1 //===- llvm/Analysis/ValueTracking.h - Walk computations --------*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file contains routines that help analyze properties that chains of
13 //===----------------------------------------------------------------------===//
15 #ifndef LLVM_ANALYSIS_VALUETRACKING_H
16 #define LLVM_ANALYSIS_VALUETRACKING_H
18 #include "llvm/ADT/ArrayRef.h"
19 #include "llvm/ADT/Optional.h"
20 #include "llvm/IR/CallSite.h"
21 #include "llvm/IR/Constants.h"
22 #include "llvm/IR/Instruction.h"
23 #include "llvm/IR/Intrinsics.h"
31 class AssumptionCache;
40 class OptimizationRemarkEmitter;
42 class TargetLibraryInfo;
45 /// Determine which bits of V are known to be either zero or one and return
46 /// them in the KnownZero/KnownOne bit sets.
48 /// This function is defined on values with integer type, values with pointer
49 /// type, and vectors of integers. In the case
50 /// where V is a vector, the known zero and known one values are the
51 /// same width as the vector element, and the bit is set only if it is true
52 /// for all of the elements in the vector.
53 void computeKnownBits(const Value *V, KnownBits &Known,
54 const DataLayout &DL, unsigned Depth = 0,
55 AssumptionCache *AC = nullptr,
56 const Instruction *CxtI = nullptr,
57 const DominatorTree *DT = nullptr,
58 OptimizationRemarkEmitter *ORE = nullptr);
60 /// Returns the known bits rather than passing by reference.
61 KnownBits computeKnownBits(const Value *V, const DataLayout &DL,
62 unsigned Depth = 0, AssumptionCache *AC = nullptr,
63 const Instruction *CxtI = nullptr,
64 const DominatorTree *DT = nullptr,
65 OptimizationRemarkEmitter *ORE = nullptr);
67 /// Compute known bits from the range metadata.
68 /// \p KnownZero the set of bits that are known to be zero
69 /// \p KnownOne the set of bits that are known to be one
70 void computeKnownBitsFromRangeMetadata(const MDNode &Ranges,
73 /// Return true if LHS and RHS have no common bits set.
74 bool haveNoCommonBitsSet(const Value *LHS, const Value *RHS,
76 AssumptionCache *AC = nullptr,
77 const Instruction *CxtI = nullptr,
78 const DominatorTree *DT = nullptr);
80 /// Return true if the given value is known to have exactly one bit set when
81 /// defined. For vectors return true if every element is known to be a power
82 /// of two when defined. Supports values with integer or pointer type and
83 /// vectors of integers. If 'OrZero' is set, then return true if the given
84 /// value is either a power of two or zero.
85 bool isKnownToBeAPowerOfTwo(const Value *V, const DataLayout &DL,
86 bool OrZero = false, unsigned Depth = 0,
87 AssumptionCache *AC = nullptr,
88 const Instruction *CxtI = nullptr,
89 const DominatorTree *DT = nullptr);
91 bool isOnlyUsedInZeroEqualityComparison(const Instruction *CxtI);
93 /// Return true if the given value is known to be non-zero when defined. For
94 /// vectors, return true if every element is known to be non-zero when
95 /// defined. For pointers, if the context instruction and dominator tree are
96 /// specified, perform context-sensitive analysis and return true if the
97 /// pointer couldn't possibly be null at the specified instruction.
98 /// Supports values with integer or pointer type and vectors of integers.
99 bool isKnownNonZero(const Value *V, const DataLayout &DL, unsigned Depth = 0,
100 AssumptionCache *AC = nullptr,
101 const Instruction *CxtI = nullptr,
102 const DominatorTree *DT = nullptr);
104 /// Return true if the two given values are negation.
105 /// Currently can recoginze Value pair:
106 /// 1: <X, Y> if X = sub (0, Y) or Y = sub (0, X)
107 /// 2: <X, Y> if X = sub (A, B) and Y = sub (B, A)
108 bool isKnownNegation(const Value *X, const Value *Y, bool NeedNSW = false);
110 /// Returns true if the give value is known to be non-negative.
