1 //===-- Verifier.cpp - Implement the Module Verifier -----------------------==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines the function verifier interface, that can be used for some 10 // basic correctness checking of input to the system. 11 // 12 // Note that this does not provide full `Java style' security and verifications, 13 // instead it just tries to ensure that code is well-formed. 14 // 15 // * Both of a binary operator's parameters are of the same type 16 // * Verify that the indices of mem access instructions match other operands 17 // * Verify that arithmetic and other things are only performed on first-class 18 // types. Verify that shifts & logicals only happen on integrals f.e. 19 // * All of the constants in a switch statement are of the correct type 20 // * The code is in valid SSA form 21 // * It should be illegal to put a label into any other type (like a structure) 22 // or to return one. [except constant arrays!] 23 // * Only phi nodes can be self referential: 'add i32 %0, %0 ; <int>:0' is bad 24 // * PHI nodes must have an entry for each predecessor, with no extras. 25 // * PHI nodes must be the first thing in a basic block, all grouped together 26 // * PHI nodes must have at least one entry 27 // * All basic blocks should only end with terminator insts, not contain them 28 // * The entry node to a function must not have predecessors 29 // * All Instructions must be embedded into a basic block 30 // * Functions cannot take a void-typed parameter 31 // * Verify that a function's argument list agrees with it's declared type. 32 // * It is illegal to specify a name for a void value. 33 // * It is illegal to have a internal global value with no initializer 34 // * It is illegal to have a ret instruction that returns a value that does not 35 // agree with the function return value type. 36 // * Function call argument types match the function prototype 37 // * A landing pad is defined by a landingpad instruction, and can be jumped to 38 // only by the unwind edge of an invoke instruction. 39 // * A landingpad instruction must be the first non-PHI instruction in the 40 // block. 41 // * Landingpad instructions must be in a function with a personality function. 42 // * All other things that are tested by asserts spread about the code... 43 // 44 //===----------------------------------------------------------------------===// 45 46 #include "llvm/IR/Verifier.h" 47 #include "llvm/ADT/APFloat.h" 48 #include "llvm/ADT/APInt.h" 49 #include "llvm/ADT/ArrayRef.h" 50 #include "llvm/ADT/DenseMap.h" 51 #include "llvm/ADT/MapVector.h" 52 #include "llvm/ADT/Optional.h" 53 #include "llvm/ADT/STLExtras.h" 54 #include "llvm/ADT/SmallPtrSet.h" 55 #include "llvm/ADT/SmallSet.h" 56 #include "llvm/ADT/SmallVector.h" 57 #include "llvm/ADT/StringExtras.h" 58 #include "llvm/ADT/StringMap.h" 59 #include "llvm/ADT/StringRef.h" 60 #include "llvm/ADT/Twine.h" 61 #include "llvm/BinaryFormat/Dwarf.h" 62 #include "llvm/IR/Argument.h" 63 #include "llvm/IR/Attributes.h" 64 #include "llvm/IR/BasicBlock.h" 65 #include "llvm/IR/CFG.h" 66 #include "llvm/IR/CallingConv.h" 67 #include "llvm/IR/Comdat.h" 68 #include "llvm/IR/Constant.h" 69 #include "llvm/IR/ConstantRange.h" 70 #include "llvm/IR/Constants.h" 71 #include "llvm/IR/DataLayout.h" 72 #include "llvm/IR/DebugInfoMetadata.h" 73 #include "llvm/IR/DebugLoc.h" 74 #include "llvm/IR/DerivedTypes.h" 75 #include "llvm/IR/Dominators.h" 76 #include "llvm/IR/Function.h" 77 #include "llvm/IR/GlobalAlias.h" 78 #include "llvm/IR/GlobalValue.h" 79 #include "llvm/IR/GlobalVariable.h" 80 #include "llvm/IR/InlineAsm.h" 81 #include "llvm/IR/InstVisitor.h" 82 #include "llvm/IR/InstrTypes.h" 83 #include "llvm/IR/Instruction.h" 84 #include "llvm/IR/Instructions.h" 85 #include "llvm/IR/IntrinsicInst.h" 86 #include "llvm/IR/Intrinsics.h" 87 #include "llvm/IR/IntrinsicsAArch64.h" 88 #include "llvm/IR/IntrinsicsARM.h" 89 #include "llvm/IR/IntrinsicsWebAssembly.h" 90 #include "llvm/IR/LLVMContext.h" 91 #include "llvm/IR/Metadata.h" 92 #include "llvm/IR/Module.h" 93 #include "llvm/IR/ModuleSlotTracker.h" 94 #include "llvm/IR/PassManager.h" 95 #include "llvm/IR/Statepoint.h" 96 #include "llvm/IR/Type.h" 97 #include "llvm/IR/Use.h" 98 #include "llvm/IR/User.h" 99 #include "llvm/IR/Value.h" 100 #include "llvm/InitializePasses.h" 101 #include "llvm/Pass.h" 102 #include "llvm/Support/AtomicOrdering.h" 103 #include "llvm/Support/Casting.h" 104 #include "llvm/Support/CommandLine.h" 105 #include "llvm/Support/ErrorHandling.h" 106 #include "llvm/Support/MathExtras.h" 107 #include "llvm/Support/raw_ostream.h" 108 #include <algorithm> 109 #include <cassert> 110 #include <cstdint> 111 #include <memory> 112 #include <string> 113 #include <utility> 114 115 using namespace llvm; 116 117 static cl::opt<bool> VerifyNoAliasScopeDomination( 118 "verify-noalias-scope-decl-dom", cl::Hidden, cl::init(false), 119 cl::desc("Ensure that llvm.experimental.noalias.scope.decl for identical " 120 "scopes are not dominating")); 121 122 namespace llvm { 123 124 struct VerifierSupport { 125 raw_ostream *OS; 126 const Module &M; 127 ModuleSlotTracker MST; 128 Triple TT; 129 const DataLayout &DL; 130 LLVMContext &Context; 131 132 /// Track the brokenness of the module while recursively visiting. 133 bool Broken = false; 134 /// Broken debug info can be "recovered" from by stripping the debug info. 135 bool BrokenDebugInfo = false; 136 /// Whether to treat broken debug info as an error. 137 bool TreatBrokenDebugInfoAsError = true; 138 139 explicit VerifierSupport(raw_ostream *OS, const Module &M) 140 : OS(OS), M(M), MST(&M), TT(M.getTargetTriple()), DL(M.getDataLayout()), 141 Context(M.getContext()) {} 142 143 private: 144 void Write(const Module *M) { 145 *OS << "; ModuleID = '" << M->getModuleIdentifier() << "'\n"; 146 } 147 148 void Write(const Value *V) { 149 if (V) 150 Write(*V); 151 } 152 153 void Write(const Value &V) { 154 if (isa<Instruction>(V)) { 155 V.print(*OS, MST); 156 *OS << '\n'; 157 } else { 158 V.printAsOperand(*OS, true, MST); 159 *OS << '\n'; 160 } 161 } 162 163 void Write(const Metadata *MD) { 164 if (!MD) 165 return; 166 MD->print(*OS, MST, &M); 167 *OS << '\n'; 168 } 169 170 template <class T> void Write(const MDTupleTypedArrayWrapper<T> &MD) { 171 Write(MD.get()); 172 } 173 174 void Write(const NamedMDNode *NMD) { 175 if (!NMD) 176 return; 177 NMD->print(*OS, MST); 178 *OS << '\n'; 179 } 180 181 void Write(Type *T) { 182 if (!T) 183 return; 184 *OS << ' ' << *T; 185 } 186 187 void Write(const Comdat *C) { 188 if (!C) 189 return; 190 *OS << *C; 191 } 192 193 void Write(const APInt *AI) { 194 if (!AI) 195 return; 196 *OS << *AI << '\n'; 197 } 198 199 void Write(const unsigned i) { *OS << i << '\n'; } 200 201 // NOLINTNEXTLINE(readability-identifier-naming) 202 void Write(const Attribute *A) { 203 if (!A) 204 return; 205 *OS << A->getAsString() << '\n'; 206 } 207 208 // NOLINTNEXTLINE(readability-identifier-naming) 209 void Write(const AttributeSet *AS) { 210 if (!AS) 211 return; 212 *OS << AS->getAsString() << '\n'; 213 } 214 215 // NOLINTNEXTLINE(readability-identifier-naming) 216 void Write(const AttributeList *AL) { 217 if (!AL) 218 return; 219 AL->print(*OS); 220 } 221 222 template <typename T> void Write(ArrayRef<T> Vs) { 223 for (const T &V : Vs) 224 Write(V); 225 } 226 227 template <typename T1, typename... Ts> 228 void WriteTs(const T1 &V1, const Ts &... Vs) { 229 Write(V1); 230 WriteTs(Vs...); 231 } 232 233 template <typename... Ts> void WriteTs() {} 234 235 public: 236 /// A check failed, so printout out the condition and the message. 237 /// 238 /// This provides a nice place to put a breakpoint if you want to see why 239 /// something is not correct. 240 void CheckFailed(const Twine &Message) { 241 if (OS) 242 *OS << Message << '\n'; 243 Broken = true; 244 } 245 246 /// A check failed (with values to print). 247 /// 248 /// This calls the Message-only version so that the above is easier to set a 249 /// breakpoint on. 250 template <typename T1, typename... Ts> 251 void CheckFailed(const Twine &Message, const T1 &V1, const Ts &... Vs) { 252 CheckFailed(Message); 253 if (OS) 254 WriteTs(V1, Vs...); 255 } 256 257 /// A debug info check failed. 258 void DebugInfoCheckFailed(const Twine &Message) { 259 if (OS) 260 *OS << Message << '\n'; 261 Broken |= TreatBrokenDebugInfoAsError; 262 BrokenDebugInfo = true; 263 } 264 265 /// A debug info check failed (with values to print). 