[InstCombine] Transform str(n)cmp to memcmp

[xbolva00]

Summary

Motivation examples:
int strcmp_memcmp() {

char buf[12];
return strcmp(buf, "key") == 0;

}

int strcmp_memcmp2() {

char buf[12];
return strcmp(buf, "key") != 0;

}

int strncmp_memcmp() {

char buf[12];
return strncmp(buf, "key", 3) == 0;

}

can be turned to memcmp.

See test file for more cases.

[xbolva00]

• More negative tests

[xbolva00]

• removed useless parameter

[xbolva00]

• Added tests to check if the result of strcmp calls is used more than once

Tests ok now? May I precommit them?

[efriedma]

Please fix the tests so they don't strcmp against uninitialized memory. Probably the simplest way to do that is use an argument instead of an alloca.

lib/Transforms/Utils/SimplifyLibCalls.cpp

156

Not sure why this check is relevant; memcmp should return the same value as strcmp.

165

I don't see how this proves anything... just because you have a pointer of type [N x i8] * doesn't imply it's actually backed by N bytes of dereferenceable memory. Please just use llvm::isDereferenceableAndAlignedPointer.

[xbolva00]

lib/Transforms/Utils/SimplifyLibCalls.cpp

156

\0 in the middle of string?
https://stackoverflow.com/questions/13095513/what-is-the-difference-between-memcmp-strcmp-and-strncmp-in-c

I think the check is probably right here..

165

Ok, thanks

[efriedma]

lib/Transforms/Utils/SimplifyLibCalls.cpp

156

I'm not sure what you mean... as far as I can tell, strcmp and memcmp should return the same result even if the non-constant string has an embedded null. Can you give an example? (I'm interpreting "same" here loosely to mean the same zero-ness and same sign bit.)

[xbolva00]

• Use isDereferenceableAndAlignedPointer

[xbolva00]

Updated.

Transformation works but I was unable to make it working with tests as you requested (as an argument). Not sure what is wrong, I had tried to put align info but nothing worked.

lib/Transforms/Utils/SimplifyLibCalls.cpp

156

Yeah, sign bit is same, but values are not. So need to check only if it is only used in condition

[xbolva00]

lib/Transforms/Utils/SimplifyLibCalls.cpp

156

Oh no. strcmp(...) < -10 could be true, but memcmp(...) < - 10 is false.

[xbolva00]

test/Transforms/InstCombine/strcmp-memcmp.ll

11

Not sure what breaks transformation with this test file, i tried [12 x i8]* align 1 %buf, but it did not worked.

Any advice? Otherwise, this transformation works with aligned alloca.

[efriedma]

I think you need to add something like "dereferenceable(4)" or "byval" to the parameter. so it's recognized as dereferenceable.

Please get rid of the lifetime.start/end intrinsics in the test.

lib/Transforms/Utils/SimplifyLibCalls.cpp

156

The C standard doesn't specify a specific return value; we don't have to return exactly the same value libc strcmp would return anyway, I think? Haven't really thought through the implications of that. It's okay to leave it for now.

[xbolva00]

lib/Transforms/Utils/SimplifyLibCalls.cpp

156

But if rhs is zero, yes, we can lift that restriction for ne/eq only.

[xbolva00]

• Added/fixed tests
• Allow any comparision with zero

Tests should be ok now, I will wait ~1 day and I will precommit them.

[xbolva00]

• Fixed logic
• Some new tests

[xbolva00]

• Rebased

[efriedma]

lib/Transforms/Utils/SimplifyLibCalls.cpp

410

std::min.

[xbolva00]

• Use std::min

[xbolva00]

In D50233#1190726, @xbolva00 wrote:

• Use std::min

Ok now?

[efriedma]

LGTM

[eugenis]

There are concerns about this optimization expressed in

https://github.com/google/sanitizers/issues/993

Specifically, it can transform

strcmp("abc\0...undef...undef...", "foobar")

into a similar memcmp() which would observe uninitialized data at the end of the first string.

I'm not a 100% sure that it is undefined behavior because there are no indeterminate values in the code at all, and memcmp() as a standard library function does not have to follow the same rules (technically). @rsmith But it upsets MemorySanitizer, and for a good reason IMHO.

This optimization should be either limited to functions w/o sanitize_memory attribute, or disabled completely.

[xbolva00]

See https://godbolt.org/z/o9CEYv
So GCC should also upset MemorySanitizer here, no?

limited to functions w/o sanitize_memory attribute

Sounds OK for me, let's hear other folks.

Edit: Seems GCC does not do this opt if memory sanitizer is on.

[eugenis]

GCC does not have MemorySanitizer.

