1 //===- AliasAnalysis.cpp - Generic Alias Analysis Interface Implementation -==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file implements the generic AliasAnalysis interface which is used as the 11 // common interface used by all clients and implementations of alias analysis. 12 // 13 // This file also implements the default version of the AliasAnalysis interface 14 // that is to be used when no other implementation is specified. This does some 15 // simple tests that detect obvious cases: two different global pointers cannot 16 // alias, a global cannot alias a malloc, two different mallocs cannot alias, 17 // etc. 18 // 19 // This alias analysis implementation really isn't very good for anything, but 20 // it is very fast, and makes a nice clean default implementation. Because it 21 // handles lots of little corner cases, other, more complex, alias analysis 22 // implementations may choose to rely on this pass to resolve these simple and 23 // easy cases. 24 // 25 //===----------------------------------------------------------------------===// 26 27 #include "llvm/Analysis/AliasAnalysis.h" 28 #include "llvm/Analysis/CaptureTracking.h" 29 #include "llvm/Analysis/Dominators.h" 30 #include "llvm/Analysis/ValueTracking.h" 31 #include "llvm/IR/BasicBlock.h" 32 #include "llvm/IR/DataLayout.h" 33 #include "llvm/IR/Function.h" 34 #include "llvm/IR/Instructions.h" 35 #include "llvm/IR/IntrinsicInst.h" 36 #include "llvm/IR/LLVMContext.h" 37 #include "llvm/IR/Type.h" 38 #include "llvm/Pass.h" 39 #include "llvm/Target/TargetLibraryInfo.h" 40 using namespace llvm; 41 42 // Register the AliasAnalysis interface, providing a nice name to refer to. 43 INITIALIZE_ANALYSIS_GROUP(AliasAnalysis, "Alias Analysis", NoAA) 44 char AliasAnalysis::ID = 0; 45 46 //===----------------------------------------------------------------------===// 47 // Default chaining methods 48 //===----------------------------------------------------------------------===// 49 50 AliasAnalysis::AliasResult 51 AliasAnalysis::alias(const Location &LocA, const Location &LocB) { 52 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 53 return AA->alias(LocA, LocB); 54 } 55 56 bool AliasAnalysis::pointsToConstantMemory(const Location &Loc, 57 bool OrLocal) { 58 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 59 return AA->pointsToConstantMemory(Loc, OrLocal); 60 } 61 62 void AliasAnalysis::deleteValue(Value *V) { 63 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 64 AA->deleteValue(V); 65 } 66 67 void AliasAnalysis::copyValue(Value *From, Value *To) { 68 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 69 AA->copyValue(From, To); 70 } 71 72 void AliasAnalysis::addEscapingUse(Use &U) { 73 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 74 AA->addEscapingUse(U); 75 } 76 77 78 AliasAnalysis::ModRefResult 79 AliasAnalysis::getModRefInfo(ImmutableCallSite CS, 80 const Location &Loc) { 81 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 82 83 ModRefBehavior MRB = getModRefBehavior(CS); 84 if (MRB == DoesNotAccessMemory) 85 return NoModRef; 86 87 ModRefResult Mask = ModRef; 88 if (onlyReadsMemory(MRB)) 89 Mask = Ref; 90 91 if (onlyAccessesArgPointees(MRB)) { 92 bool doesAlias = false; 93 if (doesAccessArgPointees(MRB)) { 94 MDNode *CSTag = CS.getInstruction()->getMetadata(LLVMContext::MD_tbaa); 95 for (ImmutableCallSite::arg_iterator AI = CS.arg_begin(), AE = CS.arg_end(); 96 AI != AE; ++AI) { 97 const Value *Arg = *AI; 98 if (!Arg->getType()->isPointerTy()) 99 continue; 100 Location CSLoc(Arg, UnknownSize, CSTag); 101 if (!isNoAlias(CSLoc, Loc)) { 102 doesAlias = true; 103 break; 104 } 105 } 106 } 107 if (!doesAlias) 108 return NoModRef; 109 } 110 111 // If Loc is a constant memory location, the call definitely could not 112 // modify the memory location. 113 if ((Mask & Mod) && pointsToConstantMemory(Loc)) 114 Mask = ModRefResult(Mask & ~Mod); 115 116 // If this is the end of the chain, don't forward. 