Line data Source code
1 : //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
2 : //
3 : // The LLVM Compiler Infrastructure
4 : //
5 : // This file is distributed under the University of Illinois Open Source
6 : // License. See LICENSE.TXT for details.
7 : //
8 : //===----------------------------------------------------------------------===//
9 : //
10 : // This simple pass provides alias and mod/ref information for global values
11 : // that do not have their address taken, and keeps track of whether functions
12 : // read or write memory (are "pure"). For this simple (but very common) case,
13 : // we can provide pretty accurate and useful information.
14 : //
15 : //===----------------------------------------------------------------------===//
16 :
17 : #include "llvm/Analysis/GlobalsModRef.h"
18 : #include "llvm/ADT/SCCIterator.h"
19 : #include "llvm/ADT/SmallPtrSet.h"
20 : #include "llvm/ADT/Statistic.h"
21 : #include "llvm/Analysis/MemoryBuiltins.h"
22 : #include "llvm/Analysis/ValueTracking.h"
23 : #include "llvm/IR/DerivedTypes.h"
24 : #include "llvm/IR/InstIterator.h"
25 : #include "llvm/IR/Instructions.h"
26 : #include "llvm/IR/IntrinsicInst.h"
27 : #include "llvm/IR/Module.h"
28 : #include "llvm/Pass.h"
29 : #include "llvm/Support/CommandLine.h"
30 : using namespace llvm;
31 :
32 : #define DEBUG_TYPE "globalsmodref-aa"
33 :
34 : STATISTIC(NumNonAddrTakenGlobalVars,
35 : "Number of global vars without address taken");
36 : STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
37 : STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
38 : STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
39 : STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
40 :
41 : // An option to enable unsafe alias results from the GlobalsModRef analysis.
42 : // When enabled, GlobalsModRef will provide no-alias results which in extremely
43 : // rare cases may not be conservatively correct. In particular, in the face of
44 : // transforms which cause assymetry between how effective GetUnderlyingObject
45 : // is for two pointers, it may produce incorrect results.
46 : //
47 : // These unsafe results have been returned by GMR for many years without
48 : // causing significant issues in the wild and so we provide a mechanism to
49 : // re-enable them for users of LLVM that have a particular performance
50 : // sensitivity and no known issues. The option also makes it easy to evaluate
51 : // the performance impact of these results.
52 77660 : static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults(
53 77660 : "enable-unsafe-globalsmodref-alias-results", cl::init(false), cl::Hidden);
54 :
55 : /// The mod/ref information collected for a particular function.
56 : ///
57 : /// We collect information about mod/ref behavior of a function here, both in
58 : /// general and as pertains to specific globals. We only have this detailed
59 : /// information when we know *something* useful about the behavior. If we
60 : /// saturate to fully general mod/ref, we remove the info for the function.
61 : class GlobalsModRef::FunctionInfo {
62 : typedef SmallDenseMap<const GlobalValue *, ModRefInfo, 16> GlobalInfoMapType;
63 :
64 : /// Build a wrapper struct that has 8-byte alignment. All heap allocations
65 : /// should provide this much alignment at least, but this makes it clear we
66 : /// specifically rely on this amount of alignment.
67 24 : struct LLVM_ALIGNAS(8) AlignedMap {
68 12 : AlignedMap() {}
69 0 : AlignedMap(const AlignedMap &Arg) : Map(Arg.Map) {}
70 : GlobalInfoMapType Map;
71 : };
72 :
73 : /// Pointer traits for our aligned map.
74 : struct AlignedMapPointerTraits {
75 : static inline void *getAsVoidPointer(AlignedMap *P) { return P; }
76 : static inline AlignedMap *getFromVoidPointer(void *P) {
77 : return (AlignedMap *)P;
78 : }
79 : enum { NumLowBitsAvailable = 3 };
80 : static_assert(AlignOf<AlignedMap>::Alignment >= (1 << NumLowBitsAvailable),
81 : "AlignedMap insufficiently aligned to have enough low bits.");
82 : };
83 :
84 : /// The bit that flags that this function may read any global. This is
85 : /// chosen to mix together with ModRefInfo bits.
86 : enum { MayReadAnyGlobal = 4 };
87 :
88 : /// Checks to document the invariants of the bit packing here.
89 : static_assert((MayReadAnyGlobal & MRI_ModRef) == 0,
90 : "ModRef and the MayReadAnyGlobal flag bits overlap.");
91 : static_assert(((MayReadAnyGlobal | MRI_ModRef) >>
92 : AlignedMapPointerTraits::NumLowBitsAvailable) == 0,
93 : "Insufficient low bits to store our flag and ModRef info.");
94 :
95 : public:
96 64 : FunctionInfo() : Info() {}
97 256 : ~FunctionInfo() {
98 268 : delete Info.getPointer();
99 128 : }
100 : // Spell out the copy ond move constructors and assignment operators to get
101 : // deep copy semantics and correct move semantics in the face of the
102 : // pointer-int pair.
