//===----------------------------------------------------------------------===//
#include "llvm/Analysis/AliasAnalysis.h"
+#include "llvm/Analysis/CaptureTracking.h"
#include "llvm/Analysis/Passes.h"
#include "llvm/Constants.h"
#include "llvm/DerivedTypes.h"
#include "llvm/Function.h"
-#include "llvm/ParameterAttributes.h"
#include "llvm/GlobalVariable.h"
#include "llvm/Instructions.h"
#include "llvm/IntrinsicInst.h"
#include <algorithm>
using namespace llvm;
+//===----------------------------------------------------------------------===//
+// Useful predicates
+//===----------------------------------------------------------------------===//
+
+static const User *isGEP(const Value *V) {
+ if (isa<GetElementPtrInst>(V) ||
+ (isa<ConstantExpr>(V) &&
+ cast<ConstantExpr>(V)->getOpcode() == Instruction::GetElementPtr))
+ return cast<User>(V);
+ return 0;
+}
+
+static const Value *GetGEPOperands(const Value *V,
+ SmallVector<Value*, 16> &GEPOps) {
+ assert(GEPOps.empty() && "Expect empty list to populate!");
+ GEPOps.insert(GEPOps.end(), cast<User>(V)->op_begin()+1,
+ cast<User>(V)->op_end());
+
+ // Accumulate all of the chained indexes into the operand array
+ V = cast<User>(V)->getOperand(0);
+
+ while (const User *G = isGEP(V)) {
+ if (!isa<Constant>(GEPOps[0]) || isa<GlobalValue>(GEPOps[0]) ||
+ !cast<Constant>(GEPOps[0])->isNullValue())
+ break; // Don't handle folding arbitrary pointer offsets yet...
+ GEPOps.erase(GEPOps.begin()); // Drop the zero index
+ GEPOps.insert(GEPOps.begin(), G->op_begin()+1, G->op_end());
+ V = G->getOperand(0);
+ }
+ return V;
+}
+
+/// isKnownNonNull - Return true if we know that the specified value is never
+/// null.
+static bool isKnownNonNull(const Value *V) {
+ // Alloca never returns null, malloc might.
+ if (isa<AllocaInst>(V)) return true;
+
+ // A byval argument is never null.
+ if (const Argument *A = dyn_cast<Argument>(V))
+ return A->hasByValAttr();
+
+ // Global values are not null unless extern weak.
+ if (const GlobalValue *GV = dyn_cast<GlobalValue>(V))
+ return !GV->hasExternalWeakLinkage();
+ return false;
+}
+
+/// isNonEscapingLocalObject - Return true if the pointer is to a function-local
+/// object that never escapes from the function.
+static bool isNonEscapingLocalObject(const Value *V) {
+ // If this is a local allocation, check to see if it escapes.
+ if (isa<AllocationInst>(V) || isNoAliasCall(V))
+ return !PointerMayBeCaptured(V, false);
+
+ // If this is an argument that corresponds to a byval or noalias argument,
+ // then it has not escaped before entering the function. Check if it escapes
+ // inside the function.
+ if (const Argument *A = dyn_cast<Argument>(V))
+ if (A->hasByValAttr() || A->hasNoAliasAttr()) {
+ // Don't bother analyzing arguments already known not to escape.
+ if (A->hasNoCaptureAttr())
+ return true;
+ return !PointerMayBeCaptured(V, false);
+ }
+ return false;
+}
+
+
+/// isObjectSmallerThan - Return true if we can prove that the object specified
+/// by V is smaller than Size.