[efriedma]

"which would observe uninitialized data at the end of the first string"

The uninitialized data isn't a problem for any implementation of memcmp that doesn't involve LTO: a cross-translation-unit call effectively freezes all unintialized data. But I guess we can't really guarantee that reliably unless we introduce an llvm.memcmp intrinsic.

In theory there's also a potential race condition with this transform, if the memcmp implementation loads from the buffer multiple times and the "uninitialized" data is written by another thread. We can maybe work around this; haven't thought through what check would be necessary.

We can solve both problems, I think, if we don't actually call the libc memcmp; we can emit an inline implementation that avoids those issues, I think. At least when msan is disabled.

If this is blocking you, you can revert for now, and we'll rework this.

[xbolva00]

In D50233#1223654, @eugenis wrote:

GCC does not have MemorySanitizer.

Ah, I was trying it with address sanitizer, sorry.

[adamreichold]

limited to functions w/o sanitize_memory attribute

Sounds OK for me, let's hear other folks.

Edit: Seems GCC does not do this opt if memory sanitizer is on.

Just for my understanding of this: If I do that replacement by hand, I am reading uninitialized memory and all bets are of. The compiler however can do this behind the scenes since my program will not be able to observe the indeterminate state (since I am looking only at == 0 of the return value of strcmp).

Does LLVM's implementation somehow guarantee that no later optimization pass comes along, sees the program reading uninitialized memory and declares UB?

[efriedma]

Does LLVM's implementation somehow guarantee that no later optimization pass comes along, sees the program reading uninitialized memory and declares UB?

In LLVM IR, reading uninitialized memory isn't itself UB; it's only UB if you perform certain operations on the result. Granted, a naive LLVM IR implementation of memcmp might involve operations which lead to UB.

[adamreichold]

In D50233#1223683, @efriedma wrote:

Does LLVM's implementation somehow guarantee that no later optimization pass comes along, sees the program reading uninitialized memory and declares UB?

In LLVM IR, reading uninitialized memory isn't itself UB; it's only UB if you perform certain operations on the result. Granted, a naive LLVM IR implementation of memcmp might involve operations which lead to UB.

But that also implies that you have to emit an inline implementation since you might not control what the implementation of memcmp supplied by libc does?

[xbolva00]

In D50233#1223686, @adamreichold wrote:

In D50233#1223683, @efriedma wrote:

Does LLVM's implementation somehow guarantee that no later optimization pass comes along, sees the program reading uninitialized memory and declares UB?

In LLVM IR, reading uninitialized memory isn't itself UB; it's only UB if you perform certain operations on the result. Granted, a naive LLVM IR implementation of memcmp might involve operations which lead to UB.

But that also implies that you have to emit an inline implementation since you might not control what the implementation of memcmp supplied by libc does?

LLVM already expands memcmp if possible, as we can see https://godbolt.org/z/o9CEYv (vs. https://godbolt.org/z/D8RhVl)

[adamreichold]

In D50233#1223691, @xbolva00 wrote:

In D50233#1223686, @adamreichold wrote:

But that also implies that you have to emit an inline implementation since you might not control what the implementation of memcmp supplied by libc does?

LLVM already expands memcmp if possible, as we can see https://godbolt.org/z/o9CEYv (vs. https://godbolt.org/z/D8RhVl)

From what I understand this is done as an optimization on a best-effort basis whereas in this case it is a precondition for the soundness of this particular optimization.

[efriedma]

But that also implies that you have to emit an inline implementation since you might not control what the implementation of memcmp supplied by libc does?

Assuming there isn't a data race, the libc implementation of memcmp can't actually do anything undefined. In assembly, "uninitialized" data always has some fixed value.

---

Given the problems here, we probably want to move this transform to the ExpandMemCmp pass, and only transform when we'll expand the compare inline.

[xbolva00]

In D50233#1223705, @efriedma wrote:

But that also implies that you have to emit an inline implementation since you might not control what the implementation of memcmp supplied by libc does?

Assuming there isn't a data race, the libc implementation of memcmp can't actually do anything undefined. In assembly, "uninitialized" data always has some fixed value.

---

Given the problems here, we probably want to move this transform to the ExpandMemCmp pass, and only transform when we'll expand the compare inline.

Cannot we just check the conditions of expansion https://github.com/llvm-mirror/llvm/blob/master/lib/CodeGen/ExpandMemCmp.cpp#L678 and apply it here? We basically miss check for optForSize. So if this transformation passes, memcmp will be expanded too.

Do we guarantee the correctness of programs if a custom opt pipeline is used (eg. disabled ExpandMemCmp, enabled InstCombine pass)?