266 template <typename T1, typename... Ts> 267 void DebugInfoCheckFailed(const Twine &Message, const T1 &V1, 268 const Ts &... Vs) { 269 DebugInfoCheckFailed(Message); 270 if (OS) 271 WriteTs(V1, Vs...); 272 } 273 }; 274 275 } // namespace llvm 276 277 namespace { 278 279 class Verifier : public InstVisitor<Verifier>, VerifierSupport { 280 friend class InstVisitor<Verifier>; 281 282 // ISD::ArgFlagsTy::MemAlign only have 4 bits for alignment, so 283 // the alignment size should not exceed 2^15. Since encode(Align) 284 // would plus the shift value by 1, the alignment size should 285 // not exceed 2^14, otherwise it can NOT be properly lowered 286 // in backend. 287 static constexpr unsigned ParamMaxAlignment = 1 << 14; 288 DominatorTree DT; 289 290 /// When verifying a basic block, keep track of all of the 291 /// instructions we have seen so far. 292 /// 293 /// This allows us to do efficient dominance checks for the case when an 294 /// instruction has an operand that is an instruction in the same block. 295 SmallPtrSet<Instruction *, 16> InstsInThisBlock; 296 297 /// Keep track of the metadata nodes that have been checked already. 298 SmallPtrSet<const Metadata *, 32> MDNodes; 299 300 /// Keep track which DISubprogram is attached to which function. 301 DenseMap<const DISubprogram *, const Function *> DISubprogramAttachments; 302 303 /// Track all DICompileUnits visited. 304 SmallPtrSet<const Metadata *, 2> CUVisited; 305 306 /// The result type for a landingpad. 307 Type *LandingPadResultTy; 308 309 /// Whether we've seen a call to @llvm.localescape in this function 310 /// already. 311 bool SawFrameEscape; 312 313 /// Whether the current function has a DISubprogram attached to it. 314 bool HasDebugInfo = false; 315 316 /// The current source language. 317 dwarf::SourceLanguage CurrentSourceLang = dwarf::DW_LANG_lo_user; 318 319 /// Whether source was present on the first DIFile encountered in each CU. 320 DenseMap<const DICompileUnit *, bool> HasSourceDebugInfo; 321 322 /// Stores the count of how many objects were passed to llvm.localescape for a 323 /// given function and the largest index passed to llvm.localrecover. 324 DenseMap<Function *, std::pair<unsigned, unsigned>> FrameEscapeInfo; 325 326 // Maps catchswitches and cleanuppads that unwind to siblings to the 327 // terminators that indicate the unwind, used to detect cycles therein. 328 MapVector<Instruction *, Instruction *> SiblingFuncletInfo; 329 330 /// Cache of constants visited in search of ConstantExprs. 331 SmallPtrSet<const Constant *, 32> ConstantExprVisited; 332 333 /// Cache of declarations of the llvm.experimental.deoptimize.<ty> intrinsic. 334 SmallVector<const Function *, 4> DeoptimizeDeclarations; 335 336 /// Cache of attribute lists verified. 337 SmallPtrSet<const void *, 32> AttributeListsVisited; 338 339 // Verify that this GlobalValue is only used in this module. 340 // This map is used to avoid visiting uses twice. We can arrive at a user 341 // twice, if they have multiple operands. In particular for very large 342 // constant expressions, we can arrive at a particular user many times. 343 SmallPtrSet<const Value *, 32> GlobalValueVisited; 344 345 // Keeps track of duplicate function argument debug info. 346 SmallVector<const DILocalVariable *, 16> DebugFnArgs; 347 348 TBAAVerifier TBAAVerifyHelper; 349 350 SmallVector<IntrinsicInst *, 4> NoAliasScopeDecls; 351 352 void checkAtomicMemAccessSize(Type *Ty, const Instruction *I); 353 354 public: 355 explicit Verifier(raw_ostream *OS, bool ShouldTreatBrokenDebugInfoAsError, 356 const Module &M) 357 : VerifierSupport(OS, M), LandingPadResultTy(nullptr), 358 SawFrameEscape(false), TBAAVerifyHelper(this) { 359 TreatBrokenDebugInfoAsError = ShouldTreatBrokenDebugInfoAsError; 360 } 361 362 bool hasBrokenDebugInfo() const { return BrokenDebugInfo; } 363 364 bool verify(const Function &F) { 365 assert(F.getParent() == &M && 366 "An instance of this class only works with a specific module!"); 367 368 // First ensure the function is well-enough formed to compute dominance 369 // information, and directly compute a dominance tree. We don't rely on the 370 // pass manager to provide this as it isolates us from a potentially 371 // out-of-date dominator tree and makes it significantly more complex to run 372 // this code outside of a pass manager. 