Bug Summary

File:lib/Analysis/GlobalsModRef.cpp
Warning:line 118, column 13
Potential memory leak

Annotated Source Code

1//===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This simple pass provides alias and mod/ref information for global values
11// that do not have their address taken, and keeps track of whether functions
12// read or write memory (are "pure"). For this simple (but very common) case,
13// we can provide pretty accurate and useful information.
14//
15//===----------------------------------------------------------------------===//
16
17#include "llvm/Analysis/GlobalsModRef.h"
18#include "llvm/ADT/SCCIterator.h"
19#include "llvm/ADT/SmallPtrSet.h"
20#include "llvm/ADT/Statistic.h"
21#include "llvm/Analysis/MemoryBuiltins.h"
22#include "llvm/Analysis/TargetLibraryInfo.h"
23#include "llvm/Analysis/ValueTracking.h"
24#include "llvm/IR/DerivedTypes.h"
25#include "llvm/IR/InstIterator.h"
26#include "llvm/IR/Instructions.h"
27#include "llvm/IR/IntrinsicInst.h"
28#include "llvm/IR/Module.h"
29#include "llvm/Pass.h"
30#include "llvm/Support/CommandLine.h"
31using namespace llvm;
32
33#define DEBUG_TYPE"globalsmodref-aa" "globalsmodref-aa"
34
35STATISTIC(NumNonAddrTakenGlobalVars,static llvm::Statistic NumNonAddrTakenGlobalVars = {"globalsmodref-aa"
, "NumNonAddrTakenGlobalVars", "Number of global vars without address taken"
, {0}, false}
36 "Number of global vars without address taken")static llvm::Statistic NumNonAddrTakenGlobalVars = {"globalsmodref-aa"
, "NumNonAddrTakenGlobalVars", "Number of global vars without address taken"
, {0}, false}
;
37STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken")static llvm::Statistic NumNonAddrTakenFunctions = {"globalsmodref-aa"
, "NumNonAddrTakenFunctions", "Number of functions without address taken"
, {0}, false}
;
38STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory")static llvm::Statistic NumNoMemFunctions = {"globalsmodref-aa"
, "NumNoMemFunctions", "Number of functions that do not access memory"
, {0}, false}
;
39STATISTIC(NumReadMemFunctions, "Number of functions that only read memory")static llvm::Statistic NumReadMemFunctions = {"globalsmodref-aa"
, "NumReadMemFunctions", "Number of functions that only read memory"
, {0}, false}
;
40STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects")static llvm::Statistic NumIndirectGlobalVars = {"globalsmodref-aa"
, "NumIndirectGlobalVars", "Number of indirect global objects"
, {0}, false}
;
41
42// An option to enable unsafe alias results from the GlobalsModRef analysis.
43// When enabled, GlobalsModRef will provide no-alias results which in extremely
44// rare cases may not be conservatively correct. In particular, in the face of
45// transforms which cause assymetry between how effective GetUnderlyingObject
46// is for two pointers, it may produce incorrect results.
47//
48// These unsafe results have been returned by GMR for many years without
49// causing significant issues in the wild and so we provide a mechanism to
50// re-enable them for users of LLVM that have a particular performance
51// sensitivity and no known issues. The option also makes it easy to evaluate
52// the performance impact of these results.
53static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults(
54 "enable-unsafe-globalsmodref-alias-results", cl::init(false), cl::Hidden);
55
56/// The mod/ref information collected for a particular function.
57///
58/// We collect information about mod/ref behavior of a function here, both in
59/// general and as pertains to specific globals. We only have this detailed
60/// information when we know *something* useful about the behavior. If we
61/// saturate to fully general mod/ref, we remove the info for the function.
62class GlobalsAAResult::FunctionInfo {
63 typedef SmallDenseMap<const GlobalValue *, ModRefInfo, 16> GlobalInfoMapType;
64
65 /// Build a wrapper struct that has 8-byte alignment. All heap allocations
66 /// should provide this much alignment at least, but this makes it clear we
67 /// specifically rely on this amount of alignment.
68 struct LLVM_ALIGNAS(8)alignas(8) AlignedMap {
69 AlignedMap() {}
70 AlignedMap(const AlignedMap &Arg) : Map(Arg.Map) {}
71 GlobalInfoMapType Map;
72 };
73
74 /// Pointer traits for our aligned map.
75 struct AlignedMapPointerTraits {
76 static inline void *getAsVoidPointer(AlignedMap *P) { return P; }
77 static inline AlignedMap *getFromVoidPointer(void *P) {
78 return (AlignedMap *)P;
79 }
80 enum { NumLowBitsAvailable = 3 };
81 static_assert(alignof(AlignedMap) >= (1 << NumLowBitsAvailable),
82 "AlignedMap insufficiently aligned to have enough low bits.");
83 };
84
85 /// The bit that flags that this function may read any global. This is
86 /// chosen to mix together with ModRefInfo bits.
87 enum { MayReadAnyGlobal = 4 };
88
89 /// Checks to document the invariants of the bit packing here.
90 static_assert((MayReadAnyGlobal & MRI_ModRef) == 0,
91 "ModRef and the MayReadAnyGlobal flag bits overlap.");
92 static_assert(((MayReadAnyGlobal | MRI_ModRef) >>
93 AlignedMapPointerTraits::NumLowBitsAvailable) == 0,
94 "Insufficient low bits to store our flag and ModRef info.");
95
96public:
97 FunctionInfo() : Info() {}
98 ~FunctionInfo() {
99 delete Info.getPointer();
100 }
101 // Spell out the copy ond move constructors and assignment operators to get
102 // deep copy semantics and correct move semantics in the face of the
103 // pointer-int pair.
