Basic support for posix_memalign / __builtin_object_size interaction

[serge-sans-paille]

Summary

It actually implements support for seeing through loads, using alias analysis to
refine the result.

This is rather limited, but I didn't want to rely on more than available analysis at that point (to be gentle with compilation time), and it does seem to catch some common scenario, as showcased by the included tests.

[xbolva00]

llvm/lib/Analysis/MemoryBuiltins.cpp

156

why remove? no record above for posix_memalign was added..

[nikic]

This is pretty unusual in terms of approach, it would be more typical to do a limited upward walk to find the clobbering store (a la FindAvailableLoadedValue).

llvm/lib/Analysis/MemoryBuiltins.cpp

839

What about the case where the object size is taken prior to initialization? In the alloca case it will be an undef initialization -- is it fine to simply ignore that case? I'd probably expect min at least to return zero for that.

Probably more obviously problematic is the noalias case, because that one doesn't make any statement on the initial contents of the memory. For a typical allocator that will be either undef or null, but this is not a requirement of noalias (an obvious violation is strdup).

901

I don't get what this check is supposed to do. You're asking here whether an escaping pointer and an escape-source alias, for which the answer should always be "yes" for the SimpleCaptureInfo-based AA used here. Can you give an example where this check does something useful?

[nikic]

llvm/lib/Analysis/MemoryBuiltins.cpp

905

To double check, does this work when a non-pointer type is stored? You might want to add a test that stores an i32 or so into a bitcasted pointer.

[serge-sans-paille]

Following @nikic suggestion, use a CFG-based graph transversal à la FindAvailableLoadedValue

[serge-sans-paille]

Added test case for simple load interactions.

[serge-sans-paille]

Take into account posix_memalign return value, as suggested by @nikic

[xbolva00]

llvm/lib/Analysis/MemoryBuiltins.cpp

156

Still no answer

891

Do you need FakeCond at all?

llvm::isImpliedByDomCondition (CmpInst::Predicate Pred, const Value *LHS, const Value *RHS, const Instruction *ContextI, const DataLayout &DL)

[serge-sans-paille]

llvm/lib/Analysis/MemoryBuiltins.cpp

156

Yup, sorry: because it's API is so different (and unique ?) from other library functions. It doesn't fit any of the existing MallocFamily nor AllocType.

891

Indeed!

[nikic]

llvm/include/llvm/Analysis/MemoryBuiltins.h

179

Make it an optional parameter instead?

llvm/lib/Analysis/MemoryBuiltins.cpp

586

Can assign unconditionally.

820

With the getUniquePredecessor() variant noted before this wouldn't matter, but if you do explore branching cases, then I'm not sure returning unknown here makes sense. Consider a simple store; if (...) { ... } else { ... } load; case. The upwards walk would hit the store along one path first and then along the other again and return unknown at that pointer.

823

This should probably only be counted once on the top level?

828

We should be checking against a budget here, to avoid scanning 150k instructions in search of a matching store...

835

Use getPointerOperand() here.

Also probably need to check SI->getValueOperand()->getType()->isPointerTy(), unless compute() handles non-pointer values gracefully.

840

This should be checking aliasing with Load.getPointerOperand(), *not* &Load itself.

887

bos -> the load

908

Should queue on a worklist rather than recursing. For the posix_memalign use-case, it might make sense to just restrict to getUniquePredecessor(), as we probably don't care about branching cases there?

[serge-sans-paille]

take @nikic remarks into account.

llvm/include/llvm/Analysis/MemoryBuiltins.h

179

That's a choice: I wanted to keep it grouped with TLI so that all analyse are kept next to each other.

llvm/lib/Analysis/MemoryBuiltins.cpp

823

This is used to count the "Number of load instructions with unsolved size and offset", thus the detailed counting.

835

I *think* this is already guarenteed by the fact that we match against the load pointer operand, which is of type T**

[nikic]

llvm/lib/Analysis/MemoryBuiltins.cpp

820

I think this limit is still overly large -- I think our usual value starting value for limits like this is 32. If you think that's too low to be practically useful, I'd go with 128 here.

823

Right, but currently you're incrementing this once per unknown predecessor, rather than once per load, no?

835

This isn't guaranteed with opaque pointers -- but also for the more general MustAlias case below, which will strip pointer casts.

