[FunctionAttrs] Added nonnull atribute to libc function args

[xbolva00]

Summary

This informs other passes that we can optimize e.g.:
int f(char *s) {

puts(s);
if (s == NULL)
        puts("was null");
return 99;

}

to:

int f(char *s) {

 puts(s);
return 99;

}

[xbolva00]

if @efriedma, @bkramer is OK with this approach, I will add some tests, etc.

For libc functions the approach seems right for me, but not sure about mem* intrinsics, if the IR builder is a good place where we should add the nonnull arg info.

Reviewers, please check the places where I added nonnull function arg attribute, I may missed something.

[xbolva00]

Calls which are not reordered in the IR -> transformation already works

int foo(void *s) {

memset(s, 0, 10);
if (!s) // eliminated
    abort();
return l;

}

int foo(char *s) {

int l = strlen(s);
if (!s)
    abort();
return l;

}

for strlen, we have IR:

; Function Attrs: nounwind
define dso_local i32 @foo(i8* readonly %s) local_unnamed_addr #0 {
entry:

%tobool = icmp eq i8* %s, null
br i1 %tobool, label %if.then, label %if.end

if.then: ; preds = %entry

tail call void @abort() #3
unreachable

if.end: ; preds = %entry

%call = tail call i32 @strlen(i8* %s) #4
ret i32 %call

}

; Function Attrs: argmemonly nounwind readonly
declare dso_local i32 @strlen(i8* nocapture nonnull) local_unnamed_addr #

Where should we work on above case? SCCP?

[efriedma]

I don't think we can reasonably do this for the functions which take a pointer+size pair; see http://lists.llvm.org/pipermail/cfe-dev/2017-January/052066.html etc. Maybe we can mark specific calls where we know the size is nonzero.

Not sure how this should interact with -fno-delete-null-pointer-checks; maybe we can make that work "correctly" by just doing all our nonnull marking on individual calls, even for the functions which take null-terminated strings.

[xbolva00]

lib/Transforms/Utils/BuildLibCalls.cpp

449 ↗

(On Diff #158174)

• 1 is correct

[xbolva00]

In D50039#1183214, @efriedma wrote:

I don't think we can reasonably do this for the functions which take a pointer+size pair; see http://lists.llvm.org/pipermail/cfe-dev/2017-January/052066.html etc. Maybe we can mark specific calls where we know the size is nonzero.

Not sure how this should interact with -fno-delete-null-pointer-checks; maybe we can make that work "correctly" by just doing all our nonnull marking on individual calls, even for the functions which take null-terminated strings.

so @rsmith 's list is what we want to follow for this type of transformation?

ISO C:

memcpy, memmove, memset, memcmp, memchr, memrchr
strncpy [param 1 only], strncat [param 1 only], strncmp

Extensions:

strndup, memccpy, mempcpy, strnlen, bcopy, bzero, bcmp, memfrob,
strncasecmp, strncasecmp_l [not parameter 4], stpncpy

Side note: GCC has no problem to optimize/remove condition (there is already ubsan checker for 0/null for mem* functions, or maybe is under development, I saw it somewhere)
int foo(void *p, int n) {

memset(p, 0, n);
if (!p)
    abort();
return 1;

}

[xbolva00]

int foo(void *p, int n) {

memset(p, 0, 0);
if (!p)
    abort();
return 1;

}
is not optimized by GCC.

Shouldn't we just do it like GCC? Do not optimize when explicit NULL or zero, otherwise be optimistic.

[efriedma]

Yes, that's the right list of functions. Like the discussion noted, we don't really want to match gcc's behavior here because it breaks legacy code for little practical benefit.

[xbolva00]

In D50039#1183401, @efriedma wrote:

Yes, that's the right list of functions. Like the discussion noted, we don't really want to match gcc's behavior here because it breaks legacy code for little practical benefit.

Okay. I will update this patch tomorrow.

[xbolva00]

• Updated the list of functions where we want to add this attribute
• Updated tests

[xbolva00]

• Small fix

[xbolva00]

• Rebased

[xbolva00]

ping :)

[xbolva00]

ping

[xbolva00]

Should I reduce this patch to just string functions for easier review?

