1 //===- CorrelatedValuePropagation.cpp - Propagate CFG-derived info --------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file implements the Correlated Value Propagation pass.
12 //===----------------------------------------------------------------------===//
14 #include "llvm/Transforms/Scalar/CorrelatedValuePropagation.h"
15 #include "llvm/Transforms/Scalar.h"
16 #include "llvm/ADT/Statistic.h"
17 #include "llvm/Analysis/GlobalsModRef.h"
18 #include "llvm/Analysis/InstructionSimplify.h"
19 #include "llvm/Analysis/LazyValueInfo.h"
20 #include "llvm/IR/CFG.h"
21 #include "llvm/IR/ConstantRange.h"
22 #include "llvm/IR/Constants.h"
23 #include "llvm/IR/Function.h"
24 #include "llvm/IR/Instructions.h"
25 #include "llvm/IR/Module.h"
26 #include "llvm/Pass.h"
27 #include "llvm/Support/Debug.h"
28 #include "llvm/Support/raw_ostream.h"
29 #include "llvm/Transforms/Utils/Local.h"
32 #define DEBUG_TYPE "correlated-value-propagation"
34 STATISTIC(NumPhis, "Number of phis propagated");
35 STATISTIC(NumSelects, "Number of selects propagated");
36 STATISTIC(NumMemAccess, "Number of memory access targets propagated");
37 STATISTIC(NumCmps, "Number of comparisons propagated");
38 STATISTIC(NumReturns, "Number of return values propagated");
39 STATISTIC(NumDeadCases, "Number of switch cases removed");
40 STATISTIC(NumSDivs, "Number of sdiv converted to udiv");
41 STATISTIC(NumAShrs, "Number of ashr converted to lshr");
42 STATISTIC(NumSRems, "Number of srem converted to urem");
44 static cl::opt<bool> DontProcessAdds("cvp-dont-process-adds", cl::init(true));
47 class CorrelatedValuePropagation : public FunctionPass {
50 CorrelatedValuePropagation(): FunctionPass(ID) {
51 initializeCorrelatedValuePropagationPass(*PassRegistry::getPassRegistry());
54 bool runOnFunction(Function &F) override;
56 void getAnalysisUsage(AnalysisUsage &AU) const override {
57 AU.addRequired<LazyValueInfoWrapperPass>();
58 AU.addPreserved<GlobalsAAWrapperPass>();
63 char CorrelatedValuePropagation::ID = 0;
64 INITIALIZE_PASS_BEGIN(CorrelatedValuePropagation, "correlated-propagation",
65 "Value Propagation", false, false)
66 INITIALIZE_PASS_DEPENDENCY(LazyValueInfoWrapperPass)
67 INITIALIZE_PASS_END(CorrelatedValuePropagation, "correlated-propagation",
68 "Value Propagation", false, false)
70 // Public interface to the Value Propagation pass
71 Pass *llvm::createCorrelatedValuePropagationPass() {
72 return new CorrelatedValuePropagation();
75 static bool processSelect(SelectInst *S, LazyValueInfo *LVI) {
76 if (S->getType()->isVectorTy()) return false;
77 if (isa<Constant>(S->getOperand(0))) return false;
79 Constant *C = LVI->getConstant(S->getOperand(0), S->getParent(), S);
82 ConstantInt *CI = dyn_cast<ConstantInt>(C);
83 if (!CI) return false;
85 Value *ReplaceWith = S->getOperand(1);
86 Value *Other = S->getOperand(2);
87 if (!CI->isOne()) std::swap(ReplaceWith, Other);
88 if (ReplaceWith == S) ReplaceWith = UndefValue::get(S->getType());
90 S->replaceAllUsesWith(ReplaceWith);
98 static bool processPHI(PHINode *P, LazyValueInfo *LVI) {
101 BasicBlock *BB = P->getParent();
102 for (unsigned i = 0, e = P->getNumIncomingValues(); i < e; ++i) {
103 Value *Incoming = P->getIncomingValue(i);
104 if (isa<Constant>(Incoming)) continue;
106 Value *V = LVI->getConstantOnEdge(Incoming, P->getIncomingBlock(i), BB, P);
108 // Look if the incoming value is a select with a scalar condition for which
109 // LVI can tells us the value. In that case replace the incoming value with
110 // the appropriate value of the select. This often allows us to remove the
113 SelectInst *SI = dyn_cast<SelectInst>(Incoming);
116 Value *Condition = SI->getCondition();
117 if (!Condition->getType()->isVectorTy()) {
118 if (Constant *C = LVI->getConstantOnEdge(
119 Condition, P->getIncomingBlock(i), BB, P)) {
120 if (C->isOneValue()) {
121 V = SI->getTrueValue();
122 } else if (C->isZeroValue()) {
123 V = SI->getFalseValue();
125 // Once LVI learns to handle vector types, we could also add support
126 // for vector type constants that are not all zeroes or all ones.