837

Should have a if(I.isDebugInst()) continue check here, to make sure debug insts can't affect optimization. (Before the limit check.)

846

Just wondering if it might be better to just bail entirely from the load-handling code if we don't have AA, rather than having extra code to support both? I don't particularly mind, but given how we essentially only care about the one lowerObjectSizeCall() usage that does have AA, this may not be particularly useful. We'd have to add some tests for a different caller that goes through these non-AA codepaths.

859

nit: getValueOperand()

871

Second part of this comment is now outdated :)

889

nit: Load.getPointerOperand()

923

As a small optimization, we could short-circuit on unknown here.

[serge-sans-paille]

Another review round trip.

[nikic]

LGTM

llvm/lib/Analysis/MemoryBuiltins.cpp

898

Should be Unknown().

llvm/test/Transforms/LowerConstantIntrinsics/builtin-object-size-load.ll

3

We should pass in the AA parameter in LowerConstantIntrinsics to avoid the need for -instcombine here, but we can do that separately...

llvm/include/llvm/Analysis/MemoryBuiltins.h

 #include "llvm/IR/InstVisitor.h"
 #include "llvm/IR/ValueHandle.h"
 #include <cstdint>
 #include <utility>
 
 namespace llvm {
 
 class AllocaInst;
+class AAResults;
 class Argument;
 class CallInst;
 class ConstantPointerNull;
 class DataLayout;
 class ExtractElementInst;
 class ExtractValueInst;
 class GEPOperator;
 class GlobalAlias;
struct ObjectSizeOpts {
   Mode EvalMode = Mode::Exact;
   /// Whether to round the result up to the alignment of allocas, byval
   /// arguments, and global variables.
   bool RoundToAlign = false;
   /// If this is true, null pointers in address space 0 will be treated as
   /// though they can't be evaluated. Otherwise, null is always considered to
   /// point to a 0 byte region of memory.
   bool NullIsUnknownSize = false;
+  /// If set, used for more accurate evaluation
+  AAResults *AA = nullptr;
 };
 
 /// Compute the size of the object pointed by Ptr. Returns true and the
 /// object size in Size if successful, and false otherwise. In this context, by
 /// object we mean the region of memory starting at Ptr to the end of the
 /// underlying object pointed to by Ptr.
 ///
 /// WARNING: The object size returned is the allocation size.  This does not
 /// imply dereferenceability at site of use since the object may be freeed in
 /// between.
 bool getObjectSize(const Value *Ptr, uint64_t &Size, const DataLayout &DL,
                    const TargetLibraryInfo *TLI, ObjectSizeOpts Opts = {});
 
 /// Try to turn a call to \@llvm.objectsize into an integer value of the given
 /// Type. Returns null on failure. If MustSucceed is true, this function will
 /// not return null, and may return conservative values governed by the second
 /// argument of the call to objectsize.
 Value *lowerObjectSizeCall(IntrinsicInst *ObjectSize, const DataLayout &DL,
                            const TargetLibraryInfo *TLI, bool MustSucceed);
-
-
+Value *lowerObjectSizeCall(IntrinsicInst *ObjectSize, const DataLayout &DL,
+                           const TargetLibraryInfo *TLI, AAResults *AA,
+                           bool MustSucceed);
 
 using SizeOffsetType = std::pair<APInt, APInt>;
 
 /// Evaluate the size and offset of an object pointed to by a Value*
 /// statically. Fails if size or offset are not known at compile time.
 class ObjectSizeOffsetVisitor
   : public InstVisitor<ObjectSizeOffsetVisitor, SizeOffsetType> {
   const DataLayout &DL;
public:
   SizeOffsetType visitIntToPtrInst(IntToPtrInst&);
   SizeOffsetType visitLoadInst(LoadInst &I);
   SizeOffsetType visitPHINode(PHINode&);
   SizeOffsetType visitSelectInst(SelectInst &I);
   SizeOffsetType visitUndefValue(UndefValue&);
   SizeOffsetType visitInstruction(Instruction &I);
 
 private:
+  SizeOffsetType findLoadSizeOffset(
+      LoadInst &LoadFrom, BasicBlock &BB, BasicBlock::iterator From,
+      SmallDenseMap<BasicBlock *, SizeOffsetType, 8> &VisitedBlocks,
+      unsigned &ScannedInstCount);
   SizeOffsetType combineSizeOffset(SizeOffsetType LHS, SizeOffsetType RHS);
   SizeOffsetType computeImpl(Value *V);
   bool CheckedZextOrTrunc(APInt &I);
 };
 
 using SizeOffsetEvalType = std::pair<Value *, Value *>;
 