103 : FunctionInfo(const FunctionInfo &Arg)
104 : : Info(nullptr, Arg.Info.getInt()) {
105 : if (const auto *ArgPtr = Arg.Info.getPointer())
106 : Info.setPointer(new AlignedMap(*ArgPtr));
107 : }
108 : FunctionInfo(FunctionInfo &&Arg)
109 192 : : Info(Arg.Info.getPointer(), Arg.Info.getInt()) {
110 64 : Arg.Info.setPointerAndInt(nullptr, 0);
111 : }
112 0 : FunctionInfo &operator=(const FunctionInfo &RHS) {
113 0 : delete Info.getPointer();
114 0 : Info.setPointerAndInt(nullptr, RHS.Info.getInt());
115 0 : if (const auto *RHSPtr = RHS.Info.getPointer())
116 0 : Info.setPointer(new AlignedMap(*RHSPtr));
117 0 : return *this;
118 : }
119 : FunctionInfo &operator=(FunctionInfo &&RHS) {
120 : delete Info.getPointer();
121 : Info.setPointerAndInt(RHS.Info.getPointer(), RHS.Info.getInt());
122 : RHS.Info.setPointerAndInt(nullptr, 0);
123 : return *this;
124 : }
125 :
126 : /// Returns the \c ModRefInfo info for this function.
127 : ModRefInfo getModRefInfo() const {
128 565 : return ModRefInfo(Info.getInt() & MRI_ModRef);
129 : }
130 :
131 : /// Adds new \c ModRefInfo for this function to its state.
132 : void addModRefInfo(ModRefInfo NewMRI) {
133 130 : Info.setInt(Info.getInt() | NewMRI);
134 : }
135 :
136 : /// Returns whether this function may read any global variable, and we don't
137 : /// know which global.
138 32 : bool mayReadAnyGlobal() const { return Info.getInt() & MayReadAnyGlobal; }
139 :
140 : /// Sets this function as potentially reading from any global.
141 6 : void setMayReadAnyGlobal() { Info.setInt(Info.getInt() | MayReadAnyGlobal); }
142 :
143 : /// Returns the \c ModRefInfo info for this function w.r.t. a particular
144 : /// global, which may be more precise than the general information above.
145 3 : ModRefInfo getModRefInfoForGlobal(const GlobalValue &GV) const {
146 3 : ModRefInfo GlobalMRI = mayReadAnyGlobal() ? MRI_Ref : MRI_NoModRef;
147 6 : if (AlignedMap *P = Info.getPointer()) {
148 0 : auto I = P->Map.find(&GV);
149 0 : if (I != P->Map.end())
150 0 : GlobalMRI = ModRefInfo(GlobalMRI | I->second);
151 : }
152 3 : return GlobalMRI;
153 : }
154 :
155 : /// Add mod/ref info from another function into ours, saturating towards
156 : /// MRI_ModRef.
157 13 : void addFunctionInfo(const FunctionInfo &FI) {
158 26 : addModRefInfo(FI.getModRefInfo());
159 :
160 13 : if (FI.mayReadAnyGlobal())
161 : setMayReadAnyGlobal();
162 :
163 26 : if (AlignedMap *P = FI.Info.getPointer())
164 0 : for (const auto &G : P->Map)
165 0 : addModRefInfoForGlobal(*G.first, G.second);
166 13 : }
167 :
168 20 : void addModRefInfoForGlobal(const GlobalValue &GV, ModRefInfo NewMRI) {
169 40 : AlignedMap *P = Info.getPointer();
170 20 : if (!P) {
171 24 : P = new AlignedMap();
172 12 : Info.setPointer(P);
173 : }
174 40 : auto &GlobalMRI = P->Map[&GV];
175 20 : GlobalMRI = ModRefInfo(GlobalMRI | NewMRI);
176 20 : }
177 :
178 : /// Clear a global's ModRef info. Should be used when a global is being
179 : /// deleted.
180 : void eraseModRefInfoForGlobal(const GlobalValue &GV) {
181 0 : if (AlignedMap *P = Info.getPointer())
182 0 : P->Map.erase(&GV);
183 : }
184 :
185 : private:
186 : /// All of the information is encoded into a single pointer, with a three bit
187 : /// integer in the low three bits. The high bit provides a flag for when this
188 : /// function may read any global. The low two bits are the ModRefInfo. And
189 : /// the pointer, when non-null, points to a map from GlobalValue to
190 : /// ModRefInfo specific to that GlobalValue.