130 // Look if the select has a constant but LVI tells us that the incoming
131 // value can never be that constant. In that case replace the incoming
132 // value with the other value of the select. This often allows us to
133 // remove the select later.
135 Constant *C = dyn_cast<Constant>(SI->getFalseValue());
138 if (LVI->getPredicateOnEdge(ICmpInst::ICMP_EQ, SI, C,
139 P->getIncomingBlock(i), BB, P) !=
140 LazyValueInfo::False)
142 V = SI->getTrueValue();
145 DEBUG(dbgs() << "CVP: Threading PHI over " << *SI << '\n');
148 P->setIncomingValue(i, V);
152 // FIXME: Provide TLI, DT, AT to SimplifyInstruction.
153 const DataLayout &DL = BB->getModule()->getDataLayout();
154 if (Value *V = SimplifyInstruction(P, DL)) {
155 P->replaceAllUsesWith(V);
156 P->eraseFromParent();
166 static bool processMemAccess(Instruction *I, LazyValueInfo *LVI) {
167 Value *Pointer = nullptr;
168 if (LoadInst *L = dyn_cast<LoadInst>(I))
169 Pointer = L->getPointerOperand();
171 Pointer = cast<StoreInst>(I)->getPointerOperand();
173 if (isa<Constant>(Pointer)) return false;
175 Constant *C = LVI->getConstant(Pointer, I->getParent(), I);
176 if (!C) return false;
179 I->replaceUsesOfWith(Pointer, C);
183 /// See if LazyValueInfo's ability to exploit edge conditions or range
184 /// information is sufficient to prove this comparison. Even for local
185 /// conditions, this can sometimes prove conditions instcombine can't by
186 /// exploiting range information.
187 static bool processCmp(CmpInst *C, LazyValueInfo *LVI) {
188 Value *Op0 = C->getOperand(0);
189 Constant *Op1 = dyn_cast<Constant>(C->getOperand(1));
190 if (!Op1) return false;
192 // As a policy choice, we choose not to waste compile time on anything where
193 // the comparison is testing local values. While LVI can sometimes reason
194 // about such cases, it's not its primary purpose. We do make sure to do
195 // the block local query for uses from terminator instructions, but that's
196 // handled in the code for each terminator.
197 auto *I = dyn_cast<Instruction>(Op0);
198 if (I && I->getParent() == C->getParent())
201 LazyValueInfo::Tristate Result =
202 LVI->getPredicateAt(C->getPredicate(), Op0, Op1, C);
203 if (Result == LazyValueInfo::Unknown) return false;
206 if (Result == LazyValueInfo::True)
207 C->replaceAllUsesWith(ConstantInt::getTrue(C->getContext()));
209 C->replaceAllUsesWith(ConstantInt::getFalse(C->getContext()));
210 C->eraseFromParent();
215 /// Simplify a switch instruction by removing cases which can never fire. If the
216 /// uselessness of a case could be determined locally then constant propagation
217 /// would already have figured it out. Instead, walk the predecessors and
218 /// statically evaluate cases based on information available on that edge. Cases
219 /// that cannot fire no matter what the incoming edge can safely be removed. If
220 /// a case fires on every incoming edge then the entire switch can be removed
221 /// and replaced with a branch to the case destination.
