1 //===- Local.cpp - Compute a local data structure graph for a function ----===//
3 // The LLVM Compiler Infrastructure
5 // This file was developed by the LLVM research group and is distributed under
6 // the University of Illinois Open Source License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // Compute the local version of the data structure graph for a function. The
11 // external interface to this file is the DSGraph constructor.
13 //===----------------------------------------------------------------------===//
15 #include "llvm/Analysis/DataStructure.h"
16 #include "llvm/Analysis/DSGraph.h"
17 #include "llvm/Constants.h"
18 #include "llvm/DerivedTypes.h"
19 #include "llvm/Instructions.h"
20 #include "llvm/Intrinsics.h"
21 #include "llvm/Support/GetElementPtrTypeIterator.h"
22 #include "llvm/Support/InstVisitor.h"
23 #include "llvm/Target/TargetData.h"
24 #include "Support/CommandLine.h"
25 #include "Support/Debug.h"
26 #include "Support/Timer.h"
29 // FIXME: This should eventually be a FunctionPass that is automatically
30 // aggregated into a Pass.
32 #include "llvm/Module.h"
36 static RegisterAnalysis<LocalDataStructures>
37 X("datastructure", "Local Data Structure Analysis");
40 TrackIntegersAsPointers("dsa-track-integers",
41 cl::desc("If this is set, track integers as potential pointers"));
45 // isPointerType - Return true if this type is big enough to hold a pointer.
46 bool isPointerType(const Type *Ty) {
47 if (isa<PointerType>(Ty))
49 else if (TrackIntegersAsPointers && Ty->isPrimitiveType() &&Ty->isInteger())
50 return Ty->getPrimitiveSize() >= PointerSize;
59 DisableDirectCallOpt("disable-direct-call-dsopt", cl::Hidden,
60 cl::desc("Disable direct call optimization in "
61 "DSGraph construction"));
63 DisableFieldSensitivity("disable-ds-field-sensitivity", cl::Hidden,
64 cl::desc("Disable field sensitivity in DSGraphs"));
66 //===--------------------------------------------------------------------===//
68 //===--------------------------------------------------------------------===//
70 /// This class is the builder class that constructs the local data structure
71 /// graph by performing a single pass over the function in question.
73 class GraphBuilder : InstVisitor<GraphBuilder> {
75 DSNodeHandle *RetNode; // Node that gets returned...
76 DSScalarMap &ScalarMap;
77 std::vector<DSCallSite> *FunctionCalls;
80 GraphBuilder(Function &f, DSGraph &g, DSNodeHandle &retNode,
81 std::vector<DSCallSite> &fc)
82 : G(g), RetNode(&retNode), ScalarMap(G.getScalarMap()),
85 // Create scalar nodes for all pointer arguments...
86 for (Function::aiterator I = f.abegin(), E = f.aend(); I != E; ++I)
87 if (isPointerType(I->getType()))
90 visit(f); // Single pass over the function
93 // GraphBuilder ctor for working on the globals graph
94 GraphBuilder(DSGraph &g)
95 : G(g), RetNode(0), ScalarMap(G.getScalarMap()), FunctionCalls(0) {
98 void mergeInGlobalInitializer(GlobalVariable *GV);
101 // Visitor functions, used to handle each instruction type we encounter...
102 friend class InstVisitor<GraphBuilder>;
103 void visitMallocInst(MallocInst &MI) { handleAlloc(MI, true); }
104 void visitAllocaInst(AllocaInst &AI) { handleAlloc(AI, false); }
105 void handleAlloc(AllocationInst &AI, bool isHeap);
107 void visitPHINode(PHINode &PN);
109 void visitGetElementPtrInst(User &GEP);
110 void visitReturnInst(ReturnInst &RI);
111 void visitLoadInst(LoadInst &LI);
112 void visitStoreInst(StoreInst &SI);
113 void visitCallInst(CallInst &CI);
114 void visitInvokeInst(InvokeInst &II);
115 void visitSetCondInst(SetCondInst &SCI) {} // SetEQ & friends are ignored
116 void visitFreeInst(FreeInst &FI);
117 void visitCastInst(CastInst &CI);
118 void visitInstruction(Instruction &I);
120 void visitCallSite(CallSite CS);
121 void visitVANextInst(VANextInst &I);
122 void visitVAArgInst(VAArgInst &I);
124 void MergeConstantInitIntoNode(DSNodeHandle &NH, Constant *C);
126 // Helper functions used to implement the visitation functions...
128 /// createNode - Create a new DSNode, ensuring that it is properly added to
131 DSNode *createNode(const Type *Ty = 0) {
132 DSNode *N = new DSNode(Ty, &G); // Create the node
133 if (DisableFieldSensitivity) {
134 // Create node handle referring to the old node so that it is
135 // immediately removed from the graph when the node handle is destroyed.
136 DSNodeHandle OldNNH = N;
137 N->foldNodeCompletely();
138 if (DSNode *FN = N->getForwardNode())
144 /// setDestTo - Set the ScalarMap entry for the specified value to point to
145 /// the specified destination. If the Value already points to a node, make
146 /// sure to merge the two destinations together.
