ManagedStatic.h"
 #include "llvm/Support/Mutex.h"
 #include "llvm/Support/raw_ostream.h"
 #include <algorithm>
 using namespace llvm;
 
 //===----------------------------------------------------------------------===//
 // Attribute Construction Methods
 //===----------------------------------------------------------------------===//
 
-Attribute Attribute::get(LLVMContext &Context, Attribute::AttrKind Kind,
-                         uint64_t Val) {
-  LLVMContextImpl *pImpl = Context.pImpl;
-  FoldingSetNodeID ID;
-  ID.AddInteger(Kind);
-  if (Val) ID.AddInteger(Val);
-
+/// Gets the attribute with the ID `ID`, or adds a new one if it doesn't exist.
+/// Uses `MakeNewAttr`, a zero-arg function, to make the new attribute.
+template <typename Func>
+static AttributeImpl *getOrAddAttribute(LLVMContextImpl &Ctx,
+                                        const FoldingSetNodeID &ID,
+                                        const Func &MakeNewAttr) {
   void *InsertPoint;
-  AttributeImpl *PA = pImpl->AttrsSet.FindNodeOrInsertPos(ID, InsertPoint);
+  if (AttributeImpl *PA = Ctx.AttrsSet.FindNodeOrInsertPos(ID, InsertPoint))
+    return PA;
 
-  if (!PA) {
-    // If we didn't find any existing attributes of the same shape then create a
-    // new one and insert it.
-    if (!Val)
-      PA = new EnumAttributeImpl(Kind);
-    else
-      PA = new IntAttributeImpl(Kind, Val);
-    pImpl->AttrsSet.InsertNode(PA, InsertPoint);
-  }
+  AttributeImpl *NewAttr = MakeNewAttr();
+  Ctx.AttrsSet.InsertNode(NewAttr, InsertPoint);
+  return NewAttr;
 
-  // Return the Attribute that we found or created.
-  return Attribute(PA);
-}
+Attribute Attribute::get(LLVMContext &Context, Attribute::AttrKind Kind,
+                         const PseudoCall &Val) {
+  assert(Val.Fn && "Null values aren't allowed in PseudoCall");
 
-Attribute Attribute::get(LLVMContext &Context, StringRef Kind, StringRef Val) {
-  LLVMContextImpl *pImpl = Context.pImpl;
   FoldingSetNodeID ID;
-  ID.AddString(Kind);
-  if (!Val.empty()) ID.AddString(Val);
-
-  void *InsertPoint;
-  AttributeImpl *PA = pImpl->AttrsSet.FindNodeOrInsertPos(ID, InsertPoint);
+  AttributeImpl::Profile(ID, Kind, Val);
+  AttributeImpl *Result = getOrAddAttribute(*Context.pImpl, ID, [&] {
+    return new PseudoCallAttributeImpl(Kind, Val);
+  });
+  return Attribute(Result);
+}
 
-  if (!PA) {
-    // If we didn't find any existing attributes of the same shape then create a
-    // new one and insert it.
-    PA = new StringAttributeImpl(Kind, Val);
-    pImpl->AttrsSet.InsertNode(PA, InsertPoint);
-  }
+Attribute Attribute::get(LLVMContext &Context, Attribute::AttrKind Kind,
+                         uint64_t Val) {
+  FoldingSetNodeID ID;
+  AttributeImpl::Profile(ID, Kind, Val);
+  AttributeImpl *Res =
+      getOrAddAttribute(*Context.pImpl, ID, [&]() -> AttributeImpl * {
+        if (Val)
+          return new IntAttributeImpl(Kind, Val);
+        return new EnumAttributeImpl(Kind);
+      });
+  return Attribute(Res);
 
-  // Return the Attribute that we found or created.
-  return Attribute(PA);
+Attribute Attribute::get(LLVMContext &Context, StringRef Kind, StringRef Val) {
+  FoldingSetNodeID ID;
+  AttributeImpl::Profile(ID, Kind, Val);
+  AttributeImpl *Res = getOrAddAttribute(
+      *Context.pImpl, ID, [&] { return new StringAttributeImpl(Kind, Val); });
+  return Attribute(Res);
 }
 
 Attribute Attribute::getWithAlignment(LLVMContext &Context, uint64_t Align) {
   assert(isPowerOf2_32(Align) && "Alignment must be a power of two.");
   assert(Align <= 0x40000000 && "Alignment too large.");
   return get(Context, Alignment, Align);
 }
 

 }
 
 Attribute Attribute::getWithDereferenceableOrNullBytes(LLVMContext &Context,
                                                        uint64_t Bytes) {
   assert(Bytes && "Bytes must be non-zero.");
   return get(Context, DereferenceableOrNull, Bytes);
 }
 
+Attribute Attribute::getWithAllocSize(LLVMContext &Context,
+                                      const Attribute::PseudoCall &Args) {
+  assert(Args.Fn && "allocsize can't take null values");
+  return get(Context, AllocSize, Args);
+}
+
 //===----------------------------------------------------------------------===//
 // Attribute Accessor Methods
 //===----------------------------------------------------------------------===//
 
 bool Attribute::isEnumAttribute() const {
   return pImpl && pImpl->isEnumAttribute();
 }
 
 bool Attribute::isIntAttribute() const {
   return pImpl && pImpl->isIntAttribute();
 }
 
+bool Attribute::isPseudoCallAttribute() const {
+  return pImpl && pImpl->isPseudoCallAttribute();
+}
+
 bool Attribute::isStringAttribute() const {
   return pImpl && pImpl->isStringAttribute();
 }
 
 Attribute::AttrKind Attribute::getKindAsEnum() const {
   if (!pImpl) return None;
-  assert((isEnumAttribute() || isIntAttribute()) &&
-         "Invalid attribute type to get the kind as an enum!");
+  assert(hasEnumKind() && "Invalid attribute type to get the kind as an enum!");
   return pImpl->getKindAsEnum();
 }
 
 uint64_t Attribute::getValueAsInt() const {
   if (!pImpl) return 0;
   assert(isIntAttribute() &&
          "Expected the attribute to be an integer attribute!");
   return pImpl->getValueAsInt();
 }
 