222 static bool processSwitch(SwitchInst *SI, LazyValueInfo *LVI) {
223 Value *Cond = SI->getCondition();
224 BasicBlock *BB = SI->getParent();
226 // If the condition was defined in same block as the switch then LazyValueInfo
227 // currently won't say anything useful about it, though in theory it could.
228 if (isa<Instruction>(Cond) && cast<Instruction>(Cond)->getParent() == BB)
231 // If the switch is unreachable then trying to improve it is a waste of time.
232 pred_iterator PB = pred_begin(BB), PE = pred_end(BB);
233 if (PB == PE) return false;
235 // Analyse each switch case in turn. This is done in reverse order so that
236 // removing a case doesn't cause trouble for the iteration.
237 bool Changed = false;
238 for (SwitchInst::CaseIt CI = SI->case_end(), CE = SI->case_begin(); CI-- != CE;
240 ConstantInt *Case = CI.getCaseValue();
242 // Check to see if the switch condition is equal to/not equal to the case
243 // value on every incoming edge, equal/not equal being the same each time.
244 LazyValueInfo::Tristate State = LazyValueInfo::Unknown;
245 for (pred_iterator PI = PB; PI != PE; ++PI) {
246 // Is the switch condition equal to the case value?
247 LazyValueInfo::Tristate Value = LVI->getPredicateOnEdge(CmpInst::ICMP_EQ,
250 // Give up on this case if nothing is known.
251 if (Value == LazyValueInfo::Unknown) {
252 State = LazyValueInfo::Unknown;
256 // If this was the first edge to be visited, record that all other edges
257 // need to give the same result.
263 // If this case is known to fire for some edges and known not to fire for
264 // others then there is nothing we can do - give up.
265 if (Value != State) {
266 State = LazyValueInfo::Unknown;
271 if (State == LazyValueInfo::False) {
272 // This case never fires - remove it.
273 CI.getCaseSuccessor()->removePredecessor(BB);
274 SI->removeCase(CI); // Does not invalidate the iterator.
276 // The condition can be modified by removePredecessor's PHI simplification
278 Cond = SI->getCondition();
282 } else if (State == LazyValueInfo::True) {
283 // This case always fires. Arrange for the switch to be turned into an
284 // unconditional branch by replacing the switch condition with the case
286 SI->setCondition(Case);
287 NumDeadCases += SI->getNumCases();
294 // If the switch has been simplified to the point where it can be replaced
295 // by a branch then do so now.
296 ConstantFoldTerminator(BB);
301 /// Infer nonnull attributes for the arguments at the specified callsite.
302 static bool processCallSite(CallSite CS, LazyValueInfo *LVI) {
303 SmallVector<unsigned, 4> Indices;
306 for (Value *V : CS.args()) {
307 PointerType *Type = dyn_cast<PointerType>(V->getType());
308 // Try to mark pointer typed parameters as non-null. We skip the
309 // relatively expensive analysis for constants which are obviously either
310 // null or non-null to start with.
311 if (Type && !CS.paramHasAttr(ArgNo + 1, Attribute::NonNull) &&
313 LVI->getPredicateAt(ICmpInst::ICMP_EQ, V,
314 ConstantPointerNull::get(Type),
315 CS.getInstruction()) == LazyValueInfo::False)
316 Indices.push_back(ArgNo + 1);
320 assert(ArgNo == CS.arg_size() && "sanity check");
325 AttributeSet AS = CS.getAttributes();
326 LLVMContext &Ctx = CS.getInstruction()->getContext();
327 AS = AS.addAttribute(Ctx, Indices, Attribute::get(Ctx, Attribute::NonNull));
328 CS.setAttributes(AS);
333 // Helper function to rewrite srem and sdiv. As a policy choice, we choose not
334 // to waste compile time on anything where the operands are local defs. While
335 // LVI can sometimes reason about such cases, it's not its primary purpose.
