1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // This simple pass provides alias and mod/ref information for global values
10 // that do not have their address taken, and keeps track of whether functions
11 // read or write memory (are "pure"). For this simple (but very common) case,
12 // we can provide pretty accurate and useful information.
14 //===----------------------------------------------------------------------===//
16 #include "llvm/Analysis/GlobalsModRef.h"
17 #include "llvm/ADT/SCCIterator.h"
18 #include "llvm/ADT/SmallPtrSet.h"
19 #include "llvm/ADT/Statistic.h"
20 #include "llvm/Analysis/CallGraph.h"
21 #include "llvm/Analysis/MemoryBuiltins.h"
22 #include "llvm/Analysis/TargetLibraryInfo.h"
23 #include "llvm/Analysis/ValueTracking.h"
24 #include "llvm/IR/DerivedTypes.h"
25 #include "llvm/IR/InstIterator.h"
26 #include "llvm/IR/Instructions.h"
27 #include "llvm/IR/IntrinsicInst.h"
28 #include "llvm/IR/Module.h"
29 #include "llvm/InitializePasses.h"
30 #include "llvm/Pass.h"
31 #include "llvm/Support/CommandLine.h"
35 #define DEBUG_TYPE "globalsmodref-aa"
37 STATISTIC(NumNonAddrTakenGlobalVars,
38 "Number of global vars without address taken");
39 STATISTIC(NumNonAddrTakenFunctions,"Number of functions without address taken");
40 STATISTIC(NumNoMemFunctions, "Number of functions that do not access memory");
41 STATISTIC(NumReadMemFunctions, "Number of functions that only read memory");
42 STATISTIC(NumIndirectGlobalVars, "Number of indirect global objects");
44 // An option to enable unsafe alias results from the GlobalsModRef analysis.
45 // When enabled, GlobalsModRef will provide no-alias results which in extremely
46 // rare cases may not be conservatively correct. In particular, in the face of
47 // transforms which cause assymetry between how effective GetUnderlyingObject
48 // is for two pointers, it may produce incorrect results.
50 // These unsafe results have been returned by GMR for many years without
51 // causing significant issues in the wild and so we provide a mechanism to
52 // re-enable them for users of LLVM that have a particular performance
53 // sensitivity and no known issues. The option also makes it easy to evaluate
54 // the performance impact of these results.
55 static cl::opt<bool> EnableUnsafeGlobalsModRefAliasResults(
56 "enable-unsafe-globalsmodref-alias-results", cl::init(false), cl::Hidden);
58 /// The mod/ref information collected for a particular function.
60 /// We collect information about mod/ref behavior of a function here, both in
61 /// general and as pertains to specific globals. We only have this detailed
62 /// information when we know *something* useful about the behavior. If we
63 /// saturate to fully general mod/ref, we remove the info for the function.
64 class GlobalsAAResult::FunctionInfo {
65 typedef SmallDenseMap<const GlobalValue *, ModRefInfo, 16> GlobalInfoMapType;
67 /// Build a wrapper struct that has 8-byte alignment. All heap allocations
68 /// should provide this much alignment at least, but this makes it clear we
69 /// specifically rely on this amount of alignment.
70 struct alignas(8) AlignedMap {
72 AlignedMap(const AlignedMap &Arg) : Map(Arg.Map) {}
73 GlobalInfoMapType Map;
76 /// Pointer traits for our aligned map.
77 struct AlignedMapPointerTraits {
78 static inline void *getAsVoidPointer(AlignedMap *P) { return P; }
79 static inline AlignedMap *getFromVoidPointer(void *P) {
80 return (AlignedMap *)P;
82 static constexpr int NumLowBitsAvailable = 3;
83 static_assert(alignof(AlignedMap) >= (1 << NumLowBitsAvailable),
84 "AlignedMap insufficiently aligned to have enough low bits.");
87 /// The bit that flags that this function may read any global. This is
88 /// chosen to mix together with ModRefInfo bits.
89 /// FIXME: This assumes ModRefInfo lattice will remain 4 bits!
90 /// It overlaps with ModRefInfo::Must bit!
91 /// FunctionInfo.getModRefInfo() masks out everything except ModRef so
92 /// this remains correct, but the Must info is lost.
93 enum { MayReadAnyGlobal = 4 };
95 /// Checks to document the invariants of the bit packing here.