+Attribute::PseudoCall Attribute::getValueAsPseudoCall() const {
+  if (!pImpl) return PseudoCall();
+  assert(isPseudoCallAttribute() &&
+         "Expected the attribute to be a pseudo-call attribute!");
+  return pImpl->getValueAsPseudoCall();
+}
+
 StringRef Attribute::getKindAsString() const {
   if (!pImpl) return StringRef();
   assert(isStringAttribute() &&
          "Invalid attribute type to get the kind as a string!");
   return pImpl->getKindAsString();
 }
 
 StringRef Attribute::getValueAsString() const {

 
 uint64_t Attribute::getDereferenceableOrNullBytes() const {
   assert(hasAttribute(Attribute::DereferenceableOrNull) &&
          "Trying to get dereferenceable bytes from "
          "non-dereferenceable attribute!");
   return pImpl->getValueAsInt();
 }
 
+Attribute::PseudoCall Attribute::getAllocSizeArgs() const {
+  assert(hasAttribute(Attribute::AllocSize) &&
+         "Trying to get allocsize args from non-allocsize attribute");
+  return pImpl->getValueAsPseudoCall();
+}
+
 std::string Attribute::getAsString(bool InAttrGrp) const {
   if (!pImpl) return "";
 
   if (hasAttribute(Attribute::SanitizeAddress))
     return "sanitize_address";
   if (hasAttribute(Attribute::AlwaysInline))
     return "alwaysinline";
   if (hasAttribute(Attribute::ArgMemOnly))
if (hasAttribute(Attribute::StackAlignment))
     return AttrWithBytesToString("alignstack");
 
   if (hasAttribute(Attribute::Dereferenceable))
     return AttrWithBytesToString("dereferenceable");
 
   if (hasAttribute(Attribute::DereferenceableOrNull))
     return AttrWithBytesToString("dereferenceable_or_null");
 
+  if (hasAttribute(Attribute::AllocSize)) {
+    // allocsize(FnTy @FnName, [ArgNo1, ArgNo2, ...])
+    std::string Result;
+    llvm::raw_string_ostream OS(Result);
+    PseudoCall Call = getValueAsPseudoCall();
+
+    OS << "allocsize(";
+
+    if (Call.hasPlaceholderFunction())
+      OS << "[[Placeholder]]";
+    else {
+      Function *Fn = Call.mustGetCalledFunction();
+
+      Fn->getType()->print(OS);
+      OS << " @";
+      // FIXME: hasName required?
+      if (Fn->hasName())
+        printLLVMNameWithoutPrefix(OS, Fn->getName());
+    }
+
+    OS << ", [";
+    for (unsigned I = 0, E = Call.Args.size(); I != E; ++I) {
+      if (I)
+        OS << ", ";
+      OS << Call.Args[I];
+    }
+    OS << "])";
+
+    OS.flush();
+    return Result;
+  }
+
   // Convert target-dependent attributes to strings of the form:
   //
   //   "kind"
   //   "kind" = "value"
   //
   if (isStringAttribute()) {
     std::string Result;
     Result += (Twine('"') + getKindAsString() + Twine('"')).str();
 
     StringRef Val = pImpl->getValueAsString();
     if (Val.empty()) return Result;
 
     Result += ("=\"" + Val + Twine('"')).str();
     return Result;
   }
 
   llvm_unreachable("Unknown attribute");
 }
 
+bool Attribute::deepEqual(Attribute Other) const {
+  assert(pImpl != Other.pImpl &&
+         "Use operator== to check for pointer equality");
+  // Immutable attributes will always be uniqued, and pointer comparisons work
+  // 100% of the time.
+  if (isImmutable() || Other.isImmutable())
+    return false;
+
+  PseudoCall Ours = getValueAsPseudoCall();
+  PseudoCall Theirs = Other.getValueAsPseudoCall();
+  return Ours.Fn == Theirs.Fn && Ours.Args.size() == Theirs.Args.size() &&
+         std::equal(Ours.Args.begin(), Ours.Args.end(), Theirs.Args.begin());
+}
+
 bool Attribute::operator<(Attribute A) const {
   if (!pImpl && !A.pImpl) return false;
   if (!pImpl) return true;
   if (!A.pImpl) return false;
   return *pImpl < *A.pImpl;
 }
 
+bool Attribute::PseudoCall::hasPlaceholderFunction() const {
+  return !isa<Function>(Fn);
+}
+
+Function *Attribute::PseudoCall::mustGetCalledFunction() const {
+  return cast<Function>(Fn);
+}
+
 //===----------------------------------------------------------------------===//
 // AttributeImpl Definition
 //===----------------------------------------------------------------------===//
 
 // Pin the vtables to this file.
 AttributeImpl::~AttributeImpl() {}
 void EnumAttributeImpl::anchor() {}
 void IntAttributeImpl::anchor() {}
+void PseudoCallAttributeImpl::anchor() {}
 void StringAttributeImpl::anchor() {}
 
 bool AttributeImpl::hasAttribute(Attribute::AttrKind A) const {
   if (isStringAttribute()) return false;
   return getKindAsEnum() == A;
 }
 
 bool AttributeImpl::hasAttribute(StringRef Kind) const {
   if (!isStringAttribute()) return false;
   return getKindAsString() == Kind;
 }
 
 Attribute::AttrKind AttributeImpl::getKindAsEnum() const {
-  assert(isEnumAttribute() || isIntAttribute());
+  assert(hasEnumKind());
   return static_cast<const EnumAttributeImpl *>(this)->getEnumKind();
 }
 
 uint64_t AttributeImpl::getValueAsInt() const {
   assert(isIntAttribute());
   return static_cast<const IntAttributeImpl *>(this)->getValue();
 }
 
+Attribute::PseudoCall AttributeImpl::getValueAsPseudoCall() const {
+  assert(isPseudoCallAttribute());
+  return static_cast<const PseudoCallAttributeImpl *>(this)->getValue();
+}
+
 StringRef AttributeImpl::getKindAsString() const {
   assert(isStringAttribute());
   return static_cast<const StringAttributeImpl *>(this)->getStringKind();
 }
 
