1 //===- GlobalsModRef.cpp - Simple Mod/Ref Analysis for Globals ------------===//
3 // The LLVM Compiler Infrastructure
5 // This file was developed by the LLVM research group and is distributed under
6 // the University of Illinois Open Source License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This simple pass provides alias and mod/ref information for global values
11 // that do not have their address taken, and keeps track of whether functions
12 // read or write memory (are "pure"). For this simple (but very common) case,
13 // we can provide pretty accurate and useful information.
15 //===----------------------------------------------------------------------===//
17 #include "llvm/Analysis/Passes.h"
18 #include "llvm/Module.h"
19 #include "llvm/Pass.h"
20 #include "llvm/Instructions.h"
21 #include "llvm/Constants.h"
22 #include "llvm/DerivedTypes.h"
23 #include "llvm/Analysis/AliasAnalysis.h"
24 #include "llvm/Analysis/CallGraph.h"
25 #include "llvm/Support/InstIterator.h"
26 #include "llvm/Support/CommandLine.h"
27 #include "llvm/ADT/Statistic.h"
28 #include "llvm/ADT/SCCIterator.h"
34 NumNonAddrTakenGlobalVars("globalsmodref-aa",
35 "Number of global vars without address taken");
37 NumNonAddrTakenFunctions("globalsmodref-aa",
38 "Number of functions without address taken");
40 NumNoMemFunctions("globalsmodref-aa",
41 "Number of functions that do not access memory");
43 NumReadMemFunctions("globalsmodref-aa",
44 "Number of functions that only read memory");
46 NumIndirectGlobalVars("globalsmodref-aa",
47 "Number of indirect global objects");
49 /// FunctionRecord - One instance of this structure is stored for every
50 /// function in the program. Later, the entries for these functions are
51 /// removed if the function is found to call an external function (in which
52 /// case we know nothing about it.
53 struct FunctionRecord {
54 /// GlobalInfo - Maintain mod/ref info for all of the globals without
55 /// addresses taken that are read or written (transitively) by this
57 std::map<GlobalValue*, unsigned> GlobalInfo;
59 unsigned getInfoForGlobal(GlobalValue *GV) const {
60 std::map<GlobalValue*, unsigned>::const_iterator I = GlobalInfo.find(GV);
61 if (I != GlobalInfo.end())
66 /// FunctionEffect - Capture whether or not this function reads or writes to
67 /// ANY memory. If not, we can do a lot of aggressive analysis on it.
68 unsigned FunctionEffect;
70 FunctionRecord() : FunctionEffect(0) {}
73 /// GlobalsModRef - The actual analysis pass.
74 class GlobalsModRef : public ModulePass, public AliasAnalysis {
75 /// NonAddressTakenGlobals - The globals that do not have their addresses
77 std::set<GlobalValue*> NonAddressTakenGlobals;
79 /// IndirectGlobals - The memory pointed to by this global is known to be
80 /// 'owned' by the global.
81 std::set<GlobalValue*> IndirectGlobals;
83 /// AllocsForIndirectGlobals - If an instruction allocates memory for an
84 /// indirect global, this map indicates which one.
85 std::map<Value*, GlobalValue*> AllocsForIndirectGlobals;
87 /// FunctionInfo - For each function, keep track of what globals are
89 std::map<Function*, FunctionRecord> FunctionInfo;
92 bool runOnModule(Module &M) {
93 InitializeAliasAnalysis(this); // set up super class
94 AnalyzeGlobals(M); // find non-addr taken globals
95 AnalyzeCallGraph(getAnalysis<CallGraph>(), M); // Propagate on CG
99 virtual void getAnalysisUsage(AnalysisUsage &AU) const {
100 AliasAnalysis::getAnalysisUsage(AU);
101 AU.addRequired<CallGraph>();
102 AU.setPreservesAll(); // Does not transform code
105 //------------------------------------------------
106 // Implement the AliasAnalysis API
108 AliasResult alias(const Value *V1, unsigned V1Size,
109 const Value *V2, unsigned V2Size);
110 ModRefResult getModRefInfo(CallSite CS, Value *P, unsigned Size);
111 ModRefResult getModRefInfo(CallSite CS1, CallSite CS2) {
112 return AliasAnalysis::getModRefInfo(CS1,CS2);
114 bool hasNoModRefInfoForCalls() const { return false; }
116 /// getModRefBehavior - Return the behavior of the specified function if
117 /// called from the specified call site. The call site may be null in which
118 /// case the most generic behavior of this function should be returned.
