1 //===- SCCP.cpp - Sparse Conditional Constant Propagation -----------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file implements sparse conditional constant propagation and merging:
11 //
12 // Specifically, this:
13 // * Assumes values are constant unless proven otherwise
14 // * Assumes BasicBlocks are dead unless proven otherwise
15 // * Proves values to be constant, and replaces them with constants
16 // * Proves conditional branches to be unconditional
17 //
18 //===----------------------------------------------------------------------===//
19
20 #include "llvm/Transforms/Scalar/SCCP.h"
21 #include "llvm/ADT/ArrayRef.h"
22 #include "llvm/ADT/DenseMap.h"
23 #include "llvm/ADT/DenseSet.h"
24 #include "llvm/ADT/PointerIntPair.h"
25 #include "llvm/ADT/STLExtras.h"
26 #include "llvm/ADT/SmallPtrSet.h"
27 #include "llvm/ADT/SmallVector.h"
28 #include "llvm/ADT/Statistic.h"
29 #include "llvm/Analysis/ConstantFolding.h"
30 #include "llvm/Analysis/GlobalsModRef.h"
31 #include "llvm/Analysis/TargetLibraryInfo.h"
32 #include "llvm/Transforms/Utils/Local.h"
33 #include "llvm/Analysis/ValueLattice.h"
34 #include "llvm/Analysis/ValueLatticeUtils.h"
35 #include "llvm/IR/BasicBlock.h"
36 #include "llvm/IR/CallSite.h"
37 #include "llvm/IR/Constant.h"
38 #include "llvm/IR/Constants.h"
39 #include "llvm/IR/DataLayout.h"
40 #include "llvm/IR/DerivedTypes.h"
41 #include "llvm/IR/Function.h"
42 #include "llvm/IR/GlobalVariable.h"
43 #include "llvm/IR/InstVisitor.h"
44 #include "llvm/IR/InstrTypes.h"
45 #include "llvm/IR/Instruction.h"
46 #include "llvm/IR/Instructions.h"
47 #include "llvm/IR/Module.h"
48 #include "llvm/IR/PassManager.h"
49 #include "llvm/IR/Type.h"
50 #include "llvm/IR/User.h"
51 #include "llvm/IR/Value.h"
52 #include "llvm/Pass.h"
53 #include "llvm/Support/Casting.h"
54 #include "llvm/Support/Debug.h"
55 #include "llvm/Support/ErrorHandling.h"
56 #include "llvm/Support/raw_ostream.h"
57 #include "llvm/Transforms/Scalar.h"
58 #include "llvm/Transforms/Utils/PredicateInfo.h"
59 #include <cassert>
60 #include <utility>
61 #include <vector>
62
63 using namespace llvm;
64
65 #define DEBUG_TYPE "sccp"
66
67 STATISTIC(NumInstRemoved, "Number of instructions removed");
68 STATISTIC(NumDeadBlocks , "Number of basic blocks unreachable");
69
70 STATISTIC(IPNumInstRemoved, "Number of instructions removed by IPSCCP");
71 STATISTIC(IPNumArgsElimed ,"Number of arguments constant propagated by IPSCCP");
72 STATISTIC(IPNumGlobalConst, "Number of globals found to be constant by IPSCCP");
73
74 namespace {
75
76 /// LatticeVal class - This class represents the different lattice values that
77 /// an LLVM value may occupy. It is a simple class with value semantics.
78 ///
79 class LatticeVal {
80 enum LatticeValueTy {
81 /// unknown - This LLVM Value has no known value yet.
82 unknown,
83
84 /// constant - This LLVM Value has a specific constant value.
85 constant,
86
87 /// forcedconstant - This LLVM Value was thought to be undef until
88 /// ResolvedUndefsIn. This is treated just like 'constant', but if merged
89 /// with another (different) constant, it goes to overdefined, instead of
90 /// asserting.
91 forcedconstant,
92
93 /// overdefined - This instruction is not known to be constant, and we know
94 /// it has a value.
95 overdefined
96 };
97
98 /// Val: This stores the current lattice value along with the Constant* for
99 /// the constant if this is a 'constant' or 'forcedconstant' value.
100 PointerIntPair<Constant *, 2, LatticeValueTy> Val;
101
getLatticeValue() const102 LatticeValueTy getLatticeValue() const {
103 return Val.getInt();
104 }
105
106 public:
LatticeVal()107 LatticeVal() : Val(nullptr, unknown) {}
108
isUnknown() const109 bool isUnknown() const { return getLatticeValue() == unknown; }
110
isConstant() const111 bool isConstant() const {
112 return getLatticeValue() == constant || getLatticeValue() == forcedconstant;
113 }
114
isOverdefined() const115 bool isOverdefined() const { return getLatticeValue() == overdefined; }
116
getConstant() const117 Constant *getConstant() const {
118 assert(isConstant() && "Cannot get the constant of a non-constant!");
119 return Val.getPointer();
120 }
121
122 /// markOverdefined - Return true if this is a change in status.
markOverdefined()123 bool markOverdefined() {
124 if (isOverdefined())
125 return false;
126
127 Val.setInt(overdefined);
128 return true;
129 }
130
131 /// markConstant - Return true if this is a change in status.
markConstant(Constant * V)132 bool markConstant(Constant *V) {
133 if (getLatticeValue() == constant) { // Constant but not forcedconstant.
134 assert(getConstant() == V && "Marking constant with different value");
135 return false;
136 }
137
138 if (isUnknown()) {
139 Val.setInt(constant);
140 assert(V && "Marking constant with NULL");
141 Val.setPointer(V);
142 } else {
143 assert(getLatticeValue() == forcedconstant &&
144 "Cannot move from overdefined to constant!");
145 // Stay at forcedconstant if the constant is the same.
146 if (V == getConstant()) return false;
147
148 // Otherwise, we go to overdefined. Assumptions made based on the
149 // forced value are possibly wrong. Assuming this is another constant
150 // could expose a contradiction.
151 Val.setInt(overdefined);
152 }
153 return true;
154 }
155
156 /// getConstantInt - If this is a constant with a ConstantInt value, return it
157 /// otherwise return null.
getConstantInt() const158 ConstantInt *getConstantInt() const {
159 if (isConstant())
160 return dyn_cast<ConstantInt>(getConstant());
161 return nullptr;
162 }
163
164 /// getBlockAddress - If this is a constant with a BlockAddress value, return
165 /// it, otherwise return null.
getBlockAddress() const166 BlockAddress *getBlockAddress() const {
167 if (isConstant())
168 return dyn_cast<BlockAddress>(getConstant());
169 return nullptr;
170 }
171
markForcedConstant(Constant * V)172 void markForcedConstant(Constant *V) {
173 assert(isUnknown() && "Can't force a defined value!");
174 Val.setInt(forcedconstant);
175 Val.setPointer(V);
176 }
177
toValueLattice() const178 ValueLatticeElement toValueLattice() const {
179 if (isOverdefined())
180 return ValueLatticeElement::getOverdefined();
181 if (isConstant())
182 return ValueLatticeElement::get(getConstant());
183 return ValueLatticeElement();
184 }
185 };
186
187 //===----------------------------------------------------------------------===//
188 //
189 /// SCCPSolver - This class is a general purpose solver for Sparse Conditional
190 /// Constant Propagation.
191 ///
192 class SCCPSolver : public InstVisitor<SCCPSolver> {
193 const DataLayout &DL;
194 const TargetLibraryInfo *TLI;
195 SmallPtrSet<BasicBlock *, 8> BBExecutable; // The BBs that are executable.
196 DenseMap<Value *, LatticeVal> ValueState; // The state each value is in.
197 // The state each parameter is in.
198 DenseMap<Value *, ValueLatticeElement> ParamState;
199
200 /// StructValueState - This maintains ValueState for values that have
201 /// StructType, for example for formal arguments, calls, insertelement, etc.
202 DenseMap<std::pair<Value *, unsigned>, LatticeVal> StructValueState;
203
204 /// GlobalValue - If we are tracking any values for the contents of a global
205 /// variable, we keep a mapping from the constant accessor to the element of
206 /// the global, to the currently known value. If the value becomes
207 /// overdefined, it's entry is simply removed from this map.
208 DenseMap<GlobalVariable *, LatticeVal> TrackedGlobals;
209
210 /// TrackedRetVals - If we are tracking arguments into and the return
211 /// value out of a function, it will have an entry in this map, indicating
212 /// what the known return value for the function is.
213 DenseMap<Function *, LatticeVal> TrackedRetVals;
214
215 /// TrackedMultipleRetVals - Same as TrackedRetVals, but used for functions
216 /// that return multiple values.
217 DenseMap<std::pair<Function *, unsigned>, LatticeVal> TrackedMultipleRetVals;
218
219 /// MRVFunctionsTracked - Each function in TrackedMultipleRetVals is
220 /// represented here for efficient lookup.
221 SmallPtrSet<Function *, 16> MRVFunctionsTracked;
222
223 /// MustTailFunctions - Each function here is a callee of non-removable
224 /// musttail call site.
225 SmallPtrSet<Function *, 16> MustTailCallees;
226
227 /// TrackingIncomingArguments - This is the set of functions for whose
228 /// arguments we make optimistic assumptions about and try to prove as
229 /// constants.
230 SmallPtrSet<Function *, 16> TrackingIncomingArguments;
231
232 /// The reason for two worklists is that overdefined is the lowest state
233 /// on the lattice, and moving things to overdefined as fast as possible
234 /// makes SCCP converge much faster.
235 ///
236 /// By having a separate worklist, we accomplish this because everything
237 /// possibly overdefined will become overdefined at the soonest possible
238 /// point.
239 SmallVector<Value *, 64> OverdefinedInstWorkList;
240 SmallVector<Value *, 64> InstWorkList;
241
242 // The BasicBlock work list
243 SmallVector<BasicBlock *, 64> BBWorkList;
244
245 /// KnownFeasibleEdges - Entries in this set are edges which have already had
246 /// PHI nodes retriggered.
247 using Edge = std::pair<BasicBlock *, BasicBlock *>;
248 DenseSet<Edge> KnownFeasibleEdges;
249
250 DenseMap<Function *, AnalysisResultsForFn> AnalysisResults;
251 DenseMap<Value *, SmallPtrSet<User *, 2>> AdditionalUsers;
252
253 public:
addAnalysis(Function & F,AnalysisResultsForFn A)254 void addAnalysis(Function &F, AnalysisResultsForFn A) {
255 AnalysisResults.insert({&F, std::move(A)});
256 }
257
getPredicateInfoFor(Instruction * I)258 const PredicateBase *getPredicateInfoFor(Instruction *I) {
259 auto A = AnalysisResults.find(I->getParent()->getParent());
260 if (A == AnalysisResults.end())
261 return nullptr;
262 return A->second.PredInfo->getPredicateInfoFor(I);
263 }
264
getDTU(Function & F)265 DomTreeUpdater getDTU(Function &F) {
266 auto A = AnalysisResults.find(&F);
267 assert(A != AnalysisResults.end() && "Need analysis results for function.");
268 return {A->second.DT, A->second.PDT, DomTreeUpdater::UpdateStrategy::Lazy};
269 }
270
SCCPSolver(const DataLayout & DL,const TargetLibraryInfo * tli)271 SCCPSolver(const DataLayout &DL, const TargetLibraryInfo *tli)
272 : DL(DL), TLI(tli) {}
273
274 /// MarkBlockExecutable - This method can be used by clients to mark all of
275 /// the blocks that are known to be intrinsically live in the processed unit.
276 ///
277 /// This returns true if the block was not considered live before.