373 // FIXME: It's really gross that we have to cast away constness here. 374 if (!F.empty()) 375 DT.recalculate(const_cast<Function &>(F)); 376 377 for (const BasicBlock &BB : F) { 378 if (!BB.empty() && BB.back().isTerminator()) 379 continue; 380 381 if (OS) { 382 *OS << "Basic Block in function '" << F.getName() 383 << "' does not have terminator!\n"; 384 BB.printAsOperand(*OS, true, MST); 385 *OS << "\n"; 386 } 387 return false; 388 } 389 390 Broken = false; 391 // FIXME: We strip const here because the inst visitor strips const. 392 visit(const_cast<Function &>(F)); 393 verifySiblingFuncletUnwinds(); 394 InstsInThisBlock.clear(); 395 DebugFnArgs.clear(); 396 LandingPadResultTy = nullptr; 397 SawFrameEscape = false; 398 SiblingFuncletInfo.clear(); 399 verifyNoAliasScopeDecl(); 400 NoAliasScopeDecls.clear(); 401 402 return !Broken; 403 } 404 405 /// Verify the module that this instance of \c Verifier was initialized with. 406 bool verify() { 407 Broken = false; 408 409 // Collect all declarations of the llvm.experimental.deoptimize intrinsic. 410 for (const Function &F : M) 411 if (F.getIntrinsicID() == Intrinsic::experimental_deoptimize) 412 DeoptimizeDeclarations.push_back(&F); 413 414 // Now that we've visited every function, verify that we never asked to 415 // recover a frame index that wasn't escaped. 416 verifyFrameRecoverIndices(); 417 for (const GlobalVariable &GV : M.globals()) 418 visitGlobalVariable(GV); 419 420 for (const GlobalAlias &GA : M.aliases()) 421 visitGlobalAlias(GA); 422 423 for (const GlobalIFunc &GI : M.ifuncs()) 424 visitGlobalIFunc(GI); 425 426 for (const NamedMDNode &NMD : M.named_metadata()) 427 visitNamedMDNode(NMD); 428 429 for (const StringMapEntry<Comdat> &SMEC : M.getComdatSymbolTable()) 430 visitComdat(SMEC.getValue()); 431 432 visitModuleFlags(); 433 visitModuleIdents(); 434 visitModuleCommandLines(); 435 436 verifyCompileUnits(); 437 438 verifyDeoptimizeCallingConvs(); 439 DISubprogramAttachments.clear(); 440 return !Broken; 441 } 442 443 private: 444 /// Whether a metadata node is allowed to be, or contain, a DILocation. 445 enum class AreDebugLocsAllowed { No, Yes }; 446 447 // Verification methods... 448 void visitGlobalValue(const GlobalValue &GV); 449 void visitGlobalVariable(const GlobalVariable &GV); 450 void visitGlobalAlias(const GlobalAlias &GA); 451 void visitGlobalIFunc(const GlobalIFunc &GI); 452 void visitAliaseeSubExpr(const GlobalAlias &A, const Constant &C); 453 void visitAliaseeSubExpr(SmallPtrSetImpl<const GlobalAlias *> &Visited, 454 const GlobalAlias &A, const Constant &C); 455 void visitNamedMDNode(const NamedMDNode &NMD); 456 void visitMDNode(const MDNode &MD, AreDebugLocsAllowed AllowLocs); 457 void visitMetadataAsValue(const MetadataAsValue &MD, Function *F); 458 void visitValueAsMetadata(const ValueAsMetadata &MD, Function *F); 459 void visitComdat(const Comdat &C); 460 void visitModuleIdents(); 461 void visitModuleCommandLines(); 462 void visitModuleFlags(); 463 void visitModuleFlag(const MDNode *Op, 464 DenseMap<const MDString *, const MDNode *> &SeenIDs, 465 SmallVectorImpl<const MDNode *> &Requirements); 466 void visitModuleFlagCGProfileEntry(const MDOperand &MDO); 467 void visitFunction(const Function &F); 468 void visitBasicBlock(BasicBlock &BB); 469 void visitRangeMetadata(Instruction &I, MDNode *Range, Type *Ty); 470 void visitDereferenceableMetadata(Instruction &I, MDNode *MD); 471 void visitProfMetadata(Instruction &I, MDNode *MD); 472 void visitAnnotationMetadata(MDNode *Annotation); 473 void visitAliasScopeMetadata(const MDNode *MD); 474 void visitAliasScopeListMetadata(const MDNode *MD); 475 void visitAccessGroupMetadata(const MDNode *MD); 476 477 template <class Ty> bool isValidMetadataArray(const MDTuple &N); 478 #define HANDLE_SPECIALIZED_MDNODE_LEAF(CLASS) void visit##CLASS(const CLASS &N); 479 #include "llvm/IR/Metadata.def" 480 void visitDIScope(const DIScope &N); 481 void visitDIVariable(const DIVariable &N); 482 void visitDILexicalBlockBase(const DILexicalBlockBase &N); 483 void visitDITemplateParameter(const DITemplateParameter &N); 484 485 void visitTemplateParams(const MDNode &N, const Metadata &RawParams); 486 487 // InstVisitor overrides... 