 StringRef AttributeImpl::getValueAsString() const {
   assert(isStringAttribute());
   return static_cast<const StringAttributeImpl *>(this)->getStringValue();
 }
 
 bool AttributeImpl::operator<(const AttributeImpl &AI) const {
   // This sorts the attributes with Attribute::AttrKinds coming first (sorted
   // relative to their enum value) and then strings.
   if (isEnumAttribute()) {
     if (AI.isEnumAttribute()) return getKindAsEnum() < AI.getKindAsEnum();
     if (AI.isIntAttribute()) return true;
+    if (AI.isPseudoCallAttribute()) return true;
     if (AI.isStringAttribute()) return true;
   }
 
   if (isIntAttribute()) {
     if (AI.isEnumAttribute()) return false;
     if (AI.isIntAttribute()) return getValueAsInt() < AI.getValueAsInt();
+    if (AI.isPseudoCallAttribute()) return true;
     if (AI.isStringAttribute()) return true;
   }
 
+  if (isPseudoCallAttribute()) {
     if (AI.isEnumAttribute()) return false;
     if (AI.isIntAttribute()) return false;
+    if (AI.isPseudoCallAttribute()) {
+      Attribute::PseudoCall Ours = getValueAsPseudoCall();
+      Attribute::PseudoCall Theirs = getValueAsPseudoCall();
+      if (Ours.Fn != Theirs.Fn) {
+        if (Ours.Fn->hasName() || Theirs.Fn->hasName())
+          return Ours.Fn->getName() < Theirs.Fn->getName();
+        // No names. Cheap out and order on address.
+        return Ours.Fn < Theirs.Fn;
+      }
+
+      return std::lexicographical_compare(
+          Ours.Args.begin(), Ours.Args.end(), Theirs.Args.begin(),
+          Theirs.Args.end());
+    }
+    if (AI.isStringAttribute()) return true;
+  }
+
+  if (AI.isEnumAttribute()) return false;
+  if (AI.isIntAttribute()) return false;
+  if (AI.isPseudoCallAttribute()) return false;
   if (getKindAsString() == AI.getKindAsString())
     return getValueAsString() < AI.getValueAsString();
   return getKindAsString() < AI.getKindAsString();
 }
 
 uint64_t AttributeImpl::getAttrMask(Attribute::AttrKind Val) {
   // FIXME: Remove this.
   switch (Val) {
case Attribute::Dereferenceable:
     break;
   case Attribute::DereferenceableOrNull:
     llvm_unreachable("dereferenceable_or_null attribute not supported in raw "
                      "format");
     break;
   case Attribute::ArgMemOnly:
     llvm_unreachable("argmemonly attribute not supported in raw format");
     break;
+  case Attribute::AllocSize:
+    llvm_unreachable("allocsize attribute not supported in raw format");
+    break;
   }
   llvm_unreachable("Unsupported attribute type");
 }
 
 //===----------------------------------------------------------------------===//
+// PseudoCallAttributeImpl Definition
+//===----------------------------------------------------------------------===//
+
+/// Removes the PseudoCallAttributeImpl from the AttrsSet in Ctx. Returns
+/// whether it was reinserted, and updates the ValPtr.
+bool PseudoCallAttributeImpl::repositionInAttrsSet(LLVMContextImpl &Ctx,
+                                                   Function *NewPtr) {
+  assert(!IsDefunct &&
+         "Defunct Pseudo-call attribute isn't in the set to begin with");
+
+  bool Removed = Ctx.AttrsSet.RemoveNode(this);
+  assert(Removed && "Non-defunct pseudo-call attribute not in the map?");
+  (void)Removed;
+
+  // AttrsSet may profile us on its own, so we need to set the value ptr here.
+  setValPtr(NewPtr);
+
+  // We can't create a PseudoCallAttribtueImpl with a null Function, so
+  // there's no point in not making this defunct if the Function has been
+  // deleted.
+  if (!NewPtr)
+    return false;
+
+  void *NewSlot;
+  FoldingSetNodeID ID;
+  Profile(ID);
+  if (Ctx.AttrsSet.FindNodeOrInsertPos(ID, NewSlot))
+    return false;
+
+  Ctx.AttrsSet.InsertNode(this, NewSlot);
+  return true;
+}
+
+// FIXME: As the deletion order stands, LLVMContextImpls delete all of their
+// Functions, then delete attributes. This moves all PseudoCallAttributes out of
+// the Attribute FoldingSet, and into the DefunctAttrs vector. They later free
+// everything in the DefunctAttrs vector. While this is suboptimal, there are
+// only generally a few PseudoCallAttributes per module, so it's not a massive
+// deal.
+void PseudoCallAttributeImpl::noteChanged(Value *NewValPtr) {
+  assert(!isInvalid() && "RAUWd a null function?!");
+  // It's possible to have a PseudoCallAttribute that is both defunct and valid.
+  // This occurs when a PseudoCallAttribute's Function gets RAUW'd such that it
+  // is identical to another PseudoCallAttribute. In that case, we have two
+  // identical attributes, one of which must become defunct (but which must also
+  // remain up-to-date with other RAUW's).
+  if (IsDefunct) {
+    setValPtr(cast_or_null<Function>(NewValPtr));
+    return;
+  }
+
+  LLVMContextImpl &Ctx = *getValPtr()->getContext().pImpl;
+  if (!repositionInAttrsSet(Ctx, cast_or_null<Function>(NewValPtr))) {
+    IsDefunct = true;
+    Ctx.DefunctAttrs.emplace_back(this);
+  }
+}
+
+
+//===----------------------------------------------------------------------===//
 // AttributeSetNode Definition
 //===----------------------------------------------------------------------===//
 
 AttributeSetNode *AttributeSetNode::get(LLVMContext &C,
                                         ArrayRef<Attribute> Attrs) {
   if (Attrs.empty())
     return nullptr;
 

 
 uint64_t AttributeSetNode::getDereferenceableOrNullBytes() const {
   for (iterator I = begin(), E = end(); I != E; ++I)
     if (I->hasAttribute(Attribute::DereferenceableOrNull))
       return I->getDereferenceableOrNullBytes();
   return 0;
 }
 
