Annotate return values of allocation functions with dereferenceable_or_null

[xbolva00]

Summary

Example
define dso_local noalias i8* @_Z6maixxnv() local_unnamed_addr #0 {
entry:

%call = tail call noalias dereferenceable_or_null(64) i8* @malloc(i64 64) #6
ret i8* %call

}

[xbolva00]

I will update/add tests after some initial code review.

lib/Transforms/InstCombine/InstCombineCalls.cpp

4189 ↗

(On Diff #216830)

Not a typo. OpNewLike never returns null, it just throws exception.

[jdoerfert]

It seems inconsistent to declare Op0C initially and Op1C late given that both are need 2 times in almost the same fashion.

We also need tests.

I think this is the right thing to do though, dereferenceability will be used for LICM and AA (D66157), and nonnull can be eliminated with any access or null check (D65402 and following).

[xbolva00]

Improved code.
Added/updated tests.

[xbolva00]

Precommited tests - Rebased.

[aaron.ballman]

I'm not an LLVM person, but I just wanted to double-check: is this correct even in the face of situations where malloc() and friends return a non-null pointer that is *not* dereferenceable? e.g., when someone calls malloc(0) with certain libc implementations?

[xbolva00]

We ignore malloc(0), realloc(p, 0), etc cases (no annotation, deref_or_null(0) is useless). All edge cases should be coveree in deref-alloc-fns.ll.

We annotate if size is known constant and > 0.

[xbolva00]

Fixed function names in new tests. (op_new_constant_size and op_new_constant_zero_size was swapped).

[jdoerfert]

Two last comments from my side.

lib/Transforms/InstCombine/InstCombineCalls.cpp

4183 ↗

(On Diff #217393)

What is wrong with invoke?

4187 ↗

(On Diff #217393)

You can "speed things up" if you check Op0C and Op1C for null first (early exit). At least one has to be nonnull and its value as well. Also below, the isXXXX check is more expensive so we should first check the operands.

[xbolva00]

Fixed review comments

[jdoerfert]

Last problem mentioned below. Otherwise, LGTM.

lib/Transforms/InstCombine/InstCombineCalls.cpp

4187 ↗

(On Diff #217427)

You cannot remove the isNullValue() check here and below, Op1C could be the reason we skipped the return above!

[xbolva00]

lib/Transforms/InstCombine/InstCombineCalls.cpp

4187 ↗

(On Diff #217427)

Sorry, I dont know what is wrong here - newly added tests pass.

We dont need OP1C for malloc.

[jdoerfert]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

What if one is NULL but the other not? Will getWithDereferenceableOrNullBytes(0) do the right thing?

[xbolva00]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

Maybe isNullValue confused you. isNullValue means just CstInt->getValue() == 0.

if Op0C is NULL -> no calloc annotation
if Op1C is NULL -> no calloc annotation

if Op0C is '0' -> no annotation; see
if ((Op0C && Op0C->isNullValue()) || (Op1C && Op1C->isNullValue()))

return;

Same for Op1C.

[xbolva00]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

I will add a comment like

// Bail out if the allocation size is zero.
if ((Op0C && Op0C->isNullValue()) || (Op1C && Op1C->isNullValue()))
  return;

[xbolva00]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

Aha, I know what do you mean.

Hmm, it could work for calloc case - I will look on it.

[xbolva00]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

eh, no :D

calloc(1, unknown_var) - We can do nothing in this case ..

[jdoerfert]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

calloc(1, 0) or calloc(0, 1) is the question

[xbolva00]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

No annotation for this cases - why should we? Calloc internally multiplies it

So calloc(0,1) is logically same as

p = malloc(0*1);
memset(p, 0, 0*1)

[xbolva00]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

man calloc
"If nmemb or size is 0, then calloc() returns either NULL, or a unique pointer value that can later be successfully passed to free()."

(so same as malloc(0))

We could fold these cases to NULL, but not worth since this rather programmer's mistake than optimization opportunity.

[jdoerfert]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

I am not asking for an annotation but if we don't accidentally put one as we should not.

What if one is NULL but the other not? Will getWithDereferenceableOrNullBytes(0) do the right thing?

[xbolva00]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

getWithDereferenceableOrNullBytes(Call.getContext(), 0) never happens here.

If Op1 is zero int or Op0 is zero int (or both are zeros), we bail out soon.

We multiplies non zero numbers here.

[jdoerfert]

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

4200

My bad. sry.

llvm/trunk/include/llvm/Analysis/MemoryBuiltins.h

 /// reallocates memory (e.g., realloc).
 bool isReallocLikeFn(const Value *V, const TargetLibraryInfo *TLI,
                      bool LookThroughBitCast = false);
 
 /// Tests if a function is a call or invoke to a library function that
 /// reallocates memory (e.g., realloc).
 bool isReallocLikeFn(const Function *F, const TargetLibraryInfo *TLI);
 
+/// Tests if a value is a call or invoke to a library function that
+/// allocates memory and throws if an allocation failed (e.g., new).
+bool isOpNewLikeFn(const Value *V, const TargetLibraryInfo *TLI,
+                     bool LookThroughBitCast = false);
+
 //===----------------------------------------------------------------------===//
 //  malloc Call Utility Functions.
 //
 
 /// extractMallocCall - Returns the corresponding CallInst if the instruction
 /// is a malloc call.  Since CallInst::CreateMalloc() only creates calls, we
 /// ignore InvokeInst here.
 const CallInst *extractMallocCall(const Value *I, const TargetLibraryInfo *TLI);

llvm/trunk/lib/Analysis/MemoryBuiltins.cpp

 }
 
 /// Tests if a functions is a call or invoke to a library function that
 /// reallocates memory (e.g., realloc).
 bool llvm::isReallocLikeFn(const Function *F, const TargetLibraryInfo *TLI) {
   return getAllocationDataForFunction(F, ReallocLike, TLI).hasValue();
 }
 
