1 //===- TypeBasedAliasAnalysis.cpp - Type-Based Alias Analysis -------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines the TypeBasedAliasAnalysis pass, which implements
11 // metadata-based TBAA.
13 // In LLVM IR, memory does not have types, so LLVM's own type system is not
14 // suitable for doing TBAA. Instead, metadata is added to the IR to describe
15 // a type system of a higher level language. This can be used to implement
16 // typical C/C++ TBAA, but it can also be used to implement custom alias
17 // analysis behavior for other languages.
19 // We now support two types of metadata format: scalar TBAA and struct-path
20 // aware TBAA. After all testing cases are upgraded to use struct-path aware
21 // TBAA and we can auto-upgrade existing bc files, the support for scalar TBAA
24 // The scalar TBAA metadata format is very simple. TBAA MDNodes have up to
25 // three fields, e.g.:
26 // !0 = metadata !{ metadata !"an example type tree" }
27 // !1 = metadata !{ metadata !"int", metadata !0 }
28 // !2 = metadata !{ metadata !"float", metadata !0 }
29 // !3 = metadata !{ metadata !"const float", metadata !2, i64 1 }
31 // The first field is an identity field. It can be any value, usually
32 // an MDString, which uniquely identifies the type. The most important
33 // name in the tree is the name of the root node. Two trees with
34 // different root node names are entirely disjoint, even if they
35 // have leaves with common names.
37 // The second field identifies the type's parent node in the tree, or
38 // is null or omitted for a root node. A type is considered to alias
39 // all of its descendants and all of its ancestors in the tree. Also,
40 // a type is considered to alias all types in other trees, so that
41 // bitcode produced from multiple front-ends is handled conservatively.
43 // If the third field is present, it's an integer which if equal to 1
44 // indicates that the type is "constant" (meaning pointsToConstantMemory
45 // should return true; see
46 // http://llvm.org/docs/AliasAnalysis.html#OtherItfs).
48 // With struct-path aware TBAA, the MDNodes attached to an instruction using
49 // "!tbaa" are called path tag nodes.
51 // The path tag node has 4 fields with the last field being optional.
53 // The first field is the base type node, it can be a struct type node
54 // or a scalar type node. The second field is the access type node, it
55 // must be a scalar type node. The third field is the offset into the base type.
56 // The last field has the same meaning as the last field of our scalar TBAA:
57 // it's an integer which if equal to 1 indicates that the access is "constant".
59 // The struct type node has a name and a list of pairs, one pair for each member
60 // of the struct. The first element of each pair is a type node (a struct type
61 // node or a sclar type node), specifying the type of the member, the second
62 // element of each pair is the offset of the member.
73 // For an acess to B.a.s, we attach !5 (a path tag node) to the load/store
74 // instruction. The base type is !4 (struct B), the access type is !2 (scalar
75 // type short) and the offset is 4.
77 // !0 = metadata !{metadata !"Simple C/C++ TBAA"}
78 // !1 = metadata !{metadata !"omnipotent char", metadata !0} // Scalar type node
79 // !2 = metadata !{metadata !"short", metadata !1} // Scalar type node
80 // !3 = metadata !{metadata !"A", metadata !2, i64 0} // Struct type node
81 // !4 = metadata !{metadata !"B", metadata !2, i64 0, metadata !3, i64 4}
82 // // Struct type node
83 // !5 = metadata !{metadata !4, metadata !2, i64 4} // Path tag node
85 // The struct type nodes and the scalar type nodes form a type DAG.
87 // char (!1) -- edge to Root
88 // short (!2) -- edge to char
89 // A (!3) -- edge with offset 0 to short
90 // B (!4) -- edge with offset 0 to short and edge with offset 4 to A
92 // To check if two tags (tagX and tagY) can alias, we start from the base type
93 // of tagX, follow the edge with the correct offset in the type DAG and adjust
94 // the offset until we reach the base type of tagY or until we reach the Root
96 // If we reach the base type of tagY, compare the adjusted offset with
97 // offset of tagY, return Alias if the offsets are the same, return NoAlias
99 // If we reach the Root node, perform the above starting from base type of tagY
100 // to see if we reach base type of tagX.
102 // If they have different roots, they're part of different potentially
103 // unrelated type systems, so we return Alias to be conservative.