148 void setDestTo(Value &V, const DSNodeHandle &NH);
150 /// getValueDest - Return the DSNode that the actual value points to.
152 DSNodeHandle getValueDest(Value &V);
154 /// getLink - This method is used to return the specified link in the
155 /// specified node if one exists. If a link does not already exist (it's
156 /// null), then we create a new node, link it, then return it.
158 DSNodeHandle &getLink(const DSNodeHandle &Node, unsigned Link = 0);
164 //===----------------------------------------------------------------------===//
165 // DSGraph constructor - Simply use the GraphBuilder to construct the local
167 DSGraph::DSGraph(const TargetData &td, Function &F, DSGraph *GG)
168 : GlobalsGraph(GG), TD(td) {
169 PrintAuxCalls = false;
171 DEBUG(std::cerr << " [Loc] Calculating graph for: " << F.getName() << "\n");
173 // Use the graph builder to construct the local version of the graph
174 GraphBuilder B(F, *this, ReturnNodes[&F], FunctionCalls);
176 Timer::addPeakMemoryMeasurement();
179 // Remove all integral constants from the scalarmap!
180 for (DSScalarMap::iterator I = ScalarMap.begin(); I != ScalarMap.end();)
181 if (isa<ConstantIntegral>(I->first))
182 ScalarMap.erase(I++);
186 // If there are any constant globals referenced in this function, merge their
187 // initializers into the local graph from the globals graph.
188 if (ScalarMap.global_begin() != ScalarMap.global_end()) {
189 ReachabilityCloner RC(*this, *GG, 0);
191 for (DSScalarMap::global_iterator I = ScalarMap.global_begin();
192 I != ScalarMap.global_end(); ++I)
193 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(*I))
194 if (!GV->isExternal() && GV->isConstant())
195 RC.merge(ScalarMap[GV], GG->ScalarMap[GV]);
198 markIncompleteNodes(DSGraph::MarkFormalArgs);
200 // Remove any nodes made dead due to merging...
201 removeDeadNodes(DSGraph::KeepUnreachableGlobals);
205 //===----------------------------------------------------------------------===//
206 // Helper method implementations...
209 /// getValueDest - Return the DSNode that the actual value points to.
211 DSNodeHandle GraphBuilder::getValueDest(Value &Val) {
213 if (V == Constant::getNullValue(V->getType()))
214 return 0; // Null doesn't point to anything, don't add to ScalarMap!
216 DSNodeHandle &NH = ScalarMap[V];
218 return NH; // Already have a node? Just return it...
220 // Otherwise we need to create a new node to point to.
221 // Check first for constant expressions that must be traversed to
222 // extract the actual value.
223 if (Constant *C = dyn_cast<Constant>(V))
224 if (ConstantPointerRef *CPR = dyn_cast<ConstantPointerRef>(C)) {
225 return NH = getValueDest(*CPR->getValue());
226 } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(C)) {
227 if (CE->getOpcode() == Instruction::Cast)
228 NH = getValueDest(*CE->getOperand(0));
229 else if (CE->getOpcode() == Instruction::GetElementPtr) {
230 visitGetElementPtrInst(*CE);
231 DSScalarMap::iterator I = ScalarMap.find(CE);
232 assert(I != ScalarMap.end() && "GEP didn't get processed right?");
235 // This returns a conservative unknown node for any unhandled ConstExpr
236 return NH = createNode()->setUnknownNodeMarker();
238 if (NH.getNode() == 0) { // (getelementptr null, X) returns null
244 } else if (ConstantIntegral *CI = dyn_cast<ConstantIntegral>(C)) {
245 // Random constants are unknown mem
246 return NH = createNode()->setUnknownNodeMarker();
248 assert(0 && "Unknown constant type!");
251 // Otherwise we need to create a new node to point to...
253 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
254 // Create a new global node for this global variable...
255 N = createNode(GV->getType()->getElementType());
258 // Otherwise just create a shadow node
262 NH.setTo(N, 0); // Remember that we are pointing to it...
267 /// getLink - This method is used to return the specified link in the
268 /// specified node if one exists. If a link does not already exist (it's
269 /// null), then we create a new node, link it, then return it. We must
270 /// specify the type of the Node field we are accessing so that we know what
271 /// type should be linked to if we need to create a new node.
273 DSNodeHandle &GraphBuilder::getLink(const DSNodeHandle &node, unsigned LinkNo) {
274 DSNodeHandle &Node = const_cast<DSNodeHandle&>(node);
275 DSNodeHandle &Link = Node.getLink(LinkNo);
276 if (!Link.getNode()) {
277 // If the link hasn't been created yet, make and return a new shadow node
284 /// setDestTo - Set the ScalarMap entry for the specified value to point to the
285 /// specified destination. If the Value already points to a node, make sure to
286 /// merge the two destinations together.