+static bool isObjectSmallerThan(const Value *V, unsigned Size,
+ const TargetData &TD) {
+ const Type *AccessTy;
+ if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(V)) {
+ AccessTy = GV->getType()->getElementType();
+ } else if (const AllocationInst *AI = dyn_cast<AllocationInst>(V)) {
+ if (!AI->isArrayAllocation())
+ AccessTy = AI->getType()->getElementType();
+ else
+ return false;
+ } else if (const Argument *A = dyn_cast<Argument>(V)) {
+ if (A->hasByValAttr())
+ AccessTy = cast<PointerType>(A->getType())->getElementType();
+ else
+ return false;
+ } else {
+ return false;
+ }
+
+ if (AccessTy->isSized())
+ return TD.getTypeAllocSize(AccessTy) < Size;
+ return false;
+}
+
+//===----------------------------------------------------------------------===//
+// NoAA Pass
+//===----------------------------------------------------------------------===//
+
namespace {
/// NoAA - This class implements the -no-aa pass, which always returns "I
/// don't know" for alias queries. NoAA is unlike other alias analysis
///
struct VISIBILITY_HIDDEN NoAA : public ImmutablePass, public AliasAnalysis {
static char ID; // Class identification, replacement for typeinfo
- NoAA() : ImmutablePass((intptr_t)&ID) {}
- explicit NoAA(intptr_t PID) : ImmutablePass(PID) { }
+ NoAA() : ImmutablePass(&ID) {}
+ explicit NoAA(void *PID) : ImmutablePass(PID) { }
virtual void getAnalysisUsage(AnalysisUsage &AU) const {
AU.addRequired<TargetData>();
return MayAlias;
}
- virtual ModRefBehavior getModRefBehavior(Function *F, CallSite CS,
- std::vector<PointerAccessInfo> *Info) {
- return UnknownModRefBehavior;
- }
-
virtual void getArgumentAccesses(Function *F, CallSite CS,
std::vector<PointerAccessInfo> &Info) {
assert(0 && "This method may not be called on this function!");
ImmutablePass *llvm::createNoAAPass() { return new NoAA(); }
+//===----------------------------------------------------------------------===//
+// BasicAA Pass
+//===----------------------------------------------------------------------===//
+
namespace {
/// BasicAliasAnalysis - This is the default alias analysis implementation.
/// Because it doesn't chain to a previous alias analysis (like -no-aa), it
/// derives from the NoAA class.
struct VISIBILITY_HIDDEN BasicAliasAnalysis : public NoAA {
static char ID; // Class identification, replacement for typeinfo
- BasicAliasAnalysis() : NoAA((intptr_t)&ID) { }
+ BasicAliasAnalysis() : NoAA(&ID) {}
AliasResult alias(const Value *V1, unsigned V1Size,
const Value *V2, unsigned V2Size);
ModRefResult getModRefInfo(CallSite CS, Value *P, unsigned Size);
- ModRefResult getModRefInfo(CallSite CS1, CallSite CS2) {
- return NoAA::getModRefInfo(CS1,CS2);
- }
+ ModRefResult getModRefInfo(CallSite CS1, CallSite CS2);
/// hasNoModRefInfoForCalls - We can provide mod/ref information against
/// non-escaping allocations.
return new BasicAliasAnalysis();
}
-/// getUnderlyingObject - This traverses the use chain to figure out what object
-/// the specified value points to. If the value points to, or is derived from,
-/// a unique object or an argument, return it. This returns:
-/// Arguments, GlobalVariables, Functions, Allocas, Mallocs.
-static const Value *getUnderlyingObject(const Value *V) {
- if (!isa<PointerType>(V->getType())) return V;
-
- // If we are at some type of object, return it. GlobalValues and Allocations
- // have unique addresses.
- if (isa<GlobalValue>(V) || isa<AllocationInst>(V) || isa<Argument>(V))
- return V;
-
- // Traverse through different addressing mechanisms...
