Home | History | Annotate | Download | only in Analysis
      1 //===- AliasAnalysis.cpp - Generic Alias Analysis Interface Implementation -==//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // This file implements the generic AliasAnalysis interface which is used as the
     11 // common interface used by all clients and implementations of alias analysis.
     12 //
     13 // This file also implements the default version of the AliasAnalysis interface
     14 // that is to be used when no other implementation is specified.  This does some
     15 // simple tests that detect obvious cases: two different global pointers cannot
     16 // alias, a global cannot alias a malloc, two different mallocs cannot alias,
     17 // etc.
     18 //
     19 // This alias analysis implementation really isn't very good for anything, but
     20 // it is very fast, and makes a nice clean default implementation.  Because it
     21 // handles lots of little corner cases, other, more complex, alias analysis
     22 // implementations may choose to rely on this pass to resolve these simple and
     23 // easy cases.
     24 //
     25 //===----------------------------------------------------------------------===//
     26 
     27 #include "llvm/Analysis/AliasAnalysis.h"
     28 #include "llvm/Analysis/CaptureTracking.h"
     29 #include "llvm/Analysis/Dominators.h"
     30 #include "llvm/Analysis/ValueTracking.h"
     31 #include "llvm/Pass.h"
     32 #include "llvm/BasicBlock.h"
     33 #include "llvm/Function.h"
     34 #include "llvm/IntrinsicInst.h"
     35 #include "llvm/Instructions.h"
     36 #include "llvm/LLVMContext.h"
     37 #include "llvm/Type.h"
     38 #include "llvm/Target/TargetData.h"
     39 #include "llvm/Target/TargetLibraryInfo.h"
     40 using namespace llvm;
     41 
     42 // Register the AliasAnalysis interface, providing a nice name to refer to.
     43 INITIALIZE_ANALYSIS_GROUP(AliasAnalysis, "Alias Analysis", NoAA)
     44 char AliasAnalysis::ID = 0;
     45 
     46 //===----------------------------------------------------------------------===//
     47 // Default chaining methods
     48 //===----------------------------------------------------------------------===//
     49 
     50 AliasAnalysis::AliasResult
     51 AliasAnalysis::alias(const Location &LocA, const Location &LocB) {
     52   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
     53   return AA->alias(LocA, LocB);
     54 }
     55 
     56 bool AliasAnalysis::pointsToConstantMemory(const Location &Loc,
     57                                            bool OrLocal) {
     58   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
     59   return AA->pointsToConstantMemory(Loc, OrLocal);
     60 }
     61 
     62 void AliasAnalysis::deleteValue(Value *V) {
     63   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
     64   AA->deleteValue(V);
     65 }
     66 
     67 void AliasAnalysis::copyValue(Value *From, Value *To) {
     68   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
     69   AA->copyValue(From, To);
     70 }
     71 
     72 void AliasAnalysis::addEscapingUse(Use &U) {
     73   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
     74   AA->addEscapingUse(U);
     75 }
     76 
     77 
     78 AliasAnalysis::ModRefResult
     79 AliasAnalysis::getModRefInfo(ImmutableCallSite CS,
     80                              const Location &Loc) {
     81   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
     82 
     83   ModRefBehavior MRB = getModRefBehavior(CS);
     84   if (MRB == DoesNotAccessMemory)
     85     return NoModRef;
     86 
     87   ModRefResult Mask = ModRef;
     88   if (onlyReadsMemory(MRB))
     89     Mask = Ref;
     90 
     91   if (onlyAccessesArgPointees(MRB)) {
     92     bool doesAlias = false;
     93     if (doesAccessArgPointees(MRB)) {
     94       MDNode *CSTag = CS.getInstruction()->getMetadata(LLVMContext::MD_tbaa);
     95       for (ImmutableCallSite::arg_iterator AI = CS.arg_begin(), AE = CS.arg_end();
     96            AI != AE; ++AI) {
     97         const Value *Arg = *AI;
     98         if (!Arg->getType()->isPointerTy())
     99           continue;
    100         Location CSLoc(Arg, UnknownSize, CSTag);
    101         if (!isNoAlias(CSLoc, Loc)) {
    102           doesAlias = true;
    103           break;
    104         }
    105       }
    106     }
    107     if (!doesAlias)
    108       return NoModRef;
    109   }
    110 
    111   // If Loc is a constant memory location, the call definitely could not
    112   // modify the memory location.