288 void GraphBuilder::setDestTo(Value &V, const DSNodeHandle &NH) {
289 ScalarMap[&V].mergeWith(NH);
293 //===----------------------------------------------------------------------===//
294 // Specific instruction type handler implementations...
297 /// Alloca & Malloc instruction implementation - Simply create a new memory
298 /// object, pointing the scalar to it.
300 void GraphBuilder::handleAlloc(AllocationInst &AI, bool isHeap) {
301 DSNode *N = createNode();
303 N->setHeapNodeMarker();
305 N->setAllocaNodeMarker();
309 // PHINode - Make the scalar for the PHI node point to all of the things the
310 // incoming values point to... which effectively causes them to be merged.
312 void GraphBuilder::visitPHINode(PHINode &PN) {
313 if (!isPointerType(PN.getType())) return; // Only pointer PHIs
315 DSNodeHandle &PNDest = ScalarMap[&PN];
316 for (unsigned i = 0, e = PN.getNumIncomingValues(); i != e; ++i)
317 PNDest.mergeWith(getValueDest(*PN.getIncomingValue(i)));
320 void GraphBuilder::visitGetElementPtrInst(User &GEP) {
321 DSNodeHandle Value = getValueDest(*GEP.getOperand(0));
322 if (Value.getNode() == 0) return;
324 // As a special case, if all of the index operands of GEP are constant zeros,
325 // handle this just like we handle casts (ie, don't do much).
326 bool AllZeros = true;
327 for (unsigned i = 1, e = GEP.getNumOperands(); i != e; ++i)
328 if (GEP.getOperand(i) !=
329 Constant::getNullValue(GEP.getOperand(i)->getType())) {
334 // If all of the indices are zero, the result points to the operand without
335 // applying the type.
337 setDestTo(GEP, Value);
342 const PointerType *PTy = cast<PointerType>(GEP.getOperand(0)->getType());
343 const Type *CurTy = PTy->getElementType();
345 if (Value.getNode()->mergeTypeInfo(CurTy, Value.getOffset())) {
346 // If the node had to be folded... exit quickly
347 setDestTo(GEP, Value); // GEP result points to folded node
351 const TargetData &TD = Value.getNode()->getTargetData();
354 // Handle the pointer index specially...
355 if (GEP.getNumOperands() > 1 &&
356 (!isa<Constant>(GEP.getOperand(1)) ||
357 !cast<Constant>(GEP.getOperand(1))->isNullValue())) {
359 // If we already know this is an array being accessed, don't do anything...
360 if (!TopTypeRec.isArray) {
361 TopTypeRec.isArray = true;
363 // If we are treating some inner field pointer as an array, fold the node
364 // up because we cannot handle it right. This can come because of
365 // something like this: &((&Pt->X)[1]) == &Pt->Y
367 if (Value.getOffset()) {
368 // Value is now the pointer we want to GEP to be...
369 Value.getNode()->foldNodeCompletely();
370 setDestTo(GEP, Value); // GEP result points to folded node
373 // This is a pointer to the first byte of the node. Make sure that we
374 // are pointing to the outter most type in the node.
375 // FIXME: We need to check one more case here...
381 // All of these subscripts are indexing INTO the elements we have...
383 for (gep_type_iterator I = gep_type_begin(GEP), E = gep_type_end(GEP);
385 if (const StructType *STy = dyn_cast<StructType>(*I)) {
386 unsigned FieldNo = cast<ConstantUInt>(I.getOperand())->getValue();
387 Offset += TD.getStructLayout(STy)->MemberOffsets[FieldNo];
388 } else if (const PointerType *PTy = dyn_cast<PointerType>(*I)) {
389 if (!isa<Constant>(I.getOperand()) ||
390 !cast<Constant>(I.getOperand())->isNullValue())
391 Value.getNode()->setArrayMarker();
396 if (const SequentialType *STy = cast<SequentialType>(*I)) {
397 CurTy = STy->getElementType();
398 if (ConstantSInt *CS = dyn_cast<ConstantSInt>(GEP.getOperand(i))) {
399 Offset += CS->getValue()*TD.getTypeSize(CurTy);
401 // Variable index into a node. We must merge all of the elements of the
402 // sequential type here.
403 if (isa<PointerType>(STy))
404 std::cerr << "Pointer indexing not handled yet!\n";
406 const ArrayType *ATy = cast<ArrayType>(STy);
407 unsigned ElSize = TD.getTypeSize(CurTy);
408 DSNode *N = Value.getNode();
409 assert(N && "Value must have a node!");
410 unsigned RawOffset = Offset+Value.getOffset();
412 // Loop over all of the elements of the array, merging them into the
414 for (unsigned i = 1, e = ATy->getNumElements(); i != e; ++i)
415 // Merge all of the byte components of this array element
416 for (unsigned j = 0; j != ElSize; ++j)
417 N->mergeIndexes(RawOffset+j, RawOffset+i*ElSize+j);
423 // Add in the offset calculated...