 /// Evaluate the size and offset of an object pointed to by a Value*.

llvm/lib/Analysis/MemoryBuiltins.cpp

 //===----------------------------------------------------------------------===//
 
 #include "llvm/Analysis/MemoryBuiltins.h"
 #include "llvm/ADT/APInt.h"
 #include "llvm/ADT/None.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/Statistic.h"
+#include "llvm/Analysis/AliasAnalysis.h"
 #include "llvm/Analysis/TargetFolder.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Analysis/Utils/Local.h"
 #include "llvm/Analysis/ValueTracking.h"
 #include "llvm/IR/Argument.h"
 #include "llvm/IR/Attributes.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DataLayout.h"
static const std::pair<LibFunc, AllocFnsTy> AllocationFnData[] = {
     {LibFunc_realloc,                           {ReallocLike,      2,  1, -1, -1, MallocFamily::Malloc}},
     {LibFunc_vec_realloc,                       {ReallocLike,      2,  1, -1, -1, MallocFamily::VecMalloc}},
     {LibFunc_reallocf,                          {ReallocLike,      2,  1, -1, -1, MallocFamily::Malloc}},
     {LibFunc_strdup,                            {StrDupLike,       1, -1, -1, -1, MallocFamily::Malloc}},
     {LibFunc_dunder_strdup,                     {StrDupLike,       1, -1, -1, -1, MallocFamily::Malloc}},
     {LibFunc_strndup,                           {StrDupLike,       2,  1, -1, -1, MallocFamily::Malloc}},
     {LibFunc_dunder_strndup,                    {StrDupLike,       2,  1, -1, -1, MallocFamily::Malloc}},
     {LibFunc___kmpc_alloc_shared,               {MallocLike,       1,  0, -1, -1, MallocFamily::KmpcAllocShared}},
-    // TODO: Handle "int posix_memalign(void **, size_t, size_t)"
 };
 // clang-format on
 
 static const Function *getCalledFunction(const Value *V,
                                          bool &IsNoBuiltin) {
   // Don't care about intrinsics in this case.
   if (isa<IntrinsicInst>(V))
     return nullptr;
bool llvm::getObjectSize(const Value *Ptr, uint64_t &Size, const DataLayout &DL,
   Size = getSizeWithOverflow(Data).getZExtValue();
   return true;
 }
 
 Value *llvm::lowerObjectSizeCall(IntrinsicInst *ObjectSize,
                                  const DataLayout &DL,
                                  const TargetLibraryInfo *TLI,
                                  bool MustSucceed) {
+  return lowerObjectSizeCall(ObjectSize, DL, TLI, /*AAResults=*/nullptr,
+                             MustSucceed);
+}
+
+Value *llvm::lowerObjectSizeCall(IntrinsicInst *ObjectSize,
+                                 const DataLayout &DL,
+                                 const TargetLibraryInfo *TLI, AAResults *AA,
+                                 bool MustSucceed) {
   assert(ObjectSize->getIntrinsicID() == Intrinsic::objectsize &&
          "ObjectSize must be a call to llvm.objectsize!");
 
   bool MaxVal = cast<ConstantInt>(ObjectSize->getArgOperand(1))->isZero();
   ObjectSizeOpts EvalOptions;
+  EvalOptions.AA = AA;
+
   // Unless we have to fold this to something, try to be as accurate as
   // possible.
   if (MustSucceed)
     EvalOptions.EvalMode =
         MaxVal ? ObjectSizeOpts::Mode::Max : ObjectSizeOpts::Mode::Min;
   else
     EvalOptions.EvalMode = ObjectSizeOpts::Mode::Exact;
 
SizeOffsetType ObjectSizeOffsetVisitor::visitGlobalVariable(GlobalVariable &GV){
   return std::make_pair(align(Size, GV.getAlign()), Zero);
 }
 
 SizeOffsetType ObjectSizeOffsetVisitor::visitIntToPtrInst(IntToPtrInst&) {
   // clueless
   return unknown();
 }
 