104 FunctionInfo(const FunctionInfo &Arg)
105 : Info(nullptr, Arg.Info.getInt()) {
106 if (const auto *ArgPtr = Arg.Info.getPointer())
107 Info.setPointer(new AlignedMap(*ArgPtr));
108 }
109 FunctionInfo(FunctionInfo &&Arg)
110 : Info(Arg.Info.getPointer(), Arg.Info.getInt()) {
111 Arg.Info.setPointerAndInt(nullptr, 0);
112 }
113 FunctionInfo &operator=(const FunctionInfo &RHS) {
1
Assuming RHS != *this
114 delete Info.getPointer();
115 Info.setPointerAndInt(nullptr, RHS.Info.getInt());
116 if (const auto *RHSPtr = RHS.Info.getPointer())
2
Assuming 'RHSPtr' is non-null
3
Taking true branch
117 Info.setPointer(new AlignedMap(*RHSPtr));
4
Memory is allocated
118 return *this;
5
Potential memory leak
119 }
120 FunctionInfo &operator=(FunctionInfo &&RHS) {
121 delete Info.getPointer();
122 Info.setPointerAndInt(RHS.Info.getPointer(), RHS.Info.getInt());
123 RHS.Info.setPointerAndInt(nullptr, 0);
124 return *this;
125 }
126
127 /// Returns the \c ModRefInfo info for this function.
128 ModRefInfo getModRefInfo() const {
129 return ModRefInfo(Info.getInt() & MRI_ModRef);
130 }
131
132 /// Adds new \c ModRefInfo for this function to its state.
133 void addModRefInfo(ModRefInfo NewMRI) {
134 Info.setInt(Info.getInt() | NewMRI);
135 }
136
137 /// Returns whether this function may read any global variable, and we don't
138 /// know which global.
139 bool mayReadAnyGlobal() const { return Info.getInt() & MayReadAnyGlobal; }
140
141 /// Sets this function as potentially reading from any global.
142 void setMayReadAnyGlobal() { Info.setInt(Info.getInt() | MayReadAnyGlobal); }
143
144 /// Returns the \c ModRefInfo info for this function w.r.t. a particular
145 /// global, which may be more precise than the general information above.
146 ModRefInfo getModRefInfoForGlobal(const GlobalValue &GV) const {
147 ModRefInfo GlobalMRI = mayReadAnyGlobal() ? MRI_Ref : MRI_NoModRef;
148 if (AlignedMap *P = Info.getPointer()) {
149 auto I = P->Map.find(&GV);
150 if (I != P->Map.end())
151 GlobalMRI = ModRefInfo(GlobalMRI | I->second);
152 }
153 return GlobalMRI;
154 }
155
156 /// Add mod/ref info from another function into ours, saturating towards
157 /// MRI_ModRef.
158 void addFunctionInfo(const FunctionInfo &FI) {
159 addModRefInfo(FI.getModRefInfo());
160
161 if (FI.mayReadAnyGlobal())
162 setMayReadAnyGlobal();
163
164 if (AlignedMap *P = FI.Info.getPointer())
165 for (const auto &G : P->Map)
166 addModRefInfoForGlobal(*G.first, G.second);
167 }
168
169 void addModRefInfoForGlobal(const GlobalValue &GV, ModRefInfo NewMRI) {
170 AlignedMap *P = Info.getPointer();
171 if (!P) {
172 P = new AlignedMap();
173 Info.setPointer(P);
174 }
175 auto &GlobalMRI = P->Map[&GV];
176 GlobalMRI = ModRefInfo(GlobalMRI | NewMRI);
177 }
178
179 /// Clear a global's ModRef info. Should be used when a global is being
180 /// deleted.
181 void eraseModRefInfoForGlobal(const GlobalValue &GV) {
182 if (AlignedMap *P = Info.getPointer())
183 P->Map.erase(&GV);
184 }
185
186private:
187 /// All of the information is encoded into a single pointer, with a three bit
188 /// integer in the low three bits. The high bit provides a flag for when this
189 /// function may read any global. The low two bits are the ModRefInfo. And
190 /// the pointer, when non-null, points to a map from GlobalValue to
191 /// ModRefInfo specific to that GlobalValue.
192 PointerIntPair<AlignedMap *, 3, unsigned, AlignedMapPointerTraits> Info;
193};
194
195void GlobalsAAResult::DeletionCallbackHandle::deleted() {
196 Value *V = getValPtr();
197 if (auto *F = dyn_cast<Function>(V))
198 GAR->FunctionInfos.erase(F);
199
200 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
201 if (GAR->NonAddressTakenGlobals.erase(GV)) {
202 // This global might be an indirect global. If so, remove it and
203 // remove any AllocRelatedValues for it.
204 if (GAR->IndirectGlobals.erase(GV)) {
205 // Remove any entries in AllocsForIndirectGlobals for this global.
206 for (auto I = GAR->AllocsForIndirectGlobals.begin(),
207 E = GAR->AllocsForIndirectGlobals.end();
208 I != E; ++I)
209 if (I->second == GV)
210 GAR->AllocsForIndirectGlobals.erase(I);
211 }
212
213 // Scan the function info we have collected and remove this global
214 // from all of them.
215 for (auto &FIPair : GAR->FunctionInfos)
216 FIPair.second.eraseModRefInfoForGlobal(*GV);
217 }
218 }
219
220 // If this is an allocation related to an indirect global, remove it.
221 GAR->AllocsForIndirectGlobals.erase(V);
222
223 // And clear out the handle.
224 setValPtr(nullptr);
225 GAR->Handles.erase(I);
226 // This object is now destroyed!