336 static bool hasLocalDefs(BinaryOperator *SDI) {
337 for (Value *O : SDI->operands()) {
338 auto *I = dyn_cast<Instruction>(O);
339 if (I && I->getParent() == SDI->getParent())
345 static bool hasPositiveOperands(BinaryOperator *SDI, LazyValueInfo *LVI) {
346 Constant *Zero = ConstantInt::get(SDI->getType(), 0);
347 for (Value *O : SDI->operands()) {
348 auto Result = LVI->getPredicateAt(ICmpInst::ICMP_SGE, O, Zero, SDI);
349 if (Result != LazyValueInfo::True)
355 static bool processSRem(BinaryOperator *SDI, LazyValueInfo *LVI) {
356 if (SDI->getType()->isVectorTy() || hasLocalDefs(SDI) ||
357 !hasPositiveOperands(SDI, LVI))
361 auto *BO = BinaryOperator::CreateURem(SDI->getOperand(0), SDI->getOperand(1),
362 SDI->getName(), SDI);
363 SDI->replaceAllUsesWith(BO);
364 SDI->eraseFromParent();
368 /// See if LazyValueInfo's ability to exploit edge conditions or range
369 /// information is sufficient to prove the both operands of this SDiv are
370 /// positive. If this is the case, replace the SDiv with a UDiv. Even for local
371 /// conditions, this can sometimes prove conditions instcombine can't by
372 /// exploiting range information.
373 static bool processSDiv(BinaryOperator *SDI, LazyValueInfo *LVI) {
374 if (SDI->getType()->isVectorTy() || hasLocalDefs(SDI) ||
375 !hasPositiveOperands(SDI, LVI))
379 auto *BO = BinaryOperator::CreateUDiv(SDI->getOperand(0), SDI->getOperand(1),
380 SDI->getName(), SDI);
381 BO->setIsExact(SDI->isExact());
382 SDI->replaceAllUsesWith(BO);
383 SDI->eraseFromParent();
388 static bool processAShr(BinaryOperator *SDI, LazyValueInfo *LVI) {
389 if (SDI->getType()->isVectorTy() || hasLocalDefs(SDI))
392 Constant *Zero = ConstantInt::get(SDI->getType(), 0);
393 if (LVI->getPredicateAt(ICmpInst::ICMP_SGE, SDI->getOperand(0), Zero, SDI) !=
398 auto *BO = BinaryOperator::CreateLShr(SDI->getOperand(0), SDI->getOperand(1),
399 SDI->getName(), SDI);
400 BO->setIsExact(SDI->isExact());
401 SDI->replaceAllUsesWith(BO);
402 SDI->eraseFromParent();
407 static bool processAdd(BinaryOperator *AddOp, LazyValueInfo *LVI) {
408 typedef OverflowingBinaryOperator OBO;
413 if (AddOp->getType()->isVectorTy() || hasLocalDefs(AddOp))
416 bool NSW = AddOp->hasNoSignedWrap();
417 bool NUW = AddOp->hasNoUnsignedWrap();
421 BasicBlock *BB = AddOp->getParent();
423 Value *LHS = AddOp->getOperand(0);
424 Value *RHS = AddOp->getOperand(1);
426 ConstantRange LRange = LVI->getConstantRange(LHS, BB, AddOp);
428 // Initialize RRange only if we need it. If we know that guaranteed no wrap
429 // range for the given LHS range is empty don't spend time calculating the
430 // range for the RHS.
431 Optional<ConstantRange> RRange;
432 auto LazyRRange = [&] () {
434 RRange = LVI->getConstantRange(RHS, BB, AddOp);
435 return RRange.getValue();
438 bool Changed = false;
440 ConstantRange NUWRange =
441 LRange.makeGuaranteedNoWrapRegion(BinaryOperator::Add, LRange,
442 OBO::NoUnsignedWrap);
443 if (!NUWRange.isEmptySet()) {
444 bool NewNUW = NUWRange.contains(LazyRRange());
445 AddOp->setHasNoUnsignedWrap(NewNUW);
450 ConstantRange NSWRange =
451 LRange.makeGuaranteedNoWrapRegion(BinaryOperator::Add, LRange,
453 if (!NSWRange.isEmptySet()) {
454 bool NewNSW = NSWRange.contains(LazyRRange());
455 AddOp->setHasNoSignedWrap(NewNSW);
463 static Constant *getConstantAt(Value *V, Instruction *At, LazyValueInfo *LVI) {
464 if (Constant *C = LVI->getConstant(V, At->getParent(), At))
467 // TODO: The following really should be sunk inside LVI's core algorithm, or
468 // at least the outer shims around such.