+Attribute::PseudoCall AttributeSetNode::getAllocSizeArgs() const {
+  for (iterator I = begin(), E = end(); I != E; ++I)
+    if (I->hasAttribute(Attribute::AllocSize))
+      return I->getAllocSizeArgs();
+  return {};
+}
+
 std::string AttributeSetNode::getAsString(bool InAttrGrp) const {
   std::string Str;
   for (iterator I = begin(), E = end(); I != E; ++I) {
     if (I != begin())
       Str += ' ';
     Str += I->getAsString(InAttrGrp);
   }
   return Str;
for (AttributeSetNode::iterator II = ASN->begin(),
       Attribute::AttrKind Kind = Attr.getKindAsEnum();
 
       if (Kind == Attribute::Alignment)
         Mask |= (Log2_32(ASN->getAlignment()) + 1) << 16;
       else if (Kind == Attribute::StackAlignment)
         Mask |= (Log2_32(ASN->getStackAlignment()) + 1) << 26;
       else if (Kind == Attribute::Dereferenceable)
         llvm_unreachable("dereferenceable not supported in bit mask");
+      else if (Kind == Attribute::AllocSize)
+        llvm_unreachable("allocsize not supported in bit mask");
       else
         Mask |= AttributeImpl::getAttrMask(Kind);
     }
 
     return Mask;
   }
 
   return 0;
for (Attribute::AttrKind Kind = Attribute::None;
     case Attribute::Dereferenceable:
       Attr = Attribute::getWithDereferenceableBytes(
           C, B.getDereferenceableBytes());
       break;
     case Attribute::DereferenceableOrNull:
       Attr = Attribute::getWithDereferenceableOrNullBytes(
           C, B.getDereferenceableOrNullBytes());
       break;
+    case Attribute::AllocSize:
+      Attr = Attribute::getWithAllocSize(C, B.getAllocSizeArgs());
+      break;
     default:
       Attr = Attribute::get(C, Kind);
     }
     Attrs.push_back(std::make_pair(Index, Attr));
   }
 
   // Add target-dependent (string) attributes.
   for (const AttrBuilder::td_type &TDA : B.td_attrs())

 AttributeSet AttributeSet::addDereferenceableOrNullAttr(LLVMContext &C,
                                                         unsigned Index,
                                                         uint64_t Bytes) const {
   llvm::AttrBuilder B;
   B.addDereferenceableOrNullAttr(Bytes);
   return addAttributes(C, Index, AttributeSet::get(C, Index, B));
 }
 
+AttributeSet
+AttributeSet::addAllocSizeAttr(LLVMContext &C, unsigned Index,
+                               const Attribute::PseudoCall &Args) {
+  llvm::AttrBuilder B;
+  B.addAllocSizeAttr(Args);
+  return addAttributes(C, Index, AttributeSet::get(C, Index, B));
+}
+
 //===----------------------------------------------------------------------===//
 // AttributeSet Accessor Methods
 //===----------------------------------------------------------------------===//
 
 LLVMContext &AttributeSet::getContext() const {
   return pImpl->getContext();
 }
 
uint64_t AttributeSet::getDereferenceableBytes(unsigned Index) const {
   return ASN ? ASN->getDereferenceableBytes() : 0;
 }
 
 uint64_t AttributeSet::getDereferenceableOrNullBytes(unsigned Index) const {
   AttributeSetNode *ASN = getAttributes(Index);
   return ASN ? ASN->getDereferenceableOrNullBytes() : 0;
 }
 
-std::string AttributeSet::getAsString(unsigned Index,
-                                      bool InAttrGrp) const {
+Attribute::PseudoCall AttributeSet::getAllocSizeArgs(unsigned Index) const {
+  AttributeSetNode *ASN = getAttributes(Index);
+  return ASN ? ASN->getAllocSizeArgs() : Attribute::PseudoCall{};
+}
+
+std::string AttributeSet::getAsString(unsigned Index, bool InAttrGrp) const {
   AttributeSetNode *ASN = getAttributes(Index);
   return ASN ? ASN->getAsString(InAttrGrp) : std::string("");
 }
 
 /// \brief The attributes for the specified index are returned.
 AttributeSetNode *AttributeSet::getAttributes(unsigned Index) const {
   if (!pImpl) return nullptr;
 

 }
 
 //===----------------------------------------------------------------------===//
 // AttrBuilder Method Implementations
 //===----------------------------------------------------------------------===//
 
 AttrBuilder::AttrBuilder(AttributeSet AS, unsigned Index)
     : Attrs(0), Alignment(0), StackAlignment(0), DerefBytes(0),
-      DerefOrNullBytes(0) {
+      DerefOrNullBytes(0), AllocSizeFn(nullptr) {
   AttributeSetImpl *pImpl = AS.pImpl;
   if (!pImpl) return;
 
   for (unsigned I = 0, E = pImpl->getNumAttributes(); I != E; ++I) {
     if (pImpl->getSlotIndex(I) != Index) continue;
 
     for (AttributeSetImpl::iterator II = pImpl->begin(I),
            IE = pImpl->end(I); II != IE; ++II)
       addAttribute(*II);
 
     break;
   }
 }
 
 void AttrBuilder::clear() {
   Attrs.reset();
   TargetDepAttrs.clear();
   Alignment = StackAlignment = DerefBytes = DerefOrNullBytes = 0;
+  AllocSizeFn = nullptr;
+  AllocSizeArgNos.clear();
 }
 
 AttrBuilder &AttrBuilder::addAttribute(Attribute::AttrKind Val) {
   assert((unsigned)Val < Attribute::EndAttrKinds && "Attribute out of range!");
   assert(Val != Attribute::Alignment && Val != Attribute::StackAlignment &&
-         Val != Attribute::Dereferenceable &&
+         Val != Attribute::Dereferenceable && Val != Attribute::AllocSize &&
          "Adding integer attribute without adding a value!");
+  assert(Val != Attribute::AllocSize &&
+         "Adding pseudo-call attribute without a value");
   Attrs[Val] = true;
   return *this;
 }
 
 AttrBuilder &AttrBuilder::addAttribute(Attribute Attr) {
   if (Attr.isStringAttribute()) {
     addAttribute(Attr.getKindAsString(), Attr.getValueAsString());
     return *this;
   }
 