MarkBlockExecutable(BasicBlock * BB)278 bool MarkBlockExecutable(BasicBlock *BB) {
279 if (!BBExecutable.insert(BB).second)
280 return false;
281 LLVM_DEBUG(dbgs() << "Marking Block Executable: " << BB->getName() << '\n');
282 BBWorkList.push_back(BB); // Add the block to the work list!
283 return true;
284 }
285
286 /// TrackValueOfGlobalVariable - Clients can use this method to
287 /// inform the SCCPSolver that it should track loads and stores to the
288 /// specified global variable if it can. This is only legal to call if
289 /// performing Interprocedural SCCP.
TrackValueOfGlobalVariable(GlobalVariable * GV)290 void TrackValueOfGlobalVariable(GlobalVariable *GV) {
291 // We only track the contents of scalar globals.
292 if (GV->getValueType()->isSingleValueType()) {
293 LatticeVal &IV = TrackedGlobals[GV];
294 if (!isa<UndefValue>(GV->getInitializer()))
295 IV.markConstant(GV->getInitializer());
296 }
297 }
298
299 /// AddTrackedFunction - If the SCCP solver is supposed to track calls into
300 /// and out of the specified function (which cannot have its address taken),
301 /// this method must be called.
AddTrackedFunction(Function * F)302 void AddTrackedFunction(Function *F) {
303 // Add an entry, F -> undef.
304 if (auto *STy = dyn_cast<StructType>(F->getReturnType())) {
305 MRVFunctionsTracked.insert(F);
306 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i)
307 TrackedMultipleRetVals.insert(std::make_pair(std::make_pair(F, i),
308 LatticeVal()));
309 } else
310 TrackedRetVals.insert(std::make_pair(F, LatticeVal()));
311 }
312
313 /// AddMustTailCallee - If the SCCP solver finds that this function is called
314 /// from non-removable musttail call site.
AddMustTailCallee(Function * F)315 void AddMustTailCallee(Function *F) {
316 MustTailCallees.insert(F);
317 }
318
319 /// Returns true if the given function is called from non-removable musttail
320 /// call site.
isMustTailCallee(Function * F)321 bool isMustTailCallee(Function *F) {
322 return MustTailCallees.count(F);
323 }
324
AddArgumentTrackedFunction(Function * F)325 void AddArgumentTrackedFunction(Function *F) {
326 TrackingIncomingArguments.insert(F);
327 }
328
329 /// Returns true if the given function is in the solver's set of
330 /// argument-tracked functions.
isArgumentTrackedFunction(Function * F)331 bool isArgumentTrackedFunction(Function *F) {
332 return TrackingIncomingArguments.count(F);
333 }
334
335 /// Solve - Solve for constants and executable blocks.
336 void Solve();
337
338 /// ResolvedUndefsIn - While solving the dataflow for a function, we assume
339 /// that branches on undef values cannot reach any of their successors.
340 /// However, this is not a safe assumption. After we solve dataflow, this
341 /// method should be use to handle this. If this returns true, the solver
342 /// should be rerun.
343 bool ResolvedUndefsIn(Function &F);
344
isBlockExecutable(BasicBlock * BB) const345 bool isBlockExecutable(BasicBlock *BB) const {
346 return BBExecutable.count(BB);
347 }
348
349 // isEdgeFeasible - Return true if the control flow edge from the 'From' basic
350 // block to the 'To' basic block is currently feasible.
351 bool isEdgeFeasible(BasicBlock *From, BasicBlock *To);
352
getStructLatticeValueFor(Value * V) const353 std::vector<LatticeVal> getStructLatticeValueFor(Value *V) const {
354 std::vector<LatticeVal> StructValues;
355 auto *STy = dyn_cast<StructType>(V->getType());
356 assert(STy && "getStructLatticeValueFor() can be called only on structs");
357 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i) {
358 auto I = StructValueState.find(std::make_pair(V, i));
359 assert(I != StructValueState.end() && "Value not in valuemap!");
360 StructValues.push_back(I->second);
361 }
362 return StructValues;
363 }
364
getLatticeValueFor(Value * V) const365 const LatticeVal &getLatticeValueFor(Value *V) const {
366 assert(!V->getType()->isStructTy() &&
367 "Should use getStructLatticeValueFor");
368 DenseMap<Value *, LatticeVal>::const_iterator I = ValueState.find(V);
369 assert(I != ValueState.end() &&
370 "V not found in ValueState nor Paramstate map!");
371 return I->second;
372 }
373
374 /// getTrackedRetVals - Get the inferred return value map.
getTrackedRetVals()375 const DenseMap<Function*, LatticeVal> &getTrackedRetVals() {
376 return TrackedRetVals;
377 }
378
379 /// getTrackedGlobals - Get and return the set of inferred initializers for
380 /// global variables.
getTrackedGlobals()381 const DenseMap<GlobalVariable*, LatticeVal> &getTrackedGlobals() {
382 return TrackedGlobals;
383 }
384
385 /// getMRVFunctionsTracked - Get the set of functions which return multiple
386 /// values tracked by the pass.
getMRVFunctionsTracked()387 const SmallPtrSet<Function *, 16> getMRVFunctionsTracked() {
388 return MRVFunctionsTracked;
389 }
390
391 /// getMustTailCallees - Get the set of functions which are called
392 /// from non-removable musttail call sites.
getMustTailCallees()393 const SmallPtrSet<Function *, 16> getMustTailCallees() {
394 return MustTailCallees;
395 }
396
397 /// markOverdefined - Mark the specified value overdefined. This
398 /// works with both scalars and structs.
markOverdefined(Value * V)399 void markOverdefined(Value *V) {
400 if (auto *STy = dyn_cast<StructType>(V->getType()))
401 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i)
402 markOverdefined(getStructValueState(V, i), V);
403 else
404 markOverdefined(ValueState[V], V);
405 }
406
407 // isStructLatticeConstant - Return true if all the lattice values
408 // corresponding to elements of the structure are not overdefined,
409 // false otherwise.
isStructLatticeConstant(Function * F,StructType * STy)410 bool isStructLatticeConstant(Function *F, StructType *STy) {
411 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i) {
412 const auto &It = TrackedMultipleRetVals.find(std::make_pair(F, i));
413 assert(It != TrackedMultipleRetVals.end());
414 LatticeVal LV = It->second;
415 if (LV.isOverdefined())
416 return false;
417 }
418 return true;
419 }
420
421 private:
422 // pushToWorkList - Helper for markConstant/markForcedConstant/markOverdefined
pushToWorkList(LatticeVal & IV,Value * V)423 void pushToWorkList(LatticeVal &IV, Value *V) {
424 if (IV.isOverdefined())
425 return OverdefinedInstWorkList.push_back(V);
426 InstWorkList.push_back(V);
427 }
428
429 // markConstant - Make a value be marked as "constant". If the value
430 // is not already a constant, add it to the instruction work list so that
431 // the users of the instruction are updated later.
markConstant(LatticeVal & IV,Value * V,Constant * C)432 bool markConstant(LatticeVal &IV, Value *V, Constant *C) {
433 if (!IV.markConstant(C)) return false;
434 LLVM_DEBUG(dbgs() << "markConstant: " << *C << ": " << *V << '\n');
435 pushToWorkList(IV, V);
436 return true;
437 }
438
markConstant(Value * V,Constant * C)439 bool markConstant(Value *V, Constant *C) {
440 assert(!V->getType()->isStructTy() && "structs should use mergeInValue");
441 return markConstant(ValueState[V], V, C);
442 }
443
markForcedConstant(Value * V,Constant * C)444 void markForcedConstant(Value *V, Constant *C) {
445 assert(!V->getType()->isStructTy() && "structs should use mergeInValue");
446 LatticeVal &IV = ValueState[V];
447 IV.markForcedConstant(C);
448 LLVM_DEBUG(dbgs() << "markForcedConstant: " << *C << ": " << *V << '\n');
449 pushToWorkList(IV, V);
450 }
451
452 // markOverdefined - Make a value be marked as "overdefined". If the
453 // value is not already overdefined, add it to the overdefined instruction
454 // work list so that the users of the instruction are updated later.
markOverdefined(LatticeVal & IV,Value * V)455 bool markOverdefined(LatticeVal &IV, Value *V) {
456 if (!IV.markOverdefined()) return false;
457
458 LLVM_DEBUG(dbgs() << "markOverdefined: ";
459 if (auto *F = dyn_cast<Function>(V)) dbgs()
460 << "Function '" << F->getName() << "'\n";
461 else dbgs() << *V << '\n');
462 // Only instructions go on the work list
463 pushToWorkList(IV, V);
464 return true;
465 }
466
mergeInValue(LatticeVal & IV,Value * V,LatticeVal MergeWithV)467 bool mergeInValue(LatticeVal &IV, Value *V, LatticeVal MergeWithV) {
468 if (IV.isOverdefined() || MergeWithV.isUnknown())
469 return false; // Noop.
470 if (MergeWithV.isOverdefined())
471 return markOverdefined(IV, V);
472 if (IV.isUnknown())
473 return markConstant(IV, V, MergeWithV.getConstant());
474 if (IV.getConstant() != MergeWithV.getConstant())
475 return markOverdefined(IV, V);
476 return false;
477 }
478
mergeInValue(Value * V,LatticeVal MergeWithV)479 bool mergeInValue(Value *V, LatticeVal MergeWithV) {
480 assert(!V->getType()->isStructTy() &&
481 "non-structs should use markConstant");
482 return mergeInValue(ValueState[V], V, MergeWithV);
483 }
484
485 /// getValueState - Return the LatticeVal object that corresponds to the
486 /// value. This function handles the case when the value hasn't been seen yet
487 /// by properly seeding constants etc.
getValueState(Value * V)488 LatticeVal &getValueState(Value *V) {
489 assert(!V->getType()->isStructTy() && "Should use getStructValueState");
490
491 std::pair<DenseMap<Value*, LatticeVal>::iterator, bool> I =
492 ValueState.insert(std::make_pair(V, LatticeVal()));
493 LatticeVal &LV = I.first->second;
494
495 if (!I.second)
496 return LV; // Common case, already in the map.
497
498 if (auto *C = dyn_cast<Constant>(V)) {
499 // Undef values remain unknown.
500 if (!isa<UndefValue>(V))
501 LV.markConstant(C); // Constants are constant
502 }
503
504 // All others are underdefined by default.
505 return LV;
506 }
507
getParamState(Value * V)508 ValueLatticeElement &getParamState(Value *V) {
509 assert(!V->getType()->isStructTy() && "Should use getStructValueState");
510
511 std::pair<DenseMap<Value*, ValueLatticeElement>::iterator, bool>
512 PI = ParamState.insert(std::make_pair(V, ValueLatticeElement()));
513 ValueLatticeElement &LV = PI.first->second;
514 if (PI.second)
515 LV = getValueState(V).toValueLattice();
516
517 return LV;
518 }
519
520 /// getStructValueState - Return the LatticeVal object that corresponds to the
521 /// value/field pair. This function handles the case when the value hasn't
522 /// been seen yet by properly seeding constants etc.
getStructValueState(Value * V,unsigned i)523 LatticeVal &getStructValueState(Value *V, unsigned i) {
524 assert(V->getType()->isStructTy() && "Should use getValueState");
525 assert(i < cast<StructType>(V->getType())->getNumElements() &&
526 "Invalid element #");
527
528 std::pair<DenseMap<std::pair<Value*, unsigned>, LatticeVal>::iterator,
529 bool> I = StructValueState.insert(
530 std::make_pair(std::make_pair(V, i), LatticeVal()));
531 LatticeVal &LV = I.first->second;
532
533 if (!I.second)
534 return LV; // Common case, already in the map.
