1 //===- LazyValueInfo.cpp - Value constraint analysis ------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file defines the interface for lazy computation of value constraint 11 // information. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "llvm/Analysis/LazyValueInfo.h" 16 #include "llvm/ADT/DenseSet.h" 17 #include "llvm/ADT/STLExtras.h" 18 #include "llvm/Analysis/AssumptionCache.h" 19 #include "llvm/Analysis/ConstantFolding.h" 20 #include "llvm/Analysis/InstructionSimplify.h" 21 #include "llvm/Analysis/TargetLibraryInfo.h" 22 #include "llvm/Analysis/ValueTracking.h" 23 #include "llvm/Analysis/ValueLattice.h" 24 #include "llvm/IR/AssemblyAnnotationWriter.h" 25 #include "llvm/IR/CFG.h" 26 #include "llvm/IR/ConstantRange.h" 27 #include "llvm/IR/Constants.h" 28 #include "llvm/IR/DataLayout.h" 29 #include "llvm/IR/Dominators.h" 30 #include "llvm/IR/Instructions.h" 31 #include "llvm/IR/IntrinsicInst.h" 32 #include "llvm/IR/Intrinsics.h" 33 #include "llvm/IR/LLVMContext.h" 34 #include "llvm/IR/PatternMatch.h" 35 #include "llvm/IR/ValueHandle.h" 36 #include "llvm/Support/Debug.h" 37 #include "llvm/Support/FormattedStream.h" 38 #include "llvm/Support/raw_ostream.h" 39 #include <map> 40 #include <stack> 41 using namespace llvm; 42 using namespace PatternMatch; 43 44 #define DEBUG_TYPE "lazy-value-info" 45 46 // This is the number of worklist items we will process to try to discover an 47 // answer for a given value. 48 static const unsigned MaxProcessedPerValue = 500; 49 50 char LazyValueInfoWrapperPass::ID = 0; 51 INITIALIZE_PASS_BEGIN(LazyValueInfoWrapperPass, "lazy-value-info", 52 "Lazy Value Information Analysis", false, true) 53 INITIALIZE_PASS_DEPENDENCY(AssumptionCacheTracker) 54 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass) 55 INITIALIZE_PASS_END(LazyValueInfoWrapperPass, "lazy-value-info", 56 "Lazy Value Information Analysis", false, true) 57 58 namespace llvm { 59 FunctionPass *createLazyValueInfoPass() { return new LazyValueInfoWrapperPass(); } 60 } 61 62 AnalysisKey LazyValueAnalysis::Key; 63 64 /// Returns true if this lattice value represents at most one possible value. 65 /// This is as precise as any lattice value can get while still representing 66 /// reachable code. 67 static bool hasSingleValue(const ValueLatticeElement &Val) { 68 if (Val.isConstantRange() && 69 Val.getConstantRange().isSingleElement()) 70 // Integer constants are single element ranges 71 return true; 72 if (Val.isConstant()) 73 // Non integer constants 74 return true; 75 return false; 76 } 77 78 /// Combine two sets of facts about the same value into a single set of 79 /// facts. Note that this method is not suitable for merging facts along 80 /// different paths in a CFG; that's what the mergeIn function is for. This 81 /// is for merging facts gathered about the same value at the same location 82 /// through two independent means. 83 /// Notes: 84 /// * This method does not promise to return the most precise possible lattice 85 /// value implied by A and B. It is allowed to return any lattice element 86 /// which is at least as strong as *either* A or B (unless our facts 87 /// conflict, see below). 88 /// * Due to unreachable code, the intersection of two lattice values could be 89 /// contradictory. If this happens, we return some valid lattice value so as 90 /// not confuse the rest of LVI. Ideally, we'd always return Undefined, but 91 /// we do not make this guarantee. TODO: This would be a useful enhancement. 92 static ValueLatticeElement intersect(const ValueLatticeElement &A, 93 const ValueLatticeElement &B) { 94 // Undefined is the strongest state. It means the value is known to be along 95 // an unreachable path. 96 if (A.isUndefined()) 97 return A; 98 if (B.isUndefined()) 99 return B; 100 101 // If we gave up for one, but got a useable fact from the other, use it. 102 if (A.isOverdefined()) 103 return B; 104 if (B.isOverdefined()) 105 return A; 106 107 // Can't get any more precise than constants. 108 if (hasSingleValue(A)) 109 return A; 110 if (hasSingleValue(B)) 111 return B; 112 113 // Could be either constant range or not constant here. 114 if (!A.isConstantRange() || !B.isConstantRange()) { 115 // TODO: Arbitrary choice, could be improved 116 return A; 117 } 118 119 // Intersect two constant ranges 120 ConstantRange Range = 121 A.getConstantRange().intersectWith(B.getConstantRange()); 122 // Note: An empty range is implicitly converted to overdefined internally. 123 // TODO: We could instead use Undefined here since we've proven a conflict 124 // and thus know this path must be unreachable. 125 return ValueLatticeElement::getRange(std::move(Range)); 126 } 127 128 //===----------------------------------------------------------------------===// 129 // LazyValueInfoCache Decl 130 //===----------------------------------------------------------------------===// 131 132 namespace { 133 /// A callback value handle updates the cache when values are erased. 134 class LazyValueInfoCache; 135 struct LVIValueHandle final : public CallbackVH { 136 // Needs to access getValPtr(), which is protected. 137 friend struct DenseMapInfo<LVIValueHandle>; 138 139 LazyValueInfoCache *Parent; 140 141 LVIValueHandle(Value *V, LazyValueInfoCache *P) 142 : CallbackVH(V), Parent(P) { } 143 144 void deleted() override; 145 void allUsesReplacedWith(Value *V) override { 146 deleted(); 147 } 148 }; 149 } // end anonymous namespace 150 151 namespace { 152 /// This is the cache kept by LazyValueInfo which 153 /// maintains information about queries across the clients' queries. 154 class LazyValueInfoCache { 155 /// This is all of the cached block information for exactly one Value*. 156 /// The entries are sorted by the BasicBlock* of the 157 /// entries, allowing us to do a lookup with a binary search. 158 /// Over-defined lattice values are recorded in OverDefinedCache to reduce 159 /// memory overhead. 160 struct ValueCacheEntryTy { 161 ValueCacheEntryTy(Value *V, LazyValueInfoCache *P) : Handle(V, P) {} 162 LVIValueHandle Handle; 163 SmallDenseMap<PoisoningVH<BasicBlock>, ValueLatticeElement, 4> BlockVals; 164 }; 165 166 /// This tracks, on a per-block basis, the set of values that are 167 /// over-defined at the end of that block. 168 typedef DenseMap<PoisoningVH<BasicBlock>, SmallPtrSet<Value *, 4>> 169 OverDefinedCacheTy; 170 /// Keep track of all blocks that we have ever seen, so we 171 /// don't spend time removing unused blocks from our caches. 172 DenseSet<PoisoningVH<BasicBlock> > SeenBlocks; 173 174 /// This is all of the cached information for all values, 175 /// mapped from Value* to key information. 176 DenseMap<Value *, std::unique_ptr<ValueCacheEntryTy>> ValueCache; 177 OverDefinedCacheTy OverDefinedCache; 178 179 180 public: 181 void insertResult(Value *Val, BasicBlock *BB, 182 const ValueLatticeElement &Result) { 183 SeenBlocks.insert(BB); 184 185 // Insert over-defined values into their own cache to reduce memory 186 // overhead. 187 if (Result.isOverdefined()) 188 OverDefinedCache[BB].insert(Val); 189 else { 190 auto It = ValueCache.find_as(Val); 191 if (It == ValueCache.end()) { 192 ValueCache[Val] = make_unique<ValueCacheEntryTy>(Val, this); 193 It = ValueCache.find_as(Val); 194 assert(It != ValueCache.end() && "Val was just added to the map!"); 195 } 196 It->second->BlockVals[BB] = Result; 197 } 198 } 199 200 bool isOverdefined(Value *V, BasicBlock *BB) const { 201 auto ODI = OverDefinedCache.find(BB); 202 203 if (ODI == OverDefinedCache.end()) 204 return false; 205 206 return ODI->second.count(V); 207 } 208 209 bool hasCachedValueInfo(Value *V, BasicBlock *BB) const { 210 if (isOverdefined(V, BB)) 211 return true; 212 213 auto I = ValueCache.find_as(V); 214 if (I == ValueCache.end()) 215 return false; 216 217 return I->second->BlockVals.count(BB); 218 } 219 220 ValueLatticeElement getCachedValueInfo(Value *V, BasicBlock *BB) const { 221 if (isOverdefined(V, BB)) 222 return ValueLatticeElement::getOverdefined(); 223 224 auto I = ValueCache.find_as(V); 225 if (I == ValueCache.end()) 226 return ValueLatticeElement(); 227 auto BBI = I->second->BlockVals.find(BB); 228 if (BBI == I->second->BlockVals.end()) 229 return ValueLatticeElement(); 230 return BBI->second; 231 } 232 233 /// clear - Empty the cache. 234 void clear() { 235 SeenBlocks.clear(); 236 ValueCache.clear(); 237 OverDefinedCache.clear(); 238 } 239 240 /// Inform the cache that a given value has been deleted. 241 void eraseValue(Value *V); 242 243 /// This is part of the update interface to inform the cache 244 /// that a block has been deleted. 245 void eraseBlock(BasicBlock *BB); 246 247 /// Updates the cache to remove any influence an overdefined value in 248 /// OldSucc might have (unless also overdefined in NewSucc). This just 249 /// flushes elements from the cache and does not add any. 250 void threadEdgeImpl(BasicBlock *OldSucc,BasicBlock *NewSucc); 251 252 friend struct LVIValueHandle; 253 }; 254 } 255 256 void LazyValueInfoCache::eraseValue(Value *V) { 257 for (auto I = OverDefinedCache.begin(), E = OverDefinedCache.end(); I != E;) { 258 // Copy and increment the iterator immediately so we can erase behind 259 // ourselves. 