104 // If neither node is an ancestor of the other and they have the same root,
105 // then we say NoAlias.
107 // TODO: The current metadata format doesn't support struct
108 // fields. For example:
113 // void foo(struct X *x, struct X *y, double *p) {
117 // Struct X has a double member, so the store to *x can alias the store to *p.
118 // Currently it's not possible to precisely describe all the things struct X
119 // aliases, so struct assignments must use conservative TBAA nodes. There's
120 // no scheme for attaching metadata to @llvm.memcpy yet either.
122 //===----------------------------------------------------------------------===//
124 #include "llvm/Analysis/Passes.h"
125 #include "llvm/Analysis/AliasAnalysis.h"
126 #include "llvm/IR/Constants.h"
127 #include "llvm/IR/LLVMContext.h"
128 #include "llvm/IR/Metadata.h"
129 #include "llvm/IR/Module.h"
130 #include "llvm/Pass.h"
131 #include "llvm/Support/CommandLine.h"
132 using namespace llvm;
134 // A handy option for disabling TBAA functionality. The same effect can also be
135 // achieved by stripping the !tbaa tags from IR, but this option is sometimes
137 static cl::opt<bool> EnableTBAA("enable-tbaa", cl::init(true));
140 /// TBAANode - This is a simple wrapper around an MDNode which provides a
141 /// higher-level interface by hiding the details of how alias analysis
142 /// information is encoded in its operands.
147 TBAANode() : Node(0) {}
148 explicit TBAANode(const MDNode *N) : Node(N) {}
150 /// getNode - Get the MDNode for this TBAANode.
151 const MDNode *getNode() const { return Node; }
153 /// getParent - Get this TBAANode's Alias tree parent.
154 TBAANode getParent() const {
155 if (Node->getNumOperands() < 2)
157 MDNode *P = dyn_cast_or_null<MDNode>(Node->getOperand(1));
160 // Ok, this node has a valid parent. Return it.
164 /// TypeIsImmutable - Test if this TBAANode represents a type for objects
165 /// which are not modified (by any means) in the context where this
166 /// AliasAnalysis is relevant.
167 bool TypeIsImmutable() const {
168 if (Node->getNumOperands() < 3)
170 ConstantInt *CI = dyn_cast<ConstantInt>(Node->getOperand(2));
173 return CI->getValue()[0];
177 /// This is a simple wrapper around an MDNode which provides a
178 /// higher-level interface by hiding the details of how alias analysis
179 /// information is encoded in its operands.
180 class TBAAStructTagNode {
181 /// This node should be created with createTBAAStructTagNode.
185 TBAAStructTagNode() : Node(0) {}
186 explicit TBAAStructTagNode(const MDNode *N) : Node(N) {}
188 /// Get the MDNode for this TBAAStructTagNode.
189 const MDNode *getNode() const { return Node; }
191 const MDNode *getBaseType() const {
192 return dyn_cast_or_null<MDNode>(Node->getOperand(0));
194 const MDNode *getAccessType() const {
195 return dyn_cast_or_null<MDNode>(Node->getOperand(1));
197 uint64_t getOffset() const {
198 return cast<ConstantInt>(Node->getOperand(2))->getZExtValue();
200 /// TypeIsImmutable - Test if this TBAAStructTagNode represents a type for
201 /// objects which are not modified (by any means) in the context where this
202 /// AliasAnalysis is relevant.
203 bool TypeIsImmutable() const {
204 if (Node->getNumOperands() < 4)
206 ConstantInt *CI = dyn_cast<ConstantInt>(Node->getOperand(3));
209 return CI->getValue()[0];
213 /// This is a simple wrapper around an MDNode which provides a
214 /// higher-level interface by hiding the details of how alias analysis
215 /// information is encoded in its operands.
216 class TBAAStructTypeNode {
217 /// This node should be created with createTBAAStructTypeNode.
221 TBAAStructTypeNode() : Node(0) {}
222 explicit TBAAStructTypeNode(const MDNode *N) : Node(N) {}
224 /// Get the MDNode for this TBAAStructTypeNode.
225 const MDNode *getNode() const { return Node; }
227 /// Get this TBAAStructTypeNode's field in the type DAG with
228 /// given offset. Update the offset to be relative to the field type.
