1 //===--- CaptureTracking.cpp - Determine whether a pointer is captured ----===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file contains routines that help determine which pointers are captured.
10 // A pointer value is captured if the function makes a copy of any part of the
11 // pointer that outlives the call. Not being captured means, more or less, that
12 // the pointer is only dereferenced and not stored in a global. Returning part
13 // of the pointer as the function return value may or may not count as capturing
14 // the pointer, depending on the context.
15 //
16 //===----------------------------------------------------------------------===//
17
18 #include "llvm/Analysis/CaptureTracking.h"
19 #include "llvm/ADT/SmallSet.h"
20 #include "llvm/ADT/SmallVector.h"
21 #include "llvm/ADT/Statistic.h"
22 #include "llvm/Analysis/AliasAnalysis.h"
23 #include "llvm/Analysis/CFG.h"
24 #include "llvm/Analysis/ValueTracking.h"
25 #include "llvm/IR/Constants.h"
26 #include "llvm/IR/Dominators.h"
27 #include "llvm/IR/Instructions.h"
28 #include "llvm/IR/IntrinsicInst.h"
29 #include "llvm/Support/CommandLine.h"
30
31 using namespace llvm;
32
33 #define DEBUG_TYPE "capture-tracking"
34
35 STATISTIC(NumCaptured, "Number of pointers maybe captured");
36 STATISTIC(NumNotCaptured, "Number of pointers not captured");
37 STATISTIC(NumCapturedBefore, "Number of pointers maybe captured before");
38 STATISTIC(NumNotCapturedBefore, "Number of pointers not captured before");
39
40 /// The default value for MaxUsesToExplore argument. It's relatively small to
41 /// keep the cost of analysis reasonable for clients like BasicAliasAnalysis,
42 /// where the results can't be cached.
43 /// TODO: we should probably introduce a caching CaptureTracking analysis and
44 /// use it where possible. The caching version can use much higher limit or
45 /// don't have this cap at all.
46 static cl::opt<unsigned>
47 DefaultMaxUsesToExplore("capture-tracking-max-uses-to-explore", cl::Hidden,
48 cl::desc("Maximal number of uses to explore."),
49 cl::init(20));
50
getDefaultMaxUsesToExploreForCaptureTracking()51 unsigned llvm::getDefaultMaxUsesToExploreForCaptureTracking() {
52 return DefaultMaxUsesToExplore;
53 }
54
~CaptureTracker()55 CaptureTracker::~CaptureTracker() {}
56
shouldExplore(const Use * U)57 bool CaptureTracker::shouldExplore(const Use *U) { return true; }
58
isDereferenceableOrNull(Value * O,const DataLayout & DL)59 bool CaptureTracker::isDereferenceableOrNull(Value *O, const DataLayout &DL) {
60 // An inbounds GEP can either be a valid pointer (pointing into
61 // or to the end of an allocation), or be null in the default
62 // address space. So for an inbounds GEP there is no way to let
63 // the pointer escape using clever GEP hacking because doing so
64 // would make the pointer point outside of the allocated object
65 // and thus make the GEP result a poison value. Similarly, other
66 // dereferenceable pointers cannot be manipulated without producing
67 // poison.
68 if (auto *GEP = dyn_cast<GetElementPtrInst>(O))
69 if (GEP->isInBounds())
70 return true;
71 bool CanBeNull, CanBeFreed;
72 return O->getPointerDereferenceableBytes(DL, CanBeNull, CanBeFreed);
73 }
74
75 namespace {
76 struct SimpleCaptureTracker : public CaptureTracker {
SimpleCaptureTracker__anon16159e300111::SimpleCaptureTracker77 explicit SimpleCaptureTracker(bool ReturnCaptures)
78 : ReturnCaptures(ReturnCaptures), Captured(false) {}
79
tooManyUses__anon16159e300111::SimpleCaptureTracker80 void tooManyUses() override { Captured = true; }
81
captured__anon16159e300111::SimpleCaptureTracker82 bool captured(const Use *U) override {
83 if (isa<ReturnInst>(U->getUser()) && !ReturnCaptures)
84 return false;
85
86 Captured = true;
87 return true;
88 }
89
90 bool ReturnCaptures;
91
92 bool Captured;
93 };
94
95 /// Only find pointer captures which happen before the given instruction. Uses
96 /// the dominator tree to determine whether one instruction is before another.