96 static_assert((MayReadAnyGlobal & static_cast<int>(ModRefInfo::MustModRef)) ==
98 "ModRef and the MayReadAnyGlobal flag bits overlap.");
99 static_assert(((MayReadAnyGlobal |
100 static_cast<int>(ModRefInfo::MustModRef)) >>
101 AlignedMapPointerTraits::NumLowBitsAvailable) == 0,
102 "Insufficient low bits to store our flag and ModRef info.");
105 FunctionInfo() : Info() {}
107 delete Info.getPointer();
109 // Spell out the copy ond move constructors and assignment operators to get
110 // deep copy semantics and correct move semantics in the face of the
112 FunctionInfo(const FunctionInfo &Arg)
113 : Info(nullptr, Arg.Info.getInt()) {
114 if (const auto *ArgPtr = Arg.Info.getPointer())
115 Info.setPointer(new AlignedMap(*ArgPtr));
117 FunctionInfo(FunctionInfo &&Arg)
118 : Info(Arg.Info.getPointer(), Arg.Info.getInt()) {
119 Arg.Info.setPointerAndInt(nullptr, 0);
121 FunctionInfo &operator=(const FunctionInfo &RHS) {
122 delete Info.getPointer();
123 Info.setPointerAndInt(nullptr, RHS.Info.getInt());
124 if (const auto *RHSPtr = RHS.Info.getPointer())
125 Info.setPointer(new AlignedMap(*RHSPtr));
128 FunctionInfo &operator=(FunctionInfo &&RHS) {
129 delete Info.getPointer();
130 Info.setPointerAndInt(RHS.Info.getPointer(), RHS.Info.getInt());
131 RHS.Info.setPointerAndInt(nullptr, 0);
135 /// This method clears MayReadAnyGlobal bit added by GlobalsAAResult to return
136 /// the corresponding ModRefInfo. It must align in functionality with
138 ModRefInfo globalClearMayReadAnyGlobal(int I) const {
139 return ModRefInfo((I & static_cast<int>(ModRefInfo::ModRef)) |
140 static_cast<int>(ModRefInfo::NoModRef));
143 /// Returns the \c ModRefInfo info for this function.
144 ModRefInfo getModRefInfo() const {
145 return globalClearMayReadAnyGlobal(Info.getInt());
148 /// Adds new \c ModRefInfo for this function to its state.
149 void addModRefInfo(ModRefInfo NewMRI) {
150 Info.setInt(Info.getInt() | static_cast<int>(setMust(NewMRI)));
153 /// Returns whether this function may read any global variable, and we don't
154 /// know which global.
155 bool mayReadAnyGlobal() const { return Info.getInt() & MayReadAnyGlobal; }
157 /// Sets this function as potentially reading from any global.
158 void setMayReadAnyGlobal() { Info.setInt(Info.getInt() | MayReadAnyGlobal); }
160 /// Returns the \c ModRefInfo info for this function w.r.t. a particular
161 /// global, which may be more precise than the general information above.
162 ModRefInfo getModRefInfoForGlobal(const GlobalValue &GV) const {
163 ModRefInfo GlobalMRI =
164 mayReadAnyGlobal() ? ModRefInfo::Ref : ModRefInfo::NoModRef;
165 if (AlignedMap *P = Info.getPointer()) {
166 auto I = P->Map.find(&GV);
167 if (I != P->Map.end())
168 GlobalMRI = unionModRef(GlobalMRI, I->second);
173 /// Add mod/ref info from another function into ours, saturating towards
175 void addFunctionInfo(const FunctionInfo &FI) {
176 addModRefInfo(FI.getModRefInfo());
178 if (FI.mayReadAnyGlobal())
179 setMayReadAnyGlobal();
181 if (AlignedMap *P = FI.Info.getPointer())
182 for (const auto &G : P->Map)
183 addModRefInfoForGlobal(*G.first, G.second);
186 void addModRefInfoForGlobal(const GlobalValue &GV, ModRefInfo NewMRI) {
187 AlignedMap *P = Info.getPointer();
189 P = new AlignedMap();
192 auto &GlobalMRI = P->Map[&GV];
193 GlobalMRI = unionModRef(GlobalMRI, NewMRI);
196 /// Clear a global's ModRef info. Should be used when a global is being
198 void eraseModRefInfoForGlobal(const GlobalValue &GV) {
199 if (AlignedMap *P = Info.getPointer())
204 /// All of the information is encoded into a single pointer, with a three bit
205 /// integer in the low three bits. The high bit provides a flag for when this
206 /// function may read any global. The low two bits are the ModRefInfo. And
207 /// the pointer, when non-null, points to a map from GlobalValue to
208 /// ModRefInfo specific to that GlobalValue.
209 PointerIntPair<AlignedMap *, 3, unsigned, AlignedMapPointerTraits> Info;
212 void GlobalsAAResult::DeletionCallbackHandle::deleted() {
213 Value *V = getValPtr();
214 if (auto *F = dyn_cast<Function>(V))
215 GAR->FunctionInfos.erase(F);
217 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
218 if (GAR->NonAddressTakenGlobals.erase(GV)) {
219 // This global might be an indirect global. If so, remove it and
220 // remove any AllocRelatedValues for it.
221 if (GAR->IndirectGlobals.erase(GV)) {
222 // Remove any entries in AllocsForIndirectGlobals for this global.
223 for (auto I = GAR->AllocsForIndirectGlobals.begin(),
224 E = GAR->AllocsForIndirectGlobals.end();
227 GAR->AllocsForIndirectGlobals.erase(I);
230 // Scan the function info we have collected and remove this global
232 for (auto &FIPair : GAR->FunctionInfos)
233 FIPair.second.eraseModRefInfoForGlobal(*GV);
237 // If this is an allocation related to an indirect global, remove it.
238 GAR->AllocsForIndirectGlobals.erase(V);
240 // And clear out the handle.