[adamreichold]

In D50233#1223705, @efriedma wrote:

But that also implies that you have to emit an inline implementation since you might not control what the implementation of memcmp supplied by libc does?

Assuming there isn't a data race, the libc implementation of memcmp can't actually do anything undefined. In assembly, "uninitialized" data always has some fixed value.

Sorry for going off into the land of imagined libc implementations here, but for example it could update a thread local variable whenever it reads a byte and my program could then read this variable and hence observe the value of the uninitialized memory. I know this a useless and contrived way to implement memcmp, I just think this shows that if one calls an external function that is not guaranteed to be free of side-effects, those side-effects could be reflected back into the current translation unit. And while even this would probably not be a UB problem, since the compiler will by construction not know that I process undefined values when I access that thread local variable and hence will not call out UB on me, this could even become a correctness issue if I make assumptions about this variable's value when the strcmp succeeds.

[efriedma]

for example it could update a thread local variable whenever it reads a byte and my program could then read this variable and hence observe the value of the uninitialized memory

We assume memcmp has the semantics described in the C standard unless you specify -fno-builtin or something; otherwise, we couldn't transform it at all.

Do we guarantee the correctness of programs if a custom opt pipeline is used (eg. disabled ExpandMemCmp, enabled InstCombine pass)?

We try to, yes... and even if we didn't, I'd be worried about it getting out of sync.

[xbolva00]

So what is proposed solution?

1, bail out if sanitize memory attribute
2, check for opt for size (as in expandMemcmp)
3, move this instcombine transformation into expandmemcmp pass

[efriedma]

If it were just msan, I would say we could just check for the msan attribute and call it done. But I'm a little worried about the potential race and potential weird interactions with LTO. So probably best to both bailout if msan is enabled, and move the transform to expandmemcmp.

lib/Transforms/Utils/SimplifyLibCalls.cpp

 #include "llvm/ADT/StringMap.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/Analysis/ConstantFolding.h"
 #include "llvm/Analysis/OptimizationRemarkEmitter.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Analysis/ValueTracking.h"
 #include "llvm/Analysis/CaptureTracking.h"
+#include "llvm/Analysis/Loads.h"
 #include "llvm/IR/DataLayout.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/IRBuilder.h"
 #include "llvm/IR/IntrinsicInst.h"
 #include "llvm/IR/Intrinsics.h"
 #include "llvm/IR/LLVMContext.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/PatternMatch.h"
static bool isLocallyOpenedFile(Value *File, CallInst *CI, IRBuilder<> &B,
 
   inferLibFuncAttributes(*CI->getCalledFunction(), *TLI);
   if (PointerMayBeCaptured(File, true, true))
     return false;
 
   return true;
 }
 
+static bool isOnlyUsedInComparisonWithZero(Value *V) {
+  for (User *U : V->users()) {
+    if (ICmpInst *IC = dyn_cast<ICmpInst>(U))
+      if (Constant *C = dyn_cast<Constant>(IC->getOperand(1)))
+        if (C->isNullValue())
+          continue;
+    // Unknown instruction.
+    return false;
+  }
+  return true;
+}
+
+static bool canTransformToMemCmp(CallInst *CI, Value *Str, uint64_t Len,
+                                 const DataLayout &DL) {
+  if (!isOnlyUsedInComparisonWithZero(CI))
+    return false;
+
+  if (!isDereferenceableAndAlignedPointer(Str, 1, APInt(64, Len), DL))
+    return false;
+    
+  return true;
+}
+
 //===----------------------------------------------------------------------===//
 // String and Memory Library Call Optimizations
 //===----------------------------------------------------------------------===//
 
 Value *LibCallSimplifier::optimizeStrCat(CallInst *CI, IRBuilder<> &B) {
   // Extract some information from the instruction
   Value *Dst = CI->getArgOperand(0);
   Value *Src = CI->getArgOperand(1);
Value *LibCallSimplifier::optimizeStrCmp(CallInst *CI, IRBuilder<> &B) {
   uint64_t Len2 = GetStringLength(Str2P);
   if (Len1 && Len2) {
     return emitMemCmp(Str1P, Str2P,
                       ConstantInt::get(DL.getIntPtrType(CI->getContext()),
                                        std::min(Len1, Len2)),
                       B, DL, TLI);
   }
 