111 bool isKnownNonNegative(const Value *V, const DataLayout &DL,
113 AssumptionCache *AC = nullptr,
114 const Instruction *CxtI = nullptr,
115 const DominatorTree *DT = nullptr);
117 /// Returns true if the given value is known be positive (i.e. non-negative
119 bool isKnownPositive(const Value *V, const DataLayout &DL, unsigned Depth = 0,
120 AssumptionCache *AC = nullptr,
121 const Instruction *CxtI = nullptr,
122 const DominatorTree *DT = nullptr);
124 /// Returns true if the given value is known be negative (i.e. non-positive
126 bool isKnownNegative(const Value *V, const DataLayout &DL, unsigned Depth = 0,
127 AssumptionCache *AC = nullptr,
128 const Instruction *CxtI = nullptr,
129 const DominatorTree *DT = nullptr);
131 /// Return true if the given values are known to be non-equal when defined.
132 /// Supports scalar integer types only.
133 bool isKnownNonEqual(const Value *V1, const Value *V2, const DataLayout &DL,
134 AssumptionCache *AC = nullptr,
135 const Instruction *CxtI = nullptr,
136 const DominatorTree *DT = nullptr);
138 /// Return true if 'V & Mask' is known to be zero. We use this predicate to
139 /// simplify operations downstream. Mask is known to be zero for bits that V
142 /// This function is defined on values with integer type, values with pointer
143 /// type, and vectors of integers. In the case
144 /// where V is a vector, the mask, known zero, and known one values are the
145 /// same width as the vector element, and the bit is set only if it is true
146 /// for all of the elements in the vector.
147 bool MaskedValueIsZero(const Value *V, const APInt &Mask,
148 const DataLayout &DL,
149 unsigned Depth = 0, AssumptionCache *AC = nullptr,
150 const Instruction *CxtI = nullptr,
151 const DominatorTree *DT = nullptr);
153 /// Return the number of times the sign bit of the register is replicated into
154 /// the other bits. We know that at least 1 bit is always equal to the sign
155 /// bit (itself), but other cases can give us information. For example,
156 /// immediately after an "ashr X, 2", we know that the top 3 bits are all
157 /// equal to each other, so we return 3. For vectors, return the number of
158 /// sign bits for the vector element with the mininum number of known sign
160 unsigned ComputeNumSignBits(const Value *Op, const DataLayout &DL,
161 unsigned Depth = 0, AssumptionCache *AC = nullptr,
162 const Instruction *CxtI = nullptr,
163 const DominatorTree *DT = nullptr);
165 /// This function computes the integer multiple of Base that equals V. If
166 /// successful, it returns true and returns the multiple in Multiple. If
167 /// unsuccessful, it returns false. Also, if V can be simplified to an
168 /// integer, then the simplified V is returned in Val. Look through sext only
169 /// if LookThroughSExt=true.
170 bool ComputeMultiple(Value *V, unsigned Base, Value *&Multiple,
171 bool LookThroughSExt = false,
174 /// Map a call instruction to an intrinsic ID. Libcalls which have equivalent
175 /// intrinsics are treated as-if they were intrinsics.
176 Intrinsic::ID getIntrinsicForCallSite(ImmutableCallSite ICS,
177 const TargetLibraryInfo *TLI);
179 /// Return true if we can prove that the specified FP value is never equal to
181 bool CannotBeNegativeZero(const Value *V, const TargetLibraryInfo *TLI,
184 /// Return true if we can prove that the specified FP value is either NaN or
185 /// never less than -0.0.
192 bool CannotBeOrderedLessThanZero(const Value *V, const TargetLibraryInfo *TLI);
194 /// Return true if the floating-point scalar value is not a NaN or if the
195 /// floating-point vector value has no NaN elements. Return false if a value
196 /// could ever be NaN.
197 bool isKnownNeverNaN(const Value *V);
199 /// Return true if we can prove that the specified FP value's sign bit is 0.
201 /// NaN --> true/false (depending on the NaN's sign bit)
206 bool SignBitMustBeZero(const Value *V, const TargetLibraryInfo *TLI);
208 /// If the specified value can be set by repeating the same byte in memory,
209 /// return the i8 value that it is represented with. This is true for all i8
210 /// values obviously, but is also true for i32 0, i32 -1, i16 0xF0F0, double
211 /// 0.0 etc. If the value can't be handled with a repeated byte store (e.g.