535
536 if (auto *C = dyn_cast<Constant>(V)) {
537 Constant *Elt = C->getAggregateElement(i);
538
539 if (!Elt)
540 LV.markOverdefined(); // Unknown sort of constant.
541 else if (isa<UndefValue>(Elt))
542 ; // Undef values remain unknown.
543 else
544 LV.markConstant(Elt); // Constants are constant.
545 }
546
547 // All others are underdefined by default.
548 return LV;
549 }
550
551 /// markEdgeExecutable - Mark a basic block as executable, adding it to the BB
552 /// work list if it is not already executable.
markEdgeExecutable(BasicBlock * Source,BasicBlock * Dest)553 bool markEdgeExecutable(BasicBlock *Source, BasicBlock *Dest) {
554 if (!KnownFeasibleEdges.insert(Edge(Source, Dest)).second)
555 return false; // This edge is already known to be executable!
556
557 if (!MarkBlockExecutable(Dest)) {
558 // If the destination is already executable, we just made an *edge*
559 // feasible that wasn't before. Revisit the PHI nodes in the block
560 // because they have potentially new operands.
561 LLVM_DEBUG(dbgs() << "Marking Edge Executable: " << Source->getName()
562 << " -> " << Dest->getName() << '\n');
563
564 for (PHINode &PN : Dest->phis())
565 visitPHINode(PN);
566 }
567 return true;
568 }
569
570 // getFeasibleSuccessors - Return a vector of booleans to indicate which
571 // successors are reachable from a given terminator instruction.
572 void getFeasibleSuccessors(Instruction &TI, SmallVectorImpl<bool> &Succs);
573
574 // OperandChangedState - This method is invoked on all of the users of an
575 // instruction that was just changed state somehow. Based on this
576 // information, we need to update the specified user of this instruction.
OperandChangedState(Instruction * I)577 void OperandChangedState(Instruction *I) {
578 if (BBExecutable.count(I->getParent())) // Inst is executable?
579 visit(*I);
580 }
581
582 // Add U as additional user of V.
addAdditionalUser(Value * V,User * U)583 void addAdditionalUser(Value *V, User *U) {
584 auto Iter = AdditionalUsers.insert({V, {}});
585 Iter.first->second.insert(U);
586 }
587
588 // Mark I's users as changed, including AdditionalUsers.
markUsersAsChanged(Value * I)589 void markUsersAsChanged(Value *I) {
590 for (User *U : I->users())
591 if (auto *UI = dyn_cast<Instruction>(U))
592 OperandChangedState(UI);
593
594 auto Iter = AdditionalUsers.find(I);
595 if (Iter != AdditionalUsers.end()) {
596 for (User *U : Iter->second)
597 if (auto *UI = dyn_cast<Instruction>(U))
598 OperandChangedState(UI);
599 }
600 }
601
602 private:
603 friend class InstVisitor<SCCPSolver>;
604
605 // visit implementations - Something changed in this instruction. Either an
606 // operand made a transition, or the instruction is newly executable. Change
607 // the value type of I to reflect these changes if appropriate.
608 void visitPHINode(PHINode &I);
609
610 // Terminators
611
612 void visitReturnInst(ReturnInst &I);
613 void visitTerminator(Instruction &TI);
614
615 void visitCastInst(CastInst &I);
616 void visitSelectInst(SelectInst &I);
617 void visitBinaryOperator(Instruction &I);
618 void visitCmpInst(CmpInst &I);
619 void visitExtractValueInst(ExtractValueInst &EVI);
620 void visitInsertValueInst(InsertValueInst &IVI);
621
visitCatchSwitchInst(CatchSwitchInst & CPI)622 void visitCatchSwitchInst(CatchSwitchInst &CPI) {
623 markOverdefined(&CPI);
624 visitTerminator(CPI);
625 }
626
627 // Instructions that cannot be folded away.
628
629 void visitStoreInst (StoreInst &I);
630 void visitLoadInst (LoadInst &I);
631 void visitGetElementPtrInst(GetElementPtrInst &I);
632
visitCallInst(CallInst & I)633 void visitCallInst (CallInst &I) {
634 visitCallSite(&I);
635 }
636
visitInvokeInst(InvokeInst & II)637 void visitInvokeInst (InvokeInst &II) {
638 visitCallSite(&II);
639 visitTerminator(II);
640 }
641
642 void visitCallSite (CallSite CS);
visitResumeInst(ResumeInst & I)643 void visitResumeInst (ResumeInst &I) { /*returns void*/ }
visitUnreachableInst(UnreachableInst & I)644 void visitUnreachableInst(UnreachableInst &I) { /*returns void*/ }
visitFenceInst(FenceInst & I)645 void visitFenceInst (FenceInst &I) { /*returns void*/ }
646
visitInstruction(Instruction & I)647 void visitInstruction(Instruction &I) {
648 // All the instructions we don't do any special handling for just
649 // go to overdefined.
650 LLVM_DEBUG(dbgs() << "SCCP: Don't know how to handle: " << I << '\n');
651 markOverdefined(&I);
652 }
653 };
654
655 } // end anonymous namespace
656
657 // getFeasibleSuccessors - Return a vector of booleans to indicate which
658 // successors are reachable from a given terminator instruction.
getFeasibleSuccessors(Instruction & TI,SmallVectorImpl<bool> & Succs)659 void SCCPSolver::getFeasibleSuccessors(Instruction &TI,
660 SmallVectorImpl<bool> &Succs) {
661 Succs.resize(TI.getNumSuccessors());
662 if (auto *BI = dyn_cast<BranchInst>(&TI)) {
663 if (BI->isUnconditional()) {
664 Succs[0] = true;
665 return;
666 }
667
668 LatticeVal BCValue = getValueState(BI->getCondition());
669 ConstantInt *CI = BCValue.getConstantInt();
670 if (!CI) {
671 // Overdefined condition variables, and branches on unfoldable constant
672 // conditions, mean the branch could go either way.
673 if (!BCValue.isUnknown())
674 Succs[0] = Succs[1] = true;
675 return;
676 }
677
678 // Constant condition variables mean the branch can only go a single way.
679 Succs[CI->isZero()] = true;
680 return;
681 }
682
683 // Unwinding instructions successors are always executable.
684 if (TI.isExceptionalTerminator()) {
685 Succs.assign(TI.getNumSuccessors(), true);
686 return;
687 }
688
689 if (auto *SI = dyn_cast<SwitchInst>(&TI)) {
690 if (!SI->getNumCases()) {
691 Succs[0] = true;
692 return;
693 }
694 LatticeVal SCValue = getValueState(SI->getCondition());
695 ConstantInt *CI = SCValue.getConstantInt();
696
697 if (!CI) { // Overdefined or unknown condition?
698 // All destinations are executable!
699 if (!SCValue.isUnknown())
700 Succs.assign(TI.getNumSuccessors(), true);
701 return;
702 }
703
704 Succs[SI->findCaseValue(CI)->getSuccessorIndex()] = true;
705 return;
706 }
707
708 // In case of indirect branch and its address is a blockaddress, we mark
709 // the target as executable.
710 if (auto *IBR = dyn_cast<IndirectBrInst>(&TI)) {
711 // Casts are folded by visitCastInst.
712 LatticeVal IBRValue = getValueState(IBR->getAddress());
713 BlockAddress *Addr = IBRValue.getBlockAddress();
714 if (!Addr) { // Overdefined or unknown condition?
715 // All destinations are executable!
716 if (!IBRValue.isUnknown())
717 Succs.assign(TI.getNumSuccessors(), true);
718 return;
719 }
720
721 BasicBlock* T = Addr->getBasicBlock();
722 assert(Addr->getFunction() == T->getParent() &&
723 "Block address of a different function ?");
724 for (unsigned i = 0; i < IBR->getNumSuccessors(); ++i) {
725 // This is the target.
726 if (IBR->getDestination(i) == T) {
727 Succs[i] = true;
728 return;
729 }
730 }
731
732 // If we didn't find our destination in the IBR successor list, then we
733 // have undefined behavior. Its ok to assume no successor is executable.
734 return;
735 }
736
737 LLVM_DEBUG(dbgs() << "Unknown terminator instruction: " << TI << '\n');
738 llvm_unreachable("SCCP: Don't know how to handle this terminator!");
739 }
740
741 // isEdgeFeasible - Return true if the control flow edge from the 'From' basic
742 // block to the 'To' basic block is currently feasible.
isEdgeFeasible(BasicBlock * From,BasicBlock * To)743 bool SCCPSolver::isEdgeFeasible(BasicBlock *From, BasicBlock *To) {
744 // Check if we've called markEdgeExecutable on the edge yet. (We could
745 // be more aggressive and try to consider edges which haven't been marked
746 // yet, but there isn't any need.)
747 return KnownFeasibleEdges.count(Edge(From, To));
748 }
749
750 // visit Implementations - Something changed in this instruction, either an
751 // operand made a transition, or the instruction is newly executable. Change
752 // the value type of I to reflect these changes if appropriate. This method
753 // makes sure to do the following actions:
754 //
755 // 1. If a phi node merges two constants in, and has conflicting value coming
756 // from different branches, or if the PHI node merges in an overdefined
757 // value, then the PHI node becomes overdefined.
758 // 2. If a phi node merges only constants in, and they all agree on value, the
759 // PHI node becomes a constant value equal to that.
760 // 3. If V <- x (op) y && isConstant(x) && isConstant(y) V = Constant
761 // 4. If V <- x (op) y && (isOverdefined(x) || isOverdefined(y)) V = Overdefined
762 // 5. If V <- MEM or V <- CALL or V <- (unknown) then V = Overdefined
763 // 6. If a conditional branch has a value that is constant, make the selected
764 // destination executable
765 // 7. If a conditional branch has a value that is overdefined, make all
766 // successors executable.
visitPHINode(PHINode & PN)767 void SCCPSolver::visitPHINode(PHINode &PN) {
768 // If this PN returns a struct, just mark the result overdefined.
769 // TODO: We could do a lot better than this if code actually uses this.
770 if (PN.getType()->isStructTy())
771 return (void)markOverdefined(&PN);
772
773 if (getValueState(&PN).isOverdefined())
774 return; // Quick exit
775
776 // Super-extra-high-degree PHI nodes are unlikely to ever be marked constant,
777 // and slow us down a lot. Just mark them overdefined.
778 if (PN.getNumIncomingValues() > 64)
779 return (void)markOverdefined(&PN);
780
781 // Look at all of the executable operands of the PHI node. If any of them
782 // are overdefined, the PHI becomes overdefined as well. If they are all
783 // constant, and they agree with each other, the PHI becomes the identical
784 // constant. If they are constant and don't agree, the PHI is overdefined.
785 // If there are no executable operands, the PHI remains unknown.
786 Constant *OperandVal = nullptr;
787 for (unsigned i = 0, e = PN.getNumIncomingValues(); i != e; ++i) {
788 LatticeVal IV = getValueState(PN.getIncomingValue(i));
789 if (IV.isUnknown()) continue; // Doesn't influence PHI node.
790
791 if (!isEdgeFeasible(PN.getIncomingBlock(i), PN.getParent()))
792 continue;
793
794 if (IV.isOverdefined()) // PHI node becomes overdefined!
795 return (void)markOverdefined(&PN);
796
797 if (!OperandVal) { // Grab the first value.
798 OperandVal = IV.getConstant();
799 continue;
800 }
801
802 // There is already a reachable operand. If we conflict with it,
803 // then the PHI node becomes overdefined. If we agree with it, we
804 // can continue on.