-SizeOffsetType ObjectSizeOffsetVisitor::visitLoadInst(LoadInst&) {
+SizeOffsetType ObjectSizeOffsetVisitor::findLoadSizeOffset(
+    LoadInst &Load, BasicBlock &BB, BasicBlock::iterator From,
+    SmallDenseMap<BasicBlock *, SizeOffsetType, 8> &VisitedBlocks,
+    unsigned &ScannedInstCount) {
+  constexpr unsigned MaxInstsToScan = 128;
+
+  auto Where = VisitedBlocks.find(&BB);
+  if (Where != VisitedBlocks.end())
+    return Where->second;
+
+  auto Unknown = [this, &BB, &VisitedBlocks]() {
+    return VisitedBlocks[&BB] = unknown();
+  };
+  auto Known = [this, &BB, &VisitedBlocks](SizeOffsetType SO) {
+    return VisitedBlocks[&BB] = SO;
+  };
+
+  do {
+    Instruction &I = *From;
+
+    if (I.isDebugOrPseudoInst())
+      continue;
+
+    if (++ScannedInstCount > MaxInstsToScan)
+      return Unknown();
+
+    if (!I.mayWriteToMemory())
+      continue;
+
+    if (auto *SI = dyn_cast<StoreInst>(&I)) {
+      AliasResult AR =
+          Options.AA->alias(SI->getPointerOperand(), Load.getPointerOperand());
+      switch ((AliasResult::Kind)AR) {
+      case AliasResult::NoAlias:
+        continue;
+      case AliasResult::MustAlias:
+        if (SI->getValueOperand()->getType()->isPointerTy())
+          return Known(compute(SI->getValueOperand()));
+        else
+          return Unknown(); // No handling of non-pointer values by `compute`.
+      default:
+        return Unknown();
+      }
+    }
+
+    if (auto *CB = dyn_cast<CallBase>(&I)) {
+      Function *Callee = CB->getCalledFunction();
+      // Bail out on indirect call.
+      if (!Callee)
+        return Unknown();
+
+      LibFunc TLIFn;
+      if (!TLI || !TLI->getLibFunc(*CB->getCalledFunction(), TLIFn) ||
+          !TLI->has(TLIFn))
+        return Unknown();
+
+      // TODO: There's probably more interesting case to support here.
+      if (TLIFn != LibFunc_posix_memalign)
+        return Unknown();
+
+      AliasResult AR =
+          Options.AA->alias(CB->getOperand(0), Load.getPointerOperand());
+      switch ((AliasResult::Kind)AR) {
+      case AliasResult::NoAlias:
+        continue;
+      case AliasResult::MustAlias:
+        break;
+      default:
+        return Unknown();
+      }
+
+      // Is the error status of posix_memalign correctly checked? If not it
+      // would be incorrect to assume it succeeds and load doesn't see the
+      // previous value.
+      Optional<bool> Checked = isImpliedByDomCondition(
+          ICmpInst::ICMP_EQ, CB, ConstantInt::get(CB->getType(), 0), &Load, DL);
+      if (!Checked || !*Checked)
+        return Unknown();
+
+      Value *Size = CB->getOperand(2);
+      auto *C = dyn_cast<ConstantInt>(Size);
+      if (!C)
+        return Unknown();
+
+      return Known({C->getValue(), APInt(C->getValue().getBitWidth(), 0)});
+    }
+
+    return Unknown();
+  } while (From-- != BB.begin());
+
+  SmallVector<SizeOffsetType> PredecessorSizeOffsets;
+  for (auto *PredBB : predecessors(&BB)) {
+    PredecessorSizeOffsets.push_back(findLoadSizeOffset(
+        Load, *PredBB, BasicBlock::iterator(PredBB->getTerminator()),
+        VisitedBlocks, ScannedInstCount));
+    if (!bothKnown(PredecessorSizeOffsets.back()))
+      return Unknown();
+  }
+
+  if (PredecessorSizeOffsets.empty())
+    return Unknown();
+
+  return Known(std::accumulate(PredecessorSizeOffsets.begin() + 1,
+                               PredecessorSizeOffsets.end(),
+                               PredecessorSizeOffsets.front(),
+                               [this](SizeOffsetType LHS, SizeOffsetType RHS) {
+                                 return combineSizeOffset(LHS, RHS);
+                               }));
+}
+
+SizeOffsetType ObjectSizeOffsetVisitor::visitLoadInst(LoadInst &LI) {
+  if (!Options.AA) {
     ++ObjectVisitorLoad;
     return unknown();
   }
 
