What improvements does GCC's `__builtin_malloc()` provide over plain `malloc()`? - c

Question

I have recently been made aware of GCC's built-in functions for some of the C library's memory management functions, specifically __builtin_malloc() and related built-ins (see https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html). Upon learning about __builtin_malloc(), I was wondering how it might work to provide performance improvements over the plain malloc() related library routines.
For example, if the function succeeds, it has to provide a block that can be freed by a call to plain free() since the pointer might be freed by a module that was compiled without __builtin_malloc() or __builtin_free() enabled (or am I wrong about this,and if __builtin_malloc() is used, the builtins must be globally used?). Therefore the allocated object has to be something that can be managed with the data structures that plain malloc() and free() deal with.
I can't find any details of how __builtin_malloc() works or what it does exactly (I'm not a compiler dev, so spelunking through GCC source code isn't in my wheelhouse). In some simple tests where I've tried calling __builtin_malloc() directly, it simply ends up being emitted in the object code as a call to plain malloc(). However, there might be subtlety or platform detail that I'm not providing in these simple tests.
What kinds of performance improvements can __builtin_malloc() provide over a call to plain malloc()? Does __builtin_malloc() have a dependency on the rather complex data structures that glibc's malloc() implementation use? Or conversely, does glibc's malloc()/free() have some code to deal with blocks that might be allocated by __builtin_malloc()?
Basically, how does it work?

Answer 1

I believe there is no special GCC-internal implementation of __builtin_malloc(). Rather, it exists as a builtin only so it can be optimized away under certain circumstances.
Take this example:
#include <stdlib.h>
int main(void)
{
int *p = malloc(4);
*p = 7;
free(p);
return 0;
}
If we disable builtins (with -fno-builtins) and look at the generated output:
$ gcc -fno-builtins -O1 -Wall -Wextra builtin_malloc.c && objdump -d -Mintel a.out
0000000000400580 <main>:
400580: 48 83 ec 08 sub rsp,0x8
400584: bf 04 00 00 00 mov edi,0x4
400589: e8 f2 fe ff ff call 400480 <malloc#plt>
40058e: c7 00 07 00 00 00 mov DWORD PTR [rax],0x7
400594: 48 89 c7 mov rdi,rax
400597: e8 b4 fe ff ff call 400450 <free#plt>
40059c: b8 00 00 00 00 mov eax,0x0
4005a1: 48 83 c4 08 add rsp,0x8
4005a5: c3 ret
Calls to malloc/free are emitted, as expected.
However, by allowing malloc to be a builtin,
$ gcc -O1 -Wall -Wextra builtin_malloc.c && objdump -d -Mintel a.out
00000000004004f0 <main>:
4004f0: b8 00 00 00 00 mov eax,0x0
4004f5: c3 ret
All of main() was optimized away!
Essentially, by allowing malloc to be a builtin, GCC is free to eliminate calls if its result is never used, because there are no additional side-effects.
It's the same mechanism that allows "wasteful" calls to printf to be changed to calls to puts:
#include <stdio.h>
int main(void)
{
printf("hello\n");
return 0;
}
Builtins disabled:
$ gcc -fno-builtin -O1 -Wall builtin_printf.c && objdump -d -Mintel a.out
0000000000400530 <main>:
400530: 48 83 ec 08 sub rsp,0x8
400534: bf e0 05 40 00 mov edi,0x4005e0
400539: b8 00 00 00 00 mov eax,0x0
40053e: e8 cd fe ff ff call 400410 <printf#plt>
400543: b8 00 00 00 00 mov eax,0x0
400548: 48 83 c4 08 add rsp,0x8
40054c: c3 ret
Builtins enabled:
gcc -O1 -Wall builtin_printf.c && objdump -d -Mintel a.out
0000000000400530 <main>:
400530: 48 83 ec 08 sub rsp,0x8
400534: bf e0 05 40 00 mov edi,0x4005e0
400539: e8 d2 fe ff ff call 400410 <puts#plt>
40053e: b8 00 00 00 00 mov eax,0x0
400543: 48 83 c4 08 add rsp,0x8
400547: c3 ret