805
806 // Check to see if there are two different constants merging, if so, the PHI
807 // node is overdefined.
808 if (IV.getConstant() != OperandVal)
809 return (void)markOverdefined(&PN);
810 }
811
812 // If we exited the loop, this means that the PHI node only has constant
813 // arguments that agree with each other(and OperandVal is the constant) or
814 // OperandVal is null because there are no defined incoming arguments. If
815 // this is the case, the PHI remains unknown.
816 if (OperandVal)
817 markConstant(&PN, OperandVal); // Acquire operand value
818 }
819
visitReturnInst(ReturnInst & I)820 void SCCPSolver::visitReturnInst(ReturnInst &I) {
821 if (I.getNumOperands() == 0) return; // ret void
822
823 Function *F = I.getParent()->getParent();
824 Value *ResultOp = I.getOperand(0);
825
826 // If we are tracking the return value of this function, merge it in.
827 if (!TrackedRetVals.empty() && !ResultOp->getType()->isStructTy()) {
828 DenseMap<Function*, LatticeVal>::iterator TFRVI =
829 TrackedRetVals.find(F);
830 if (TFRVI != TrackedRetVals.end()) {
831 mergeInValue(TFRVI->second, F, getValueState(ResultOp));
832 return;
833 }
834 }
835
836 // Handle functions that return multiple values.
837 if (!TrackedMultipleRetVals.empty()) {
838 if (auto *STy = dyn_cast<StructType>(ResultOp->getType()))
839 if (MRVFunctionsTracked.count(F))
840 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i)
841 mergeInValue(TrackedMultipleRetVals[std::make_pair(F, i)], F,
842 getStructValueState(ResultOp, i));
843 }
844 }
845
visitTerminator(Instruction & TI)846 void SCCPSolver::visitTerminator(Instruction &TI) {
847 SmallVector<bool, 16> SuccFeasible;
848 getFeasibleSuccessors(TI, SuccFeasible);
849
850 BasicBlock *BB = TI.getParent();
851
852 // Mark all feasible successors executable.
853 for (unsigned i = 0, e = SuccFeasible.size(); i != e; ++i)
854 if (SuccFeasible[i])
855 markEdgeExecutable(BB, TI.getSuccessor(i));
856 }
857
visitCastInst(CastInst & I)858 void SCCPSolver::visitCastInst(CastInst &I) {
859 LatticeVal OpSt = getValueState(I.getOperand(0));
860 if (OpSt.isOverdefined()) // Inherit overdefinedness of operand
861 markOverdefined(&I);
862 else if (OpSt.isConstant()) {
863 // Fold the constant as we build.
864 Constant *C = ConstantFoldCastOperand(I.getOpcode(), OpSt.getConstant(),
865 I.getType(), DL);
866 if (isa<UndefValue>(C))
867 return;
868 // Propagate constant value
869 markConstant(&I, C);
870 }
871 }
872
visitExtractValueInst(ExtractValueInst & EVI)873 void SCCPSolver::visitExtractValueInst(ExtractValueInst &EVI) {
874 // If this returns a struct, mark all elements over defined, we don't track
875 // structs in structs.
876 if (EVI.getType()->isStructTy())
877 return (void)markOverdefined(&EVI);
878
879 // If this is extracting from more than one level of struct, we don't know.
880 if (EVI.getNumIndices() != 1)
881 return (void)markOverdefined(&EVI);
882
883 Value *AggVal = EVI.getAggregateOperand();
884 if (AggVal->getType()->isStructTy()) {
885 unsigned i = *EVI.idx_begin();
886 LatticeVal EltVal = getStructValueState(AggVal, i);
887 mergeInValue(getValueState(&EVI), &EVI, EltVal);
888 } else {
889 // Otherwise, must be extracting from an array.
890 return (void)markOverdefined(&EVI);
891 }
892 }
893
visitInsertValueInst(InsertValueInst & IVI)894 void SCCPSolver::visitInsertValueInst(InsertValueInst &IVI) {
895 auto *STy = dyn_cast<StructType>(IVI.getType());
896 if (!STy)
897 return (void)markOverdefined(&IVI);
898
899 // If this has more than one index, we can't handle it, drive all results to
900 // undef.
901 if (IVI.getNumIndices() != 1)
902 return (void)markOverdefined(&IVI);
903
904 Value *Aggr = IVI.getAggregateOperand();
905 unsigned Idx = *IVI.idx_begin();
906
907 // Compute the result based on what we're inserting.
908 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i) {
909 // This passes through all values that aren't the inserted element.
910 if (i != Idx) {
911 LatticeVal EltVal = getStructValueState(Aggr, i);
912 mergeInValue(getStructValueState(&IVI, i), &IVI, EltVal);
913 continue;
914 }
915
916 Value *Val = IVI.getInsertedValueOperand();
917 if (Val->getType()->isStructTy())
918 // We don't track structs in structs.
919 markOverdefined(getStructValueState(&IVI, i), &IVI);
920 else {
921 LatticeVal InVal = getValueState(Val);
922 mergeInValue(getStructValueState(&IVI, i), &IVI, InVal);
923 }
924 }
925 }
926
visitSelectInst(SelectInst & I)927 void SCCPSolver::visitSelectInst(SelectInst &I) {
928 // If this select returns a struct, just mark the result overdefined.
929 // TODO: We could do a lot better than this if code actually uses this.
930 if (I.getType()->isStructTy())
931 return (void)markOverdefined(&I);
932
933 LatticeVal CondValue = getValueState(I.getCondition());
934 if (CondValue.isUnknown())
935 return;
936
937 if (ConstantInt *CondCB = CondValue.getConstantInt()) {
938 Value *OpVal = CondCB->isZero() ? I.getFalseValue() : I.getTrueValue();
939 mergeInValue(&I, getValueState(OpVal));
940 return;
941 }
942
943 // Otherwise, the condition is overdefined or a constant we can't evaluate.
944 // See if we can produce something better than overdefined based on the T/F
945 // value.
946 LatticeVal TVal = getValueState(I.getTrueValue());
947 LatticeVal FVal = getValueState(I.getFalseValue());
948
949 // select ?, C, C -> C.
950 if (TVal.isConstant() && FVal.isConstant() &&
951 TVal.getConstant() == FVal.getConstant())
952 return (void)markConstant(&I, FVal.getConstant());
953
954 if (TVal.isUnknown()) // select ?, undef, X -> X.
955 return (void)mergeInValue(&I, FVal);
956 if (FVal.isUnknown()) // select ?, X, undef -> X.
957 return (void)mergeInValue(&I, TVal);
958 markOverdefined(&I);
959 }
960
961 // Handle Binary Operators.
visitBinaryOperator(Instruction & I)962 void SCCPSolver::visitBinaryOperator(Instruction &I) {
963 LatticeVal V1State = getValueState(I.getOperand(0));
964 LatticeVal V2State = getValueState(I.getOperand(1));
965
966 LatticeVal &IV = ValueState[&I];
967 if (IV.isOverdefined()) return;
968
969 if (V1State.isConstant() && V2State.isConstant()) {
970 Constant *C = ConstantExpr::get(I.getOpcode(), V1State.getConstant(),
971 V2State.getConstant());
972 // X op Y -> undef.
973 if (isa<UndefValue>(C))
974 return;
975 return (void)markConstant(IV, &I, C);
976 }
977
978 // If something is undef, wait for it to resolve.
979 if (!V1State.isOverdefined() && !V2State.isOverdefined())
980 return;
981
982 // Otherwise, one of our operands is overdefined. Try to produce something
983 // better than overdefined with some tricks.
984 // If this is 0 / Y, it doesn't matter that the second operand is
985 // overdefined, and we can replace it with zero.
986 if (I.getOpcode() == Instruction::UDiv || I.getOpcode() == Instruction::SDiv)
987 if (V1State.isConstant() && V1State.getConstant()->isNullValue())
988 return (void)markConstant(IV, &I, V1State.getConstant());
989
990 // If this is:
991 // -> AND/MUL with 0
992 // -> OR with -1
993 // it doesn't matter that the other operand is overdefined.
994 if (I.getOpcode() == Instruction::And || I.getOpcode() == Instruction::Mul ||
995 I.getOpcode() == Instruction::Or) {
996 LatticeVal *NonOverdefVal = nullptr;
997 if (!V1State.isOverdefined())
998 NonOverdefVal = &V1State;
999 else if (!V2State.isOverdefined())
1000 NonOverdefVal = &V2State;
1001
1002 if (NonOverdefVal) {
1003 if (NonOverdefVal->isUnknown())
1004 return;
1005
1006 if (I.getOpcode() == Instruction::And ||
1007 I.getOpcode() == Instruction::Mul) {
1008 // X and 0 = 0
1009 // X * 0 = 0
1010 if (NonOverdefVal->getConstant()->isNullValue())
1011 return (void)markConstant(IV, &I, NonOverdefVal->getConstant());
1012 } else {
1013 // X or -1 = -1
1014 if (ConstantInt *CI = NonOverdefVal->getConstantInt())
1015 if (CI->isMinusOne())
1016 return (void)markConstant(IV, &I, NonOverdefVal->getConstant());
1017 }
1018 }
1019 }
1020
1021 markOverdefined(&I);
1022 }
1023
1024 // Handle ICmpInst instruction.
visitCmpInst(CmpInst & I)1025 void SCCPSolver::visitCmpInst(CmpInst &I) {
1026 // Do not cache this lookup, getValueState calls later in the function might
1027 // invalidate the reference.
1028 if (ValueState[&I].isOverdefined()) return;
1029
1030 Value *Op1 = I.getOperand(0);
1031 Value *Op2 = I.getOperand(1);
1032
1033 // For parameters, use ParamState which includes constant range info if
1034 // available.
1035 auto V1Param = ParamState.find(Op1);
1036 ValueLatticeElement V1State = (V1Param != ParamState.end())
1037 ? V1Param->second
1038 : getValueState(Op1).toValueLattice();
1039
1040 auto V2Param = ParamState.find(Op2);
1041 ValueLatticeElement V2State = V2Param != ParamState.end()
1042 ? V2Param->second
1043 : getValueState(Op2).toValueLattice();
1044
1045 Constant *C = V1State.getCompare(I.getPredicate(), I.getType(), V2State);
1046 if (C) {
1047 if (isa<UndefValue>(C))
1048 return;
1049 LatticeVal CV;
1050 CV.markConstant(C);
1051 mergeInValue(&I, CV);
1052 return;
1053 }
1054
1055 // If operands are still unknown, wait for it to resolve.
1056 if (!V1State.isOverdefined() && !V2State.isOverdefined() &&
1057 !ValueState[&I].isConstant())
1058 return;
1059
1060 markOverdefined(&I);
1061 }
1062
1063 // Handle getelementptr instructions. If all operands are constants then we
1064 // can turn this into a getelementptr ConstantExpr.
visitGetElementPtrInst(GetElementPtrInst & I)1065 void SCCPSolver::visitGetElementPtrInst(GetElementPtrInst &I) {
1066 if (ValueState[&I].isOverdefined()) return;
1067
1068 SmallVector<Constant*, 8> Operands;
1069 Operands.reserve(I.getNumOperands());
1070
1071 for (unsigned i = 0, e = I.getNumOperands(); i != e; ++i) {
1072 LatticeVal State = getValueState(I.getOperand(i));
1073 if (State.isUnknown())
1074 return; // Operands are not resolved yet.