[efriedma]

I'm still concerned that this doesn't really interact appropriately with -fno-delete-null-pointer-checks... specifically, the nonnull markings could cause unexpected optimizations. I mean, it's sort of dubious to use -fno-delete-null-pointer-checks without -ffreestanding anyway, given that many C library APIs special-case null, but we should still try to make it work as well as we can. I think we can solve that problem by changing how the nonnull markings are implemented: instead of marking the functions themselves as non-null, we should mark calls to those functions (as long as the calls are not in "null-pointer-is-valid" functions).

In terms of splitting the patch, yes, it probably makes sense to split into markings for char* pointers, and markings for other pointers.

lib/Transforms/Utils/BuildLibCalls.cpp

272 ↗

(On Diff #161212)

For sprintf, I think we can mark both 0 and 1.

[xbolva00]

Ok, makes sense. Just looking into FunctionAttrs, there is a FIXME comment for "EnableNonnullArgPropagation". If we carefully handle these nonnull arg attributes (e.g. avoid memcpy(d, s, 0) optimization), are there any reasons whyEnableNonnullArgPropagation should be still disabled?

[efriedma]

Off the top of my head, I think we fixed clang, so it should be okay... but please verify that the clang fix actually went in. And it should be a separate patch, of course.

[xbolva00]

Adding @spatel since he is the author of "EnableNonnullArgPropagation" (https://reviews.llvm.org/D27855)

[spatel]

In D50039#1247201, @xbolva00 wrote:

Adding @spatel since he is the author of "EnableNonnullArgPropagation" (https://reviews.llvm.org/D27855)

From what I can tell, the patch that was supposed to make the C functions safe and let us flip the setting of EnableNonnullArgPropagation is here:
D30806

It was approved, but it was never committed?

[xbolva00]

Since we are gonna mark args as nonull at the callsites, we can be more precisice since we know if "size" arg is constant and > 0.

e.g.
strncmp(d,s, 10) - we can mark "d", "s" as nonnull, right?

[efriedma]

strncmp(d,s, 10) - we can mark "d", "s" as nonnull, right?

Yes, sure.

[xbolva00]

I am trying to do this in functionattrs but problem is that the call was sunk to the successor before the functionattrs ran and in the functionattrs we just go thru instructionsof EntryBlock :/

[xbolva00]

• Reimplemented

[xbolva00]

@efriedma , please, can you look at it?

Tests will be added later after major design issues are addressed.

[xbolva00]

lib/Transforms/IPO/FunctionAttrs.cpp

636 ↗

(On Diff #169627)

As a possible follow up for FunctionAttrs, is there any interest to implement TODO comment (check for post-dominance, be unrestricted to just entry block)?

[xbolva00]

• Fixed strtok

[efriedma]

This doesn't look like the patch I was expecting.

Propogating nonnull like this probably makes sense, but this patch should be split into two parts. In the first part, you can extend SimplifyLibCalls to just call Call->addParamAttr(ArgNo, Attribute::NonNull) on calls to known library functions, or something like that. Then the second part does the inference from callee to caller; essentially this patch, but looking for nonnull attributes instead of specific libcalls.

[xbolva00]

Alright, definitely a better solution! Thanks, I will split it.

Then the second part does the inference from callee to caller; essentially this patch, but looking for nonnull attributes instead of specific libcalls.

But basically, this is what addArgumentAttrsFromCallsites does. So if I do this correctly in Simplifylibcalls, can I remove "EnableNonnullArgPropagation" flag which blocks the propagation to function args?

[efriedma]

I think we still need the clang patch to preemptively strip nonnull annotations from C library functions before we turn on EnableNonnullArgPropagation by default, to be safe. But yes, the right approach is to add the correct nonnull attributes, then enable nonnull propagation.

[xbolva00]

Thanks :)

What I would like to do as follow up is to turn FunctionAttrs to use dominators info.

[xbolva00]

InstCombine does something weird for me.

define dso_local i32 @fff6(i8* nocapture readonly %s) local_unnamed_addr #5 {
entry:

%call = tail call i64 @strlen(i8* %s) #8
%conv = trunc i64 %call to i32
ret i32 %conv

}

I add nonnull for strlen so... -> call i64 @strlen(i8* nonnull %s) but after -instcombine we have undef here (@spatel ?)
define dso_local i32 @fff6(i8* nocapture readonly %s) local_unnamed_addr #5 {
entry:

ret i32 undef

}

I will look more closely to visitCallSite...