119 virtual ModRefBehavior getModRefBehavior(Function *F, CallSite CS,
120 std::vector<PointerAccessInfo> *Info) {
121 if (FunctionRecord *FR = getFunctionInfo(F))
122 if (FR->FunctionEffect == 0)
123 return DoesNotAccessMemory;
124 else if ((FR->FunctionEffect & Mod) == 0)
125 return OnlyReadsMemory;
126 return AliasAnalysis::getModRefBehavior(F, CS, Info);
129 virtual void deleteValue(Value *V);
130 virtual void copyValue(Value *From, Value *To);
133 /// getFunctionInfo - Return the function info for the function, or null if
134 /// the function calls an external function (in which case we don't have
135 /// anything useful to say about it).
136 FunctionRecord *getFunctionInfo(Function *F) {
137 std::map<Function*, FunctionRecord>::iterator I = FunctionInfo.find(F);
138 if (I != FunctionInfo.end())
143 void AnalyzeGlobals(Module &M);
144 void AnalyzeCallGraph(CallGraph &CG, Module &M);
145 void AnalyzeSCC(std::vector<CallGraphNode *> &SCC);
146 bool AnalyzeUsesOfPointer(Value *V, std::vector<Function*> &Readers,
147 std::vector<Function*> &Writers,
148 GlobalValue *OkayStoreDest = 0);
149 bool AnalyzeIndirectGlobalMemory(GlobalValue *GV);
152 RegisterPass<GlobalsModRef> X("globalsmodref-aa",
153 "Simple mod/ref analysis for globals");
154 RegisterAnalysisGroup<AliasAnalysis> Y(X);
157 Pass *llvm::createGlobalsModRefPass() { return new GlobalsModRef(); }
159 /// getUnderlyingObject - This traverses the use chain to figure out what object
160 /// the specified value points to. If the value points to, or is derived from,
161 /// a global object, return it.
162 static Value *getUnderlyingObject(Value *V) {
163 if (!isa<PointerType>(V->getType())) return V;
165 // If we are at some type of object... return it.
166 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) return GV;
168 // Traverse through different addressing mechanisms.
169 if (Instruction *I = dyn_cast<Instruction>(V)) {
170 if (isa<BitCastInst>(I) || isa<GetElementPtrInst>(I))
171 return getUnderlyingObject(I->getOperand(0));
172 } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(V)) {
173 if (CE->getOpcode() == Instruction::BitCast ||
174 CE->getOpcode() == Instruction::GetElementPtr)
175 return getUnderlyingObject(CE->getOperand(0));
178 // Othewise, we don't know what this is, return it as the base pointer.
182 /// AnalyzeGlobals - Scan through the users of all of the internal
183 /// GlobalValue's in the program. If none of them have their "Address taken"
184 /// (really, their address passed to something nontrivial), record this fact,
185 /// and record the functions that they are used directly in.
186 void GlobalsModRef::AnalyzeGlobals(Module &M) {
187 std::vector<Function*> Readers, Writers;
188 for (Module::iterator I = M.begin(), E = M.end(); I != E; ++I)
189 if (I->hasInternalLinkage()) {
190 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
191 // Remember that we are tracking this global.
192 NonAddressTakenGlobals.insert(I);
193 ++NumNonAddrTakenFunctions;
195 Readers.clear(); Writers.clear();
198 for (Module::global_iterator I = M.global_begin(), E = M.global_end();
200 if (I->hasInternalLinkage()) {
201 if (!AnalyzeUsesOfPointer(I, Readers, Writers)) {
202 // Remember that we are tracking this global, and the mod/ref fns
203 NonAddressTakenGlobals.insert(I);
204 for (unsigned i = 0, e = Readers.size(); i != e; ++i)
205 FunctionInfo[Readers[i]].GlobalInfo[I] |= Ref;
207 if (!I->isConstant()) // No need to keep track of writers to constants
208 for (unsigned i = 0, e = Writers.size(); i != e; ++i)
209 FunctionInfo[Writers[i]].GlobalInfo[I] |= Mod;
210 ++NumNonAddrTakenGlobalVars;
212 // If this global holds a pointer type, see if it is an indirect global.
213 if (isa<PointerType>(I->getType()->getElementType()) &&
214 AnalyzeIndirectGlobalMemory(I))
215 ++NumIndirectGlobalVars;
217 Readers.clear(); Writers.clear();
221 /// AnalyzeUsesOfPointer - Look at all of the users of the specified pointer.
222 /// If this is used by anything complex (i.e., the address escapes), return
223 /// true. Also, while we are at it, keep track of those functions that read and
224 /// write to the value.
226 /// If OkayStoreDest is non-null, stores into this global are allowed.