    113   if ((Mask & Mod) && pointsToConstantMemory(Loc))
    114     Mask = ModRefResult(Mask & ~Mod);
    115 
    116   // If this is the end of the chain, don't forward.
    117   if (!AA) return Mask;
    118 
    119   // Otherwise, fall back to the next AA in the chain. But we can merge
    120   // in any mask we've managed to compute.
    121   return ModRefResult(AA->getModRefInfo(CS, Loc) & Mask);
    122 }
    123 
    124 AliasAnalysis::ModRefResult
    125 AliasAnalysis::getModRefInfo(ImmutableCallSite CS1, ImmutableCallSite CS2) {
    126   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
    127 
    128   // If CS1 or CS2 are readnone, they don't interact.
    129   ModRefBehavior CS1B = getModRefBehavior(CS1);
    130   if (CS1B == DoesNotAccessMemory) return NoModRef;
    131 
    132   ModRefBehavior CS2B = getModRefBehavior(CS2);
    133   if (CS2B == DoesNotAccessMemory) return NoModRef;
    134 
    135   // If they both only read from memory, there is no dependence.
    136   if (onlyReadsMemory(CS1B) && onlyReadsMemory(CS2B))
    137     return NoModRef;
    138 
    139   AliasAnalysis::ModRefResult Mask = ModRef;
    140 
    141   // If CS1 only reads memory, the only dependence on CS2 can be
    142   // from CS1 reading memory written by CS2.
    143   if (onlyReadsMemory(CS1B))
    144     Mask = ModRefResult(Mask & Ref);
    145 
    146   // If CS2 only access memory through arguments, accumulate the mod/ref
    147   // information from CS1's references to the memory referenced by
    148   // CS2's arguments.
    149   if (onlyAccessesArgPointees(CS2B)) {
    150     AliasAnalysis::ModRefResult R = NoModRef;
    151     if (doesAccessArgPointees(CS2B)) {
    152       MDNode *CS2Tag = CS2.getInstruction()->getMetadata(LLVMContext::MD_tbaa);
    153       for (ImmutableCallSite::arg_iterator
    154            I = CS2.arg_begin(), E = CS2.arg_end(); I != E; ++I) {
    155         const Value *Arg = *I;
    156         if (!Arg->getType()->isPointerTy())
    157           continue;
    158         Location CS2Loc(Arg, UnknownSize, CS2Tag);
    159         R = ModRefResult((R | getModRefInfo(CS1, CS2Loc)) & Mask);
    160         if (R == Mask)
    161           break;
    162       }
    163     }
    164     return R;
    165   }
    166 
    167   // If CS1 only accesses memory through arguments, check if CS2 references
    168   // any of the memory referenced by CS1's arguments. If not, return NoModRef.
    169   if (onlyAccessesArgPointees(CS1B)) {
    170     AliasAnalysis::ModRefResult R = NoModRef;
    171     if (doesAccessArgPointees(CS1B)) {
    172       MDNode *CS1Tag = CS1.getInstruction()->getMetadata(LLVMContext::MD_tbaa);
    173       for (ImmutableCallSite::arg_iterator
    174            I = CS1.arg_begin(), E = CS1.arg_end(); I != E; ++I) {
    175         const Value *Arg = *I;
    176         if (!Arg->getType()->isPointerTy())
    177           continue;
    178         Location CS1Loc(Arg, UnknownSize, CS1Tag);
    179         if (getModRefInfo(CS2, CS1Loc) != NoModRef) {
    180           R = Mask;
    181           break;
    182         }
    183       }
    184     }
    185     if (R == NoModRef)
    186       return R;
    187   }
    188 
    189   // If this is the end of the chain, don't forward.