[xbolva00]

• More marked functions

include/llvm/Transforms/Utils/SimplifyLibCalls.h

private:
   Value *optimizeStrLen(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrPBrk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrTo(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrSpn(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrCSpn(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrStr(CallInst *CI, IRBuilder<> &B);
   Value *optimizeMemChr(CallInst *CI, IRBuilder<> &B);
   Value *optimizeMemCmp(CallInst *CI, IRBuilder<> &B);
-  Value *optimizeMemCpy(CallInst *CI, IRBuilder<> &B);
-  Value *optimizeMemMove(CallInst *CI, IRBuilder<> &B);
-  Value *optimizeMemSet(CallInst *CI, IRBuilder<> &B);
+  Value *optimizeMemCpy(CallInst *CI, IRBuilder<> &B, bool isIntrinsic = false);
+  Value *optimizeMemMove(CallInst *CI, IRBuilder<> &B, bool isIntrinsic = false);
+  Value *optimizeMemSet(CallInst *CI, IRBuilder<> &B, bool isIntrinsic = false);
   Value *optimizeRealloc(CallInst *CI, IRBuilder<> &B);
   Value *optimizeWcslen(CallInst *CI, IRBuilder<> &B);
   // Wrapper for all String/Memory Library Call Optimizations
   Value *optimizeStringMemoryLibCall(CallInst *CI, IRBuilder<> &B);
 
   // Math Library Optimizations
   Value *optimizeCAbs(CallInst *CI, IRBuilder<> &B);
   Value *optimizePow(CallInst *CI, IRBuilder<> &B);

lib/Transforms/Utils/SimplifyLibCalls.cpp

if (!isDereferenceableAndAlignedPointer(Str, 1, APInt(64, Len), DL))
     return false;
 
   if (CI->getFunction()->hasFnAttribute(Attribute::SanitizeMemory))
     return false;
 
   return true;
 }
 
+static bool isPositiveSize(Value *Arg) {
+  return isa<ConstantInt>(Arg) && cast<ConstantInt>(Arg)->getZExtValue() > 0;
+}
+
+static bool setNonNullParam(CallInst *CI, unsigned ArgNo) {
+  Function *F = CI->getFunction();
+  if (!F || F->nullPointerIsDefined())
+    return false;
+
+  if (!CI->paramHasAttr(ArgNo, Attribute::NonNull)) {
+    CI->addParamAttr(ArgNo, Attribute::NonNull);
+    return true;
+  }
+  return false;
+}
+
 //===----------------------------------------------------------------------===//
 // String and Memory Library Call Optimizations
 //===----------------------------------------------------------------------===//
 
 Value *LibCallSimplifier::optimizeStrCat(CallInst *CI, IRBuilder<> &B) {
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
   // Extract some information from the instruction
   Value *Dst = CI->getArgOperand(0);
   Value *Src = CI->getArgOperand(1);
 
   // See if we can get the length of the input string.
   uint64_t Len = GetStringLength(Src);
   if (Len == 0)
     return nullptr;
Value *LibCallSimplifier::optimizeStrNCat(CallInst *CI, IRBuilder<> &B) {
   --SrcLen; // Unbias length.
 
   // Handle the simple, do-nothing cases:
   // strncat(x, "", c) -> x
   // strncat(x,  c, 0) -> x
   if (SrcLen == 0 || Len == 0)
     return Dst;
 
+  // Non-zero length case
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
+
   // We don't optimize this case.
   if (Len < SrcLen)
     return nullptr;
 
   // strncat(x, s, c) -> strcat(x, s)
   // s is constant so the strcat can be optimized further.
   return emitStrLenMemCpy(Src, Dst, SrcLen, B);
 }
Value *LibCallSimplifier::optimizeStrCmp(CallInst *CI, IRBuilder<> &B) {
   } else if (HasStr1 && !HasStr2) {
     if (canTransformToMemCmp(CI, Str2P, Len1, DL))
       return emitMemCmp(
           Str1P, Str2P,
           ConstantInt::get(DL.getIntPtrType(CI->getContext()), Len1), B, DL,
           TLI);
   }
 
