1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This simple pass provides alias and mod/ref information for global values
11 // that do not have their address taken, and keeps track of whether functions
12 // read or write memory (are "pure"). For this simple (but very common) case,
13 // we can provide pretty accurate and useful information.
15 //===----------------------------------------------------------------------===//
17 #include "llvm/Analysis/GlobalsModRef.h"
18 #include "llvm/ADT/SCCIterator.h"
19 #include "llvm/ADT/SmallPtrSet.h"
20 #include "llvm/ADT/Statistic.h"
21 #include "llvm/Analysis/MemoryBuiltins.h"
22 #include "llvm/Analysis/TargetLibraryInfo.h"
23 #include "llvm/Analysis/ValueTracking.h"
24 #include "llvm/IR/DerivedTypes.h"
25 #include "llvm/IR/InstIterator.h"
26 #include "llvm/IR/Instructions.h"
27 #include "llvm/IR/IntrinsicInst.h"
28 #include "llvm/IR/Module.h"
29 #include "llvm/Pass.h"
30 #include "llvm/Support/CommandLine.h"
33 #define DEBUG_TYPE "globalsmodref-aa"
35 STATISTIC(NumNonAddrTakenGlobalVars,
36 "Number of global vars without address taken");
37 STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
38 STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
39 STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
40 STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
42 // An option to enable unsafe alias results from the GlobalsModRef analysis.
43 // When enabled, GlobalsModRef will provide no-alias results which in extremely
44 // rare cases may not be conservatively correct. In particular, in the face of
45 // transforms which cause assymetry between how effective GetUnderlyingObject
46 // is for two pointers, it may produce incorrect results.
48 // These unsafe results have been returned by GMR for many years without
49 // causing significant issues in the wild and so we provide a mechanism to
50 // re-enable them for users of LLVM that have a particular performance
51 // sensitivity and no known issues. The option also makes it easy to evaluate
52 // the performance impact of these results.
53 static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults(
54 "enable-unsafe-globalsmodref-alias-results", cl::init(false), cl::Hidden);
56 /// The mod/ref information collected for a particular function.
58 /// We collect information about mod/ref behavior of a function here, both in
59 /// general and as pertains to specific globals. We only have this detailed
60 /// information when we know *something* useful about the behavior. If we
61 /// saturate to fully general mod/ref, we remove the info for the function.
62 class GlobalsAAResult::FunctionInfo {
63 typedef SmallDenseMap<const GlobalValue *, ModRefInfo, 16> GlobalInfoMapType;
65 /// Build a wrapper struct that has 8-byte alignment. All heap allocations
66 /// should provide this much alignment at least, but this makes it clear we
67 /// specifically rely on this amount of alignment.
68 struct LLVM_ALIGNAS(8) AlignedMap {
70 AlignedMap(const AlignedMap &Arg) : Map(Arg.Map) {}
71 GlobalInfoMapType Map;
74 /// Pointer traits for our aligned map.
75 struct AlignedMapPointerTraits {
76 static inline void *getAsVoidPointer(AlignedMap *P) { return P; }
77 static inline AlignedMap *getFromVoidPointer(void *P) {
78 return (AlignedMap *)P;
80 enum { NumLowBitsAvailable = 3 };
81 static_assert(AlignOf<AlignedMap>::Alignment >= (1 << NumLowBitsAvailable),
82 "AlignedMap insufficiently aligned to have enough low bits.");
85 /// The bit that flags that this function may read any global. This is
86 /// chosen to mix together with ModRefInfo bits.
87 enum { MayReadAnyGlobal = 4 };
89 /// Checks to document the invariants of the bit packing here.
90 static_assert((MayReadAnyGlobal & MRI_ModRef) == 0,
91 "ModRef and the MayReadAnyGlobal flag bits overlap.");
92 static_assert(((MayReadAnyGlobal | MRI_ModRef) >>
93 AlignedMapPointerTraits::NumLowBitsAvailable) == 0,
94 "Insufficient low bits to store our flag and ModRef info.");
97 FunctionInfo() : Info() {}
99 delete Info.getPointer();
101 // Spell out the copy ond move constructors and assignment operators to get
102 // deep copy semantics and correct move semantics in the face of the
104 FunctionInfo(const FunctionInfo &Arg)
105 : Info(nullptr, Arg.Info.getInt()) {
106 if (const auto *ArgPtr = Arg.Info.getPointer())
107 Info.setPointer(new AlignedMap(*ArgPtr));
109 FunctionInfo(FunctionInfo &&Arg)
110 : Info(Arg.Info.getPointer(), Arg.Info.getInt()) {
111 Arg.Info.setPointerAndInt(nullptr, 0);
113 FunctionInfo &operator=(const FunctionInfo &RHS) {
114 delete Info.getPointer();
115 Info.setPointerAndInt(nullptr, RHS.Info.getInt());
116 if (const auto *RHSPtr = RHS.Info.getPointer())
117 Info.setPointer(new AlignedMap(*RHSPtr));
120 FunctionInfo &operator=(FunctionInfo &&RHS) {
121 delete Info.getPointer();
122 Info.setPointerAndInt(RHS.Info.getPointer(), RHS.Info.getInt());
123 RHS.Info.setPointerAndInt(nullptr, 0);
127 /// Returns the \c ModRefInfo info for this function.