424 Value.setOffset(Value.getOffset()+Offset);
426 // Value is now the pointer we want to GEP to be...
427 setDestTo(GEP, Value);
430 void GraphBuilder::visitLoadInst(LoadInst &LI) {
431 DSNodeHandle Ptr = getValueDest(*LI.getOperand(0));
432 if (Ptr.getNode() == 0) return;
434 // Make that the node is read from...
435 Ptr.getNode()->setReadMarker();
437 // Ensure a typerecord exists...
438 Ptr.getNode()->mergeTypeInfo(LI.getType(), Ptr.getOffset(), false);
440 if (isPointerType(LI.getType()))
441 setDestTo(LI, getLink(Ptr));
444 void GraphBuilder::visitStoreInst(StoreInst &SI) {
445 const Type *StoredTy = SI.getOperand(0)->getType();
446 DSNodeHandle Dest = getValueDest(*SI.getOperand(1));
447 if (Dest.isNull()) return;
449 // Mark that the node is written to...
450 Dest.getNode()->setModifiedMarker();
452 // Ensure a type-record exists...
453 Dest.getNode()->mergeTypeInfo(StoredTy, Dest.getOffset());
455 // Avoid adding edges from null, or processing non-"pointer" stores
456 if (isPointerType(StoredTy))
457 Dest.addEdgeTo(getValueDest(*SI.getOperand(0)));
460 void GraphBuilder::visitReturnInst(ReturnInst &RI) {
461 if (RI.getNumOperands() && isPointerType(RI.getOperand(0)->getType()))
462 RetNode->mergeWith(getValueDest(*RI.getOperand(0)));
465 void GraphBuilder::visitVANextInst(VANextInst &I) {
466 getValueDest(*I.getOperand(0)).mergeWith(getValueDest(I));
469 void GraphBuilder::visitVAArgInst(VAArgInst &I) {
470 DSNodeHandle Ptr = getValueDest(*I.getOperand(0));
471 if (Ptr.isNull()) return;
473 // Make that the node is read from.
474 Ptr.getNode()->setReadMarker();
476 // Ensure a typerecord exists...
477 Ptr.getNode()->mergeTypeInfo(I.getType(), Ptr.getOffset(), false);
479 if (isPointerType(I.getType()))
480 setDestTo(I, getLink(Ptr));
484 void GraphBuilder::visitCallInst(CallInst &CI) {
488 void GraphBuilder::visitInvokeInst(InvokeInst &II) {
492 void GraphBuilder::visitCallSite(CallSite CS) {
493 Value *Callee = CS.getCalledValue();
494 if (ConstantPointerRef *CPR = dyn_cast<ConstantPointerRef>(Callee))
495 Callee = CPR->getValue();
497 // Special case handling of certain libc allocation functions here.
498 if (Function *F = dyn_cast<Function>(Callee))
500 switch (F->getIntrinsicID()) {
501 case Intrinsic::vastart:
502 getValueDest(*CS.getInstruction()).getNode()->setAllocaNodeMarker();
504 case Intrinsic::vacopy:
505 getValueDest(*CS.getInstruction()).
506 mergeWith(getValueDest(**(CS.arg_begin())));
508 case Intrinsic::vaend:
510 case Intrinsic::memmove:
511 case Intrinsic::memcpy: {
512 // Merge the first & second arguments, and mark the memory read and
514 DSNodeHandle RetNH = getValueDest(**CS.arg_begin());
515 RetNH.mergeWith(getValueDest(**(CS.arg_begin()+1)));
516 if (DSNode *N = RetNH.getNode())
517 N->setModifiedMarker()->setReadMarker();
520 case Intrinsic::memset:
521 // Mark the memory modified.
522 if (DSNode *N = getValueDest(**CS.arg_begin()).getNode())
523 N->setModifiedMarker();
526 if (F->getName() == "calloc" || F->getName() == "posix_memalign" ||
527 F->getName() == "memalign" || F->getName() == "valloc") {
528 setDestTo(*CS.getInstruction(),
529 createNode()->setHeapNodeMarker()->setModifiedMarker());
531 } else if (F->getName() == "realloc") {
532 DSNodeHandle RetNH = getValueDest(*CS.getInstruction());
533 RetNH.mergeWith(getValueDest(**CS.arg_begin()));
534 if (DSNode *N = RetNH.getNode())
535 N->setHeapNodeMarker()->setModifiedMarker()->setReadMarker();
537 } else if (F->getName() == "memmove") {
538 // Merge the first & second arguments, and mark the memory read and
540 DSNodeHandle RetNH = getValueDest(**CS.arg_begin());
541 RetNH.mergeWith(getValueDest(**(CS.arg_begin()+1)));
542 if (DSNode *N = RetNH.getNode())
543 N->setModifiedMarker()->setReadMarker();
546 } else if (F->getName() == "atoi" || F->getName() == "atof" ||
547 F->getName() == "atol" || F->getName() == "atoll" ||
548 F->getName() == "remove" || F->getName() == "unlink" ||
549 F->getName() == "rename" || F->getName() == "memcmp" ||
550 F->getName() == "strcmp" || F->getName() == "strncmp" ||
551 F->getName() == "execl" || F->getName() == "execlp" ||
552 F->getName() == "execle" || F->getName() == "execv" ||
553 F->getName() == "execvp" || F->getName() == "chmod" ||
554 F->getName() == "puts" || F->getName() == "write" ||
555 F->getName() == "open" || F->getName() == "create" ||
556 F->getName() == "truncate" || F->getName() == "chdir" ||
557 F->getName() == "mkdir" || F->getName() == "rmdir") {
558 // These functions read all of their pointer operands.