469 auto *C = dyn_cast<CmpInst>(V);
470 if (!C) return nullptr;
472 Value *Op0 = C->getOperand(0);
473 Constant *Op1 = dyn_cast<Constant>(C->getOperand(1));
474 if (!Op1) return nullptr;
476 LazyValueInfo::Tristate Result =
477 LVI->getPredicateAt(C->getPredicate(), Op0, Op1, At);
478 if (Result == LazyValueInfo::Unknown)
481 return (Result == LazyValueInfo::True) ?
482 ConstantInt::getTrue(C->getContext()) :
483 ConstantInt::getFalse(C->getContext());
486 static bool runImpl(Function &F, LazyValueInfo *LVI) {
487 bool FnChanged = false;
489 // Visiting in a pre-order depth-first traversal causes us to simplify early
490 // blocks before querying later blocks (which require us to analyze early
491 // blocks). Eagerly simplifying shallow blocks means there is strictly less
492 // work to do for deep blocks. This also means we don't visit unreachable
494 for (BasicBlock *BB : depth_first(&F.getEntryBlock())) {
495 bool BBChanged = false;
496 for (BasicBlock::iterator BI = BB->begin(), BE = BB->end(); BI != BE;) {
497 Instruction *II = &*BI++;
498 switch (II->getOpcode()) {
499 case Instruction::Select:
500 BBChanged |= processSelect(cast<SelectInst>(II), LVI);
502 case Instruction::PHI:
503 BBChanged |= processPHI(cast<PHINode>(II), LVI);
505 case Instruction::ICmp:
506 case Instruction::FCmp:
507 BBChanged |= processCmp(cast<CmpInst>(II), LVI);
509 case Instruction::Load:
510 case Instruction::Store:
511 BBChanged |= processMemAccess(II, LVI);
513 case Instruction::Call:
514 case Instruction::Invoke:
515 BBChanged |= processCallSite(CallSite(II), LVI);
517 case Instruction::SRem:
518 BBChanged |= processSRem(cast<BinaryOperator>(II), LVI);
520 case Instruction::SDiv:
521 BBChanged |= processSDiv(cast<BinaryOperator>(II), LVI);
523 case Instruction::AShr:
524 BBChanged |= processAShr(cast<BinaryOperator>(II), LVI);
526 case Instruction::Add:
527 BBChanged |= processAdd(cast<BinaryOperator>(II), LVI);
532 Instruction *Term = BB->getTerminator();
533 switch (Term->getOpcode()) {
534 case Instruction::Switch:
535 BBChanged |= processSwitch(cast<SwitchInst>(Term), LVI);
537 case Instruction::Ret: {
538 auto *RI = cast<ReturnInst>(Term);
539 // Try to determine the return value if we can. This is mainly here to
540 // simplify the writing of unit tests, but also helps to enable IPO by
541 // constant folding the return values of callees.
542 auto *RetVal = RI->getReturnValue();
543 if (!RetVal) break; // handle "ret void"
544 if (isa<Constant>(RetVal)) break; // nothing to do
545 if (auto *C = getConstantAt(RetVal, RI, LVI)) {
547 RI->replaceUsesOfWith(RetVal, C);
553 FnChanged |= BBChanged;
559 bool CorrelatedValuePropagation::runOnFunction(Function &F) {
563 LazyValueInfo *LVI = &getAnalysis<LazyValueInfoWrapperPass>().getLVI();
564 return runImpl(F, LVI);
568 CorrelatedValuePropagationPass::run(Function &F, FunctionAnalysisManager &AM) {
570 LazyValueInfo *LVI = &AM.getResult<LazyValueAnalysis>(F);
571 bool Changed = runImpl(F, LVI);
573 // FIXME: We need to invalidate LVI to avoid PR28400. Is there a better
575 AM.invalidate<LazyValueAnalysis>(F);
578 return PreservedAnalyses::all();
579 PreservedAnalyses PA;
580 PA.preserve<GlobalsAA>();