[ExprConstant] Improve memchr/memcmp for type mismatch and multibyte element types

[hubert.reinterpretcast]

Summary

memchr and memcmp operate upon the character units of the object representation; that is, the size_t parameter expresses the number of character units. The constant folding implementation is updated in this patch to account for multibyte element types in the arrays passed to memchr/memcmp and, in the case of memcmp, to account for the possibility that the arrays may have differing element types (even when they are byte-sized).

Actual inspection of the object representation is not implemented. Comparisons are done only between elements with the same object size; that is, memchr will fail when inspecting at least one character unit of a multibyte element. The integer types are assumed to have two's complement representation with 0 for false, 1 for true, and no padding bits.

memcmp on multibyte elements will only be able to fold in cases where enough elements are equal for the answer to be 0.

Various tests are added to guard against incorrect folding for cases that miscompile on some system or other prior to this patch. At the same time, the unsigned 32-bit wchar_t testing in test/SemaCXX/constexpr-string.cpp is restored.

[aaron.ballman]

lib/AST/ExprConstant.cpp

6151

Drop the top-level const.

8448

Drop top-level const. (Same suggestion anywhere the type is local to a function and is not a pointer or reference type.)

8461

Don't use auto here as the type is not spelled out in the initialization.

8465

Drop const and use a non-deduced type.

8466

Can you add a string literal to this assert explaining what's gone wrong if it triggers?

[rsmith]

lib/AST/ExprConstant.cpp

6147–6148

Why do we need to do this explicitly, rather than allowing to simply happen as part of the first handleLValueToRValueConversion below?

6150

Considering the LValue base here is incorrect. The object or array we're copying could be a subobject, and the complete object type (the type of the lvalue base) is irrelevant for such copies. Use Result.Designator.getType(Info.Ctx) to find the type that the lvalue designates. (You can bail out here if the designator is invalid; handleLValueToRValueConversion will always fail on such cases anyway.

6159–6160

Please add an assert here that the types do match in the non-raw-byte case. (They must, or the subobject designator would be invalid; the only special case is that a void* can point to anything, and only the memchr variants here take a void*.)

8433–8436

Per above comment, this is not correct.

8467

Style nit: please use while (true) rather than for (;;)

8471–8476

The *only* possible problem here is for bool, right? This comment would be clearer if it said that.

8484

Please add a comment before this return indicating that the result depends on byte order (and maybe a FIXME to compare the bytes in the right order rather than bailing out). We're going to need to deal with the byte order / representation problem for std::bit_cast pretty soon anyway.

8488–8489

This looks wrong. If 0 < MaxLength && MaxLength < LengthPerElement, we're supposed to compare *part of* the next element; this current approach doesn't do that. (If you did one more full-element compare, that'd be conservatively correct because we're only checking for equality, not ordering, but perhaps we should only permit cases where MaxLength is a multiple of LengthPerElement?

test/CodeGenCXX/builtins.cpp

41

Please test this in a way that doesn't rely on IR generation constant-evaluating if conditions. Moreover, there's nothing about IR generation that you're actually testing here, so please phrase this as a Sema test instead (eg, check that a VLA bound gets folded to a constant). Likewise for the other tests below.

[hubert.reinterpretcast]

Make an initial pass at addressing the review comments

Address comments on style and code comments

lib/AST/ExprConstant.cpp

6159–6160

Will do.

8471–8476

We do assume two's complement representation (which C89 does not require to be true); so, bool is more problematic than other things, but the comment is not just about bool.

8488–8489

We are doing one more full-element compare to be conservatively correct. There is a test for that.

test/CodeGenCXX/builtins.cpp

41

Not all of these cases can fold successfully with the current implementation. The check would need to be that we either fold (and get the right value), or don't fold at all.

[rsmith]

lib/AST/ExprConstant.cpp

8465

Use toCharUnitsFromBits here, and use CharUnits as a type-safe way of representing a size in terms of a number of chars. In fact, consider using getTypeSizeInChars a few lines above and only operating in chars, never bits.

8471–8476

There is no type other than bool that needs the extOrTrunc; maybe drop the "especially"?

8488–8489

Oh, I see now. Right. :)

Maybe add "Be careful not to compare more than MaxLength bytes" to the FIXME above, so a future maintainer doesn't get confused?

test/CodeGenCXX/builtins.cpp

41

Seems fine to have a test that we don't fold certain cases at all, with a comment saying that it's OK if we start folding them to a constant and what that constant should be.