1075
1076 if (State.isOverdefined())
1077 return (void)markOverdefined(&I);
1078
1079 assert(State.isConstant() && "Unknown state!");
1080 Operands.push_back(State.getConstant());
1081 }
1082
1083 Constant *Ptr = Operands[0];
1084 auto Indices = makeArrayRef(Operands.begin() + 1, Operands.end());
1085 Constant *C =
1086 ConstantExpr::getGetElementPtr(I.getSourceElementType(), Ptr, Indices);
1087 if (isa<UndefValue>(C))
1088 return;
1089 markConstant(&I, C);
1090 }
1091
visitStoreInst(StoreInst & SI)1092 void SCCPSolver::visitStoreInst(StoreInst &SI) {
1093 // If this store is of a struct, ignore it.
1094 if (SI.getOperand(0)->getType()->isStructTy())
1095 return;
1096
1097 if (TrackedGlobals.empty() || !isa<GlobalVariable>(SI.getOperand(1)))
1098 return;
1099
1100 GlobalVariable *GV = cast<GlobalVariable>(SI.getOperand(1));
1101 DenseMap<GlobalVariable*, LatticeVal>::iterator I = TrackedGlobals.find(GV);
1102 if (I == TrackedGlobals.end() || I->second.isOverdefined()) return;
1103
1104 // Get the value we are storing into the global, then merge it.
1105 mergeInValue(I->second, GV, getValueState(SI.getOperand(0)));
1106 if (I->second.isOverdefined())
1107 TrackedGlobals.erase(I); // No need to keep tracking this!
1108 }
1109
1110 // Handle load instructions. If the operand is a constant pointer to a constant
1111 // global, we can replace the load with the loaded constant value!
visitLoadInst(LoadInst & I)1112 void SCCPSolver::visitLoadInst(LoadInst &I) {
1113 // If this load is of a struct, just mark the result overdefined.
1114 if (I.getType()->isStructTy())
1115 return (void)markOverdefined(&I);
1116
1117 LatticeVal PtrVal = getValueState(I.getOperand(0));
1118 if (PtrVal.isUnknown()) return; // The pointer is not resolved yet!
1119
1120 LatticeVal &IV = ValueState[&I];
1121 if (IV.isOverdefined()) return;
1122
1123 if (!PtrVal.isConstant() || I.isVolatile())
1124 return (void)markOverdefined(IV, &I);
1125
1126 Constant *Ptr = PtrVal.getConstant();
1127
1128 // load null is undefined.
1129 if (isa<ConstantPointerNull>(Ptr)) {
1130 if (NullPointerIsDefined(I.getFunction(), I.getPointerAddressSpace()))
1131 return (void)markOverdefined(IV, &I);
1132 else
1133 return;
1134 }
1135
1136 // Transform load (constant global) into the value loaded.
1137 if (auto *GV = dyn_cast<GlobalVariable>(Ptr)) {
1138 if (!TrackedGlobals.empty()) {
1139 // If we are tracking this global, merge in the known value for it.
1140 DenseMap<GlobalVariable*, LatticeVal>::iterator It =
1141 TrackedGlobals.find(GV);
1142 if (It != TrackedGlobals.end()) {
1143 mergeInValue(IV, &I, It->second);
1144 return;
1145 }
1146 }
1147 }
1148
1149 // Transform load from a constant into a constant if possible.
1150 if (Constant *C = ConstantFoldLoadFromConstPtr(Ptr, I.getType(), DL)) {
1151 if (isa<UndefValue>(C))
1152 return;
1153 return (void)markConstant(IV, &I, C);
1154 }
1155
1156 // Otherwise we cannot say for certain what value this load will produce.
1157 // Bail out.
1158 markOverdefined(IV, &I);
1159 }
1160
visitCallSite(CallSite CS)1161 void SCCPSolver::visitCallSite(CallSite CS) {
1162 Function *F = CS.getCalledFunction();
1163 Instruction *I = CS.getInstruction();
1164
1165 if (auto *II = dyn_cast<IntrinsicInst>(I)) {
1166 if (II->getIntrinsicID() == Intrinsic::ssa_copy) {
1167 if (ValueState[I].isOverdefined())
1168 return;
1169
1170 auto *PI = getPredicateInfoFor(I);
1171 if (!PI)
1172 return;
1173
1174 Value *CopyOf = I->getOperand(0);
1175 auto *PBranch = dyn_cast<PredicateBranch>(PI);
1176 if (!PBranch) {
1177 mergeInValue(ValueState[I], I, getValueState(CopyOf));
1178 return;
1179 }
1180
1181 Value *Cond = PBranch->Condition;
1182
1183 // Everything below relies on the condition being a comparison.
1184 auto *Cmp = dyn_cast<CmpInst>(Cond);
1185 if (!Cmp) {
1186 mergeInValue(ValueState[I], I, getValueState(CopyOf));
1187 return;
1188 }
1189
1190 Value *CmpOp0 = Cmp->getOperand(0);
1191 Value *CmpOp1 = Cmp->getOperand(1);
1192 if (CopyOf != CmpOp0 && CopyOf != CmpOp1) {
1193 mergeInValue(ValueState[I], I, getValueState(CopyOf));
1194 return;
1195 }
1196
1197 if (CmpOp0 != CopyOf)
1198 std::swap(CmpOp0, CmpOp1);
1199
1200 LatticeVal OriginalVal = getValueState(CopyOf);
1201 LatticeVal EqVal = getValueState(CmpOp1);
1202 LatticeVal &IV = ValueState[I];
1203 if (PBranch->TrueEdge && Cmp->getPredicate() == CmpInst::ICMP_EQ) {
1204 addAdditionalUser(CmpOp1, I);
1205 if (OriginalVal.isConstant())
1206 mergeInValue(IV, I, OriginalVal);
1207 else
1208 mergeInValue(IV, I, EqVal);
1209 return;
1210 }
1211 if (!PBranch->TrueEdge && Cmp->getPredicate() == CmpInst::ICMP_NE) {
1212 addAdditionalUser(CmpOp1, I);
1213 if (OriginalVal.isConstant())
1214 mergeInValue(IV, I, OriginalVal);
1215 else
1216 mergeInValue(IV, I, EqVal);
1217 return;
1218 }
1219
1220 return (void)mergeInValue(IV, I, getValueState(CopyOf));
1221 }
1222 }
1223
1224 // The common case is that we aren't tracking the callee, either because we
1225 // are not doing interprocedural analysis or the callee is indirect, or is
1226 // external. Handle these cases first.
1227 if (!F || F->isDeclaration()) {
1228 CallOverdefined:
1229 // Void return and not tracking callee, just bail.
1230 if (I->getType()->isVoidTy()) return;
1231
1232 // Otherwise, if we have a single return value case, and if the function is
1233 // a declaration, maybe we can constant fold it.
1234 if (F && F->isDeclaration() && !I->getType()->isStructTy() &&
1235 canConstantFoldCallTo(CS, F)) {
1236 SmallVector<Constant*, 8> Operands;
1237 for (CallSite::arg_iterator AI = CS.arg_begin(), E = CS.arg_end();
1238 AI != E; ++AI) {
1239 if (AI->get()->getType()->isStructTy())
1240 return markOverdefined(I); // Can't handle struct args.
1241 LatticeVal State = getValueState(*AI);
1242
1243 if (State.isUnknown())
1244 return; // Operands are not resolved yet.
1245 if (State.isOverdefined())
1246 return (void)markOverdefined(I);
1247 assert(State.isConstant() && "Unknown state!");
1248 Operands.push_back(State.getConstant());
1249 }
1250
1251 if (getValueState(I).isOverdefined())
1252 return;
1253
1254 // If we can constant fold this, mark the result of the call as a
1255 // constant.
1256 if (Constant *C = ConstantFoldCall(CS, F, Operands, TLI)) {
1257 // call -> undef.
1258 if (isa<UndefValue>(C))
1259 return;
1260 return (void)markConstant(I, C);
1261 }
1262 }
1263
1264 // Otherwise, we don't know anything about this call, mark it overdefined.
1265 return (void)markOverdefined(I);
1266 }
1267
1268 // If this is a local function that doesn't have its address taken, mark its
1269 // entry block executable and merge in the actual arguments to the call into
1270 // the formal arguments of the function.
1271 if (!TrackingIncomingArguments.empty() && TrackingIncomingArguments.count(F)){
1272 MarkBlockExecutable(&F->front());
1273
1274 // Propagate information from this call site into the callee.
1275 CallSite::arg_iterator CAI = CS.arg_begin();
1276 for (Function::arg_iterator AI = F->arg_begin(), E = F->arg_end();
1277 AI != E; ++AI, ++CAI) {
1278 // If this argument is byval, and if the function is not readonly, there
1279 // will be an implicit copy formed of the input aggregate.
1280 if (AI->hasByValAttr() && !F->onlyReadsMemory()) {
1281 markOverdefined(&*AI);
1282 continue;
1283 }
1284
1285 if (auto *STy = dyn_cast<StructType>(AI->getType())) {
1286 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i) {
1287 LatticeVal CallArg = getStructValueState(*CAI, i);
1288 mergeInValue(getStructValueState(&*AI, i), &*AI, CallArg);
1289 }
1290 } else {
1291 // Most other parts of the Solver still only use the simpler value
1292 // lattice, so we propagate changes for parameters to both lattices.
1293 LatticeVal ConcreteArgument = getValueState(*CAI);
1294 bool ParamChanged =
1295 getParamState(&*AI).mergeIn(ConcreteArgument.toValueLattice(), DL);
1296 bool ValueChanged = mergeInValue(&*AI, ConcreteArgument);
1297 // Add argument to work list, if the state of a parameter changes but
1298 // ValueState does not change (because it is already overdefined there),
1299 // We have to take changes in ParamState into account, as it is used
1300 // when evaluating Cmp instructions.
1301 if (!ValueChanged && ParamChanged)
1302 pushToWorkList(ValueState[&*AI], &*AI);
1303 }
1304 }
1305 }
1306
1307 // If this is a single/zero retval case, see if we're tracking the function.
1308 if (auto *STy = dyn_cast<StructType>(F->getReturnType())) {
1309 if (!MRVFunctionsTracked.count(F))
1310 goto CallOverdefined; // Not tracking this callee.
1311
1312 // If we are tracking this callee, propagate the result of the function
1313 // into this call site.
1314 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i)
1315 mergeInValue(getStructValueState(I, i), I,
1316 TrackedMultipleRetVals[std::make_pair(F, i)]);
1317 } else {
1318 DenseMap<Function*, LatticeVal>::iterator TFRVI = TrackedRetVals.find(F);
1319 if (TFRVI == TrackedRetVals.end())
1320 goto CallOverdefined; // Not tracking this callee.
1321
1322 // If so, propagate the return value of the callee into this call result.
1323 mergeInValue(I, TFRVI->second);
1324 }
1325 }
1326
Solve()1327 void SCCPSolver::Solve() {
1328 // Process the work lists until they are empty!
1329 while (!BBWorkList.empty() || !InstWorkList.empty() ||
1330 !OverdefinedInstWorkList.empty()) {
1331 // Process the overdefined instruction's work list first, which drives other
1332 // things to overdefined more quickly.
1333 while (!OverdefinedInstWorkList.empty()) {
1334 Value *I = OverdefinedInstWorkList.pop_back_val();
1335
1336 LLVM_DEBUG(dbgs() << "\nPopped off OI-WL: " << *I << '\n');
1337
1338 // "I" got into the work list because it either made the transition from
1339 // bottom to constant, or to overdefined.
1340 //
1341 // Anything on this worklist that is overdefined need not be visited
1342 // since all of its users will have already been marked as overdefined
1343 // Update all of the users of this instruction's value.
1344 //
1345 markUsersAsChanged(I);
1346 }
1347
1348 // Process the instruction work list.