260 auto Iter = I++; 261 SmallPtrSetImpl<Value *> &ValueSet = Iter->second; 262 ValueSet.erase(V); 263 if (ValueSet.empty()) 264 OverDefinedCache.erase(Iter); 265 } 266 267 ValueCache.erase(V); 268 } 269 270 void LVIValueHandle::deleted() { 271 // This erasure deallocates *this, so it MUST happen after we're done 272 // using any and all members of *this. 273 Parent->eraseValue(*this); 274 } 275 276 void LazyValueInfoCache::eraseBlock(BasicBlock *BB) { 277 // Shortcut if we have never seen this block. 278 DenseSet<PoisoningVH<BasicBlock> >::iterator I = SeenBlocks.find(BB); 279 if (I == SeenBlocks.end()) 280 return; 281 SeenBlocks.erase(I); 282 283 auto ODI = OverDefinedCache.find(BB); 284 if (ODI != OverDefinedCache.end()) 285 OverDefinedCache.erase(ODI); 286 287 for (auto &I : ValueCache) 288 I.second->BlockVals.erase(BB); 289 } 290 291 void LazyValueInfoCache::threadEdgeImpl(BasicBlock *OldSucc, 292 BasicBlock *NewSucc) { 293 // When an edge in the graph has been threaded, values that we could not 294 // determine a value for before (i.e. were marked overdefined) may be 295 // possible to solve now. We do NOT try to proactively update these values. 296 // Instead, we clear their entries from the cache, and allow lazy updating to 297 // recompute them when needed. 298 299 // The updating process is fairly simple: we need to drop cached info 300 // for all values that were marked overdefined in OldSucc, and for those same 301 // values in any successor of OldSucc (except NewSucc) in which they were 302 // also marked overdefined. 303 std::vector<BasicBlock*> worklist; 304 worklist.push_back(OldSucc); 305 306 auto I = OverDefinedCache.find(OldSucc); 307 if (I == OverDefinedCache.end()) 308 return; // Nothing to process here. 309 SmallVector<Value *, 4> ValsToClear(I->second.begin(), I->second.end()); 310 311 // Use a worklist to perform a depth-first search of OldSucc's successors. 312 // NOTE: We do not need a visited list since any blocks we have already 313 // visited will have had their overdefined markers cleared already, and we 314 // thus won't loop to their successors. 315 while (!worklist.empty()) { 316 BasicBlock *ToUpdate = worklist.back(); 317 worklist.pop_back(); 318 319 // Skip blocks only accessible through NewSucc. 320 if (ToUpdate == NewSucc) continue; 321 322 // If a value was marked overdefined in OldSucc, and is here too... 323 auto OI = OverDefinedCache.find(ToUpdate); 324 if (OI == OverDefinedCache.end()) 325 continue; 326 SmallPtrSetImpl<Value *> &ValueSet = OI->second; 327 328 bool changed = false; 329 for (Value *V : ValsToClear) { 330 if (!ValueSet.erase(V)) 331 continue; 332 333 // If we removed anything, then we potentially need to update 334 // blocks successors too. 335 changed = true; 336 337 if (ValueSet.empty()) { 338 OverDefinedCache.erase(OI); 339 break; 340 } 341 } 342 343 if (!changed) continue; 344 345 worklist.insert(worklist.end(), succ_begin(ToUpdate), succ_end(ToUpdate)); 346 } 347 } 348 349 350 namespace { 351 /// An assembly annotator class to print LazyValueCache information in 352 /// comments. 353 class LazyValueInfoImpl; 354 class LazyValueInfoAnnotatedWriter : public AssemblyAnnotationWriter { 355 LazyValueInfoImpl *LVIImpl; 356 // While analyzing which blocks we can solve values for, we need the dominator 357 // information. Since this is an optional parameter in LVI, we require this 358 // DomTreeAnalysis pass in the printer pass, and pass the dominator 359 // tree to the LazyValueInfoAnnotatedWriter. 360 DominatorTree &DT; 361 362 public: 363 LazyValueInfoAnnotatedWriter(LazyValueInfoImpl *L, DominatorTree &DTree) 364 : LVIImpl(L), DT(DTree) {} 365 366 virtual void emitBasicBlockStartAnnot(const BasicBlock *BB, 367 formatted_raw_ostream &OS); 368 369 virtual void emitInstructionAnnot(const Instruction *I, 370 formatted_raw_ostream &OS); 371 }; 372 } 373 namespace { 374 // The actual implementation of the lazy analysis and update. Note that the 375 // inheritance from LazyValueInfoCache is intended to be temporary while 376 // splitting the code and then transitioning to a has-a relationship. 377 class LazyValueInfoImpl { 378 379 /// Cached results from previous queries 380 LazyValueInfoCache TheCache; 381 382 /// This stack holds the state of the value solver during a query. 383 /// It basically emulates the callstack of the naive 384 /// recursive value lookup process. 385 SmallVector<std::pair<BasicBlock*, Value*>, 8> BlockValueStack; 386 387 /// Keeps track of which block-value pairs are in BlockValueStack. 388 DenseSet<std::pair<BasicBlock*, Value*> > BlockValueSet; 389 390 /// Push BV onto BlockValueStack unless it's already in there. 391 /// Returns true on success. 392 bool pushBlockValue(const std::pair<BasicBlock *, Value *> &BV) { 393 if (!BlockValueSet.insert(BV).second) 394 return false; // It's already in the stack. 395 396 DEBUG(dbgs() << "PUSH: " << *BV.second << " in " << BV.first->getName() 397 << "\n"); 398 BlockValueStack.push_back(BV); 399 return true; 400 } 401 402 AssumptionCache *AC; ///< A pointer to the cache of @llvm.assume calls. 403 const DataLayout &DL; ///< A mandatory DataLayout 404 DominatorTree *DT; ///< An optional DT pointer. 405 406 ValueLatticeElement getBlockValue(Value *Val, BasicBlock *BB); 407 bool getEdgeValue(Value *V, BasicBlock *F, BasicBlock *T, 408 ValueLatticeElement &Result, Instruction *CxtI = nullptr); 409 bool hasBlockValue(Value *Val, BasicBlock *BB); 410 411 // These methods process one work item and may add more. A false value 412 // returned means that the work item was not completely processed and must 413 // be revisited after going through the new items. 414 bool solveBlockValue(Value *Val, BasicBlock *BB); 415 bool solveBlockValueImpl(ValueLatticeElement &Res, Value *Val, 416 BasicBlock *BB); 417 bool solveBlockValueNonLocal(ValueLatticeElement &BBLV, Value *Val, 418 BasicBlock *BB); 419 bool solveBlockValuePHINode(ValueLatticeElement &BBLV, PHINode *PN, 420 BasicBlock *BB); 421 bool solveBlockValueSelect(ValueLatticeElement &BBLV, SelectInst *S, 422 BasicBlock *BB); 423 bool solveBlockValueBinaryOp(ValueLatticeElement &BBLV, BinaryOperator *BBI, 424 BasicBlock *BB); 425 bool solveBlockValueCast(ValueLatticeElement &BBLV, CastInst *CI, 426 BasicBlock *BB); 427 void intersectAssumeOrGuardBlockValueConstantRange(Value *Val, 428 ValueLatticeElement &BBLV, 429 Instruction *BBI); 430 431 void solve(); 432 433 public: 434 /// This is the query interface to determine the lattice 435 /// value for the specified Value* at the end of the specified block. 436 ValueLatticeElement getValueInBlock(Value *V, BasicBlock *BB, 437 Instruction *CxtI = nullptr); 438 439 /// This is the query interface to determine the lattice 440 /// value for the specified Value* at the specified instruction (generally 441 /// from an assume intrinsic). 442 ValueLatticeElement getValueAt(Value *V, Instruction *CxtI); 443 444 /// This is the query interface to determine the lattice 445 /// value for the specified Value* that is true on the specified edge. 446 ValueLatticeElement getValueOnEdge(Value *V, BasicBlock *FromBB, 447 BasicBlock *ToBB, 448 Instruction *CxtI = nullptr); 449 450 /// Complete flush all previously computed values 451 void clear() { 452 TheCache.clear(); 453 } 454 455 /// Printing the LazyValueInfo Analysis. 456 void printLVI(Function &F, DominatorTree &DTree, raw_ostream &OS) { 457 LazyValueInfoAnnotatedWriter Writer(this, DTree); 458 F.print(OS, &Writer); 459 } 460 461 /// This is part of the update interface to inform the cache 462 /// that a block has been deleted. 463 void eraseBlock(BasicBlock *BB) { 464 TheCache.eraseBlock(BB); 465 } 466 467 /// This is the update interface to inform the cache that an edge from 468 /// PredBB to OldSucc has been threaded to be from PredBB to NewSucc. 469 void threadEdge(BasicBlock *PredBB,BasicBlock *OldSucc,BasicBlock *NewSucc); 470 471 LazyValueInfoImpl(AssumptionCache *AC, const DataLayout &DL, 472 DominatorTree *DT = nullptr) 473 : AC(AC), DL(DL), DT(DT) {} 474 }; 475 } // end anonymous namespace 476 477 478 void LazyValueInfoImpl::solve() { 479 SmallVector<std::pair<BasicBlock *, Value *>, 8> StartingStack( 480 BlockValueStack.begin(), BlockValueStack.end()); 481 482 unsigned processedCount = 0; 483 while (!BlockValueStack.empty()) { 484 processedCount++; 485 // Abort if we have to process too many values to get a result for this one. 486 // Because of the design of the overdefined cache currently being per-block 487 // to avoid naming-related issues (IE it wants to try to give different 488 // results for the same name in different blocks), overdefined results don't 489 // get cached globally, which in turn means we will often try to rediscover 490 // the same overdefined result again and again. Once something like 491 // PredicateInfo is used in LVI or CVP, we should be able to make the 492 // overdefined cache global, and remove this throttle. 