97 /// Only support the case where the Value is defined in the same basic block
98 /// as the given instruction and the use.
99 struct CapturesBefore : public CaptureTracker {
100
CapturesBefore__anon16159e300111::CapturesBefore101 CapturesBefore(bool ReturnCaptures, const Instruction *I, const DominatorTree *DT,
102 bool IncludeI)
103 : BeforeHere(I), DT(DT),
104 ReturnCaptures(ReturnCaptures), IncludeI(IncludeI), Captured(false) {}
105
tooManyUses__anon16159e300111::CapturesBefore106 void tooManyUses() override { Captured = true; }
107
isSafeToPrune__anon16159e300111::CapturesBefore108 bool isSafeToPrune(Instruction *I) {
109 if (BeforeHere == I)
110 return !IncludeI;
111
112 // We explore this usage only if the usage can reach "BeforeHere".
113 // If use is not reachable from entry, there is no need to explore.
114 if (!DT->isReachableFromEntry(I->getParent()))
115 return true;
116
117 // Check whether there is a path from I to BeforeHere.
118 return !isPotentiallyReachable(I, BeforeHere, nullptr, DT);
119 }
120
captured__anon16159e300111::CapturesBefore121 bool captured(const Use *U) override {
122 Instruction *I = cast<Instruction>(U->getUser());
123 if (isa<ReturnInst>(I) && !ReturnCaptures)
124 return false;
125
126 // Check isSafeToPrune() here rather than in shouldExplore() to avoid
127 // an expensive reachability query for every instruction we look at.
128 // Instead we only do one for actual capturing candidates.
129 if (isSafeToPrune(I))
130 return false;
131
132 Captured = true;
133 return true;
134 }
135
136 const Instruction *BeforeHere;
137 const DominatorTree *DT;
138
139 bool ReturnCaptures;
140 bool IncludeI;
141
142 bool Captured;
143 };
144 }
145
146 /// PointerMayBeCaptured - Return true if this pointer value may be captured
147 /// by the enclosing function (which is required to exist). This routine can
148 /// be expensive, so consider caching the results. The boolean ReturnCaptures
149 /// specifies whether returning the value (or part of it) from the function
150 /// counts as capturing it or not. The boolean StoreCaptures specified whether
151 /// storing the value (or part of it) into memory anywhere automatically
152 /// counts as capturing it or not.
PointerMayBeCaptured(const Value * V,bool ReturnCaptures,bool StoreCaptures,unsigned MaxUsesToExplore)153 bool llvm::PointerMayBeCaptured(const Value *V,
154 bool ReturnCaptures, bool StoreCaptures,
155 unsigned MaxUsesToExplore) {
156 assert(!isa<GlobalValue>(V) &&
157 "It doesn't make sense to ask whether a global is captured.");
158
159 // TODO: If StoreCaptures is not true, we could do Fancy analysis
160 // to determine whether this store is not actually an escape point.
161 // In that case, BasicAliasAnalysis should be updated as well to
162 // take advantage of this.
163 (void)StoreCaptures;
164
165 SimpleCaptureTracker SCT(ReturnCaptures);
166 PointerMayBeCaptured(V, &SCT, MaxUsesToExplore);
167 if (SCT.Captured)
168 ++NumCaptured;
169 else
170 ++NumNotCaptured;
171 return SCT.Captured;
172 }
173
174 /// PointerMayBeCapturedBefore - Return true if this pointer value may be
175 /// captured by the enclosing function (which is required to exist). If a
176 /// DominatorTree is provided, only captures which happen before the given
177 /// instruction are considered. This routine can be expensive, so consider
178 /// caching the results. The boolean ReturnCaptures specifies whether
179 /// returning the value (or part of it) from the function counts as capturing
180 /// it or not. The boolean StoreCaptures specified whether storing the value
181 /// (or part of it) into memory anywhere automatically counts as capturing it
182 /// or not.
PointerMayBeCapturedBefore(const Value * V,bool ReturnCaptures,bool StoreCaptures,const Instruction * I,const DominatorTree * DT,bool IncludeI,unsigned MaxUsesToExplore)183 bool llvm::PointerMayBeCapturedBefore(const Value *V, bool ReturnCaptures,
184 bool StoreCaptures, const Instruction *I,
185 const DominatorTree *DT, bool IncludeI,
186 unsigned MaxUsesToExplore) {
187 assert(!isa<GlobalValue>(V) &&
188 "It doesn't make sense to ask whether a global is captured.");
189
190 if (!DT)
191 return PointerMayBeCaptured(V, ReturnCaptures, StoreCaptures,
192 MaxUsesToExplore);
193
194 // TODO: See comment in PointerMayBeCaptured regarding what could be done
195 // with StoreCaptures.