    190   if (!AA) return Mask;
    191 
    192   // Otherwise, fall back to the next AA in the chain. But we can merge
    193   // in any mask we've managed to compute.
    194   return ModRefResult(AA->getModRefInfo(CS1, CS2) & Mask);
    195 }
    196 
    197 AliasAnalysis::ModRefBehavior
    198 AliasAnalysis::getModRefBehavior(ImmutableCallSite CS) {
    199   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
    200 
    201   ModRefBehavior Min = UnknownModRefBehavior;
    202 
    203   // Call back into the alias analysis with the other form of getModRefBehavior
    204   // to see if it can give a better response.
    205   if (const Function *F = CS.getCalledFunction())
    206     Min = getModRefBehavior(F);
    207 
    208   // If this is the end of the chain, don't forward.
    209   if (!AA) return Min;
    210 
    211   // Otherwise, fall back to the next AA in the chain. But we can merge
    212   // in any result we've managed to compute.
    213   return ModRefBehavior(AA->getModRefBehavior(CS) & Min);
    214 }
    215 
    216 AliasAnalysis::ModRefBehavior
    217 AliasAnalysis::getModRefBehavior(const Function *F) {
    218   assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!");
    219   return AA->getModRefBehavior(F);
    220 }
    221 
    222 //===----------------------------------------------------------------------===//
    223 // AliasAnalysis non-virtual helper method implementation
    224 //===----------------------------------------------------------------------===//
    225 
    226 AliasAnalysis::Location AliasAnalysis::getLocation(const LoadInst *LI) {
    227   return Location(LI->getPointerOperand(),
    228                   getTypeStoreSize(LI->getType()),
    229                   LI->getMetadata(LLVMContext::MD_tbaa));
    230 }
    231 
    232 AliasAnalysis::Location AliasAnalysis::getLocation(const StoreInst *SI) {
    233   return Location(SI->getPointerOperand(),
    234                   getTypeStoreSize(SI->getValueOperand()->getType()),
    235                   SI->getMetadata(LLVMContext::MD_tbaa));
    236 }
    237 
    238 AliasAnalysis::Location AliasAnalysis::getLocation(const VAArgInst *VI) {
    239   return Location(VI->getPointerOperand(),
    240                   UnknownSize,
    241                   VI->getMetadata(LLVMContext::MD_tbaa));
    242 }
    243 
    244 AliasAnalysis::Location
    245 AliasAnalysis::getLocation(const AtomicCmpXchgInst *CXI) {
    246   return Location(CXI->getPointerOperand(),
    247                   getTypeStoreSize(CXI->getCompareOperand()->getType()),
    248                   CXI->getMetadata(LLVMContext::MD_tbaa));
    249 }
    250 
    251 AliasAnalysis::Location
    252 AliasAnalysis::getLocation(const AtomicRMWInst *RMWI) {
    253   return Location(RMWI->getPointerOperand(),
    254                   getTypeStoreSize(RMWI->getValOperand()->getType()),
    255                   RMWI->getMetadata(LLVMContext::MD_tbaa));
    256 }
    257 
    258 AliasAnalysis::Location
    259 AliasAnalysis::getLocationForSource(const MemTransferInst *MTI) {
    260   uint64_t Size = UnknownSize;
    261   if (ConstantInt *C = dyn_cast<ConstantInt>(MTI->getLength()))
    262     Size = C->getValue().getZExtValue();
    263 
    264   // memcpy/memmove can have TBAA tags. For memcpy, they apply
    265   // to both the source and the destination.
    266   MDNode *TBAATag = MTI->getMetadata(LLVMContext::MD_tbaa);
    267 
    268   return Location(MTI->getRawSource(), Size, TBAATag);
    269 }
    270 
    271 AliasAnalysis::Location
    272 AliasAnalysis::getLocationForDest(const MemIntrinsic *MTI) {
    273   uint64_t Size = UnknownSize;
    274   if (ConstantInt *C = dyn_cast<ConstantInt>(MTI->getLength()))
    275     Size = C->getValue().getZExtValue();
    276 
    277   // memcpy/memmove can have TBAA tags. For memcpy, they apply
    278   // to both the source and the destination.