493 if (processedCount > MaxProcessedPerValue) { 494 DEBUG(dbgs() << "Giving up on stack because we are getting too deep\n"); 495 // Fill in the original values 496 while (!StartingStack.empty()) { 497 std::pair<BasicBlock *, Value *> &e = StartingStack.back(); 498 TheCache.insertResult(e.second, e.first, 499 ValueLatticeElement::getOverdefined()); 500 StartingStack.pop_back(); 501 } 502 BlockValueSet.clear(); 503 BlockValueStack.clear(); 504 return; 505 } 506 std::pair<BasicBlock *, Value *> e = BlockValueStack.back(); 507 assert(BlockValueSet.count(e) && "Stack value should be in BlockValueSet!"); 508 509 if (solveBlockValue(e.second, e.first)) { 510 // The work item was completely processed. 511 assert(BlockValueStack.back() == e && "Nothing should have been pushed!"); 512 assert(TheCache.hasCachedValueInfo(e.second, e.first) && 513 "Result should be in cache!"); 514 515 DEBUG(dbgs() << "POP " << *e.second << " in " << e.first->getName() 516 << " = " << TheCache.getCachedValueInfo(e.second, e.first) << "\n"); 517 518 BlockValueStack.pop_back(); 519 BlockValueSet.erase(e); 520 } else { 521 // More work needs to be done before revisiting. 522 assert(BlockValueStack.back() != e && "Stack should have been pushed!"); 523 } 524 } 525 } 526 527 bool LazyValueInfoImpl::hasBlockValue(Value *Val, BasicBlock *BB) { 528 // If already a constant, there is nothing to compute. 529 if (isa<Constant>(Val)) 530 return true; 531 532 return TheCache.hasCachedValueInfo(Val, BB); 533 } 534 535 ValueLatticeElement LazyValueInfoImpl::getBlockValue(Value *Val, 536 BasicBlock *BB) { 537 // If already a constant, there is nothing to compute. 538 if (Constant *VC = dyn_cast<Constant>(Val)) 539 return ValueLatticeElement::get(VC); 540 541 return TheCache.getCachedValueInfo(Val, BB); 542 } 543 544 static ValueLatticeElement getFromRangeMetadata(Instruction *BBI) { 545 switch (BBI->getOpcode()) { 546 default: break; 547 case Instruction::Load: 548 case Instruction::Call: 549 case Instruction::Invoke: 550 if (MDNode *Ranges = BBI->getMetadata(LLVMContext::MD_range)) 551 if (isa<IntegerType>(BBI->getType())) { 552 return ValueLatticeElement::getRange( 553 getConstantRangeFromMetadata(*Ranges)); 554 } 555 break; 556 }; 557 // Nothing known - will be intersected with other facts 558 return ValueLatticeElement::getOverdefined(); 559 } 560 561 bool LazyValueInfoImpl::solveBlockValue(Value *Val, BasicBlock *BB) { 562 if (isa<Constant>(Val)) 563 return true; 564 565 if (TheCache.hasCachedValueInfo(Val, BB)) { 566 // If we have a cached value, use that. 567 DEBUG(dbgs() << " reuse BB '" << BB->getName() 568 << "' val=" << TheCache.getCachedValueInfo(Val, BB) << '\n'); 569 570 // Since we're reusing a cached value, we don't need to update the 571 // OverDefinedCache. The cache will have been properly updated whenever the 572 // cached value was inserted. 573 return true; 574 } 575 576 // Hold off inserting this value into the Cache in case we have to return 577 // false and come back later. 578 ValueLatticeElement Res; 579 if (!solveBlockValueImpl(Res, Val, BB)) 580 // Work pushed, will revisit 581 return false; 582 583 TheCache.insertResult(Val, BB, Res); 584 return true; 585 } 586 587 bool LazyValueInfoImpl::solveBlockValueImpl(ValueLatticeElement &Res, 588 Value *Val, BasicBlock *BB) { 589 590 Instruction *BBI = dyn_cast<Instruction>(Val); 591 if (!BBI || BBI->getParent() != BB) 592 return solveBlockValueNonLocal(Res, Val, BB); 593 594 if (PHINode *PN = dyn_cast<PHINode>(BBI)) 595 return solveBlockValuePHINode(Res, PN, BB); 596 597 if (auto *SI = dyn_cast<SelectInst>(BBI)) 598 return solveBlockValueSelect(Res, SI, BB); 599 600 // If this value is a nonnull pointer, record it's range and bailout. Note 601 // that for all other pointer typed values, we terminate the search at the 602 // definition. We could easily extend this to look through geps, bitcasts, 603 // and the like to prove non-nullness, but it's not clear that's worth it 604 // compile time wise. The context-insensitive value walk done inside 605 // isKnownNonZero gets most of the profitable cases at much less expense. 606 // This does mean that we have a sensativity to where the defining 607 // instruction is placed, even if it could legally be hoisted much higher. 608 // That is unfortunate. 609 PointerType *PT = dyn_cast<PointerType>(BBI->getType()); 610 if (PT && isKnownNonZero(BBI, DL)) { 611 Res = ValueLatticeElement::getNot(ConstantPointerNull::get(PT)); 612 return true; 613 } 614 if (BBI->getType()->isIntegerTy()) { 615 if (auto *CI = dyn_cast<CastInst>(BBI)) 616 return solveBlockValueCast(Res, CI, BB); 617 618 BinaryOperator *BO = dyn_cast<BinaryOperator>(BBI); 619 if (BO && isa<ConstantInt>(BO->getOperand(1))) 620 return solveBlockValueBinaryOp(Res, BO, BB); 621 } 622 623 DEBUG(dbgs() << " compute BB '" << BB->getName() 624 << "' - unknown inst def found.\n"); 625 Res = getFromRangeMetadata(BBI); 626 return true; 627 } 628 629 static bool InstructionDereferencesPointer(Instruction *I, Value *Ptr) { 630 if (LoadInst *L = dyn_cast<LoadInst>(I)) { 631 return L->getPointerAddressSpace() == 0 && 632 GetUnderlyingObject(L->getPointerOperand(), 633 L->getModule()->getDataLayout()) == Ptr; 634 } 635 if (StoreInst *S = dyn_cast<StoreInst>(I)) { 636 return S->getPointerAddressSpace() == 0 && 637 GetUnderlyingObject(S->getPointerOperand(), 638 S->getModule()->getDataLayout()) == Ptr; 639 } 640 if (MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) { 641 if (MI->isVolatile()) return false; 642 643 // FIXME: check whether it has a valuerange that excludes zero? 644 ConstantInt *Len = dyn_cast<ConstantInt>(MI->getLength()); 645 if (!Len || Len->isZero()) return false; 646 647 if (MI->getDestAddressSpace() == 0) 648 if (GetUnderlyingObject(MI->getRawDest(), 649 MI->getModule()->getDataLayout()) == Ptr) 650 return true; 651 if (MemTransferInst *MTI = dyn_cast<MemTransferInst>(MI)) 652 if (MTI->getSourceAddressSpace() == 0) 653 if (GetUnderlyingObject(MTI->getRawSource(), 654 MTI->getModule()->getDataLayout()) == Ptr) 655 return true; 656 } 657 return false; 658 } 659 660 /// Return true if the allocation associated with Val is ever dereferenced 661 /// within the given basic block. This establishes the fact Val is not null, 662 /// but does not imply that the memory at Val is dereferenceable. (Val may 663 /// point off the end of the dereferenceable part of the object.) 664 static bool isObjectDereferencedInBlock(Value *Val, BasicBlock *BB) { 665 assert(Val->getType()->isPointerTy()); 666 667 const DataLayout &DL = BB->getModule()->getDataLayout(); 668 Value *UnderlyingVal = GetUnderlyingObject(Val, DL); 669 // If 'GetUnderlyingObject' didn't converge, skip it. It won't converge 670 // inside InstructionDereferencesPointer either. 671 if (UnderlyingVal == GetUnderlyingObject(UnderlyingVal, DL, 1)) 672 for (Instruction &I : *BB) 673 if (InstructionDereferencesPointer(&I, UnderlyingVal)) 674 return true; 675 return false; 676 } 677 678 bool LazyValueInfoImpl::solveBlockValueNonLocal(ValueLatticeElement &BBLV, 679 Value *Val, BasicBlock *BB) { 680 ValueLatticeElement Result; // Start Undefined. 681 682 // If this is the entry block, we must be asking about an argument. The 683 // value is overdefined. 684 if (BB == &BB->getParent()->getEntryBlock()) { 685 assert(isa<Argument>(Val) && "Unknown live-in to the entry block"); 686 // Before giving up, see if we can prove the pointer non-null local to 687 // this particular block. 688 if (Val->getType()->isPointerTy() && 689 (isKnownNonZero(Val, DL) || isObjectDereferencedInBlock(Val, BB))) { 690 PointerType *PTy = cast<PointerType>(Val->getType()); 691 Result = ValueLatticeElement::getNot(ConstantPointerNull::get(PTy)); 692 } else { 693 Result = ValueLatticeElement::getOverdefined(); 694 } 695 BBLV = Result; 696 return true; 697 } 698 699 // Loop over all of our predecessors, merging what we know from them into 700 // result. If we encounter an unexplored predecessor, we eagerly explore it 701 // in a depth first manner. In practice, this has the effect of discovering 702 // paths we can't analyze eagerly without spending compile times analyzing 703 // other paths. This heuristic benefits from the fact that predecessors are 704 // frequently arranged such that dominating ones come first and we quickly 705 // find a path to function entry. TODO: We should consider explicitly 706 // canonicalizing to make this true rather than relying on this happy 707 // accident. 708 for (pred_iterator PI = pred_begin(BB), E = pred_end(BB); PI != E; ++PI) { 709 ValueLatticeElement EdgeResult; 710 if (!getEdgeValue(Val, *PI, BB, EdgeResult)) 711 // Explore that input, then return here 712 return false; 713 714 Result.mergeIn(EdgeResult, DL); 715 716 // If we hit overdefined, exit early. The BlockVals entry is already set 717 // to overdefined. 718 if (Result.isOverdefined()) { 719 DEBUG(dbgs() << " compute BB '" << BB->getName() 720 << "' - overdefined because of pred (non local).\n"); 721 // Before giving up, see if we can prove the pointer non-null local to 722 // this particular block. 723 if (Val->getType()->isPointerTy() && 724 isObjectDereferencedInBlock(Val, BB)) { 725 PointerType *PTy = cast<PointerType>(Val->getType()); 726 Result = ValueLatticeElement::getNot(ConstantPointerNull::get(PTy)); 727 } 728 729 BBLV = Result; 730 return true; 731 } 732 } 733 734 // Return the merged value, which is more precise than 'overdefined'. 