1349 while (!InstWorkList.empty()) {
1350 Value *I = InstWorkList.pop_back_val();
1351
1352 LLVM_DEBUG(dbgs() << "\nPopped off I-WL: " << *I << '\n');
1353
1354 // "I" got into the work list because it made the transition from undef to
1355 // constant.
1356 //
1357 // Anything on this worklist that is overdefined need not be visited
1358 // since all of its users will have already been marked as overdefined.
1359 // Update all of the users of this instruction's value.
1360 //
1361 if (I->getType()->isStructTy() || !getValueState(I).isOverdefined())
1362 markUsersAsChanged(I);
1363 }
1364
1365 // Process the basic block work list.
1366 while (!BBWorkList.empty()) {
1367 BasicBlock *BB = BBWorkList.back();
1368 BBWorkList.pop_back();
1369
1370 LLVM_DEBUG(dbgs() << "\nPopped off BBWL: " << *BB << '\n');
1371
1372 // Notify all instructions in this basic block that they are newly
1373 // executable.
1374 visit(BB);
1375 }
1376 }
1377 }
1378
1379 /// ResolvedUndefsIn - While solving the dataflow for a function, we assume
1380 /// that branches on undef values cannot reach any of their successors.
1381 /// However, this is not a safe assumption. After we solve dataflow, this
1382 /// method should be use to handle this. If this returns true, the solver
1383 /// should be rerun.
1384 ///
1385 /// This method handles this by finding an unresolved branch and marking it one
1386 /// of the edges from the block as being feasible, even though the condition
1387 /// doesn't say it would otherwise be. This allows SCCP to find the rest of the
1388 /// CFG and only slightly pessimizes the analysis results (by marking one,
1389 /// potentially infeasible, edge feasible). This cannot usefully modify the
1390 /// constraints on the condition of the branch, as that would impact other users
1391 /// of the value.
1392 ///
1393 /// This scan also checks for values that use undefs, whose results are actually
1394 /// defined. For example, 'zext i8 undef to i32' should produce all zeros
1395 /// conservatively, as "(zext i8 X -> i32) & 0xFF00" must always return zero,
1396 /// even if X isn't defined.
ResolvedUndefsIn(Function & F)1397 bool SCCPSolver::ResolvedUndefsIn(Function &F) {
1398 for (BasicBlock &BB : F) {
1399 if (!BBExecutable.count(&BB))
1400 continue;
1401
1402 for (Instruction &I : BB) {
1403 // Look for instructions which produce undef values.
1404 if (I.getType()->isVoidTy()) continue;
1405
1406 if (auto *STy = dyn_cast<StructType>(I.getType())) {
1407 // Only a few things that can be structs matter for undef.
1408
1409 // Tracked calls must never be marked overdefined in ResolvedUndefsIn.
1410 if (CallSite CS = CallSite(&I))
1411 if (Function *F = CS.getCalledFunction())
1412 if (MRVFunctionsTracked.count(F))
1413 continue;
1414
1415 // extractvalue and insertvalue don't need to be marked; they are
1416 // tracked as precisely as their operands.
1417 if (isa<ExtractValueInst>(I) || isa<InsertValueInst>(I))
1418 continue;
1419
1420 // Send the results of everything else to overdefined. We could be
1421 // more precise than this but it isn't worth bothering.
1422 for (unsigned i = 0, e = STy->getNumElements(); i != e; ++i) {
1423 LatticeVal &LV = getStructValueState(&I, i);
1424 if (LV.isUnknown())
1425 markOverdefined(LV, &I);
1426 }
1427 continue;
1428 }
1429
1430 LatticeVal &LV = getValueState(&I);
1431 if (!LV.isUnknown()) continue;
1432
1433 // extractvalue is safe; check here because the argument is a struct.
1434 if (isa<ExtractValueInst>(I))
1435 continue;
1436
1437 // Compute the operand LatticeVals, for convenience below.
1438 // Anything taking a struct is conservatively assumed to require
1439 // overdefined markings.
1440 if (I.getOperand(0)->getType()->isStructTy()) {
1441 markOverdefined(&I);
1442 return true;
1443 }
1444 LatticeVal Op0LV = getValueState(I.getOperand(0));
1445 LatticeVal Op1LV;
1446 if (I.getNumOperands() == 2) {
1447 if (I.getOperand(1)->getType()->isStructTy()) {
1448 markOverdefined(&I);
1449 return true;
1450 }
1451
1452 Op1LV = getValueState(I.getOperand(1));
1453 }
1454 // If this is an instructions whose result is defined even if the input is
1455 // not fully defined, propagate the information.
1456 Type *ITy = I.getType();
1457 switch (I.getOpcode()) {
1458 case Instruction::Add:
1459 case Instruction::Sub:
1460 case Instruction::Trunc:
1461 case Instruction::FPTrunc:
1462 case Instruction::BitCast:
1463 break; // Any undef -> undef
1464 case Instruction::FSub:
1465 case Instruction::FAdd:
1466 case Instruction::FMul:
1467 case Instruction::FDiv:
1468 case Instruction::FRem:
1469 // Floating-point binary operation: be conservative.
1470 if (Op0LV.isUnknown() && Op1LV.isUnknown())
1471 markForcedConstant(&I, Constant::getNullValue(ITy));
1472 else
1473 markOverdefined(&I);
1474 return true;
1475 case Instruction::ZExt:
1476 case Instruction::SExt:
1477 case Instruction::FPToUI:
1478 case Instruction::FPToSI:
1479 case Instruction::FPExt:
1480 case Instruction::PtrToInt:
1481 case Instruction::IntToPtr:
1482 case Instruction::SIToFP:
1483 case Instruction::UIToFP:
1484 // undef -> 0; some outputs are impossible
1485 markForcedConstant(&I, Constant::getNullValue(ITy));
1486 return true;
1487 case Instruction::Mul:
1488 case Instruction::And:
1489 // Both operands undef -> undef
1490 if (Op0LV.isUnknown() && Op1LV.isUnknown())
1491 break;
1492 // undef * X -> 0. X could be zero.
1493 // undef & X -> 0. X could be zero.
1494 markForcedConstant(&I, Constant::getNullValue(ITy));
1495 return true;
1496 case Instruction::Or:
1497 // Both operands undef -> undef
1498 if (Op0LV.isUnknown() && Op1LV.isUnknown())
1499 break;
1500 // undef | X -> -1. X could be -1.
1501 markForcedConstant(&I, Constant::getAllOnesValue(ITy));
1502 return true;
1503 case Instruction::Xor:
1504 // undef ^ undef -> 0; strictly speaking, this is not strictly
1505 // necessary, but we try to be nice to people who expect this
1506 // behavior in simple cases
1507 if (Op0LV.isUnknown() && Op1LV.isUnknown()) {
1508 markForcedConstant(&I, Constant::getNullValue(ITy));
1509 return true;
1510 }
1511 // undef ^ X -> undef
1512 break;
1513 case Instruction::SDiv:
1514 case Instruction::UDiv:
1515 case Instruction::SRem:
1516 case Instruction::URem:
1517 // X / undef -> undef. No change.
1518 // X % undef -> undef. No change.
1519 if (Op1LV.isUnknown()) break;
1520
1521 // X / 0 -> undef. No change.
1522 // X % 0 -> undef. No change.
1523 if (Op1LV.isConstant() && Op1LV.getConstant()->isZeroValue())
1524 break;
1525
1526 // undef / X -> 0. X could be maxint.
1527 // undef % X -> 0. X could be 1.
1528 markForcedConstant(&I, Constant::getNullValue(ITy));
1529 return true;
1530 case Instruction::AShr:
1531 // X >>a undef -> undef.
1532 if (Op1LV.isUnknown()) break;
1533
1534 // Shifting by the bitwidth or more is undefined.
1535 if (Op1LV.isConstant()) {
1536 if (auto *ShiftAmt = Op1LV.getConstantInt())
1537 if (ShiftAmt->getLimitedValue() >=
1538 ShiftAmt->getType()->getScalarSizeInBits())
1539 break;
1540 }
1541
1542 // undef >>a X -> 0
1543 markForcedConstant(&I, Constant::getNullValue(ITy));
1544 return true;
1545 case Instruction::LShr:
1546 case Instruction::Shl:
1547 // X << undef -> undef.
1548 // X >> undef -> undef.
1549 if (Op1LV.isUnknown()) break;
1550
1551 // Shifting by the bitwidth or more is undefined.
1552 if (Op1LV.isConstant()) {
1553 if (auto *ShiftAmt = Op1LV.getConstantInt())
1554 if (ShiftAmt->getLimitedValue() >=
1555 ShiftAmt->getType()->getScalarSizeInBits())
1556 break;
1557 }
1558
1559 // undef << X -> 0
1560 // undef >> X -> 0
1561 markForcedConstant(&I, Constant::getNullValue(ITy));
1562 return true;
1563 case Instruction::Select:
1564 Op1LV = getValueState(I.getOperand(1));
1565 // undef ? X : Y -> X or Y. There could be commonality between X/Y.
1566 if (Op0LV.isUnknown()) {
1567 if (!Op1LV.isConstant()) // Pick the constant one if there is any.
1568 Op1LV = getValueState(I.getOperand(2));
1569 } else if (Op1LV.isUnknown()) {
1570 // c ? undef : undef -> undef. No change.
1571 Op1LV = getValueState(I.getOperand(2));
1572 if (Op1LV.isUnknown())
1573 break;
1574 // Otherwise, c ? undef : x -> x.
1575 } else {
1576 // Leave Op1LV as Operand(1)'s LatticeValue.
1577 }
1578
1579 if (Op1LV.isConstant())
1580 markForcedConstant(&I, Op1LV.getConstant());
1581 else
1582 markOverdefined(&I);
1583 return true;
1584 case Instruction::Load:
1585 // A load here means one of two things: a load of undef from a global,
1586 // a load from an unknown pointer. Either way, having it return undef
1587 // is okay.
1588 break;
1589 case Instruction::ICmp:
1590 // X == undef -> undef. Other comparisons get more complicated.
1591 Op0LV = getValueState(I.getOperand(0));
1592 Op1LV = getValueState(I.getOperand(1));
1593
1594 if ((Op0LV.isUnknown() || Op1LV.isUnknown()) &&
1595 cast<ICmpInst>(&I)->isEquality())
1596 break;
1597 markOverdefined(&I);
1598 return true;
1599 case Instruction::Call:
1600 case Instruction::Invoke:
1601 // There are two reasons a call can have an undef result
1602 // 1. It could be tracked.
1603 // 2. It could be constant-foldable.
1604 // Because of the way we solve return values, tracked calls must
1605 // never be marked overdefined in ResolvedUndefsIn.
1606 if (Function *F = CallSite(&I).getCalledFunction())
1607 if (TrackedRetVals.count(F))
1608 break;
1609
1610 // If the call is constant-foldable, we mark it overdefined because
1611 // we do not know what return values are valid.
1612 markOverdefined(&I);
1613 return true;
1614 default:
1615 // If we don't know what should happen here, conservatively mark it
1616 // overdefined.
1617 markOverdefined(&I);
1618 return true;
1619 }
1620 }
1621
1622 // Check to see if we have a branch or switch on an undefined value. If so
1623 // we force the branch to go one way or the other to make the successor
1624 // values live. It doesn't really matter which way we force it.
1625 Instruction *TI = BB.getTerminator();
1626 if (auto *BI = dyn_cast<BranchInst>(TI)) {
1627 if (!BI->isConditional()) continue;
1628 if (!getValueState(BI->getCondition()).isUnknown())
1629 continue;
1630
1631 // If the input to SCCP is actually branch on undef, fix the undef to
1632 // false.