212 /// i16 0x1234), return null.
213 Value *isBytewiseValue(Value *V);
215 /// Given an aggregrate and an sequence of indices, see if the scalar value
216 /// indexed is already around as a register, for example if it were inserted
217 /// directly into the aggregrate.
219 /// If InsertBefore is not null, this function will duplicate (modified)
220 /// insertvalues when a part of a nested struct is extracted.
221 Value *FindInsertedValue(Value *V,
222 ArrayRef<unsigned> idx_range,
223 Instruction *InsertBefore = nullptr);
225 /// Analyze the specified pointer to see if it can be expressed as a base
226 /// pointer plus a constant offset. Return the base and offset to the caller.
227 Value *GetPointerBaseWithConstantOffset(Value *Ptr, int64_t &Offset,
228 const DataLayout &DL);
229 inline const Value *GetPointerBaseWithConstantOffset(const Value *Ptr,
231 const DataLayout &DL) {
232 return GetPointerBaseWithConstantOffset(const_cast<Value *>(Ptr), Offset,
236 /// Returns true if the GEP is based on a pointer to a string (array of
237 // \p CharSize integers) and is indexing into this string.
238 bool isGEPBasedOnPointerToString(const GEPOperator *GEP,
239 unsigned CharSize = 8);
241 /// Represents offset+length into a ConstantDataArray.
242 struct ConstantDataArraySlice {
243 /// ConstantDataArray pointer. nullptr indicates a zeroinitializer (a valid
244 /// initializer, it just doesn't fit the ConstantDataArray interface).
245 const ConstantDataArray *Array;
247 /// Slice starts at this Offset.
250 /// Length of the slice.
253 /// Moves the Offset and adjusts Length accordingly.
254 void move(uint64_t Delta) {
255 assert(Delta < Length);
260 /// Convenience accessor for elements in the slice.
261 uint64_t operator[](unsigned I) const {
262 return Array==nullptr ? 0 : Array->getElementAsInteger(I + Offset);
266 /// Returns true if the value \p V is a pointer into a ConstantDataArray.
267 /// If successful \p Slice will point to a ConstantDataArray info object
268 /// with an appropriate offset.
269 bool getConstantDataArrayInfo(const Value *V, ConstantDataArraySlice &Slice,
270 unsigned ElementSize, uint64_t Offset = 0);
272 /// This function computes the length of a null-terminated C string pointed to
273 /// by V. If successful, it returns true and returns the string in Str. If
274 /// unsuccessful, it returns false. This does not include the trailing null
275 /// character by default. If TrimAtNul is set to false, then this returns any
276 /// trailing null characters as well as any other characters that come after
278 bool getConstantStringInfo(const Value *V, StringRef &Str,
279 uint64_t Offset = 0, bool TrimAtNul = true);
281 /// If we can compute the length of the string pointed to by the specified
282 /// pointer, return 'len+1'. If we can't, return 0.
283 uint64_t GetStringLength(const Value *V, unsigned CharSize = 8);
285 /// This function returns call pointer argument that is considered the same by
286 /// aliasing rules. You CAN'T use it to replace one value with another.
287 const Value *getArgumentAliasingToReturnedPointer(ImmutableCallSite CS);
288 inline Value *getArgumentAliasingToReturnedPointer(CallSite CS) {
289 return const_cast<Value *>(
290 getArgumentAliasingToReturnedPointer(ImmutableCallSite(CS)));
293 // {launder,strip}.invariant.group returns pointer that aliases its argument,
294 // and it only captures pointer by returning it.
295 // These intrinsics are not marked as nocapture, because returning is
296 // considered as capture. The arguments are not marked as returned neither,
297 // because it would make it useless.