242 GAR->Handles.erase(I);
243 // This object is now destroyed!
246 FunctionModRefBehavior GlobalsAAResult::getModRefBehavior(const Function *F) {
247 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
249 if (FunctionInfo *FI = getFunctionInfo(F)) {
250 if (!isModOrRefSet(FI->getModRefInfo()))
251 Min = FMRB_DoesNotAccessMemory;
252 else if (!isModSet(FI->getModRefInfo()))
253 Min = FMRB_OnlyReadsMemory;
256 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(F) & Min);
259 FunctionModRefBehavior
260 GlobalsAAResult::getModRefBehavior(const CallBase *Call) {
261 FunctionModRefBehavior Min = FMRB_UnknownModRefBehavior;
263 if (!Call->hasOperandBundles())
264 if (const Function *F = Call->getCalledFunction())
265 if (FunctionInfo *FI = getFunctionInfo(F)) {
266 if (!isModOrRefSet(FI->getModRefInfo()))
267 Min = FMRB_DoesNotAccessMemory;
268 else if (!isModSet(FI->getModRefInfo()))
269 Min = FMRB_OnlyReadsMemory;
272 return FunctionModRefBehavior(AAResultBase::getModRefBehavior(Call) & Min);
275 /// Returns the function info for the function, or null if we don't have
276 /// anything useful to say about it.
277 GlobalsAAResult::FunctionInfo *
278 GlobalsAAResult::getFunctionInfo(const Function *F) {
279 auto I = FunctionInfos.find(F);
280 if (I != FunctionInfos.end())
285 /// AnalyzeGlobals - Scan through the users of all of the internal
286 /// GlobalValue's in the program. If none of them have their "address taken"
287 /// (really, their address passed to something nontrivial), record this fact,
288 /// and record the functions that they are used directly in.
289 void GlobalsAAResult::AnalyzeGlobals(Module &M) {
290 SmallPtrSet<Function *, 32> TrackedFunctions;
291 for (Function &F : M)
292 if (F.hasLocalLinkage()) {
293 if (!AnalyzeUsesOfPointer(&F)) {
294 // Remember that we are tracking this global.
295 NonAddressTakenGlobals.insert(&F);
296 TrackedFunctions.insert(&F);
297 Handles.emplace_front(*this, &F);
298 Handles.front().I = Handles.begin();
299 ++NumNonAddrTakenFunctions;
301 UnknownFunctionsWithLocalLinkage = true;
304 SmallPtrSet<Function *, 16> Readers, Writers;
305 for (GlobalVariable &GV : M.globals())
306 if (GV.hasLocalLinkage()) {
307 if (!AnalyzeUsesOfPointer(&GV, &Readers,
308 GV.isConstant() ? nullptr : &Writers)) {
309 // Remember that we are tracking this global, and the mod/ref fns
310 NonAddressTakenGlobals.insert(&GV);
311 Handles.emplace_front(*this, &GV);
312 Handles.front().I = Handles.begin();
314 for (Function *Reader : Readers) {
315 if (TrackedFunctions.insert(Reader).second) {
316 Handles.emplace_front(*this, Reader);
317 Handles.front().I = Handles.begin();
319 FunctionInfos[Reader].addModRefInfoForGlobal(GV, ModRefInfo::Ref);
322 if (!GV.isConstant()) // No need to keep track of writers to constants
323 for (Function *Writer : Writers) {
324 if (TrackedFunctions.insert(Writer).second) {
325 Handles.emplace_front(*this, Writer);
326 Handles.front().I = Handles.begin();
328 FunctionInfos[Writer].addModRefInfoForGlobal(GV, ModRefInfo::Mod);
330 ++NumNonAddrTakenGlobalVars;
332 // If this global holds a pointer type, see if it is an indirect global.
333 if (GV.getValueType()->isPointerTy() &&
334 AnalyzeIndirectGlobalMemory(&GV))
335 ++NumIndirectGlobalVars;
342 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
343 /// If this is used by anything complex (i.e., the address escapes), return
344 /// true. Also, while we are at it, keep track of those functions that read and
345 /// write to the value.
347 /// If OkayStoreDest is non-null, stores into this global are allowed.
348 bool GlobalsAAResult::AnalyzeUsesOfPointer(Value *V,
349 SmallPtrSetImpl<Function *> *Readers,
350 SmallPtrSetImpl<Function *> *Writers,
351 GlobalValue *OkayStoreDest) {
352 if (!V->getType()->isPointerTy())
355 for (Use &U : V->uses()) {
356 User *I = U.getUser();
357 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
359 Readers->insert(LI->getParent()->getParent());
360 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
361 if (V == SI->getOperand(1)) {
363 Writers->insert(SI->getParent()->getParent());
364 } else if (SI->getOperand(1) != OkayStoreDest) {
365 return true; // Storing the pointer
367 } else if (Operator::getOpcode(I) == Instruction::GetElementPtr) {
368 if (AnalyzeUsesOfPointer(I, Readers, Writers))
370 } else if (Operator::getOpcode(I) == Instruction::BitCast) {
371 if (AnalyzeUsesOfPointer(I, Readers, Writers, OkayStoreDest))
373 } else if (auto *Call = dyn_cast<CallBase>(I)) {
374 // Make sure that this is just the function being called, not that it is
375 // passing into the function.