227}
228
229FunctionModRefBehavior GlobalsAAResult::getModRefBehavior(const Function *F) {
230 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
231
232 if (FunctionInfo *FI = getFunctionInfo(F)) {
233 if (FI->getModRefInfo() == MRI_NoModRef)
234 Min = FMRB_DoesNotAccessMemory;
235 else if ((FI->getModRefInfo() & MRI_Mod) == 0)
236 Min = FMRB_OnlyReadsMemory;
237 }
238
239 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(F) & Min);
240}
241
242FunctionModRefBehavior
243GlobalsAAResult::getModRefBehavior(ImmutableCallSite CS) {
244 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
245
246 if (!CS.hasOperandBundles())
247 if (const Function *F = CS.getCalledFunction())
248 if (FunctionInfo *FI = getFunctionInfo(F)) {
249 if (FI->getModRefInfo() == MRI_NoModRef)
250 Min = FMRB_DoesNotAccessMemory;
251 else if ((FI->getModRefInfo() & MRI_Mod) == 0)
252 Min = FMRB_OnlyReadsMemory;
253 }
254
255 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(CS) & Min);
256}
257
258/// Returns the function info for the function, or null if we don't have
259/// anything useful to say about it.
260GlobalsAAResult::FunctionInfo *
261GlobalsAAResult::getFunctionInfo(const Function *F) {
262 auto I = FunctionInfos.find(F);
263 if (I != FunctionInfos.end())
264 return &I->second;
265 return nullptr;
266}
267
268/// AnalyzeGlobals - Scan through the users of all of the internal
269/// GlobalValue's in the program. If none of them have their "address taken"
270/// (really, their address passed to something nontrivial), record this fact,
271/// and record the functions that they are used directly in.
272void GlobalsAAResult::AnalyzeGlobals(Module &M) {
273 SmallPtrSet<Function *, 32> TrackedFunctions;
274 for (Function &F : M)
275 if (F.hasLocalLinkage())
276 if (!AnalyzeUsesOfPointer(&F)) {
277 // Remember that we are tracking this global.
278 NonAddressTakenGlobals.insert(&F);
279 TrackedFunctions.insert(&F);
280 Handles.emplace_front(*this, &F);
281 Handles.front().I = Handles.begin();
282 ++NumNonAddrTakenFunctions;
283 }
284
285 SmallPtrSet<Function *, 16> Readers, Writers;
286 for (GlobalVariable &GV : M.globals())
287 if (GV.hasLocalLinkage()) {
288 if (!AnalyzeUsesOfPointer(&GV, &Readers,
289 GV.isConstant() ? nullptr : &Writers)) {
290 // Remember that we are tracking this global, and the mod/ref fns
291 NonAddressTakenGlobals.insert(&GV);
292 Handles.emplace_front(*this, &GV);
293 Handles.front().I = Handles.begin();
294
295 for (Function *Reader : Readers) {
296 if (TrackedFunctions.insert(Reader).second) {
297 Handles.emplace_front(*this, Reader);
298 Handles.front().I = Handles.begin();
299 }
300 FunctionInfos[Reader].addModRefInfoForGlobal(GV, MRI_Ref);
301 }
302
303 if (!GV.isConstant()) // No need to keep track of writers to constants
304 for (Function *Writer : Writers) {
305 if (TrackedFunctions.insert(Writer).second) {
306 Handles.emplace_front(*this, Writer);
307 Handles.front().I = Handles.begin();
308 }
309 FunctionInfos[Writer].addModRefInfoForGlobal(GV, MRI_Mod);
310 }
311 ++NumNonAddrTakenGlobalVars;
312
313 // If this global holds a pointer type, see if it is an indirect global.
314 if (GV.getValueType()->isPointerTy() &&
315 AnalyzeIndirectGlobalMemory(&GV))
316 ++NumIndirectGlobalVars;
317 }
318 Readers.clear();
319 Writers.clear();
320 }
321}
322
323/// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
324/// If this is used by anything complex (i.e., the address escapes), return
325/// true. Also, while we are at it, keep track of those functions that read and
326/// write to the value.
327///
328/// If OkayStoreDest is non-null, stores into this global are allowed.
329bool GlobalsAAResult::AnalyzeUsesOfPointer(Value *V,
330 SmallPtrSetImpl<Function *> *Readers,
331 SmallPtrSetImpl<Function *> *Writers,
332 GlobalValue *OkayStoreDest) {
333 if (!V->getType()->isPointerTy())
334 return true;
335
336 for (Use &U : V->uses()) {
337 User *I = U.getUser();
338 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
339 if (Readers)
340 Readers->insert(LI->getParent()->getParent());
341 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
342 if (V == SI->getOperand(1)) {
343 if (Writers)
344 Writers->insert(SI->getParent()->getParent());
345 } else if (SI->getOperand(1) != OkayStoreDest) {
346 return true; // Storing the pointer
347 }
348 } else if (Operator::getOpcode(I) == Instruction::GetElementPtr) {
349 if (AnalyzeUsesOfPointer(I, Readers, Writers))
350 return true;
351 } else if (Operator::getOpcode(I) == Instruction::BitCast) {
352 if (AnalyzeUsesOfPointer(I, Readers, Writers, OkayStoreDest))
353 return true;
354 } else if (auto CS = CallSite(I)) {
355 // Make sure that this is just the function being called, not that it is
356 // passing into the function.
357 if (CS.isDataOperand(&U)) {
358 // Detect calls to free.
359 if (CS.isArgOperand(&U) && isFreeCall(I, &TLI)) {
360 if (Writers)
361 Writers->insert(CS->getParent()->getParent());
362 } else {
363 return true; // Argument of an unknown call.
