recognize more alloc fns
MODIFY
ir/instr.cpp
ir/instr.cpp
@@ -2349,8 +2349,12 @@ StateValue FnCall::toSMT(State &s) const {
m.copy(ptr_old, Pointer(m, p_new));
// 1) realloc(ptr, 0) always free the ptr.
- // 2) If allocation failed, we should not free previous ptr.
- m.free(expr::mkIf(size == 0 || allocated, allocptr, nullp), false);
+ // 2) If allocation failed, we should not free previous ptr, unless it's
+ // reallocf (always frees the pointer)
+ expr freeptr = getName() == "reallocf"
+ ? allocptr
+ : expr::mkIf(size == 0 || allocated, allocptr, nullp);
+ m.free(freeptr, false);
}
// FIXME: for a realloc that zeroes the new stuff

MODIFY
llvm_util/known_fns.cpp
llvm_util/known_fns.cpp
@@ -70,6 +70,17 @@ static bool implict_attrs_(llvm::LibFunc libfn, FnAttrs &attrs,
attrs.add(AllocKind::Uninitialized);
RETURN_EXACT();
+ case llvm::LibFunc_aligned_alloc:
+ case llvm::LibFunc_memalign:
+ alloc_fns(1);
+ attrs.set(FnAttrs::NoThrow);
+ attrs.set(FnAttrs::NoFree);
+ attrs.allocfamily = "malloc";
+ attrs.add(AllocKind::Alloc);
+ attrs.add(AllocKind::Uninitialized);
+ set_param(0, ParamAttrs::AllocAlign);
+ RETURN_EXACT();
+
case llvm::LibFunc_calloc:
alloc_fns(0, 1);
attrs.set(FnAttrs::NoThrow);
@@ -80,6 +91,7 @@ static bool implict_attrs_(llvm::LibFunc libfn, FnAttrs &attrs,
RETURN_EXACT();
case llvm::LibFunc_realloc:
+ case llvm::LibFunc_reallocf:
alloc_fns(1);
attrs.set(FnAttrs::NoThrow);
attrs.allocfamily = "malloc";
@@ -99,7 +111,8 @@ static bool implict_attrs_(llvm::LibFunc libfn, FnAttrs &attrs,
set_param(0, ParamAttrs::AllocPtr);
RETURN_EXACT();
- case llvm::LibFunc_Znwm:
+ case llvm::LibFunc_Znwj: // new(unsigned int)
+ case llvm::LibFunc_Znwm: // new(unsigned long)
alloc_fns(0);
attrs.set(FnAttrs::NoFree);
attrs.allocfamily = "_Znwm";
@@ -107,6 +120,47 @@ static bool implict_attrs_(llvm::LibFunc libfn, FnAttrs &attrs,
attrs.add(AllocKind::Uninitialized);
RETURN_EXACT();
+ case llvm::LibFunc_vec_malloc:
+ alloc_fns(0);
+ attrs.set(FnAttrs::NoThrow);
+ attrs.set(FnAttrs::NoFree);
+ attrs.allocfamily = "vecmalloc";
+ attrs.add(AllocKind::Alloc);
+ attrs.add(AllocKind::Uninitialized);
+ set_align(16);
+ RETURN_EXACT();
+
+ case llvm::LibFunc_vec_calloc:
+ alloc_fns(0, 1);
+ attrs.set(FnAttrs::NoThrow);
+ attrs.set(FnAttrs::NoFree);
+ attrs.allocfamily = "vecmalloc";
+ attrs.add(AllocKind::Alloc);
+ attrs.add(AllocKind::Zeroed);
+ set_align(16);
+ RETURN_EXACT();
+
+ case llvm::LibFunc_vec_realloc:
+ alloc_fns(1);
+ attrs.set(FnAttrs::NoThrow);
+ attrs.allocfamily = "vecmalloc";
+ attrs.add(AllocKind::Realloc);
+ attrs.add(AllocKind::Uninitialized);
+ set_param(0, ParamAttrs::AllocPtr);
+ set_param(0, ParamAttrs::NoCapture);
+ set_align(16);
+ RETURN_EXACT();
+
+ case llvm::LibFunc_vec_free:
+ ret_and_args_no_undef();
+ attrs.set(FnAttrs::InaccessibleMemOnly);
+ attrs.set(FnAttrs::NoThrow);
+ attrs.set(FnAttrs::WillReturn);
+ attrs.allocfamily = "vecmalloc";
+ attrs.add(AllocKind::Free);
+ set_param(0, ParamAttrs::AllocPtr);
+ RETURN_EXACT();
+
case llvm::LibFunc_fwrite:
case llvm::LibFunc_fwrite_unlocked:
case llvm::LibFunc_fread:

recognize more alloc fns