1 //===-- MallocHelper.cpp - Functions to identify malloc calls -------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This family of functions identifies calls to malloc, bitcasts of malloc
11 // calls, and the types and array sizes associated with them.
13 //===----------------------------------------------------------------------===//
15 #include "llvm/Analysis/MallocHelper.h"
16 #include "llvm/Constants.h"
17 #include "llvm/Instructions.h"
18 #include "llvm/Module.h"
19 #include "llvm/Analysis/ConstantFolding.h"
22 //===----------------------------------------------------------------------===//
23 // malloc Call Utility Functions.
26 /// isMalloc - Returns true if the the value is either a malloc call or a
27 /// bitcast of the result of a malloc call.
28 bool llvm::isMalloc(const Value* I) {
29 return extractMallocCall(I) || extractMallocCallFromBitCast(I);
32 static bool isMallocCall(const CallInst *CI) {
36 const Module* M = CI->getParent()->getParent()->getParent();
37 Constant *MallocFunc = M->getFunction("malloc");
39 if (CI->getOperand(0) != MallocFunc)
45 /// extractMallocCall - Returns the corresponding CallInst if the instruction
46 /// is a malloc call. Since CallInst::CreateMalloc() only creates calls, we
47 /// ignore InvokeInst here.
48 const CallInst* llvm::extractMallocCall(const Value* I) {
49 const CallInst *CI = dyn_cast<CallInst>(I);
50 return (isMallocCall(CI)) ? CI : NULL;
53 CallInst* llvm::extractMallocCall(Value* I) {
54 CallInst *CI = dyn_cast<CallInst>(I);
55 return (isMallocCall(CI)) ? CI : NULL;
58 static bool isBitCastOfMallocCall(const BitCastInst* BCI) {
62 return isMallocCall(dyn_cast<CallInst>(BCI->getOperand(0)));
65 /// extractMallocCallFromBitCast - Returns the corresponding CallInst if the
66 /// instruction is a bitcast of the result of a malloc call.
67 CallInst* llvm::extractMallocCallFromBitCast(Value* I) {
68 BitCastInst *BCI = dyn_cast<BitCastInst>(I);
69 return (isBitCastOfMallocCall(BCI)) ? cast<CallInst>(BCI->getOperand(0))
73 const CallInst* llvm::extractMallocCallFromBitCast(const Value* I) {
74 const BitCastInst *BCI = dyn_cast<BitCastInst>(I);
75 return (isBitCastOfMallocCall(BCI)) ? cast<CallInst>(BCI->getOperand(0))
79 static bool isArrayMallocHelper(const CallInst *CI, LLVMContext &Context,
80 const TargetData* TD) {
84 const Type* T = getMallocAllocatedType(CI);
86 // We can only indentify an array malloc if we know the type of the malloc
90 Value* MallocArg = CI->getOperand(1);
91 Constant *ElementSize = ConstantExpr::getSizeOf(T);
92 ElementSize = ConstantExpr::getTruncOrBitCast(ElementSize,
93 MallocArg->getType());
94 Constant *FoldedElementSize = ConstantFoldConstantExpression(
95 cast<ConstantExpr>(ElementSize),
99 if (isa<ConstantExpr>(MallocArg))
100 return (MallocArg != ElementSize);
102 BinaryOperator *BI = dyn_cast<BinaryOperator>(MallocArg);
106 if (BI->getOpcode() == Instruction::Mul)
107 // ArraySize * ElementSize
108 if (BI->getOperand(1) == ElementSize ||
109 (FoldedElementSize && BI->getOperand(1) == FoldedElementSize))
112 // TODO: Detect case where MallocArg mul has been transformed to shl.
117 /// isArrayMalloc - Returns the corresponding CallInst if the instruction
118 /// matches the malloc call IR generated by CallInst::CreateMalloc(). This
119 /// means that it is a malloc call with one bitcast use AND the malloc call's
120 /// size argument is:
121 /// 1. a constant not equal to the malloc's allocated type
123 /// 2. the result of a multiplication by the malloc's allocated type
124 /// Otherwise it returns NULL.