+/// Tests if a value is a call or invoke to a library function that
+/// allocates memory and throws if an allocation failed (e.g., new).
+bool llvm::isOpNewLikeFn(const Value *V, const TargetLibraryInfo *TLI,
+                     bool LookThroughBitCast) {
+  return getAllocationData(V, OpNewLike, TLI, LookThroughBitCast).hasValue();
+}
+
 /// extractMallocCall - Returns the corresponding CallInst if the instruction
 /// is a malloc call.  Since CallInst::CreateMalloc() only creates calls, we
 /// ignore InvokeInst here.
 const CallInst *llvm::extractMallocCall(const Value *I,
                                         const TargetLibraryInfo *TLI) {
   return isMallocLikeFn(I, TLI) ? dyn_cast<CallInst>(I) : nullptr;
 }
 

llvm/trunk/lib/Transforms/InstCombine/InstCombineCalls.cpp

static IntrinsicInst *findInitTrampoline(Value *Callee) {
 
   if (IntrinsicInst *IT = findInitTrampolineFromAlloca(TrampMem))
     return IT;
   if (IntrinsicInst *IT = findInitTrampolineFromBB(AdjustTramp, TrampMem))
     return IT;
   return nullptr;
 }
 
+static void annotateAnyAllocSite(CallBase &Call, const TargetLibraryInfo *TLI) {
+  ConstantInt *Op0C = dyn_cast<ConstantInt>(Call.getOperand(0));
+  ConstantInt *Op1C = (Call.getNumArgOperands() == 1)
+                          ? nullptr
+                          : dyn_cast<ConstantInt>(Call.getOperand(1));
+  if ((Op0C && Op0C->isNullValue()) || (Op1C && Op1C->isNullValue()))
+    return;
+  if (isMallocLikeFn(&Call, TLI) && Op0C) {
+    Call.addAttribute(AttributeList::ReturnIndex,
+                      Attribute::getWithDereferenceableOrNullBytes(
+                          Call.getContext(), Op0C->getZExtValue()));
+  } else if (isOpNewLikeFn(&Call, TLI) && Op0C) {
+    Call.addAttribute(AttributeList::ReturnIndex,
+                      Attribute::getWithDereferenceableBytes(
+                          Call.getContext(), Op0C->getZExtValue()));
+  } else if (isReallocLikeFn(&Call, TLI) && Op1C) {
+    Call.addAttribute(AttributeList::ReturnIndex,
+                      Attribute::getWithDereferenceableOrNullBytes(
+                          Call.getContext(), Op1C->getZExtValue()));
+  } else if (isCallocLikeFn(&Call, TLI) && Op0C && Op1C) {
+    bool Overflow;
+    const APInt &N = Op0C->getValue();
+    APInt Size = N.umul_ov(Op1C->getValue(), Overflow);
+    if (!Overflow)
+      Call.addAttribute(AttributeList::ReturnIndex,
+                        Attribute::getWithDereferenceableOrNullBytes(
+                            Call.getContext(), Size.getZExtValue()));
+  }
+}
+
 /// Improvements for call, callbr and invoke instructions.
 Instruction *InstCombiner::visitCallBase(CallBase &Call) {
+  if (isAllocationFn(&Call, &TLI))
+    annotateAnyAllocSite(Call, &TLI);
+
   if (isAllocLikeFn(&Call, &TLI))
     return visitAllocSite(Call);
 
   bool Changed = false;
 
   // Mark any parameters that are known to be non-null with the nonnull
   // attribute.  This is helpful for inlining calls to functions with null
   // checks on their arguments.

llvm/trunk/test/Transforms/InstCombine/compare-unescaped.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt -instcombine -S < %s | FileCheck %s
 
 @gp = global i32* null, align 8
 
 declare i8* @malloc(i64) #1
 
 define i1 @compare_global_trivialeq() {
+; CHECK-LABEL: @compare_global_trivialeq(
+; CHECK-NEXT:    ret i1 false
+;
   %m = call i8* @malloc(i64 4)
   %bc = bitcast i8* %m to i32*
   %lgp = load i32*, i32** @gp, align 8
   %cmp = icmp eq i32* %bc, %lgp
   ret i1 %cmp
-; CHECK-LABEL: compare_global_trivialeq
-; CHECK: ret i1 false
 }
 
 define i1 @compare_global_trivialne() {
+; CHECK-LABEL: @compare_global_trivialne(
+; CHECK-NEXT:    ret i1 true
+;
   %m = call i8* @malloc(i64 4)
   %bc = bitcast i8* %m to i32*
   %lgp = load i32*, i32** @gp, align 8
   %cmp = icmp ne i32* %bc, %lgp
   ret i1 %cmp
-; CHECK-LABEL: compare_global_trivialne
-; CHECK: ret i1 true
 }
 
 
 ; Although the %m is marked nocapture in the deopt operand in call to function f,
 ; we cannot remove the alloc site: call to malloc
 ; The comparison should fold to false irrespective of whether the call to malloc can be elided or not
 declare void @f()
 define i1 @compare_and_call_with_deopt() {
-; CHECK-LABEL: compare_and_call_with_deopt
+; CHECK-LABEL: @compare_and_call_with_deopt(
+; CHECK-NEXT:    [[M:%.*]] = call dereferenceable_or_null(24) i8* @malloc(i64 24)
+; CHECK-NEXT:    tail call void @f() [ "deopt"(i8* [[M]]) ]
+; CHECK-NEXT:    ret i1 false
+;
   %m = call i8* @malloc(i64 24)
   %bc = bitcast i8* %m to i32*
   %lgp = load i32*, i32** @gp, align 8, !nonnull !0
   %cmp = icmp eq i32* %lgp, %bc
   tail call void @f() [ "deopt"(i8* %m) ]
   ret i1 %cmp
-; CHECK: ret i1 false
 }
 
 ; Same functon as above with deopt operand in function f, but comparison is NE
 define i1 @compare_ne_and_call_with_deopt() {
-; CHECK-LABEL: compare_ne_and_call_with_deopt
+; CHECK-LABEL: @compare_ne_and_call_with_deopt(
+; CHECK-NEXT:    [[M:%.*]] = call dereferenceable_or_null(24) i8* @malloc(i64 24)
+; CHECK-NEXT:    tail call void @f() [ "deopt"(i8* [[M]]) ]
+; CHECK-NEXT:    ret i1 true
+;
   %m = call i8* @malloc(i64 24)
   %bc = bitcast i8* %m to i32*
   %lgp = load i32*, i32** @gp, align 8, !nonnull !0
   %cmp = icmp ne i32* %lgp, %bc
   tail call void @f() [ "deopt"(i8* %m) ]
   ret i1 %cmp
-; CHECK: ret i1 true
 }
 