229 TBAAStructTypeNode getParent(uint64_t &Offset) const {
230 // Parent can be omitted for the root node.
231 if (Node->getNumOperands() < 2)
232 return TBAAStructTypeNode();
234 // Fast path for a scalar type node and a struct type node with a single
236 if (Node->getNumOperands() <= 3) {
237 uint64_t Cur = Node->getNumOperands() == 2 ? 0 :
238 cast<ConstantInt>(Node->getOperand(2))->getZExtValue();
240 MDNode *P = dyn_cast_or_null<MDNode>(Node->getOperand(1));
242 return TBAAStructTypeNode();
243 return TBAAStructTypeNode(P);
246 // Assume the offsets are in order. We return the previous field if
247 // the current offset is bigger than the given offset.
249 for (unsigned Idx = 1; Idx < Node->getNumOperands(); Idx += 2) {
250 uint64_t Cur = cast<ConstantInt>(Node->getOperand(Idx + 1))->
254 "TBAAStructTypeNode::getParent should have an offset match!");
259 // Move along the last field.
261 TheIdx = Node->getNumOperands() - 2;
262 uint64_t Cur = cast<ConstantInt>(Node->getOperand(TheIdx + 1))->
265 MDNode *P = dyn_cast_or_null<MDNode>(Node->getOperand(TheIdx));
267 return TBAAStructTypeNode();
268 return TBAAStructTypeNode(P);
274 /// TypeBasedAliasAnalysis - This is a simple alias analysis
275 /// implementation that uses TypeBased to answer queries.
276 class TypeBasedAliasAnalysis : public ImmutablePass,
277 public AliasAnalysis {
279 static char ID; // Class identification, replacement for typeinfo
280 TypeBasedAliasAnalysis() : ImmutablePass(ID) {
281 initializeTypeBasedAliasAnalysisPass(*PassRegistry::getPassRegistry());
284 virtual void initializePass() {
285 InitializeAliasAnalysis(this);
288 /// getAdjustedAnalysisPointer - This method is used when a pass implements
289 /// an analysis interface through multiple inheritance. If needed, it
290 /// should override this to adjust the this pointer as needed for the
291 /// specified pass info.
292 virtual void *getAdjustedAnalysisPointer(const void *PI) {
293 if (PI == &AliasAnalysis::ID)
294 return (AliasAnalysis*)this;
298 bool Aliases(const MDNode *A, const MDNode *B) const;
299 bool PathAliases(const MDNode *A, const MDNode *B) const;
302 virtual void getAnalysisUsage(AnalysisUsage &AU) const;
303 virtual AliasResult alias(const Location &LocA, const Location &LocB);
304 virtual bool pointsToConstantMemory(const Location &Loc, bool OrLocal);
305 virtual ModRefBehavior getModRefBehavior(ImmutableCallSite CS);
306 virtual ModRefBehavior getModRefBehavior(const Function *F);
307 virtual ModRefResult getModRefInfo(ImmutableCallSite CS,
308 const Location &Loc);
309 virtual ModRefResult getModRefInfo(ImmutableCallSite CS1,
310 ImmutableCallSite CS2);
312 } // End of anonymous namespace
314 // Register this pass...
315 char TypeBasedAliasAnalysis::ID = 0;
316 INITIALIZE_AG_PASS(TypeBasedAliasAnalysis, AliasAnalysis, "tbaa",
317 "Type-Based Alias Analysis", false, true, false)
319 ImmutablePass *llvm::createTypeBasedAliasAnalysisPass() {
320 return new TypeBasedAliasAnalysis();
324 TypeBasedAliasAnalysis::getAnalysisUsage(AnalysisUsage &AU) const {
325 AU.setPreservesAll();
326 AliasAnalysis::getAnalysisUsage(AU);
329 /// Check the first operand of the tbaa tag node, if it is a MDNode, we treat
330 /// it as struct-path aware TBAA format, otherwise, we treat it as scalar TBAA
332 static bool isStructPathTBAA(const MDNode *MD) {
333 // Anonymous TBAA root starts with a MDNode and dragonegg uses it as
335 return isa<MDNode>(MD->getOperand(0)) && MD->getNumOperands() >= 3;
338 /// Aliases - Test whether the type represented by A may alias the
339 /// type represented by B.