1633 if (isa<UndefValue>(BI->getCondition())) {
1634 BI->setCondition(ConstantInt::getFalse(BI->getContext()));
1635 markEdgeExecutable(&BB, TI->getSuccessor(1));
1636 return true;
1637 }
1638
1639 // Otherwise, it is a branch on a symbolic value which is currently
1640 // considered to be undef. Make sure some edge is executable, so a
1641 // branch on "undef" always flows somewhere.
1642 // FIXME: Distinguish between dead code and an LLVM "undef" value.
1643 BasicBlock *DefaultSuccessor = TI->getSuccessor(1);
1644 if (markEdgeExecutable(&BB, DefaultSuccessor))
1645 return true;
1646
1647 continue;
1648 }
1649
1650 if (auto *IBR = dyn_cast<IndirectBrInst>(TI)) {
1651 // Indirect branch with no successor ?. Its ok to assume it branches
1652 // to no target.
1653 if (IBR->getNumSuccessors() < 1)
1654 continue;
1655
1656 if (!getValueState(IBR->getAddress()).isUnknown())
1657 continue;
1658
1659 // If the input to SCCP is actually branch on undef, fix the undef to
1660 // the first successor of the indirect branch.
1661 if (isa<UndefValue>(IBR->getAddress())) {
1662 IBR->setAddress(BlockAddress::get(IBR->getSuccessor(0)));
1663 markEdgeExecutable(&BB, IBR->getSuccessor(0));
1664 return true;
1665 }
1666
1667 // Otherwise, it is a branch on a symbolic value which is currently
1668 // considered to be undef. Make sure some edge is executable, so a
1669 // branch on "undef" always flows somewhere.
1670 // FIXME: IndirectBr on "undef" doesn't actually need to go anywhere:
1671 // we can assume the branch has undefined behavior instead.
1672 BasicBlock *DefaultSuccessor = IBR->getSuccessor(0);
1673 if (markEdgeExecutable(&BB, DefaultSuccessor))
1674 return true;
1675
1676 continue;
1677 }
1678
1679 if (auto *SI = dyn_cast<SwitchInst>(TI)) {
1680 if (!SI->getNumCases() || !getValueState(SI->getCondition()).isUnknown())
1681 continue;
1682
1683 // If the input to SCCP is actually switch on undef, fix the undef to
1684 // the first constant.
1685 if (isa<UndefValue>(SI->getCondition())) {
1686 SI->setCondition(SI->case_begin()->getCaseValue());
1687 markEdgeExecutable(&BB, SI->case_begin()->getCaseSuccessor());
1688 return true;
1689 }
1690
1691 // Otherwise, it is a branch on a symbolic value which is currently
1692 // considered to be undef. Make sure some edge is executable, so a
1693 // branch on "undef" always flows somewhere.
1694 // FIXME: Distinguish between dead code and an LLVM "undef" value.
1695 BasicBlock *DefaultSuccessor = SI->case_begin()->getCaseSuccessor();
1696 if (markEdgeExecutable(&BB, DefaultSuccessor))
1697 return true;
1698
1699 continue;
1700 }
1701 }
1702
1703 return false;
1704 }
1705
tryToReplaceWithConstant(SCCPSolver & Solver,Value * V)1706 static bool tryToReplaceWithConstant(SCCPSolver &Solver, Value *V) {
1707 Constant *Const = nullptr;
1708 if (V->getType()->isStructTy()) {
1709 std::vector<LatticeVal> IVs = Solver.getStructLatticeValueFor(V);
1710 if (llvm::any_of(IVs,
1711 [](const LatticeVal &LV) { return LV.isOverdefined(); }))
1712 return false;
1713 std::vector<Constant *> ConstVals;
1714 auto *ST = dyn_cast<StructType>(V->getType());
1715 for (unsigned i = 0, e = ST->getNumElements(); i != e; ++i) {
1716 LatticeVal V = IVs[i];
1717 ConstVals.push_back(V.isConstant()
1718 ? V.getConstant()
1719 : UndefValue::get(ST->getElementType(i)));
1720 }
1721 Const = ConstantStruct::get(ST, ConstVals);
1722 } else {
1723 const LatticeVal &IV = Solver.getLatticeValueFor(V);
1724 if (IV.isOverdefined())
1725 return false;
1726
1727 Const = IV.isConstant() ? IV.getConstant() : UndefValue::get(V->getType());
1728 }
1729 assert(Const && "Constant is nullptr here!");
1730
1731 // Replacing `musttail` instructions with constant breaks `musttail` invariant
1732 // unless the call itself can be removed
1733 CallInst *CI = dyn_cast<CallInst>(V);
1734 if (CI && CI->isMustTailCall() && !CI->isSafeToRemove()) {
1735 CallSite CS(CI);
1736 Function *F = CS.getCalledFunction();
1737
1738 // Don't zap returns of the callee
1739 if (F)
1740 Solver.AddMustTailCallee(F);
1741
1742 LLVM_DEBUG(dbgs() << " Can\'t treat the result of musttail call : " << *CI
1743 << " as a constant\n");
1744 return false;
1745 }
1746
1747 LLVM_DEBUG(dbgs() << " Constant: " << *Const << " = " << *V << '\n');
1748
1749 // Replaces all of the uses of a variable with uses of the constant.
1750 V->replaceAllUsesWith(Const);
1751 return true;
1752 }
1753
1754 // runSCCP() - Run the Sparse Conditional Constant Propagation algorithm,
1755 // and return true if the function was modified.
runSCCP(Function & F,const DataLayout & DL,const TargetLibraryInfo * TLI)1756 static bool runSCCP(Function &F, const DataLayout &DL,
1757 const TargetLibraryInfo *TLI) {
1758 LLVM_DEBUG(dbgs() << "SCCP on function '" << F.getName() << "'\n");
1759 SCCPSolver Solver(DL, TLI);
1760
1761 // Mark the first block of the function as being executable.
1762 Solver.MarkBlockExecutable(&F.front());
1763
1764 // Mark all arguments to the function as being overdefined.
1765 for (Argument &AI : F.args())
1766 Solver.markOverdefined(&AI);
1767
1768 // Solve for constants.
1769 bool ResolvedUndefs = true;
1770 while (ResolvedUndefs) {
1771 Solver.Solve();
1772 LLVM_DEBUG(dbgs() << "RESOLVING UNDEFs\n");
1773 ResolvedUndefs = Solver.ResolvedUndefsIn(F);
1774 }
1775
1776 bool MadeChanges = false;
1777
1778 // If we decided that there are basic blocks that are dead in this function,
1779 // delete their contents now. Note that we cannot actually delete the blocks,
1780 // as we cannot modify the CFG of the function.
1781
1782 for (BasicBlock &BB : F) {
1783 if (!Solver.isBlockExecutable(&BB)) {
1784 LLVM_DEBUG(dbgs() << " BasicBlock Dead:" << BB);
1785
1786 ++NumDeadBlocks;
1787 NumInstRemoved += removeAllNonTerminatorAndEHPadInstructions(&BB);
1788
1789 MadeChanges = true;
1790 continue;
1791 }
1792
1793 // Iterate over all of the instructions in a function, replacing them with
1794 // constants if we have found them to be of constant values.
1795 for (BasicBlock::iterator BI = BB.begin(), E = BB.end(); BI != E;) {
1796 Instruction *Inst = &*BI++;
1797 if (Inst->getType()->isVoidTy() || Inst->isTerminator())
1798 continue;
1799
1800 if (tryToReplaceWithConstant(Solver, Inst)) {
1801 if (isInstructionTriviallyDead(Inst))
1802 Inst->eraseFromParent();
1803 // Hey, we just changed something!
1804 MadeChanges = true;
1805 ++NumInstRemoved;
1806 }
1807 }
1808 }
1809
1810 return MadeChanges;
1811 }
1812
run(Function & F,FunctionAnalysisManager & AM)1813 PreservedAnalyses SCCPPass::run(Function &F, FunctionAnalysisManager &AM) {
1814 const DataLayout &DL = F.getParent()->getDataLayout();
1815 auto &TLI = AM.getResult<TargetLibraryAnalysis>(F);
1816 if (!runSCCP(F, DL, &TLI))
1817 return PreservedAnalyses::all();
1818
1819 auto PA = PreservedAnalyses();
1820 PA.preserve<GlobalsAA>();
1821 PA.preserveSet<CFGAnalyses>();
1822 return PA;
1823 }
1824
1825 namespace {
1826
1827 //===--------------------------------------------------------------------===//
1828 //
1829 /// SCCP Class - This class uses the SCCPSolver to implement a per-function
1830 /// Sparse Conditional Constant Propagator.
1831 ///
1832 class SCCPLegacyPass : public FunctionPass {
1833 public:
1834 // Pass identification, replacement for typeid
1835 static char ID;
1836
SCCPLegacyPass()1837 SCCPLegacyPass() : FunctionPass(ID) {
1838 initializeSCCPLegacyPassPass(*PassRegistry::getPassRegistry());
1839 }
1840
getAnalysisUsage(AnalysisUsage & AU) const1841 void getAnalysisUsage(AnalysisUsage &AU) const override {
1842 AU.addRequired<TargetLibraryInfoWrapperPass>();
1843 AU.addPreserved<GlobalsAAWrapperPass>();
1844 AU.setPreservesCFG();
1845 }
1846
1847 // runOnFunction - Run the Sparse Conditional Constant Propagation
1848 // algorithm, and return true if the function was modified.
runOnFunction(Function & F)1849 bool runOnFunction(Function &F) override {
1850 if (skipFunction(F))
1851 return false;
1852 const DataLayout &DL = F.getParent()->getDataLayout();
1853 const TargetLibraryInfo *TLI =
1854 &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
1855 return runSCCP(F, DL, TLI);
1856 }
1857 };
1858
1859 } // end anonymous namespace
1860
1861 char SCCPLegacyPass::ID = 0;
1862
1863 INITIALIZE_PASS_BEGIN(SCCPLegacyPass, "sccp",
1864 "Sparse Conditional Constant Propagation", false, false)
INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)1865 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
1866 INITIALIZE_PASS_END(SCCPLegacyPass, "sccp",
1867 "Sparse Conditional Constant Propagation", false, false)
1868
1869 // createSCCPPass - This is the public interface to this file.
1870 FunctionPass *llvm::createSCCPPass() { return new SCCPLegacyPass(); }
1871
findReturnsToZap(Function & F,SmallVector<ReturnInst *,8> & ReturnsToZap,SCCPSolver & Solver)1872 static void findReturnsToZap(Function &F,
1873 SmallVector<ReturnInst *, 8> &ReturnsToZap,
1874 SCCPSolver &Solver) {
1875 // We can only do this if we know that nothing else can call the function.
1876 if (!Solver.isArgumentTrackedFunction(&F))
1877 return;
1878
1879 // There is a non-removable musttail call site of this function. Zapping
1880 // returns is not allowed.
1881 if (Solver.isMustTailCallee(&F)) {
1882 LLVM_DEBUG(dbgs() << "Can't zap returns of the function : " << F.getName()
1883 << " due to present musttail call of it\n");
1884 return;
1885 }
1886
1887 for (BasicBlock &BB : F) {
1888 if (CallInst *CI = BB.getTerminatingMustTailCall()) {
1889 LLVM_DEBUG(dbgs() << "Can't zap return of the block due to present "
1890 << "musttail call : " << *CI << "\n");
1891 (void)CI;
1892 return;
1893 }
1894
1895 if (auto *RI = dyn_cast<ReturnInst>(BB.getTerminator()))
1896 if (!isa<UndefValue>(RI->getOperand(0)))
1897 ReturnsToZap.push_back(RI);
1898 }
1899 }
1900
1901 // Update the condition for terminators that are branching on indeterminate
1902 // values, forcing them to use a specific edge.
forceIndeterminateEdge(Instruction * I,SCCPSolver & Solver)1903 static void forceIndeterminateEdge(Instruction* I, SCCPSolver &Solver) {
1904 BasicBlock *Dest = nullptr;
1905 Constant *C = nullptr;
1906 if (SwitchInst *SI = dyn_cast<SwitchInst>(I)) {
1907 if (!isa<ConstantInt>(SI->getCondition())) {
1908 // Indeterminate switch; use first case value.