 ; Same function as above, but global not marked nonnull, and we cannot fold the comparison
 define i1 @compare_ne_global_maybe_null() {
-; CHECK-LABEL: compare_ne_global_maybe_null
+; CHECK-LABEL: @compare_ne_global_maybe_null(
+; CHECK-NEXT:    [[M:%.*]] = call dereferenceable_or_null(24) i8* @malloc(i64 24)
+; CHECK-NEXT:    [[BC:%.*]] = bitcast i8* [[M]] to i32*
+; CHECK-NEXT:    [[LGP:%.*]] = load i32*, i32** @gp, align 8
+; CHECK-NEXT:    [[CMP:%.*]] = icmp ne i32* [[LGP]], [[BC]]
+; CHECK-NEXT:    tail call void @f() [ "deopt"(i8* [[M]]) ]
+; CHECK-NEXT:    ret i1 [[CMP]]
+;
   %m = call i8* @malloc(i64 24)
   %bc = bitcast i8* %m to i32*
   %lgp = load i32*, i32** @gp
   %cmp = icmp ne i32* %lgp, %bc
   tail call void @f() [ "deopt"(i8* %m) ]
   ret i1 %cmp
-; CHECK: ret i1 %cmp
 }
 
 ; FIXME: The comparison should fold to false since %m escapes (call to function escape)
 ; after the comparison.
 declare void @escape(i8*)
 define i1 @compare_and_call_after() {
-; CHECK-LABEL: compare_and_call_after
+; CHECK-LABEL: @compare_and_call_after(
+; CHECK-NEXT:    [[M:%.*]] = call dereferenceable_or_null(24) i8* @malloc(i64 24)
+; CHECK-NEXT:    [[BC:%.*]] = bitcast i8* [[M]] to i32*
+; CHECK-NEXT:    [[LGP:%.*]] = load i32*, i32** @gp, align 8, !nonnull !0
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i32* [[LGP]], [[BC]]
+; CHECK-NEXT:    br i1 [[CMP]], label [[ESCAPE_CALL:%.*]], label [[JUST_RETURN:%.*]]
+; CHECK:       escape_call:
+; CHECK-NEXT:    call void @escape(i8* [[M]])
+; CHECK-NEXT:    ret i1 true
+; CHECK:       just_return:
+; CHECK-NEXT:    ret i1 [[CMP]]
+;
   %m = call i8* @malloc(i64 24)
   %bc = bitcast i8* %m to i32*
   %lgp = load i32*, i32** @gp, align 8, !nonnull !0
   %cmp = icmp eq i32* %bc, %lgp
   br i1 %cmp, label %escape_call, label %just_return
 
 escape_call:
   call void @escape(i8* %m)
   ret i1 true
 
 just_return:
   ret i1 %cmp
 }
 
 define i1 @compare_distinct_mallocs() {
+; CHECK-LABEL: @compare_distinct_mallocs(
+; CHECK-NEXT:    ret i1 false
+;
   %m = call i8* @malloc(i64 4)
   %n = call i8* @malloc(i64 4)
   %cmp = icmp eq i8* %m, %n
   ret i1 %cmp
-  ; CHECK-LABEL: compare_distinct_mallocs
-  ; CHECK: ret i1 false
 }
 
-; the compare is folded to true since the folding compare looks through bitcasts. 
-; call to malloc and the bitcast instructions are elided after that since there are no uses of the malloc 
+; the compare is folded to true since the folding compare looks through bitcasts.
+; call to malloc and the bitcast instructions are elided after that since there are no uses of the malloc
 define i1 @compare_samepointer_under_bitcast() {
+; CHECK-LABEL: @compare_samepointer_under_bitcast(
+; CHECK-NEXT:    ret i1 true
+;
   %m = call i8* @malloc(i64 4)
   %bc = bitcast i8* %m to i32*
   %bcback = bitcast i32* %bc to i8*
   %cmp = icmp eq i8* %m, %bcback
   ret i1 %cmp
-; CHECK-LABEL: compare_samepointer_under_bitcast
-; CHECK: ret i1 true 
 }
 
-; the compare is folded to true since the folding compare looks through bitcasts. 
+; the compare is folded to true since the folding compare looks through bitcasts.
 ; The malloc call for %m cannot be elided since it is used in the call to function f.
 define i1 @compare_samepointer_escaped() {
+; CHECK-LABEL: @compare_samepointer_escaped(
+; CHECK-NEXT:    [[M:%.*]] = call dereferenceable_or_null(4) i8* @malloc(i64 4)
+; CHECK-NEXT:    call void @f() [ "deopt"(i8* [[M]]) ]
+; CHECK-NEXT:    ret i1 true
+;
   %m = call i8* @malloc(i64 4)
   %bc = bitcast i8* %m to i32*
   %bcback = bitcast i32* %bc to i8*
   %cmp = icmp eq i8* %m, %bcback
   call void @f() [ "deopt"(i8* %m) ]
   ret i1 %cmp
-; CHECK-LABEL: compare_samepointer_escaped
-; CHECK-NEXT: %m = call i8* @malloc(i64 4)
-; CHECK-NEXT: call void @f() [ "deopt"(i8* %m) ]
-; CHECK: ret i1 true 
 }
 