341 TypeBasedAliasAnalysis::Aliases(const MDNode *A,
342 const MDNode *B) const {
343 if (isStructPathTBAA(A))
344 return PathAliases(A, B);
346 // Keep track of the root node for A and B.
347 TBAANode RootA, RootB;
349 // Climb the tree from A to see if we reach B.
350 for (TBAANode T(A); ; ) {
351 if (T.getNode() == B)
352 // B is an ancestor of A.
361 // Climb the tree from B to see if we reach A.
362 for (TBAANode T(B); ; ) {
363 if (T.getNode() == A)
364 // A is an ancestor of B.
373 // Neither node is an ancestor of the other.
375 // If they have different roots, they're part of different potentially
376 // unrelated type systems, so we must be conservative.
377 if (RootA.getNode() != RootB.getNode())
380 // If they have the same root, then we've proved there's no alias.
384 /// Test whether the struct-path tag represented by A may alias the
385 /// struct-path tag represented by B.
387 TypeBasedAliasAnalysis::PathAliases(const MDNode *A,
388 const MDNode *B) const {
389 // Keep track of the root node for A and B.
390 TBAAStructTypeNode RootA, RootB;
391 TBAAStructTagNode TagA(A), TagB(B);
393 // TODO: We need to check if AccessType of TagA encloses AccessType of
394 // TagB to support aggregate AccessType. If yes, return true.
396 // Start from the base type of A, follow the edge with the correct offset in
397 // the type DAG and adjust the offset until we reach the base type of B or
398 // until we reach the Root node.
399 // Compare the adjusted offset once we have the same base.
401 // Climb the type DAG from base type of A to see if we reach base type of B.
402 const MDNode *BaseA = TagA.getBaseType();
403 const MDNode *BaseB = TagB.getBaseType();
404 uint64_t OffsetA = TagA.getOffset(), OffsetB = TagB.getOffset();
405 for (TBAAStructTypeNode T(BaseA); ; ) {
406 if (T.getNode() == BaseB)
407 // Base type of A encloses base type of B, check if the offsets match.
408 return OffsetA == OffsetB;
411 // Follow the edge with the correct offset, OffsetA will be adjusted to
412 // be relative to the field type.
413 T = T.getParent(OffsetA);
418 // Reset OffsetA and climb the type DAG from base type of B to see if we reach
420 OffsetA = TagA.getOffset();
421 for (TBAAStructTypeNode T(BaseB); ; ) {
422 if (T.getNode() == BaseA)
423 // Base type of B encloses base type of A, check if the offsets match.
424 return OffsetA == OffsetB;
427 // Follow the edge with the correct offset, OffsetB will be adjusted to
428 // be relative to the field type.
429 T = T.getParent(OffsetB);
434 // Neither node is an ancestor of the other.
436 // If they have different roots, they're part of different potentially
437 // unrelated type systems, so we must be conservative.
438 if (RootA.getNode() != RootB.getNode())
441 // If they have the same root, then we've proved there's no alias.
445 AliasAnalysis::AliasResult
446 TypeBasedAliasAnalysis::alias(const Location &LocA,
447 const Location &LocB) {
449 return AliasAnalysis::alias(LocA, LocB);
451 // Get the attached MDNodes. If either value lacks a tbaa MDNode, we must
453 const MDNode *AM = LocA.TBAATag;
454 if (!AM) return AliasAnalysis::alias(LocA, LocB);
455 const MDNode *BM = LocB.TBAATag;
456 if (!BM) return AliasAnalysis::alias(LocA, LocB);
458 // If they may alias, chain to the next AliasAnalysis.
460 return AliasAnalysis::alias(LocA, LocB);
462 // Otherwise return a definitive result.
466 bool TypeBasedAliasAnalysis::pointsToConstantMemory(const Location &Loc,
469 return AliasAnalysis::pointsToConstantMemory(Loc, OrLocal);
471 const MDNode *M = Loc.TBAATag;
472 if (!M) return AliasAnalysis::pointsToConstantMemory(Loc, OrLocal);
474 // If this is an "immutable" type, we can assume the pointer is pointing
475 // to constant memory.