559 for (CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
561 if (isPointerType((*AI)->getType()))
562 if (DSNode *N = getValueDest(**AI).getNode())
566 } else if (F->getName() == "read" || F->getName() == "pipe" ||
567 F->getName() == "wait" || F->getName() == "time") {
568 // These functions write all of their pointer operands.
569 for (CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
571 if (isPointerType((*AI)->getType()))
572 if (DSNode *N = getValueDest(**AI).getNode())
573 N->setModifiedMarker();
576 } else if (F->getName() == "stat" || F->getName() == "fstat" ||
577 F->getName() == "lstat") {
578 // These functions read their first operand if its a pointer.
579 CallSite::arg_iterator AI = CS.arg_begin();
580 if (isPointerType((*AI)->getType())) {
581 DSNodeHandle Path = getValueDest(**AI);
582 if (DSNode *N = Path.getNode()) N->setReadMarker();
585 // Then they write into the stat buffer.
586 DSNodeHandle StatBuf = getValueDest(**++AI);
587 if (DSNode *N = StatBuf.getNode()) {
588 N->setModifiedMarker();
589 const Type *StatTy = F->getFunctionType()->getParamType(1);
590 if (const PointerType *PTy = dyn_cast<PointerType>(StatTy))
591 N->mergeTypeInfo(PTy->getElementType(), StatBuf.getOffset());
594 } else if (F->getName() == "strtod" || F->getName() == "strtof" ||
595 F->getName() == "strtold") {
596 // These functions read the first pointer
597 if (DSNode *Str = getValueDest(**CS.arg_begin()).getNode()) {
598 Str->setReadMarker();
599 // If the second parameter is passed, it will point to the first
601 const DSNodeHandle &EndPtrNH = getValueDest(**(CS.arg_begin()+1));
602 if (DSNode *End = EndPtrNH.getNode()) {
603 End->mergeTypeInfo(PointerType::get(Type::SByteTy),
604 EndPtrNH.getOffset(), false);
605 End->setModifiedMarker();
606 DSNodeHandle &Link = getLink(EndPtrNH);
607 Link.mergeWith(getValueDest(**CS.arg_begin()));
612 } else if (F->getName() == "fopen" || F->getName() == "fdopen" ||
613 F->getName() == "freopen") {
614 // These functions read all of their pointer operands.
615 for (CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
617 if (isPointerType((*AI)->getType()))
618 if (DSNode *N = getValueDest(**AI).getNode())
621 // fopen allocates in an unknown way and writes to the file
622 // descriptor. Also, merge the allocated type into the node.
623 DSNodeHandle Result = getValueDest(*CS.getInstruction());
624 if (DSNode *N = Result.getNode()) {
625 N->setModifiedMarker()->setUnknownNodeMarker();
626 const Type *RetTy = F->getFunctionType()->getReturnType();
627 if (const PointerType *PTy = dyn_cast<PointerType>(RetTy))
628 N->mergeTypeInfo(PTy->getElementType(), Result.getOffset());
631 // If this is freopen, merge the file descriptor passed in with the
633 if (F->getName() == "freopen")
634 Result.mergeWith(getValueDest(**--CS.arg_end()));
637 } else if (F->getName() == "fclose" && CS.arg_end()-CS.arg_begin() ==1){
638 // fclose reads and deallocates the memory in an unknown way for the
639 // file descriptor. It merges the FILE type into the descriptor.
640 DSNodeHandle H = getValueDest(**CS.arg_begin());
641 if (DSNode *N = H.getNode()) {
642 N->setReadMarker()->setUnknownNodeMarker();
643 const Type *ArgTy = F->getFunctionType()->getParamType(0);
644 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
645 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
648 } else if (CS.arg_end()-CS.arg_begin() == 1 &&
649 (F->getName() == "fflush" || F->getName() == "feof" ||
650 F->getName() == "fileno" || F->getName() == "clearerr" ||
651 F->getName() == "rewind" || F->getName() == "ftell" ||
652 F->getName() == "ferror" || F->getName() == "fgetc" ||
653 F->getName() == "fgetc" || F->getName() == "_IO_getc")) {
654 // fflush reads and writes the memory for the file descriptor. It
655 // merges the FILE type into the descriptor.