+  SmallDenseMap<BasicBlock *, SizeOffsetType, 8> VisitedBlocks;
+  unsigned ScannedInstCount = 0;
+  SizeOffsetType SO =
+      findLoadSizeOffset(LI, *LI.getParent(), BasicBlock::iterator(LI),
+                         VisitedBlocks, ScannedInstCount);
+  if (!bothKnown(SO))
+    ++ObjectVisitorLoad;
+  return SO;
+}
+
 SizeOffsetType ObjectSizeOffsetVisitor::combineSizeOffset(SizeOffsetType LHS,
                                                           SizeOffsetType RHS) {
   if (!bothKnown(LHS) || !bothKnown(RHS))
     return unknown();
 
   switch (Options.EvalMode) {
   case ObjectSizeOpts::Mode::Min:
     return (getSizeWithOverflow(LHS).slt(getSizeWithOverflow(RHS))) ? LHS : RHS;
ObjectSizeOffsetEvaluator::visitGEPOperator(GEPOperator &GEP) {
   return std::make_pair(PtrData.first, Offset);
 }
 
 SizeOffsetEvalType ObjectSizeOffsetEvaluator::visitIntToPtrInst(IntToPtrInst&) {
   // clueless
   return unknown();
 }
 
-SizeOffsetEvalType ObjectSizeOffsetEvaluator::visitLoadInst(LoadInst&) {
+SizeOffsetEvalType ObjectSizeOffsetEvaluator::visitLoadInst(LoadInst &LI) {
   return unknown();
 }
 
 SizeOffsetEvalType ObjectSizeOffsetEvaluator::visitPHINode(PHINode &PHI) {
   // Create 2 PHIs: one for size and another for offset.
   PHINode *SizePHI   = Builder.CreatePHI(IntTy, PHI.getNumIncomingValues());
   PHINode *OffsetPHI = Builder.CreatePHI(IntTy, PHI.getNumIncomingValues());
 

llvm/lib/Transforms/InstCombine/InstCombineCalls.cpp

Instruction *InstCombinerImpl::visitCallInst(CallInst &CI) {
   if (II->isCommutative()) {
     if (CallInst *NewCall = canonicalizeConstantArg0ToArg1(CI))
       return NewCall;
   }
 
   Intrinsic::ID IID = II->getIntrinsicID();
   switch (IID) {
   case Intrinsic::objectsize:
-    if (Value *V = lowerObjectSizeCall(II, DL, &TLI, /*MustSucceed=*/false))
+    if (Value *V = lowerObjectSizeCall(II, DL, &TLI, AA, /*MustSucceed=*/false))
       return replaceInstUsesWith(CI, V);
     return nullptr;
   case Intrinsic::abs: {
     Value *IIOperand = II->getArgOperand(0);
     bool IntMinIsPoison = cast<Constant>(II->getArgOperand(1))->isOneValue();
 
     // abs(-x) -> abs(x)
     // TODO: Copy nsw if it was present on the neg?

llvm/lib/Transforms/InstCombine/InstructionCombining.cpp

for (unsigned i = 0, e = Users.size(); i != e; ++i) {
       if (!Users[i])
        continue;
 
       Instruction *I = cast<Instruction>(&*Users[i]);
 
       if (IntrinsicInst *II = dyn_cast<IntrinsicInst>(I)) {
         if (II->getIntrinsicID() == Intrinsic::objectsize) {
           Value *Result =
-              lowerObjectSizeCall(II, DL, &TLI, /*MustSucceed=*/true);
+              lowerObjectSizeCall(II, DL, &TLI, AA, /*MustSucceed=*/true);
           replaceInstUsesWith(*I, Result);
           eraseInstFromFunction(*I);
           Users[i] = nullptr; // Skip examining in the next loop.
         }
       }
     }
     for (unsigned i = 0, e = Users.size(); i != e; ++i) {
       if (!Users[i])