191 : PointerIntPair<AlignedMap *, 3, unsigned, AlignedMapPointerTraits> Info;
192 : };
193 :
194 0 : void GlobalsModRef::DeletionCallbackHandle::deleted() {
195 0 : Value *V = getValPtr();
196 0 : if (auto *F = dyn_cast<Function>(V))
197 0 : GMR.FunctionInfos.erase(F);
198 :
199 0 : if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
200 0 : if (GMR.NonAddressTakenGlobals.erase(GV)) {
201 : // This global might be an indirect global. If so, remove it and
202 : // remove any AllocRelatedValues for it.
203 0 : if (GMR.IndirectGlobals.erase(GV)) {
204 : // Remove any entries in AllocsForIndirectGlobals for this global.
205 0 : for (auto I = GMR.AllocsForIndirectGlobals.begin(),
206 0 : E = GMR.AllocsForIndirectGlobals.end();
207 : I != E; ++I)
208 0 : if (I->second == GV)
209 0 : GMR.AllocsForIndirectGlobals.erase(I);
210 : }
211 :
212 : // Scan the function info we have collected and remove this global
213 : // from all of them.
214 0 : for (auto &FIPair : GMR.FunctionInfos)
215 0 : FIPair.second.eraseModRefInfoForGlobal(*GV);
216 : }
217 : }
218 :
219 : // If this is an allocation related to an indirect global, remove it.
220 0 : GMR.AllocsForIndirectGlobals.erase(V);
221 :
222 : // And clear out the handle.
223 0 : setValPtr(nullptr);
224 0 : GMR.Handles.erase(I);
225 : // This object is now destroyed!
226 0 : }
227 :
228 : char GlobalsModRef::ID = 0;
229 3924 : INITIALIZE_AG_PASS_BEGIN(GlobalsModRef, AliasAnalysis, "globalsmodref-aa",
230 : "Simple mod/ref analysis for globals", false, true,
231 : false)
232 3924 : INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
233 15730 : INITIALIZE_AG_PASS_END(GlobalsModRef, AliasAnalysis, "globalsmodref-aa",
234 : "Simple mod/ref analysis for globals", false, true,
235 : false)
236 :
237 20 : Pass *llvm::createGlobalsModRefPass() { return new GlobalsModRef(); }
238 :
239 238 : GlobalsModRef::GlobalsModRef() : ModulePass(ID) {
240 34 : initializeGlobalsModRefPass(*PassRegistry::getPassRegistry());
241 34 : }
242 :
243 52 : FunctionModRefBehavior GlobalsModRef::getModRefBehavior(const Function *F) {
244 52 : FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
245 :
246 52 : if (FunctionInfo *FI = getFunctionInfo(F)) {
247 23 : if (FI->getModRefInfo() == MRI_NoModRef)
248 : Min = FMRB_DoesNotAccessMemory;
249 10 : else if ((FI->getModRefInfo() & MRI_Mod) == 0)
250 6 : Min = FMRB_OnlyReadsMemory;
251 : }
252 :
253 52 : return FunctionModRefBehavior(AliasAnalysis::getModRefBehavior(F) & Min);
254 : }
255 :
256 52 : FunctionModRefBehavior GlobalsModRef::getModRefBehavior(ImmutableCallSite CS) {
257 52 : FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
258 :
259 52 : if (const Function *F = CS.getCalledFunction())
260 52 : if (FunctionInfo *FI = getFunctionInfo(F)) {
261 23 : if (FI->getModRefInfo() == MRI_NoModRef)
262 : Min = FMRB_DoesNotAccessMemory;
263 10 : else if ((FI->getModRefInfo() & MRI_Mod) == 0)
264 6 : Min = FMRB_OnlyReadsMemory;
265 : }
266 :
267 52 : return FunctionModRefBehavior(AliasAnalysis::getModRefBehavior(CS) & Min);
268 : }
269 :
270 : /// Returns the function info for the function, or null if we don't have
271 : /// anything useful to say about it.
272 130 : GlobalsModRef::FunctionInfo *GlobalsModRef::getFunctionInfo(const Function *F) {
273 130 : auto I = FunctionInfos.find(F);
274 390 : if (I != FunctionInfos.end())
275 62 : return &I->second;
276 : return nullptr;
277 : }
278 :
279 : /// AnalyzeGlobals - Scan through the users of all of the internal
280 : /// GlobalValue's in the program. If none of them have their "address taken"
281 : /// (really, their address passed to something nontrivial), record this fact,
282 : /// and record the functions that they are used directly in.
283 34 : void GlobalsModRef::AnalyzeGlobals(Module &M) {
284 : SmallPtrSet<Function *, 64> TrackedFunctions;
285 102 : for (Function &F : M)
286 128 : if (F.hasLocalLinkage())
287 7 : if (!AnalyzeUsesOfPointer(&F)) {
288 : // Remember that we are tracking this global.