- if (const Instruction *I = dyn_cast<Instruction>(V)) {
- if (isa<BitCastInst>(I) || isa<GetElementPtrInst>(I))
- return getUnderlyingObject(I->getOperand(0));
- } else if (const ConstantExpr *CE = dyn_cast<ConstantExpr>(V)) {
- if (CE->getOpcode() == Instruction::BitCast ||
- CE->getOpcode() == Instruction::GetElementPtr)
- return getUnderlyingObject(CE->getOperand(0));
- }
- return V;
-}
-
-static const User *isGEP(const Value *V) {
- if (isa<GetElementPtrInst>(V) ||
- (isa<ConstantExpr>(V) &&
- cast<ConstantExpr>(V)->getOpcode() == Instruction::GetElementPtr))
- return cast<User>(V);
- return 0;
-}
-
-static const Value *GetGEPOperands(const Value *V,
- SmallVector<Value*, 16> &GEPOps){
- assert(GEPOps.empty() && "Expect empty list to populate!");
- GEPOps.insert(GEPOps.end(), cast<User>(V)->op_begin()+1,
- cast<User>(V)->op_end());
-
- // Accumulate all of the chained indexes into the operand array
- V = cast<User>(V)->getOperand(0);
-
- while (const User *G = isGEP(V)) {
- if (!isa<Constant>(GEPOps[0]) || isa<GlobalValue>(GEPOps[0]) ||
- !cast<Constant>(GEPOps[0])->isNullValue())
- break; // Don't handle folding arbitrary pointer offsets yet...
- GEPOps.erase(GEPOps.begin()); // Drop the zero index
- GEPOps.insert(GEPOps.begin(), G->op_begin()+1, G->op_end());
- V = G->getOperand(0);
- }
- return V;
-}
/// pointsToConstantMemory - Chase pointers until we find a (constant
/// global) or not.
bool BasicAliasAnalysis::pointsToConstantMemory(const Value *P) {
if (const GlobalVariable *GV =
- dyn_cast<GlobalVariable>(getUnderlyingObject(P)))
+ dyn_cast<GlobalVariable>(P->getUnderlyingObject()))
return GV->isConstant();
return false;
}
-// Determine if an AllocationInst instruction escapes from the function it is
-// contained in. If it does not escape, there is no way for another function to
-// mod/ref it. We do this by looking at its uses and determining if the uses
-// can escape (recursively).
-static bool AddressMightEscape(const Value *V) {
- for (Value::use_const_iterator UI = V->use_begin(), E = V->use_end();
- UI != E; ++UI) {
- const Instruction *I = cast<Instruction>(*UI);
- switch (I->getOpcode()) {
- case Instruction::Load:
- break; //next use.
- case Instruction::Store:
- if (I->getOperand(0) == V)
- return true; // Escapes if the pointer is stored.
- break; // next use.
- case Instruction::GetElementPtr:
- if (AddressMightEscape(I))
- return true;
- break; // next use.
- case Instruction::BitCast:
- if (AddressMightEscape(I))
- return true;
- break; // next use
- case Instruction::Ret:
- // If returned, the address will escape to calling functions, but no
- // callees could modify it.
- break; // next use
- case Instruction::Call:
- // If the call is to a few known safe intrinsics, we know that it does
- // not escape
- if (!isa<MemIntrinsic>(I))
- return true;
- break; // next use
- default:
- return true;
- }
- }
- return false;
-}
// getModRefInfo - Check to see if the specified callsite can clobber the
// specified memory object. Since we only look at local properties of this
AliasAnalysis::ModRefResult
BasicAliasAnalysis::getModRefInfo(CallSite CS, Value *P, unsigned Size) {
if (!isa<Constant>(P)) {
- const Value *Object = getUnderlyingObject(P);
+ const Value *Object = P->getUnderlyingObject();
// If this is a tail call and P points to a stack location, we know that
// the tail call cannot access or modify the local stack.
if (CI->isTailCall())
return NoModRef;
- // Allocations and byval arguments are "new" objects.
- if (isa<AllocationInst>(Object) || isa<Argument>(Object)) {
- // Okay, the pointer is to a stack allocated (or effectively so, for
- // for noalias parameters) object. If the address of this object doesn't
- // escape from this function body to a callee, then we know that no
- // callees can mod/ref it unless they are actually passed it.