298 bool isIntrinsicReturningPointerAliasingArgumentWithoutCapturing(
299 ImmutableCallSite CS);
301 /// This method strips off any GEP address adjustments and pointer casts from
302 /// the specified value, returning the original object being addressed. Note
303 /// that the returned value has pointer type if the specified value does. If
304 /// the MaxLookup value is non-zero, it limits the number of instructions to
306 Value *GetUnderlyingObject(Value *V, const DataLayout &DL,
307 unsigned MaxLookup = 6);
308 inline const Value *GetUnderlyingObject(const Value *V, const DataLayout &DL,
309 unsigned MaxLookup = 6) {
310 return GetUnderlyingObject(const_cast<Value *>(V), DL, MaxLookup);
313 /// This method is similar to GetUnderlyingObject except that it can
314 /// look through phi and select instructions and return multiple objects.
316 /// If LoopInfo is passed, loop phis are further analyzed. If a pointer
317 /// accesses different objects in each iteration, we don't look through the
318 /// phi node. E.g. consider this loop nest:
323 /// A[i][j] = A[i-1][j] * B[j]
326 /// This is transformed by Load-PRE to stash away A[i] for the next iteration
327 /// of the outer loop:
329 /// Curr = A[0]; // Prev_0
331 /// Prev = Curr; // Prev = PHI (Prev_0, Curr)
334 /// Curr[j] = Prev[j] * B[j]
338 /// Since A[i] and A[i-1] are independent pointers, getUnderlyingObjects
339 /// should not assume that Curr and Prev share the same underlying object thus
340 /// it shouldn't look through the phi above.
341 void GetUnderlyingObjects(Value *V, SmallVectorImpl<Value *> &Objects,
342 const DataLayout &DL, LoopInfo *LI = nullptr,
343 unsigned MaxLookup = 6);
345 /// This is a wrapper around GetUnderlyingObjects and adds support for basic
346 /// ptrtoint+arithmetic+inttoptr sequences.
347 bool getUnderlyingObjectsForCodeGen(const Value *V,
348 SmallVectorImpl<Value *> &Objects,
349 const DataLayout &DL);
351 /// Return true if the only users of this pointer are lifetime markers.
352 bool onlyUsedByLifetimeMarkers(const Value *V);
354 /// Return true if the instruction does not have any effects besides
355 /// calculating the result and does not have undefined behavior.
357 /// This method never returns true for an instruction that returns true for
358 /// mayHaveSideEffects; however, this method also does some other checks in
359 /// addition. It checks for undefined behavior, like dividing by zero or
360 /// loading from an invalid pointer (but not for undefined results, like a
361 /// shift with a shift amount larger than the width of the result). It checks
362 /// for malloc and alloca because speculatively executing them might cause a
363 /// memory leak. It also returns false for instructions related to control
364 /// flow, specifically terminators and PHI nodes.
366 /// If the CtxI is specified this method performs context-sensitive analysis
367 /// and returns true if it is safe to execute the instruction immediately
370 /// If the CtxI is NOT specified this method only looks at the instruction
371 /// itself and its operands, so if this method returns true, it is safe to
372 /// move the instruction as long as the correct dominance relationships for
373 /// the operands and users hold.
375 /// This method can return true for instructions that read memory;
376 /// for such instructions, moving them may change the resulting value.
377 bool isSafeToSpeculativelyExecute(const Value *V,
378 const Instruction *CtxI = nullptr,
379 const DominatorTree *DT = nullptr);
381 /// Returns true if the result or effects of the given instructions \p I
382 /// depend on or influence global memory.
383 /// Memory dependence arises for example if the instruction reads from
384 /// memory or may produce effects or undefined behaviour. Memory dependent
385 /// instructions generally cannot be reorderd with respect to other memory
386 /// dependent instructions or moved into non-dominated basic blocks.
387 /// Instructions which just compute a value based on the values of their
388 /// operands are not memory dependent.
389 bool mayBeMemoryDependent(const Instruction &I);
391 /// Return true if it is an intrinsic that cannot be speculated but also
393 bool isAssumeLikeIntrinsic(const Instruction *I);
395 /// Return true if it is valid to use the assumptions provided by an
396 /// assume intrinsic, I, at the point in the control-flow identified by the
397 /// context instruction, CxtI.