+  // strcmp to memcmp
+  uint64_t Len = 0;
+  if (!HasStr1 && !HasStr2) {
+    return nullptr;
+  } else if (!HasStr1 && HasStr2) {
+    Len = Len2;
+  } else if (HasStr1 && !HasStr2) {
+    std::swap(Str1P, Str2P);
+    Len = Len1;
+  }
+
+  if (canTransformToMemCmp(CI, Str1P, Len, DL))
+    return emitMemCmp(Str1P, Str2P,
+                      ConstantInt::get(DL.getIntPtrType(CI->getContext()), Len),
+                      B, DL, TLI);
+
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeStrNCmp(CallInst *CI, IRBuilder<> &B) {
   Value *Str1P = CI->getArgOperand(0), *Str2P = CI->getArgOperand(1);
   if (Str1P == Str2P) // strncmp(x,x,n)  -> 0
     return ConstantInt::get(CI->getType(), 0);
 
Value *LibCallSimplifier::optimizeStrNCmp(CallInst *CI, IRBuilder<> &B) {
 
   if (HasStr1 && Str1.empty()) // strncmp("", x, n) -> -*x
     return B.CreateNeg(
         B.CreateZExt(B.CreateLoad(Str2P, "strcmpload"), CI->getType()));
 
   if (HasStr2 && Str2.empty()) // strncmp(x, "", n) -> *x
     return B.CreateZExt(B.CreateLoad(Str1P, "strcmpload"), CI->getType());
 
+  // strncmp to memcmp
+  if (!HasStr1 && !HasStr2) {
+    return nullptr;
+  } else if (HasStr1 && !HasStr2) {
+    std::swap(Str1P, Str2P);
+  }
+
+  if (canTransformToMemCmp(CI, Str1P, Length, DL))
+    return emitMemCmp(Str1P, Str2P, CI->getArgOperand(2), B, DL, TLI);
+
   return nullptr;
 }
 
 Value *LibCallSimplifier::optimizeStrCpy(CallInst *CI, IRBuilder<> &B) {
   Value *Dst = CI->getArgOperand(0), *Src = CI->getArgOperand(1);
   if (Dst == Src) // strcpy(x,x)  -> x
     return Src;
 