364 }
365 }
366 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(I)) {
367 if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
368 return true; // Allow comparison against null.
369 } else if (Constant *C = dyn_cast<Constant>(I)) {
370 // Ignore constants which don't have any live uses.
371 if (isa<GlobalValue>(C) || C->isConstantUsed())
372 return true;
373 } else {
374 return true;
375 }
376 }
377
378 return false;
379}
380
381/// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
382/// which holds a pointer type. See if the global always points to non-aliased
383/// heap memory: that is, all initializers of the globals are allocations, and
384/// those allocations have no use other than initialization of the global.
385/// Further, all loads out of GV must directly use the memory, not store the
386/// pointer somewhere. If this is true, we consider the memory pointed to by
387/// GV to be owned by GV and can disambiguate other pointers from it.
388bool GlobalsAAResult::AnalyzeIndirectGlobalMemory(GlobalVariable *GV) {
389 // Keep track of values related to the allocation of the memory, f.e. the
390 // value produced by the malloc call and any casts.
391 std::vector<Value *> AllocRelatedValues;
392
393 // If the initializer is a valid pointer, bail.
394 if (Constant *C = GV->getInitializer())
395 if (!C->isNullValue())
396 return false;
397
398 // Walk the user list of the global. If we find anything other than a direct
399 // load or store, bail out.
400 for (User *U : GV->users()) {
401 if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
402 // The pointer loaded from the global can only be used in simple ways:
403 // we allow addressing of it and loading storing to it. We do *not* allow
404 // storing the loaded pointer somewhere else or passing to a function.
405 if (AnalyzeUsesOfPointer(LI))
406 return false; // Loaded pointer escapes.
407 // TODO: Could try some IP mod/ref of the loaded pointer.
408 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
409 // Storing the global itself.
410 if (SI->getOperand(0) == GV)
411 return false;
412
413 // If storing the null pointer, ignore it.
414 if (isa<ConstantPointerNull>(SI->getOperand(0)))
415 continue;
416
417 // Check the value being stored.
418 Value *Ptr = GetUnderlyingObject(SI->getOperand(0),
419 GV->getParent()->getDataLayout());
420
421 if (!isAllocLikeFn(Ptr, &TLI))
422 return false; // Too hard to analyze.
423
424 // Analyze all uses of the allocation. If any of them are used in a
425 // non-simple way (e.g. stored to another global) bail out.
426 if (AnalyzeUsesOfPointer(Ptr, /*Readers*/ nullptr, /*Writers*/ nullptr,
427 GV))
428 return false; // Loaded pointer escapes.
429
430 // Remember that this allocation is related to the indirect global.
431 AllocRelatedValues.push_back(Ptr);
432 } else {
433 // Something complex, bail out.
434 return false;
435 }
436 }
437
438 // Okay, this is an indirect global. Remember all of the allocations for
439 // this global in AllocsForIndirectGlobals.
440 while (!AllocRelatedValues.empty()) {
441 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
442 Handles.emplace_front(*this, AllocRelatedValues.back());
443 Handles.front().I = Handles.begin();
444 AllocRelatedValues.pop_back();
445 }
446 IndirectGlobals.insert(GV);
447 Handles.emplace_front(*this, GV);
448 Handles.front().I = Handles.begin();
449 return true;
450}
451
452void GlobalsAAResult::CollectSCCMembership(CallGraph &CG) {
453 // We do a bottom-up SCC traversal of the call graph. In other words, we
454 // visit all callees before callers (leaf-first).
455 unsigned SCCID = 0;
456 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
457 const std::vector<CallGraphNode *> &SCC = *I;
458 assert(!SCC.empty() && "SCC with no functions?")((!SCC.empty() && "SCC with no functions?") ? static_cast
<void> (0) : __assert_fail ("!SCC.empty() && \"SCC with no functions?\""
, "/tmp/buildd/llvm-toolchain-snapshot-5.0~svn298304/lib/Analysis/GlobalsModRef.cpp"
, 458, __PRETTY_FUNCTION__))
;
459
460 for (auto *CGN : SCC)
461 if (Function *F = CGN->getFunction())
462 FunctionToSCCMap[F] = SCCID;
463 ++SCCID;
464 }
465}
466
467/// AnalyzeCallGraph - At this point, we know the functions where globals are
468/// immediately stored to and read from. Propagate this information up the call
469/// graph to all callers and compute the mod/ref info for all memory for each
470/// function.
471void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) {
472 // We do a bottom-up SCC traversal of the call graph. In other words, we
473 // visit all callees before callers (leaf-first).
474 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
475 const std::vector<CallGraphNode *> &SCC = *I;
476 assert(!SCC.empty() && "SCC with no functions?")((!SCC.empty() && "SCC with no functions?") ? static_cast
<void> (0) : __assert_fail ("!SCC.empty() && \"SCC with no functions?\""
, "/tmp/buildd/llvm-toolchain-snapshot-5.0~svn298304/lib/Analysis/GlobalsModRef.cpp"
, 476, __PRETTY_FUNCTION__))
;
477
478 if (!SCC[0]->getFunction() || !SCC[0]->getFunction()->isDefinitionExact()) {
479 // Calls externally or not exact - can't say anything useful. Remove any
480 // existing function records (may have been created when scanning
481 // globals).
482 for (auto *Node : SCC)
483 FunctionInfos.erase(Node->getFunction());
484 continue;
485 }
486
487 FunctionInfo &FI = FunctionInfos[SCC[0]->getFunction()];
488 bool KnowNothing = false;
489
490 // Collect the mod/ref properties due to called functions. We only compute
491 // one mod-ref set.