Generally the principle is that we want our unit tests to test as few layers of the stack as possible; the chosen test directory should ideally correspond to the layer under test. If you'd really like this to be more of an integration test, that's fine too (eg, if you have code like this in a platform header that really must be handled a certain way), but then it would belong in test/Integration. If you do put it in test/Integration, it'd then be reasonable to include -O in the test flags too, if that makes sense for what you want to test.

[hubert.reinterpretcast]

Use lvalue designator, add assertions for type matching

[hubert.reinterpretcast]

lib/AST/ExprConstant.cpp

6147–6148

We want the error message to be produced even if we bail early on not having a valid designator.

6150

Got it; I also updated the tests to be sensitive to this issue.

test/CodeGenCXX/builtins.cpp

41

I think a SemaCXX test based on the following pattern would work:

constexpr decltype(sizeof 0) Good = 42, Bad = 43;
template <decltype(sizeof 0)> struct A;
struct NotBad {};
template <> struct A<Good> : NotBad {};

template <typename T, decltype(sizeof 0) N> A<N> *evalFor(T (&)[N]);
NotBad *evalFor(...);
void chk(NotBad *);

void f() {
  int x[__builtin_memcmp("", "", 1) == 0 ? Good : Bad];
  chk(evalFor(x));
}

[hubert.reinterpretcast]

Address remaining ExprConstant.cpp review comments

Use BytesRemaining/BytesPerElement to improve readability;
tweak FIXME comment to refer to the _remaining_ bytes.
Use CharUnits-to-CharUnits comparisons where straightforward.
Tweak comment about internal representation mismatch.

[hubert.reinterpretcast]

I'll update the tests to be in terms of constant/variable array length tomorrow. I think I've gotten through the rest of the comments.

[hubert.reinterpretcast]

Recast representation-sensitive tests as SemaCXX tests using array bounds

[rsmith]

lib/AST/ExprConstant.cpp

6147–6148

If we have an invalid designator, we already produced a diagnostic when setting it invalid, and generally don't need to diagnose anything else.

[hubert.reinterpretcast]

lib/AST/ExprConstant.cpp

6147–6148

The null pointer diagnostic does not get produced if we do not do the check here on cases like the following:

static_assert(__builtin_memchr((int *)0, 0, 1) == 0, "");

include/clang/Basic/DiagnosticASTKinds.td

def note_constexpr_access_volatile_obj : Note<
   "%select{temporary|object %2|member %2}1 is not allowed in "
   "a constant expression">;
 def note_constexpr_ltor_mutable : Note<
   "read of mutable member %0 is not allowed in a constant expression">;
 def note_constexpr_ltor_non_const_int : Note<
   "read of non-const variable %0 is not allowed in a constant expression">;
 def note_constexpr_ltor_non_constexpr : Note<
   "read of non-constexpr variable %0 is not allowed in a constant expression">;
+def note_constexpr_ltor_incomplete_type : Note<
+  "read of incomplete type %0 is not allowed in a constant expression">;
 def note_constexpr_access_null : Note<
   "%select{read of|assignment to|increment of|decrement of}0 "
   "dereferenced null pointer is not allowed in a constant expression">;
 def note_constexpr_access_past_end : Note<
   "%select{read of|assignment to|increment of|decrement of}0 "
   "dereferenced one-past-the-end pointer is not allowed in a constant expression">;
 def note_constexpr_access_unsized_array : Note<
   "%select{read of|assignment to|increment of|decrement of}0 "

lib/AST/ExprConstant.cpp

for (CallStackFrame *Frame = CurrentCall; Frame != &BottomFrame;
 
     SmallVector<char, 128> Buffer;
     llvm::raw_svector_ostream Out(Buffer);
     describeCall(Frame, Out);
     addDiag(Frame->CallLoc, diag::note_constexpr_call_here) << Out.str();
   }
 }
 
+/// Kinds of access we can perform on an object, for diagnostics.
+enum AccessKinds {
+  AK_Read,
+  AK_Assign,
+  AK_Increment,
+  AK_Decrement
+};
+
 namespace {
   struct ComplexValue {
   private:
     bool IsInt;
 
   public:
     APSInt IntReal, IntImag;
     APFloat FloatReal, FloatImag;
void setNull(QualType PointerTy, uint64_t TargetVal) {
       Designator = SubobjectDesignator(PointerTy->getPointeeType());
       IsNullPtr = true;
     }
 
     void setInvalid(APValue::LValueBase B, unsigned I = 0) {
       set(B, true);
     }
 