- if (isa<AllocationInst>(Object) ||
- cast<Argument>(Object)->hasByValAttr() ||
- cast<Argument>(Object)->hasNoAliasAttr())
- if (!AddressMightEscape(Object)) {
- bool passedAsArg = false;
- for (CallSite::arg_iterator CI = CS.arg_begin(), CE = CS.arg_end();
- CI != CE; ++CI)
- if (isa<PointerType>((*CI)->getType()) &&
- (getUnderlyingObject(*CI) == P ||
- alias(cast<Value>(CI), ~0U, P, ~0U) != NoAlias))
- passedAsArg = true;
-
- if (!passedAsArg)
- return NoModRef;
- }
+ // If the pointer is to a locally allocated object that does not escape,
+ // then the call can not mod/ref the pointer unless the call takes the
+ // argument without capturing it.
+ if (isNonEscapingLocalObject(Object) && CS.getInstruction() != Object) {
+ bool passedAsArg = false;
+ // TODO: Eventually only check 'nocapture' arguments.
+ for (CallSite::arg_iterator CI = CS.arg_begin(), CE = CS.arg_end();
+ CI != CE; ++CI)
+ if (isa<PointerType>((*CI)->getType()) &&
+ alias(cast<Value>(CI), ~0U, P, ~0U) != NoAlias)
+ passedAsArg = true;
+
+ if (!passedAsArg)
+ return NoModRef;
}
}
return AliasAnalysis::getModRefInfo(CS, P, Size);
}
-/// isIdentifiedObject - Return true if this pointer refers to a distinct and
-/// identifiable object. This returns true for:
-/// Global Variables and Functions
-/// Allocas and Mallocs
-/// ByVal and NoAlias Arguments
-///
-static bool isIdentifiedObject(const Value *V) {
- if (isa<GlobalValue>(V) || isa<AllocationInst>(V))
- return true;
- if (const Argument *A = dyn_cast<Argument>(V))
- return A->hasNoAliasAttr() || A->hasByValAttr();
- return false;
-}
-/// isKnownNonNull - Return true if we know that the specified value is never
-/// null.
-static bool isKnownNonNull(const Value *V) {
- // Alloca never returns null, malloc might.
- if (isa<AllocaInst>(V)) return true;
+AliasAnalysis::ModRefResult
+BasicAliasAnalysis::getModRefInfo(CallSite CS1, CallSite CS2) {
+ // If CS1 or CS2 are readnone, they don't interact.
+ ModRefBehavior CS1B = AliasAnalysis::getModRefBehavior(CS1);
+ if (CS1B == DoesNotAccessMemory) return NoModRef;
- // A byval argument is never null.
- if (const Argument *A = dyn_cast<Argument>(V))
- return A->hasByValAttr();
-
- // Global values are not null unless extern weak.
- if (const GlobalValue *GV = dyn_cast<GlobalValue>(V))
- return !GV->hasExternalWeakLinkage();
- return false;
-}
-
-/// isNonEscapingLocalObject - Return true if the pointer is to a function-local
-/// object that never escapes from the function.
-static bool isNonEscapingLocalObject(const Value *V) {
- // If this is a local allocation or byval argument, check to see if it
- // escapes.
- if (isa<AllocationInst>(V) ||
- (isa<Argument>(V) && cast<Argument>(V)->hasByValAttr()))
- return !AddressMightEscape(V);
- return false;
-}
-
-
-/// isObjectSmallerThan - Return true if we can prove that the object specified
-/// by V is smaller than Size.
-static bool isObjectSmallerThan(const Value *V, unsigned Size,
- const TargetData &TD) {
- const Type *AccessTy = 0;
- if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(V))
- AccessTy = GV->getType()->getElementType();
+ ModRefBehavior CS2B = AliasAnalysis::getModRefBehavior(CS2);
+ if (CS2B == DoesNotAccessMemory) return NoModRef;
- if (const AllocationInst *AI = dyn_cast<AllocationInst>(V))
- if (!AI->isArrayAllocation())
- AccessTy = AI->getType()->getElementType();
-
- if (const Argument *A = dyn_cast<Argument>(V))
- if (A->hasByValAttr())
- AccessTy = cast<PointerType>(A->getType())->getElementType();
+ // If they both only read from memory, just return ref.