196
197 CapturesBefore CB(ReturnCaptures, I, DT, IncludeI);
198 PointerMayBeCaptured(V, &CB, MaxUsesToExplore);
199 if (CB.Captured)
200 ++NumCapturedBefore;
201 else
202 ++NumNotCapturedBefore;
203 return CB.Captured;
204 }
205
PointerMayBeCaptured(const Value * V,CaptureTracker * Tracker,unsigned MaxUsesToExplore)206 void llvm::PointerMayBeCaptured(const Value *V, CaptureTracker *Tracker,
207 unsigned MaxUsesToExplore) {
208 assert(V->getType()->isPointerTy() && "Capture is for pointers only!");
209 if (MaxUsesToExplore == 0)
210 MaxUsesToExplore = DefaultMaxUsesToExplore;
211
212 SmallVector<const Use *, 20> Worklist;
213 Worklist.reserve(getDefaultMaxUsesToExploreForCaptureTracking());
214 SmallSet<const Use *, 20> Visited;
215
216 auto AddUses = [&](const Value *V) {
217 unsigned Count = 0;
218 for (const Use &U : V->uses()) {
219 // If there are lots of uses, conservatively say that the value
220 // is captured to avoid taking too much compile time.
221 if (Count++ >= MaxUsesToExplore) {
222 Tracker->tooManyUses();
223 return false;
224 }
225 if (!Visited.insert(&U).second)
226 continue;
227 if (!Tracker->shouldExplore(&U))
228 continue;
229 Worklist.push_back(&U);
230 }
231 return true;
232 };
233 if (!AddUses(V))
234 return;
235
236 while (!Worklist.empty()) {
237 const Use *U = Worklist.pop_back_val();
238 Instruction *I = cast<Instruction>(U->getUser());
239
240 switch (I->getOpcode()) {
241 case Instruction::Call:
242 case Instruction::Invoke: {
243 auto *Call = cast<CallBase>(I);
244 // Not captured if the callee is readonly, doesn't return a copy through
245 // its return value and doesn't unwind (a readonly function can leak bits
246 // by throwing an exception or not depending on the input value).
247 if (Call->onlyReadsMemory() && Call->doesNotThrow() &&
248 Call->getType()->isVoidTy())
249 break;
250
251 // The pointer is not captured if returned pointer is not captured.
252 // NOTE: CaptureTracking users should not assume that only functions
253 // marked with nocapture do not capture. This means that places like
254 // getUnderlyingObject in ValueTracking or DecomposeGEPExpression
255 // in BasicAA also need to know about this property.
256 if (isIntrinsicReturningPointerAliasingArgumentWithoutCapturing(Call,
257 true)) {
258 if (!AddUses(Call))
259 return;
260 break;
261 }
262
263 // Volatile operations effectively capture the memory location that they
264 // load and store to.
265 if (auto *MI = dyn_cast<MemIntrinsic>(Call))
266 if (MI->isVolatile())
267 if (Tracker->captured(U))
268 return;
269
270 // Not captured if only passed via 'nocapture' arguments. Note that
271 // calling a function pointer does not in itself cause the pointer to
272 // be captured. This is a subtle point considering that (for example)
273 // the callee might return its own address. It is analogous to saying
274 // that loading a value from a pointer does not cause the pointer to be
275 // captured, even though the loaded value might be the pointer itself
276 // (think of self-referential objects).
277 if (Call->isDataOperand(U) &&
278 !Call->doesNotCapture(Call->getDataOperandNo(U))) {
279 // The parameter is not marked 'nocapture' - captured.
280 if (Tracker->captured(U))
281 return;
282 }
283 break;
284 }
285 case Instruction::Load:
286 // Volatile loads make the address observable.
287 if (cast<LoadInst>(I)->isVolatile())
288 if (Tracker->captured(U))
289 return;
290 break;
291 case Instruction::VAArg:
292 // "va-arg" from a pointer does not cause it to be captured.
293 break;
294 case Instruction::Store:
295 // Stored the pointer - conservatively assume it may be captured.
296 // Volatile stores make the address observable.