227 bool GlobalsModRef::AnalyzeUsesOfPointer(Value *V,
228 std::vector<Function*> &Readers,
229 std::vector<Function*> &Writers,
230 GlobalValue *OkayStoreDest) {
231 if (!isa<PointerType>(V->getType())) return true;
233 for (Value::use_iterator UI = V->use_begin(), E = V->use_end(); UI != E; ++UI)
234 if (LoadInst *LI = dyn_cast<LoadInst>(*UI)) {
235 Readers.push_back(LI->getParent()->getParent());
236 } else if (StoreInst *SI = dyn_cast<StoreInst>(*UI)) {
237 if (V == SI->getOperand(1)) {
238 Writers.push_back(SI->getParent()->getParent());
239 } else if (SI->getOperand(1) != OkayStoreDest) {
240 return true; // Storing the pointer
242 } else if (GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(*UI)) {
243 if (AnalyzeUsesOfPointer(GEP, Readers, Writers)) return true;
244 } else if (CallInst *CI = dyn_cast<CallInst>(*UI)) {
245 // Make sure that this is just the function being called, not that it is
246 // passing into the function.
247 for (unsigned i = 1, e = CI->getNumOperands(); i != e; ++i)
248 if (CI->getOperand(i) == V) return true;
249 } else if (InvokeInst *II = dyn_cast<InvokeInst>(*UI)) {
250 // Make sure that this is just the function being called, not that it is
251 // passing into the function.
252 for (unsigned i = 3, e = II->getNumOperands(); i != e; ++i)
253 if (II->getOperand(i) == V) return true;
254 } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(*UI)) {
255 if (CE->getOpcode() == Instruction::GetElementPtr ||
256 CE->getOpcode() == Instruction::BitCast) {
257 if (AnalyzeUsesOfPointer(CE, Readers, Writers))
262 } else if (SetCondInst *SCI = dyn_cast<SetCondInst>(*UI)) {
263 if (!isa<ConstantPointerNull>(SCI->getOperand(1)))
264 return true; // Allow comparison against null.
265 } else if (FreeInst *F = dyn_cast<FreeInst>(*UI)) {
266 Writers.push_back(F->getParent()->getParent());
273 /// AnalyzeIndirectGlobalMemory - We found an non-address-taken global variable
274 /// which holds a pointer type. See if the global always points to non-aliased
275 /// heap memory: that is, all initializers of the globals are allocations, and
276 /// those allocations have no use other than initialization of the global.
277 /// Further, all loads out of GV must directly use the memory, not store the
278 /// pointer somewhere. If this is true, we consider the memory pointed to by
279 /// GV to be owned by GV and can disambiguate other pointers from it.
280 bool GlobalsModRef::AnalyzeIndirectGlobalMemory(GlobalValue *GV) {
281 // Keep track of values related to the allocation of the memory, f.e. the
282 // value produced by the malloc call and any casts.
283 std::vector<Value*> AllocRelatedValues;
285 // Walk the user list of the global. If we find anything other than a direct
286 // load or store, bail out.
287 for (Value::use_iterator I = GV->use_begin(), E = GV->use_end(); I != E; ++I){
288 if (LoadInst *LI = dyn_cast<LoadInst>(*I)) {
289 // The pointer loaded from the global can only be used in simple ways:
290 // we allow addressing of it and loading storing to it. We do *not* allow
291 // storing the loaded pointer somewhere else or passing to a function.
292 std::vector<Function*> ReadersWriters;
293 if (AnalyzeUsesOfPointer(LI, ReadersWriters, ReadersWriters))
294 return false; // Loaded pointer escapes.
295 // TODO: Could try some IP mod/ref of the loaded pointer.
296 } else if (StoreInst *SI = dyn_cast<StoreInst>(*I)) {
297 // Storing the global itself.
298 if (SI->getOperand(0) == GV) return false;
300 // If storing the null pointer, ignore it.
301 if (isa<ConstantPointerNull>(SI->getOperand(0)))
304 // Check the value being stored.
305 Value *Ptr = getUnderlyingObject(SI->getOperand(0));
307 if (isa<MallocInst>(Ptr)) {
309 } else if (CallInst *CI = dyn_cast<CallInst>(Ptr)) {
310 Function *F = CI->getCalledFunction();
311 if (!F || !F->isExternal()) return false; // Too hard to analyze.
312 if (F->getName() != "calloc") return false; // Not calloc.
314 return false; // Too hard to analyze.
317 // Analyze all uses of the allocation. If any of them are used in a
318 // non-simple way (e.g. stored to another global) bail out.