    279   MDNode *TBAATag = MTI->getMetadata(LLVMContext::MD_tbaa);
    280 
    281   return Location(MTI->getRawDest(), Size, TBAATag);
    282 }
    283 
    284 
    285 
    286 AliasAnalysis::ModRefResult
    287 AliasAnalysis::getModRefInfo(const LoadInst *L, const Location &Loc) {
    288   // Be conservative in the face of volatile/atomic.
    289   if (!L->isUnordered())
    290     return ModRef;
    291 
    292   // If the load address doesn't alias the given address, it doesn't read
    293   // or write the specified memory.
    294   if (!alias(getLocation(L), Loc))
    295     return NoModRef;
    296 
    297   // Otherwise, a load just reads.
    298   return Ref;
    299 }
    300 
    301 AliasAnalysis::ModRefResult
    302 AliasAnalysis::getModRefInfo(const StoreInst *S, const Location &Loc) {
    303   // Be conservative in the face of volatile/atomic.
    304   if (!S->isUnordered())
    305     return ModRef;
    306 
    307   // If the store address cannot alias the pointer in question, then the
    308   // specified memory cannot be modified by the store.
    309   if (!alias(getLocation(S), Loc))
    310     return NoModRef;
    311 
    312   // If the pointer is a pointer to constant memory, then it could not have been
    313   // modified by this store.
    314   if (pointsToConstantMemory(Loc))
    315     return NoModRef;
    316 
    317   // Otherwise, a store just writes.
    318   return Mod;
    319 }
    320 
    321 AliasAnalysis::ModRefResult
    322 AliasAnalysis::getModRefInfo(const VAArgInst *V, const Location &Loc) {
    323   // If the va_arg address cannot alias the pointer in question, then the
    324   // specified memory cannot be accessed by the va_arg.
    325   if (!alias(getLocation(V), Loc))
    326     return NoModRef;
    327 
    328   // If the pointer is a pointer to constant memory, then it could not have been
    329   // modified by this va_arg.
    330   if (pointsToConstantMemory(Loc))
    331     return NoModRef;
    332 
    333   // Otherwise, a va_arg reads and writes.
    334   return ModRef;
    335 }
    336 
    337 AliasAnalysis::ModRefResult
    338 AliasAnalysis::getModRefInfo(const AtomicCmpXchgInst *CX, const Location &Loc) {
    339   // Acquire/Release cmpxchg has properties that matter for arbitrary addresses.
    340   if (CX->getOrdering() > Monotonic)
    341     return ModRef;
    342 
    343   // If the cmpxchg address does not alias the location, it does not access it.
    344   if (!alias(getLocation(CX), Loc))
    345     return NoModRef;
    346 
    347   return ModRef;
    348 }
    349 
    350 AliasAnalysis::ModRefResult
    351 AliasAnalysis::getModRefInfo(const AtomicRMWInst *RMW, const Location &Loc) {
    352   // Acquire/Release atomicrmw has properties that matter for arbitrary addresses.
    353   if (RMW->getOrdering() > Monotonic)
    354     return ModRef;
    355 
    356   // If the atomicrmw address does not alias the location, it does not access it.
    357   if (!alias(getLocation(RMW), Loc))
    358     return NoModRef;
    359 
    360   return ModRef;
    361 }
    362 
    363 namespace {
    364   /// Only find pointer captures which happen before the given instruction. Uses
    365   /// the dominator tree to determine whether one instruction is before another.