 ; Technically, we can fold the %cmp2 comparison, even though %m escapes through
 ; the ret statement since `ret` terminates the function and we cannot reach from
-; the ret to cmp. 
+; the ret to cmp.
 ; FIXME: Folding this %cmp2 when %m escapes through ret could be an issue with
 ; cross-threading data dependencies since we do not make the distinction between
 ; atomic and non-atomic loads in capture tracking.
 define i8* @compare_ret_escape(i8* %c) {
+; CHECK-LABEL: @compare_ret_escape(
+; CHECK-NEXT:    [[M:%.*]] = call dereferenceable_or_null(4) i8* @malloc(i64 4)
+; CHECK-NEXT:    [[N:%.*]] = call dereferenceable_or_null(4) i8* @malloc(i64 4)
+; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i8* [[N]], [[C:%.*]]
+; CHECK-NEXT:    br i1 [[CMP]], label [[RETST:%.*]], label [[CHK:%.*]]
+; CHECK:       retst:
+; CHECK-NEXT:    ret i8* [[M]]
+; CHECK:       chk:
+; CHECK-NEXT:    [[BC:%.*]] = bitcast i8* [[M]] to i32*
+; CHECK-NEXT:    [[LGP:%.*]] = load i32*, i32** @gp, align 8, !nonnull !0
+; CHECK-NEXT:    [[CMP2:%.*]] = icmp eq i32* [[LGP]], [[BC]]
+; CHECK-NEXT:    br i1 [[CMP2]], label [[RETST]], label [[CHK2:%.*]]
+; CHECK:       chk2:
+; CHECK-NEXT:    ret i8* [[N]]
+;
   %m = call i8* @malloc(i64 4)
   %n = call i8* @malloc(i64 4)
   %cmp = icmp eq i8* %n, %c
   br i1 %cmp, label %retst, label %chk
 
 retst:
   ret i8* %m
 
 chk:
   %bc = bitcast i8* %m to i32*
   %lgp = load i32*, i32** @gp, align 8, !nonnull !0
   %cmp2 = icmp eq i32* %bc, %lgp
   br i1 %cmp2, label %retst,  label %chk2
 
 chk2:
   ret i8* %n
-; CHECK-LABEL: compare_ret_escape
-; CHECK: %cmp = icmp eq i8* %n, %c
-; CHECK: %cmp2 = icmp eq i32* %lgp, %bc
 }
 
 ; The malloc call for %m cannot be elided since it is used in the call to function f.
 ; However, the cmp can be folded to true as %n doesnt escape and %m, %n are distinct allocations
 define i1 @compare_distinct_pointer_escape() {
+; CHECK-LABEL: @compare_distinct_pointer_escape(
+; CHECK-NEXT:    [[M:%.*]] = call dereferenceable_or_null(4) i8* @malloc(i64 4)
+; CHECK-NEXT:    tail call void @f() [ "deopt"(i8* [[M]]) ]
+; CHECK-NEXT:    ret i1 true
+;
   %m = call i8* @malloc(i64 4)
   %n = call i8* @malloc(i64 4)
   tail call void @f() [ "deopt"(i8* %m) ]
   %cmp = icmp ne i8* %m, %n
   ret i1 %cmp
-; CHECK-LABEL: compare_distinct_pointer_escape
-; CHECK-NEXT: %m = call i8* @malloc(i64 4)
-; CHECK-NEXT: tail call void @f() [ "deopt"(i8* %m) ]
-; CHECK-NEXT: ret i1 true
 }
 
 !0 = !{}

llvm/trunk/test/Transforms/InstCombine/deref-alloc-fns.ll

 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias i8* @malloc(i64 %n)
   ret i8* %call
 }
 
 define noalias i8* @malloc_constant_size() {
 ; CHECK-LABEL: @malloc_constant_size(
-; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias i8* @malloc(i64 40)
+; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias dereferenceable_or_null(40) i8* @malloc(i64 40)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias i8* @malloc(i64 40)
   ret i8* %call
 }
 
 define noalias i8* @malloc_constant_size2() {
 ; CHECK-LABEL: @malloc_constant_size2(
 ; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias dereferenceable_or_null(80) i8* @malloc(i64 40)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias dereferenceable_or_null(80) i8* @malloc(i64 40)
   ret i8* %call
 }
 
 define noalias i8* @malloc_constant_size3() {
 ; CHECK-LABEL: @malloc_constant_size3(
-; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias dereferenceable(80) i8* @malloc(i64 40)
+; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias dereferenceable(80) dereferenceable_or_null(40) i8* @malloc(i64 40)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias dereferenceable(80) i8* @malloc(i64 40)
   ret i8* %call
 }
 
 
 define noalias i8* @malloc_constant_zero_size() {

 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias i8* @realloc(i8* %p, i64 0)
   ret i8* %call
 }
 
 define noalias i8* @realloc_constant_size(i8* %p) {
 ; CHECK-LABEL: @realloc_constant_size(
-; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias i8* @realloc(i8* [[P:%.*]], i64 40)
+; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias dereferenceable_or_null(40) i8* @realloc(i8* [[P:%.*]], i64 40)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias i8* @realloc(i8* %p, i64 40)
   ret i8* %call
 }
 
 define noalias i8* @calloc_nonconstant_size(i64 %n) {
 ; CHECK-LABEL: @calloc_nonconstant_size(

 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias i8* @calloc(i64 0, i64 %n)
   ret i8* %call
 }
 
 define noalias i8* @calloc_constant_size() {
 ; CHECK-LABEL: @calloc_constant_size(
-; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias i8* @calloc(i64 16, i64 8)
+; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias dereferenceable_or_null(128) i8* @calloc(i64 16, i64 8)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias i8* @calloc(i64 16, i64 8)
   ret i8* %call
 }
 
 define noalias i8* @calloc_constant_size_overflow() {
 ; CHECK-LABEL: @calloc_constant_size_overflow(
 ; CHECK-NEXT:    [[CALL:%.*]] = tail call noalias i8* @calloc(i64 2000000000000, i64 80000000000)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call noalias i8* @calloc(i64 2000000000000, i64 80000000000)
   ret i8* %call
 }
 
-
 define noalias i8* @op_new_nonconstant_size(i64 %n) {
 ; CHECK-LABEL: @op_new_nonconstant_size(
 ; CHECK-NEXT:    [[CALL:%.*]] = tail call i8* @_Znam(i64 [[N:%.*]])
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call i8* @_Znam(i64 %n)
   ret i8* %call
 }
 
-define noalias i8* @op_new_constant_zero_size() {
-; CHECK-LABEL: @op_new_constant_zero_size(
-; CHECK-NEXT:    [[CALL:%.*]] = tail call i8* @_Znam(i64 40)
+define noalias i8* @op_new_constant_size() {
+; CHECK-LABEL: @op_new_constant_size(
+; CHECK-NEXT:    [[CALL:%.*]] = tail call dereferenceable_or_null(40) i8* @_Znam(i64 40)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call i8* @_Znam(i64 40)
   ret i8* %call
 }
 