test/Transforms/InstCombine/strcmp-memcmp.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt < %s -instcombine -S | FileCheck %s
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+
+@key = constant [4 x i8] c"key\00", align 1
+
+declare void @use(i32)
+
+define i32 @strcmp_memcmp([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+
+  ret i32 %conv
+}
+
+declare i32 @strcmp(i8* nocapture, i8* nocapture)
+
+define i32 @strcmp_memcmp2([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp2(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+
+  %call = call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp3([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp3(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp ne i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  %cmp = icmp ne i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp4([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp4(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp ne i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string)
+  %cmp = icmp ne i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp5([5 x i8]* dereferenceable (5) %buf) {
+; CHECK-LABEL: @strcmp_memcmp5(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [5 x i8], [5 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [5 x i8], [5 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull align 1 %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp6([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp6(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp sgt i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  %cmp = icmp sgt i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp7([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp7(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[MEMCMP_LOBIT:%.*]] = lshr i32 [[MEMCMP]], 31
+; CHECK-NEXT:    ret i32 [[MEMCMP_LOBIT]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string)
+  %cmp = icmp slt i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp8([4 x i8]* dereferenceable (4) %buf) {
+; CHECK-LABEL: @strcmp_memcmp8(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [4 x i8], [4 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [4 x i8], [4 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 2)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 2)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+declare i32 @strncmp(i8* nocapture, i8* nocapture, i64)
+
+define i32 @strncmp_memcmp2([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp2(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 11)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp ne i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 11)
+  %cmp = icmp ne i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp3([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp3(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 11)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 11)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp4([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp4(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 5)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 5)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp5([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp5(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 5)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 5)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+
+define i32 @strncmp_memcmp6([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp6(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 5)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp ne i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 5)
+  %cmp = icmp ne i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp7([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp7(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 4)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp8([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp8(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 3)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 3)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp9([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp9(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 5)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp sgt i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 5)
+  %cmp = icmp sgt i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp10([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp10(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 5)
+; CHECK-NEXT:    [[MEMCMP_LOBIT:%.*]] = lshr i32 [[MEMCMP]], 31
+; CHECK-NEXT:    ret i32 [[MEMCMP_LOBIT]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 5)
+  %cmp = icmp slt i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp11([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp11(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 12)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 12)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp12([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp12(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[MEMCMP:%.*]] = call i32 @memcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 12)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[MEMCMP]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 12)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+; Negative tests
+define i32 @strcmp_memcmp_bad([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp_bad(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+; CHECK-NEXT:    [[CMP:%.*]] = icmp sgt i32 [[CALL]], 3
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  %cmp = icmp sgt i32 %call, 3
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp_bad2([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp_bad2(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull [[STRING]])
+; CHECK-NEXT:    [[CMP:%.*]] = icmp slt i32 [[CALL]], 3
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string)
+  %cmp = icmp slt i32 %call, 3
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp_bad3([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strcmp_memcmp_bad3(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+; CHECK-NEXT:    ret i32 [[CALL]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  ret i32 %call
+}
+
+
+define i32 @strcmp_memcmp_bad4(i8* nocapture readonly %buf) {
+; CHECK-LABEL: @strcmp_memcmp_bad4(
+; CHECK-NEXT:    [[CALL:%.*]] = tail call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* [[BUF:%.*]])
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %call = tail call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* %buf)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+
+define i32 @strcmp_memcmp_bad5([3 x i8]* dereferenceable (3) %buf) {
+; CHECK-LABEL: @strcmp_memcmp_bad5(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [3 x i8], [3 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [3 x i8], [3 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp_bad6([4 x i8]* dereferenceable (4) %buf, i8* nocapture readonly %k) {
+; CHECK-LABEL: @strcmp_memcmp_bad6(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [4 x i8], [4 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strcmp(i8* nonnull [[STRING]], i8* [[K:%.*]])
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [4 x i8], [4 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* %k)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp_bad7(i8* nocapture readonly %k) {
+; CHECK-LABEL: @strcmp_memcmp_bad7(
+; CHECK-NEXT:    [[CALL:%.*]] = tail call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* [[K:%.*]])
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %call = tail call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* %k)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strcmp_memcmp_bad8([4 x i8]* dereferenceable (4) %buf) {
+; CHECK-LABEL: @strcmp_memcmp_bad8(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [4 x i8], [4 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strcmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+; CHECK-NEXT:    tail call void @use(i32 [[CALL]])
+; CHECK-NEXT:    ret i32 0
+;
+  %string = getelementptr inbounds [4 x i8], [4 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strcmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0))
+  tail call void @use(i32 %call)
+  ret i32 0
+}
+
+define i32 @strncmp_memcmp_bad([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp_bad(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull [[STRING]], i64 5)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp sgt i32 [[CALL]], 3
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 5)
+  %cmp = icmp sgt i32 %call, 3
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+
+define i32 @strncmp_memcmp_bad1([12 x i8]* dereferenceable (12) %buf) {
+; CHECK-LABEL: @strncmp_memcmp_bad1(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull [[STRING]], i64 5)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp slt i32 [[CALL]], 3
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 5)
+  %cmp = icmp slt i32 %call, 3
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp_bad2([12 x i8]* dereferenceable (12) %buf, i64 %n) {
+; CHECK-LABEL: @strncmp_memcmp_bad2(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [12 x i8], [12 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull [[STRING]], i64 [[N:%.*]])
+; CHECK-NEXT:    [[CMP:%.*]] = icmp slt i32 [[CALL]], 1
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %string = getelementptr inbounds [12 x i8], [12 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* nonnull %string, i64 %n)
+  %cmp = icmp slt i32 %call, 1
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp_bad3(i8* nocapture readonly %k) {
+; CHECK-LABEL: @strncmp_memcmp_bad3(
+; CHECK-NEXT:    [[CALL:%.*]] = tail call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* [[K:%.*]], i64 2)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32 [[CALL]], 0
+; CHECK-NEXT:    [[CONV:%.*]] = zext i1 [[CMP]] to i32
+; CHECK-NEXT:    ret i32 [[CONV]]
+;
+  %call = tail call i32 @strncmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i8* %k, i64 2)
+  %cmp = icmp eq i32 %call, 0
+  %conv = zext i1 %cmp to i32
+  ret i32 %conv
+}
+
+define i32 @strncmp_memcmp_bad4([4 x i8]* dereferenceable (4) %buf) {
+; CHECK-LABEL: @strncmp_memcmp_bad4(
+; CHECK-NEXT:    [[STRING:%.*]] = getelementptr inbounds [4 x i8], [4 x i8]* [[BUF:%.*]], i64 0, i64 0
+; CHECK-NEXT:    [[CALL:%.*]] = call i32 @strncmp(i8* nonnull [[STRING]], i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 2)
+; CHECK-NEXT:    tail call void @use(i32 [[CALL]])
+; CHECK-NEXT:    ret i32 0
+;
+  %string = getelementptr inbounds [4 x i8], [4 x i8]* %buf, i64 0, i64 0
+  %call = call i32 @strncmp(i8* nonnull %string, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @key, i64 0, i64 0), i64 2)
+  tail call void @use(i32 %call)
+  ret i32 0
+}
+
+declare i32 @memcmp(i8* nocapture, i8* nocapture, i64)