128 ModRefInfo getModRefInfo() const {
129 return ModRefInfo(Info.getInt() & MRI_ModRef);
132 /// Adds new \c ModRefInfo for this function to its state.
133 void addModRefInfo(ModRefInfo NewMRI) {
134 Info.setInt(Info.getInt() | NewMRI);
137 /// Returns whether this function may read any global variable, and we don't
138 /// know which global.
139 bool mayReadAnyGlobal() const { return Info.getInt() & MayReadAnyGlobal; }
141 /// Sets this function as potentially reading from any global.
142 void setMayReadAnyGlobal() { Info.setInt(Info.getInt() | MayReadAnyGlobal); }
144 /// Returns the \c ModRefInfo info for this function w.r.t. a particular
145 /// global, which may be more precise than the general information above.
146 ModRefInfo getModRefInfoForGlobal(const GlobalValue &GV) const {
147 ModRefInfo GlobalMRI = mayReadAnyGlobal() ? MRI_Ref : MRI_NoModRef;
148 if (AlignedMap *P = Info.getPointer()) {
149 auto I = P->Map.find(&GV);
150 if (I != P->Map.end())
151 GlobalMRI = ModRefInfo(GlobalMRI | I->second);
156 /// Add mod/ref info from another function into ours, saturating towards
158 void addFunctionInfo(const FunctionInfo &FI) {
159 addModRefInfo(FI.getModRefInfo());
161 if (FI.mayReadAnyGlobal())
162 setMayReadAnyGlobal();
164 if (AlignedMap *P = FI.Info.getPointer())
165 for (const auto &G : P->Map)
166 addModRefInfoForGlobal(*G.first, G.second);
169 void addModRefInfoForGlobal(const GlobalValue &GV, ModRefInfo NewMRI) {
170 AlignedMap *P = Info.getPointer();
172 P = new AlignedMap();
175 auto &GlobalMRI = P->Map[&GV];
176 GlobalMRI = ModRefInfo(GlobalMRI | NewMRI);
179 /// Clear a global's ModRef info. Should be used when a global is being
181 void eraseModRefInfoForGlobal(const GlobalValue &GV) {
182 if (AlignedMap *P = Info.getPointer())
187 /// All of the information is encoded into a single pointer, with a three bit
188 /// integer in the low three bits. The high bit provides a flag for when this
189 /// function may read any global. The low two bits are the ModRefInfo. And
190 /// the pointer, when non-null, points to a map from GlobalValue to
191 /// ModRefInfo specific to that GlobalValue.
192 PointerIntPair<AlignedMap *, 3, unsigned, AlignedMapPointerTraits> Info;
195 void GlobalsAAResult::DeletionCallbackHandle::deleted() {
196 Value *V = getValPtr();
197 if (auto *F = dyn_cast<Function>(V))
198 GAR->FunctionInfos.erase(F);
200 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
201 if (GAR->NonAddressTakenGlobals.erase(GV)) {
202 // This global might be an indirect global. If so, remove it and
203 // remove any AllocRelatedValues for it.
204 if (GAR->IndirectGlobals.erase(GV)) {
205 // Remove any entries in AllocsForIndirectGlobals for this global.
206 for (auto I = GAR->AllocsForIndirectGlobals.begin(),
207 E = GAR->AllocsForIndirectGlobals.end();
210 GAR->AllocsForIndirectGlobals.erase(I);
213 // Scan the function info we have collected and remove this global
215 for (auto &FIPair : GAR->FunctionInfos)
216 FIPair.second.eraseModRefInfoForGlobal(*GV);
220 // If this is an allocation related to an indirect global, remove it.
221 GAR->AllocsForIndirectGlobals.erase(V);
223 // And clear out the handle.
225 GAR->Handles.erase(I);
226 // This object is now destroyed!