-define noalias i8* @op_new_constant_size() {
-; CHECK-LABEL: @op_new_constant_size(
+define noalias i8* @op_new_constant_zero_size() {
+; CHECK-LABEL: @op_new_constant_zero_size(
 ; CHECK-NEXT:    [[CALL:%.*]] = tail call i8* @_Znam(i64 0)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = tail call i8* @_Znam(i64 0)
   ret i8* %call
 }

llvm/trunk/test/Transforms/InstCombine/malloc-free-delete.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt < %s -instcombine -S | FileCheck %s
 ; PR1201
 define i32 @main(i32 %argc, i8** %argv) {
 ; CHECK-LABEL: @main(
-    %c_19 = alloca i8*
-    %malloc_206 = tail call i8* @malloc(i32 mul (i32 ptrtoint (i8* getelementptr (i8, i8* null, i32 1) to i32), i32 10))
-    store i8* %malloc_206, i8** %c_19
-    %tmp_207 = load i8*, i8** %c_19
-    tail call void @free(i8* %tmp_207)
-    ret i32 0
-; CHECK-NEXT: ret i32 0
+; CHECK-NEXT:    ret i32 0
+;
 }
 
 declare noalias i8* @calloc(i32, i32) nounwind
 declare noalias i8* @malloc(i32)
 declare void @free(i8*)
 
 define i1 @foo() {
 ; CHECK-LABEL: @foo(
-; CHECK-NEXT: ret i1 false
+; CHECK-NEXT:    ret i1 false
+;
   %m = call i8* @malloc(i32 1)
   %z = icmp eq i8* %m, null
   call void @free(i8* %m)
   ret i1 %z
 }
 
 declare void @llvm.lifetime.start.p0i8(i64, i8*)
 declare void @llvm.lifetime.end.p0i8(i64, i8*)
 declare i64 @llvm.objectsize.i64(i8*, i1)
 declare void @llvm.memcpy.p0i8.p0i8.i32(i8* nocapture, i8* nocapture, i32, i1) nounwind
 declare void @llvm.memmove.p0i8.p0i8.i32(i8* nocapture, i8* nocapture, i32, i1) nounwind
 declare void @llvm.memset.p0i8.i32(i8*, i8, i32, i1) nounwind
 
 define void @test3(i8* %src) {
 ; CHECK-LABEL: @test3(
-; CHECK-NEXT: ret void
+; CHECK-NEXT:    ret void
+;
   %a = call noalias i8* @malloc(i32 10)
   call void @llvm.lifetime.start.p0i8(i64 10, i8* %a)
   call void @llvm.lifetime.end.p0i8(i64 10, i8* %a)
   %size = call i64 @llvm.objectsize.i64(i8* %a, i1 true)
   store i8 42, i8* %a
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %a, i8* %src, i32 32, i1 false)
   call void @llvm.memmove.p0i8.p0i8.i32(i8* %a, i8* %src, i32 32, i1 false)
   call void @llvm.memset.p0i8.i32(i8* %a, i8 5, i32 32, i1 false)
   %alloc2 = call noalias i8* @calloc(i32 5, i32 7) nounwind
   %z = icmp ne i8* %alloc2, null
   ret void
 }
 
 ;; This used to crash.
 define void @test4() {
 ; CHECK-LABEL: @test4(
-; CHECK-NEXT: ret void
+; CHECK-NEXT:    ret void
+;
   %A = call i8* @malloc(i32 16000)
   %B = bitcast i8* %A to double*
   %C = bitcast double* %B to i8*
   call void @free(i8* %C)
   ret void
 }
 
-; CHECK-LABEL: @test5(
 define void @test5(i8* %ptr, i8** %esc) {
-; CHECK-NEXT: call i8* @malloc
-; CHECK-NEXT: call i8* @malloc
-; CHECK-NEXT: call i8* @malloc
-; CHECK-NEXT: call i8* @malloc
-; CHECK-NEXT: call i8* @malloc
-; CHECK-NEXT: call i8* @malloc
-; CHECK-NEXT: call i8* @malloc
-; CHECK-NEXT: call void @llvm.memcpy
-; CHECK-NEXT: call void @llvm.memmove
-; CHECK-NEXT: store
-; CHECK-NEXT: call void @llvm.memcpy
-; CHECK-NEXT: call void @llvm.memmove
-; CHECK-NEXT: call void @llvm.memset
-; CHECK-NEXT: store volatile
-; CHECK-NEXT: ret
+; CHECK-LABEL: @test5(
+; CHECK-NEXT:    [[A:%.*]] = call dereferenceable_or_null(700) i8* @malloc(i32 700)
+; CHECK-NEXT:    [[B:%.*]] = call dereferenceable_or_null(700) i8* @malloc(i32 700)
+; CHECK-NEXT:    [[C:%.*]] = call dereferenceable_or_null(700) i8* @malloc(i32 700)
+; CHECK-NEXT:    [[D:%.*]] = call dereferenceable_or_null(700) i8* @malloc(i32 700)
+; CHECK-NEXT:    [[E:%.*]] = call dereferenceable_or_null(700) i8* @malloc(i32 700)
+; CHECK-NEXT:    [[F:%.*]] = call dereferenceable_or_null(700) i8* @malloc(i32 700)
+; CHECK-NEXT:    [[G:%.*]] = call dereferenceable_or_null(700) i8* @malloc(i32 700)
+; CHECK-NEXT:    call void @llvm.memcpy.p0i8.p0i8.i32(i8* align 1 dereferenceable(32) [[PTR:%.*]], i8* align 1 dereferenceable(32) [[A]], i32 32, i1 false)
+; CHECK-NEXT:    call void @llvm.memmove.p0i8.p0i8.i32(i8* align 1 dereferenceable(32) [[PTR]], i8* align 1 dereferenceable(32) [[B]], i32 32, i1 false)
+; CHECK-NEXT:    store i8* [[C]], i8** [[ESC:%.*]], align 8
+; CHECK-NEXT:    call void @llvm.memcpy.p0i8.p0i8.i32(i8* [[D]], i8* [[PTR]], i32 32, i1 true)
+; CHECK-NEXT:    call void @llvm.memmove.p0i8.p0i8.i32(i8* [[E]], i8* [[PTR]], i32 32, i1 true)
+; CHECK-NEXT:    call void @llvm.memset.p0i8.i32(i8* [[F]], i8 5, i32 32, i1 true)
+; CHECK-NEXT:    store volatile i8 4, i8* [[G]], align 1
+; CHECK-NEXT:    ret void
+;
   %a = call i8* @malloc(i32 700)
   %b = call i8* @malloc(i32 700)
   %c = call i8* @malloc(i32 700)
   %d = call i8* @malloc(i32 700)
   %e = call i8* @malloc(i32 700)
   %f = call i8* @malloc(i32 700)
   %g = call i8* @malloc(i32 700)
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %ptr, i8* %a, i32 32, i1 false)
   call void @llvm.memmove.p0i8.p0i8.i32(i8* %ptr, i8* %b, i32 32, i1 false)
   store i8* %c, i8** %esc
   call void @llvm.memcpy.p0i8.p0i8.i32(i8* %d, i8* %ptr, i32 32, i1 true)
   call void @llvm.memmove.p0i8.p0i8.i32(i8* %e, i8* %ptr, i32 32, i1 true)
   call void @llvm.memset.p0i8.i32(i8* %f, i8 5, i32 32, i1 true)
   store volatile i8 4, i8* %g
   ret void
 }
 