    366   struct CapturesBefore : public CaptureTracker {
    367     CapturesBefore(const Instruction *I, DominatorTree *DT)
    368       : BeforeHere(I), DT(DT), Captured(false) {}
    369 
    370     void tooManyUses() { Captured = true; }
    371 
    372     bool shouldExplore(Use *U) {
    373       Instruction *I = cast<Instruction>(U->getUser());
    374       BasicBlock *BB = I->getParent();
    375       if (BeforeHere != I &&
    376           (!DT->isReachableFromEntry(BB) || DT->dominates(BeforeHere, I)))
    377         return false;
    378       return true;
    379     }
    380 
    381     bool captured(Use *U) {
    382       Instruction *I = cast<Instruction>(U->getUser());
    383       BasicBlock *BB = I->getParent();
    384       if (BeforeHere != I &&
    385           (!DT->isReachableFromEntry(BB) || DT->dominates(BeforeHere, I)))
    386         return false;
    387       Captured = true;
    388       return true;
    389     }
    390 
    391     const Instruction *BeforeHere;
    392     DominatorTree *DT;
    393 
    394     bool Captured;
    395   };
    396 }
    397 
    398 // FIXME: this is really just shoring-up a deficiency in alias analysis.
    399 // BasicAA isn't willing to spend linear time determining whether an alloca
    400 // was captured before or after this particular call, while we are. However,
    401 // with a smarter AA in place, this test is just wasting compile time.
    402 AliasAnalysis::ModRefResult
    403 AliasAnalysis::callCapturesBefore(const Instruction *I,
    404                                   const AliasAnalysis::Location &MemLoc,
    405                                   DominatorTree *DT) {
    406   if (!DT || !TD) return AliasAnalysis::ModRef;
    407 
    408   const Value *Object = GetUnderlyingObject(MemLoc.Ptr, TD);
    409   if (!isIdentifiedObject(Object) || isa<GlobalValue>(Object) ||
    410       isa<Constant>(Object))
    411     return AliasAnalysis::ModRef;
    412 
    413   ImmutableCallSite CS(I);
    414   if (!CS.getInstruction() || CS.getInstruction() == Object)
    415     return AliasAnalysis::ModRef;
    416 
    417   CapturesBefore CB(I, DT);
    418   llvm::PointerMayBeCaptured(Object, &CB);
    419   if (CB.Captured)
    420     return AliasAnalysis::ModRef;
    421 
    422   unsigned ArgNo = 0;
    423   for (ImmutableCallSite::arg_iterator CI = CS.arg_begin(), CE = CS.arg_end();
    424        CI != CE; ++CI, ++ArgNo) {
    425     // Only look at the no-capture or byval pointer arguments.  If this
    426     // pointer were passed to arguments that were neither of these, then it
    427     // couldn't be no-capture.
    428     if (!(*CI)->getType()->isPointerTy() ||
    429         (!CS.doesNotCapture(ArgNo) && !CS.isByValArgument(ArgNo)))
    430       continue;
    431 
    432     // If this is a no-capture pointer argument, see if we can tell that it
    433     // is impossible to alias the pointer we're checking.  If not, we have to
    434     // assume that the call could touch the pointer, even though it doesn't
    435     // escape.
    436     if (!isNoAlias(AliasAnalysis::Location(*CI),
    437                    AliasAnalysis::Location(Object))) {
    438       return AliasAnalysis::ModRef;
    439     }
    440   }
    441   return AliasAnalysis::NoModRef;
    442 }
    443 
    444 // AliasAnalysis destructor: DO NOT move this to the header file for
    445 // AliasAnalysis or else clients of the AliasAnalysis class may not depend on
    446 // the AliasAnalysis.o file in the current .a file, causing alias analysis
    447 // support to not be included in the tool correctly!
    448 //
    449 AliasAnalysis::~AliasAnalysis() {}
    450 
    451 /// InitializeAliasAnalysis - Subclasses must call this method to initialize the
    452 /// AliasAnalysis interface before any other methods are called.
    453 ///
    454 void AliasAnalysis::InitializeAliasAnalysis(Pass *P) {
    455   TD = P->getAnalysisIfAvailable<TargetData>();
    456   TLI = P->getAnalysisIfAvailable<TargetLibraryInfo>();
    457   AA = &P->getAnalysis<AliasAnalysis>();
    458 }
    459 
    460 // getAnalysisUsage - All alias analysis implementations should invoke this
    461 // directly (using AliasAnalysis::getAnalysisUsage(AU)).