llvm/test/Transforms/LowerConstantIntrinsics/builtin-object-size-load.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt --instcombine -lower-constant-intrinsics -S < %s | FileCheck %s
+
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare i64 @llvm.objectsize.i64.p0i8(i8*, i1 immarg, i1 immarg, i1 immarg)
+
+
+define dso_local i64 @check_store_load(i1 %cond) local_unnamed_addr {
+; CHECK-LABEL: @check_store_load(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[PTR01:%.*]] = alloca [10 x i8], align 1
+; CHECK-NEXT:    br i1 [[COND:%.*]], label [[IF_THEN:%.*]], label [[IF_END:%.*]]
+; CHECK:       if.then:
+; CHECK-NEXT:    [[PTR01_SUB:%.*]] = getelementptr inbounds [10 x i8], [10 x i8]* [[PTR01]], i64 0, i64 0
+; CHECK-NEXT:    br label [[RETURN:%.*]]
+; CHECK:       if.end:
+; CHECK-NEXT:    [[PTR12:%.*]] = alloca [12 x i8], align 1
+; CHECK-NEXT:    [[PTR12_SUB:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[PTR12]], i64 0, i64 0
+; CHECK-NEXT:    br label [[RETURN]]
+; CHECK:       return:
+; CHECK-NEXT:    [[STOREMERGE:%.*]] = phi i8* [ [[PTR12_SUB]], [[IF_END]] ], [ [[PTR01_SUB]], [[IF_THEN]] ]
+; CHECK-NEXT:    ret i64 12
+;
+entry:
+  %holder = alloca i8*
+  %ptr0 = alloca i8, i64 10
+  br i1 %cond, label %if.then, label %if.end
+
+if.then:
+  store i8* %ptr0, i8** %holder
+  br label %return
+
+if.end:
+  %ptr1 = alloca i8, i64 12
+  store i8* %ptr1, i8** %holder
+  br label %return
+
+return:
+  %held = load i8*, i8** %holder
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %held, i1 false, i1 true, i1 false)
+  ret i64 %objsize
+
+}