+  private:
     // Check that this LValue is not based on a null pointer. If it is, produce
     // a diagnostic and mark the designator as invalid.
-    bool checkNullPointer(EvalInfo &Info, const Expr *E,
-                          CheckSubobjectKind CSK) {
+    template <typename GenDiagType>
+    bool checkNullPointerDiagnosingWith(const GenDiagType &GenDiag) {
       if (Designator.Invalid)
         return false;
       if (IsNullPtr) {
-        Info.CCEDiag(E, diag::note_constexpr_null_subobject)
-          << CSK;
+        GenDiag();
         Designator.setInvalid();
         return false;
       }
       return true;
     }
 
+  public:
+    bool checkNullPointer(EvalInfo &Info, const Expr *E,
+                          CheckSubobjectKind CSK) {
+      return checkNullPointerDiagnosingWith([&Info, E, CSK] {
+        Info.CCEDiag(E, diag::note_constexpr_null_subobject) << CSK;
+      });
+    }
+
+    bool checkNullPointerForFoldAccess(EvalInfo &Info, const Expr *E,
+                                       AccessKinds AK) {
+      return checkNullPointerDiagnosingWith([&Info, E, AK] {
+        Info.FFDiag(E, diag::note_constexpr_access_null) << AK;
+      });
+    }
+
     // Check this LValue refers to an object. If not, set the designator to be
     // invalid and emit a diagnostic.
     bool checkSubobject(EvalInfo &Info, const Expr *E, CheckSubobjectKind CSK) {
       return (CSK == CSK_ArrayToPointer || checkNullPointer(Info, E, CSK)) &&
              Designator.checkSubobject(Info, E, CSK);
     }
 
     void addDecl(EvalInfo &Info, const Expr *E,
static bool diagnoseUnreadableFields(EvalInfo &Info, const Expr *E,
   for (auto &BaseSpec : RD->bases())
     if (diagnoseUnreadableFields(Info, E, BaseSpec.getType()))
       return true;
 
   // All mutable fields were empty, and thus not actually read.
   return false;
 }
 
-/// Kinds of access we can perform on an object, for diagnostics.
-enum AccessKinds {
-  AK_Read,
-  AK_Assign,
-  AK_Increment,
-  AK_Decrement
-};
-
 namespace {
 /// A handle to a complete object (an object that is not a subobject of
 /// another object).
 struct CompleteObject {
   /// The value of the complete object.
   APValue *Value;
   /// The type of the complete object.
   QualType Type;
if (BuiltinOp != Builtin::BIstrchr &&
         BuiltinOp != Builtin::BIwcschr &&
         BuiltinOp != Builtin::BI__builtin_strchr &&
         BuiltinOp != Builtin::BI__builtin_wcschr) {
       APSInt N;
       if (!EvaluateInteger(E->getArg(2), N, Info))
         return false;
       MaxLength = N.getExtValue();
     }
-
-    QualType CharTy = E->getArg(0)->getType()->getPointeeType();
-
+    // We cannot find the value if there are no candidates to match against.
+    if (MaxLength == 0u)
+      return ZeroInitialization(E);
+    if (!Result.checkNullPointerForFoldAccess(Info, E, AK_Read))
+      return false;
+    QualType CharTy =
+        Info.Ctx.getBaseElementType(getType(Result.getLValueBase()));
+    const bool IsRawByte = BuiltinOp == Builtin::BImemchr ||
+                           BuiltinOp == Builtin::BI__builtin_memchr;
+    // Pointers to const void may point to objects of incomplete type.
+    if (IsRawByte && CharTy->isIncompleteType()) {
+      Info.FFDiag(E, diag::note_constexpr_ltor_incomplete_type) << CharTy;
+      return false;
+    }
+    // Give up on byte-oriented matching against multibyte elements.
+    if (IsRawByte && Info.Ctx.getTypeSize(CharTy) > Info.Ctx.getCharWidth())
+      return false;
     // Figure out what value we're actually looking for (after converting to
     // the corresponding unsigned type if necessary).
     uint64_t DesiredVal;
     bool StopAtNull = false;
     switch (BuiltinOp) {
     case Builtin::BIstrchr:
     case Builtin::BI__builtin_strchr:
       // strchr compares directly to the passed integer, and therefore
bool IntExprEvaluator::VisitBuiltinCallExpr(const CallExpr *E,
   case Builtin::BI__builtin_wcsncmp:
   case Builtin::BI__builtin_memcmp:
   case Builtin::BI__builtin_wmemcmp: {
     LValue String1, String2;
     if (!EvaluatePointer(E->getArg(0), String1, Info) ||
         !EvaluatePointer(E->getArg(1), String2, Info))
       return false;
 