    462 void AliasAnalysis::getAnalysisUsage(AnalysisUsage &AU) const {
    463   AU.addRequired<AliasAnalysis>();         // All AA's chain
    464 }
    465 
    466 /// getTypeStoreSize - Return the TargetData store size for the given type,
    467 /// if known, or a conservative value otherwise.
    468 ///
    469 uint64_t AliasAnalysis::getTypeStoreSize(Type *Ty) {
    470   return TD ? TD->getTypeStoreSize(Ty) : UnknownSize;
    471 }
    472 
    473 /// canBasicBlockModify - Return true if it is possible for execution of the
    474 /// specified basic block to modify the value pointed to by Ptr.
    475 ///
    476 bool AliasAnalysis::canBasicBlockModify(const BasicBlock &BB,
    477                                         const Location &Loc) {
    478   return canInstructionRangeModify(BB.front(), BB.back(), Loc);
    479 }
    480 
    481 /// canInstructionRangeModify - Return true if it is possible for the execution
    482 /// of the specified instructions to modify the value pointed to by Ptr.  The
    483 /// instructions to consider are all of the instructions in the range of [I1,I2]
    484 /// INCLUSIVE.  I1 and I2 must be in the same basic block.
    485 ///
    486 bool AliasAnalysis::canInstructionRangeModify(const Instruction &I1,
    487                                               const Instruction &I2,
    488                                               const Location &Loc) {
    489   assert(I1.getParent() == I2.getParent() &&
    490          "Instructions not in same basic block!");
    491   BasicBlock::const_iterator I = &I1;
    492   BasicBlock::const_iterator E = &I2;
    493   ++E;  // Convert from inclusive to exclusive range.
    494 
    495   for (; I != E; ++I) // Check every instruction in range
    496     if (getModRefInfo(I, Loc) & Mod)
    497       return true;
    498   return false;
    499 }
    500 
    501 /// isNoAliasCall - Return true if this pointer is returned by a noalias
    502 /// function.
    503 bool llvm::isNoAliasCall(const Value *V) {
    504   if (isa<CallInst>(V) || isa<InvokeInst>(V))
    505     return ImmutableCallSite(cast<Instruction>(V))
    506       .paramHasAttr(0, Attribute::NoAlias);
    507   return false;
    508 }
    509 
    510 /// isIdentifiedObject - Return true if this pointer refers to a distinct and
    511 /// identifiable object.  This returns true for:
    512 ///    Global Variables and Functions (but not Global Aliases)
    513 ///    Allocas and Mallocs
    514 ///    ByVal and NoAlias Arguments
    515 ///    NoAlias returns
    516 ///
    517 bool llvm::isIdentifiedObject(const Value *V) {
    518   if (isa<AllocaInst>(V))
    519     return true;
    520   if (isa<GlobalValue>(V) && !isa<GlobalAlias>(V))
    521     return true;
    522   if (isNoAliasCall(V))
    523     return true;
    524   if (const Argument *A = dyn_cast<Argument>(V))
    525     return A->hasNoAliasAttr() || A->hasByValAttr();
    526   return false;
    527 }
    528 
    529 /// isKnownNonNull - Return true if we know that the specified value is never
    530 /// null.
    531 bool llvm::isKnownNonNull(const Value *V) {
    532   // Alloca never returns null, malloc might.
    533   if (isa<AllocaInst>(V)) return true;
    534 
    535   // A byval argument is never null.
    536   if (const Argument *A = dyn_cast<Argument>(V))
    537     return A->hasByValAttr();
    538 
    539   // Global values are not null unless extern weak.
    540   if (const GlobalValue *GV = dyn_cast<GlobalValue>(V))
    541     return !GV->hasExternalWeakLinkage();
    542   return false;
    543 }
    544