 ;; When a basic block contains only a call to free and this block is accessed
 ;; through a test of the argument of free against null, move the call in the
 ;; predecessor block.
 ;; Using simplifycfg will remove the empty basic block and the branch operation
 ;; Then, performing a dead elimination will remove the comparison.
 ;; This is what happens with -O1 and upper.
-; CHECK-LABEL: @test6(
 define void @test6(i8* %foo) minsize {
-; CHECK:  %tobool = icmp eq i8* %foo, null
-;; Call to free moved
-; CHECK-NEXT: tail call void @free(i8* %foo)
-; CHECK-NEXT: br i1 %tobool, label %if.end, label %if.then
-; CHECK: if.then:
-;; Block is now empty and may be simplified by simplifycfg
-; CHECK-NEXT:   br label %if.end
-; CHECK: if.end:
-; CHECK-NEXT:  ret void
+; CHECK-LABEL: @test6(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[TOBOOL:%.*]] = icmp eq i8* [[FOO:%.*]], null
+; CHECK-NEXT:    tail call void @free(i8* [[FOO]])
+; CHECK-NEXT:    br i1 [[TOBOOL]], label [[IF_END:%.*]], label [[IF_THEN:%.*]]
+; CHECK:       if.then:
+; CHECK-NEXT:    br label [[IF_END]]
+; CHECK:       if.end:
+; CHECK-NEXT:    ret void
+;
+;; Call to free moved
+;; Block is now empty and may be simplified by simplifycfg
 entry:
   %tobool = icmp eq i8* %foo, null
   br i1 %tobool, label %if.end, label %if.then
 
 if.then:                                          ; preds = %entry
   tail call void @free(i8* %foo)
   br label %if.end
 
 if.end:                                           ; preds = %entry, %if.then
   ret void
 }
 
 declare i8* @_ZnwmRKSt9nothrow_t(i64, i8*) nobuiltin
 declare void @_ZdlPvRKSt9nothrow_t(i8*, i8*) nobuiltin
 declare i32 @__gxx_personality_v0(...)
 declare void @_ZN1AC2Ev(i8* %this)
 
-; CHECK-LABEL: @test7(
 define void @test7() personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
+; CHECK-LABEL: @test7(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    invoke void @_ZN1AC2Ev(i8* undef)
+; CHECK-NEXT:    to label [[DOTNOEXC_I:%.*]] unwind label [[LPAD_I:%.*]]
+; CHECK:       .noexc.i:
+; CHECK-NEXT:    unreachable
+; CHECK:       lpad.i:
+; CHECK-NEXT:    [[TMP0:%.*]] = landingpad { i8*, i32 }
+; CHECK-NEXT:    cleanup
+; CHECK-NEXT:    resume { i8*, i32 } [[TMP0]]
+;
 entry:
   %nt = alloca i8
-  ; CHECK-NOT: call {{.*}}@_ZnwmRKSt9nothrow_t(
   %call.i = tail call i8* @_ZnwmRKSt9nothrow_t(i64 1, i8* %nt) builtin nounwind
   invoke void @_ZN1AC2Ev(i8* undef)
-          to label %.noexc.i unwind label %lpad.i
 
 .noexc.i:                                         ; preds = %entry
   unreachable
 
 lpad.i:                                           ; preds = %entry
   %0 = landingpad { i8*, i32 } cleanup
-  ; CHECK-NOT: call {{.*}}@_ZdlPvRKSt9nothrow_t(
   call void @_ZdlPvRKSt9nothrow_t(i8* %call.i, i8* %nt) builtin nounwind
   resume { i8*, i32 } %0
 }
 
 declare i8* @_Znwm(i64) nobuiltin
 define i8* @_Znwj(i32 %n) nobuiltin {
+; CHECK-LABEL: @_Znwj(
+; CHECK-NEXT:    [[Z:%.*]] = zext i32 [[N:%.*]] to i64
+; CHECK-NEXT:    [[M:%.*]] = call i8* @_Znwm(i64 [[Z]])
+; CHECK-NEXT:    ret i8* [[M]]
+;
   %z = zext i32 %n to i64
   %m = call i8* @_Znwm(i64 %z)
   ret i8* %m
 }
 declare i8* @_Znam(i64) nobuiltin
 declare i8* @_Znaj(i32) nobuiltin
 declare void @_ZdlPv(i8*) nobuiltin
 declare void @_ZdaPv(i8*) nobuiltin
 