-    QualType CharTy = E->getArg(0)->getType()->getPointeeType();
-
     uint64_t MaxLength = uint64_t(-1);
     if (BuiltinOp != Builtin::BIstrcmp &&
         BuiltinOp != Builtin::BIwcscmp &&
         BuiltinOp != Builtin::BI__builtin_strcmp &&
         BuiltinOp != Builtin::BI__builtin_wcscmp) {
       APSInt N;
       if (!EvaluateInteger(E->getArg(2), N, Info))
         return false;
       MaxLength = N.getExtValue();
     }
+
+    // Empty substrings compare equal by definition.
+    if (MaxLength == 0u)
+      return Success(0, E);
+
+    if (!String1.checkNullPointerForFoldAccess(Info, E, AK_Read) ||
+        !String2.checkNullPointerForFoldAccess(Info, E, AK_Read))
+      return false;
+
+    QualType CharTy1 =
+        Info.Ctx.getBaseElementType(getType(String1.getLValueBase()));
+    QualType CharTy2 =
+        Info.Ctx.getBaseElementType(getType(String2.getLValueBase()));
+
+    const auto &ReadCurElems = [&](APValue &Char1, APValue &Char2) {
+      return handleLValueToRValueConversion(Info, E, CharTy1, String1, Char1) &&
+             handleLValueToRValueConversion(Info, E, CharTy2, String2, Char2) &&
+             Char1.isInt() && Char2.isInt();
+    };
+    const auto &AdvanceElems = [&] {
+      return HandleLValueArrayAdjustment(Info, E, String1, CharTy1, 1) &&
+             HandleLValueArrayAdjustment(Info, E, String2, CharTy2, 1);
+    };
+
+    const bool IsRawByte = BuiltinOp == Builtin::BImemcmp ||
+                           BuiltinOp == Builtin::BI__builtin_memcmp;
+
+    if (IsRawByte) {
+      // Pointers to const void may point to objects of incomplete type.
+      if (CharTy1->isIncompleteType()) {
+        Info.FFDiag(E, diag::note_constexpr_ltor_incomplete_type) << CharTy1;
+        return false;
+      }
+      if (CharTy2->isIncompleteType()) {
+        Info.FFDiag(E, diag::note_constexpr_ltor_incomplete_type) << CharTy2;
+        return false;
+      }
+      const auto CharTy1Width = Info.Ctx.getTypeSize(CharTy1);
+      // Give up on comparing between elements with disparate widths.
+      if (CharTy1Width != Info.Ctx.getTypeSize(CharTy2))
+        return false;
+      const auto LengthPerElement = CharTy1Width / Info.Ctx.getCharWidth();
+      assert(MaxLength);
+      for (;;) {
+        APValue Char1, Char2;
+        if (!ReadCurElems(Char1, Char2))
+          return false;
+        // We have compatible in-memory widths, but a possible type and internal
+        // representation mismatch. Assuming two's complement representation,
+        // including 0 for `false` and 1 for `true`, we can check an appropriate
+        // number of elements for equality even if they are not byte-sized.
+        const APSInt Char1InMem = Char1.getInt().extOrTrunc(CharTy1Width);
+        const APSInt Char2InMem = Char2.getInt().extOrTrunc(CharTy1Width);
+        if (Char1InMem.ne(Char2InMem)) {
+          // If the elements are byte-sized, then we can produce a three-way
+          // comparison result in a straightforward manner.
+          if (LengthPerElement == 1u) {
+            // memcmp always compares unsigned chars.
+            return Success(Char1InMem.ult(Char2InMem) ? -1 : 1, E);
+          }
+          return false;
+        }
+        if (!AdvanceElems())
+          return false;
+        if (MaxLength <= LengthPerElement)
+          break;
+        MaxLength -= LengthPerElement;
+      }
+      // Enough elements are equal to account for the memcmp limit.
+      return Success(0, E);
+    }
+
     bool StopAtNull = (BuiltinOp != Builtin::BImemcmp &&
                        BuiltinOp != Builtin::BIwmemcmp &&
                        BuiltinOp != Builtin::BI__builtin_memcmp &&
                        BuiltinOp != Builtin::BI__builtin_wmemcmp);
     bool IsWide = BuiltinOp == Builtin::BIwcscmp ||
                   BuiltinOp == Builtin::BIwcsncmp ||
                   BuiltinOp == Builtin::BIwmemcmp ||
                   BuiltinOp == Builtin::BI__builtin_wcscmp ||
                   BuiltinOp == Builtin::BI__builtin_wcsncmp ||
                   BuiltinOp == Builtin::BI__builtin_wmemcmp;
+
     for (; MaxLength; --MaxLength) {
       APValue Char1, Char2;
-      if (!handleLValueToRValueConversion(Info, E, CharTy, String1, Char1) ||
-          !handleLValueToRValueConversion(Info, E, CharTy, String2, Char2) ||
-          !Char1.isInt() || !Char2.isInt())
+      if (!ReadCurElems(Char1, Char2))
         return false;
       if (Char1.getInt() != Char2.getInt()) {
         if (IsWide) // wmemcmp compares with wchar_t signedness.
           return Success(Char1.getInt() < Char2.getInt() ? -1 : 1, E);
         // memcmp always compares unsigned chars.
         return Success(Char1.getInt().ult(Char2.getInt()) ? -1 : 1, E);
       }
       if (StopAtNull && !Char1.getInt())
         return Success(0, E);
       assert(!(StopAtNull && !Char2.getInt()));
-      if (!HandleLValueArrayAdjustment(Info, E, String1, CharTy, 1) ||
-          !HandleLValueArrayAdjustment(Info, E, String2, CharTy, 1))
+      if (!AdvanceElems())
         return false;
     }
     // We hit the strncmp / memcmp limit.
     return Success(0, E);
   }
 