735 assert(!Result.isOverdefined()); 736 BBLV = Result; 737 return true; 738 } 739 740 bool LazyValueInfoImpl::solveBlockValuePHINode(ValueLatticeElement &BBLV, 741 PHINode *PN, BasicBlock *BB) { 742 ValueLatticeElement Result; // Start Undefined. 743 744 // Loop over all of our predecessors, merging what we know from them into 745 // result. See the comment about the chosen traversal order in 746 // solveBlockValueNonLocal; the same reasoning applies here. 747 for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) { 748 BasicBlock *PhiBB = PN->getIncomingBlock(i); 749 Value *PhiVal = PN->getIncomingValue(i); 750 ValueLatticeElement EdgeResult; 751 // Note that we can provide PN as the context value to getEdgeValue, even 752 // though the results will be cached, because PN is the value being used as 753 // the cache key in the caller. 754 if (!getEdgeValue(PhiVal, PhiBB, BB, EdgeResult, PN)) 755 // Explore that input, then return here 756 return false; 757 758 Result.mergeIn(EdgeResult, DL); 759 760 // If we hit overdefined, exit early. The BlockVals entry is already set 761 // to overdefined. 762 if (Result.isOverdefined()) { 763 DEBUG(dbgs() << " compute BB '" << BB->getName() 764 << "' - overdefined because of pred (local).\n"); 765 766 BBLV = Result; 767 return true; 768 } 769 } 770 771 // Return the merged value, which is more precise than 'overdefined'. 772 assert(!Result.isOverdefined() && "Possible PHI in entry block?"); 773 BBLV = Result; 774 return true; 775 } 776 777 static ValueLatticeElement getValueFromCondition(Value *Val, Value *Cond, 778 bool isTrueDest = true); 779 780 // If we can determine a constraint on the value given conditions assumed by 781 // the program, intersect those constraints with BBLV 782 void LazyValueInfoImpl::intersectAssumeOrGuardBlockValueConstantRange( 783 Value *Val, ValueLatticeElement &BBLV, Instruction *BBI) { 784 BBI = BBI ? BBI : dyn_cast<Instruction>(Val); 785 if (!BBI) 786 return; 787 788 for (auto &AssumeVH : AC->assumptionsFor(Val)) { 789 if (!AssumeVH) 790 continue; 791 auto *I = cast<CallInst>(AssumeVH); 792 if (!isValidAssumeForContext(I, BBI, DT)) 793 continue; 794 795 BBLV = intersect(BBLV, getValueFromCondition(Val, I->getArgOperand(0))); 796 } 797 798 // If guards are not used in the module, don't spend time looking for them 799 auto *GuardDecl = BBI->getModule()->getFunction( 800 Intrinsic::getName(Intrinsic::experimental_guard)); 801 if (!GuardDecl || GuardDecl->use_empty()) 802 return; 803 804 for (Instruction &I : make_range(BBI->getIterator().getReverse(), 805 BBI->getParent()->rend())) { 806 Value *Cond = nullptr; 807 if (match(&I, m_Intrinsic<Intrinsic::experimental_guard>(m_Value(Cond)))) 808 BBLV = intersect(BBLV, getValueFromCondition(Val, Cond)); 809 } 810 } 811 812 bool LazyValueInfoImpl::solveBlockValueSelect(ValueLatticeElement &BBLV, 813 SelectInst *SI, BasicBlock *BB) { 814 815 // Recurse on our inputs if needed 816 if (!hasBlockValue(SI->getTrueValue(), BB)) { 817 if (pushBlockValue(std::make_pair(BB, SI->getTrueValue()))) 818 return false; 819 BBLV = ValueLatticeElement::getOverdefined(); 820 return true; 821 } 822 ValueLatticeElement TrueVal = getBlockValue(SI->getTrueValue(), BB); 823 // If we hit overdefined, don't ask more queries. We want to avoid poisoning 824 // extra slots in the table if we can. 825 if (TrueVal.isOverdefined()) { 826 BBLV = ValueLatticeElement::getOverdefined(); 827 return true; 828 } 829 830 if (!hasBlockValue(SI->getFalseValue(), BB)) { 831 if (pushBlockValue(std::make_pair(BB, SI->getFalseValue()))) 832 return false; 833 BBLV = ValueLatticeElement::getOverdefined(); 834 return true; 835 } 836 ValueLatticeElement FalseVal = getBlockValue(SI->getFalseValue(), BB); 837 // If we hit overdefined, don't ask more queries. We want to avoid poisoning 838 // extra slots in the table if we can. 839 if (FalseVal.isOverdefined()) { 840 BBLV = ValueLatticeElement::getOverdefined(); 841 return true; 842 } 843 844 if (TrueVal.isConstantRange() && FalseVal.isConstantRange()) { 845 const ConstantRange &TrueCR = TrueVal.getConstantRange(); 846 const ConstantRange &FalseCR = FalseVal.getConstantRange(); 847 Value *LHS = nullptr; 848 Value *RHS = nullptr; 849 SelectPatternResult SPR = matchSelectPattern(SI, LHS, RHS); 850 // Is this a min specifically of our two inputs? (Avoid the risk of 851 // ValueTracking getting smarter looking back past our immediate inputs.) 852 if (SelectPatternResult::isMinOrMax(SPR.Flavor) && 853 LHS == SI->getTrueValue() && RHS == SI->getFalseValue()) { 854 ConstantRange ResultCR = [&]() { 855 switch (SPR.Flavor) { 856 default: 857 llvm_unreachable("unexpected minmax type!"); 858 case SPF_SMIN: /// Signed minimum 859 return TrueCR.smin(FalseCR); 860 case SPF_UMIN: /// Unsigned minimum 861 return TrueCR.umin(FalseCR); 862 case SPF_SMAX: /// Signed maximum 863 return TrueCR.smax(FalseCR); 864 case SPF_UMAX: /// Unsigned maximum 865 return TrueCR.umax(FalseCR); 866 }; 867 }(); 868 BBLV = ValueLatticeElement::getRange(ResultCR); 869 return true; 870 } 871 872 // TODO: ABS, NABS from the SelectPatternResult 873 } 874 875 // Can we constrain the facts about the true and false values by using the 876 // condition itself? This shows up with idioms like e.g. select(a > 5, a, 5). 877 // TODO: We could potentially refine an overdefined true value above. 878 Value *Cond = SI->getCondition(); 879 TrueVal = intersect(TrueVal, 880 getValueFromCondition(SI->getTrueValue(), Cond, true)); 881 FalseVal = intersect(FalseVal, 882 getValueFromCondition(SI->getFalseValue(), Cond, false)); 883 884 // Handle clamp idioms such as: 885 // %24 = constantrange<0, 17> 886 // %39 = icmp eq i32 %24, 0 887 // %40 = add i32 %24, -1 888 // %siv.next = select i1 %39, i32 16, i32 %40 889 // %siv.next = constantrange<0, 17> not <-1, 17> 890 // In general, this can handle any clamp idiom which tests the edge 891 // condition via an equality or inequality. 892 if (auto *ICI = dyn_cast<ICmpInst>(Cond)) { 893 ICmpInst::Predicate Pred = ICI->getPredicate(); 894 Value *A = ICI->getOperand(0); 895 if (ConstantInt *CIBase = dyn_cast<ConstantInt>(ICI->getOperand(1))) { 896 auto addConstants = [](ConstantInt *A, ConstantInt *B) { 897 assert(A->getType() == B->getType()); 898 return ConstantInt::get(A->getType(), A->getValue() + B->getValue()); 899 }; 900 // See if either input is A + C2, subject to the constraint from the 901 // condition that A != C when that input is used. We can assume that 902 // that input doesn't include C + C2. 903 ConstantInt *CIAdded; 904 switch (Pred) { 905 default: break; 906 case ICmpInst::ICMP_EQ: 907 if (match(SI->getFalseValue(), m_Add(m_Specific(A), 908 m_ConstantInt(CIAdded)))) { 909 auto ResNot = addConstants(CIBase, CIAdded); 910 FalseVal = intersect(FalseVal, 911 ValueLatticeElement::getNot(ResNot)); 912 } 913 break; 914 case ICmpInst::ICMP_NE: 915 if (match(SI->getTrueValue(), m_Add(m_Specific(A), 916 m_ConstantInt(CIAdded)))) { 917 auto ResNot = addConstants(CIBase, CIAdded); 918 TrueVal = intersect(TrueVal, 919 ValueLatticeElement::getNot(ResNot)); 920 } 921 break; 922 }; 923 } 924 } 925 926 ValueLatticeElement Result; // Start Undefined. 927 Result.mergeIn(TrueVal, DL); 928 Result.mergeIn(FalseVal, DL); 929 BBLV = Result; 930 return true; 931 } 932 933 bool LazyValueInfoImpl::solveBlockValueCast(ValueLatticeElement &BBLV, 934 CastInst *CI, 935 BasicBlock *BB) { 936 if (!CI->getOperand(0)->getType()->isSized()) { 937 // Without knowing how wide the input is, we can't analyze it in any useful 938 // way. 939 BBLV = ValueLatticeElement::getOverdefined(); 940 return true; 941 } 942 943 // Filter out casts we don't know how to reason about before attempting to 944 // recurse on our operand. This can cut a long search short if we know we're 945 // not going to be able to get any useful information anways. 946 switch (CI->getOpcode()) { 947 case Instruction::Trunc: 948 case Instruction::SExt: 949 case Instruction::ZExt: 950 case Instruction::BitCast: 951 break; 952 default: 953 // Unhandled instructions are overdefined. 954 DEBUG(dbgs() << " compute BB '" << BB->getName() 955 << "' - overdefined (unknown cast).\n"); 956 BBLV = ValueLatticeElement::getOverdefined(); 957 return true; 958 } 959 960 // Figure out the range of the LHS. If that fails, we still apply the 961 // transfer rule on the full set since we may be able to locally infer 962 // interesting facts. 963 if (!hasBlockValue(CI->getOperand(0), BB)) 964 if (pushBlockValue(std::make_pair(BB, CI->getOperand(0)))) 965 // More work to do before applying this transfer rule. 966 return false; 967 968 const unsigned OperandBitWidth = 969 DL.getTypeSizeInBits(CI->getOperand(0)->getType()); 970 ConstantRange LHSRange = ConstantRange(OperandBitWidth); 971 if (hasBlockValue(CI->getOperand(0), BB)) { 972 ValueLatticeElement LHSVal = getBlockValue(CI->getOperand(0), BB); 973 intersectAssumeOrGuardBlockValueConstantRange(CI->getOperand(0), LHSVal, 974 CI); 975 if (LHSVal.isConstantRange()) 976 LHSRange = LHSVal.getConstantRange(); 977 } 978 979 const unsigned ResultBitWidth = CI->getType()->getIntegerBitWidth(); 980 981 // NOTE: We're currently limited by the set of operations that ConstantRange 982 // can evaluate symbolically. Enhancing that set will allows us to analyze 983 // more definitions. 