 define linkonce void @_ZdlPvm(i8* %p, i64) nobuiltin {
+; CHECK-LABEL: @_ZdlPvm(
+; CHECK-NEXT:    call void @_ZdlPv(i8* [[P:%.*]])
+; CHECK-NEXT:    ret void
+;
   call void @_ZdlPv(i8* %p)
   ret void
 }
 define linkonce void @_ZdlPvj(i8* %p, i32) nobuiltin {
+; CHECK-LABEL: @_ZdlPvj(
+; CHECK-NEXT:    call void @_ZdlPv(i8* [[P:%.*]])
+; CHECK-NEXT:    ret void
+;
   call void @_ZdlPv(i8* %p)
   ret void
 }
 define linkonce void @_ZdaPvm(i8* %p, i64) nobuiltin {
+; CHECK-LABEL: @_ZdaPvm(
+; CHECK-NEXT:    call void @_ZdaPv(i8* [[P:%.*]])
+; CHECK-NEXT:    ret void
+;
   call void @_ZdaPv(i8* %p)
   ret void
 }
 define linkonce void @_ZdaPvj(i8* %p, i32) nobuiltin {
+; CHECK-LABEL: @_ZdaPvj(
+; CHECK-NEXT:    call void @_ZdaPv(i8* [[P:%.*]])
+; CHECK-NEXT:    ret void
+;
   call void @_ZdaPv(i8* %p)
   ret void
 }
 
 
 ; new(size_t, align_val_t)
 declare i8* @_ZnwmSt11align_val_t(i64, i64) nobuiltin
 declare i8* @_ZnwjSt11align_val_t(i32, i32) nobuiltin

 ; delete[](void*, align_val_t)
 declare void @_ZdaPvSt11align_val_t(i8*, i64) nobuiltin
 ; delete(void*, align_val_t, nothrow)
 declare void @_ZdlPvSt11align_val_tRKSt9nothrow_t(i8*, i64, i8*) nobuiltin
 ; delete[](void*, align_val_t, nothrow)
 declare void @_ZdaPvSt11align_val_tRKSt9nothrow_t(i8*, i64, i8*) nobuiltin
 
 
-; CHECK-LABEL: @test8(
 define void @test8() {
-  ; CHECK-NOT: call
+; CHECK-LABEL: @test8(
+; CHECK-NEXT:    ret void
+;
   %nt = alloca i8
   %nw = call i8* @_Znwm(i64 32) builtin
   call void @_ZdlPv(i8* %nw) builtin
   %na = call i8* @_Znam(i64 32) builtin
   call void @_ZdaPv(i8* %na) builtin
   %nwm = call i8* @_Znwm(i64 32) builtin
   call void @_ZdlPvm(i8* %nwm, i64 32) builtin
   %nwj = call i8* @_Znwj(i32 32) builtin
;
   %najat = call i8* @_ZnajSt11align_val_tRKSt9nothrow_t(i32 32, i32 8, i8* %nt) builtin
   call void @_ZdaPvSt11align_val_tRKSt9nothrow_t(i8* %najat, i64 8, i8* %nt) builtin
   ret void
 }
 
 declare noalias i8* @"\01??2@YAPEAX_K@Z"(i64) nobuiltin
 declare void @"\01??3@YAXPEAX@Z"(i8*) nobuiltin
 
-; CHECK-LABEL: @test9(
 define void @test9() {
-  ; CHECK-NOT: call
+; CHECK-LABEL: @test9(
+; CHECK-NEXT:    ret void
+;
   %new_long_long = call noalias i8* @"\01??2@YAPEAX_K@Z"(i64 32) builtin
   call void @"\01??3@YAXPEAX@Z"(i8* %new_long_long) builtin
   ret void
 }
 
 define void @test10()  {
-; CHECK-LABEL: @test10
-; CHECK: call void @_ZdlPv
+; CHECK-LABEL: @test10(
+; CHECK-NEXT:    call void @_ZdlPv(i8* null)
+; CHECK-NEXT:    ret void
+;
   call void @_ZdlPv(i8* null)
   ret void
 }
 
 define void @test11() {
-; CHECK-LABEL: @test11
-; CHECK: call i8* @_Znwm
-; CHECK: call void @_ZdlPv
+; CHECK-LABEL: @test11(
+; CHECK-NEXT:    [[CALL:%.*]] = call dereferenceable_or_null(8) i8* @_Znwm(i64 8) #5
+; CHECK-NEXT:    call void @_ZdlPv(i8* [[CALL]])
+; CHECK-NEXT:    ret void
+;
   %call = call i8* @_Znwm(i64 8) builtin
   call void @_ZdlPv(i8* %call)
   ret void
 }
 
 ;; Check that the optimization that moves a call to free in its predecessor
 ;; block (see test6) also happens when noop casts are involved.
-; CHECK-LABEL: @test12(
 define void @test12(i32* %foo) minsize {
-; CHECK:  %tobool = icmp eq i32* %foo, null
-;; Everything before the call to free should have been moved as well.
-; CHECK-NEXT:   %bitcast = bitcast i32* %foo to i8*
-;; Call to free moved
-; CHECK-NEXT: tail call void @free(i8* %bitcast)
-; CHECK-NEXT: br i1 %tobool, label %if.end, label %if.then
-; CHECK: if.then:
-;; Block is now empty and may be simplified by simplifycfg
-; CHECK-NEXT:   br label %if.end
-; CHECK: if.end:
-; CHECK-NEXT:  ret void
+; CHECK-LABEL: @test12(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[TOBOOL:%.*]] = icmp eq i32* [[FOO:%.*]], null
+; CHECK-NEXT:    [[BITCAST:%.*]] = bitcast i32* [[FOO]] to i8*
+; CHECK-NEXT:    tail call void @free(i8* [[BITCAST]])
+; CHECK-NEXT:    br i1 [[TOBOOL]], label [[IF_END:%.*]], label [[IF_THEN:%.*]]
+; CHECK:       if.then:
+; CHECK-NEXT:    br label [[IF_END]]
+; CHECK:       if.end:
+; CHECK-NEXT:    ret void
+;
+;; Everything before the call to free should have been moved as well.
+;; Call to free moved
+;; Block is now empty and may be simplified by simplifycfg
 entry:
   %tobool = icmp eq i32* %foo, null
   br i1 %tobool, label %if.end, label %if.then
 
 if.then:                                          ; preds = %entry
   %bitcast = bitcast i32* %foo to i8*
   tail call void @free(i8* %bitcast)
   br label %if.end
 