+ if (CS1B == OnlyReadsMemory && CS2B == OnlyReadsMemory)
+ return Ref;
- if (AccessTy && AccessTy->isSized())
- return TD.getABITypeSize(AccessTy) < Size;
- return false;
+ // Otherwise, fall back to NoAA (mod+ref).
+ return NoAA::getModRefInfo(CS1, CS2);
}
+
// alias - Provide a bunch of ad-hoc rules to disambiguate in common cases, such
-// as array references. Note that this function is heavily tail recursive.
-// Hopefully we have a smart C++ compiler. :)
+// as array references.
//
AliasAnalysis::AliasResult
BasicAliasAnalysis::alias(const Value *V1, unsigned V1Size,
// Are we checking for alias of the same value?
if (V1 == V2) return MustAlias;
- if ((!isa<PointerType>(V1->getType()) || !isa<PointerType>(V2->getType())) &&
- V1->getType() != Type::Int64Ty && V2->getType() != Type::Int64Ty)
+ if (!isa<PointerType>(V1->getType()) || !isa<PointerType>(V2->getType()))
return NoAlias; // Scalars cannot alias each other
- // Strip off cast instructions...
+ // Strip off cast instructions. Since V1 and V2 are pointers, they must be
+ // pointer<->pointer bitcasts.
if (const BitCastInst *I = dyn_cast<BitCastInst>(V1))
return alias(I->getOperand(0), V1Size, V2, V2Size);
if (const BitCastInst *I = dyn_cast<BitCastInst>(V2))
return alias(V1, V1Size, I->getOperand(0), V2Size);
- // Figure out what objects these things are pointing to if we can...
- const Value *O1 = getUnderlyingObject(V1);
- const Value *O2 = getUnderlyingObject(V2);
+ // Figure out what objects these things are pointing to if we can.
+ const Value *O1 = V1->getUnderlyingObject();
+ const Value *O2 = V2->getUnderlyingObject();
if (O1 != O2) {
// If V1/V2 point to two different objects we know that we have no alias.
if (isIdentifiedObject(O1) && isIdentifiedObject(O2))
return NoAlias;
- // Incoming argument cannot alias locally allocated object!
- if ((isa<Argument>(O1) && isa<AllocationInst>(O2)) ||
- (isa<Argument>(O2) && isa<AllocationInst>(O1)))
+ // Arguments can't alias with local allocations or noalias calls.
+ if ((isa<Argument>(O1) && (isa<AllocationInst>(O2) || isNoAliasCall(O2))) ||
+ (isa<Argument>(O2) && (isa<AllocationInst>(O1) || isNoAliasCall(O1))))
return NoAlias;
-
+
// Most objects can't alias null.
if ((isa<ConstantPointerNull>(V2) && isKnownNonNull(O1)) ||
(isa<ConstantPointerNull>(V1) && isKnownNonNull(O2)))
// non-escaping local object, then we know the object couldn't escape to a
// point where the call could return it.
if ((isa<CallInst>(O1) || isa<InvokeInst>(O1)) &&
- isNonEscapingLocalObject(O2))
+ isNonEscapingLocalObject(O2) && O1 != O2)
return NoAlias;
if ((isa<CallInst>(O2) || isa<InvokeInst>(O2)) &&
- isNonEscapingLocalObject(O1))
+ isNonEscapingLocalObject(O1) && O1 != O2)
return NoAlias;
// If we have two gep instructions with must-alias'ing base pointers, figure
// constant expression getelementptrs here.
//
if (isGEP(V1) && isGEP(V2)) {
+ const User *GEP1 = cast<User>(V1);
+ const User *GEP2 = cast<User>(V2);
+
+ // If V1 and V2 are identical GEPs, just recurse down on both of them.
+ // This allows us to analyze things like:
+ // P = gep A, 0, i, 1
+ // Q = gep B, 0, i, 1
+ // by just analyzing A and B. This is even safe for variable indices.
+ if (GEP1->getType() == GEP2->getType() &&
+ GEP1->getNumOperands() == GEP2->getNumOperands() &&
+ GEP1->getOperand(0)->getType() == GEP2->getOperand(0)->getType() &&
+ // All operands are the same, ignoring the base.