656 DSNodeHandle H = getValueDest(**CS.arg_begin());
657 if (DSNode *N = H.getNode()) {
658 N->setReadMarker()->setModifiedMarker();
660 const Type *ArgTy = F->getFunctionType()->getParamType(0);
661 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
662 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
665 } else if (CS.arg_end()-CS.arg_begin() == 4 &&
666 (F->getName() == "fwrite" || F->getName() == "fread")) {
667 // fread writes the first operand, fwrite reads it. They both
668 // read/write the FILE descriptor, and merges the FILE type.
669 DSNodeHandle H = getValueDest(**--CS.arg_end());
670 if (DSNode *N = H.getNode()) {
671 N->setReadMarker()->setModifiedMarker();
672 const Type *ArgTy = F->getFunctionType()->getParamType(3);
673 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
674 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
677 H = getValueDest(**CS.arg_begin());
678 if (DSNode *N = H.getNode())
679 if (F->getName() == "fwrite")
682 N->setModifiedMarker();
684 } else if (F->getName() == "fgets" && CS.arg_end()-CS.arg_begin() == 3){
685 // fgets reads and writes the memory for the file descriptor. It
686 // merges the FILE type into the descriptor, and writes to the
687 // argument. It returns the argument as well.
688 CallSite::arg_iterator AI = CS.arg_begin();
689 DSNodeHandle H = getValueDest(**AI);
690 if (DSNode *N = H.getNode())
691 N->setModifiedMarker(); // Writes buffer
692 H.mergeWith(getValueDest(*CS.getInstruction())); // Returns buffer
695 // Reads and writes file descriptor, merge in FILE type.
696 H = getValueDest(**AI);
697 if (DSNode *N = H.getNode()) {
698 N->setReadMarker()->setModifiedMarker();
699 const Type *ArgTy = F->getFunctionType()->getParamType(2);
700 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
701 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
704 } else if (F->getName() == "ungetc" || F->getName() == "fputc" ||
705 F->getName() == "fputs" || F->getName() == "putc" ||
706 F->getName() == "ftell" || F->getName() == "rewind" ||
707 F->getName() == "_IO_putc") {
708 // These functions read and write the memory for the file descriptor,
709 // which is passes as the last argument.
710 DSNodeHandle H = getValueDest(**--CS.arg_end());
711 if (DSNode *N = H.getNode()) {
712 N->setReadMarker()->setModifiedMarker();
713 const Type *ArgTy = *--F->getFunctionType()->param_end();
714 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
715 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
718 // Any pointer arguments are read.
719 for (CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
721 if (isPointerType((*AI)->getType()))
722 if (DSNode *N = getValueDest(**AI).getNode())
725 } else if (F->getName() == "fseek" || F->getName() == "fgetpos" ||
726 F->getName() == "fsetpos") {
727 // These functions read and write the memory for the file descriptor,
728 // and read/write all other arguments.
729 DSNodeHandle H = getValueDest(**CS.arg_begin());
730 if (DSNode *N = H.getNode()) {
731 const Type *ArgTy = *--F->getFunctionType()->param_end();
732 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
733 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
736 // Any pointer arguments are read.
737 for (CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
739 if (isPointerType((*AI)->getType()))
740 if (DSNode *N = getValueDest(**AI).getNode())
741 N->setReadMarker()->setModifiedMarker();
743 } else if (F->getName() == "printf" || F->getName() == "fprintf" ||
744 F->getName() == "sprintf") {
745 CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
747 if (F->getName() == "fprintf") {
748 // fprintf reads and writes the FILE argument, and applies the type
750 DSNodeHandle H = getValueDest(**AI);
751 if (DSNode *N = H.getNode()) {
752 N->setModifiedMarker();
753 const Type *ArgTy = (*AI)->getType();
754 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
755 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
757 } else if (F->getName() == "sprintf") {
758 // sprintf writes the first string argument.
759 DSNodeHandle H = getValueDest(**AI++);
760 if (DSNode *N = H.getNode()) {
761 N->setModifiedMarker();
762 const Type *ArgTy = (*AI)->getType();
763 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
764 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
768 for (; AI != E; ++AI) {
769 // printf reads all pointer arguments.
770 if (isPointerType((*AI)->getType()))
771 if (DSNode *N = getValueDest(**AI).getNode())
775 } else if (F->getName() == "vprintf" || F->getName() == "vfprintf" ||
776 F->getName() == "vsprintf") {
777 CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
779 if (F->getName() == "vfprintf") {
780 // ffprintf reads and writes the FILE argument, and applies the type
782 DSNodeHandle H = getValueDest(**AI);
783 if (DSNode *N = H.getNode()) {
784 N->setModifiedMarker()->setReadMarker();
785 const Type *ArgTy = (*AI)->getType();
786 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
787 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
790 } else if (F->getName() == "vsprintf") {
791 // vsprintf writes the first string argument.
792 DSNodeHandle H = getValueDest(**AI++);
793 if (DSNode *N = H.getNode()) {
794 N->setModifiedMarker();
795 const Type *ArgTy = (*AI)->getType();
796 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
797 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
803 if (isPointerType((*AI)->getType()))
804 if (DSNode *N = getValueDest(**AI).getNode())
809 // Read the valist, and the pointed-to objects.