   Attribute::AttrKind Kind = Attr.getKindAsEnum();
   Attrs[Kind] = true;
 
   if (Kind == Attribute::Alignment)
     Alignment = Attr.getAlignment();
   else if (Kind == Attribute::StackAlignment)
     StackAlignment = Attr.getStackAlignment();
   else if (Kind == Attribute::Dereferenceable)
     DerefBytes = Attr.getDereferenceableBytes();
   else if (Kind == Attribute::DereferenceableOrNull)
     DerefOrNullBytes = Attr.getDereferenceableOrNullBytes();
+  else if (Kind == Attribute::AllocSize) {
+    Attribute::PseudoCall Call = Attr.getAllocSizeArgs();
+    AllocSizeFn = Call.Fn;
+    AllocSizeArgNos.clear();
+    AllocSizeArgNos.append(Call.Args.begin(), Call.Args.end());
+  }
   return *this;
 }
 
 AttrBuilder &AttrBuilder::addAttribute(StringRef A, StringRef V) {
   TargetDepAttrs[A] = V;
   return *this;
 }
 
 AttrBuilder &AttrBuilder::removeAttribute(Attribute::AttrKind Val) {
   assert((unsigned)Val < Attribute::EndAttrKinds && "Attribute out of range!");
   Attrs[Val] = false;
 
   if (Val == Attribute::Alignment)
     Alignment = 0;
   else if (Val == Attribute::StackAlignment)
     StackAlignment = 0;
   else if (Val == Attribute::Dereferenceable)
     DerefBytes = 0;
   else if (Val == Attribute::DereferenceableOrNull)
     DerefOrNullBytes = 0;
+  else if (Val == Attribute::AllocSize) {
+    AllocSizeFn = nullptr;
+    AllocSizeArgNos.clear();
+  }
 
   return *this;
 }
 
 AttrBuilder &AttrBuilder::removeAttributes(AttributeSet A, uint64_t Index) {
   unsigned Slot = ~0U;
   for (unsigned I = 0, E = A.getNumSlots(); I != E; ++I)
     if (A.getSlotIndex(I) == Index) {
       Slot = I;
       break;
     }
 
   assert(Slot != ~0U && "Couldn't find index in AttributeSet!");
 
   for (AttributeSet::iterator I = A.begin(Slot), E = A.end(Slot); I != E; ++I) {
     Attribute Attr = *I;
-    if (Attr.isEnumAttribute() || Attr.isIntAttribute()) {
+    if (Attr.hasEnumKind()) {
       removeAttribute(Attr.getKindAsEnum());
     } else {
       assert(Attr.isStringAttribute() && "Invalid attribute type!");
       removeAttribute(Attr.getKindAsString());
     }
   }
 
   return *this;
 }
 
 AttrBuilder &AttrBuilder::removeAttribute(StringRef A) {
   std::map<std::string, std::string>::iterator I = TargetDepAttrs.find(A);
   if (I != TargetDepAttrs.end())
     TargetDepAttrs.erase(I);
   return *this;
 }
 
+Attribute::PseudoCall AttrBuilder::getAllocSizeArgs() const {
+  return {AllocSizeFn, AllocSizeArgNos};
+}
+
 AttrBuilder &AttrBuilder::addAlignmentAttr(unsigned Align) {
   if (Align == 0) return *this;
 
   assert(isPowerOf2_32(Align) && "Alignment must be a power of two.");
   assert(Align <= 0x40000000 && "Alignment too large.");
 
   Attrs[Attribute::Alignment] = true;
   Alignment = Align;
AttrBuilder &AttrBuilder::addDereferenceableOrNullAttr(uint64_t Bytes) {
   if (Bytes == 0)
     return *this;
 
   Attrs[Attribute::DereferenceableOrNull] = true;
   DerefOrNullBytes = Bytes;
   return *this;
 }
 
+AttrBuilder &
+AttrBuilder::addAllocSizeAttr(const Attribute::PseudoCall &Call) {
+  // (0, 0) is our "not present" value, so we need to check for it here.
+  assert(Call.Fn && "allocsize can't take null values");
+
+  Attrs[Attribute::AllocSize] = true;
+  AllocSizeFn = Call.Fn;
+  AllocSizeArgNos.clear();
+  AllocSizeArgNos.append(Call.Args.begin(), Call.Args.end());
+  return *this;
+}
+
+AttrBuilder &
+AttrBuilder::addAllocSizeAttrWithPlaceholder(Constant *Fn,
+                                             ArrayRef<unsigned> Args) {
+  assert(Fn && "allocsize can't take null values");
+
+  Attrs[Attribute::AllocSize] = true;
+  AllocSizeFn = Fn;
+  AllocSizeArgNos.clear();
+  AllocSizeArgNos.append(Args.begin(), Args.end());
+  return *this;
+}
+
 AttrBuilder &AttrBuilder::merge(const AttrBuilder &B) {
   // FIXME: What if both have alignments, but they don't match?!
   if (!Alignment)
     Alignment = B.Alignment;
 
   if (!StackAlignment)
     StackAlignment = B.StackAlignment;
 
   if (!DerefBytes)
     DerefBytes = B.DerefBytes;
 
   if (!DerefOrNullBytes)
     DerefOrNullBytes = B.DerefOrNullBytes;
 
+  if (!AllocSizeFn) {
+    AllocSizeFn = B.AllocSizeFn;
+    AllocSizeArgNos = B.AllocSizeArgNos;
+  }
+
   Attrs |= B.Attrs;
 
   for (auto I : B.td_attrs())
     TargetDepAttrs[I.first] = I.second;
 
   return *this;
 }
 
 AttrBuilder &AttrBuilder::remove(const AttrBuilder &B) {
   // FIXME: What if both have alignments, but they don't match?!
   if (B.Alignment)
     Alignment = 0;
 
   if (B.StackAlignment)
     StackAlignment = 0;
 
   if (B.DerefBytes)
     DerefBytes = 0;
 
   if (B.DerefOrNullBytes)
     DerefOrNullBytes = 0;
 