376 if (Call->isDataOperand(&U)) {
377 // Detect calls to free.
378 if (Call->isArgOperand(&U) &&
379 isFreeCall(I, &GetTLI(*Call->getFunction()))) {
381 Writers->insert(Call->getParent()->getParent());
383 return true; // Argument of an unknown call.
386 } else if (ICmpInst *ICI = dyn_cast<ICmpInst>(I)) {
387 if (!isa<ConstantPointerNull>(ICI->getOperand(1)))
388 return true; // Allow comparison against null.
389 } else if (Constant *C = dyn_cast<Constant>(I)) {
390 // Ignore constants which don't have any live uses.
391 if (isa<GlobalValue>(C) || C->isConstantUsed())
401 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
402 /// which holds a pointer type. See if the global always points to non-aliased
403 /// heap memory: that is, all initializers of the globals are allocations, and
404 /// those allocations have no use other than initialization of the global.
405 /// Further, all loads out of GV must directly use the memory, not store the
406 /// pointer somewhere. If this is true, we consider the memory pointed to by
407 /// GV to be owned by GV and can disambiguate other pointers from it.
408 bool GlobalsAAResult::AnalyzeIndirectGlobalMemory(GlobalVariable *GV) {
409 // Keep track of values related to the allocation of the memory, f.e. the
410 // value produced by the malloc call and any casts.
411 std::vector<Value *> AllocRelatedValues;
413 // If the initializer is a valid pointer, bail.
414 if (Constant *C = GV->getInitializer())
415 if (!C->isNullValue())
418 // Walk the user list of the global. If we find anything other than a direct
419 // load or store, bail out.
420 for (User *U : GV->users()) {
421 if (LoadInst *LI = dyn_cast<LoadInst>(U)) {
422 // The pointer loaded from the global can only be used in simple ways:
423 // we allow addressing of it and loading storing to it. We do *not* allow
424 // storing the loaded pointer somewhere else or passing to a function.
425 if (AnalyzeUsesOfPointer(LI))
426 return false; // Loaded pointer escapes.
427 // TODO: Could try some IP mod/ref of the loaded pointer.
428 } else if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
429 // Storing the global itself.
430 if (SI->getOperand(0) == GV)
433 // If storing the null pointer, ignore it.
434 if (isa<ConstantPointerNull>(SI->getOperand(0)))
437 // Check the value being stored.
438 Value *Ptr = GetUnderlyingObject(SI->getOperand(0),
439 GV->getParent()->getDataLayout());
441 if (!isAllocLikeFn(Ptr, &GetTLI(*SI->getFunction())))
442 return false; // Too hard to analyze.
444 // Analyze all uses of the allocation. If any of them are used in a
445 // non-simple way (e.g. stored to another global) bail out.
446 if (AnalyzeUsesOfPointer(Ptr, /*Readers*/ nullptr, /*Writers*/ nullptr,
448 return false; // Loaded pointer escapes.
450 // Remember that this allocation is related to the indirect global.
451 AllocRelatedValues.push_back(Ptr);
453 // Something complex, bail out.
458 // Okay, this is an indirect global. Remember all of the allocations for
459 // this global in AllocsForIndirectGlobals.
460 while (!AllocRelatedValues.empty()) {
461 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
462 Handles.emplace_front(*this, AllocRelatedValues.back());
463 Handles.front().I = Handles.begin();
464 AllocRelatedValues.pop_back();
466 IndirectGlobals.insert(GV);
467 Handles.emplace_front(*this, GV);
468 Handles.front().I = Handles.begin();
472 void GlobalsAAResult::CollectSCCMembership(CallGraph &CG) {
473 // We do a bottom-up SCC traversal of the call graph. In other words, we
474 // visit all callees before callers (leaf-first).
476 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
477 const std::vector<CallGraphNode *> &SCC = *I;
478 assert(!SCC.empty() && "SCC with no functions?");
480 for (auto *CGN : SCC)
481 if (Function *F = CGN->getFunction())
482 FunctionToSCCMap[F] = SCCID;
487 /// AnalyzeCallGraph - At this point, we know the functions where globals are
488 /// immediately stored to and read from. Propagate this information up the call
489 /// graph to all callers and compute the mod/ref info for all memory for each
491 void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) {
492 // We do a bottom-up SCC traversal of the call graph. In other words, we
493 // visit all callees before callers (leaf-first).
494 for (scc_iterator<CallGraph *> I = scc_begin(&CG); !I.isAtEnd(); ++I) {
495 const std::vector<CallGraphNode *> &SCC = *I;
496 assert(!SCC.empty() && "SCC with no functions?");
498 Function *F = SCC[0]->getFunction();
500 if (!F || !F->isDefinitionExact()) {
501 // Calls externally or not exact - can't say anything useful. Remove any
502 // existing function records (may have been created when scanning
504 for (auto *Node : SCC)
505 FunctionInfos.erase(Node->getFunction());
509 FunctionInfo &FI = FunctionInfos[F];
510 Handles.emplace_front(*this, F);
511 Handles.front().I = Handles.begin();
512 bool KnowNothing = false;
514 // Collect the mod/ref properties due to called functions. We only compute
516 for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
522 if (F->isDeclaration() || F->hasOptNone()) {
523 // Try to get mod/ref behaviour from function attributes.