117 if (!AA) return Mask; 118 119 // Otherwise, fall back to the next AA in the chain. But we can merge 120 // in any mask we've managed to compute. 121 return ModRefResult(AA->getModRefInfo(CS, Loc) & Mask); 122 } 123 124 AliasAnalysis::ModRefResult 125 AliasAnalysis::getModRefInfo(ImmutableCallSite CS1, ImmutableCallSite CS2) { 126 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 127 128 // If CS1 or CS2 are readnone, they don't interact. 129 ModRefBehavior CS1B = getModRefBehavior(CS1); 130 if (CS1B == DoesNotAccessMemory) return NoModRef; 131 132 ModRefBehavior CS2B = getModRefBehavior(CS2); 133 if (CS2B == DoesNotAccessMemory) return NoModRef; 134 135 // If they both only read from memory, there is no dependence. 136 if (onlyReadsMemory(CS1B) && onlyReadsMemory(CS2B)) 137 return NoModRef; 138 139 AliasAnalysis::ModRefResult Mask = ModRef; 140 141 // If CS1 only reads memory, the only dependence on CS2 can be 142 // from CS1 reading memory written by CS2. 143 if (onlyReadsMemory(CS1B)) 144 Mask = ModRefResult(Mask & Ref); 145 146 // If CS2 only access memory through arguments, accumulate the mod/ref 147 // information from CS1's references to the memory referenced by 148 // CS2's arguments. 149 if (onlyAccessesArgPointees(CS2B)) { 150 AliasAnalysis::ModRefResult R = NoModRef; 151 if (doesAccessArgPointees(CS2B)) { 152 MDNode *CS2Tag = CS2.getInstruction()->getMetadata(LLVMContext::MD_tbaa); 153 for (ImmutableCallSite::arg_iterator 154 I = CS2.arg_begin(), E = CS2.arg_end(); I != E; ++I) { 155 const Value *Arg = *I; 156 if (!Arg->getType()->isPointerTy()) 157 continue; 158 Location CS2Loc(Arg, UnknownSize, CS2Tag); 159 R = ModRefResult((R | getModRefInfo(CS1, CS2Loc)) & Mask); 160 if (R == Mask) 161 break; 162 } 163 } 164 return R; 165 } 166 167 // If CS1 only accesses memory through arguments, check if CS2 references 168 // any of the memory referenced by CS1's arguments. If not, return NoModRef. 169 if (onlyAccessesArgPointees(CS1B)) { 170 AliasAnalysis::ModRefResult R = NoModRef; 171 if (doesAccessArgPointees(CS1B)) { 172 MDNode *CS1Tag = CS1.getInstruction()->getMetadata(LLVMContext::MD_tbaa); 173 for (ImmutableCallSite::arg_iterator 174 I = CS1.arg_begin(), E = CS1.arg_end(); I != E; ++I) { 175 const Value *Arg = *I; 176 if (!Arg->getType()->isPointerTy()) 177 continue; 178 Location CS1Loc(Arg, UnknownSize, CS1Tag); 179 if (getModRefInfo(CS2, CS1Loc) != NoModRef) { 180 R = Mask; 181 break; 182 } 183 } 184 } 185 if (R == NoModRef) 186 return R; 187 } 188 189 // If this is the end of the chain, don't forward. 190 if (!AA) return Mask; 191 192 // Otherwise, fall back to the next AA in the chain. But we can merge 193 // in any mask we've managed to compute. 194 return ModRefResult(AA->getModRefInfo(CS1, CS2) & Mask); 195 } 196 197 AliasAnalysis::ModRefBehavior 198 AliasAnalysis::getModRefBehavior(ImmutableCallSite CS) { 199 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 200 201 ModRefBehavior Min = UnknownModRefBehavior; 202 203 // Call back into the alias analysis with the other form of getModRefBehavior 204 // to see if it can give a better response. 205 if (const Function *F = CS.getCalledFunction()) 206 Min = getModRefBehavior(F); 207 208 // If this is the end of the chain, don't forward. 209 if (!AA) return Min; 210 211 // Otherwise, fall back to the next AA in the chain. But we can merge 212 // in any result we've managed to compute. 213 return ModRefBehavior(AA->getModRefBehavior(CS) & Min); 214 } 215 216 AliasAnalysis::ModRefBehavior 217 AliasAnalysis::getModRefBehavior(const Function *F) { 218 assert(AA && "AA didn't call InitializeAliasAnalysis in its run method!"); 219 return AA->getModRefBehavior(F); 220 } 221 222 //===----------------------------------------------------------------------===// 223 // AliasAnalysis non-virtual helper method implementation 224 //===----------------------------------------------------------------------===// 225 226 AliasAnalysis::Location AliasAnalysis::getLocation(const LoadInst *LI) { 227 return Location(LI->getPointerOperand(), 228 