   case Builtin::BI__atomic_always_lock_free:
   case Builtin::BI__atomic_is_lock_free:

test/CodeGenCXX/builtins.cpp

 // RUN: %clang_cc1 -triple=x86_64-linux-gnu -emit-llvm -o - %s | FileCheck %s
+// RUN: %clang_cc1 -triple=s390x-suse-linux -emit-llvm -o - %s | FileCheck %s
 
 // PR8839
 extern "C" char memmove();
 
 int main() {
   // CHECK: call {{signext i8|i8}} @memmove()
   return memmove();
 }

 
 int x = __builtin_abs(-2);
 // CHECK:  store i32 2, i32* @x, align 4
 
 long y = __builtin_abs(-2l);
 // CHECK:  [[Y:%.+]] = call i64 @_Z13__builtin_absl(i64 -2)
 // CHECK:  store i64 [[Y]], i64* @y, align 8
 
+namespace MemchrMultibyteElementTests {
+#define STR2(X) #X
+#define STR(X) STR2(X)
+constexpr const char ByteOrderString[] = STR(__BYTE_ORDER__);
+// CHECK: define void @_ZN27MemchrMultibyteElementTests12memchr_testsEv()
+void memchr_tests(void) {
+  extern void matchedFirstByteIn04030201();
+  constexpr unsigned int u04030201 = 0x04030201;
+  if (__builtin_memchr(&u04030201, *ByteOrderString - '0', 1u) == &u04030201) {
+    matchedFirstByteIn04030201();
+    // CHECK: call void @_ZN27MemchrMultibyteElementTests26matchedFirstByteIn04030201Ev()
+  }
+  extern void checkedFirstByteIn000000ED();
+  constexpr unsigned int uED = 0xEDU;
+  if (__builtin_memchr(&uED, 0xED, 1u) ==
+      (*ByteOrderString == '1' ? &uED : nullptr)) {
+    checkedFirstByteIn000000ED();
+    // CHECK: call void @_ZN27MemchrMultibyteElementTests26checkedFirstByteIn000000EDEv()
+  }
+}
+#undef STR
+#undef STR2
+}
+
 extern const char char_memchr_arg[32];
 char *memchr_result = __builtin_char_memchr(char_memchr_arg, 123, 32);
-// CHECK: call i8* @memchr(i8* getelementptr inbounds ([32 x i8], [32 x i8]* @char_memchr_arg, i32 0, i32 0), i32 123, i64 32)
+// CHECK: call i8* @memchr(i8* getelementptr inbounds ([32 x i8], [32 x i8]* @char_memchr_arg, i32 0, i32 0), i32 {{(signext )?}}123, i64 32)
+
+namespace MemcmpMultibyteElementTests {
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#define CHK_BY_ENDIAN(X, OP_LE, OP_OTHER) ((X) OP_LE 0)
+#else
+#define CHK_BY_ENDIAN(X, OP_LE, OP_OTHER) ((X) OP_OTHER 0)
+#endif
+#define LT <
+#define EQ ==
+#define GT >
+using MemchrMultibyteElementTests::ByteOrderString;