319 std::vector<Function*> ReadersWriters;
320 if (AnalyzeUsesOfPointer(Ptr, ReadersWriters, ReadersWriters, GV))
321 return false; // Loaded pointer escapes.
323 // Remember that this allocation is related to the indirect global.
324 AllocRelatedValues.push_back(Ptr);
326 // Something complex, bail out.
331 // Okay, this is an indirect global. Remember all of the allocations for
332 // this global in AllocsForIndirectGlobals.
333 while (!AllocRelatedValues.empty()) {
334 AllocsForIndirectGlobals[AllocRelatedValues.back()] = GV;
335 AllocRelatedValues.pop_back();
337 IndirectGlobals.insert(GV);
341 /// AnalyzeCallGraph - At this point, we know the functions where globals are
342 /// immediately stored to and read from. Propagate this information up the call
343 /// graph to all callers and compute the mod/ref info for all memory for each
345 void GlobalsModRef::AnalyzeCallGraph(CallGraph &CG, Module &M) {
346 // We do a bottom-up SCC traversal of the call graph. In other words, we
347 // visit all callees before callers (leaf-first).
348 for (scc_iterator<CallGraph*> I = scc_begin(&CG), E = scc_end(&CG); I!=E; ++I)
349 if ((*I).size() != 1) {
351 } else if (Function *F = (*I)[0]->getFunction()) {
352 if (!F->isExternal()) {
353 // Nonexternal function.
356 // Otherwise external function. Handle intrinsics and other special
358 if (getAnalysis<AliasAnalysis>().doesNotAccessMemory(F))
359 // If it does not access memory, process the function, causing us to
360 // realize it doesn't do anything (the body is empty).
363 // Otherwise, don't process it. This will cause us to conservatively
368 // Do not process the external node, assume the worst.
372 void GlobalsModRef::AnalyzeSCC(std::vector<CallGraphNode *> &SCC) {
373 assert(!SCC.empty() && "SCC with no functions?");
374 FunctionRecord &FR = FunctionInfo[SCC[0]->getFunction()];
376 bool CallsExternal = false;
377 unsigned FunctionEffect = 0;
379 // Collect the mod/ref properties due to called functions. We only compute
381 for (unsigned i = 0, e = SCC.size(); i != e && !CallsExternal; ++i)
382 for (CallGraphNode::iterator CI = SCC[i]->begin(), E = SCC[i]->end();
384 if (Function *Callee = CI->second->getFunction()) {
385 if (FunctionRecord *CalleeFR = getFunctionInfo(Callee)) {
386 // Propagate function effect up.
387 FunctionEffect |= CalleeFR->FunctionEffect;
389 // Incorporate callee's effects on globals into our info.
390 for (std::map<GlobalValue*, unsigned>::iterator GI =
391 CalleeFR->GlobalInfo.begin(), E = CalleeFR->GlobalInfo.end();
393 FR.GlobalInfo[GI->first] |= GI->second;
396 // Okay, if we can't say anything about it, maybe some other alias
399 AliasAnalysis::getModRefBehavior(Callee, CallSite());
400 if (MRB != DoesNotAccessMemory) {
401 // FIXME: could make this more aggressive for functions that just
402 // read memory. We should just say they read all globals.
403 CallsExternal = true;
408 CallsExternal = true;
412 // If this SCC calls an external function, we can't say anything about it, so
413 // remove all SCC functions from the FunctionInfo map.
415 for (unsigned i = 0, e = SCC.size(); i != e; ++i)
416 FunctionInfo.erase(SCC[i]->getFunction());
420 // Otherwise, unless we already know that this function mod/refs memory, scan
421 // the function bodies to see if there are any explicit loads or stores.
422 if (FunctionEffect != ModRef) {
423 for (unsigned i = 0, e = SCC.size(); i != e && FunctionEffect != ModRef;++i)
424 for (inst_iterator II = inst_begin(SCC[i]->getFunction()),
425 E = inst_end(SCC[i]->getFunction());
426 II != E && FunctionEffect != ModRef; ++II)
427 if (isa<LoadInst>(*II))
428 FunctionEffect |= Ref;
429 else if (isa<StoreInst>(*II))
430 FunctionEffect |= Mod;
431 else if (isa<MallocInst>(*II) || isa<FreeInst>(*II))
432 FunctionEffect |= ModRef;
435 if ((FunctionEffect & Mod) == 0)
436 ++NumReadMemFunctions;
437 if (FunctionEffect == 0)
439 FR.FunctionEffect = FunctionEffect;
441 // Finally, now that we know the full effect on this SCC, clone the
442 // information to each function in the SCC.