getTypeStoreSize(LI->getType()), 229 LI->getMetadata(LLVMContext::MD_tbaa)); 230 } 231 232 AliasAnalysis::Location AliasAnalysis::getLocation(const StoreInst *SI) { 233 return Location(SI->getPointerOperand(), 234 getTypeStoreSize(SI->getValueOperand()->getType()), 235 SI->getMetadata(LLVMContext::MD_tbaa)); 236 } 237 238 AliasAnalysis::Location AliasAnalysis::getLocation(const VAArgInst *VI) { 239 return Location(VI->getPointerOperand(), 240 UnknownSize, 241 VI->getMetadata(LLVMContext::MD_tbaa)); 242 } 243 244 AliasAnalysis::Location 245 AliasAnalysis::getLocation(const AtomicCmpXchgInst *CXI) { 246 return Location(CXI->getPointerOperand(), 247 getTypeStoreSize(CXI->getCompareOperand()->getType()), 248 CXI->getMetadata(LLVMContext::MD_tbaa)); 249 } 250 251 AliasAnalysis::Location 252 AliasAnalysis::getLocation(const AtomicRMWInst *RMWI) { 253 return Location(RMWI->getPointerOperand(), 254 getTypeStoreSize(RMWI->getValOperand()->getType()), 255 RMWI->getMetadata(LLVMContext::MD_tbaa)); 256 } 257 258 AliasAnalysis::Location 259 AliasAnalysis::getLocationForSource(const MemTransferInst *MTI) { 260 uint64_t Size = UnknownSize; 261 if (ConstantInt *C = dyn_cast<ConstantInt>(MTI->getLength())) 262 Size = C->getValue().getZExtValue(); 263 264 // memcpy/memmove can have TBAA tags. For memcpy, they apply 265 // to both the source and the destination. 266 MDNode *TBAATag = MTI->getMetadata(LLVMContext::MD_tbaa); 267 268 return Location(MTI->getRawSource(), Size, TBAATag); 269 } 270 271 AliasAnalysis::Location 272 AliasAnalysis::getLocationForDest(const MemIntrinsic *MTI) { 273 uint64_t Size = UnknownSize; 274 if (ConstantInt *C = dyn_cast<ConstantInt>(MTI->getLength())) 275 Size = C->getValue().getZExtValue(); 276 277 // memcpy/memmove can have TBAA tags. For memcpy, they apply 278 // to both the source and the destination. 279 MDNode *TBAATag = MTI->getMetadata(LLVMContext::MD_tbaa); 280 281 return Location(MTI->getRawDest(), Size, TBAATag); 282 } 283 284 285 286 AliasAnalysis::ModRefResult 287 AliasAnalysis::getModRefInfo(const LoadInst *L, const Location &Loc) { 288 // Be conservative in the face of volatile/atomic. 289 if (!L->isUnordered()) 290 return ModRef; 291 292 // If the load address doesn't alias the given address, it doesn't read 293 // or write the specified memory. 294 if (!alias(getLocation(L), Loc)) 295 return NoModRef; 296 297 // Otherwise, a load just reads. 298 return Ref; 299 } 300 301 AliasAnalysis::ModRefResult 302 AliasAnalysis::getModRefInfo(const StoreInst *S, const Location &Loc) { 303 // Be conservative in the face of volatile/atomic. 304 if (!S->isUnordered()) 305 return ModRef; 306 307 // If the store address cannot alias the pointer in question, then the 308 // specified memory cannot be modified by the store. 309 if (!alias(getLocation(S), Loc)) 310 return NoModRef; 311 312 // If the pointer is a pointer to constant memory, then it could not have been 313 // modified by this store. 314 if (pointsToConstantMemory(Loc)) 315 return NoModRef; 316 317 // Otherwise, a store just writes. 318 return Mod; 319 } 320 321 AliasAnalysis::ModRefResult 322 AliasAnalysis::getModRefInfo(const VAArgInst *V, const Location &Loc) { 323 // If the va_arg address cannot alias the pointer in question, then the 324 // specified memory cannot be accessed by the va_arg. 325 if (!alias(getLocation(V), Loc)) 326 return NoModRef; 327 328 // If the pointer is a pointer to constant memory, then it could not have been 329 // modified by this va_arg. 330 if (pointsToConstantMemory(Loc)) 331 return NoModRef; 332 333 // Otherwise, a va_arg reads and writes. 334 return ModRef; 335 } 336 337 AliasAnalysis::ModRefResult 338 AliasAnalysis::getModRefInfo(const AtomicCmpXchgInst *CX, const Location &Loc) { 339 // Acquire/Release cmpxchg has properties that matter for arbitrary addresses. 