289 0 : NonAddressTakenGlobals.insert(&F);
290 0 : TrackedFunctions.insert(&F);
291 0 : Handles.emplace_front(*this, &F);
292 0 : Handles.front().I = Handles.begin();
293 : ++NumNonAddrTakenFunctions;
294 : }
295 :
296 136 : SmallPtrSet<Function *, 64> Readers, Writers;
297 34 : for (GlobalVariable &GV : M.globals())
298 44 : if (GV.hasLocalLinkage()) {
299 11 : if (!AnalyzeUsesOfPointer(&GV, &Readers,
300 : GV.isConstant() ? nullptr : &Writers)) {
301 : // Remember that we are tracking this global, and the mod/ref fns
302 8 : NonAddressTakenGlobals.insert(&GV);
303 16 : Handles.emplace_front(*this, &GV);
304 24 : Handles.front().I = Handles.begin();
305 :
306 36 : for (Function *Reader : Readers) {
307 10 : if (TrackedFunctions.insert(Reader).second) {
308 9 : Handles.emplace_front(*this, Reader);
309 27 : Handles.front().I = Handles.begin();
310 : }
311 20 : FunctionInfos[Reader].addModRefInfoForGlobal(GV, MRI_Ref);
312 : }
313 :
314 8 : if (!GV.isConstant()) // No need to keep track of writers to constants
315 36 : for (Function *Writer : Writers) {
316 10 : if (TrackedFunctions.insert(Writer).second) {
317 3 : Handles.emplace_front(*this, Writer);
318 9 : Handles.front().I = Handles.begin();
319 : }
320 20 : FunctionInfos[Writer].addModRefInfoForGlobal(GV, MRI_Mod);
321 : }
322 : ++NumNonAddrTakenGlobalVars;
323 :
324 : // If this global holds a pointer type, see if it is an indirect global.
325 32 : if (GV.getType()->getElementType()->isPointerTy() &&
326 2 : AnalyzeIndirectGlobalMemory(&GV))
327 : ++NumIndirectGlobalVars;
328 : }
329 11 : Readers.clear();
330 11 : Writers.clear();
331 : }
332 34 : }
333 :
334 : /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
335 : /// If this is used by anything complex (i.e., the address escapes), return
336 : /// true. Also, while we are at it, keep track of those functions that read and
337 : /// write to the value.
338 : ///
339 : /// If OkayStoreDest is non-null, stores into this global are allowed.
340 32 : bool GlobalsModRef::AnalyzeUsesOfPointer(Value *V,
341 : SmallPtrSetImpl<Function *> *Readers,
342 : SmallPtrSetImpl<Function *> *Writers,
343 : GlobalValue *OkayStoreDest) {
344 64 : if (!V->getType()->isPointerTy())
345 : return true;
346 :
347 32 : for (Use &U : V->uses()) {
348 45 : User *I = U.getUser();
349 45 : if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
350 14 : if (Readers)
351 11 : Readers->insert(LI->getParent()->getParent());
352 31 : } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
353 11 : if (V == SI->getOperand(1)) {
354 10 : if (Writers)
355 10 : Writers->insert(SI->getParent()->getParent());
356 1 : } else if (SI->getOperand(1) != OkayStoreDest) {
357 : return true; // Storing the pointer
358 : }
359 20 : } else if (Operator::getOpcode(I) == Instruction::GetElementPtr) {
360 2 : if (AnalyzeUsesOfPointer(I, Readers, Writers))
361 : return true;
362 18 : } else if (Operator::getOpcode(I) == Instruction::BitCast) {
363 8 : if (AnalyzeUsesOfPointer(I, Readers, Writers, OkayStoreDest))
364 : return true;
365 20 : } else if (auto CS = CallSite(I)) {
366 : // Make sure that this is just the function being called, not that it is
367 : // passing into the function.
368 1 : if (!CS.isCallee(&U)) {
369 : // Detect calls to free.
370 2 : if (isFreeCall(I, TLI)) {
371 0 : if (Writers)
372 0 : Writers->insert(CS->getParent()->getParent());
373 : } else {
374 : return true; // Argument of an unknown call.
375 : }
376 : }
377 9 : } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(I)) {
378 0 : if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
379 : return true; // Allow comparison against null.
380 : } else {
381 : return true;
382 : }
383 : }
384 :
385 : return false;
386 : }
387 :
388 : /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
389 : /// which holds a pointer type. See if the global always points to non-aliased
390 : /// heap memory: that is, all initializers of the globals are allocations, and
391 : /// those allocations have no use other than initialization of the global.
392 : /// Further, all loads out of GV must directly use the memory, not store the
393 : /// pointer somewhere. If this is true, we consider the memory pointed to by
394 : /// GV to be owned by GV and can disambiguate other pointers from it.