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
+
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeStrNCmp(CallInst *CI, IRBuilder<> &B) {
   Value *Str1P = CI->getArgOperand(0), *Str2P = CI->getArgOperand(1);
   if (Str1P == Str2P) // strncmp(x,x,n)  -> 0
     return ConstantInt::get(CI->getType(), 0);
 
if (!HasStr1 && HasStr2) {
     Len1 = std::min(Len1, Length);
     if (canTransformToMemCmp(CI, Str2P, Len1, DL))
       return emitMemCmp(
           Str1P, Str2P,
           ConstantInt::get(DL.getIntPtrType(CI->getContext()), Len1), B, DL,
           TLI);
   }
 
+  // Non-zero length case
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
+
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeStrCpy(CallInst *CI, IRBuilder<> &B) {
   Value *Dst = CI->getArgOperand(0), *Src = CI->getArgOperand(1);
   if (Dst == Src) // strcpy(x,x)  -> x
     return Src;
 
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
+
   // See if we can get the length of the input string.
   uint64_t Len = GetStringLength(Src);
   if (Len == 0)
     return nullptr;
 
   // We have enough information to now generate the memcpy call to do the
   // copy for us.  Make a memcpy to copy the nul byte with align = 1.
   B.CreateMemCpy(Dst, 1, Src, 1,
Value *LibCallSimplifier::optimizeStrNCpy(CallInst *CI, IRBuilder<> &B) {
   if (ConstantInt *LengthArg = dyn_cast<ConstantInt>(LenOp))
     Len = LengthArg->getZExtValue();
   else
     return nullptr;
 
   if (Len == 0)
     return Dst; // strncpy(x, y, 0) -> x
 
+  // Non-zero length case
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
+
   // Let strncpy handle the zero padding
   if (Len > SrcLen + 1)
     return nullptr;
 
   Type *PT = Callee->getFunctionType()->getParamType(0);
   // strncpy(x, s, c) -> memcpy(align 1 x, align 1 s, c) [s and c are constant]
   B.CreateMemCpy(Dst, 1, Src, 1, ConstantInt::get(DL.getIntPtrType(PT), Len));
 
Value *LibCallSimplifier::optimizeStringLength(CallInst *CI, IRBuilder<> &B,
   // strlen(x) == 0 --> *x == 0
   if (isOnlyUsedInZeroEqualityComparison(CI))
     return B.CreateZExt(B.CreateLoad(Src, "strlenfirst"), CI->getType());
 
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeStrLen(CallInst *CI, IRBuilder<> &B) {
-  return optimizeStringLength(CI, B, 8);
+  if (Value *V = optimizeStringLength(CI, B, 8))
+    return V;
+
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  if (AttrChanged)
+    CI->dump();
+  if (AttrChanged)
+    return CI;
+  return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeWcslen(CallInst *CI, IRBuilder<> &B) {
   Module &M = *CI->getModule();
   unsigned WCharSize = TLI->getWCharSize(M) * 8;
   // We cannot perform this optimization without wchar_size metadata.
   if (WCharSize == 0)
     return nullptr;
if (HasStr1 && HasStr2) {
     return B.CreateBitCast(Result, CI->getType());
   }
 
   // fold strstr(x, "y") -> strchr(x, 'y').
   if (HasStr2 && ToFindStr.size() == 1) {
     Value *StrChr = emitStrChr(CI->getArgOperand(0), ToFindStr[0], B, TLI);
     return StrChr ? B.CreateBitCast(StrChr, CI->getType()) : nullptr;
   }
+
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeMemChr(CallInst *CI, IRBuilder<> &B) {
   Value *SrcStr = CI->getArgOperand(0);
   ConstantInt *CharC = dyn_cast<ConstantInt>(CI->getArgOperand(1));
   ConstantInt *LenC = dyn_cast<ConstantInt>(CI->getArgOperand(2));
 
if (getConstantStringInfo(LHS, LHSStr) &&
     int Cmp = memcmp(LHSStr.data(), RHSStr.data(), Len);
     if (Cmp < 0)
       Ret = -1;
     else if (Cmp > 0)
       Ret = 1;
     return ConstantInt::get(CI->getType(), Ret);
   }
 