488 using InstVisitor<Verifier>::visit; 489 void visit(Instruction &I); 490 491 void visitTruncInst(TruncInst &I); 492 void visitZExtInst(ZExtInst &I); 493 void visitSExtInst(SExtInst &I); 494 void visitFPTruncInst(FPTruncInst &I); 495 void visitFPExtInst(FPExtInst &I); 496 void visitFPToUIInst(FPToUIInst &I); 497 void visitFPToSIInst(FPToSIInst &I); 498 void visitUIToFPInst(UIToFPInst &I); 499 void visitSIToFPInst(SIToFPInst &I); 500 void visitIntToPtrInst(IntToPtrInst &I); 501 void visitPtrToIntInst(PtrToIntInst &I); 502 void visitBitCastInst(BitCastInst &I); 503 void visitAddrSpaceCastInst(AddrSpaceCastInst &I); 504 void visitPHINode(PHINode &PN); 505 void visitCallBase(CallBase &Call); 506 void visitUnaryOperator(UnaryOperator &U); 507 void visitBinaryOperator(BinaryOperator &B); 508 void visitICmpInst(ICmpInst &IC); 509 void visitFCmpInst(FCmpInst &FC); 510 void visitExtractElementInst(ExtractElementInst &EI); 511 void visitInsertElementInst(InsertElementInst &EI); 512 void visitShuffleVectorInst(ShuffleVectorInst &EI); 513 void visitVAArgInst(VAArgInst &VAA) { visitInstruction(VAA); } 514 void visitCallInst(CallInst &CI); 515 void visitInvokeInst(InvokeInst &II); 516 void visitGetElementPtrInst(GetElementPtrInst &GEP); 517 void visitLoadInst(LoadInst &LI); 518 void visitStoreInst(StoreInst &SI); 519 void verifyDominatesUse(Instruction &I, unsigned i); 520 void visitInstruction(Instruction &I); 521 void visitTerminator(Instruction &I); 522 void visitBranchInst(BranchInst &BI); 523 void visitReturnInst(ReturnInst &RI); 524 void visitSwitchInst(SwitchInst &SI); 525 void visitIndirectBrInst(IndirectBrInst &BI); 526 void visitCallBrInst(CallBrInst &CBI); 527 void visitSelectInst(SelectInst &SI); 528 void visitUserOp1(Instruction &I); 529 void visitUserOp2(Instruction &I) { visitUserOp1(I); } 530 void visitIntrinsicCall(Intrinsic::ID ID, CallBase &Call); 531 void visitConstrainedFPIntrinsic(ConstrainedFPIntrinsic &FPI); 532 void visitVPIntrinsic(VPIntrinsic &VPI); 533 void visitDbgIntrinsic(StringRef Kind, DbgVariableIntrinsic &DII); 534 void visitDbgLabelIntrinsic(StringRef Kind, DbgLabelInst &DLI); 535 void visitAtomicCmpXchgInst(AtomicCmpXchgInst &CXI); 536 void visitAtomicRMWInst(AtomicRMWInst &RMWI); 537 void visitFenceInst(FenceInst &FI); 538 void visitAllocaInst(AllocaInst &AI); 539 void visitExtractValueInst(ExtractValueInst &EVI); 540 void visitInsertValueInst(InsertValueInst &IVI); 541 void visitEHPadPredecessors(Instruction &I); 542 void visitLandingPadInst(LandingPadInst &LPI); 543 void visitResumeInst(ResumeInst &RI); 544 void visitCatchPadInst(CatchPadInst &CPI); 545 void visitCatchReturnInst(CatchReturnInst &CatchReturn); 546 void visitCleanupPadInst(CleanupPadInst &CPI); 547 void visitFuncletPadInst(FuncletPadInst &FPI); 548 void visitCatchSwitchInst(CatchSwitchInst &CatchSwitch); 549 void visitCleanupReturnInst(CleanupReturnInst &CRI); 550 551 void verifySwiftErrorCall(CallBase &Call, const Value *SwiftErrorVal); 552 void verifySwiftErrorValue(const Value *SwiftErrorVal); 553 void verifyTailCCMustTailAttrs(const AttrBuilder &Attrs, StringRef Context); 554 void verifyMustTailCall(CallInst &CI); 555 bool verifyAttributeCount(AttributeList Attrs, unsigned Params); 556 void verifyAttributeTypes(AttributeSet Attrs, const Value *V); 557 void verifyParameterAttrs(AttributeSet Attrs, Type *Ty, const Value *V); 558 void checkUnsignedBaseTenFuncAttr(AttributeList Attrs, StringRef Attr, 559 const Value *V); 560 void verifyFunctionAttrs(FunctionType *FT, AttributeList Attrs, 561 const Value *V, bool IsIntrinsic, bool IsInlineAsm); 562 void verifyFunctionMetadata(ArrayRef<std::pair<unsigned, MDNode *>> MDs); 563 564 void visitConstantExprsRecursively(const Constant *EntryC); 565 void visitConstantExpr(const ConstantExpr *CE); 566 void verifyInlineAsmCall(const CallBase &Call); 567 void verifyStatepoint(const CallBase &Call); 568 void verifyFrameRecoverIndices(); 569 void verifySiblingFuncletUnwinds(); 570 571 void verifyFragmentExpression(const DbgVariableIntrinsic &I); 572 template <typename ValueOrMetadata> 573 void verifyFragmentExpression(const DIVariable &V, 574 DIExpression::FragmentInfo Fragment, 575 ValueOrMetadata *Desc); 576 void verifyFnArgs(const DbgVariableIntrinsic &I); 577 void verifyNotEntryValue(const DbgVariableIntrinsic &I); 578 579 /// Module-level debug info verification... 