810 if (AI != E && isPointerType((*AI)->getType())) {
811 const DSNodeHandle &VAList = getValueDest(**AI);
812 if (DSNode *N = VAList.getNode()) {
814 N->mergeTypeInfo(PointerType::get(Type::SByteTy),
815 VAList.getOffset(), false);
817 DSNodeHandle &VAListObjs = getLink(VAList);
818 VAListObjs.getNode()->setReadMarker();
823 } else if (F->getName() == "scanf" || F->getName() == "fscanf" ||
824 F->getName() == "sscanf") {
825 CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
827 if (F->getName() == "fscanf") {
828 // fscanf reads and writes the FILE argument, and applies the type
830 DSNodeHandle H = getValueDest(**AI);
831 if (DSNode *N = H.getNode()) {
833 const Type *ArgTy = (*AI)->getType();
834 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
835 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
837 } else if (F->getName() == "sscanf") {
838 // sscanf reads the first string argument.
839 DSNodeHandle H = getValueDest(**AI++);
840 if (DSNode *N = H.getNode()) {
842 const Type *ArgTy = (*AI)->getType();
843 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
844 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
848 for (; AI != E; ++AI) {
849 // scanf writes all pointer arguments.
850 if (isPointerType((*AI)->getType()))
851 if (DSNode *N = getValueDest(**AI).getNode())
852 N->setModifiedMarker();
855 } else if (F->getName() == "strtok") {
856 // strtok reads and writes the first argument, returning it. It reads
857 // its second arg. FIXME: strtok also modifies some hidden static
858 // data. Someday this might matter.
859 CallSite::arg_iterator AI = CS.arg_begin();
860 DSNodeHandle H = getValueDest(**AI++);
861 if (DSNode *N = H.getNode()) {
862 N->setReadMarker()->setModifiedMarker(); // Reads/Writes buffer
863 const Type *ArgTy = F->getFunctionType()->getParamType(0);
864 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
865 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
867 H.mergeWith(getValueDest(*CS.getInstruction())); // Returns buffer
869 H = getValueDest(**AI); // Reads delimiter
870 if (DSNode *N = H.getNode()) {
872 const Type *ArgTy = F->getFunctionType()->getParamType(1);
873 if (const PointerType *PTy = dyn_cast<PointerType>(ArgTy))
874 N->mergeTypeInfo(PTy->getElementType(), H.getOffset());
877 } else if (F->getName() == "strchr" || F->getName() == "strrchr" ||
878 F->getName() == "strstr") {
879 // These read their arguments, and return the first one
880 DSNodeHandle H = getValueDest(**CS.arg_begin());
881 H.mergeWith(getValueDest(*CS.getInstruction())); // Returns buffer
883 for (CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
885 if (isPointerType((*AI)->getType()))
886 if (DSNode *N = getValueDest(**AI).getNode())
889 if (DSNode *N = H.getNode())
892 } else if (F->getName() == "modf" && CS.arg_end()-CS.arg_begin() == 2) {
893 // This writes its second argument, and forces it to double.
894 DSNodeHandle H = getValueDest(**--CS.arg_end());
895 if (DSNode *N = H.getNode()) {
896 N->setModifiedMarker();
897 N->mergeTypeInfo(Type::DoubleTy, H.getOffset());
901 // Unknown function, warn if it returns a pointer type or takes a
903 bool Warn = isPointerType(CS.getInstruction()->getType());
905 for (CallSite::arg_iterator I = CS.arg_begin(), E = CS.arg_end();
907 if (isPointerType((*I)->getType())) {
912 std::cerr << "WARNING: Call to unknown external function '"
913 << F->getName() << "' will cause pessimistic results!\n";
918 // Set up the return value...
920 Instruction *I = CS.getInstruction();
921 if (isPointerType(I->getType()))
922 RetVal = getValueDest(*I);
924 DSNode *CalleeNode = 0;
925 if (DisableDirectCallOpt || !isa<Function>(Callee)) {
926 CalleeNode = getValueDest(*Callee).getNode();
927 if (CalleeNode == 0) {
928 std::cerr << "WARNING: Program is calling through a null pointer?\n"<< *I;
929 return; // Calling a null pointer?
933 std::vector<DSNodeHandle> Args;
934 Args.reserve(CS.arg_end()-CS.arg_begin());
936 // Calculate the arguments vector...
937 for (CallSite::arg_iterator I = CS.arg_begin(), E = CS.arg_end(); I != E; ++I)
938 if (isPointerType((*I)->getType()))
939 Args.push_back(getValueDest(**I));
941 // Add a new function call entry...
943 FunctionCalls->push_back(DSCallSite(CS, RetVal, CalleeNode, Args));
945 FunctionCalls->push_back(DSCallSite(CS, RetVal, cast<Function>(Callee),
949 void GraphBuilder::visitFreeInst(FreeInst &FI) {
950 // Mark that the node is written to...