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
+
+  return nullptr;
+}
+
+Value *LibCallSimplifier::optimizeMemCpy(CallInst *CI, IRBuilder<> &B,
+                                         bool isIntrinsic) {
+  if (isIntrinsic) {
+    if (!isPositiveSize(CI->getArgOperand(2)))
+      return nullptr;
+    bool AttrChanged = false;
+    AttrChanged |= setNonNullParam(CI, 0);
+    AttrChanged |= setNonNullParam(CI, 1);
+    if (AttrChanged)
+      return CI;
     return nullptr;
   }
 
-Value *LibCallSimplifier::optimizeMemCpy(CallInst *CI, IRBuilder<> &B) {
   // memcpy(x, y, n) -> llvm.memcpy(align 1 x, align 1 y, n)
   B.CreateMemCpy(CI->getArgOperand(0), 1, CI->getArgOperand(1), 1,
                  CI->getArgOperand(2));
   return CI->getArgOperand(0);
 }
 
-Value *LibCallSimplifier::optimizeMemMove(CallInst *CI, IRBuilder<> &B) {
+Value *LibCallSimplifier::optimizeMemMove(CallInst *CI, IRBuilder<> &B,
+                                          bool isIntrinsic) {
+  if (isIntrinsic) {
+    if (!isPositiveSize(CI->getArgOperand(2)))
+      return nullptr;
+    bool AttrChanged = false;
+    AttrChanged |= setNonNullParam(CI, 0);
+    AttrChanged |= setNonNullParam(CI, 1);
+    if (AttrChanged)
+      return CI;
+    return nullptr;
+  }
+
   // memmove(x, y, n) -> llvm.memmove(align 1 x, align 1 y, n)
   B.CreateMemMove(CI->getArgOperand(0), 1, CI->getArgOperand(1), 1,
                   CI->getArgOperand(2));
   return CI->getArgOperand(0);
 }
 
 /// Fold memset[_chk](malloc(n), 0, n) --> calloc(1, n).
 Value *LibCallSimplifier::foldMallocMemset(CallInst *Memset, IRBuilder<> &B) {
if (!Calloc)
     return nullptr;
 
   Malloc->replaceAllUsesWith(Calloc);
   eraseFromParent(Malloc);
 
   return Calloc;
 }
 
-Value *LibCallSimplifier::optimizeMemSet(CallInst *CI, IRBuilder<> &B) {
+Value *LibCallSimplifier::optimizeMemSet(CallInst *CI, IRBuilder<> &B,
+                                         bool isIntrinsic) {
+  if (isIntrinsic) {
+    if (!isPositiveSize(CI->getArgOperand(2)))
+      return nullptr;
+    bool AttrChanged = false;
+    AttrChanged |= setNonNullParam(CI, 0);
+    if (AttrChanged)
+      return CI;
+    return nullptr;
+  }
+
   if (auto *Calloc = foldMallocMemset(CI, B))
     return Calloc;
 
   // memset(p, v, n) -> llvm.memset(align 1 p, v, n)
   Value *Val = B.CreateIntCast(CI->getArgOperand(1), B.getInt8Ty(), false);
   B.CreateMemSet(CI->getArgOperand(0), Val, CI->getArgOperand(2), 1);
   return CI->getArgOperand(0);
 }
return B.CreateAnd(CI->getArgOperand(0),
                      ConstantInt::get(CI->getType(), 0x7F));
 }
 
 Value *LibCallSimplifier::optimizeAtoi(CallInst *CI, IRBuilder<> &B) {
   StringRef Str;
   if (!getConstantStringInfo(CI->getArgOperand(0), Str))
     return nullptr;
 
-  return convertStrToNumber(CI, Str, 10);
+  if (Value *V = convertStrToNumber(CI, Str, 10))
+    return V;
+
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  if (AttrChanged)
+    return CI;
+  return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeStrtol(CallInst *CI, IRBuilder<> &B) {
   StringRef Str;
   if (!getConstantStringInfo(CI->getArgOperand(0), Str))
     return nullptr;
 
   if (!isa<ConstantPointerNull>(CI->getArgOperand(1)))
     return nullptr;
 
-  if (ConstantInt *CInt = dyn_cast<ConstantInt>(CI->getArgOperand(2))) {
-    return convertStrToNumber(CI, Str, CInt->getSExtValue());
-  }
+  if (ConstantInt *CInt = dyn_cast<ConstantInt>(CI->getArgOperand(2)))
+    if (Value *V = convertStrToNumber(CI, Str, CInt->getSExtValue()))
+      return V;
 