984 BBLV = ValueLatticeElement::getRange(LHSRange.castOp(CI->getOpcode(), 985 ResultBitWidth)); 986 return true; 987 } 988 989 bool LazyValueInfoImpl::solveBlockValueBinaryOp(ValueLatticeElement &BBLV, 990 BinaryOperator *BO, 991 BasicBlock *BB) { 992 993 assert(BO->getOperand(0)->getType()->isSized() && 994 "all operands to binary operators are sized"); 995 996 // Filter out operators we don't know how to reason about before attempting to 997 // recurse on our operand(s). This can cut a long search short if we know 998 // we're not going to be able to get any useful information anyways. 999 switch (BO->getOpcode()) { 1000 case Instruction::Add: 1001 case Instruction::Sub: 1002 case Instruction::Mul: 1003 case Instruction::UDiv: 1004 case Instruction::Shl: 1005 case Instruction::LShr: 1006 case Instruction::And: 1007 case Instruction::Or: 1008 // continue into the code below 1009 break; 1010 default: 1011 // Unhandled instructions are overdefined. 1012 DEBUG(dbgs() << " compute BB '" << BB->getName() 1013 << "' - overdefined (unknown binary operator).\n"); 1014 BBLV = ValueLatticeElement::getOverdefined(); 1015 return true; 1016 }; 1017 1018 // Figure out the range of the LHS. If that fails, use a conservative range, 1019 // but apply the transfer rule anyways. This lets us pick up facts from 1020 // expressions like "and i32 (call i32 @foo()), 32" 1021 if (!hasBlockValue(BO->getOperand(0), BB)) 1022 if (pushBlockValue(std::make_pair(BB, BO->getOperand(0)))) 1023 // More work to do before applying this transfer rule. 1024 return false; 1025 1026 const unsigned OperandBitWidth = 1027 DL.getTypeSizeInBits(BO->getOperand(0)->getType()); 1028 ConstantRange LHSRange = ConstantRange(OperandBitWidth); 1029 if (hasBlockValue(BO->getOperand(0), BB)) { 1030 ValueLatticeElement LHSVal = getBlockValue(BO->getOperand(0), BB); 1031 intersectAssumeOrGuardBlockValueConstantRange(BO->getOperand(0), LHSVal, 1032 BO); 1033 if (LHSVal.isConstantRange()) 1034 LHSRange = LHSVal.getConstantRange(); 1035 } 1036 1037 ConstantInt *RHS = cast<ConstantInt>(BO->getOperand(1)); 1038 ConstantRange RHSRange = ConstantRange(RHS->getValue()); 1039 1040 // NOTE: We're currently limited by the set of operations that ConstantRange 1041 // can evaluate symbolically. Enhancing that set will allows us to analyze 1042 // more definitions. 1043 Instruction::BinaryOps BinOp = BO->getOpcode(); 1044 BBLV = ValueLatticeElement::getRange(LHSRange.binaryOp(BinOp, RHSRange)); 1045 return true; 1046 } 1047 1048 static ValueLatticeElement getValueFromICmpCondition(Value *Val, ICmpInst *ICI, 1049 bool isTrueDest) { 1050 Value *LHS = ICI->getOperand(0); 1051 Value *RHS = ICI->getOperand(1); 1052 CmpInst::Predicate Predicate = ICI->getPredicate(); 1053 1054 if (isa<Constant>(RHS)) { 1055 if (ICI->isEquality() && LHS == Val) { 1056 // We know that V has the RHS constant if this is a true SETEQ or 1057 // false SETNE. 1058 if (isTrueDest == (Predicate == ICmpInst::ICMP_EQ)) 1059 return ValueLatticeElement::get(cast<Constant>(RHS)); 1060 else 1061 return ValueLatticeElement::getNot(cast<Constant>(RHS)); 1062 } 1063 } 1064 1065 if (!Val->getType()->isIntegerTy()) 1066 return ValueLatticeElement::getOverdefined(); 1067 1068 // Use ConstantRange::makeAllowedICmpRegion in order to determine the possible 1069 // range of Val guaranteed by the condition. Recognize comparisons in the from 1070 // of: 1071 // icmp <pred> Val, ... 1072 // icmp <pred> (add Val, Offset), ... 1073 // The latter is the range checking idiom that InstCombine produces. Subtract 1074 // the offset from the allowed range for RHS in this case. 1075 1076 // Val or (add Val, Offset) can be on either hand of the comparison 1077 if (LHS != Val && !match(LHS, m_Add(m_Specific(Val), m_ConstantInt()))) { 1078 std::swap(LHS, RHS); 1079 Predicate = CmpInst::getSwappedPredicate(Predicate); 1080 } 1081 1082 ConstantInt *Offset = nullptr; 1083 if (LHS != Val) 1084 match(LHS, m_Add(m_Specific(Val), m_ConstantInt(Offset))); 1085 1086 if (LHS == Val || Offset) { 1087 // Calculate the range of values that are allowed by the comparison 1088 ConstantRange RHSRange(RHS->getType()->getIntegerBitWidth(), 1089 /*isFullSet=*/true); 1090 if (ConstantInt *CI = dyn_cast<ConstantInt>(RHS)) 1091 RHSRange = ConstantRange(CI->getValue()); 1092 else if (Instruction *I = dyn_cast<Instruction>(RHS)) 1093 if (auto *Ranges = I->getMetadata(LLVMContext::MD_range)) 1094 RHSRange = getConstantRangeFromMetadata(*Ranges); 1095 1096 // If we're interested in the false dest, invert the condition 1097 CmpInst::Predicate Pred = 1098 isTrueDest ? Predicate : CmpInst::getInversePredicate(Predicate); 1099 ConstantRange TrueValues = 1100 ConstantRange::makeAllowedICmpRegion(Pred, RHSRange); 1101 1102 if (Offset) // Apply the offset from above. 1103 TrueValues = TrueValues.subtract(Offset->getValue()); 1104 1105 return ValueLatticeElement::getRange(std::move(TrueValues)); 1106 } 1107 1108 return ValueLatticeElement::getOverdefined(); 1109 } 1110 1111 static ValueLatticeElement 1112 getValueFromCondition(Value *Val, Value *Cond, bool isTrueDest, 1113 DenseMap<Value*, ValueLatticeElement> &Visited); 1114 1115 static ValueLatticeElement 1116 getValueFromConditionImpl(Value *Val, Value *Cond, bool isTrueDest, 1117 DenseMap<Value*, ValueLatticeElement> &Visited) { 1118 if (ICmpInst *ICI = dyn_cast<ICmpInst>(Cond)) 1119 return getValueFromICmpCondition(Val, ICI, isTrueDest); 1120 1121 // Handle conditions in the form of (cond1 && cond2), we know that on the 1122 // true dest path both of the conditions hold. Similarly for conditions of 1123 // the form (cond1 || cond2), we know that on the false dest path neither 1124 // condition holds. 1125 BinaryOperator *BO = dyn_cast<BinaryOperator>(Cond); 1126 if (!BO || (isTrueDest && BO->getOpcode() != BinaryOperator::And) || 1127 (!isTrueDest && BO->getOpcode() != BinaryOperator::Or)) 1128 return ValueLatticeElement::getOverdefined(); 1129 1130 auto RHS = getValueFromCondition(Val, BO->getOperand(0), isTrueDest, Visited); 1131 auto LHS = getValueFromCondition(Val, BO->getOperand(1), isTrueDest, Visited); 1132 return intersect(RHS, LHS); 1133 } 1134 1135 static ValueLatticeElement 1136 getValueFromCondition(Value *Val, Value *Cond, bool isTrueDest, 1137 DenseMap<Value*, ValueLatticeElement> &Visited) { 1138 auto I = Visited.find(Cond); 1139 if (I != Visited.end()) 1140 return I->second; 1141 1142 auto Result = getValueFromConditionImpl(Val, Cond, isTrueDest, Visited); 1143 Visited[Cond] = Result; 1144 return Result; 1145 } 1146 1147 ValueLatticeElement getValueFromCondition(Value *Val, Value *Cond, 1148 bool isTrueDest) { 1149 assert(Cond && "precondition"); 1150 DenseMap<Value*, ValueLatticeElement> Visited; 1151 return getValueFromCondition(Val, Cond, isTrueDest, Visited); 1152 } 1153 1154 // Return true if Usr has Op as an operand, otherwise false. 1155 static bool usesOperand(User *Usr, Value *Op) { 1156 return find(Usr->operands(), Op) != Usr->op_end(); 1157 } 1158 1159 // Return true if the instruction type of Val is supported by 1160 // constantFoldUser(). Currently CastInst and BinaryOperator only. Call this 1161 // before calling constantFoldUser() to find out if it's even worth attempting 1162 // to call it. 1163 static bool isOperationFoldable(User *Usr) { 1164 return isa<CastInst>(Usr) || isa<BinaryOperator>(Usr); 1165 } 1166 1167 // Check if Usr can be simplified to an integer constant when the value of one 1168 // of its operands Op is an integer constant OpConstVal. If so, return it as an 1169 // lattice value range with a single element or otherwise return an overdefined 1170 // lattice value. 1171 static ValueLatticeElement constantFoldUser(User *Usr, Value *Op, 1172 const APInt &OpConstVal, 1173 const DataLayout &DL) { 1174 assert(isOperationFoldable(Usr) && "Precondition"); 1175 Constant* OpConst = Constant::getIntegerValue(Op->getType(), OpConstVal); 1176 // Check if Usr can be simplified to a constant. 1177 if (auto *CI = dyn_cast<CastInst>(Usr)) { 1178 assert(CI->getOperand(0) == Op && "Operand 0 isn't Op"); 1179 if (auto *C = dyn_cast_or_null<ConstantInt>( 1180 SimplifyCastInst(CI->getOpcode(), OpConst, 1181 CI->getDestTy(), DL))) { 1182 return ValueLatticeElement::getRange(ConstantRange(C->getValue())); 1183 } 1184 } else if (auto *BO = dyn_cast<BinaryOperator>(Usr)) { 1185 bool Op0Match = BO->getOperand(0) == Op; 1186 bool Op1Match = BO->getOperand(1) == Op; 1187 assert((Op0Match || Op1Match) && 1188 "Operand 0 nor Operand 1 isn't a match"); 1189 Value *LHS = Op0Match ? OpConst : BO->getOperand(0); 1190 Value *RHS = Op1Match ? OpConst : BO->getOperand(1); 1191 if (auto *C = dyn_cast_or_null<ConstantInt>( 1192 SimplifyBinOp(BO->getOpcode(), LHS, RHS, DL))) { 1193 return ValueLatticeElement::getRange(ConstantRange(C->getValue())); 1194 } 1195 } 1196 return ValueLatticeElement::getOverdefined(); 1197 } 1198 1199 /// \brief Compute the value of Val on the edge BBFrom -> BBTo. Returns false if 1200 /// Val is not constrained on the edge. Result is unspecified if return value 1201 /// is false. 