+// CHECK: define void @_ZN27MemcmpMultibyteElementTests12memcmp_testsEv()
+void memcmp_tests(void) {
+#ifdef __SIZEOF_INT128__
+  extern void checkedFirstByteInAllZeroLowerHalfInt128Pair();
+  constexpr __int128 i128_ff_8_00_8 = -(__int128)1 - -1ull;
+  constexpr __int128 i128_00_16 = 0;
+  if (CHK_BY_ENDIAN(__builtin_memcmp(&i128_ff_8_00_8, &i128_00_16, 1u),
+                    EQ, GT)) {
+    checkedFirstByteInAllZeroLowerHalfInt128Pair();
+    // CHECK: call void @_ZN27MemcmpMultibyteElementTests44checkedFirstByteInAllZeroLowerHalfInt128PairEv()
+  }
+#endif
+  extern void mixedSizeComparisonSucceeded();
+  constexpr const signed char ByteOrderStringReduced[] = {
+      ByteOrderString[0] - '0', ByteOrderString[1] - '0',
+      ByteOrderString[2] - '0', ByteOrderString[3] - '0',
+  };
+  constexpr signed int i04030201 = 0x04030201;
+  constexpr unsigned int u04030201 = 0x04030201u;
+  if (__builtin_memcmp(ByteOrderStringReduced, &i04030201, sizeof(int)) == 0 &&
+      __builtin_memcmp(&u04030201, ByteOrderStringReduced, sizeof(int)) == 0) {
+    mixedSizeComparisonSucceeded();
+    // CHECK: call void @_ZN27MemcmpMultibyteElementTests28mixedSizeComparisonSucceededEv()
+  }
+  extern void checkedFirstByteInMixedSizeButEqualValueUIntUShortPair();
+  constexpr unsigned int ui0000FEFF = 0x0000feffU;
+  constexpr unsigned short usFEFF = 0xfeffU;
+  if (CHK_BY_ENDIAN(__builtin_memcmp(&ui0000FEFF, &usFEFF, 1u), EQ, LT)) {
+    checkedFirstByteInMixedSizeButEqualValueUIntUShortPair();
+    // CHECK: call void @_ZN27MemcmpMultibyteElementTests54checkedFirstByteInMixedSizeButEqualValueUIntUShortPairEv()
+  }
+  extern void checkedForFirstDifferentByteInUIntPair();
+  constexpr unsigned int ui08038700 = 0x08038700u;
+  constexpr unsigned int ui08048600 = 0x08048600u;
+  if (CHK_BY_ENDIAN(__builtin_memcmp(&ui08038700, &ui08048600, sizeof(int)),
+                    GT, LT)) {
+    checkedForFirstDifferentByteInUIntPair();
+    // CHECK: call void @_ZN27MemcmpMultibyteElementTests38checkedForFirstDifferentByteInUIntPairEv()
+  }
+}
+#undef GT
+#undef EQ
+#undef LT
+#undef CHK_BY_ENDIAN
+}
 
 int constexpr_overflow_result() {
   constexpr int x = 1;
   // CHECK: alloca i32
   constexpr int y = 2;
   // CHECK: alloca i32
   int z;
   // CHECK: [[Z:%.+]] = alloca i32
 