llvm/test/Transforms/LowerConstantIntrinsics/builtin-object-size-posix-memalign.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt --instcombine -lower-constant-intrinsics -S < %s | FileCheck %s
+
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare dso_local i32 @posix_memalign(i8** noundef, i64 noundef, i64 noundef)
+declare i64 @llvm.objectsize.i64.p0i8(i8*, i1 immarg, i1 immarg, i1 immarg)
+
+; Check posix_memalign call with proper handlig of return value
+define dso_local i64 @check_posix_memalign(i32 noundef %n) local_unnamed_addr {
+; CHECK-LABEL: @check_posix_memalign(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[OBJ:%.*]] = alloca i8*, align 8
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @posix_memalign(i8** noundef nonnull [[OBJ]], i64 noundef 8, i64 noundef 10)
+; CHECK-NEXT:    [[TOBOOL_NOT:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    br i1 [[TOBOOL_NOT]], label [[COND_FALSE:%.*]], label [[EXIT:%.*]]
+; CHECK:       cond.false:
+; CHECK-NEXT:    br label [[EXIT]]
+; CHECK:       exit:
+; CHECK-NEXT:    [[COND:%.*]] = phi i64 [ -2, [[ENTRY:%.*]] ], [ 10, [[COND_FALSE]] ]
+; CHECK-NEXT:    ret i64 [[COND]]
+;
+entry:
+  %obj = alloca i8*
+  %call = call i32 @posix_memalign(i8** noundef %obj, i64 noundef 8, i64 noundef 10)
+  %tobool = icmp ne i32 %call, 0
+  br i1 %tobool, label %exit, label %cond.false
+
+cond.false:
+  %val = load i8*, i8** %obj
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %val, i1 false, i1 true, i1 false)
+  br label %exit
+
+exit:
+  %cond = phi i64 [ -2, %entry ], [ %objsize, %cond.false ]
+  ret i64 %cond
+
+}
+
+
+; Same test case as above but with idiomatic NULL initialization
+define dso_local i64 @check_posix_memalign_null() {
+; CHECK-LABEL: @check_posix_memalign_null(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[OBJ:%.*]] = alloca i8*, align 8
+; CHECK-NEXT:    store i8* null, i8** [[OBJ]], align 8
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @posix_memalign(i8** noundef nonnull [[OBJ]], i64 noundef 8, i64 noundef 10)
+; CHECK-NEXT:    [[TOBOOL_NOT:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    br i1 [[TOBOOL_NOT]], label [[COND_FALSE:%.*]], label [[EXIT:%.*]]
+; CHECK:       cond.false:
+; CHECK-NEXT:    br label [[EXIT]]
+; CHECK:       exit:
+; CHECK-NEXT:    [[COND:%.*]] = phi i64 [ -2, [[ENTRY:%.*]] ], [ 10, [[COND_FALSE]] ]
+; CHECK-NEXT:    ret i64 [[COND]]
+;
+entry:
+  %obj = alloca i8*
+  store i8* null, i8** %obj
+  %call = call i32 @posix_memalign(i8** noundef %obj, i64 noundef 8, i64 noundef 10)
+  %tobool = icmp ne i32 %call, 0
+  br i1 %tobool, label %exit, label %cond.false
+
+cond.false:
+  %val = load i8*, i8** %obj
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %val, i1 false, i1 true, i1 false)
+  br label %exit
+
+exit:
+  %cond = phi i64 [ -2, %entry ], [ %objsize, %cond.false ]
+  ret i64 %cond
+}
+
+; Using argument storage instead of local storage for the allocated pointer.
+define dso_local i64 @check_posix_memalign_arg(i8** noalias noundef %obj) {
+; CHECK-LABEL: @check_posix_memalign_arg(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @posix_memalign(i8** noundef [[OBJ:%.*]], i64 noundef 8, i64 noundef 10)
+; CHECK-NEXT:    [[TOBOOL_NOT:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    br i1 [[TOBOOL_NOT]], label [[COND_FALSE:%.*]], label [[EXIT:%.*]]
+; CHECK:       cond.false:
+; CHECK-NEXT:    br label [[EXIT]]
+; CHECK:       exit:
+; CHECK-NEXT:    [[COND:%.*]] = phi i64 [ -2, [[ENTRY:%.*]] ], [ 10, [[COND_FALSE]] ]
+; CHECK-NEXT:    ret i64 [[COND]]
+;
+entry:
+  %call = call i32 @posix_memalign(i8** noundef %obj, i64 noundef 8, i64 noundef 10)
+  %tobool = icmp ne i32 %call, 0
+  br i1 %tobool, label %exit, label %cond.false
+
+cond.false:
+  %val = load i8*, i8** %obj
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %val, i1 false, i1 true, i1 false)
+  br label %exit
+
+exit:
+  %cond = phi i64 [ -2, %entry ], [ %objsize, %cond.false ]
+  ret i64 %cond
+
+}
+
+; posix_memalign can fail, in that case no object_size can be guessed.
+define dso_local i64 @check_posix_memalign_unchecked() {
+; CHECK-LABEL: @check_posix_memalign_unchecked(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[OBJ:%.*]] = alloca i8*, align 8
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @posix_memalign(i8** noundef nonnull [[OBJ]], i64 noundef 8, i64 noundef 10)