229 FunctionModRefBehavior GlobalsAAResult::getModRefBehavior(const Function *F) {
230 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
232 if (FunctionInfo *FI = getFunctionInfo(F)) {
233 if (FI->getModRefInfo() == MRI_NoModRef)
234 Min = FMRB_DoesNotAccessMemory;
235 else if ((FI->getModRefInfo() & MRI_Mod) == 0)
236 Min = FMRB_OnlyReadsMemory;
239 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(F) & Min);
242 FunctionModRefBehavior
243 GlobalsAAResult::getModRefBehavior(ImmutableCallSite CS) {
244 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
246 if (const Function *F = CS.getCalledFunction())
247 if (FunctionInfo *FI = getFunctionInfo(F)) {
248 if (FI->getModRefInfo() == MRI_NoModRef)
249 Min = FMRB_DoesNotAccessMemory;
250 else if ((FI->getModRefInfo() & MRI_Mod) == 0)
251 Min = FMRB_OnlyReadsMemory;
254 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(CS) & Min);
257 /// Returns the function info for the function, or null if we don't have
258 /// anything useful to say about it.
259 GlobalsAAResult::FunctionInfo *
260 GlobalsAAResult::getFunctionInfo(const Function *F) {
261 auto I = FunctionInfos.find(F);
262 if (I != FunctionInfos.end())
267 /// AnalyzeGlobals - Scan through the users of all of the internal
268 /// GlobalValue's in the program. If none of them have their "address taken"
269 /// (really, their address passed to something nontrivial), record this fact,
270 /// and record the functions that they are used directly in.
271 void GlobalsAAResult::AnalyzeGlobals(Module &M) {
272 SmallPtrSet<Function *, 64> TrackedFunctions;
273 for (Function &F : M)
274 if (F.hasLocalLinkage())
275 if (!AnalyzeUsesOfPointer(&F)) {
276 // Remember that we are tracking this global.
277 NonAddressTakenGlobals.insert(&F);
278 TrackedFunctions.insert(&F);
279 Handles.emplace_front(*this, &F);
280 Handles.front().I = Handles.begin();
281 ++NumNonAddrTakenFunctions;
284 SmallPtrSet<Function *, 64> Readers, Writers;
285 for (GlobalVariable &GV : M.globals())
286 if (GV.hasLocalLinkage()) {
287 if (!AnalyzeUsesOfPointer(&GV, &Readers,
288 GV.isConstant() ? nullptr : &Writers)) {
289 // Remember that we are tracking this global, and the mod/ref fns
290 NonAddressTakenGlobals.insert(&GV);
291 Handles.emplace_front(*this, &GV);
292 Handles.front().I = Handles.begin();
294 for (Function *Reader : Readers) {
295 if (TrackedFunctions.insert(Reader).second) {
296 Handles.emplace_front(*this, Reader);
297 Handles.front().I = Handles.begin();
299 FunctionInfos[Reader].addModRefInfoForGlobal(GV, MRI_Ref);
302 if (!GV.isConstant()) // No need to keep track of writers to constants
303 for (Function *Writer : Writers) {
304 if (TrackedFunctions.insert(Writer).second) {
305 Handles.emplace_front(*this, Writer);
306 Handles.front().I = Handles.begin();
308 FunctionInfos[Writer].addModRefInfoForGlobal(GV, MRI_Mod);
310 ++NumNonAddrTakenGlobalVars;
312 // If this global holds a pointer type, see if it is an indirect global.
313 if (GV.getType()->getElementType()->isPointerTy() &&
314 AnalyzeIndirectGlobalMemory(&GV))
315 ++NumIndirectGlobalVars;
322 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
323 /// If this is used by anything complex (i.e., the address escapes), return
324 /// true. Also, while we are at it, keep track of those functions that read and
325 /// write to the value.
327 /// If OkayStoreDest is non-null, stores into this global are allowed.
328 bool GlobalsAAResult::AnalyzeUsesOfPointer(Value *V,
329 SmallPtrSetImpl<Function *> *Readers,
330 SmallPtrSetImpl<Function *> *Writers,
331 GlobalValue *OkayStoreDest) {
332 if (!V->getType()->isPointerTy())
335 for (Use &U : V->uses()) {
336 User *I = U.getUser();
337 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
339 Readers->insert(LI->getParent()->getParent());
340 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
341 if (V == SI->getOperand(1)) {
343 Writers->insert(SI->getParent()->getParent());
344 } else if (SI->getOperand(1) != OkayStoreDest) {
345 return true; // Storing the pointer
347 } else if (Operator::getOpcode(I) == Instruction::GetElementPtr) {
348 if (AnalyzeUsesOfPointer(I, Readers, Writers))
350 } else if (Operator::getOpcode(I) == Instruction::BitCast) {
351 if (AnalyzeUsesOfPointer(I, Readers, Writers, OkayStoreDest))
353 } else if (auto CS = CallSite(I)) {
354 // Make sure that this is just the function being called, not that it is
355 // passing into the function.
356 if (CS.isDataOperand(&U)) {
357 // Detect calls to free.