125 /// The unique bitcast is needed to determine the type/size of the array
127 CallInst* llvm::isArrayMalloc(Value* I, LLVMContext &Context,
128 const TargetData* TD) {
129 CallInst *CI = extractMallocCall(I);
130 return (isArrayMallocHelper(CI, Context, TD)) ? CI : NULL;
133 const CallInst* llvm::isArrayMalloc(const Value* I, LLVMContext &Context,
134 const TargetData* TD) {
135 const CallInst *CI = extractMallocCall(I);
136 return (isArrayMallocHelper(CI, Context, TD)) ? CI : NULL;
139 /// getMallocType - Returns the PointerType resulting from the malloc call.
140 /// This PointerType is the result type of the call's only bitcast use.
141 /// If there is no unique bitcast use, then return NULL.
142 const PointerType* llvm::getMallocType(const CallInst* CI) {
143 assert(isMalloc(CI) && "GetMallocType and not malloc call");
145 const BitCastInst* BCI = NULL;
147 // Determine if CallInst has a bitcast use.
148 for (Value::use_const_iterator UI = CI->use_begin(), E = CI->use_end();
150 if ((BCI = dyn_cast<BitCastInst>(cast<Instruction>(*UI++))))
153 // Malloc call has 1 bitcast use and no other uses, so type is the bitcast's
155 if (BCI && CI->hasOneUse())
156 return cast<PointerType>(BCI->getDestTy());
158 // Malloc call was not bitcast, so type is the malloc function's return type.
160 return cast<PointerType>(CI->getType());
162 // Type could not be determined.
166 /// getMallocAllocatedType - Returns the Type allocated by malloc call. This
167 /// Type is the result type of the call's only bitcast use. If there is no
168 /// unique bitcast use, then return NULL.
169 const Type* llvm::getMallocAllocatedType(const CallInst* CI) {
170 const PointerType* PT = getMallocType(CI);
171 return PT ? PT->getElementType() : NULL;
174 /// isConstantOne - Return true only if val is constant int 1.
175 static bool isConstantOne(Value *val) {
176 return isa<ConstantInt>(val) && cast<ConstantInt>(val)->isOne();
179 /// getMallocArraySize - Returns the array size of a malloc call. The array
180 /// size is computated in 1 of 3 ways:
181 /// 1. If the element type if of size 1, then array size is the argument to
183 /// 2. Else if the malloc's argument is a constant, the array size is that
184 /// argument divided by the element type's size.
185 /// 3. Else the malloc argument must be a multiplication and the array size is
186 /// the first operand of the multiplication.
187 /// This function returns constant 1 if:
188 /// 1. The malloc call's allocated type cannot be determined.
189 /// 2. IR wasn't created by a call to CallInst::CreateMalloc() with a non-NULL
191 Value* llvm::getMallocArraySize(CallInst* CI, LLVMContext &Context,
192 const TargetData* TD) {
193 // Match CreateMalloc's use of constant 1 array-size for non-array mallocs.
194 if (!isArrayMalloc(CI, Context, TD))
195 return ConstantInt::get(CI->getOperand(1)->getType(), 1);
197 Value* MallocArg = CI->getOperand(1);
198 assert(getMallocAllocatedType(CI) && "getMallocArraySize and no type");
199 Constant *ElementSize = ConstantExpr::getSizeOf(getMallocAllocatedType(CI));
200 ElementSize = ConstantExpr::getTruncOrBitCast(ElementSize,
201 MallocArg->getType());
203 Constant* CO = dyn_cast<Constant>(MallocArg);
204 BinaryOperator* BO = dyn_cast<BinaryOperator>(MallocArg);
205 assert((isConstantOne(ElementSize) || CO || BO) &&
206 "getMallocArraySize and malformed malloc IR");
208 if (isConstantOne(ElementSize))
212 return CO->getOperand(0);
214 // TODO: Detect case where MallocArg mul has been transformed to shl.
216 assert(BO && "getMallocArraySize not constant but not multiplication either");
217 return BO->getOperand(0);