340 if (CX->getOrdering() > Monotonic) 341 return ModRef; 342 343 // If the cmpxchg address does not alias the location, it does not access it. 344 if (!alias(getLocation(CX), Loc)) 345 return NoModRef; 346 347 return ModRef; 348 } 349 350 AliasAnalysis::ModRefResult 351 AliasAnalysis::getModRefInfo(const AtomicRMWInst *RMW, const Location &Loc) { 352 // Acquire/Release atomicrmw has properties that matter for arbitrary addresses. 353 if (RMW->getOrdering() > Monotonic) 354 return ModRef; 355 356 // If the atomicrmw address does not alias the location, it does not access it. 357 if (!alias(getLocation(RMW), Loc)) 358 return NoModRef; 359 360 return ModRef; 361 } 362 363 namespace { 364 // Conservatively return true. Return false, if there is a single path 365 // starting from "From" and the path does not reach "To". 366 static bool hasPath(const BasicBlock *From, const BasicBlock *To) { 367 const unsigned MaxCheck = 5; 368 const BasicBlock *Current = From; 369 for (unsigned I = 0; I < MaxCheck; I++) { 370 unsigned NumSuccs = Current->getTerminator()->getNumSuccessors(); 371 if (NumSuccs > 1) 372 return true; 373 if (NumSuccs == 0) 374 return false; 375 Current = Current->getTerminator()->getSuccessor(0); 376 if (Current == To) 377 return true; 378 } 379 return true; 380 } 381 382 /// Only find pointer captures which happen before the given instruction. Uses 383 /// the dominator tree to determine whether one instruction is before another. 384 /// Only support the case where the Value is defined in the same basic block 385 /// as the given instruction and the use. 386 struct CapturesBefore : public CaptureTracker { 387 CapturesBefore(const Instruction *I, DominatorTree *DT) 388 : BeforeHere(I), DT(DT), Captured(false) {} 389 390 void tooManyUses() { Captured = true; } 391 392 bool shouldExplore(Use *U) { 393 Instruction *I = cast<Instruction>(U->getUser()); 394 BasicBlock *BB = I->getParent(); 395 // We explore this usage only if the usage can reach "BeforeHere". 396 // If use is not reachable from entry, there is no need to explore. 397 if (BeforeHere != I && !DT->isReachableFromEntry(BB)) 398 return false; 399 // If the value is defined in the same basic block as use and BeforeHere, 400 // there is no need to explore the use if BeforeHere dominates use. 401 // Check whether there is a path from I to BeforeHere. 402 if (BeforeHere != I && DT->dominates(BeforeHere, I) && 403 !hasPath(BB, BeforeHere->getParent())) 404 return false; 405 return true; 406 } 407 408 bool captured(Use *U) { 409 Instruction *I = cast<Instruction>(U->getUser()); 410 BasicBlock *BB = I->getParent(); 411 // Same logic as in shouldExplore. 412 if (BeforeHere != I && !DT->isReachableFromEntry(BB)) 413 return false; 414 if (BeforeHere != I && DT->dominates(BeforeHere, I) && 415 !hasPath(BB, BeforeHere->getParent())) 416 return false; 417 Captured = true; 418 return true; 419 } 420 421 const Instruction *BeforeHere; 422 DominatorTree *DT; 423 424 bool Captured; 425 }; 426 } 427 428 // FIXME: this is really just shoring-up a deficiency in alias analysis. 429 // BasicAA isn't willing to spend linear time determining whether an alloca 430 // was captured before or after this particular call, while we are. However, 431 // with a smarter AA in place, this test is just wasting compile time. 432 AliasAnalysis::ModRefResult 433 AliasAnalysis::callCapturesBefore(const Instruction *I, 434 const AliasAnalysis::Location &MemLoc, 435 DominatorTree *DT) { 436 if (!DT || !TD) return AliasAnalysis::ModRef; 437 438 const Value *Object = GetUnderlyingObject(MemLoc.Ptr, TD); 439 if (!isIdentifiedObject(Object) || isa<GlobalValue>(Object) || 440 isa<Constant>(Object)) 441 return AliasAnalysis::ModRef; 442 443 ImmutableCallSite CS(I); 444 if (!CS.getInstruction() || CS.getInstruction() == Object) 445 return AliasAnalysis::ModRef; 446 447 CapturesBefore CB(I, DT); 448 llvm::PointerMayBeCaptured(Object, &CB); 449 if (CB.Captured) 450 return AliasAnalysis::ModRef; 451 452 unsigned ArgNo = 0; 453 for (ImmutableCallSite::arg_iterator CI = CS.arg_begin(), CE = CS.arg_end(); 454 CI != CE; ++CI, ++ArgNo) { 455 // Only look at the no-capture or byval pointer arguments. If this 456 // pointer were passed to arguments that were neither of these, then it 457 // couldn't be no-capture. 