358 if (CS.isArgOperand(&U) && isFreeCall(I, &TLI)) {
360 Writers->insert(CS->getParent()->getParent());
361 } else if (CS.doesNotCapture(CS.getDataOperandNo(&U))) {
362 Function *ParentF = CS->getParent()->getParent();
363 // A nocapture argument may be read from or written to, but does not
364 // escape unless the call can somehow recurse.
366 // nocapture "indicates that the callee does not make any copies of
367 // the pointer that outlive itself". Therefore if we directly or
368 // indirectly recurse, we must treat the pointer as escaping.
369 if (FunctionToSCCMap[ParentF] ==
370 FunctionToSCCMap[CS.getCalledFunction()])
373 Readers->insert(ParentF);
375 Writers->insert(ParentF);
377 return true; // Argument of an unknown call.
379 // If the Callee is not ReadNone, it may read the global,
380 // and if it is not ReadOnly, it may also write to it.
381 Function *CalleeF = CS.getCalledFunction();
382 if (!CalleeF->doesNotAccessMemory()) {
384 Readers->insert(CalleeF);
385 if (Writers && !CalleeF->onlyReadsMemory())
386 Writers->insert(CalleeF);
389 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(I)) {
390 if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
391 return true; // Allow comparison against null.
400 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
401 /// which holds a pointer type. See if the global always points to non-aliased
402 /// heap memory: that is, all initializers of the globals are allocations, and
403 /// those allocations have no use other than initialization of the global.
404 /// Further, all loads out of GV must directly use the memory, not store the
405 /// pointer somewhere. If this is true, we consider the memory pointed to by
406 /// GV to be owned by GV and can disambiguate other pointers from it.
407 bool GlobalsAAResult::AnalyzeIndirectGlobalMemory(GlobalVariable *GV) {
408 // Keep track of values related to the allocation of the memory, f.e. the
409 // value produced by the malloc call and any casts.
410 std::vector<Value *> AllocRelatedValues;
412 // If the initializer is a valid pointer, bail.
413 if (Constant *C = GV->getInitializer())
414 if (!C->isNullValue())
417 // Walk the user list of the global. If we find anything other than a direct
418 // load or store, bail out.
419 for (User *U : GV->users()) {
420 if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
421 // The pointer loaded from the global can only be used in simple ways:
422 // we allow addressing of it and loading storing to it. We do *not* allow
423 // storing the loaded pointer somewhere else or passing to a function.
424 if (AnalyzeUsesOfPointer(LI))
425 return false; // Loaded pointer escapes.
426 // TODO: Could try some IP mod/ref of the loaded pointer.
427 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
428 // Storing the global itself.
429 if (SI->getOperand(0) == GV)
432 // If storing the null pointer, ignore it.
433 if (isa<ConstantPointerNull>(SI->getOperand(0)))
436 // Check the value being stored.
437 Value *Ptr = GetUnderlyingObject(SI->getOperand(0),
438 GV->getParent()->getDataLayout());
440 if (!isAllocLikeFn(Ptr, &TLI))
441 return false; // Too hard to analyze.
443 // Analyze all uses of the allocation. If any of them are used in a
444 // non-simple way (e.g. stored to another global) bail out.
445 if (AnalyzeUsesOfPointer(Ptr, /*Readers*/ nullptr, /*Writers*/ nullptr,
447 return false; // Loaded pointer escapes.
449 // Remember that this allocation is related to the indirect global.
450 AllocRelatedValues.push_back(Ptr);
452 // Something complex, bail out.
457 // Okay, this is an indirect global. Remember all of the allocations for
458 // this global in AllocsForIndirectGlobals.
459 while (!AllocRelatedValues.empty()) {
460 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
461 Handles.emplace_front(*this, AllocRelatedValues.back());
462 Handles.front().I = Handles.begin();
463 AllocRelatedValues.pop_back();
465 IndirectGlobals.insert(GV);
466 Handles.emplace_front(*this, GV);
467 Handles.front().I = Handles.begin();
471 void GlobalsAAResult::CollectSCCMembership(CallGraph &CG) {
472 // We do a bottom-up SCC traversal of the call graph. In other words, we
473 // visit all callees before callers (leaf-first).
475 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
476 const std::vector<CallGraphNode *> &SCC = *I;
477 assert(!SCC.empty() && "SCC with no functions?");
479 for (auto *CGN : SCC)
480 if (Function *F = CGN->getFunction())
481 FunctionToSCCMap[F] = SCCID;
486 /// AnalyzeCallGraph - At this point, we know the functions where globals are
487 /// immediately stored to and read from. Propagate this information up the call
488 /// graph to all callers and compute the mod/ref info for all memory for each
490 void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) {
491 // We do a bottom-up SCC traversal of the call graph. In other words, we
492 // visit all callees before callers (leaf-first).