524 if (F->doesNotAccessMemory()) {
525 // Can't do better than that!
526 } else if (F->onlyReadsMemory()) {
527 FI.addModRefInfo(ModRefInfo::Ref);
528 if (!F->isIntrinsic() && !F->onlyAccessesArgMemory())
529 // This function might call back into the module and read a global -
530 // consider every global as possibly being read by this function.
531 FI.setMayReadAnyGlobal();
533 FI.addModRefInfo(ModRefInfo::ModRef);
534 if (!F->onlyAccessesArgMemory())
535 FI.setMayReadAnyGlobal();
536 if (!F->isIntrinsic()) {
544 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
545 CI != E && !KnowNothing; ++CI)
546 if (Function *Callee = CI->second->getFunction()) {
547 if (FunctionInfo *CalleeFI = getFunctionInfo(Callee)) {
548 // Propagate function effect up.
549 FI.addFunctionInfo(*CalleeFI);
551 // Can't say anything about it. However, if it is inside our SCC,
552 // then nothing needs to be done.
553 CallGraphNode *CalleeNode = CG[Callee];
554 if (!is_contained(SCC, CalleeNode))
562 // If we can't say anything useful about this SCC, remove all SCC functions
563 // from the FunctionInfos map.
565 for (auto *Node : SCC)
566 FunctionInfos.erase(Node->getFunction());
570 // Scan the function bodies for explicit loads or stores.
571 for (auto *Node : SCC) {
572 if (isModAndRefSet(FI.getModRefInfo()))
573 break; // The mod/ref lattice saturates here.
575 // Don't prove any properties based on the implementation of an optnone
576 // function. Function attributes were already used as a best approximation
578 if (Node->getFunction()->hasOptNone())
581 for (Instruction &I : instructions(Node->getFunction())) {
582 if (isModAndRefSet(FI.getModRefInfo()))
583 break; // The mod/ref lattice saturates here.
585 // We handle calls specially because the graph-relevant aspects are
587 if (auto *Call = dyn_cast<CallBase>(&I)) {
588 auto &TLI = GetTLI(*Node->getFunction());
589 if (isAllocationFn(Call, &TLI) || isFreeCall(Call, &TLI)) {
590 // FIXME: It is completely unclear why this is necessary and not
591 // handled by the above graph code.
592 FI.addModRefInfo(ModRefInfo::ModRef);
593 } else if (Function *Callee = Call->getCalledFunction()) {
594 // The callgraph doesn't include intrinsic calls.
595 if (Callee->isIntrinsic()) {
596 if (isa<DbgInfoIntrinsic>(Call))
597 // Don't let dbg intrinsics affect alias info.
600 FunctionModRefBehavior Behaviour =
601 AAResultBase::getModRefBehavior(Callee);
602 FI.addModRefInfo(createModRefInfo(Behaviour));
608 // All non-call instructions we use the primary predicates for whether
609 // they read or write memory.
610 if (I.mayReadFromMemory())
611 FI.addModRefInfo(ModRefInfo::Ref);
612 if (I.mayWriteToMemory())
613 FI.addModRefInfo(ModRefInfo::Mod);
617 if (!isModSet(FI.getModRefInfo()))
618 ++NumReadMemFunctions;
619 if (!isModOrRefSet(FI.getModRefInfo()))
622 // Finally, now that we know the full effect on this SCC, clone the
623 // information to each function in the SCC.
624 // FI is a reference into FunctionInfos, so copy it now so that it doesn't
625 // get invalidated if DenseMap decides to re-hash.
626 FunctionInfo CachedFI = FI;
627 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
628 FunctionInfos[SCC[i]->getFunction()] = CachedFI;
632 // GV is a non-escaping global. V is a pointer address that has been loaded from.
633 // If we can prove that V must escape, we can conclude that a load from V cannot
635 static bool isNonEscapingGlobalNoAliasWithLoad(const GlobalValue *GV,
638 const DataLayout &DL) {
639 SmallPtrSet<const Value *, 8> Visited;
640 SmallVector<const Value *, 8> Inputs;
644 const Value *Input = Inputs.pop_back_val();
646 if (isa<GlobalValue>(Input) || isa<Argument>(Input) || isa<CallInst>(Input) ||
647 isa<InvokeInst>(Input))
648 // Arguments to functions or returns from functions are inherently
649 // escaping, so we can immediately classify those as not aliasing any
650 // non-addr-taken globals.
652 // (Transitive) loads from a global are also safe - if this aliased
653 // another global, its address would escape, so no alias.