395 2 : bool GlobalsModRef::AnalyzeIndirectGlobalMemory(GlobalValue *GV) {
396 : // Keep track of values related to the allocation of the memory, f.e. the
397 : // value produced by the malloc call and any casts.
398 : std::vector<Value *> AllocRelatedValues;
399 :
400 : // Walk the user list of the global. If we find anything other than a direct
401 : // load or store, bail out.
402 16 : for (User *U : GV->users()) {
403 5 : if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
404 : // The pointer loaded from the global can only be used in simple ways:
405 : // we allow addressing of it and loading storing to it. We do *not* allow
406 : // storing the loaded pointer somewhere else or passing to a function.
407 3 : if (AnalyzeUsesOfPointer(LI))
408 : return false; // Loaded pointer escapes.
409 : // TODO: Could try some IP mod/ref of the loaded pointer.
410 2 : } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
411 : // Storing the global itself.
412 2 : if (SI->getOperand(0) == GV)
413 0 : return false;
414 :
415 : // If storing the null pointer, ignore it.
416 4 : if (isa<ConstantPointerNull>(SI->getOperand(0)))
417 1 : continue;
418 :
419 : // Check the value being stored.
420 1 : Value *Ptr = GetUnderlyingObject(SI->getOperand(0),
421 2 : GV->getParent()->getDataLayout());
422 :
423 1 : if (!isAllocLikeFn(Ptr, TLI))
424 : return false; // Too hard to analyze.
425 :
426 : // Analyze all uses of the allocation. If any of them are used in a
427 : // non-simple way (e.g. stored to another global) bail out.
428 1 : if (AnalyzeUsesOfPointer(Ptr, /*Readers*/ nullptr, /*Writers*/ nullptr,
429 : GV))
430 : return false; // Loaded pointer escapes.
431 :
432 : // Remember that this allocation is related to the indirect global.
433 1 : AllocRelatedValues.push_back(Ptr);
434 : } else {
435 : // Something complex, bail out.
436 : return false;
437 : }
438 : }
439 :
440 : // Okay, this is an indirect global. Remember all of the allocations for
441 : // this global in AllocsForIndirectGlobals.
442 3 : while (!AllocRelatedValues.empty()) {
443 2 : AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
444 1 : Handles.emplace_front(*this, AllocRelatedValues.back());
445 3 : Handles.front().I = Handles.begin();
446 1 : AllocRelatedValues.pop_back();
447 : }
448 2 : IndirectGlobals.insert(GV);
449 2 : Handles.emplace_front(*this, GV);
450 6 : Handles.front().I = Handles.begin();
451 2 : return true;
452 : }
453 :
454 : /// AnalyzeCallGraph - At this point, we know the functions where globals are
455 : /// immediately stored to and read from. Propagate this information up the call
456 : /// graph to all callers and compute the mod/ref info for all memory for each
457 : /// function.
458 34 : void GlobalsModRef::AnalyzeCallGraph(CallGraph &CG, Module &M) {
459 : // We do a bottom-up SCC traversal of the call graph. In other words, we
460 : // visit all callees before callers (leaf-first).
461 207 : for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
462 105 : const std::vector<CallGraphNode *> &SCC = *I;
463 : assert(!SCC.empty() && "SCC with no functions?");
464 :
465 210 : if (!SCC[0]->getFunction()) {
466 : // Calls externally - can't say anything useful. Remove any existing
467 : // function records (may have been created when scanning globals).
468 82 : for (auto *Node : SCC)
469 41 : FunctionInfos.erase(Node->getFunction());
470 : continue;
471 : }
472 :
473 192 : FunctionInfo &FI = FunctionInfos[SCC[0]->getFunction()];
474 64 : bool KnowNothing = false;
475 :
476 : // Collect the mod/ref properties due to called functions. We only compute
477 : // one mod-ref set.
478 192 : for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
479 192 : Function *F = SCC[i]->getFunction();
480 64 : if (!F) {
481 : KnowNothing = true;
482 : break;
483 : }
484 :
485 64 : if (F->isDeclaration()) {
486 : // Try to get mod/ref behaviour from function attributes.
487 11 : if (F->doesNotAccessMemory()) {
488 : // Can't do better than that!
489 8 : } else if (F->onlyReadsMemory()) {
490 : FI.addModRefInfo(MRI_Ref);
491 1 : if (!F->isIntrinsic())
492 : // This function might call back into the module and read a global -
493 : // consider every global as possibly being read by this function.
494 : FI.setMayReadAnyGlobal();
495 : } else {
496 : FI.addModRefInfo(MRI_ModRef);
497 : // Can't say anything useful unless it's an intrinsic - they don't
498 : // read or write global variables of the kind considered here.