493 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
494 const std::vector<CallGraphNode *> &SCC = *I;
495 assert(!SCC.empty() && "SCC with no functions?");
497 if (!SCC[0]->getFunction() || SCC[0]->getFunction()->mayBeOverridden()) {
498 // Calls externally or is weak - can't say anything useful. Remove any existing
499 // function records (may have been created when scanning globals).
500 for (auto *Node : SCC)
501 FunctionInfos.erase(Node->getFunction());
505 FunctionInfo &FI = FunctionInfos[SCC[0]->getFunction()];
506 bool KnowNothing = false;
508 // Collect the mod/ref properties due to called functions. We only compute
510 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
511 Function *F = SCC[i]->getFunction();
517 if (F->isDeclaration()) {
518 // Try to get mod/ref behaviour from function attributes.
519 if (F->doesNotAccessMemory() || F->onlyAccessesInaccessibleMemory()) {
520 // Can't do better than that!
521 } else if (F->onlyReadsMemory()) {
522 FI.addModRefInfo(MRI_Ref);
523 if (!F->isIntrinsic())
524 // This function might call back into the module and read a global -
525 // consider every global as possibly being read by this function.
526 FI.setMayReadAnyGlobal();
527 } else if (F->onlyAccessesArgMemory() ||
528 F->onlyAccessesInaccessibleMemOrArgMem()) {
529 // This function may only access (read/write) memory pointed to by its
530 // arguments. If this pointer is to a global, this escaping use of the
531 // pointer is captured in AnalyzeUsesOfPointer().
532 FI.addModRefInfo(MRI_ModRef);
534 FI.addModRefInfo(MRI_ModRef);
535 // Can't say anything useful unless it's an intrinsic - they don't
536 // read or write global variables of the kind considered here.
537 KnowNothing = !F->isIntrinsic();
542 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
543 CI != E && !KnowNothing; ++CI)
544 if (Function *Callee = CI->second->getFunction()) {
545 if (FunctionInfo *CalleeFI = getFunctionInfo(Callee)) {
546 // Propagate function effect up.
547 FI.addFunctionInfo(*CalleeFI);
549 // Can't say anything about it. However, if it is inside our SCC,
550 // then nothing needs to be done.
551 CallGraphNode *CalleeNode = CG[Callee];
552 if (std::find(SCC.begin(), SCC.end(), CalleeNode) == SCC.end())
560 // If we can't say anything useful about this SCC, remove all SCC functions
561 // from the FunctionInfos map.
563 for (auto *Node : SCC)
564 FunctionInfos.erase(Node->getFunction());
568 // Scan the function bodies for explicit loads or stores.
569 for (auto *Node : SCC) {
570 if (FI.getModRefInfo() == MRI_ModRef)
571 break; // The mod/ref lattice saturates here.
572 for (Instruction &I : instructions(Node->getFunction())) {
573 if (FI.getModRefInfo() == MRI_ModRef)
574 break; // The mod/ref lattice saturates here.
576 // We handle calls specially because the graph-relevant aspects are
578 if (auto CS = CallSite(&I)) {
579 if (isAllocationFn(&I, &TLI) || isFreeCall(&I, &TLI)) {
580 // FIXME: It is completely unclear why this is necessary and not
581 // handled by the above graph code.
582 FI.addModRefInfo(MRI_ModRef);
583 } else if (Function *Callee = CS.getCalledFunction()) {
584 // The callgraph doesn't include intrinsic calls.
585 if (Callee->isIntrinsic()) {
586 FunctionModRefBehavior Behaviour =
587 AAResultBase::getModRefBehavior(Callee);
588 FI.addModRefInfo(ModRefInfo(Behaviour & MRI_ModRef));
594 // All non-call instructions we use the primary predicates for whether
595 // thay read or write memory.
596 if (I.mayReadFromMemory())
597 FI.addModRefInfo(MRI_Ref);
598 if (I.mayWriteToMemory())
599 FI.addModRefInfo(MRI_Mod);
603 if ((FI.getModRefInfo() & MRI_Mod) == 0)
604 ++NumReadMemFunctions;
605 if (FI.getModRefInfo() == MRI_NoModRef)
608 // Finally, now that we know the full effect on this SCC, clone the
609 // information to each function in the SCC.
610 // FI is a reference into FunctionInfos, so copy it now so that it doesn't
611 // get invalidated if DenseMap decides to re-hash.
612 FunctionInfo CachedFI = FI;
613 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
614 FunctionInfos[SCC[i]->getFunction()] = CachedFI;
618 // GV is a non-escaping global. V is a pointer address that has been loaded from.