656 // Recurse through a limited number of selects, loads and PHIs. This is an
657 // arbitrary depth of 4, lower numbers could be used to fix compile time
658 // issues if needed, but this is generally expected to be only be important
663 if (auto *LI = dyn_cast<LoadInst>(Input)) {
664 Inputs.push_back(GetUnderlyingObject(LI->getPointerOperand(), DL));
667 if (auto *SI = dyn_cast<SelectInst>(Input)) {
668 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL);
669 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL);
670 if (Visited.insert(LHS).second)
671 Inputs.push_back(LHS);
672 if (Visited.insert(RHS).second)
673 Inputs.push_back(RHS);
676 if (auto *PN = dyn_cast<PHINode>(Input)) {
677 for (const Value *Op : PN->incoming_values()) {
678 Op = GetUnderlyingObject(Op, DL);
679 if (Visited.insert(Op).second)
680 Inputs.push_back(Op);
686 } while (!Inputs.empty());
688 // All inputs were known to be no-alias.
692 // There are particular cases where we can conclude no-alias between
693 // a non-addr-taken global and some other underlying object. Specifically,
694 // a non-addr-taken global is known to not be escaped from any function. It is
695 // also incorrect for a transformation to introduce an escape of a global in
696 // a way that is observable when it was not there previously. One function
697 // being transformed to introduce an escape which could possibly be observed
698 // (via loading from a global or the return value for example) within another
699 // function is never safe. If the observation is made through non-atomic
700 // operations on different threads, it is a data-race and UB. If the
701 // observation is well defined, by being observed the transformation would have
702 // changed program behavior by introducing the observed escape, making it an
703 // invalid transform.
705 // This property does require that transformations which *temporarily* escape
706 // a global that was not previously escaped, prior to restoring it, cannot rely
707 // on the results of GMR::alias. This seems a reasonable restriction, although
708 // currently there is no way to enforce it. There is also no realistic
709 // optimization pass that would make this mistake. The closest example is
710 // a transformation pass which does reg2mem of SSA values but stores them into
711 // global variables temporarily before restoring the global variable's value.
712 // This could be useful to expose "benign" races for example. However, it seems
713 // reasonable to require that a pass which introduces escapes of global
714 // variables in this way to either not trust AA results while the escape is
715 // active, or to be forced to operate as a module pass that cannot co-exist
716 // with an alias analysis such as GMR.
717 bool GlobalsAAResult::isNonEscapingGlobalNoAlias(const GlobalValue *GV,
719 // In order to know that the underlying object cannot alias the
720 // non-addr-taken global, we must know that it would have to be an escape.
721 // Thus if the underlying object is a function argument, a load from
722 // a global, or the return of a function, it cannot alias. We can also
723 // recurse through PHI nodes and select nodes provided all of their inputs
724 // resolve to one of these known-escaping roots.
725 SmallPtrSet<const Value *, 8> Visited;
726 SmallVector<const Value *, 8> Inputs;
731 const Value *Input = Inputs.pop_back_val();
733 if (auto *InputGV = dyn_cast<GlobalValue>(Input)) {
734 // If one input is the very global we're querying against, then we can't
735 // conclude no-alias.
739 // Distinct GlobalVariables never alias, unless overriden or zero-sized.
740 // FIXME: The condition can be refined, but be conservative for now.
741 auto *GVar = dyn_cast<GlobalVariable>(GV);
742 auto *InputGVar = dyn_cast<GlobalVariable>(InputGV);
743 if (GVar && InputGVar &&
744 !GVar->isDeclaration() && !InputGVar->isDeclaration() &&
745 !GVar->isInterposable() && !InputGVar->isInterposable()) {
746 Type *GVType = GVar->getInitializer()->getType();
747 Type *InputGVType = InputGVar->getInitializer()->getType();
748 if (GVType->isSized() && InputGVType->isSized() &&
749 (DL.getTypeAllocSize(GVType) > 0) &&
750 (DL.getTypeAllocSize(InputGVType) > 0))
754 // Conservatively return false, even though we could be smarter
755 // (e.g. look through GlobalAliases).
759 if (isa<Argument>(Input) || isa<CallInst>(Input) ||
760 isa<InvokeInst>(Input)) {
761 // Arguments to functions or returns from functions are inherently
762 // escaping, so we can immediately classify those as not aliasing any
763 // non-addr-taken globals.
767 // Recurse through a limited number of selects, loads and PHIs. This is an
768 // arbitrary depth of 4, lower numbers could be used to fix compile time
769 // issues if needed, but this is generally expected to be only be important
774 if (auto *LI = dyn_cast<LoadInst>(Input)) {
775 // A pointer loaded from a global would have been captured, and we know
776 // that the global is non-escaping, so no alias.
777 const Value *Ptr = GetUnderlyingObject(LI->getPointerOperand(), DL);
778 if (isNonEscapingGlobalNoAliasWithLoad(GV, Ptr, Depth, DL))
779 // The load does not alias with GV.
781 // Otherwise, a load could come from anywhere, so bail.