492 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
493 Function *F = SCC[i]->getFunction();
494 if (!F) {
495 KnowNothing = true;
496 break;
497 }
498
499 if (F->isDeclaration()) {
500 // Try to get mod/ref behaviour from function attributes.
501 if (F->doesNotAccessMemory()) {
502 // Can't do better than that!
503 } else if (F->onlyReadsMemory()) {
504 FI.addModRefInfo(MRI_Ref);
505 if (!F->isIntrinsic() && !F->onlyAccessesArgMemory())
506 // This function might call back into the module and read a global -
507 // consider every global as possibly being read by this function.
508 FI.setMayReadAnyGlobal();
509 } else {
510 FI.addModRefInfo(MRI_ModRef);
511 // Can't say anything useful unless it's an intrinsic - they don't
512 // read or write global variables of the kind considered here.
513 KnowNothing = !F->isIntrinsic();
514 }
515 continue;
516 }
517
518 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
519 CI != E && !KnowNothing; ++CI)
520 if (Function *Callee = CI->second->getFunction()) {
521 if (FunctionInfo *CalleeFI = getFunctionInfo(Callee)) {
522 // Propagate function effect up.
523 FI.addFunctionInfo(*CalleeFI);
524 } else {
525 // Can't say anything about it. However, if it is inside our SCC,
526 // then nothing needs to be done.
527 CallGraphNode *CalleeNode = CG[Callee];
528 if (!is_contained(SCC, CalleeNode))
529 KnowNothing = true;
530 }
531 } else {
532 KnowNothing = true;
533 }
534 }
535
536 // If we can't say anything useful about this SCC, remove all SCC functions
537 // from the FunctionInfos map.
538 if (KnowNothing) {
539 for (auto *Node : SCC)
540 FunctionInfos.erase(Node->getFunction());
541 continue;
542 }
543
544 // Scan the function bodies for explicit loads or stores.
545 for (auto *Node : SCC) {
546 if (FI.getModRefInfo() == MRI_ModRef)
547 break; // The mod/ref lattice saturates here.
548 for (Instruction &I : instructions(Node->getFunction())) {
549 if (FI.getModRefInfo() == MRI_ModRef)
550 break; // The mod/ref lattice saturates here.
551
552 // We handle calls specially because the graph-relevant aspects are
553 // handled above.
554 if (auto CS = CallSite(&I)) {
555 if (isAllocationFn(&I, &TLI) || isFreeCall(&I, &TLI)) {
556 // FIXME: It is completely unclear why this is necessary and not
557 // handled by the above graph code.
558 FI.addModRefInfo(MRI_ModRef);
559 } else if (Function *Callee = CS.getCalledFunction()) {
560 // The callgraph doesn't include intrinsic calls.
561 if (Callee->isIntrinsic()) {
562 FunctionModRefBehavior Behaviour =
563 AAResultBase::getModRefBehavior(Callee);
564 FI.addModRefInfo(ModRefInfo(Behaviour & MRI_ModRef));
565 }
566 }
567 continue;
568 }
569
570 // All non-call instructions we use the primary predicates for whether
571 // thay read or write memory.
572 if (I.mayReadFromMemory())
573 FI.addModRefInfo(MRI_Ref);
574 if (I.mayWriteToMemory())
575 FI.addModRefInfo(MRI_Mod);
576 }
577 }
578
579 if ((FI.getModRefInfo() & MRI_Mod) == 0)
580 ++NumReadMemFunctions;
581 if (FI.getModRefInfo() == MRI_NoModRef)
582 ++NumNoMemFunctions;
583
584 // Finally, now that we know the full effect on this SCC, clone the
585 // information to each function in the SCC.
586 // FI is a reference into FunctionInfos, so copy it now so that it doesn't
587 // get invalidated if DenseMap decides to re-hash.
588 FunctionInfo CachedFI = FI;
589 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
590 FunctionInfos[SCC[i]->getFunction()] = CachedFI;
591 }
592}
593
594// GV is a non-escaping global. V is a pointer address that has been loaded from.
595// If we can prove that V must escape, we can conclude that a load from V cannot
596// alias GV.
597static bool isNonEscapingGlobalNoAliasWithLoad(const GlobalValue *GV,
598 const Value *V,
599 int &Depth,
600 const DataLayout &DL) {
601 SmallPtrSet<const Value *, 8> Visited;
602 SmallVector<const Value *, 8> Inputs;
603 Visited.insert(V);
604 Inputs.push_back(V);
605 do {
606 const Value *Input = Inputs.pop_back_val();
607
608 if (isa<GlobalValue>(Input) || isa<Argument>(Input) || isa<CallInst>(Input) ||
609 isa<InvokeInst>(Input))
610 // Arguments to functions or returns from functions are inherently
611 // escaping, so we can immediately classify those as not aliasing any
612 // non-addr-taken globals.
613 //
614 // (Transitive) loads from a global are also safe - if this aliased
615 // another global, its address would escape, so no alias.
616 continue;
617
618 // Recurse through a limited number of selects, loads and PHIs. This is an
619 // arbitrary depth of 4, lower numbers could be used to fix compile time
620 // issues if needed, but this is generally expected to be only be important
621 // for small depths.