+; CHECK-NEXT:    [[VAL:%.*]] = load i8*, i8** [[OBJ]], align 8
+; CHECK-NEXT:    ret i64 -1
+;
+entry:
+  %obj = alloca i8*
+  %call = call i32 @posix_memalign(i8** noundef %obj, i64 noundef 8, i64 noundef 10)
+  %val = load i8*, i8** %obj
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %val, i1 false, i1 true, i1 false)
+  ret i64 %objsize
+}
+
+; Checks that bo upon posix_memalign failure behaves correctly
+define dso_local i64 @check_posix_memalign_inverted_cond() {
+; CHECK-LABEL: @check_posix_memalign_inverted_cond(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[OBJ:%.*]] = alloca i8*, align 8
+; CHECK-NEXT:    store i8* null, i8** [[OBJ]], align 8
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @posix_memalign(i8** noundef nonnull [[OBJ]], i64 noundef 8, i64 noundef 10)
+; CHECK-NEXT:    [[TOBOOL:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    br i1 [[TOBOOL]], label [[EXIT:%.*]], label [[COND_FALSE:%.*]]
+; CHECK:       cond.false:
+; CHECK-NEXT:    [[VAL:%.*]] = load i8*, i8** [[OBJ]], align 8
+; CHECK-NEXT:    br label [[EXIT]]
+; CHECK:       exit:
+; CHECK-NEXT:    [[COND:%.*]] = phi i64 [ -2, [[ENTRY:%.*]] ], [ -1, [[COND_FALSE]] ]
+; CHECK-NEXT:    ret i64 [[COND]]
+;
+entry:
+  %obj = alloca i8*
+  store i8* null, i8** %obj
+  %call = call i32 @posix_memalign(i8** noundef %obj, i64 noundef 8, i64 noundef 10)
+  %tobool = icmp eq i32 %call, 0
+  br i1 %tobool, label %exit, label %cond.false
+
+cond.false:
+  %val = load i8*, i8** %obj
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %val, i1 false, i1 true, i1 false)
+  br label %exit
+
+exit:
+  %cond = phi i64 [ -2, %entry ], [ %objsize, %cond.false ]
+  ret i64 %cond
+}
+
+; Check posix_memalign call with a runtime condition check
+define dso_local i64 @check_posix_memalign_runtime_cond(i32 noundef %n) local_unnamed_addr {
+; CHECK-LABEL: @check_posix_memalign_runtime_cond(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[OBJ:%.*]] = alloca i8*, align 8
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @posix_memalign(i8** noundef nonnull [[OBJ]], i64 noundef 8, i64 noundef 10)
+; CHECK-NEXT:    [[TOBOOL_NOT:%.*]] = icmp eq i32 [[CALL]], [[N:%.*]]
+; CHECK-NEXT:    br i1 [[TOBOOL_NOT]], label [[COND_FALSE:%.*]], label [[EXIT:%.*]]
+; CHECK:       cond.false:
+; CHECK-NEXT:    [[VAL:%.*]] = load i8*, i8** [[OBJ]], align 8
+; CHECK-NEXT:    br label [[EXIT]]
+; CHECK:       exit:
+; CHECK-NEXT:    [[COND:%.*]] = phi i64 [ -2, [[ENTRY:%.*]] ], [ -1, [[COND_FALSE]] ]
+; CHECK-NEXT:    ret i64 [[COND]]
+;
+entry:
+  %obj = alloca i8*
+  %call = call i32 @posix_memalign(i8** noundef %obj, i64 noundef 8, i64 noundef 10)
+  %tobool = icmp ne i32 %call, %n
+  br i1 %tobool, label %exit, label %cond.false
+
+cond.false:
+  %val = load i8*, i8** %obj
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %val, i1 false, i1 true, i1 false)
+  br label %exit
+
+exit:
+  %cond = phi i64 [ -2, %entry ], [ %objsize, %cond.false ]
+  ret i64 %cond
+
+}
+
+; Check posix_memalign call with two different paths leading to the same alloc.
+define dso_local i64 @check_posix_memalign_diamond() local_unnamed_addr {
+; CHECK-LABEL: @check_posix_memalign_diamond(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[OBJ:%.*]] = alloca i8*, align 8
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @posix_memalign(i8** noundef nonnull [[OBJ]], i64 noundef 8, i64 noundef 10)
+; CHECK-NEXT:    [[TOBOOL_NOT:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    br i1 [[TOBOOL_NOT]], label [[COND_FALSE:%.*]], label [[COND_TRUE:%.*]]
+; CHECK:       cond.true:
+; CHECK-NEXT:    br label [[EXIT:%.*]]
+; CHECK:       cond.false:
+; CHECK-NEXT:    br label [[EXIT]]
+; CHECK:       exit:
+; CHECK-NEXT:    [[COND:%.*]] = phi i64 [ -2, [[COND_TRUE]] ], [ 10, [[COND_FALSE]] ]
+; CHECK-NEXT:    ret i64 [[COND]]
+;
+entry:
+  %obj = alloca i8*
+  %call = call i32 @posix_memalign(i8** noundef %obj, i64 noundef 8, i64 noundef 10)
+  %tobool = icmp ne i32 %call, 0
+  br i1 %tobool, label %cond.true, label %cond.false
+
+cond.true:
+  br label %exit
+
+cond.false:
+  %val = load i8*, i8** %obj
+  %objsize = call i64 @llvm.objectsize.i64.p0i8(i8* %val, i1 false, i1 true, i1 false)
+  br label %exit
+
+exit:
+  %cond = phi i64 [ -2, %cond.true ], [ %objsize, %cond.false ]
+  ret i64 %cond
+
+}