499 7 : KnowNothing = !F->isIntrinsic();
500 : }
501 : continue;
502 : }
503 :
504 287 : for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
505 75 : CI != E && !KnowNothing; ++CI)
506 44 : if (Function *Callee = CI->second->getFunction()) {
507 22 : if (FunctionInfo *CalleeFI = getFunctionInfo(Callee)) {
508 : // Propagate function effect up.
509 13 : FI.addFunctionInfo(*CalleeFI);
510 : } else {
511 : // Can't say anything about it. However, if it is inside our SCC,
512 : // then nothing needs to be done.
513 9 : CallGraphNode *CalleeNode = CG[Callee];
514 18 : if (std::find(SCC.begin(), SCC.end(), CalleeNode) == SCC.end())
515 9 : KnowNothing = true;
516 : }
517 : } else {
518 : KnowNothing = true;
519 : }
520 : }
521 :
522 : // If we can't say anything useful about this SCC, remove all SCC functions
523 : // from the FunctionInfos map.
524 64 : if (KnowNothing) {
525 75 : for (auto *Node : SCC)
526 15 : FunctionInfos.erase(Node->getFunction());
527 : continue;
528 : }
529 :
530 : // Scan the function bodies for explicit loads or stores.
531 241 : for (auto *Node : SCC) {
532 49 : if (FI.getModRefInfo() == MRI_ModRef)
533 : break; // The mod/ref lattice saturates here.
534 441 : for (Instruction &I : instructions(Node->getFunction())) {
535 140 : if (FI.getModRefInfo() == MRI_ModRef)
536 : break; // The mod/ref lattice saturates here.
537 :
538 : // We handle calls specially because the graph-relevant aspects are
539 : // handled above.
540 242 : if (auto CS = CallSite(&I)) {
541 24 : if (isAllocationFn(&I, TLI) || isFreeCall(&I, TLI)) {
542 : // FIXME: It is completely unclear why this is necessary and not
543 : // handled by the above graph code.
544 : FI.addModRefInfo(MRI_ModRef);
545 12 : } else if (Function *Callee = CS.getCalledFunction()) {
546 : // The callgraph doesn't include intrinsic calls.
547 12 : if (Callee->isIntrinsic()) {
548 : FunctionModRefBehavior Behaviour =
549 3 : AliasAnalysis::getModRefBehavior(Callee);
550 3 : FI.addModRefInfo(ModRefInfo(Behaviour & MRI_ModRef));
551 : }
552 : }
553 : continue;
554 : }
555 :
556 : // All non-call instructions we use the primary predicates for whether
557 : // thay read or write memory.
558 109 : if (I.mayReadFromMemory())
559 : FI.addModRefInfo(MRI_Ref);
560 109 : if (I.mayWriteToMemory())
561 : FI.addModRefInfo(MRI_Mod);
562 : }
563 : }
564 :
565 : if ((FI.getModRefInfo() & MRI_Mod) == 0)
566 : ++NumReadMemFunctions;
567 : if (FI.getModRefInfo() == MRI_NoModRef)
568 : ++NumNoMemFunctions;
569 :
570 : // Finally, now that we know the full effect on this SCC, clone the
571 : // information to each function in the SCC.
572 98 : for (unsigned i = 1, e = SCC.size(); i != e; ++i)
573 0 : FunctionInfos[SCC[i]->getFunction()] = FI;
574 : }
575 34 : }
576 :
577 : // There are particular cases where we can conclude no-alias between
578 : // a non-addr-taken global and some other underlying object. Specifically,
579 : // a non-addr-taken global is known to not be escaped from any function. It is
580 : // also incorrect for a transformation to introduce an escape of a global in
581 : // a way that is observable when it was not there previously. One function
582 : // being transformed to introduce an escape which could possibly be observed
583 : // (via loading from a global or the return value for example) within another
584 : // function is never safe. If the observation is made through non-atomic
585 : // operations on different threads, it is a data-race and UB. If the
586 : // observation is well defined, by being observed the transformation would have
587 : // changed program behavior by introducing the observed escape, making it an
588 : // invalid transform.
589 : //
590 : // This property does require that transformations which *temporarily* escape
591 : // a global that was not previously escaped, prior to restoring it, cannot rely
592 : // on the results of GMR::alias. This seems a reasonable restriction, although
593 : // currently there is no way to enforce it. There is also no realistic
594 : // optimization pass that would make this mistake. The closest example is
595 : // a transformation pass which does reg2mem of SSA values but stores them into
596 : // global variables temporarily before restoring the global variable's value.
597 : // This could be useful to expose "benign" races for example. However, it seems
598 : // reasonable to require that a pass which introduces escapes of global
599 : // variables in this way to either not trust AA results while the escape is
600 : // active, or to be forced to operate as a module pass that cannot co-exist
601 : // with an alias analysis such as GMR.