+ std::equal(GEP1->op_begin()+1, GEP1->op_end(), GEP2->op_begin()+1))
+ return alias(GEP1->getOperand(0), V1Size, GEP2->getOperand(0), V2Size);
+
+
// Drill down into the first non-gep value, to test for must-aliasing of
// the base pointers.
- const User *G = cast<User>(V1);
- while (isGEP(G->getOperand(0)) &&
- G->getOperand(1) ==
- Constant::getNullValue(G->getOperand(1)->getType()))
- G = cast<User>(G->getOperand(0));
- const Value *BasePtr1 = G->getOperand(0);
-
- G = cast<User>(V2);
- while (isGEP(G->getOperand(0)) &&
- G->getOperand(1) ==
- Constant::getNullValue(G->getOperand(1)->getType()))
- G = cast<User>(G->getOperand(0));
- const Value *BasePtr2 = G->getOperand(0);
+ while (isGEP(GEP1->getOperand(0)) &&
+ GEP1->getOperand(1) ==
+ Constant::getNullValue(GEP1->getOperand(1)->getType()))
+ GEP1 = cast<User>(GEP1->getOperand(0));
+ const Value *BasePtr1 = GEP1->getOperand(0);
+
+ while (isGEP(GEP2->getOperand(0)) &&
+ GEP2->getOperand(1) ==
+ Constant::getNullValue(GEP2->getOperand(1)->getType()))
+ GEP2 = cast<User>(GEP2->getOperand(0));
+ const Value *BasePtr2 = GEP2->getOperand(0);
// Do the base pointers alias?
AliasResult BaseAlias = alias(BasePtr1, ~0U, BasePtr2, ~0U);
return MayAlias;
}
-// This function is used to determin if the indices of two GEP instructions are
+// This function is used to determine if the indices of two GEP instructions are
// equal. V1 and V2 are the indices.
static bool IndexOperandsEqual(Value *V1, Value *V2) {
if (V1->getType() == V2->getType())
if (G1OC != G2OC) {
// Handle the "be careful" case above: if this is an array/vector
// subscript, scan for a subsequent variable array index.
- if (isa<SequentialType>(BasePtr1Ty)) {
- const Type *NextTy =
- cast<SequentialType>(BasePtr1Ty)->getElementType();
+ if (const SequentialType *STy =
+ dyn_cast<SequentialType>(BasePtr1Ty)) {
+ const Type *NextTy = STy;
bool isBadCase = false;
- for (unsigned Idx = FirstConstantOper+1;
+ for (unsigned Idx = FirstConstantOper;
Idx != MinOperands && isa<SequentialType>(NextTy); ++Idx) {
const Value *V1 = GEP1Ops[Idx], *V2 = GEP2Ops[Idx];
if (!isa<Constant>(V1) || !isa<Constant>(V2)) {
isBadCase = true;
break;
}
+ // If the array is indexed beyond the bounds of the static type
+ // at this level, it will also fall into the "be careful" case.
+ // It would theoretically be possible to analyze these cases,
+ // but for now just be conservatively correct.
+ if (const ArrayType *ATy = dyn_cast<ArrayType>(STy))
+ if (cast<ConstantInt>(G1OC)->getZExtValue() >=
+ ATy->getNumElements() ||
+ cast<ConstantInt>(G2OC)->getZExtValue() >=
+ ATy->getNumElements()) {
+ isBadCase = true;
+ break;
+ }
+ if (const VectorType *VTy = dyn_cast<VectorType>(STy))
+ if (cast<ConstantInt>(G1OC)->getZExtValue() >=
+ VTy->getNumElements() ||
+ cast<ConstantInt>(G2OC)->getZExtValue() >=
+ VTy->getNumElements()) {
+ isBadCase = true;
+ break;
+ }
+ STy = cast<SequentialType>(NextTy);
NextTy = cast<SequentialType>(NextTy)->getElementType();
}