1202 static bool getEdgeValueLocal(Value *Val, BasicBlock *BBFrom, 1203 BasicBlock *BBTo, ValueLatticeElement &Result) { 1204 // TODO: Handle more complex conditionals. If (v == 0 || v2 < 1) is false, we 1205 // know that v != 0. 1206 if (BranchInst *BI = dyn_cast<BranchInst>(BBFrom->getTerminator())) { 1207 // If this is a conditional branch and only one successor goes to BBTo, then 1208 // we may be able to infer something from the condition. 1209 if (BI->isConditional() && 1210 BI->getSuccessor(0) != BI->getSuccessor(1)) { 1211 bool isTrueDest = BI->getSuccessor(0) == BBTo; 1212 assert(BI->getSuccessor(!isTrueDest) == BBTo && 1213 "BBTo isn't a successor of BBFrom"); 1214 Value *Condition = BI->getCondition(); 1215 1216 // If V is the condition of the branch itself, then we know exactly what 1217 // it is. 1218 if (Condition == Val) { 1219 Result = ValueLatticeElement::get(ConstantInt::get( 1220 Type::getInt1Ty(Val->getContext()), isTrueDest)); 1221 return true; 1222 } 1223 1224 // If the condition of the branch is an equality comparison, we may be 1225 // able to infer the value. 1226 Result = getValueFromCondition(Val, Condition, isTrueDest); 1227 if (!Result.isOverdefined()) 1228 return true; 1229 1230 if (User *Usr = dyn_cast<User>(Val)) { 1231 assert(Result.isOverdefined() && "Result isn't overdefined"); 1232 // Check with isOperationFoldable() first to avoid linearly iterating 1233 // over the operands unnecessarily which can be expensive for 1234 // instructions with many operands. 1235 if (isa<IntegerType>(Usr->getType()) && isOperationFoldable(Usr)) { 1236 const DataLayout &DL = BBTo->getModule()->getDataLayout(); 1237 if (usesOperand(Usr, Condition)) { 1238 // If Val has Condition as an operand and Val can be folded into a 1239 // constant with either Condition == true or Condition == false, 1240 // propagate the constant. 1241 // eg. 1242 // ; %Val is true on the edge to %then. 1243 // %Val = and i1 %Condition, true. 1244 // br %Condition, label %then, label %else 1245 APInt ConditionVal(1, isTrueDest ? 1 : 0); 1246 Result = constantFoldUser(Usr, Condition, ConditionVal, DL); 1247 } else { 1248 // If one of Val's operand has an inferred value, we may be able to 1249 // infer the value of Val. 1250 // eg. 1251 // ; %Val is 94 on the edge to %then. 1252 // %Val = add i8 %Op, 1 1253 // %Condition = icmp eq i8 %Op, 93 1254 // br i1 %Condition, label %then, label %else 1255 for (unsigned i = 0; i < Usr->getNumOperands(); ++i) { 1256 Value *Op = Usr->getOperand(i); 1257 ValueLatticeElement OpLatticeVal = 1258 getValueFromCondition(Op, Condition, isTrueDest); 1259 if (Optional<APInt> OpConst = OpLatticeVal.asConstantInteger()) { 1260 Result = constantFoldUser(Usr, Op, OpConst.getValue(), DL); 1261 break; 1262 } 1263 } 1264 } 1265 } 1266 } 1267 if (!Result.isOverdefined()) 1268 return true; 1269 } 1270 } 1271 1272 // If the edge was formed by a switch on the value, then we may know exactly 1273 // what it is. 1274 if (SwitchInst *SI = dyn_cast<SwitchInst>(BBFrom->getTerminator())) { 1275 Value *Condition = SI->getCondition(); 1276 if (!isa<IntegerType>(Val->getType())) 1277 return false; 1278 bool ValUsesConditionAndMayBeFoldable = false; 1279 if (Condition != Val) { 1280 // Check if Val has Condition as an operand. 1281 if (User *Usr = dyn_cast<User>(Val)) 1282 ValUsesConditionAndMayBeFoldable = isOperationFoldable(Usr) && 1283 usesOperand(Usr, Condition); 1284 if (!ValUsesConditionAndMayBeFoldable) 1285 return false; 1286 } 1287 assert((Condition == Val || ValUsesConditionAndMayBeFoldable) && 1288 "Condition != Val nor Val doesn't use Condition"); 1289 1290 bool DefaultCase = SI->getDefaultDest() == BBTo; 1291 unsigned BitWidth = Val->getType()->getIntegerBitWidth(); 1292 ConstantRange EdgesVals(BitWidth, DefaultCase/*isFullSet*/); 1293 1294 for (auto Case : SI->cases()) { 1295 APInt CaseValue = Case.getCaseValue()->getValue(); 1296 ConstantRange EdgeVal(CaseValue); 1297 if (ValUsesConditionAndMayBeFoldable) { 1298 User *Usr = cast<User>(Val); 1299 const DataLayout &DL = BBTo->getModule()->getDataLayout(); 1300 ValueLatticeElement EdgeLatticeVal = 1301 constantFoldUser(Usr, Condition, CaseValue, DL); 1302 if (EdgeLatticeVal.isOverdefined()) 1303 return false; 1304 EdgeVal = EdgeLatticeVal.getConstantRange(); 1305 } 1306 if (DefaultCase) { 1307 // It is possible that the default destination is the destination of 1308 // some cases. We cannot perform difference for those cases. 1309 // We know Condition != CaseValue in BBTo. In some cases we can use 1310 // this to infer Val == f(Condition) is != f(CaseValue). For now, we 1311 // only do this when f is identity (i.e. Val == Condition), but we 1312 // should be able to do this for any injective f. 1313 if (Case.getCaseSuccessor() != BBTo && Condition == Val) 1314 EdgesVals = EdgesVals.difference(EdgeVal); 1315 } else if (Case.getCaseSuccessor() == BBTo) 1316 EdgesVals = EdgesVals.unionWith(EdgeVal); 1317 } 1318 Result = ValueLatticeElement::getRange(std::move(EdgesVals)); 1319 return true; 1320 } 1321 return false; 1322 } 1323 1324 /// \brief Compute the value of Val on the edge BBFrom -> BBTo or the value at 1325 /// the basic block if the edge does not constrain Val. 1326 bool LazyValueInfoImpl::getEdgeValue(Value *Val, BasicBlock *BBFrom, 1327 BasicBlock *BBTo, 1328 ValueLatticeElement &Result, 1329 Instruction *CxtI) { 1330 // If already a constant, there is nothing to compute. 1331 if (Constant *VC = dyn_cast<Constant>(Val)) { 1332 Result = ValueLatticeElement::get(VC); 1333 return true; 1334 } 1335 1336 ValueLatticeElement LocalResult; 1337 if (!getEdgeValueLocal(Val, BBFrom, BBTo, LocalResult)) 1338 // If we couldn't constrain the value on the edge, LocalResult doesn't 1339 // provide any information. 1340 LocalResult = ValueLatticeElement::getOverdefined(); 1341 1342 if (hasSingleValue(LocalResult)) { 1343 // Can't get any more precise here 1344 Result = LocalResult; 1345 return true; 1346 } 1347 1348 if (!hasBlockValue(Val, BBFrom)) { 1349 if (pushBlockValue(std::make_pair(BBFrom, Val))) 1350 return false; 1351 // No new information. 1352 Result = LocalResult; 1353 return true; 1354 } 1355 1356 // Try to intersect ranges of the BB and the constraint on the edge. 1357 ValueLatticeElement InBlock = getBlockValue(Val, BBFrom); 1358 intersectAssumeOrGuardBlockValueConstantRange(Val, InBlock, 1359 BBFrom->getTerminator()); 1360 // We can use the context instruction (generically the ultimate instruction 1361 // the calling pass is trying to simplify) here, even though the result of 1362 // this function is generally cached when called from the solve* functions 1363 // (and that cached result might be used with queries using a different 1364 // context instruction), because when this function is called from the solve* 1365 // functions, the context instruction is not provided. When called from 1366 // LazyValueInfoImpl::getValueOnEdge, the context instruction is provided, 1367 // but then the result is not cached. 1368 intersectAssumeOrGuardBlockValueConstantRange(Val, InBlock, CxtI); 1369 1370 Result = intersect(LocalResult, InBlock); 1371 return true; 1372 } 1373 1374 ValueLatticeElement LazyValueInfoImpl::getValueInBlock(Value *V, BasicBlock *BB, 1375 Instruction *CxtI) { 1376 DEBUG(dbgs() << "LVI Getting block end value " << *V << " at '" 1377 << BB->getName() << "'\n"); 1378 1379 assert(BlockValueStack.empty() && BlockValueSet.empty()); 1380 if (!hasBlockValue(V, BB)) { 1381 pushBlockValue(std::make_pair(BB, V)); 1382 solve(); 1383 } 1384 ValueLatticeElement Result = getBlockValue(V, BB); 1385 intersectAssumeOrGuardBlockValueConstantRange(V, Result, CxtI); 1386 1387 DEBUG(dbgs() << " Result = " << Result << "\n"); 1388 return Result; 1389 } 1390 1391 ValueLatticeElement LazyValueInfoImpl::getValueAt(Value *V, Instruction *CxtI) { 1392 DEBUG(dbgs() << "LVI Getting value " << *V << " at '" 1393 << CxtI->getName() << "'\n"); 1394 1395 if (auto *C = dyn_cast<Constant>(V)) 1396 return ValueLatticeElement::get(C); 1397 1398 ValueLatticeElement Result = ValueLatticeElement::getOverdefined(); 1399 if (auto *I = dyn_cast<Instruction>(V)) 1400 Result = getFromRangeMetadata(I); 1401 intersectAssumeOrGuardBlockValueConstantRange(V, Result, CxtI); 1402 1403 DEBUG(dbgs() << " Result = " << Result << "\n"); 1404 return Result; 1405 } 1406 1407 ValueLatticeElement LazyValueInfoImpl:: 1408 getValueOnEdge(Value *V, BasicBlock *FromBB, BasicBlock *ToBB, 1409 Instruction *CxtI) { 1410 DEBUG(dbgs() << "LVI Getting edge value " << *V << " from '" 1411 << FromBB->getName() << "' to '" << ToBB->getName() << "'\n"); 1412 1413 ValueLatticeElement Result; 1414 if (!getEdgeValue(V, FromBB, ToBB, Result, CxtI)) { 1415 solve(); 1416 bool WasFastQuery = getEdgeValue(V, FromBB, ToBB, Result, CxtI); 1417 (void)WasFastQuery; 1418 assert(WasFastQuery && "More work to do after problem solved?"); 1419 } 1420 1421 DEBUG(dbgs() << " Result = " << Result << "\n"); 1422 return Result; 1423 } 1424 1425 void LazyValueInfoImpl::threadEdge(BasicBlock *PredBB, BasicBlock *OldSucc, 1426 BasicBlock *NewSucc) { 1427 TheCache.threadEdgeImpl(OldSucc, NewSucc); 1428 } 1429 1430 //===----------------------------------------------------------------------===// 1431 // LazyValueInfo Impl 1432 //===----------------------------------------------------------------------===// 1433 1434 /// This lazily constructs the LazyValueInfoImpl. 