602 14 : bool GlobalsModRef::isNonEscapingGlobalNoAlias(const GlobalValue *GV,
603 : const Value *V) {
604 : // In order to know that the underlying object cannot alias the
605 : // non-addr-taken global, we must know that it would have to be an escape.
606 : // Thus if the underlying object is a function argument, a load from
607 : // a global, or the return of a function, it cannot alias. We can also
608 : // recurse through PHI nodes and select nodes provided all of their inputs
609 : // resolve to one of these known-escaping roots.
610 14 : SmallPtrSet<const Value *, 8> Visited;
611 14 : SmallVector<const Value *, 8> Inputs;
612 14 : Visited.insert(V);
613 14 : Inputs.push_back(V);
614 14 : int Depth = 0;
615 31 : do {
616 38 : const Value *Input = Inputs.pop_back_val();
617 :
618 76 : if (auto *InputGV = dyn_cast<GlobalValue>(Input)) {
619 : // If one input is the very global we're querying against, then we can't
620 : // conclude no-alias.
621 10 : if (InputGV == GV)
622 : return false;
623 :
624 : // Distinct GlobalVariables never alias, unless overriden or zero-sized.
625 : // FIXME: The condition can be refined, but be conservative for now.
626 10 : auto *GVar = dyn_cast<GlobalVariable>(GV);
627 10 : auto *InputGVar = dyn_cast<GlobalVariable>(InputGV);
628 30 : if (GVar && InputGVar &&
629 23 : !GVar->isDeclaration() && !InputGVar->isDeclaration() &&
630 19 : !GVar->mayBeOverridden() && !InputGVar->mayBeOverridden()) {
631 3 : Type *GVType = GVar->getInitializer()->getType();
632 3 : Type *InputGVType = InputGVar->getInitializer()->getType();
633 12 : if (GVType->isSized() && InputGVType->isSized() &&
634 9 : (DL->getTypeAllocSize(GVType) > 0) &&
635 3 : (DL->getTypeAllocSize(InputGVType) > 0))
636 31 : continue;
637 : }
638 :
639 : // Conservatively return false, even though we could be smarter
640 : // (e.g. look through GlobalAliases).
641 : return false;
642 : }
643 :
644 72 : if (isa<Argument>(Input) || isa<CallInst>(Input) ||
645 : isa<InvokeInst>(Input)) {
646 : // Arguments to functions or returns from functions are inherently
647 : // escaping, so we can immediately classify those as not aliasing any
648 : // non-addr-taken globals.
649 : continue;
650 : }
651 40 : if (auto *LI = dyn_cast<LoadInst>(Input)) {
652 : // A pointer loaded from a global would have been captured, and we know
653 : // that the global is non-escaping, so no alias.
654 32 : if (isa<GlobalValue>(GetUnderlyingObject(LI->getPointerOperand(), *DL)))
655 : continue;
656 :
657 : // Otherwise, a load could come from anywhere, so bail.
658 : return false;
659 : }
660 :
661 : // Recurse through a limited number of selects and PHIs. This is an
662 : // arbitrary depth of 4, lower numbers could be used to fix compile time
663 : // issues if needed, but this is generally expected to be only be important
664 : // for small depths.
665 12 : if (++Depth > 4)
666 : return false;
667 24 : if (auto *SI = dyn_cast<SelectInst>(Input)) {
668 18 : const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), *DL);
669 18 : const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), *DL);
670 9 : if (Visited.insert(LHS).second)
671 9 : Inputs.push_back(LHS);
672 9 : if (Visited.insert(RHS).second)
673 9 : Inputs.push_back(RHS);
674 : continue;
675 : }
676 6 : if (auto *PN = dyn_cast<PHINode>(Input)) {
677 9 : for (const Value *Op : PN->incoming_values()) {
678 12 : Op = GetUnderlyingObject(Op, *DL);
679 6 : if (Visited.insert(Op).second)
680 6 : Inputs.push_back(Op);
681 : }
682 3 : continue;
683 : }
684 :
685 : // FIXME: It would be good to handle other obvious no-alias cases here, but
686 : // it isn't clear how to do so reasonbly without building a small version
687 : // of BasicAA into this code. We could recurse into AliasAnalysis::alias
688 : // here but that seems likely to go poorly as we're inside the
689 : // implementation of such a query. Until then, just conservatievly retun
690 : // false.
691 : return false;
692 : } while (!Inputs.empty());
693 :
694 : // If all the inputs to V were definitively no-alias, then V is no-alias.
695 : return true;
696 : }
697 :
698 : /// alias - If one of the pointers is to a global that we are tracking, and the
699 : /// other is some random pointer, we know there cannot be an alias, because the
700 : /// address of the global isn't taken.