+  if (B.AllocSizeFn) {
+    AllocSizeFn = nullptr;
+    AllocSizeArgNos.clear();
+  }
+
   Attrs &= ~B.Attrs;
 
   for (auto I : B.td_attrs())
     TargetDepAttrs.erase(I.first);
 
   return *this;
 }
 
if (A.getSlotIndex(I) == Index) {
       Slot = I;
       break;
     }
 
   assert(Slot != ~0U && "Couldn't find the index!");
 
   for (AttributeSet::iterator I = A.begin(Slot), E = A.end(Slot); I != E; ++I) {
     Attribute Attr = *I;
-    if (Attr.isEnumAttribute() || Attr.isIntAttribute()) {
+    if (Attr.hasEnumKind()) {
       if (Attrs[I->getKindAsEnum()])
         return true;
     } else {
       assert(Attr.isStringAttribute() && "Invalid attribute kind!");
       return TargetDepAttrs.find(Attr.getKindAsString())!=TargetDepAttrs.end();
     }
   }
 

 AttrBuilder &AttrBuilder::addRawValue(uint64_t Val) {
   // FIXME: Remove this in 4.0.
   if (!Val) return *this;
 
   for (Attribute::AttrKind I = Attribute::None; I != Attribute::EndAttrKinds;
        I = Attribute::AttrKind(I + 1)) {
     if (I == Attribute::Dereferenceable ||
         I == Attribute::DereferenceableOrNull ||
-        I == Attribute::ArgMemOnly)
+        I == Attribute::ArgMemOnly ||
+        I == Attribute::AllocSize)
       continue;
     if (uint64_t A = (Val & AttributeImpl::getAttrMask(I))) {
       Attrs[I] = true;
  
       if (I == Attribute::Alignment)
         Alignment = 1ULL << ((A >> 16) - 1);
       else if (I == Attribute::StackAlignment)
         StackAlignment = 1ULL << ((A >> 26)-1);

lib/IR/LLVMContextImpl.h

public:
 
   typedef DenseMap<APFloat, ConstantFP *, DenseMapAPFloatKeyInfo> FPMapTy;
   FPMapTy FPConstants;
 
   FoldingSet<AttributeImpl> AttrsSet;
   FoldingSet<AttributeSetImpl> AttrsLists;
   FoldingSet<AttributeSetNode> AttrsSetNodes;
 
+  // Pseudo-call attributes that either had their functions deleted, or had
+  // their function changed such that they were identical to a preexisting
+  // pseudo-call attribute.
+  SmallVector<std::unique_ptr<PseudoCallAttributeImpl>, 8> DefunctAttrs;
+
   StringMap<MDString> MDStringCache;
   DenseMap<Value *, ValueAsMetadata *> ValuesAsMetadata;
   DenseMap<Metadata *, MetadataAsValue *> MetadataAsValues;
 
   DenseMap<const Value*, ValueName*> ValueNames;
 
 #define HANDLE_MDNODE_LEAF_UNIQUABLE(CLASS)                                    \
   DenseSet<CLASS *, CLASS##Info> CLASS##s;

lib/IR/Verifier.cpp

if (I->getKindAsEnum() == Attribute::NoReturn ||
         I->getKindAsEnum() == Attribute::NoBuiltin ||
         I->getKindAsEnum() == Attribute::Cold ||
         I->getKindAsEnum() == Attribute::OptimizeNone ||
         I->getKindAsEnum() == Attribute::JumpTable ||
         I->getKindAsEnum() == Attribute::Convergent ||
         I->getKindAsEnum() == Attribute::ArgMemOnly ||
         I->getKindAsEnum() == Attribute::NoRecurse ||
         I->getKindAsEnum() == Attribute::InaccessibleMemOnly ||
-        I->getKindAsEnum() == Attribute::InaccessibleMemOrArgMemOnly) {
+        I->getKindAsEnum() == Attribute::InaccessibleMemOrArgMemOnly ||
+        I->getKindAsEnum() == Attribute::AllocSize) {
       if (!isFunction) {
         CheckFailed("Attribute '" + I->getAsString() +
                     "' only applies to functions!", V);
         return;
       }
     } else if (I->getKindAsEnum() == Attribute::ReadOnly ||
                I->getKindAsEnum() == Attribute::ReadNone) {
       if (Idx == 0) {
void Verifier::VerifyFunctionAttrs(FunctionType *FT, AttributeSet Attrs,
   }
 
   if (Attrs.hasAttribute(AttributeSet::FunctionIndex,
                          Attribute::JumpTable)) {
     const GlobalValue *GV = cast<GlobalValue>(V);
     Assert(GV->hasUnnamedAddr(),
            "Attribute 'jumptable' requires 'unnamed_addr'", V);
   }
+
+  if (Attrs.hasAttribute(AttributeSet::FunctionIndex, Attribute::AllocSize)) {
+    Attribute::PseudoCall Call =
+        Attrs.getAllocSizeArgs(AttributeSet::FunctionIndex);
+
+    Assert(!Call.hasPlaceholderFunction(),
+           "Pseudo-calls must have actual Functions.");
+
+    Function *TargetFn = Call.mustGetCalledFunction();
+    FunctionType *TargetFT = TargetFn->getFunctionType();
+    auto *RetTy = dyn_cast<StructType>(TargetFT->getReturnType());
+    Assert(RetTy && RetTy->getNumElements() == 2 &&
+               RetTy->getElementType(0)->isIntegerTy() &&
+               RetTy->getElementType(1)->isIntegerTy(),
+           "Function used in allocsize should return a struct of two ints", V);
+
+    ArrayRef<Type *> TargetParams = TargetFT->params();
+    Assert(Call.Args.size() == TargetParams.size(),
+           "Mismatch between allocsize argument array length and allocsize "
+           "target arity",
+           V);
+
+    ArrayRef<Type *> BaseFnParams = FT->params();
+    for (unsigned I = 0, E = Call.Args.size(); I != E; ++I) {
+      unsigned ParamNo = Call.Args[I];
+      Assert(ParamNo < BaseFnParams.size(),
+             "Out of bounds allocsize parameter index", V);
+
+      Assert(BaseFnParams[ParamNo] == TargetParams[I],
+             Twine("Type of paramater #") + utostr(ParamNo) +
+                 " doesn't match type of allocsize target parameter #" +
+                 utostr(I),
+             V);
+    }
+
+    Assert(!TargetFn->isDeclaration(),
+           "Function used in allocsize must have a visible definition", V);
+  }
 }
 