 if.end:                                           ; preds = %entry, %if.then
   ret void
 }
 

llvm/trunk/test/Transforms/InstCombine/objsize.ll

 }
 
 ; rdar://7782496
 @s = external global i8*
 
 define i8* @test5(i32 %n) nounwind ssp {
 ; CHECK-LABEL: @test5(
 ; CHECK-NEXT:  entry:
-; CHECK-NEXT:    [[TMP0:%.*]] = tail call noalias i8* @malloc(i32 20) #0
+; CHECK-NEXT:    [[TMP0:%.*]] = tail call noalias dereferenceable_or_null(20) i8* @malloc(i32 20) #0
 ; CHECK-NEXT:    [[TMP1:%.*]] = load i8*, i8** @s, align 8
 ; CHECK-NEXT:    call void @llvm.memcpy.p0i8.p0i8.i32(i8* align 1 dereferenceable(10) [[TMP0]], i8* align 1 dereferenceable(10) [[TMP1]], i32 10, i1 false)
 ; CHECK-NEXT:    ret i8* [[TMP0]]
 ;
 entry:
   %0 = tail call noalias i8* @malloc(i32 20) nounwind
   %1 = tail call i32 @llvm.objectsize.i32.p0i8(i8* %0, i1 false, i1 false, i1 false)
   %2 = load i8*, i8** @s, align 8
   %3 = tail call i8* @__memcpy_chk(i8* %0, i8* %2, i32 10, i32 %1) nounwind
   ret i8* %0
 }
 
 define void @test6(i32 %n) nounwind ssp {
 ; CHECK-LABEL: @test6(
 ; CHECK-NEXT:  entry:
-; CHECK-NEXT:    [[TMP0:%.*]] = tail call noalias i8* @malloc(i32 20) #0
+; CHECK-NEXT:    [[TMP0:%.*]] = tail call noalias dereferenceable_or_null(20) i8* @malloc(i32 20) #0
 ; CHECK-NEXT:    [[TMP1:%.*]] = load i8*, i8** @s, align 8
 ; CHECK-NEXT:    [[TMP2:%.*]] = tail call i8* @__memcpy_chk(i8* [[TMP0]], i8* [[TMP1]], i32 30, i32 20) #0
 ; CHECK-NEXT:    ret void
 ;
 entry:
   %0 = tail call noalias i8* @malloc(i32 20) nounwind
   %1 = tail call i32 @llvm.objectsize.i32.p0i8(i8* %0, i1 false, i1 false, i1 false)
   %2 = load i8*, i8** @s, align 8
   %3 = tail call i8* @__memcpy_chk(i8* %0, i8* %2, i32 30, i32 %1) nounwind
   ret void
 }
 
 declare i8* @__memset_chk(i8*, i32, i32, i32) nounwind
 
 declare noalias i8* @malloc(i32) nounwind
 
 define i32 @test7(i8** %esc) {
 ; CHECK-LABEL: @test7(
-; CHECK-NEXT:    [[ALLOC:%.*]] = call noalias i8* @malloc(i32 48) #0
+; CHECK-NEXT:    [[ALLOC:%.*]] = call noalias dereferenceable_or_null(48) i8* @malloc(i32 48) #0
 ; CHECK-NEXT:    store i8* [[ALLOC]], i8** [[ESC:%.*]], align 4
 ; CHECK-NEXT:    ret i32 32
 ;
   %alloc = call noalias i8* @malloc(i32 48) nounwind
   store i8* %alloc, i8** %esc
   %gep = getelementptr inbounds i8, i8* %alloc, i32 16
   %objsize = call i32 @llvm.objectsize.i32.p0i8(i8* %gep, i1 false, i1 false, i1 false) nounwind readonly
   ret i32 %objsize
 }
 
 declare noalias i8* @calloc(i32, i32) nounwind
 
 define i32 @test8(i8** %esc) {
 ; CHECK-LABEL: @test8(
-; CHECK-NEXT:    [[ALLOC:%.*]] = call noalias i8* @calloc(i32 5, i32 7) #0
+; CHECK-NEXT:    [[ALLOC:%.*]] = call noalias dereferenceable_or_null(35) i8* @calloc(i32 5, i32 7) #0
 ; CHECK-NEXT:    store i8* [[ALLOC]], i8** [[ESC:%.*]], align 4
 ; CHECK-NEXT:    ret i32 30
 ;
   %alloc = call noalias i8* @calloc(i32 5, i32 7) nounwind
   store i8* %alloc, i8** %esc
   %gep = getelementptr inbounds i8, i8* %alloc, i32 5
   %objsize = call i32 @llvm.objectsize.i32.p0i8(i8* %gep, i1 false, i1 false, i1 false) nounwind readonly
   ret i32 %objsize

llvm/trunk/test/Transforms/InstCombine/realloc.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt < %s -instcombine -S | FileCheck %s
 
 declare i8* @realloc(i8*, i64) #1
 declare noalias i8* @malloc(i64) #1
 
 
 define i8* @realloc_null_ptr() #0 {
 ; CHECK-LABEL: @realloc_null_ptr(
-; CHECK-NEXT:    [[MALLOC:%.*]] = call i8* @malloc(i64 100)
+; CHECK-NEXT:    [[MALLOC:%.*]] = call dereferenceable_or_null(100) i8* @malloc(i64 100)
 ; CHECK-NEXT:    ret i8* [[MALLOC]]
 ;
   %call = call i8* @realloc(i8* null, i64 100) #2
   ret i8* %call
 }
 
 define i8* @realloc_unknown_ptr(i8* %ptr) #0 {
 ; CHECK-LABEL: @realloc_unknown_ptr(
-; CHECK-NEXT:    [[CALL:%.*]] = call i8* @realloc(i8* [[PTR:%.*]], i64 100)
+; CHECK-NEXT:    [[CALL:%.*]] = call dereferenceable_or_null(100) i8* @realloc(i8* [[PTR:%.*]], i64 100)
 ; CHECK-NEXT:    ret i8* [[CALL]]
 ;
   %call = call i8* @realloc(i8* %ptr, i64 100) #2
   ret i8* %call
 }