458 if (!(*CI)->getType()->isPointerTy() || 459 (!CS.doesNotCapture(ArgNo) && !CS.isByValArgument(ArgNo))) 460 continue; 461 462 // If this is a no-capture pointer argument, see if we can tell that it 463 // is impossible to alias the pointer we're checking. If not, we have to 464 // assume that the call could touch the pointer, even though it doesn't 465 // escape. 466 if (!isNoAlias(AliasAnalysis::Location(*CI), 467 AliasAnalysis::Location(Object))) { 468 return AliasAnalysis::ModRef; 469 } 470 } 471 return AliasAnalysis::NoModRef; 472 } 473 474 // AliasAnalysis destructor: DO NOT move this to the header file for 475 // AliasAnalysis or else clients of the AliasAnalysis class may not depend on 476 // the AliasAnalysis.o file in the current .a file, causing alias analysis 477 // support to not be included in the tool correctly! 478 // 479 AliasAnalysis::~AliasAnalysis() {} 480 481 /// InitializeAliasAnalysis - Subclasses must call this method to initialize the 482 /// AliasAnalysis interface before any other methods are called. 483 /// 484 void AliasAnalysis::InitializeAliasAnalysis(Pass *P) { 485 TD = P->getAnalysisIfAvailable<DataLayout>(); 486 TLI = P->getAnalysisIfAvailable<TargetLibraryInfo>(); 487 AA = &P->getAnalysis<AliasAnalysis>(); 488 } 489 490 // getAnalysisUsage - All alias analysis implementations should invoke this 491 // directly (using AliasAnalysis::getAnalysisUsage(AU)). 492 void AliasAnalysis::getAnalysisUsage(AnalysisUsage &AU) const { 493 AU.addRequired<AliasAnalysis>(); // All AA's chain 494 } 495 496 /// getTypeStoreSize - Return the DataLayout store size for the given type, 497 /// if known, or a conservative value otherwise. 498 /// 499 uint64_t AliasAnalysis::getTypeStoreSize(Type *Ty) { 500 return TD ? TD->getTypeStoreSize(Ty) : UnknownSize; 501 } 502 503 /// canBasicBlockModify - Return true if it is possible for execution of the 504 /// specified basic block to modify the value pointed to by Ptr. 505 /// 506 bool AliasAnalysis::canBasicBlockModify(const BasicBlock &BB, 507 const Location &Loc) { 508 return canInstructionRangeModify(BB.front(), BB.back(), Loc); 509 } 510 511 /// canInstructionRangeModify - Return true if it is possible for the execution 512 /// of the specified instructions to modify the value pointed to by Ptr. The 513 /// instructions to consider are all of the instructions in the range of [I1,I2] 514 /// INCLUSIVE. I1 and I2 must be in the same basic block. 515 /// 516 bool AliasAnalysis::canInstructionRangeModify(const Instruction &I1, 517 const Instruction &I2, 518 const Location &Loc) { 519 assert(I1.getParent() == I2.getParent() && 520 "Instructions not in same basic block!"); 521 BasicBlock::const_iterator I = &I1; 522 BasicBlock::const_iterator E = &I2; 523 ++E; // Convert from inclusive to exclusive range. 524 525 for (; I != E; ++I) // Check every instruction in range 526 if (getModRefInfo(I, Loc) & Mod) 527 return true; 528 return false; 529 } 530 531 /// isNoAliasCall - Return true if this pointer is returned by a noalias 532 /// function. 533 bool llvm::isNoAliasCall(const Value *V) { 534 if (isa<CallInst>(V) || isa<InvokeInst>(V)) 535 return ImmutableCallSite(cast<Instruction>(V)) 536 .paramHasAttr(0, Attribute::NoAlias); 537 return false; 538 } 539 540 /// isIdentifiedObject - Return true if this pointer refers to a distinct and 541 /// identifiable object. This returns true for: 542 /// Global Variables and Functions (but not Global Aliases) 543 /// Allocas and Mallocs 544 /// ByVal and NoAlias Arguments 545 /// NoAlias returns 546 /// 547 bool llvm::isIdentifiedObject(const Value *V) { 548 if (isa<AllocaInst>(V)) 549 return true; 550 if (isa<GlobalValue>(V) && !isa<GlobalAlias>(V)) 551 return true; 552 if (isNoAliasCall(V)) 553 return true; 554 if (const Argument *A = dyn_cast<Argument>(V)) 555 return A->hasNoAliasAttr() || A->hasByValAttr(); 556 return false; 557 } 558