 void Verifier::VerifyFunctionMetadata(
     const SmallVector<std::pair<unsigned, MDNode *>, 4> MDs) {
   if (MDs.empty())
     return;
 
   for (unsigned i = 0; i < MDs.size(); i++) {

test/Bitcode/allocsize.ll

+; RUN: llvm-as %s -o - | llvm-dis | FileCheck %s
+; RUN: verify-uselistorder < %s
+
+; CHECK: Function Attrs: allocsize({ i32, i32 } (i32, i32)* @_check_allocsize, [1, 2])
+; CHECK: declare void @test_allocsize
+declare void @test_allocsize(i8*, i32, i32) allocsize({i32, i32}(i32, i32)* @_check_allocsize, [1, 2])
+
+define {i32, i32} @_check_allocsize(i32, i32) {
+  ret {i32, i32} {i32 0, i32 0}
+}
+
[e-mail] = appending global [1 x i8*] [
+  i8* bitcast ({i32, i32}(i32, i32)* @_check_allocsize to i8*)
+]

test/Transforms/InstCombine/allocsize.ll

+; RUN: opt < %s -instcombine -S | FileCheck %s
+;
+; Test that instcombine folds allocsize function calls properly.
+; All allocation functions are assumed to return a block of memory N bytes
+; long. We expect that the returned pointer is 4 bytes into said block of
+; memory, to simulate an object header (or similar).
+
+declare i8* @my_malloc(i8*, i32) allocsize({i32, i32}(i32)* @malloc_compute, [1])
+
+declare i8* @my_calloc(i8*, i8*, i32, i32) allocsize(
+  {i32, i32}(i32, i32)* @calloc_compute, [2, 3])
+
+; Checking core functionality...
+
+; CHECK-LABEL: define void @test_malloc
+define void @test_malloc(i8** %p, i64* %r) {
+  %1 = call i8* @my_malloc(i8* null, i32 100)
+  store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false)
+  ; CHECK: store i64 96
+  store i64 %2, i64* %r, align 8
+
+  %3 = call i8* @my_malloc(i8* null, i32 -1)
+  store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize
+  %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false)
+  store i64 %4, i64* %r, align 8
+  ret void
+}
+
+; CHECK-LABEL: define void @test_calloc
+define void @test_calloc(i8** %p, i64* %r) {
+  %1 = call i8* @my_calloc(i8* null, i8* null, i32 100, i32 5)
+  store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false)
+  ; CHECK: store i64 496
+  store i64 %2, i64* %r, align 8
+
+  %3 = call i8* @my_calloc(i8* null, i8* null, i32 100, i32 -1)
+  store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize
+  %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false)
+  store i64 %4, i64* %r, align 8
+
+  %5 = call i8* @my_calloc(i8* null, i8* null, i32 -1, i32 100)
+  store i8* %5, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize
+  %6 = call i64 @llvm.objectsize.i64.p0i8(i8* %5, i1 false)
+  store i64 %6, i64* %r, align 8
+  ret void
+}
+
+declare i64 @llvm.objectsize.i64.p0i8(i8*, i1)
+
+define {i32, i32} @malloc_compute(i32 %i) {
+  %1 = insertvalue {i32, i32} {i32 0, i32 4}, i32 %i, 0
+  ret {i32, i32} %1
+}
+
+define {i32, i32} @calloc_compute(i32 %i, i32 %j) {
+  %1 = mul nsw i32 %i, %j
+  %2 = insertvalue {i32, i32} {i32 0, i32 4}, i32 %1, 0
+  ret {i32, i32} %2
+}
+
+; Failure cases with non-constant values...
+; CHECK-LABEL: define void @test_malloc_fails
+define void @test_malloc_fails(i8** %p, i64* %r, i32 %n) {
+  %1 = call i8* @my_malloc(i8* null, i32 %n)
+  store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize.i64.p0i8
+  %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false)
+  store i64 %2, i64* %r, align 8
+  ret void
+}
+
+; CHECK-LABEL: define void @test_calloc_fails
+define void @test_calloc_fails(i8** %p, i64* %r, i32 %n) {
+  %1 = call i8* @my_calloc(i8* null, i8* null, i32 %n, i32 5)
+  store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize.i64.p0i8
+  %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false)
+  store i64 %2, i64* %r, align 8
+
+  %3 = call i8* @my_calloc(i8* null, i8* null, i32 100, i32 %n)
+  store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize.i64.p0i8
+  %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false)
+  store i64 %4, i64* %r, align 8
+  ret void
+}
+
+declare i8* @my_malloc_outofline(i8*, i32) #0
+declare i8* @my_calloc_outofline(i8*, i8*, i32, i32) #1
+
+; Verifying that out of line allocsize is parsed correctly...
+
+; CHECK-LABEL: define void @test_outofline
+define void @test_outofline(i8** %p, i64* %r) {
+  %1 = call i8* @my_malloc_outofline(i8* null, i32 100)
+  store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false)
+  ; CHECK: store i64 96
+  store i64 %2, i64* %r, align 8
+
+  %3 = call i8* @my_calloc_outofline(i8* null, i8* null, i32 100, i32 5)
+  store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false)
+  ; CHECK: store i64 496
+  store i64 %4, i64* %r, align 8
+  ret void
+}
+
+; Edge cases, yay.
+
+declare i8* @malloc_constant(i8* %p) allocsize({i32, i32}()* @compute_constant)
+declare i8* @malloc_bad(i1 %badalign) allocsize(
+    {i32, i32}(i1)* @compute_bad_constant, [0])
+
+; CHECK-LABEL: define void @test_constant
+define void @test_constant(i8** %p, i64* %r) {
+  %1 = call i8* @malloc_constant(i8* null)
+  store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false)
+  ; CHECK: store i64 8
+  store i64 %2, i64* %r, align 8
+
+  %3 = call i8* @malloc_bad(i1 true)
+  store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize
+  %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false)
+  store i64 %4, i64* %r, align 8
+
+  %5 = call i8* @malloc_bad(i1 false)
+  store i8* %5, i8** %p, align 8 ; To ensure objectsize isn't killed
+
+  ; CHECK: @llvm.objectsize
+  %6 = call i64 @llvm.objectsize.i64.p0i8(i8* %5, i1 false)
+  store i64 %6, i64* %r, align 8
+  ret void
+}
+
+define {i32, i32} @compute_constant() { ret {i32, i32} {i32 16, i32 8} }
+
+define {i32, i32} @compute_bad_constant(i1 %badalign) {
+  %1 = select i1 %badalign, {i32, i32} {i32 4, i32 8}, {i32, i32} {i32 -4, i32 0}
+  ret {i32, i32} %1
+}
+
+; Test with arbitrary (foldable) pointers, as well.
+
+declare i8* @malloc_fold(i8* %p, i32 %n) allocsize(
+    {i32, i32}(i8*, i32)* @malloc_compute2, [0, 1])
+
+declare i8* @calloc_fold(i8* %p, i8* %u, i32 %n, i32 %m) allocsize(
+    {i32, i32}(i8*, i8*, i32, i32)* @calloc_compute2, [0, 1, 2, 3])
+
+; CHECK-LABEL: define void @test_malloc_calloc_fold
+define void @test_malloc_calloc_fold(i8** %p, i64* %r) {
+  %1 = call i8* @malloc_fold(i8* null, i32 32)
+  %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false)
+  store i64 %2, i64* %r, align 8
+
+  %3 = call i8* @calloc_fold(i8* null, i8* null, i32 8, i32 8)
+  store i8* %3, i8** %p, align 8
+  %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false)
+  ; CHECK: store i64 60
+  store i64 %4, i64* %r, align 8
+  ret void
+}
+
+attributes #0 = { allocsize({i32, i32}(i32)* @malloc_compute, [1]) }
+attributes #1 = { allocsize({i32, i32}(i32, i32)* @calloc_compute, [2, 3]) }
+
+; Manually inlined @malloc_compute because we don't run the inliner pass.
+define private {i32, i32} @malloc_compute2(i8* %_, i32 %i) unnamed_addr {
+  %1 = sub nsw i32 %i, 4
+  %2 = insertvalue {i32, i32} {i32 0, i32 4}, i32 %1, 0
+  ret {i32, i32} %2
+}
+
+; Manually inlined @calloc_compute because we don't run the inliner pass.
+define {i32, i32} @calloc_compute2(i8* %_, i8* %_2, i32 %i, i32 %j) {
+  %1 = mul nsw i32 %i, %j
+  %2 = insertvalue {i32, i32} {i32 0, i32 4}, i32 %1, 0
+  ret {i32, i32} %2
+}
+
[e-mail] = appending global [4 x i8*] [
+  i8* bitcast ({i32, i32}(i32)* @malloc_compute to i8*),
+  i8* bitcast ({i32, i32}(i32, i32)* @calloc_compute to i8*),
+  i8* bitcast ({i32, i32}(i8*, i32)* @malloc_compute2 to i8*),
+  i8* bitcast ({i32, i32}(i8*, i8*, i32, i32)* @calloc_compute2 to i8*)
+]