951 if (DSNode *N = getValueDest(*FI.getOperand(0)).getNode())
952 N->setModifiedMarker()->setHeapNodeMarker();
956 void GraphBuilder::visitCastInst(CastInst &CI) {
957 if (isPointerType(CI.getType()))
958 if (isPointerType(CI.getOperand(0)->getType())) {
959 // Cast one pointer to the other, just act like a copy instruction
960 setDestTo(CI, getValueDest(*CI.getOperand(0)));
962 // Cast something (floating point, small integer) to a pointer. We need
963 // to track the fact that the node points to SOMETHING, just something we
964 // don't know about. Make an "Unknown" node.
966 setDestTo(CI, createNode()->setUnknownNodeMarker());
971 // visitInstruction - For all other instruction types, if we have any arguments
972 // that are of pointer type, make them have unknown composition bits, and merge
973 // the nodes together.
974 void GraphBuilder::visitInstruction(Instruction &Inst) {
975 DSNodeHandle CurNode;
976 if (isPointerType(Inst.getType()))
977 CurNode = getValueDest(Inst);
978 for (User::op_iterator I = Inst.op_begin(), E = Inst.op_end(); I != E; ++I)
979 if (isPointerType((*I)->getType()))
980 CurNode.mergeWith(getValueDest(**I));
982 if (CurNode.getNode())
983 CurNode.getNode()->setUnknownNodeMarker();
988 //===----------------------------------------------------------------------===//
989 // LocalDataStructures Implementation
990 //===----------------------------------------------------------------------===//
992 // MergeConstantInitIntoNode - Merge the specified constant into the node
994 void GraphBuilder::MergeConstantInitIntoNode(DSNodeHandle &NH, Constant *C) {
995 // Ensure a type-record exists...
996 NH.getNode()->mergeTypeInfo(C->getType(), NH.getOffset());
998 if (C->getType()->isFirstClassType()) {
999 if (isPointerType(C->getType()))
1000 // Avoid adding edges from null, or processing non-"pointer" stores
1001 NH.addEdgeTo(getValueDest(*C));
1005 const TargetData &TD = NH.getNode()->getTargetData();
1007 if (ConstantArray *CA = dyn_cast<ConstantArray>(C)) {
1008 for (unsigned i = 0, e = CA->getNumOperands(); i != e; ++i)
1009 // We don't currently do any indexing for arrays...
1010 MergeConstantInitIntoNode(NH, cast<Constant>(CA->getOperand(i)));
1011 } else if (ConstantStruct *CS = dyn_cast<ConstantStruct>(C)) {
1012 const StructLayout *SL = TD.getStructLayout(CS->getType());
1013 for (unsigned i = 0, e = CS->getNumOperands(); i != e; ++i) {
1014 DSNodeHandle NewNH(NH.getNode(), NH.getOffset()+SL->MemberOffsets[i]);
1015 MergeConstantInitIntoNode(NewNH, cast<Constant>(CS->getOperand(i)));
1017 } else if (ConstantAggregateZero *CAZ = dyn_cast<ConstantAggregateZero>(C)) {
1020 assert(0 && "Unknown constant type!");
1024 void GraphBuilder::mergeInGlobalInitializer(GlobalVariable *GV) {
1025 assert(!GV->isExternal() && "Cannot merge in external global!");
1026 // Get a node handle to the global node and merge the initializer into it.
1027 DSNodeHandle NH = getValueDest(*GV);
1028 MergeConstantInitIntoNode(NH, GV->getInitializer());
1032 bool LocalDataStructures::run(Module &M) {
1033 GlobalsGraph = new DSGraph(getAnalysis<TargetData>());
1035 const TargetData &TD = getAnalysis<TargetData>();
1038 GraphBuilder GGB(*GlobalsGraph);
1040 // Add initializers for all of the globals to the globals graph...
1041 for (Module::giterator I = M.gbegin(), E = M.gend(); I != E; ++I)
1042 if (!I->isExternal())
1043 GGB.mergeInGlobalInitializer(I);
1046 // Calculate all of the graphs...
1047 for (Module::iterator I = M.begin(), E = M.end(); I != E; ++I)
1048 if (!I->isExternal())
1049 DSInfo.insert(std::make_pair(I, new DSGraph(TD, *I, GlobalsGraph)));
1051 GlobalsGraph->removeTriviallyDeadNodes();
1052 GlobalsGraph->markIncompleteNodes(DSGraph::MarkFormalArgs);
1056 // releaseMemory - If the pass pipeline is done with this pass, we can release
1057 // our memory... here...
1059 void LocalDataStructures::releaseMemory() {
1060 for (hash_map<Function*, DSGraph*>::iterator I = DSInfo.begin(),
1061 E = DSInfo.end(); I != E; ++I) {
1062 I->second->getReturnNodes().erase(I->first);
1063 if (I->second->getReturnNodes().empty())
1067 // Empty map so next time memory is released, data structures are not
1070 delete GlobalsGraph;