398 bool isValidAssumeForContext(const Instruction *I, const Instruction *CxtI,
399 const DominatorTree *DT = nullptr);
401 enum class OverflowResult { AlwaysOverflows, MayOverflow, NeverOverflows };
403 OverflowResult computeOverflowForUnsignedMul(const Value *LHS,
405 const DataLayout &DL,
407 const Instruction *CxtI,
408 const DominatorTree *DT);
409 OverflowResult computeOverflowForSignedMul(const Value *LHS, const Value *RHS,
410 const DataLayout &DL,
412 const Instruction *CxtI,
413 const DominatorTree *DT);
414 OverflowResult computeOverflowForUnsignedAdd(const Value *LHS,
416 const DataLayout &DL,
418 const Instruction *CxtI,
419 const DominatorTree *DT);
420 OverflowResult computeOverflowForSignedAdd(const Value *LHS, const Value *RHS,
421 const DataLayout &DL,
422 AssumptionCache *AC = nullptr,
423 const Instruction *CxtI = nullptr,
424 const DominatorTree *DT = nullptr);
425 /// This version also leverages the sign bit of Add if known.
426 OverflowResult computeOverflowForSignedAdd(const AddOperator *Add,
427 const DataLayout &DL,
428 AssumptionCache *AC = nullptr,
429 const Instruction *CxtI = nullptr,
430 const DominatorTree *DT = nullptr);
431 OverflowResult computeOverflowForUnsignedSub(const Value *LHS, const Value *RHS,
432 const DataLayout &DL,
434 const Instruction *CxtI,
435 const DominatorTree *DT);
436 OverflowResult computeOverflowForSignedSub(const Value *LHS, const Value *RHS,
437 const DataLayout &DL,
439 const Instruction *CxtI,
440 const DominatorTree *DT);
442 /// Returns true if the arithmetic part of the \p II 's result is
443 /// used only along the paths control dependent on the computation
444 /// not overflowing, \p II being an <op>.with.overflow intrinsic.
445 bool isOverflowIntrinsicNoWrap(const IntrinsicInst *II,
446 const DominatorTree &DT);
448 /// Return true if this function can prove that the instruction I will
449 /// always transfer execution to one of its successors (including the next
450 /// instruction that follows within a basic block). E.g. this is not
451 /// guaranteed for function calls that could loop infinitely.
453 /// In other words, this function returns false for instructions that may
454 /// transfer execution or fail to transfer execution in a way that is not
455 /// captured in the CFG nor in the sequence of instructions within a basic
458 /// Undefined behavior is assumed not to happen, so e.g. division is
459 /// guaranteed to transfer execution to the following instruction even
460 /// though division by zero might cause undefined behavior.
461 bool isGuaranteedToTransferExecutionToSuccessor(const Instruction *I);
463 /// Returns true if this block does not contain a potential implicit exit.
464 /// This is equivelent to saying that all instructions within the basic block
465 /// are guaranteed to transfer execution to their successor within the basic
466 /// block. This has the same assumptions w.r.t. undefined behavior as the
467 /// instruction variant of this function.
468 bool isGuaranteedToTransferExecutionToSuccessor(const BasicBlock *BB);
470 /// Return true if this function can prove that the instruction I
471 /// is executed for every iteration of the loop L.
473 /// Note that this currently only considers the loop header.
474 bool isGuaranteedToExecuteForEveryIteration(const Instruction *I,
477 /// Return true if this function can prove that I is guaranteed to yield
478 /// full-poison (all bits poison) if at least one of its operands are
479 /// full-poison (all bits poison).
481 /// The exact rules for how poison propagates through instructions have
482 /// not been settled as of 2015-07-10, so this function is conservative
483 /// and only considers poison to be propagated in uncontroversial
484 /// cases. There is no attempt to track values that may be only partially
486 bool propagatesFullPoison(const Instruction *I);
488 /// Return either nullptr or an operand of I such that I will trigger
489 /// undefined behavior if I is executed and that operand has a full-poison
490 /// value (all bits poison).
491 const Value *getGuaranteedNonFullPoisonOp(const Instruction *I);
493 /// Return true if this function can prove that if PoisonI is executed
494 /// and yields a full-poison value (all bits poison), then that will
495 /// trigger undefined behavior.
497 /// Note that this currently only considers the basic block that is
499 bool programUndefinedIfFullPoison(const Instruction *PoisonI);
501 /// Specific patterns of select instructions we can match.