580 void verifyCompileUnits(); 581 582 /// Module-level verification that all @llvm.experimental.deoptimize 583 /// declarations share the same calling convention. 584 void verifyDeoptimizeCallingConvs(); 585 586 void verifyAttachedCallBundle(const CallBase &Call, 587 const OperandBundleUse &BU); 588 589 /// Verify all-or-nothing property of DIFile source attribute within a CU. 590 void verifySourceDebugInfo(const DICompileUnit &U, const DIFile &F); 591 592 /// Verify the llvm.experimental.noalias.scope.decl declarations 593 void verifyNoAliasScopeDecl(); 594 }; 595 596 } // end anonymous namespace 597 598 /// We know that cond should be true, if not print an error message. 599 #define Check(C, ...) \ 600 do { \ 601 if (!(C)) { \ 602 CheckFailed(__VA_ARGS__); \ 603 return; \ 604 } \ 605 } while (false) 606 607 /// We know that a debug info condition should be true, if not print 608 /// an error message. 609 #define CheckDI(C, ...) \ 610 do { \ 611 if (!(C)) { \ 612 DebugInfoCheckFailed(__VA_ARGS__); \ 613 return; \ 614 } \ 615 } while (false) 616 617 void Verifier::visit(Instruction &I) { 618 for (unsigned i = 0, e = I.getNumOperands(); i != e; ++i) 619 Check(I.getOperand(i) != nullptr, "Operand is null", &I); 620 InstVisitor<Verifier>::visit(I); 621 } 622 623 // Helper to iterate over indirect users. By returning false, the callback can ask to stop traversing further. 624 static void forEachUser(const Value *User, 625 SmallPtrSet<const Value *, 32> &Visited, 626 llvm::function_ref<bool(const Value *)> Callback) { 627 if (!Visited.insert(User).second) 628 return; 629 630 SmallVector<const Value *> WorkList; 631 append_range(WorkList, User->materialized_users()); 632 while (!WorkList.empty()) { 633 const Value *Cur = WorkList.pop_back_val(); 634 if (!Visited.insert(Cur).second) 635 continue; 636 if (Callback(Cur)) 637 append_range(WorkList, Cur->materialized_users()); 638 } 639 } 640 641 void Verifier::visitGlobalValue(const GlobalValue &GV) { 642 Check(!GV.isDeclaration() || GV.hasValidDeclarationLinkage(), 643 "Global is external, but doesn't have external or weak linkage!", &GV); 644 645 if (const GlobalObject *GO = dyn_cast<GlobalObject>(&GV)) { 646 647 if (MaybeAlign A = GO->getAlign()) { 648 Check(A->value() <= Value::MaximumAlignment, 649 "huge alignment values are unsupported", GO); 650 } 651 } 652 Check(!GV.hasAppendingLinkage() || isa<GlobalVariable>(GV), 653 "Only global variables can have appending linkage!", &GV); 654 655 if (GV.hasAppendingLinkage()) { 656 const GlobalVariable *GVar = dyn_cast<GlobalVariable>(&GV); 657 Check(GVar && GVar->getValueType()->isArrayTy(), 658 "Only global arrays can have appending linkage!", GVar); 659 } 660 661 if (GV.isDeclarationForLinker()) 662 Check(!GV.hasComdat(), "Declaration may not be in a Comdat!", &GV); 663 664 if (GV.hasDLLImportStorageClass()) { 665 Check(!GV.isDSOLocal(), "GlobalValue with DLLImport Storage is dso_local!", 666 &GV); 667 668 Check((GV.isDeclaration() && 669 (GV.hasExternalLinkage() || GV.hasExternalWeakLinkage())) || 670 GV.hasAvailableExternallyLinkage(), 671 "Global is marked as dllimport, but not external", &GV); 672 } 673 674 if (GV.isImplicitDSOLocal()) 675 Check(GV.isDSOLocal(), 676 "GlobalValue with local linkage or non-default " 677 "visibility must be dso_local!", 678 &GV); 679 680 forEachUser(&GV, GlobalValueVisited, [&](const Value *V) -> bool { 681 if (const Instruction *I = dyn_cast<Instruction>(V)) { 682 if (!I->getParent() || !I->getParent()->getParent()) 683 CheckFailed("Global is referenced by parentless instruction!", &GV, &M, 684 I); 685 else if (I->getParent()->getParent()->getParent() != &M) 686 CheckFailed("Global is referenced in a different