1435 static LazyValueInfoImpl &getImpl(void *&PImpl, AssumptionCache *AC, 1436 const DataLayout *DL, 1437 DominatorTree *DT = nullptr) { 1438 if (!PImpl) { 1439 assert(DL && "getCache() called with a null DataLayout"); 1440 PImpl = new LazyValueInfoImpl(AC, *DL, DT); 1441 } 1442 return *static_cast<LazyValueInfoImpl*>(PImpl); 1443 } 1444 1445 bool LazyValueInfoWrapperPass::runOnFunction(Function &F) { 1446 Info.AC = &getAnalysis<AssumptionCacheTracker>().getAssumptionCache(F); 1447 const DataLayout &DL = F.getParent()->getDataLayout(); 1448 1449 DominatorTreeWrapperPass *DTWP = 1450 getAnalysisIfAvailable<DominatorTreeWrapperPass>(); 1451 Info.DT = DTWP ? &DTWP->getDomTree() : nullptr; 1452 Info.TLI = &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(); 1453 1454 if (Info.PImpl) 1455 getImpl(Info.PImpl, Info.AC, &DL, Info.DT).clear(); 1456 1457 // Fully lazy. 1458 return false; 1459 } 1460 1461 void LazyValueInfoWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const { 1462 AU.setPreservesAll(); 1463 AU.addRequired<AssumptionCacheTracker>(); 1464 AU.addRequired<TargetLibraryInfoWrapperPass>(); 1465 } 1466 1467 LazyValueInfo &LazyValueInfoWrapperPass::getLVI() { return Info; } 1468 1469 LazyValueInfo::~LazyValueInfo() { releaseMemory(); } 1470 1471 void LazyValueInfo::releaseMemory() { 1472 // If the cache was allocated, free it. 1473 if (PImpl) { 1474 delete &getImpl(PImpl, AC, nullptr); 1475 PImpl = nullptr; 1476 } 1477 } 1478 1479 bool LazyValueInfo::invalidate(Function &F, const PreservedAnalyses &PA, 1480 FunctionAnalysisManager::Invalidator &Inv) { 1481 // We need to invalidate if we have either failed to preserve this analyses 1482 // result directly or if any of its dependencies have been invalidated. 1483 auto PAC = PA.getChecker<LazyValueAnalysis>(); 1484 if (!(PAC.preserved() || PAC.preservedSet<AllAnalysesOn<Function>>()) || 1485 (DT && Inv.invalidate<DominatorTreeAnalysis>(F, PA))) 1486 return true; 1487 1488 return false; 1489 } 1490 1491 void LazyValueInfoWrapperPass::releaseMemory() { Info.releaseMemory(); } 1492 1493 LazyValueInfo LazyValueAnalysis::run(Function &F, 1494 FunctionAnalysisManager &FAM) { 1495 auto &AC = FAM.getResult<AssumptionAnalysis>(F); 1496 auto &TLI = FAM.getResult<TargetLibraryAnalysis>(F); 1497 auto *DT = FAM.getCachedResult<DominatorTreeAnalysis>(F); 1498 1499 return LazyValueInfo(&AC, &F.getParent()->getDataLayout(), &TLI, DT); 1500 } 1501 1502 /// Returns true if we can statically tell that this value will never be a 1503 /// "useful" constant. In practice, this means we've got something like an 1504 /// alloca or a malloc call for which a comparison against a constant can 1505 /// only be guarding dead code. Note that we are potentially giving up some 1506 /// precision in dead code (a constant result) in favour of avoiding a 1507 /// expensive search for a easily answered common query. 1508 static bool isKnownNonConstant(Value *V) { 1509 V = V->stripPointerCasts(); 1510 // The return val of alloc cannot be a Constant. 1511 if (isa<AllocaInst>(V)) 1512 return true; 1513 return false; 1514 } 1515 1516 Constant *LazyValueInfo::getConstant(Value *V, BasicBlock *BB, 1517 Instruction *CxtI) { 1518 // Bail out early if V is known not to be a Constant. 1519 if (isKnownNonConstant(V)) 1520 return nullptr; 1521 1522 const DataLayout &DL = BB->getModule()->getDataLayout(); 1523 ValueLatticeElement Result = 1524 getImpl(PImpl, AC, &DL, DT).getValueInBlock(V, BB, CxtI); 1525 1526 if (Result.isConstant()) 1527 return Result.getConstant(); 1528 if (Result.isConstantRange()) { 1529 const ConstantRange &CR = Result.getConstantRange(); 1530 if (const APInt *SingleVal = CR.getSingleElement()) 1531 return ConstantInt::get(V->getContext(), *SingleVal); 1532 } 1533 return nullptr; 1534 } 1535 1536 ConstantRange LazyValueInfo::getConstantRange(Value *V, BasicBlock *BB, 1537 Instruction *CxtI) { 1538 assert(V->getType()->isIntegerTy()); 1539 unsigned Width = V->getType()->getIntegerBitWidth(); 1540 const DataLayout &DL = BB->getModule()->getDataLayout(); 1541 ValueLatticeElement Result = 1542 getImpl(PImpl, AC, &DL, DT).getValueInBlock(V, BB, CxtI); 1543 if (Result.isUndefined()) 1544 return ConstantRange(Width, /*isFullSet=*/false); 1545 if (Result.isConstantRange()) 1546 return Result.getConstantRange(); 1547 // We represent ConstantInt constants as constant ranges but other kinds 1548 // of integer constants, i.e. ConstantExpr will be tagged as constants 1549 assert(!(Result.isConstant() && isa<ConstantInt>(Result.getConstant())) && 1550 "ConstantInt value must be represented as constantrange"); 1551 return ConstantRange(Width, /*isFullSet=*/true); 1552 } 1553 1554 /// Determine whether the specified value is known to be a 1555 /// constant on the specified edge. Return null if not. 1556 Constant *LazyValueInfo::getConstantOnEdge(Value *V, BasicBlock *FromBB, 1557 BasicBlock *ToBB, 1558 Instruction *CxtI) { 1559 const DataLayout &DL = FromBB->getModule()->getDataLayout(); 1560 ValueLatticeElement Result = 1561 getImpl(PImpl, AC, &DL, DT).getValueOnEdge(V, FromBB, ToBB, CxtI); 1562 1563 if (Result.isConstant()) 1564 return Result.getConstant(); 1565 if (Result.isConstantRange()) { 1566 const ConstantRange &CR = Result.getConstantRange(); 1567 if (const APInt *SingleVal = CR.getSingleElement()) 1568 return ConstantInt::get(V->getContext(), *SingleVal); 1569 } 1570 return nullptr; 1571 } 1572 1573 ConstantRange LazyValueInfo::getConstantRangeOnEdge(Value *V, 1574 BasicBlock *FromBB, 1575 BasicBlock *ToBB, 1576 Instruction *CxtI) { 1577 unsigned Width = V->getType()->getIntegerBitWidth(); 1578 const DataLayout &DL = FromBB->getModule()->getDataLayout(); 1579 ValueLatticeElement Result = 1580 getImpl(PImpl, AC, &DL, DT).getValueOnEdge(V, FromBB, ToBB, CxtI); 1581 1582 if (Result.isUndefined()) 1583 return ConstantRange(Width, /*isFullSet=*/false); 1584 if (Result.isConstantRange()) 1585 return Result.getConstantRange(); 1586 // We represent ConstantInt constants as constant ranges but other kinds 1587 // of integer constants, i.e. ConstantExpr will be tagged as constants 1588 assert(!(Result.isConstant() && isa<ConstantInt>(Result.getConstant())) && 1589 "ConstantInt value must be represented as constantrange"); 1590 return ConstantRange(Width, /*isFullSet=*/true); 1591 } 1592 1593 static LazyValueInfo::Tristate 1594 getPredicateResult(unsigned Pred, Constant *C, const ValueLatticeElement &Val, 1595 const DataLayout &DL, TargetLibraryInfo *TLI) { 1596 // If we know the value is a constant, evaluate the conditional. 1597 Constant *Res = nullptr; 1598 if (Val.isConstant()) { 1599 Res = ConstantFoldCompareInstOperands(Pred, Val.getConstant(), C, DL, TLI); 1600 if (ConstantInt *ResCI = dyn_cast<ConstantInt>(Res)) 1601 return ResCI->isZero() ? LazyValueInfo::False : LazyValueInfo::True; 1602 return LazyValueInfo::Unknown; 1603 } 1604 1605 if (Val.isConstantRange()) { 1606 ConstantInt *CI = dyn_cast<ConstantInt>(C); 1607 if (!CI) return LazyValueInfo::Unknown; 1608 1609 const ConstantRange &CR = Val.getConstantRange(); 1610 if (Pred == ICmpInst::ICMP_EQ) { 1611 if (!CR.contains(CI->getValue())) 1612 return LazyValueInfo::False; 1613 1614 if (CR.isSingleElement()) 1615 return LazyValueInfo::True; 1616 } else if (Pred == ICmpInst::ICMP_NE) { 1617 if (!CR.contains(CI->getValue())) 1618 return LazyValueInfo::True; 1619 1620 if (CR.isSingleElement()) 1621 return LazyValueInfo::False; 1622 } else { 1623 // Handle more complex predicates. 1624 ConstantRange TrueValues = ConstantRange::makeExactICmpRegion( 1625 (ICmpInst::Predicate)Pred, CI->getValue()); 1626 if (TrueValues.contains(CR)) 1627 return LazyValueInfo::True; 1628 if (TrueValues.inverse().contains(CR)) 1629 return LazyValueInfo::False; 1630 } 1631 return LazyValueInfo::Unknown; 1632 } 1633 1634 if (Val.isNotConstant()) { 1635 // If this is an equality comparison, we can try to fold it knowing that 1636 // "V != C1". 1637 if (Pred == ICmpInst::ICMP_EQ) { 1638 // !C1 == C -> false iff C1 == C. 1639 Res = ConstantFoldCompareInstOperands(ICmpInst::ICMP_NE, 1640 Val.getNotConstant(), C, DL, 1641 TLI); 1642 if (Res->isNullValue()) 1643 return LazyValueInfo::False; 1644 } else if (Pred == ICmpInst::ICMP_NE) { 1645 // !C1 != C -> true iff C1 == C. 1646 Res = ConstantFoldCompareInstOperands(ICmpInst::ICMP_NE, 1647 Val.getNotConstant(), C, DL, 1648 TLI); 1649 if (Res->isNullValue()) 1650 return LazyValueInfo::True; 1651 } 1652 return LazyValueInfo::Unknown; 1653 } 1654 1655 return LazyValueInfo::Unknown; 1656 } 1657 1658 /// Determine whether the specified value comparison with a constant is known to 1659 /// be true or false on the specified CFG edge. Pred is a CmpInst predicate. 