784 if (auto *SI = dyn_cast<SelectInst>(Input)) {
785 const Value *LHS = GetUnderlyingObject(SI->getTrueValue(), DL);
786 const Value *RHS = GetUnderlyingObject(SI->getFalseValue(), DL);
787 if (Visited.insert(LHS).second)
788 Inputs.push_back(LHS);
789 if (Visited.insert(RHS).second)
790 Inputs.push_back(RHS);
793 if (auto *PN = dyn_cast<PHINode>(Input)) {
794 for (const Value *Op : PN->incoming_values()) {
795 Op = GetUnderlyingObject(Op, DL);
796 if (Visited.insert(Op).second)
797 Inputs.push_back(Op);
802 // FIXME: It would be good to handle other obvious no-alias cases here, but
803 // it isn't clear how to do so reasonably without building a small version
804 // of BasicAA into this code. We could recurse into AAResultBase::alias
805 // here but that seems likely to go poorly as we're inside the
806 // implementation of such a query. Until then, just conservatively return
809 } while (!Inputs.empty());
811 // If all the inputs to V were definitively no-alias, then V is no-alias.
815 bool GlobalsAAResult::invalidate(Module &, const PreservedAnalyses &PA,
816 ModuleAnalysisManager::Invalidator &) {
817 // Check whether the analysis has been explicitly invalidated. Otherwise, it's
818 // stateless and remains preserved.
819 auto PAC = PA.getChecker<GlobalsAA>();
820 return !PAC.preservedWhenStateless();
823 /// alias - If one of the pointers is to a global that we are tracking, and the
824 /// other is some random pointer, we know there cannot be an alias, because the
825 /// address of the global isn't taken.
826 AliasResult GlobalsAAResult::alias(const MemoryLocation &LocA,
827 const MemoryLocation &LocB,
829 // Get the base object these pointers point to.
830 const Value *UV1 = GetUnderlyingObject(LocA.Ptr, DL);
831 const Value *UV2 = GetUnderlyingObject(LocB.Ptr, DL);
833 // If either of the underlying values is a global, they may be non-addr-taken
834 // globals, which we can answer queries about.
835 const GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
836 const GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
838 // If the global's address is taken, pretend we don't know it's a pointer to
840 if (GV1 && !NonAddressTakenGlobals.count(GV1))
842 if (GV2 && !NonAddressTakenGlobals.count(GV2))
845 // If the two pointers are derived from two different non-addr-taken
846 // globals we know these can't alias.
847 if (GV1 && GV2 && GV1 != GV2)
850 // If one is and the other isn't, it isn't strictly safe but we can fake
851 // this result if necessary for performance. This does not appear to be
852 // a common problem in practice.
853 if (EnableUnsafeGlobalsModRefAliasResults)
854 if ((GV1 || GV2) && GV1 != GV2)
857 // Check for a special case where a non-escaping global can be used to
858 // conclude no-alias.
859 if ((GV1 || GV2) && GV1 != GV2) {
860 const GlobalValue *GV = GV1 ? GV1 : GV2;
861 const Value *UV = GV1 ? UV2 : UV1;
862 if (isNonEscapingGlobalNoAlias(GV, UV))
866 // Otherwise if they are both derived from the same addr-taken global, we
867 // can't know the two accesses don't overlap.
870 // These pointers may be based on the memory owned by an indirect global. If
871 // so, we may be able to handle this. First check to see if the base pointer
872 // is a direct load from an indirect global.
874 if (const LoadInst *LI = dyn_cast<LoadInst>(UV1))
875 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
876 if (IndirectGlobals.count(GV))
878 if (const LoadInst *LI = dyn_cast<LoadInst>(UV2))
879 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
880 if (IndirectGlobals.count(GV))
883 // These pointers may also be from an allocation for the indirect global. If
884 // so, also handle them.
886 GV1 = AllocsForIndirectGlobals.lookup(UV1);
888 GV2 = AllocsForIndirectGlobals.lookup(UV2);
890 // Now that we know whether the two pointers are related to indirect globals,
891 // use this to disambiguate the pointers. If the pointers are based on
892 // different indirect globals they cannot alias.
893 if (GV1 && GV2 && GV1 != GV2)
896 // If one is based on an indirect global and the other isn't, it isn't
897 // strictly safe but we can fake this result if necessary for performance.
898 // This does not appear to be a common problem in practice.
899 if (EnableUnsafeGlobalsModRefAliasResults)
900 if ((GV1 || GV2) && GV1 != GV2)
903 return AAResultBase::alias(LocA, LocB, AAQI);
906 ModRefInfo GlobalsAAResult::getModRefInfoForArgument(const CallBase *Call,
907 const GlobalValue *GV,
909 if (Call->doesNotAccessMemory())
910 return ModRefInfo::NoModRef;
911 ModRefInfo ConservativeResult =
912 Call->onlyReadsMemory() ? ModRefInfo::Ref : ModRefInfo::ModRef;
914 // Iterate through all the arguments to the called function. If any argument
915 // is based on GV, return the conservative result.
916 for (auto &A : Call->args()) {
917 SmallVector<const Value*, 4> Objects;
918 GetUnderlyingObjects(A, Objects, DL);
920 // All objects must be identified.
921 if (!all_of(Objects, isIdentifiedObject) &&
922 // Try ::alias to see if all objects are known not to alias GV.