module!", &GV, &M, I, 687 I->getParent()->getParent(), 688 I->getParent()->getParent()->getParent()); 689 return false; 690 } else if (const Function *F = dyn_cast<Function>(V)) { 691 if (F->getParent() != &M) 692 CheckFailed("Global is used by function in a different module", &GV, &M, 693 F, F->getParent()); 694 return false; 695 } 696 return true; 697 }); 698 } 699 700 void Verifier::visitGlobalVariable(const GlobalVariable &GV) { 701 if (GV.hasInitializer()) { 702 Check(GV.getInitializer()->getType() == GV.getValueType(), 703 "Global variable initializer type does not match global " 704 "variable type!", 705 &GV); 706 // If the global has common linkage, it must have a zero initializer and 707 // cannot be constant. 708 if (GV.hasCommonLinkage()) { 709 Check(GV.getInitializer()->isNullValue(), 710 "'common' global must have a zero initializer!", &GV); 711 Check(!GV.isConstant(), "'common' global may not be marked constant!", 712 &GV); 713 Check(!GV.hasComdat(), "'common' global may not be in a Comdat!", &GV); 714 } 715 } 716 717 if (GV.hasName() && (GV.getName() == "llvm.global_ctors" || 718 GV.getName() == "llvm.global_dtors")) { 719 Check(!GV.hasInitializer() || GV.hasAppendingLinkage(), 720 "invalid linkage for intrinsic global variable", &GV); 721 // Don't worry about emitting an error for it not being an array, 722 // visitGlobalValue will complain on appending non-array. 723 if (ArrayType *ATy = dyn_cast<ArrayType>(GV.getValueType())) { 724 StructType *STy = dyn_cast<StructType>(ATy->getElementType()); 725 PointerType *FuncPtrTy = 726 FunctionType::get(Type::getVoidTy(Context), false)-> 727 getPointerTo(DL.getProgramAddressSpace()); 728 Check(STy && (STy->getNumElements() == 2 || STy->getNumElements() == 3) && 729 STy->getTypeAtIndex(0u)->isIntegerTy(32) && 730 STy->getTypeAtIndex(1) == FuncPtrTy, 731 "wrong type for intrinsic global variable", &GV); 732 Check(STy->getNumElements() == 3, 733 "the third field of the element type is mandatory, " 734 "specify i8* null to migrate from the obsoleted 2-field form"); 735 Type *ETy = STy->getTypeAtIndex(2); 736 Type *Int8Ty = Type::getInt8Ty(ETy->getContext()); 737 Check(ETy->isPointerTy() && 738 cast<PointerType>(ETy)->isOpaqueOrPointeeTypeMatches(Int8Ty), 739 "wrong type for intrinsic global variable", &GV); 740 } 741 } 742 743 if (GV.hasName() && (GV.getName() == "llvm.used" || 744 GV.getName() == "llvm.compiler.used")) { 745 Check(!GV.hasInitializer() || GV.hasAppendingLinkage(), 746 "invalid linkage for intrinsic global variable", &GV); 747 Type *GVType = GV.getValueType(); 748 if (ArrayType *ATy = dyn_cast<ArrayType>(GVType)) { 749 PointerType *PTy = dyn_cast<PointerType>(ATy->getElementType()); 750 Check(PTy, "wrong type for intrinsic global variable", &GV); 751 if (GV.hasInitializer()) { 752 const Constant *Init = GV.getInitializer(); 753 const ConstantArray *InitArray = dyn_cast<ConstantArray>(Init); 754 Check(InitArray, "wrong initalizer for intrinsic global variable", 755 Init); 756 for (Value *Op : InitArray->operands()) { 757 Value *V = Op->stripPointerCasts(); 758 Check(isa<GlobalVariable>(V) || isa<Function>(V) || 759 isa<GlobalAlias>(V), 760 Twine("invalid ") + GV.getName() + " member", V); 761 Check(V->hasName(), 762 Twine("members of ") + GV.getName() + " must be named", V); 763 } 764 } 765 } 766 } 767 768 // Visit any debug info attachments. 769 SmallVector<MDNode *, 1> MDs; 770 GV.getMetadata(LLVMContext::MD_dbg, MDs); 771 for (auto *MD : MDs) { 772 if (auto *GVE = dyn_cast<DIGlobalVariableExpression>(MD)) 773 visitDIGlobalVariableExpression(*GVE); 774 else 775 CheckDI(false, "!dbg attachment of global variable must be a " 776 "DIGlobalVariableExpression"); 777 } 778 779 // Scalable vectors cannot be global variables, since we don't know 780 // the runtime size. If the global is an array containing scalable vectors, 781 // that will be caught by the isValidElementType methods in StructType or 782 // ArrayType instead. 