1909 Dest = SI->case_begin()->getCaseSuccessor();
1910 C = SI->case_begin()->getCaseValue();
1911 }
1912 } else if (BranchInst *BI = dyn_cast<BranchInst>(I)) {
1913 if (!isa<ConstantInt>(BI->getCondition())) {
1914 // Indeterminate branch; use false.
1915 Dest = BI->getSuccessor(1);
1916 C = ConstantInt::getFalse(BI->getContext());
1917 }
1918 } else if (IndirectBrInst *IBR = dyn_cast<IndirectBrInst>(I)) {
1919 if (!isa<BlockAddress>(IBR->getAddress()->stripPointerCasts())) {
1920 // Indeterminate indirectbr; use successor 0.
1921 Dest = IBR->getSuccessor(0);
1922 C = BlockAddress::get(IBR->getSuccessor(0));
1923 }
1924 } else {
1925 llvm_unreachable("Unexpected terminator instruction");
1926 }
1927 if (C) {
1928 assert(Solver.isEdgeFeasible(I->getParent(), Dest) &&
1929 "Didn't find feasible edge?");
1930 (void)Dest;
1931
1932 I->setOperand(0, C);
1933 }
1934 }
1935
runIPSCCP(Module & M,const DataLayout & DL,const TargetLibraryInfo * TLI,function_ref<AnalysisResultsForFn (Function &)> getAnalysis)1936 bool llvm::runIPSCCP(
1937 Module &M, const DataLayout &DL, const TargetLibraryInfo *TLI,
1938 function_ref<AnalysisResultsForFn(Function &)> getAnalysis) {
1939 SCCPSolver Solver(DL, TLI);
1940
1941 // Loop over all functions, marking arguments to those with their addresses
1942 // taken or that are external as overdefined.
1943 for (Function &F : M) {
1944 if (F.isDeclaration())
1945 continue;
1946
1947 Solver.addAnalysis(F, getAnalysis(F));
1948
1949 // Determine if we can track the function's return values. If so, add the
1950 // function to the solver's set of return-tracked functions.
1951 if (canTrackReturnsInterprocedurally(&F))
1952 Solver.AddTrackedFunction(&F);
1953
1954 // Determine if we can track the function's arguments. If so, add the
1955 // function to the solver's set of argument-tracked functions.
1956 if (canTrackArgumentsInterprocedurally(&F)) {
1957 Solver.AddArgumentTrackedFunction(&F);
1958 continue;
1959 }
1960
1961 // Assume the function is called.
1962 Solver.MarkBlockExecutable(&F.front());
1963
1964 // Assume nothing about the incoming arguments.
1965 for (Argument &AI : F.args())
1966 Solver.markOverdefined(&AI);
1967 }
1968
1969 // Determine if we can track any of the module's global variables. If so, add
1970 // the global variables we can track to the solver's set of tracked global
1971 // variables.
1972 for (GlobalVariable &G : M.globals()) {
1973 G.removeDeadConstantUsers();
1974 if (canTrackGlobalVariableInterprocedurally(&G))
1975 Solver.TrackValueOfGlobalVariable(&G);
1976 }
1977
1978 // Solve for constants.
1979 bool ResolvedUndefs = true;
1980 Solver.Solve();
1981 while (ResolvedUndefs) {
1982 LLVM_DEBUG(dbgs() << "RESOLVING UNDEFS\n");
1983 ResolvedUndefs = false;
1984 for (Function &F : M)
1985 if (Solver.ResolvedUndefsIn(F)) {
1986 // We run Solve() after we resolved an undef in a function, because
1987 // we might deduce a fact that eliminates an undef in another function.
1988 Solver.Solve();
1989 ResolvedUndefs = true;
1990 }
1991 }
1992
1993 bool MadeChanges = false;
1994
1995 // Iterate over all of the instructions in the module, replacing them with
1996 // constants if we have found them to be of constant values.
1997
1998 for (Function &F : M) {
1999 if (F.isDeclaration())
2000 continue;
2001
2002 SmallVector<BasicBlock *, 512> BlocksToErase;
2003
2004 if (Solver.isBlockExecutable(&F.front()))
2005 for (Function::arg_iterator AI = F.arg_begin(), E = F.arg_end(); AI != E;
2006 ++AI) {
2007 if (!AI->use_empty() && tryToReplaceWithConstant(Solver, &*AI)) {
2008 ++IPNumArgsElimed;
2009 continue;
2010 }
2011 }
2012
2013 for (Function::iterator BB = F.begin(), E = F.end(); BB != E; ++BB) {
2014 if (!Solver.isBlockExecutable(&*BB)) {
2015 LLVM_DEBUG(dbgs() << " BasicBlock Dead:" << *BB);
2016 ++NumDeadBlocks;
2017
2018 MadeChanges = true;
2019
2020 if (&*BB != &F.front())
2021 BlocksToErase.push_back(&*BB);
2022 continue;
2023 }
2024
2025 for (BasicBlock::iterator BI = BB->begin(), E = BB->end(); BI != E; ) {
2026 Instruction *Inst = &*BI++;
2027 if (Inst->getType()->isVoidTy())
2028 continue;
2029 if (tryToReplaceWithConstant(Solver, Inst)) {
2030 if (Inst->isSafeToRemove())
2031 Inst->eraseFromParent();
2032 // Hey, we just changed something!
2033 MadeChanges = true;
2034 ++IPNumInstRemoved;
2035 }
2036 }
2037 }
2038
2039 DomTreeUpdater DTU = Solver.getDTU(F);
2040 // Change dead blocks to unreachable. We do it after replacing constants
2041 // in all executable blocks, because changeToUnreachable may remove PHI
2042 // nodes in executable blocks we found values for. The function's entry
2043 // block is not part of BlocksToErase, so we have to handle it separately.
2044 for (BasicBlock *BB : BlocksToErase) {
2045 NumInstRemoved +=
2046 changeToUnreachable(BB->getFirstNonPHI(), /*UseLLVMTrap=*/false,
2047 /*PreserveLCSSA=*/false, &DTU);
2048 }
2049 if (!Solver.isBlockExecutable(&F.front()))
2050 NumInstRemoved += changeToUnreachable(F.front().getFirstNonPHI(),
2051 /*UseLLVMTrap=*/false,
2052 /*PreserveLCSSA=*/false, &DTU);
2053
2054 // Now that all instructions in the function are constant folded,
2055 // use ConstantFoldTerminator to get rid of in-edges, record DT updates and
2056 // delete dead BBs.
2057 for (BasicBlock *DeadBB : BlocksToErase) {
2058 // If there are any PHI nodes in this successor, drop entries for BB now.
2059 for (Value::user_iterator UI = DeadBB->user_begin(),
2060 UE = DeadBB->user_end();
2061 UI != UE;) {
2062 // Grab the user and then increment the iterator early, as the user
2063 // will be deleted. Step past all adjacent uses from the same user.
2064 auto *I = dyn_cast<Instruction>(*UI);
2065 do { ++UI; } while (UI != UE && *UI == I);
2066
2067 // Ignore blockaddress users; BasicBlock's dtor will handle them.
2068 if (!I) continue;
2069
2070 // If we have forced an edge for an indeterminate value, then force the
2071 // terminator to fold to that edge.
2072 forceIndeterminateEdge(I, Solver);
2073 bool Folded = ConstantFoldTerminator(I->getParent(),
2074 /*DeleteDeadConditions=*/false,
2075 /*TLI=*/nullptr, &DTU);
2076 assert(Folded &&
2077 "Expect TermInst on constantint or blockaddress to be folded");
2078 (void) Folded;
2079 }
2080 // Mark dead BB for deletion.
2081 DTU.deleteBB(DeadBB);
2082 }
2083
2084 for (BasicBlock &BB : F) {
2085 for (BasicBlock::iterator BI = BB.begin(), E = BB.end(); BI != E;) {
2086 Instruction *Inst = &*BI++;
2087 if (Solver.getPredicateInfoFor(Inst)) {
2088 if (auto *II = dyn_cast<IntrinsicInst>(Inst)) {
2089 if (II->getIntrinsicID() == Intrinsic::ssa_copy) {
2090 Value *Op = II->getOperand(0);
2091 Inst->replaceAllUsesWith(Op);
2092 Inst->eraseFromParent();
2093 }
2094 }
2095 }
2096 }
2097 }
2098 }
2099
2100 // If we inferred constant or undef return values for a function, we replaced
2101 // all call uses with the inferred value. This means we don't need to bother
2102 // actually returning anything from the function. Replace all return
2103 // instructions with return undef.
2104 //
2105 // Do this in two stages: first identify the functions we should process, then
2106 // actually zap their returns. This is important because we can only do this
2107 // if the address of the function isn't taken. In cases where a return is the
2108 // last use of a function, the order of processing functions would affect
2109 // whether other functions are optimizable.
2110 SmallVector<ReturnInst*, 8> ReturnsToZap;
2111
2112 const DenseMap<Function*, LatticeVal> &RV = Solver.getTrackedRetVals();
2113 for (const auto &I : RV) {
2114 Function *F = I.first;
2115 if (I.second.isOverdefined() || F->getReturnType()->isVoidTy())
2116 continue;
2117 findReturnsToZap(*F, ReturnsToZap, Solver);
2118 }
2119
2120 for (const auto &F : Solver.getMRVFunctionsTracked()) {
2121 assert(F->getReturnType()->isStructTy() &&
2122 "The return type should be a struct");
2123 StructType *STy = cast<StructType>(F->getReturnType());
2124 if (Solver.isStructLatticeConstant(F, STy))
2125 findReturnsToZap(*F, ReturnsToZap, Solver);
2126 }
2127
2128 // Zap all returns which we've identified as zap to change.
2129 for (unsigned i = 0, e = ReturnsToZap.size(); i != e; ++i) {
2130 Function *F = ReturnsToZap[i]->getParent()->getParent();
2131 ReturnsToZap[i]->setOperand(0, UndefValue::get(F->getReturnType()));
2132 }
2133
2134 // If we inferred constant or undef values for globals variables, we can
2135 // delete the global and any stores that remain to it.
2136 const DenseMap<GlobalVariable*, LatticeVal> &TG = Solver.getTrackedGlobals();
2137 for (DenseMap<GlobalVariable*, LatticeVal>::const_iterator I = TG.begin(),
2138 E = TG.end(); I != E; ++I) {
2139 GlobalVariable *GV = I->first;
2140 assert(!I->second.isOverdefined() &&
2141 "Overdefined values should have been taken out of the map!");
2142 LLVM_DEBUG(dbgs() << "Found that GV '" << GV->getName()
2143 << "' is constant!\n");
2144 while (!GV->use_empty()) {
2145 StoreInst *SI = cast<StoreInst>(GV->user_back());
2146 SI->eraseFromParent();
2147 }
2148 M.getGlobalList().erase(GV);
2149 ++IPNumGlobalConst;
2150 }
2151
2152 return MadeChanges;
2153 }
2154