622 if (++Depth > 4)
623 return false;
624
625 if (auto *LI = dyn_cast<LoadInst>(Input)) {
626 Inputs.push_back(GetUnderlyingObject(LI->getPointerOperand(), DL));
627 continue;
628 }
629 if (auto *SI = dyn_cast<SelectInst>(Input)) {
630 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL);
631 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL);
632 if (Visited.insert(LHS).second)
633 Inputs.push_back(LHS);
634 if (Visited.insert(RHS).second)
635 Inputs.push_back(RHS);
636 continue;
637 }
638 if (auto *PN = dyn_cast<PHINode>(Input)) {
639 for (const Value *Op : PN->incoming_values()) {
640 Op = GetUnderlyingObject(Op, DL);
641 if (Visited.insert(Op).second)
642 Inputs.push_back(Op);
643 }
644 continue;
645 }
646
647 return false;
648 } while (!Inputs.empty());
649
650 // All inputs were known to be no-alias.
651 return true;
652}
653
654// There are particular cases where we can conclude no-alias between
655// a non-addr-taken global and some other underlying object. Specifically,
656// a non-addr-taken global is known to not be escaped from any function. It is
657// also incorrect for a transformation to introduce an escape of a global in
658// a way that is observable when it was not there previously. One function
659// being transformed to introduce an escape which could possibly be observed
660// (via loading from a global or the return value for example) within another
661// function is never safe. If the observation is made through non-atomic
662// operations on different threads, it is a data-race and UB. If the
663// observation is well defined, by being observed the transformation would have
664// changed program behavior by introducing the observed escape, making it an
665// invalid transform.
666//
667// This property does require that transformations which *temporarily* escape
668// a global that was not previously escaped, prior to restoring it, cannot rely
669// on the results of GMR::alias. This seems a reasonable restriction, although
670// currently there is no way to enforce it. There is also no realistic
671// optimization pass that would make this mistake. The closest example is
672// a transformation pass which does reg2mem of SSA values but stores them into
673// global variables temporarily before restoring the global variable's value.
674// This could be useful to expose "benign" races for example. However, it seems
675// reasonable to require that a pass which introduces escapes of global
676// variables in this way to either not trust AA results while the escape is
677// active, or to be forced to operate as a module pass that cannot co-exist
678// with an alias analysis such as GMR.
679bool GlobalsAAResult::isNonEscapingGlobalNoAlias(const GlobalValue *GV,
680 const Value *V) {
681 // In order to know that the underlying object cannot alias the
682 // non-addr-taken global, we must know that it would have to be an escape.
683 // Thus if the underlying object is a function argument, a load from
684 // a global, or the return of a function, it cannot alias. We can also
685 // recurse through PHI nodes and select nodes provided all of their inputs
686 // resolve to one of these known-escaping roots.
687 SmallPtrSet<const Value *, 8> Visited;
688 SmallVector<const Value *, 8> Inputs;
689 Visited.insert(V);
690 Inputs.push_back(V);
691 int Depth = 0;
692 do {
693 const Value *Input = Inputs.pop_back_val();
694
695 if (auto *InputGV = dyn_cast<GlobalValue>(Input)) {
696 // If one input is the very global we're querying against, then we can't
697 // conclude no-alias.
698 if (InputGV == GV)
699 return false;
700
701 // Distinct GlobalVariables never alias, unless overriden or zero-sized.
702 // FIXME: The condition can be refined, but be conservative for now.
703 auto *GVar = dyn_cast<GlobalVariable>(GV);
704 auto *InputGVar = dyn_cast<GlobalVariable>(InputGV);
705 if (GVar && InputGVar &&
706 !GVar->isDeclaration() && !InputGVar->isDeclaration() &&
707 !GVar->isInterposable() && !InputGVar->isInterposable()) {
708 Type *GVType = GVar->getInitializer()->getType();
709 Type *InputGVType = InputGVar->getInitializer()->getType();
710 if (GVType->isSized() && InputGVType->isSized() &&
711 (DL.getTypeAllocSize(GVType) > 0) &&
712 (DL.getTypeAllocSize(InputGVType) > 0))
713 continue;
714 }
715
716 // Conservatively return false, even though we could be smarter
717 // (e.g. look through GlobalAliases).
718 return false;
719 }
720
721 if (isa<Argument>(Input) || isa<CallInst>(Input) ||
722 isa<InvokeInst>(Input)) {
723 // Arguments to functions or returns from functions are inherently
724 // escaping, so we can immediately classify those as not aliasing any
725 // non-addr-taken globals.
726 continue;
727 }
728
729 // Recurse through a limited number of selects, loads and PHIs. This is an
730 // arbitrary depth of 4, lower numbers could be used to fix compile time
731 // issues if needed, but this is generally expected to be only be important
732 // for small depths.
733 if (++Depth > 4)
734 return false;
735
736 if (auto *LI = dyn_cast<LoadInst>(Input)) {
737 // A pointer loaded from a global would have been captured, and we know
738 // that the global is non-escaping, so no alias.
739 const Value *Ptr = GetUnderlyingObject(LI->getPointerOperand(), DL);
740 if (isNonEscapingGlobalNoAliasWithLoad(GV, Ptr, Depth, DL))
741 // The load does not alias with GV.
742 continue;
743 // Otherwise, a load could come from anywhere, so bail.
744 return false;
745 }
746 if (auto *SI = dyn_cast<SelectInst>(Input)) {
747 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL);
748 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL);
749 if (Visited.insert(LHS).second)
750 Inputs.push_back(LHS);
751 if (Visited.insert(RHS).second)
752 Inputs.push_back(RHS);
753 continue;
754 }
755 if (auto *PN = dyn_cast<PHINode>(Input)) {
756 for (const Value *Op : PN->incoming_values()) {
757 Op = GetUnderlyingObject(Op, DL);
758 if (Visited.insert(Op).second)
759 Inputs.push_back(Op);
760 }
761 continue;
762 }
763
764 // FIXME: It would be good to handle other obvious no-alias cases here, but
765 // it isn't clear how to do so reasonbly without building a small version
766 // of BasicAA into this code. We could recurse into AAResultBase::alias
767 // here but that seems likely to go poorly as we're inside the
768 // implementation of such a query. Until then, just conservatievly retun
769 // false.