297 if (U->getOperandNo() == 0 || cast<StoreInst>(I)->isVolatile())
298 if (Tracker->captured(U))
299 return;
300 break;
301 case Instruction::AtomicRMW: {
302 // atomicrmw conceptually includes both a load and store from
303 // the same location.
304 // As with a store, the location being accessed is not captured,
305 // but the value being stored is.
306 // Volatile stores make the address observable.
307 auto *ARMWI = cast<AtomicRMWInst>(I);
308 if (U->getOperandNo() == 1 || ARMWI->isVolatile())
309 if (Tracker->captured(U))
310 return;
311 break;
312 }
313 case Instruction::AtomicCmpXchg: {
314 // cmpxchg conceptually includes both a load and store from
315 // the same location.
316 // As with a store, the location being accessed is not captured,
317 // but the value being stored is.
318 // Volatile stores make the address observable.
319 auto *ACXI = cast<AtomicCmpXchgInst>(I);
320 if (U->getOperandNo() == 1 || U->getOperandNo() == 2 ||
321 ACXI->isVolatile())
322 if (Tracker->captured(U))
323 return;
324 break;
325 }
326 case Instruction::BitCast:
327 case Instruction::GetElementPtr:
328 case Instruction::PHI:
329 case Instruction::Select:
330 case Instruction::AddrSpaceCast:
331 // The original value is not captured via this if the new value isn't.
332 if (!AddUses(I))
333 return;
334 break;
335 case Instruction::ICmp: {
336 unsigned Idx = U->getOperandNo();
337 unsigned OtherIdx = 1 - Idx;
338 if (auto *CPN = dyn_cast<ConstantPointerNull>(I->getOperand(OtherIdx))) {
339 // Don't count comparisons of a no-alias return value against null as
340 // captures. This allows us to ignore comparisons of malloc results
341 // with null, for example.
342 if (CPN->getType()->getAddressSpace() == 0)
343 if (isNoAliasCall(U->get()->stripPointerCasts()))
344 break;
345 if (!I->getFunction()->nullPointerIsDefined()) {
346 auto *O = I->getOperand(Idx)->stripPointerCastsSameRepresentation();
347 // Comparing a dereferenceable_or_null pointer against null cannot
348 // lead to pointer escapes, because if it is not null it must be a
349 // valid (in-bounds) pointer.
350 if (Tracker->isDereferenceableOrNull(O, I->getModule()->getDataLayout()))
351 break;
352 }
353 }
354 // Comparison against value stored in global variable. Given the pointer
355 // does not escape, its value cannot be guessed and stored separately in a
356 // global variable.
357 auto *LI = dyn_cast<LoadInst>(I->getOperand(OtherIdx));
358 if (LI && isa<GlobalVariable>(LI->getPointerOperand()))
359 break;
360 // Otherwise, be conservative. There are crazy ways to capture pointers
361 // using comparisons.
362 if (Tracker->captured(U))
363 return;
364 break;
365 }
366 default:
367 // Something else - be conservative and say it is captured.
368 if (Tracker->captured(U))
369 return;
370 break;
371 }
372 }
373
374 // All uses examined.
375 }
376
isNonEscapingLocalObject(const Value * V,SmallDenseMap<const Value *,bool,8> * IsCapturedCache)377 bool llvm::isNonEscapingLocalObject(
378 const Value *V, SmallDenseMap<const Value *, bool, 8> *IsCapturedCache) {
379 SmallDenseMap<const Value *, bool, 8>::iterator CacheIt;
380 if (IsCapturedCache) {
381 bool Inserted;
382 std::tie(CacheIt, Inserted) = IsCapturedCache->insert({V, false});
383 if (!Inserted)
384 // Found cached result, return it!
385 return CacheIt->second;
386 }
387
388 // If this is an identified function-local object, check to see if it escapes.
389 if (isIdentifiedFunctionLocal(V)) {
390 // Set StoreCaptures to True so that we can assume in our callers that the
391 // pointer is not the result of a load instruction. Currently
392 // PointerMayBeCaptured doesn't have any special analysis for the
393 // StoreCaptures=false case; if it did, our callers could be refined to be
394 // more precise.
395 auto Ret = !PointerMayBeCaptured(V, false, /*StoreCaptures=*/true);
396 if (IsCapturedCache)
397 CacheIt->second = Ret;
398 return Ret;
399 }
400
401 return false;
402 }
403