701 47 : AliasResult GlobalsModRef::alias(const MemoryLocation &LocA,
702 : const MemoryLocation &LocB) {
703 : // Get the base object these pointers point to.
704 94 : const Value *UV1 = GetUnderlyingObject(LocA.Ptr, *DL);
705 94 : const Value *UV2 = GetUnderlyingObject(LocB.Ptr, *DL);
706 :
707 : // If either of the underlying values is a global, they may be non-addr-taken
708 : // globals, which we can answer queries about.
709 94 : const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
710 94 : const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
711 47 : if (GV1 || GV2) {
712 : // If the global's address is taken, pretend we don't know it's a pointer to
713 : // the global.
714 59 : if (GV1 && !NonAddressTakenGlobals.count(GV1))
715 4 : GV1 = nullptr;
716 63 : if (GV2 && !NonAddressTakenGlobals.count(GV2))
717 6 : GV2 = nullptr;
718 :
719 : // If the two pointers are derived from two different non-addr-taken
720 : // globals we know these can't alias.
721 33 : if (GV1 && GV2 && GV1 != GV2)
722 : return NoAlias;
723 :
724 : // If one is and the other isn't, it isn't strictly safe but we can fake
725 : // this result if necessary for performance. This does not appear to be
726 : // a common problem in practice.
727 31 : if (EnableUnsafeGlobalsModRefAliasResults)
728 2 : if ((GV1 || GV2) && GV1 != GV2)
729 : return NoAlias;
730 :
731 : // Check for a special case where a non-escaping global can be used to
732 : // conclude no-alias.
733 29 : if ((GV1 || GV2) && GV1 != GV2) {
734 14 : const GlobalValue *GV = GV1 ? GV1 : GV2;
735 14 : const Value *UV = GV1 ? UV2 : UV1;
736 14 : if (isNonEscapingGlobalNoAlias(GV, UV))
737 : return NoAlias;
738 : }
739 :
740 : // Otherwise if they are both derived from the same addr-taken global, we
741 : // can't know the two accesses don't overlap.
742 : }
743 :
744 : // These pointers may be based on the memory owned by an indirect global. If
745 : // so, we may be able to handle this. First check to see if the base pointer
746 : // is a direct load from an indirect global.
747 36 : GV1 = GV2 = nullptr;
748 72 : if (const LoadInst *LI = dyn_cast<LoadInst>(UV1))
749 3 : if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
750 2 : if (IndirectGlobals.count(GV))
751 1 : GV1 = GV;
752 72 : if (const LoadInst *LI = dyn_cast<LoadInst>(UV2))
753 6 : if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
754 4 : if (IndirectGlobals.count(GV))
755 2 : GV2 = GV;
756 :
757 : // These pointers may also be from an allocation for the indirect global. If
758 : // so, also handle them.
759 36 : if (!GV1)
760 70 : GV1 = AllocsForIndirectGlobals.lookup(UV1);
761 36 : if (!GV2)
762 68 : GV2 = AllocsForIndirectGlobals.lookup(UV2);
763 :
764 : // Now that we know whether the two pointers are related to indirect globals,
765 : // use this to disambiguate the pointers. If the pointers are based on
766 : // different indirect globals they cannot alias.
767 36 : if (GV1 && GV2 && GV1 != GV2)
768 : return NoAlias;
769 :
770 : // If one is based on an indirect global and the other isn't, it isn't
771 : // strictly safe but we can fake this result if necessary for performance.
772 : // This does not appear to be a common problem in practice.
773 36 : if (EnableUnsafeGlobalsModRefAliasResults)
774 4 : if ((GV1 || GV2) && GV1 != GV2)
775 : return NoAlias;
776 :
777 35 : return AliasAnalysis::alias(LocA, LocB);
778 : }
779 :
780 8 : ModRefInfo GlobalsModRef::getModRefInfo(ImmutableCallSite CS,
781 : const MemoryLocation &Loc) {
782 8 : unsigned Known = MRI_ModRef;
783 :
784 : // If we are asking for mod/ref info of a direct call with a pointer to a
785 : // global we are tracking, return information if we have it.
786 8 : const DataLayout &DL = CS.getCaller()->getParent()->getDataLayout();
787 8 : if (const GlobalValue *GV =
788 24 : dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL)))
789 6 : if (GV->hasLocalLinkage())
790 6 : if (const Function *F = CS.getCalledFunction())
791 12 : if (NonAddressTakenGlobals.count(GV))
792 4 : if (const FunctionInfo *FI = getFunctionInfo(F))
793 3 : Known = FI->getModRefInfoForGlobal(*GV);
794 :
795 8 : if (Known == MRI_NoModRef)
796 : return MRI_NoModRef; // No need to query other mod/ref analyses
797 6 : return ModRefInfo(Known & AliasAnalysis::getModRefInfo(CS, Loc));
798 116490 : }
|