770 return false;
771 } while (!Inputs.empty());
772
773 // If all the inputs to V were definitively no-alias, then V is no-alias.
774 return true;
775}
776
777/// alias - If one of the pointers is to a global that we are tracking, and the
778/// other is some random pointer, we know there cannot be an alias, because the
779/// address of the global isn't taken.
780AliasResult GlobalsAAResult::alias(const MemoryLocation &LocA,
781 const MemoryLocation &LocB) {
782 // Get the base object these pointers point to.
783 const Value *UV1 = GetUnderlyingObject(LocA.Ptr, DL);
784 const Value *UV2 = GetUnderlyingObject(LocB.Ptr, DL);
785
786 // If either of the underlying values is a global, they may be non-addr-taken
787 // globals, which we can answer queries about.
788 const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
789 const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
790 if (GV1 || GV2) {
791 // If the global's address is taken, pretend we don't know it's a pointer to
792 // the global.
793 if (GV1 && !NonAddressTakenGlobals.count(GV1))
794 GV1 = nullptr;
795 if (GV2 && !NonAddressTakenGlobals.count(GV2))
796 GV2 = nullptr;
797
798 // If the two pointers are derived from two different non-addr-taken
799 // globals we know these can't alias.
800 if (GV1 && GV2 && GV1 != GV2)
801 return NoAlias;
802
803 // If one is and the other isn't, it isn't strictly safe but we can fake
804 // this result if necessary for performance. This does not appear to be
805 // a common problem in practice.
806 if (EnableUnsafeGlobalsModRefAliasResults)
807 if ((GV1 || GV2) && GV1 != GV2)
808 return NoAlias;
809
810 // Check for a special case where a non-escaping global can be used to
811 // conclude no-alias.
812 if ((GV1 || GV2) && GV1 != GV2) {
813 const GlobalValue *GV = GV1 ? GV1 : GV2;
814 const Value *UV = GV1 ? UV2 : UV1;
815 if (isNonEscapingGlobalNoAlias(GV, UV))
816 return NoAlias;
817 }
818
819 // Otherwise if they are both derived from the same addr-taken global, we
820 // can't know the two accesses don't overlap.
821 }
822
823 // These pointers may be based on the memory owned by an indirect global. If
824 // so, we may be able to handle this. First check to see if the base pointer
825 // is a direct load from an indirect global.
826 GV1 = GV2 = nullptr;
827 if (const LoadInst *LI = dyn_cast<LoadInst>(UV1))
828 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
829 if (IndirectGlobals.count(GV))
830 GV1 = GV;
831 if (const LoadInst *LI = dyn_cast<LoadInst>(UV2))
832 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
833 if (IndirectGlobals.count(GV))
834 GV2 = GV;
835
836 // These pointers may also be from an allocation for the indirect global. If
837 // so, also handle them.
838 if (!GV1)
839 GV1 = AllocsForIndirectGlobals.lookup(UV1);
840 if (!GV2)
841 GV2 = AllocsForIndirectGlobals.lookup(UV2);
842
843 // Now that we know whether the two pointers are related to indirect globals,
844 // use this to disambiguate the pointers. If the pointers are based on
845 // different indirect globals they cannot alias.
846 if (GV1 && GV2 && GV1 != GV2)
847 return NoAlias;
848
849 // If one is based on an indirect global and the other isn't, it isn't
850 // strictly safe but we can fake this result if necessary for performance.
851 // This does not appear to be a common problem in practice.
852 if (EnableUnsafeGlobalsModRefAliasResults)
853 if ((GV1 || GV2) && GV1 != GV2)
854 return NoAlias;
855
856 return AAResultBase::alias(LocA, LocB);
857}
858
859ModRefInfo GlobalsAAResult::getModRefInfoForArgument(ImmutableCallSite CS,
860 const GlobalValue *GV) {
861 if (CS.doesNotAccessMemory())
862 return MRI_NoModRef;
863 ModRefInfo ConservativeResult = CS.onlyReadsMemory() ? MRI_Ref : MRI_ModRef;
864
865 // Iterate through all the arguments to the called function. If any argument
866 // is based on GV, return the conservative result.
867 for (auto &A : CS.args()) {
868 SmallVector<Value*, 4> Objects;
869 GetUnderlyingObjects(A, Objects, DL);
870
871 // All objects must be identified.
872 if (!all_of(Objects, isIdentifiedObject) &&
873 // Try ::alias to see if all objects are known not to alias GV.
874 !all_of(Objects, [&](Value *V) {
875 return this->alias(MemoryLocation(V), MemoryLocation(GV)) == NoAlias;
876 }))
877 return ConservativeResult;
878
879 if (is_contained(Objects, GV))
880 return ConservativeResult;
881 }
882
883 // We identified all objects in the argument list, and none of them were GV.
884 return MRI_NoModRef;
885}
886
887ModRefInfo GlobalsAAResult::getModRefInfo(ImmutableCallSite CS,
888 const MemoryLocation &Loc) {
889 unsigned Known = MRI_ModRef;
890
891 // If we are asking for mod/ref info of a direct call with a pointer to a
892 // global we are tracking, return information if we have it.