   __builtin_sadd_overflow(x, y, &z);
   return z;
   // CHECK: [[RET_PTR:%.+]] = extractvalue { i32, i1 } %0, 0
   // CHECK: store i32 [[RET_PTR]], i32* [[Z]]
   // CHECK: [[RET_VAL:%.+]] = load i32, i32* [[Z]]
   // CHECK: ret i32 [[RET_VAL]]
 }

test/SemaCXX/constexpr-string.cpp

namespace StrcmpEtc {
   static_assert(__builtin_memcmp("a\203", "a\003", 2) == 1);
   static_assert(__builtin_memcmp(0, 0, 0) == 0);
   static_assert(__builtin_memcmp("abab\0banana", "abab\0banana", 100) == 0); // expected-error {{not an integral constant}} expected-note {{dereferenced one-past-the-end}}
   static_assert(__builtin_memcmp("abab\0banana", "abab\0canada", 100) == -1); // FIXME: Should we reject this?
   static_assert(__builtin_memcmp("abab\0banana", "abab\0canada", 7) == -1);
   static_assert(__builtin_memcmp("abab\0banana", "abab\0canada", 6) == -1);
   static_assert(__builtin_memcmp("abab\0banana", "abab\0canada", 5) == 0);
 
+  extern struct Incomplete incomplete;
+  static_assert(__builtin_memcmp(&incomplete, "", 0u) == 0);
+  static_assert(__builtin_memcmp("", &incomplete, 0u) == 0);
+  static_assert(__builtin_memcmp(&incomplete, "", 1u) == 42); // expected-error {{not an integral constant}} expected-note {{read of incomplete type 'struct Incomplete'}}
+  static_assert(__builtin_memcmp("", &incomplete, 1u) == 42); // expected-error {{not an integral constant}} expected-note {{read of incomplete type 'struct Incomplete'}}
+
+  constexpr unsigned char ku00fe00[] = {0x00, 0xfe, 0x00};
+  constexpr unsigned char ku00feff[] = {0x00, 0xfe, 0xff};
+  constexpr signed char ks00fe00[] = {0, -2, 0};
+  constexpr signed char ks00feff[] = {0, -2, -1};
+  static_assert(__builtin_memcmp(ku00feff, ks00fe00, 2) == 0);
+  static_assert(__builtin_memcmp(ku00feff, ks00fe00, 99) == 1);
+  static_assert(__builtin_memcmp(ku00fe00, ks00feff, 99) == -1);
+  static_assert(__builtin_memcmp(ks00feff, ku00fe00, 2) == 0);
+  static_assert(__builtin_memcmp(ks00feff, ku00fe00, 99) == 1);
+  static_assert(__builtin_memcmp(ks00fe00, ku00feff, 99) == -1);
+  static_assert(__builtin_memcmp(ks00fe00, ks00feff, 2) == 0);
+  static_assert(__builtin_memcmp(ks00feff, ks00fe00, 99) == 1);
+  static_assert(__builtin_memcmp(ks00fe00, ks00feff, 99) == -1);
+
+  constexpr bool kb000100[] = {false, true, false};
+  static_assert(sizeof(bool) != 1u || __builtin_memcmp(ks00fe00, kb000100, 1) == 0);
+  static_assert(sizeof(bool) != 1u || __builtin_memcmp(ks00fe00, kb000100, 2) == 1);
+
+  constexpr long ksl[] = {0, -1};
+  constexpr unsigned int kui[] = {0, 0u - 1};
+  constexpr unsigned long long kull[] = {0, 0ull - 1};
+  constexpr const auto *kuSizeofLong(void) {
+    if constexpr(sizeof(long) == sizeof(int)) {
+      return kui;
+    } else {
+      static_assert(sizeof(long) == sizeof(long long));
+      return kull;
+    }
+  }
+  static_assert(__builtin_memcmp(ksl, kuSizeofLong(), sizeof(long) - 1) == 0);
+  static_assert(__builtin_memcmp(ksl, kuSizeofLong(), sizeof(long) + 0) == 0);
+  static_assert(__builtin_memcmp(ksl, kuSizeofLong(), sizeof(long) + 1) == 0);
+  static_assert(__builtin_memcmp(ksl, kuSizeofLong(), 2*sizeof(long) - 1) == 0);
+  static_assert(__builtin_memcmp(ksl, kuSizeofLong(), 2*sizeof(long) + 0) == 0);
+  static_assert(__builtin_memcmp(ksl, kuSizeofLong(), 2*sizeof(long) + 1) == 42); // expected-error {{not an integral constant}} expected-note {{dereferenced one-past-the-end}}
+  static_assert(__builtin_memcmp(ksl + 1, kuSizeofLong() + 1, sizeof(long) - 1) == 0);
+  static_assert(__builtin_memcmp(ksl + 1, kuSizeofLong() + 1, sizeof(long) + 0) == 0);
+  static_assert(__builtin_memcmp(ksl + 1, kuSizeofLong() + 1, sizeof(long) + 1) == 42); // expected-error {{not an integral constant}} expected-note {{dereferenced one-past-the-end}}
+
   constexpr int a = strcmp("hello", "world"); // expected-error {{constant expression}} expected-note {{non-constexpr function 'strcmp' cannot be used in a constant expression}}
   constexpr int b = strncmp("hello", "world", 3); // expected-error {{constant expression}} expected-note {{non-constexpr function 'strncmp' cannot be used in a constant expression}}
   constexpr int c = memcmp("hello", "world", 3); // expected-error {{constant expression}} expected-note {{non-constexpr function 'memcmp' cannot be used in a constant expression}}
 }
 
