__attribute__((alloc_size(1,2)))

JEMALLOC_ALWAYS_INLINE bool
compute_size_with_overflow(bool may_overflow, dynamic_opts_t *dopts,
    size_t *size) {
        /*
         * This function is just num_items * item_size, except that we may have
         * to check for overflow.
         */

        if (!may_overflow) {
                assert(dopts->num_items == 1);
                *size = dopts->item_size;
                return false;
        }

        /* A size_t with its high-half bits all set to 1. */
        const static size_t high_bits = SIZE_T_MAX << (sizeof(size_t) * 8 / 2);

        *size = dopts->item_size * dopts->num_items;

        if (unlikely(*size == 0)) {
                return (dopts->num_items != 0 && dopts->item_size != 0);
        }

        /*
         * We got a non-zero size, but we don't know if we overflowed to get
         * there.  To avoid having to do a divide, we'll be clever and note that
         * if both A and B can be represented in N/2 bits, then their product
         * can be represented in N bits (without the possibility of overflow).
         */
        if (likely((high_bits & (dopts->num_items | dopts->item_size)) == 0)) {
                return false;
        }
        if (likely(*size / dopts->item_size == dopts->num_items)) {
                return false;
        }
        return true;
}

/*
 * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
 * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
 */
#define MUL_NO_OVERFLOW	(1UL << (sizeof(size_t) * 4))

void *
mallocarray(size_t nmemb, size_t size, int type, int flags)
{
	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
	    nmemb > 0 && SIZE_MAX / nmemb < size) {
		if (flags & M_CANFAIL)
			return (NULL);
		panic("mallocarray: overflow %zu * %zu", nmemb, size);
	}
	return (malloc(size * nmemb, type, flags));
}