893 if (const GlobalValue *GV =
894 dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL)))
895 if (GV->hasLocalLinkage())
896 if (const Function *F = CS.getCalledFunction())
897 if (NonAddressTakenGlobals.count(GV))
898 if (const FunctionInfo *FI = getFunctionInfo(F))
899 Known = FI->getModRefInfoForGlobal(*GV) |
900 getModRefInfoForArgument(CS, GV);
901
902 if (Known == MRI_NoModRef)
903 return MRI_NoModRef; // No need to query other mod/ref analyses
904 return ModRefInfo(Known & AAResultBase::getModRefInfo(CS, Loc));
905}
906
907GlobalsAAResult::GlobalsAAResult(const DataLayout &DL,
908 const TargetLibraryInfo &TLI)
909 : AAResultBase(), DL(DL), TLI(TLI) {}
910
911GlobalsAAResult::GlobalsAAResult(GlobalsAAResult &&Arg)
912 : AAResultBase(std::move(Arg)), DL(Arg.DL), TLI(Arg.TLI),
913 NonAddressTakenGlobals(std::move(Arg.NonAddressTakenGlobals)),
914 IndirectGlobals(std::move(Arg.IndirectGlobals)),
915 AllocsForIndirectGlobals(std::move(Arg.AllocsForIndirectGlobals)),
916 FunctionInfos(std::move(Arg.FunctionInfos)),
917 Handles(std::move(Arg.Handles)) {
918 // Update the parent for each DeletionCallbackHandle.
919 for (auto &H : Handles) {
920 assert(H.GAR == &Arg)((H.GAR == &Arg) ? static_cast<void> (0) : __assert_fail
("H.GAR == &Arg", "/tmp/buildd/llvm-toolchain-snapshot-5.0~svn298304/lib/Analysis/GlobalsModRef.cpp"
, 920, __PRETTY_FUNCTION__))
;
921 H.GAR = this;
922 }
923}
924
925GlobalsAAResult::~GlobalsAAResult() {}
926
927/*static*/ GlobalsAAResult
928GlobalsAAResult::analyzeModule(Module &M, const TargetLibraryInfo &TLI,
929 CallGraph &CG) {
930 GlobalsAAResult Result(M.getDataLayout(), TLI);
931
932 // Discover which functions aren't recursive, to feed into AnalyzeGlobals.
933 Result.CollectSCCMembership(CG);
934
935 // Find non-addr taken globals.
936 Result.AnalyzeGlobals(M);
937
938 // Propagate on CG.
939 Result.AnalyzeCallGraph(CG, M);
940
941 return Result;
942}
943
944AnalysisKey GlobalsAA::Key;
945
946GlobalsAAResult GlobalsAA::run(Module &M, ModuleAnalysisManager &AM) {
947 return GlobalsAAResult::analyzeModule(M,
948 AM.getResult<TargetLibraryAnalysis>(M),
949 AM.getResult<CallGraphAnalysis>(M));
950}
951
952char GlobalsAAWrapperPass::ID = 0;
953INITIALIZE_PASS_BEGIN(GlobalsAAWrapperPass, "globals-aa",static void *initializeGlobalsAAWrapperPassPassOnce(PassRegistry
&Registry) {
954 "Globals Alias Analysis", false, true)static void *initializeGlobalsAAWrapperPassPassOnce(PassRegistry
&Registry) {
955INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)initializeCallGraphWrapperPassPass(Registry);
956INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)initializeTargetLibraryInfoWrapperPassPass(Registry);
957INITIALIZE_PASS_END(GlobalsAAWrapperPass, "globals-aa",PassInfo *PI = new PassInfo( "Globals Alias Analysis", "globals-aa"
, &GlobalsAAWrapperPass::ID, PassInfo::NormalCtor_t(callDefaultCtor
<GlobalsAAWrapperPass>), false, true); Registry.registerPass
(*PI, true); return PI; } static llvm::once_flag InitializeGlobalsAAWrapperPassPassFlag
; void llvm::initializeGlobalsAAWrapperPassPass(PassRegistry &
Registry) { llvm::call_once(InitializeGlobalsAAWrapperPassPassFlag
, initializeGlobalsAAWrapperPassPassOnce, std::ref(Registry))
; }
958 "Globals Alias Analysis", false, true)PassInfo *PI = new PassInfo( "Globals Alias Analysis", "globals-aa"
, &GlobalsAAWrapperPass::ID, PassInfo::NormalCtor_t(callDefaultCtor
<GlobalsAAWrapperPass>), false, true); Registry.registerPass
(*PI, true); return PI; } static llvm::once_flag InitializeGlobalsAAWrapperPassPassFlag
; void llvm::initializeGlobalsAAWrapperPassPass(PassRegistry &
Registry) { llvm::call_once(InitializeGlobalsAAWrapperPassPassFlag
, initializeGlobalsAAWrapperPassPassOnce, std::ref(Registry))
; }
959
960ModulePass *llvm::createGlobalsAAWrapperPass() {
961 return new GlobalsAAWrapperPass();
962}
963
964GlobalsAAWrapperPass::GlobalsAAWrapperPass() : ModulePass(ID) {
965 initializeGlobalsAAWrapperPassPass(*PassRegistry::getPassRegistry());
966}
967
968bool GlobalsAAWrapperPass::runOnModule(Module &M) {
969 Result.reset(new GlobalsAAResult(GlobalsAAResult::analyzeModule(
970 M, getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(),
971 getAnalysis<CallGraphWrapperPass>().getCallGraph())));
972 return false;
973}
974
975bool GlobalsAAWrapperPass::doFinalization(Module &M) {
976 Result.reset();
977 return false;
978}
979
980void GlobalsAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const {
981 AU.setPreservesAll();
982 AU.addRequired<CallGraphWrapperPass>();
983 AU.addRequired<TargetLibraryInfoWrapperPass>();
984}