 namespace WcscmpEtc {
   constexpr wchar_t kFoobar[6] = {L'f',L'o',L'o',L'b',L'a',L'r'};
   constexpr wchar_t kFoobazfoobar[12] = {L'f',L'o',L'o',L'b',L'a',L'z',L'f',L'o',L'o',L'b',L'a',L'r'};
namespace StrchrEtc {
   static_assert(__builtin_memchr(kStr, '\xff', 8) == kStr + 4);
   static_assert(__builtin_memchr(kStr, '\xff' + 256, 8) == kStr + 4);
   static_assert(__builtin_memchr(kStr, '\xff' - 256, 8) == kStr + 4);
   static_assert(__builtin_memchr(kFoo, 'x', 3) == nullptr);
   static_assert(__builtin_memchr(kFoo, 'x', 4) == nullptr); // expected-error {{not an integral constant}} expected-note {{dereferenced one-past-the-end}}
   static_assert(__builtin_memchr(nullptr, 'x', 3) == nullptr); // expected-error {{not an integral constant}} expected-note {{dereferenced null}}
   static_assert(__builtin_memchr(nullptr, 'x', 0) == nullptr); // FIXME: Should we reject this?
 
+  extern struct Incomplete incomplete;
+  static_assert(__builtin_memchr(&incomplete, 0, 0u) == nullptr);
+  static_assert(__builtin_memchr(&incomplete, 0, 1u) == nullptr); // expected-error {{not an integral constant}} expected-note {{read of incomplete type 'struct Incomplete'}}
+
+  const unsigned char &u1 = 0xf0;
+  auto &&i1 = (const signed char []){-128}; // expected-warning {{compound literals are a C99-specific feature}}
+  static_assert(__builtin_memchr(&u1, -(0x0f + 1), 1) == &u1);
+  static_assert(__builtin_memchr(i1, 0x80, 1) == i1);
+
+  enum class E : unsigned char {};
+  constexpr E e{240};
+  static_assert(__builtin_memchr(&e, 240, 1) == &e);
+
+  constexpr bool kBool[] = {false, true, false};
+  constexpr const bool *const kBoolPastTheEndPtr = kBool + 3;
+  static_assert(sizeof(bool) != 1u || __builtin_memchr(kBoolPastTheEndPtr - 3, 1, 99) == kBool + 1);
+  static_assert(sizeof(bool) != 1u || __builtin_memchr(kBool + 1, 0, 99) == kBoolPastTheEndPtr - 1);
+  static_assert(sizeof(bool) != 1u || __builtin_memchr(kBoolPastTheEndPtr - 3, -1, 3) == nullptr);
+  static_assert(sizeof(bool) != 1u || __builtin_memchr(kBoolPastTheEndPtr, 0, 1) == nullptr); // expected-error {{not an integral constant}} expected-note {{dereferenced one-past-the-end}}
+
   static_assert(__builtin_char_memchr(kStr, 'a', 0) == nullptr);
   static_assert(__builtin_char_memchr(kStr, 'a', 1) == kStr);
   static_assert(__builtin_char_memchr(kStr, '\0', 5) == nullptr);
   static_assert(__builtin_char_memchr(kStr, '\0', 6) == kStr + 5);
   static_assert(__builtin_char_memchr(kStr, '\xff', 8) == kStr + 4);
   static_assert(__builtin_char_memchr(kStr, '\xff' + 256, 8) == kStr + 4);
   static_assert(__builtin_char_memchr(kStr, '\xff' - 256, 8) == kStr + 4);
   static_assert(__builtin_char_memchr(kFoo, 'x', 3) == nullptr);