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  if (AttrChanged)
+    return CI;
   return nullptr;
 }
 
 //===----------------------------------------------------------------------===//
 // Formatting and IO Library Call Optimizations
 //===----------------------------------------------------------------------===//
 
 static bool isReportingError(Function *Callee, CallInst *CI, int StreamArg);
if (TLI->has(LibFunc_iprintf) && !callHasFloatingPointArgument(CI)) {
     Module *M = B.GetInsertBlock()->getParent()->getParent();
     Constant *IPrintFFn =
         M->getOrInsertFunction("iprintf", FT, Callee->getAttributes());
     CallInst *New = cast<CallInst>(CI->clone());
     New->setCalledFunction(IPrintFFn);
     B.Insert(New);
     return New;
   }
+
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  if (AttrChanged)
+    return CI;
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeSPrintFString(CallInst *CI, IRBuilder<> &B) {
   // Check for a fixed format string.
   StringRef FormatStr;
   if (!getConstantStringInfo(CI->getArgOperand(1), FormatStr))
     return nullptr;
if (TLI->has(LibFunc_siprintf) && !callHasFloatingPointArgument(CI)) {
     Module *M = B.GetInsertBlock()->getParent()->getParent();
     Constant *SIPrintFFn =
         M->getOrInsertFunction("siprintf", FT, Callee->getAttributes());
     CallInst *New = cast<CallInst>(CI->clone());
     New->setCalledFunction(SIPrintFFn);
     B.Insert(New);
     return New;
   }
+
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  AttrChanged |= setNonNullParam(CI, 1);
+  if (AttrChanged)
+    return CI;
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeSnPrintFString(CallInst *CI, IRBuilder<> &B) {
   // Check for a fixed format string.
   StringRef FormatStr;
   if (!getConstantStringInfo(CI->getArgOperand(2), FormatStr))
     return nullptr;
Value *LibCallSimplifier::optimizeSnPrintFString(CallInst *CI, IRBuilder<> &B) {
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeSnPrintF(CallInst *CI, IRBuilder<> &B) {
   if (Value *V = optimizeSnPrintFString(CI, B)) {
     return V;
   }
 
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 2);
+  if (AttrChanged)
+    return CI;
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeFPrintFString(CallInst *CI, IRBuilder<> &B) {
   optimizeErrorReporting(CI, B, 0);
 
   // All the optimizations depend on the format string.
   StringRef FormatStr;
Value *LibCallSimplifier::optimizePuts(CallInst *CI, IRBuilder<> &B) {
   if (Str.empty() && CI->use_empty()) {
     // puts("") -> putchar('\n')
     Value *Res = emitPutChar(B.getInt32('\n'), B, TLI);
     if (CI->use_empty() || !Res)
       return Res;
     return B.CreateIntCast(Res, CI->getType(), true);
   }
 
+  bool AttrChanged = false;
+  AttrChanged |= setNonNullParam(CI, 0);
+  if (AttrChanged)
+    return CI;
   return nullptr;
 }
 
 bool LibCallSimplifier::hasFloatVersion(StringRef FuncName) {
   LibFunc Func;
   SmallString<20> FloatFuncName = FuncName;
   FloatFuncName += 'f';
   if (TLI->getLibFunc(FloatFuncName, Func))
case Intrinsic::pow:
       return optimizePow(CI, Builder);
     case Intrinsic::exp2:
       return optimizeExp2(CI, Builder);
     case Intrinsic::log:
       return optimizeLog(CI, Builder);
     case Intrinsic::sqrt:
       return optimizeSqrt(CI, Builder);
     // TODO: Use foldMallocMemset() with memset intrinsic.
+    case Intrinsic::memset:
+      return optimizeMemSet(CI, Builder, true);
+    case Intrinsic::memcpy:
+      return optimizeMemCpy(CI, Builder, true);
+    case Intrinsic::memmove:
+      return optimizeMemMove(CI, Builder, true);
     default:
       return nullptr;
     }
   }
 
   // Also try to simplify calls to fortified library functions.
   if (Value *SimplifiedFortifiedCI = FortifiedSimplifier.optimizeCall(CI)) {
     // Try to further simplify the result.