476 if ((!isStructPathTBAA(M) && TBAANode(M).TypeIsImmutable()) ||
477 (isStructPathTBAA(M) && TBAAStructTagNode(M).TypeIsImmutable()))
480 return AliasAnalysis::pointsToConstantMemory(Loc, OrLocal);
483 AliasAnalysis::ModRefBehavior
484 TypeBasedAliasAnalysis::getModRefBehavior(ImmutableCallSite CS) {
486 return AliasAnalysis::getModRefBehavior(CS);
488 ModRefBehavior Min = UnknownModRefBehavior;
490 // If this is an "immutable" type, we can assume the call doesn't write
492 if (const MDNode *M = CS.getInstruction()->getMetadata(LLVMContext::MD_tbaa))
493 if ((!isStructPathTBAA(M) && TBAANode(M).TypeIsImmutable()) ||
494 (isStructPathTBAA(M) && TBAAStructTagNode(M).TypeIsImmutable()))
495 Min = OnlyReadsMemory;
497 return ModRefBehavior(AliasAnalysis::getModRefBehavior(CS) & Min);
500 AliasAnalysis::ModRefBehavior
501 TypeBasedAliasAnalysis::getModRefBehavior(const Function *F) {
502 // Functions don't have metadata. Just chain to the next implementation.
503 return AliasAnalysis::getModRefBehavior(F);
506 AliasAnalysis::ModRefResult
507 TypeBasedAliasAnalysis::getModRefInfo(ImmutableCallSite CS,
508 const Location &Loc) {
510 return AliasAnalysis::getModRefInfo(CS, Loc);
512 if (const MDNode *L = Loc.TBAATag)
513 if (const MDNode *M =
514 CS.getInstruction()->getMetadata(LLVMContext::MD_tbaa))
518 return AliasAnalysis::getModRefInfo(CS, Loc);
521 AliasAnalysis::ModRefResult
522 TypeBasedAliasAnalysis::getModRefInfo(ImmutableCallSite CS1,
523 ImmutableCallSite CS2) {
525 return AliasAnalysis::getModRefInfo(CS1, CS2);
527 if (const MDNode *M1 =
528 CS1.getInstruction()->getMetadata(LLVMContext::MD_tbaa))
529 if (const MDNode *M2 =
530 CS2.getInstruction()->getMetadata(LLVMContext::MD_tbaa))
531 if (!Aliases(M1, M2))
534 return AliasAnalysis::getModRefInfo(CS1, CS2);
537 bool MDNode::isTBAAVtableAccess() const {
538 if (!isStructPathTBAA(this)) {
539 if (getNumOperands() < 1) return false;
540 if (MDString *Tag1 = dyn_cast<MDString>(getOperand(0))) {
541 if (Tag1->getString() == "vtable pointer") return true;
546 // For struct-path aware TBAA, we use the access type of the tag.
547 if (getNumOperands() < 2) return false;
548 MDNode *Tag = cast_or_null<MDNode>(getOperand(1));
549 if (!Tag) return false;
550 if (MDString *Tag1 = dyn_cast<MDString>(Tag->getOperand(0))) {
551 if (Tag1->getString() == "vtable pointer") return true;
556 MDNode *MDNode::getMostGenericTBAA(MDNode *A, MDNode *B) {
563 // For struct-path aware TBAA, we use the access type of the tag.
564 bool StructPath = isStructPathTBAA(A);
566 A = cast_or_null<MDNode>(A->getOperand(1));
568 B = cast_or_null<MDNode>(B->getOperand(1));
572 SmallVector<MDNode *, 4> PathA;
576 T = T->getNumOperands() >= 2 ? cast_or_null<MDNode>(T->getOperand(1)) : 0;
579 SmallVector<MDNode *, 4> PathB;
583 T = T->getNumOperands() >= 2 ? cast_or_null<MDNode>(T->getOperand(1)) : 0;
586 int IA = PathA.size() - 1;
587 int IB = PathB.size() - 1;
590 while (IA >= 0 && IB >=0) {
591 if (PathA[IA] == PathB[IB])
603 // We need to convert from a type node to a tag node.
604 Type *Int64 = IntegerType::get(A->getContext(), 64);
605 Value *Ops[3] = { Ret, Ret, ConstantInt::get(Int64, 0) };
606 return MDNode::get(A->getContext(), Ops);