619 // If we can prove that V must escape, we can conclude that a load from V cannot
621 static bool isNonEscapingGlobalNoAliasWithLoad(const GlobalValue *GV,
624 const DataLayout &DL) {
625 SmallPtrSet<const Value *, 8> Visited;
626 SmallVector<const Value *, 8> Inputs;
630 const Value *Input = Inputs.pop_back_val();
632 if (isa<GlobalValue>(Input) || isa<Argument>(Input) || isa<CallInst>(Input) ||
633 isa<InvokeInst>(Input))
634 // Arguments to functions or returns from functions are inherently
635 // escaping, so we can immediately classify those as not aliasing any
636 // non-addr-taken globals.
638 // (Transitive) loads from a global are also safe - if this aliased
639 // another global, its address would escape, so no alias.
642 // Recurse through a limited number of selects, loads and PHIs. This is an
643 // arbitrary depth of 4, lower numbers could be used to fix compile time
644 // issues if needed, but this is generally expected to be only be important
649 if (auto *LI = dyn_cast<LoadInst>(Input)) {
650 Inputs.push_back(GetUnderlyingObject(LI->getPointerOperand(), DL));
653 if (auto *SI = dyn_cast<SelectInst>(Input)) {
654 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL);
655 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL);
656 if (Visited.insert(LHS).second)
657 Inputs.push_back(LHS);
658 if (Visited.insert(RHS).second)
659 Inputs.push_back(RHS);
662 if (auto *PN = dyn_cast<PHINode>(Input)) {
663 for (const Value *Op : PN->incoming_values()) {
664 Op = GetUnderlyingObject(Op, DL);
665 if (Visited.insert(Op).second)
666 Inputs.push_back(Op);
672 } while (!Inputs.empty());
674 // All inputs were known to be no-alias.
678 // There are particular cases where we can conclude no-alias between
679 // a non-addr-taken global and some other underlying object. Specifically,
680 // a non-addr-taken global is known to not be escaped from any function. It is
681 // also incorrect for a transformation to introduce an escape of a global in
682 // a way that is observable when it was not there previously. One function
683 // being transformed to introduce an escape which could possibly be observed
684 // (via loading from a global or the return value for example) within another
685 // function is never safe. If the observation is made through non-atomic
686 // operations on different threads, it is a data-race and UB. If the
687 // observation is well defined, by being observed the transformation would have
688 // changed program behavior by introducing the observed escape, making it an
689 // invalid transform.
691 // This property does require that transformations which *temporarily* escape
692 // a global that was not previously escaped, prior to restoring it, cannot rely
693 // on the results of GMR::alias. This seems a reasonable restriction, although
694 // currently there is no way to enforce it. There is also no realistic
695 // optimization pass that would make this mistake. The closest example is
696 // a transformation pass which does reg2mem of SSA values but stores them into
697 // global variables temporarily before restoring the global variable's value.
698 // This could be useful to expose "benign" races for example. However, it seems
699 // reasonable to require that a pass which introduces escapes of global
700 // variables in this way to either not trust AA results while the escape is
701 // active, or to be forced to operate as a module pass that cannot co-exist
702 // with an alias analysis such as GMR.
703 bool GlobalsAAResult::isNonEscapingGlobalNoAlias(const GlobalValue *GV,
705 // In order to know that the underlying object cannot alias the
706 // non-addr-taken global, we must know that it would have to be an escape.
707 // Thus if the underlying object is a function argument, a load from
708 // a global, or the return of a function, it cannot alias. We can also
709 // recurse through PHI nodes and select nodes provided all of their inputs
710 // resolve to one of these known-escaping roots.
711 SmallPtrSet<const Value *, 8> Visited;
712 SmallVector<const Value *, 8> Inputs;
717 const Value *Input = Inputs.pop_back_val();
719 if (auto *InputGV = dyn_cast<GlobalValue>(Input)) {
720 // If one input is the very global we're querying against, then we can't
721 // conclude no-alias.
725 // Distinct GlobalVariables never alias, unless overriden or zero-sized.
726 // FIXME: The condition can be refined, but be conservative for now.
727 auto *GVar = dyn_cast<GlobalVariable>(GV);
728 auto *InputGVar = dyn_cast<GlobalVariable>(InputGV);
729 if (GVar && InputGVar &&
730 !GVar->isDeclaration() && !InputGVar->isDeclaration() &&
731 !GVar->mayBeOverridden() && !InputGVar->mayBeOverridden()) {
732 Type *GVType = GVar->getInitializer()->getType();
733 Type *InputGVType = InputGVar->getInitializer()->getType();
734 if (GVType->isSized() && InputGVType->isSized() &&
735 (DL.getTypeAllocSize(GVType) > 0) &&
736 (DL.getTypeAllocSize(InputGVType) > 0))
740 // Conservatively return false, even though we could be smarter
741 // (e.g. look through GlobalAliases).
745 if (isa<Argument>(Input) || isa<CallInst>(Input) ||
746 isa<InvokeInst>(Input)) {
747 // Arguments to functions or returns from functions are inherently
748 // escaping, so we can immediately classify those as not aliasing any
749 // non-addr-taken globals.