443 for (unsigned i = 1, e = SCC.size(); i != e; ++i)
444 FunctionInfo[SCC[i]->getFunction()] = FR;
449 /// alias - If one of the pointers is to a global that we are tracking, and the
450 /// other is some random pointer, we know there cannot be an alias, because the
451 /// address of the global isn't taken.
452 AliasAnalysis::AliasResult
453 GlobalsModRef::alias(const Value *V1, unsigned V1Size,
454 const Value *V2, unsigned V2Size) {
455 // Get the base object these pointers point to.
456 Value *UV1 = getUnderlyingObject(const_cast<Value*>(V1));
457 Value *UV2 = getUnderlyingObject(const_cast<Value*>(V2));
459 // If either of the underlying values is a global, they may be non-addr-taken
460 // globals, which we can answer queries about.
461 GlobalValue *GV1 = dyn_cast<GlobalValue>(UV1);
462 GlobalValue *GV2 = dyn_cast<GlobalValue>(UV2);
464 // If the global's address is taken, pretend we don't know it's a pointer to
466 if (GV1 && !NonAddressTakenGlobals.count(GV1)) GV1 = 0;
467 if (GV2 && !NonAddressTakenGlobals.count(GV2)) GV2 = 0;
469 // If the the two pointers are derived from two different non-addr-taken
470 // globals, or if one is and the other isn't, we know these can't alias.
471 if ((GV1 || GV2) && GV1 != GV2)
474 // Otherwise if they are both derived from the same addr-taken global, we
475 // can't know the two accesses don't overlap.
478 // These pointers may be based on the memory owned by an indirect global. If
479 // so, we may be able to handle this. First check to see if the base pointer
480 // is a direct load from an indirect global.
482 if (LoadInst *LI = dyn_cast<LoadInst>(UV1))
483 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
484 if (IndirectGlobals.count(GV))
486 if (LoadInst *LI = dyn_cast<LoadInst>(UV2))
487 if (GlobalVariable *GV = dyn_cast<GlobalVariable>(LI->getOperand(0)))
488 if (IndirectGlobals.count(GV))
491 // These pointers may also be from an allocation for the indirect global. If
492 // so, also handle them.
493 if (AllocsForIndirectGlobals.count(UV1))
494 GV1 = AllocsForIndirectGlobals[UV1];
495 if (AllocsForIndirectGlobals.count(UV2))
496 GV2 = AllocsForIndirectGlobals[UV2];
498 // Now that we know whether the two pointers are related to indirect globals,
499 // use this to disambiguate the pointers. If either pointer is based on an
500 // indirect global and if they are not both based on the same indirect global,
501 // they cannot alias.
502 if ((GV1 || GV2) && GV1 != GV2)
505 return AliasAnalysis::alias(V1, V1Size, V2, V2Size);
508 AliasAnalysis::ModRefResult
509 GlobalsModRef::getModRefInfo(CallSite CS, Value *P, unsigned Size) {
510 unsigned Known = ModRef;
512 // If we are asking for mod/ref info of a direct call with a pointer to a
513 // global we are tracking, return information if we have it.
514 if (GlobalValue *GV = dyn_cast<GlobalValue>(getUnderlyingObject(P)))
515 if (GV->hasInternalLinkage())
516 if (Function *F = CS.getCalledFunction())
517 if (NonAddressTakenGlobals.count(GV))
518 if (FunctionRecord *FR = getFunctionInfo(F))
519 Known = FR->getInfoForGlobal(GV);
521 if (Known == NoModRef)
522 return NoModRef; // No need to query other mod/ref analyses
523 return ModRefResult(Known & AliasAnalysis::getModRefInfo(CS, P, Size));
527 //===----------------------------------------------------------------------===//
528 // Methods to update the analysis as a result of the client transformation.
530 void GlobalsModRef::deleteValue(Value *V) {
531 if (GlobalValue *GV = dyn_cast<GlobalValue>(V)) {
532 if (NonAddressTakenGlobals.erase(GV)) {
533 // This global might be an indirect global. If so, remove it and remove
534 // any AllocRelatedValues for it.
535 if (IndirectGlobals.erase(GV)) {
536 // Remove any entries in AllocsForIndirectGlobals for this global.
537 for (std::map<Value*, GlobalValue*>::iterator
538 I = AllocsForIndirectGlobals.begin(),
539 E = AllocsForIndirectGlobals.end(); I != E; ) {
540 if (I->second == GV) {
541 AllocsForIndirectGlobals.erase(I++);
550 // Otherwise, if this is an allocation related to an indirect global, remove
552 AllocsForIndirectGlobals.erase(V);
555 void GlobalsModRef::copyValue(Value *From, Value *To) {