923 !all_of(Objects, [&](const Value *V) {
924 return this->alias(MemoryLocation(V), MemoryLocation(GV), AAQI) ==
927 return ConservativeResult;
929 if (is_contained(Objects, GV))
930 return ConservativeResult;
933 // We identified all objects in the argument list, and none of them were GV.
934 return ModRefInfo::NoModRef;
937 ModRefInfo GlobalsAAResult::getModRefInfo(const CallBase *Call,
938 const MemoryLocation &Loc,
940 ModRefInfo Known = ModRefInfo::ModRef;
942 // If we are asking for mod/ref info of a direct call with a pointer to a
943 // global we are tracking, return information if we have it.
944 if (const GlobalValue *GV =
945 dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL)))
946 // If GV is internal to this IR and there is no function with local linkage
947 // that has had their address taken, keep looking for a tighter ModRefInfo.
948 if (GV->hasLocalLinkage() && !UnknownFunctionsWithLocalLinkage)
949 if (const Function *F = Call->getCalledFunction())
950 if (NonAddressTakenGlobals.count(GV))
951 if (const FunctionInfo *FI = getFunctionInfo(F))
952 Known = unionModRef(FI->getModRefInfoForGlobal(*GV),
953 getModRefInfoForArgument(Call, GV, AAQI));
955 if (!isModOrRefSet(Known))
956 return ModRefInfo::NoModRef; // No need to query other mod/ref analyses
957 return intersectModRef(Known, AAResultBase::getModRefInfo(Call, Loc, AAQI));
960 GlobalsAAResult::GlobalsAAResult(
961 const DataLayout &DL,
962 std::function<const TargetLibraryInfo &(Function &F)> GetTLI)
963 : AAResultBase(), DL(DL), GetTLI(std::move(GetTLI)) {}
965 GlobalsAAResult::GlobalsAAResult(GlobalsAAResult &&Arg)
966 : AAResultBase(std::move(Arg)), DL(Arg.DL), GetTLI(std::move(Arg.GetTLI)),
967 NonAddressTakenGlobals(std::move(Arg.NonAddressTakenGlobals)),
968 IndirectGlobals(std::move(Arg.IndirectGlobals)),
969 AllocsForIndirectGlobals(std::move(Arg.AllocsForIndirectGlobals)),
970 FunctionInfos(std::move(Arg.FunctionInfos)),
971 Handles(std::move(Arg.Handles)) {
972 // Update the parent for each DeletionCallbackHandle.
973 for (auto &H : Handles) {
974 assert(H.GAR == &Arg);
979 GlobalsAAResult::~GlobalsAAResult() {}
981 /*static*/ GlobalsAAResult GlobalsAAResult::analyzeModule(
982 Module &M, std::function<const TargetLibraryInfo &(Function &F)> GetTLI,
984 GlobalsAAResult Result(M.getDataLayout(), GetTLI);
986 // Discover which functions aren't recursive, to feed into AnalyzeGlobals.
987 Result.CollectSCCMembership(CG);
989 // Find non-addr taken globals.
990 Result.AnalyzeGlobals(M);
993 Result.AnalyzeCallGraph(CG, M);
998 AnalysisKey GlobalsAA::Key;
1000 GlobalsAAResult GlobalsAA::run(Module &M, ModuleAnalysisManager &AM) {
1001 FunctionAnalysisManager &FAM =
1002 AM.getResult<FunctionAnalysisManagerModuleProxy>(M).getManager();
1003 auto GetTLI = [&FAM](Function &F) -> TargetLibraryInfo & {
1004 return FAM.getResult<TargetLibraryAnalysis>(F);
1006 return GlobalsAAResult::analyzeModule(M, GetTLI,
1007 AM.getResult<CallGraphAnalysis>(M));
1010 char GlobalsAAWrapperPass::ID = 0;
1011 INITIALIZE_PASS_BEGIN(GlobalsAAWrapperPass, "globals-aa",
1012 "Globals Alias Analysis", false, true)
1013 INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
1014 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
1015 INITIALIZE_PASS_END(GlobalsAAWrapperPass, "globals-aa",
1016 "Globals Alias Analysis", false, true)
1018 ModulePass *llvm::createGlobalsAAWrapperPass() {
1019 return new GlobalsAAWrapperPass();
1022 GlobalsAAWrapperPass::GlobalsAAWrapperPass() : ModulePass(ID) {
1023 initializeGlobalsAAWrapperPassPass(*PassRegistry::getPassRegistry());
1026 bool GlobalsAAWrapperPass::runOnModule(Module &M) {
1027 auto GetTLI = [this](Function &F) -> TargetLibraryInfo & {
1028 return this->getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
1030 Result.reset(new GlobalsAAResult(GlobalsAAResult::analyzeModule(
1031 M, GetTLI, getAnalysis<CallGraphWrapperPass>().getCallGraph())));
1035 bool GlobalsAAWrapperPass::doFinalization(Module &M) {
1040 void GlobalsAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const {
1041 AU.setPreservesAll();
1042 AU.addRequired<CallGraphWrapperPass>();
1043 AU.addRequired<TargetLibraryInfoWrapperPass>();