1660 LazyValueInfo::Tristate 1661 LazyValueInfo::getPredicateOnEdge(unsigned Pred, Value *V, Constant *C, 1662 BasicBlock *FromBB, BasicBlock *ToBB, 1663 Instruction *CxtI) { 1664 const DataLayout &DL = FromBB->getModule()->getDataLayout(); 1665 ValueLatticeElement Result = 1666 getImpl(PImpl, AC, &DL, DT).getValueOnEdge(V, FromBB, ToBB, CxtI); 1667 1668 return getPredicateResult(Pred, C, Result, DL, TLI); 1669 } 1670 1671 LazyValueInfo::Tristate 1672 LazyValueInfo::getPredicateAt(unsigned Pred, Value *V, Constant *C, 1673 Instruction *CxtI) { 1674 // Is or is not NonNull are common predicates being queried. If 1675 // isKnownNonZero can tell us the result of the predicate, we can 1676 // return it quickly. But this is only a fastpath, and falling 1677 // through would still be correct. 1678 const DataLayout &DL = CxtI->getModule()->getDataLayout(); 1679 if (V->getType()->isPointerTy() && C->isNullValue() && 1680 isKnownNonZero(V->stripPointerCasts(), DL)) { 1681 if (Pred == ICmpInst::ICMP_EQ) 1682 return LazyValueInfo::False; 1683 else if (Pred == ICmpInst::ICMP_NE) 1684 return LazyValueInfo::True; 1685 } 1686 ValueLatticeElement Result = getImpl(PImpl, AC, &DL, DT).getValueAt(V, CxtI); 1687 Tristate Ret = getPredicateResult(Pred, C, Result, DL, TLI); 1688 if (Ret != Unknown) 1689 return Ret; 1690 1691 // Note: The following bit of code is somewhat distinct from the rest of LVI; 1692 // LVI as a whole tries to compute a lattice value which is conservatively 1693 // correct at a given location. In this case, we have a predicate which we 1694 // weren't able to prove about the merged result, and we're pushing that 1695 // predicate back along each incoming edge to see if we can prove it 1696 // separately for each input. As a motivating example, consider: 1697 // bb1: 1698 // %v1 = ... ; constantrange<1, 5> 1699 // br label %merge 1700 // bb2: 1701 // %v2 = ... ; constantrange<10, 20> 1702 // br label %merge 1703 // merge: 1704 // %phi = phi [%v1, %v2] ; constantrange<1,20> 1705 // %pred = icmp eq i32 %phi, 8 1706 // We can't tell from the lattice value for '%phi' that '%pred' is false 1707 // along each path, but by checking the predicate over each input separately, 1708 // we can. 1709 // We limit the search to one step backwards from the current BB and value. 1710 // We could consider extending this to search further backwards through the 1711 // CFG and/or value graph, but there are non-obvious compile time vs quality 1712 // tradeoffs. 1713 if (CxtI) { 1714 BasicBlock *BB = CxtI->getParent(); 1715 1716 // Function entry or an unreachable block. Bail to avoid confusing 1717 // analysis below. 1718 pred_iterator PI = pred_begin(BB), PE = pred_end(BB); 1719 if (PI == PE) 1720 return Unknown; 1721 1722 // If V is a PHI node in the same block as the context, we need to ask 1723 // questions about the predicate as applied to the incoming value along 1724 // each edge. This is useful for eliminating cases where the predicate is 1725 // known along all incoming edges. 1726 if (auto *PHI = dyn_cast<PHINode>(V)) 1727 if (PHI->getParent() == BB) { 1728 Tristate Baseline = Unknown; 1729 for (unsigned i = 0, e = PHI->getNumIncomingValues(); i < e; i++) { 1730 Value *Incoming = PHI->getIncomingValue(i); 1731 BasicBlock *PredBB = PHI->getIncomingBlock(i); 1732 // Note that PredBB may be BB itself. 1733 Tristate Result = getPredicateOnEdge(Pred, Incoming, C, PredBB, BB, 1734 CxtI); 1735 1736 // Keep going as long as we've seen a consistent known result for 1737 // all inputs. 1738 Baseline = (i == 0) ? Result /* First iteration */ 1739 : (Baseline == Result ? Baseline : Unknown); /* All others */ 1740 if (Baseline == Unknown) 1741 break; 1742 } 1743 if (Baseline != Unknown) 1744 return Baseline; 1745 } 1746 1747 // For a comparison where the V is outside this block, it's possible 1748 // that we've branched on it before. Look to see if the value is known 1749 // on all incoming edges. 1750 if (!isa<Instruction>(V) || 1751 cast<Instruction>(V)->getParent() != BB) { 1752 // For predecessor edge, determine if the comparison is true or false 1753 // on that edge. If they're all true or all false, we can conclude 1754 // the value of the comparison in this block. 1755 Tristate Baseline = getPredicateOnEdge(Pred, V, C, *PI, BB, CxtI); 1756 if (Baseline != Unknown) { 1757 // Check that all remaining incoming values match the first one. 1758 while (++PI != PE) { 1759 Tristate Ret = getPredicateOnEdge(Pred, V, C, *PI, BB, CxtI); 1760 if (Ret != Baseline) break; 1761 } 1762 // If we terminated early, then one of the values didn't match. 1763 if (PI == PE) { 1764 return Baseline; 1765 } 1766 } 1767 } 1768 } 1769 return Unknown; 1770 } 1771 1772 void LazyValueInfo::threadEdge(BasicBlock *PredBB, BasicBlock *OldSucc, 1773 BasicBlock *NewSucc) { 1774 if (PImpl) { 1775 const DataLayout &DL = PredBB->getModule()->getDataLayout(); 1776 getImpl(PImpl, AC, &DL, DT).threadEdge(PredBB, OldSucc, NewSucc); 1777 } 1778 } 1779 1780 void LazyValueInfo::eraseBlock(BasicBlock *BB) { 1781 if (PImpl) { 1782 const DataLayout &DL = BB->getModule()->getDataLayout(); 1783 getImpl(PImpl, AC, &DL, DT).eraseBlock(BB); 1784 } 1785 } 1786 1787 1788 void LazyValueInfo::printLVI(Function &F, DominatorTree &DTree, raw_ostream &OS) { 1789 if (PImpl) { 1790 getImpl(PImpl, AC, DL, DT).printLVI(F, DTree, OS); 1791 } 1792 } 1793 1794 // Print the LVI for the function arguments at the start of each basic block. 1795 void LazyValueInfoAnnotatedWriter::emitBasicBlockStartAnnot( 1796 const BasicBlock *BB, formatted_raw_ostream &OS) { 1797 // Find if there are latticevalues defined for arguments of the function. 1798 auto *F = BB->getParent(); 1799 for (auto &Arg : F->args()) { 1800 ValueLatticeElement Result = LVIImpl->getValueInBlock( 1801 const_cast<Argument *>(&Arg), const_cast<BasicBlock *>(BB)); 1802 if (Result.isUndefined()) 1803 continue; 1804 OS << "; LatticeVal for: '" << Arg << "' is: " << Result << "\n"; 1805 } 1806 } 1807 1808 // This function prints the LVI analysis for the instruction I at the beginning 1809 // of various basic blocks. It relies on calculated values that are stored in 1810 // the LazyValueInfoCache, and in the absence of cached values, recalculte the 1811 // LazyValueInfo for `I`, and print that info. 1812 void LazyValueInfoAnnotatedWriter::emitInstructionAnnot( 1813 const Instruction *I, formatted_raw_ostream &OS) { 1814 1815 auto *ParentBB = I->getParent(); 1816 SmallPtrSet<const BasicBlock*, 16> BlocksContainingLVI; 1817 // We can generate (solve) LVI values only for blocks that are dominated by 1818 // the I's parent. However, to avoid generating LVI for all dominating blocks, 1819 // that contain redundant/uninteresting information, we print LVI for 1820 // blocks that may use this LVI information (such as immediate successor 1821 // blocks, and blocks that contain uses of `I`). 1822 auto printResult = [&](const BasicBlock *BB) { 1823 if (!BlocksContainingLVI.insert(BB).second) 1824 return; 1825 ValueLatticeElement Result = LVIImpl->getValueInBlock( 1826 const_cast<Instruction *>(I), const_cast<BasicBlock *>(BB)); 1827 OS << "; LatticeVal for: '" << *I << "' in BB: '"; 1828 BB->printAsOperand(OS, false); 1829 OS << "' is: " << Result << "\n"; 1830 }; 1831 1832 printResult(ParentBB); 1833 // Print the LVI analysis results for the the immediate successor blocks, that 1834 // are dominated by `ParentBB`. 1835 for (auto *BBSucc : successors(ParentBB)) 1836 if (DT.dominates(ParentBB, BBSucc)) 1837 printResult(BBSucc); 1838 1839 // Print LVI in blocks where `I` is used. 1840 for (auto *U : I->users()) 1841 if (auto *UseI = dyn_cast<Instruction>(U)) 1842 if (!isa<PHINode>(UseI) || DT.dominates(ParentBB, UseI->getParent())) 1843 printResult(UseI->getParent()); 1844 1845 } 1846 1847 namespace { 1848 // Printer class for LazyValueInfo results. 1849 class LazyValueInfoPrinter : public FunctionPass { 1850 public: 1851 static char ID; // Pass identification, replacement for typeid 1852 LazyValueInfoPrinter() : FunctionPass(ID) { 1853 initializeLazyValueInfoPrinterPass(*PassRegistry::getPassRegistry()); 1854 } 1855 1856 void getAnalysisUsage(AnalysisUsage &AU) const override { 1857 AU.setPreservesAll(); 1858 AU.addRequired<LazyValueInfoWrapperPass>(); 1859 AU.addRequired<DominatorTreeWrapperPass>(); 1860 } 1861 1862 // Get the mandatory dominator tree analysis and pass this in to the 1863 // LVIPrinter. We cannot rely on the LVI's DT, since it's optional. 1864 bool runOnFunction(Function &F) override { 1865 dbgs() << "LVI for function '" << F.getName() << "':\n"; 1866 auto &LVI = getAnalysis<LazyValueInfoWrapperPass>().getLVI(); 1867 auto &DTree = getAnalysis<DominatorTreeWrapperPass>().getDomTree(); 1868 LVI.printLVI(F, DTree, dbgs()); 1869 return false; 1870 } 1871 }; 1872 } 1873 1874 char LazyValueInfoPrinter::ID = 0; 1875 INITIALIZE_PASS_BEGIN(LazyValueInfoPrinter, "print-lazy-value-info", 1876 "Lazy Value Info Printer Pass", false, false) 1877 INITIALIZE_PASS_DEPENDENCY(LazyValueInfoWrapperPass) 1878 INITIALIZE_PASS_END(LazyValueInfoPrinter, "print-lazy-value-info", 1879 "Lazy Value Info Printer Pass", false, false) 1880