test/Verifier/alloc-size-failedparse.ll

+; RUN: not llvm-as %s -o /dev/null 2>&1 | FileCheck %s
+;
+; We handle allocsize with identical args in the parser, rather than the
+; verifier. So, a seperate test is needed.
+
+; CHECK: expected function
+declare i8* @a(i32, i32) allocsize(i32 0)

test/Verifier/allocsize.ll

+; RUN: not llvm-as %s -o /dev/null 2>&1 | FileCheck %s
+
+; CHECK: Function used in allocsize should return a struct of two ints
+declare i8* @a(i32) allocsize(i32(i32)* @bad_return1, [0])
+
+; CHECK: Function used in allocsize should return a struct of two ints
+declare i8* @b(i32) allocsize({i32, double}(i32)* @bad_return2, [0])
+
+; CHECK: Function used in allocsize should return a struct of two ints
+declare i8* @c(i32) allocsize({i32}(i32)* @bad_return3, [0])
+
+; CHECK: Function used in allocsize should return a struct of two ints
+declare i8* @d(i32) allocsize({i32, i32, i32}(i32)* @bad_return4, [0])
+
+; CHECK: Function used in allocsize must have a visible definition
+declare i8* @e(i32) allocsize({i32, i32}(i32)* @just_decl, [0])
+
+; CHECK: Mismatch between allocsize argument array length and allocsize target arity
+declare i8* @f(i32, i32) allocsize({i32, i32}(i32)* @good_return_1, [0, 1])
+
+; CHECK: Mismatch between allocsize argument array length and allocsize target arity
+declare i8* @g(i32) allocsize({i32, i32}(i32, i32)* @good_return_2, [0])
+
+; CHECK: Out of bounds allocsize parameter index
+declare i8* @h(i32) allocsize({i32, i32}(i32, i32)* @good_return_2, [0, 1])
+
+; CHECK: Out of bounds allocsize parameter index
+declare i8* @i(i32) allocsize({i32, i32}(i32, i32)* @good_return_2, [1, 0])
+
+; CHECK: Out of bounds allocsize parameter index
+declare i8* @j(i32, i32) allocsize({i32, i32}(i32)* @good_return_1, [2])
+
+; CHECK: Type of paramater #1 doesn't match type of allocsize target parameter #0
+declare i8* @k(i32, i8*) allocsize({i32, i32}(i32)* @good_return_1, [1])
+
+define {i32, i32} @good_return_1(i32) { ret {i32, i32} zeroinitializer }
+define {i32, i32} @good_return_2(i32, i32) { ret {i32, i32} zeroinitializer }
+
+define i32 @bad_return1(i32) { ret i32 zeroinitializer }
+define {i32, double} @bad_return2(i32) { ret {i32, double} zeroinitializer }
+define {i32} @bad_return3(i32) { ret {i32} zeroinitializer }
+define {i32, i32, i32} @bad_return4(i32) { ret {i32, i32, i32} zeroinitializer }
+
+declare {i32, i32} @just_decl(i32)