502 enum SelectPatternFlavor {
504 SPF_SMIN, /// Signed minimum
505 SPF_UMIN, /// Unsigned minimum
506 SPF_SMAX, /// Signed maximum
507 SPF_UMAX, /// Unsigned maximum
508 SPF_FMINNUM, /// Floating point minnum
509 SPF_FMAXNUM, /// Floating point maxnum
510 SPF_ABS, /// Absolute value
511 SPF_NABS /// Negated absolute value
514 /// Behavior when a floating point min/max is given one NaN and one
515 /// non-NaN as input.
516 enum SelectPatternNaNBehavior {
517 SPNB_NA = 0, /// NaN behavior not applicable.
518 SPNB_RETURNS_NAN, /// Given one NaN input, returns the NaN.
519 SPNB_RETURNS_OTHER, /// Given one NaN input, returns the non-NaN.
520 SPNB_RETURNS_ANY /// Given one NaN input, can return either (or
521 /// it has been determined that no operands can
525 struct SelectPatternResult {
526 SelectPatternFlavor Flavor;
527 SelectPatternNaNBehavior NaNBehavior; /// Only applicable if Flavor is
528 /// SPF_FMINNUM or SPF_FMAXNUM.
529 bool Ordered; /// When implementing this min/max pattern as
530 /// fcmp; select, does the fcmp have to be
533 /// Return true if \p SPF is a min or a max pattern.
534 static bool isMinOrMax(SelectPatternFlavor SPF) {
535 return SPF != SPF_UNKNOWN && SPF != SPF_ABS && SPF != SPF_NABS;
539 /// Pattern match integer [SU]MIN, [SU]MAX and ABS idioms, returning the kind
540 /// and providing the out parameter results if we successfully match.
542 /// For ABS/NABS, LHS will be set to the input to the abs idiom. RHS will be
543 /// the negation instruction from the idiom.
545 /// If CastOp is not nullptr, also match MIN/MAX idioms where the type does
546 /// not match that of the original select. If this is the case, the cast
547 /// operation (one of Trunc,SExt,Zext) that must be done to transform the
548 /// type of LHS and RHS into the type of V is returned in CastOp.
551 /// %1 = icmp slt i32 %a, i32 4
552 /// %2 = sext i32 %a to i64
553 /// %3 = select i1 %1, i64 %2, i64 4
555 /// -> LHS = %a, RHS = i32 4, *CastOp = Instruction::SExt
557 SelectPatternResult matchSelectPattern(Value *V, Value *&LHS, Value *&RHS,
558 Instruction::CastOps *CastOp = nullptr,
560 inline SelectPatternResult
561 matchSelectPattern(const Value *V, const Value *&LHS, const Value *&RHS,
562 Instruction::CastOps *CastOp = nullptr) {
563 Value *L = const_cast<Value*>(LHS);
564 Value *R = const_cast<Value*>(RHS);
565 auto Result = matchSelectPattern(const_cast<Value*>(V), L, R);
571 /// Return the canonical comparison predicate for the specified
572 /// minimum/maximum flavor.
573 CmpInst::Predicate getMinMaxPred(SelectPatternFlavor SPF,
574 bool Ordered = false);
576 /// Return the inverse minimum/maximum flavor of the specified flavor.
577 /// For example, signed minimum is the inverse of signed maximum.
578 SelectPatternFlavor getInverseMinMaxFlavor(SelectPatternFlavor SPF);
580 /// Return the canonical inverse comparison predicate for the specified
581 /// minimum/maximum flavor.
582 CmpInst::Predicate getInverseMinMaxPred(SelectPatternFlavor SPF);
584 /// Return true if RHS is known to be implied true by LHS. Return false if
585 /// RHS is known to be implied false by LHS. Otherwise, return None if no
586 /// implication can be made.
587 /// A & B must be i1 (boolean) values or a vector of such values. Note that
588 /// the truth table for implication is the same as <=u on i1 values (but not
589 /// <=s!). The truth table for both is:
594 Optional<bool> isImpliedCondition(const Value *LHS, const Value *RHS,
595 const DataLayout &DL, bool LHSIsTrue = true,
597 } // end namespace llvm
599 #endif // LLVM_ANALYSIS_VALUETRACKING_H