to address the points in order: 1. a specific optimisation pass won't do this, but the combination of several passes written with other intentions can 2 & 3.

to address the points in order: 1. a specific optimisation pass won't do this, but the combination of several passes written with other intentions can 2 & 3. the C runtime a compiler links with is known to the compiler/linker, and it _does_ usually treat intrinsics like malloc specially A quick google reveals https://github.com/llvm/llvm-project/issues/52930 https://github.com/llvm/llvm-project/issues/52930, LLVM recognising uninitialised memory as 'undef', and needing to treat it as poisoned (IIRC propogation of undef can cause things like separate uses of the variable to not even unify to a single value) EDIT: duplicated link