753 // Recurse through a limited number of selects, loads and PHIs. This is an
754 // arbitrary depth of 4, lower numbers could be used to fix compile time
755 // issues if needed, but this is generally expected to be only be important
760 if (auto *LI = dyn_cast<LoadInst>(Input)) {
761 // A pointer loaded from a global would have been captured, and we know
762 // that the global is non-escaping, so no alias.
763 const Value *Ptr = GetUnderlyingObject(LI->getPointerOperand(), DL);
764 if (isNonEscapingGlobalNoAliasWithLoad(GV, Ptr, Depth, DL))
765 // The load does not alias with GV.
767 // Otherwise, a load could come from anywhere, so bail.
770 if (auto *SI = dyn_cast<SelectInst>(Input)) {
771 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL);
772 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL);
773 if (Visited.insert(LHS).second)
774 Inputs.push_back(LHS);
775 if (Visited.insert(RHS).second)
776 Inputs.push_back(RHS);
779 if (auto *PN = dyn_cast<PHINode>(Input)) {
780 for (const Value *Op : PN->incoming_values()) {
781 Op = GetUnderlyingObject(Op, DL);
782 if (Visited.insert(Op).second)
783 Inputs.push_back(Op);
788 // FIXME: It would be good to handle other obvious no-alias cases here, but
789 // it isn't clear how to do so reasonbly without building a small version
790 // of BasicAA into this code. We could recurse into AAResultBase::alias
791 // here but that seems likely to go poorly as we're inside the
792 // implementation of such a query. Until then, just conservatievly retun
795 } while (!Inputs.empty());
797 // If all the inputs to V were definitively no-alias, then V is no-alias.
801 /// alias - If one of the pointers is to a global that we are tracking, and the
802 /// other is some random pointer, we know there cannot be an alias, because the
803 /// address of the global isn't taken.
804 AliasResult GlobalsAAResult::alias(const MemoryLocation &LocA,
805 const MemoryLocation &LocB) {
806 // Get the base object these pointers point to.
807 const Value *UV1 = GetUnderlyingObject(LocA.Ptr, DL);
808 const Value *UV2 = GetUnderlyingObject(LocB.Ptr, DL);
810 // If either of the underlying values is a global, they may be non-addr-taken
811 // globals, which we can answer queries about.
812 const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
813 const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
815 // If the global's address is taken, pretend we don't know it's a pointer to
817 if (GV1 && !NonAddressTakenGlobals.count(GV1))
819 if (GV2 && !NonAddressTakenGlobals.count(GV2))
822 // If the two pointers are derived from two different non-addr-taken
823 // globals we know these can't alias.
824 if (GV1 && GV2 && GV1 != GV2)
827 // If one is and the other isn't, it isn't strictly safe but we can fake
828 // this result if necessary for performance. This does not appear to be
829 // a common problem in practice.
830 if (EnableUnsafeGlobalsModRefAliasResults)
831 if ((GV1 || GV2) && GV1 != GV2)
834 // Check for a special case where a non-escaping global can be used to
835 // conclude no-alias.
836 if ((GV1 || GV2) && GV1 != GV2) {
837 const GlobalValue *GV = GV1 ? GV1 : GV2;
838 const Value *UV = GV1 ? UV2 : UV1;
839 if (isNonEscapingGlobalNoAlias(GV, UV))
843 // Otherwise if they are both derived from the same addr-taken global, we
844 // can't know the two accesses don't overlap.
847 // These pointers may be based on the memory owned by an indirect global. If
848 // so, we may be able to handle this. First check to see if the base pointer
849 // is a direct load from an indirect global.
851 if (const LoadInst *LI = dyn_cast<LoadInst>(UV1))
852 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
853 if (IndirectGlobals.count(GV))
855 if (const LoadInst *LI = dyn_cast<LoadInst>(UV2))
856 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
857 if (IndirectGlobals.count(GV))
860 // These pointers may also be from an allocation for the indirect global. If
861 // so, also handle them.
863 GV1 = AllocsForIndirectGlobals.lookup(UV1);
865 GV2 = AllocsForIndirectGlobals.lookup(UV2);
867 // Now that we know whether the two pointers are related to indirect globals,
868 // use this to disambiguate the pointers. If the pointers are based on
869 // different indirect globals they cannot alias.
870 if (GV1 && GV2 && GV1 != GV2)
873 // If one is based on an indirect global and the other isn't, it isn't
874 // strictly safe but we can fake this result if necessary for performance.
875 // This does not appear to be a common problem in practice.
876 if (EnableUnsafeGlobalsModRefAliasResults)
877 if ((GV1 || GV2) && GV1 != GV2)
880 return AAResultBase::alias(LocA, LocB);
883 ModRefInfo GlobalsAAResult::getModRefInfoForArgument(ImmutableCallSite CS,
884 const GlobalValue *GV) {
885 if (CS.doesNotAccessMemory())
887 ModRefInfo ConservativeResult = CS.onlyReadsMemory() ? MRI_Ref : MRI_ModRef;
889 // Iterate through all the arguments to the called function. If any argument
890 // is based on GV, return the conservative result.
891 for (auto &A : CS.args()) {
892 SmallVector<Value*, 4> Objects;
893 GetUnderlyingObjects(A, Objects, DL);
895 // All objects must be identified.
896 if (!std::all_of(Objects.begin(), Objects.end(), isIdentifiedObject))
897 return ConservativeResult;
899 if (std::find(Objects.begin(), Objects.end(), GV) != Objects.end())
900 return ConservativeResult;
903 // We identified all objects in the argument list, and none of them were GV.
907 ModRefInfo GlobalsAAResult::getModRefInfo(ImmutableCallSite CS,
908 const MemoryLocation &Loc) {
909 unsigned Known = MRI_ModRef;
911 // If we are asking for mod/ref info of a direct call with a pointer to a
912 // global we are tracking, return information if we have it.
913 if (const GlobalValue *GV =
914 dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL)))
915 if (GV->hasLocalLinkage())
916 if (const Function *F = CS.getCalledFunction())
917 if (NonAddressTakenGlobals.count(GV))
918 if (const FunctionInfo *FI = getFunctionInfo(F))
919 Known = FI->getModRefInfoForGlobal(*GV) |
920 getModRefInfoForArgument(CS, GV);
922 if (Known == MRI_NoModRef)
923 return MRI_NoModRef; // No need to query other mod/ref analyses
924 return ModRefInfo(Known & AAResultBase::getModRefInfo(CS, Loc));
927 GlobalsAAResult::GlobalsAAResult(const DataLayout &DL,
928 const TargetLibraryInfo &TLI)
929 : AAResultBase(TLI), DL(DL) {}
931 GlobalsAAResult::GlobalsAAResult(GlobalsAAResult &&Arg)
932 : AAResultBase(std::move(Arg)), DL(Arg.DL),
933 NonAddressTakenGlobals(std::move(Arg.NonAddressTakenGlobals)),
934 IndirectGlobals(std::move(Arg.IndirectGlobals)),
935 AllocsForIndirectGlobals(std::move(Arg.AllocsForIndirectGlobals)),
936 FunctionInfos(std::move(Arg.FunctionInfos)),
937 Handles(std::move(Arg.Handles)) {
938 // Update the parent for each DeletionCallbackHandle.
939 for (auto &H : Handles) {
940 assert(H.GAR == &Arg);
945 /*static*/ GlobalsAAResult
946 GlobalsAAResult::analyzeModule(Module &M, const TargetLibraryInfo &TLI,
948 GlobalsAAResult Result(M.getDataLayout(), TLI);
950 // Discover which functions aren't recursive, to feed into AnalyzeGlobals.
951 Result.CollectSCCMembership(CG);
953 // Find non-addr taken globals.
954 Result.AnalyzeGlobals(M);
957 Result.AnalyzeCallGraph(CG, M);
962 GlobalsAAResult GlobalsAA::run(Module &M, AnalysisManager<Module> *AM) {
963 return GlobalsAAResult::analyzeModule(M,
964 AM->getResult<TargetLibraryAnalysis>(M),
965 AM->getResult<CallGraphAnalysis>(M));
968 char GlobalsAA::PassID;
970 char GlobalsAAWrapperPass::ID = 0;
971 INITIALIZE_PASS_BEGIN(GlobalsAAWrapperPass, "globals-aa",
972 "Globals Alias Analysis", false, true)
973 INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
974 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
975 INITIALIZE_PASS_END(GlobalsAAWrapperPass, "globals-aa",
976 "Globals Alias Analysis", false, true)
978 ModulePass *llvm::createGlobalsAAWrapperPass() {
979 return new GlobalsAAWrapperPass();
982 GlobalsAAWrapperPass::GlobalsAAWrapperPass() : ModulePass(ID) {
983 initializeGlobalsAAWrapperPassPass(*PassRegistry::getPassRegistry());
986 bool GlobalsAAWrapperPass::runOnModule(Module &M) {
987 Result.reset(new GlobalsAAResult(GlobalsAAResult::analyzeModule(
988 M, getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(),
989 getAnalysis<CallGraphWrapperPass>().getCallGraph())));
993 bool GlobalsAAWrapperPass::doFinalization(Module &M) {
998 void GlobalsAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const {
999 AU.setPreservesAll();
1000 AU.addRequired<CallGraphWrapperPass>();
1001 AU.addRequired<TargetLibraryInfoWrapperPass>();