783 Check(!isa<ScalableVectorType>(GV.getValueType()), 784 "Globals cannot contain scalable vectors", &GV); 785 786 if (auto *STy = dyn_cast<StructType>(GV.getValueType())) 787 Check(!STy->containsScalableVectorType(), 788 "Globals cannot contain scalable vectors", &GV); 789 790 if (!GV.hasInitializer()) { 791 visitGlobalValue(GV); 792 return; 793 } 794 795 // Walk any aggregate initializers looking for bitcasts between address spaces 796 visitConstantExprsRecursively(GV.getInitializer()); 797 798 visitGlobalValue(GV); 799 } 800 801 void Verifier::visitAliaseeSubExpr(const GlobalAlias &GA, const Constant &C) { 802 SmallPtrSet<const GlobalAlias*, 4> Visited; 803 Visited.insert(&GA); 804 visitAliaseeSubExpr(Visited, GA, C); 805 } 806 807 void Verifier::visitAliaseeSubExpr(SmallPtrSetImpl<const GlobalAlias*> &Visited, 808 const GlobalAlias &GA, const Constant &C) { 809 if (const auto *GV = dyn_cast<GlobalValue>(&C)) { 810 Check(!GV->isDeclarationForLinker(), "Alias must point to a definition", 811 &GA); 812 813 if (const auto *GA2 = dyn_cast<GlobalAlias>(GV)) { 814 Check(Visited.insert(GA2).second, "Aliases cannot form a cycle", &GA); 815 816 Check(!GA2->isInterposable(), 817 "Alias cannot point to an interposable alias", &GA); 818 } else { 819 // Only continue verifying subexpressions of GlobalAliases. 820 // Do not recurse into global initializers. 821 return; 822 } 823 } 824 825 if (const auto *CE = dyn_cast<ConstantExpr>(&C)) 826 visitConstantExprsRecursively(CE); 827 828 for (const Use &U : C.operands()) { 829 Value *V = &*U; 830 if (const auto *GA2 = dyn_cast<GlobalAlias>(V)) 831 visitAliaseeSubExpr(Visited, GA, *GA2->getAliasee()); 832 else if (const auto *C2 = dyn_cast<Constant>(V)) 833 visitAliaseeSubExpr(Visited, GA, *C2); 834 } 835 } 836 837 void Verifier::visitGlobalAlias(const GlobalAlias &GA) { 838 Check(GlobalAlias::isValidLinkage(GA.getLinkage()), 839 "Alias should have private, internal, linkonce, weak, linkonce_odr, " 840 "weak_odr, or external linkage!", 841 &GA); 842 const Constant *Aliasee = GA.getAliasee(); 843 Check(Aliasee, "Aliasee cannot be NULL!", &GA); 844 Check(GA.getType() == Aliasee->getType(), 845 "Alias and aliasee types should match!", &GA); 846 847 Check(isa<GlobalValue>(Aliasee) || isa<ConstantExpr>(Aliasee), 848 "Aliasee should be either GlobalValue or ConstantExpr", &GA); 849 850 visitAliaseeSubExpr(GA, *Aliasee); 851 852 visitGlobalValue(GA); 853 } 854 855 void Verifier::visitGlobalIFunc(const GlobalIFunc &GI) { 856 Check(GlobalIFunc::isValidLinkage(GI.getLinkage()), 857 "IFunc should have private, internal, linkonce, weak, linkonce_odr, " 858 "weak_odr, or external linkage!", 859 &GI); 860 // Pierce through ConstantExprs and GlobalAliases and check that the resolver 861 // is a Function definition. 862 const Function *Resolver = GI.getResolverFunction(); 863 Check(Resolver, "IFunc must have a Function resolver", &GI); 864 Check(!Resolver->isDeclarationForLinker(), 865 "IFunc resolver must be a definition", &GI); 866 867 // Check that the immediate resolver operand (prior to any bitcasts) has the 868 // correct type. 869 const Type *ResolverTy = GI.getResolver()->getType(); 870 const Type *ResolverFuncTy = 871 GlobalIFunc::getResolverFunctionType(GI.getValueType()); 872 Check(ResolverTy == ResolverFuncTy->getPointerTo(), 873 "IFunc resolver has incorrect type", &GI); 874 } 875 876 void Verifier::visitNamedMDNode(const NamedMDNode &NMD) { 877 // There used to be various other llvm.dbg.* nodes, but we don't support 878 // upgrading them and we want to reserve the namespace for future uses. 879 if (NMD.getName().startswith("llvm.dbg.")) 880 CheckDI(NMD.getName() == "llvm.dbg.cu", 881 "unrecognized named metadata node in the llvm.dbg namespace", &NMD); 882 for (const MDNode *MD : NMD.operands()) { 883 if (NMD.getName() == "llvm.dbg.cu") 884 CheckDI(MD && isa<DICompileUnit>(MD), "invalid compile unit", &NMD, MD); 885 886 if (!MD) 887 continue; 888 889 visitMDNode(*MD, AreDebugLocsAllowed::Yes); 890 } 891 } 892 893 void Verifier::visitMDNode(const MDNode &MD, AreDebugLocsAllowed AllowLocs) { 894 // Only visit each node once. Metadata can be mutually recursive, so this 895 // avoids infinite recursion here, as well as being an optimization. 896 if (!MDNodes.insert(&MD).second) 897 return; 898 899 Check(&MD.getContext() == &Context, 900 "MDNode context does not match Module context!", &MD); 901 902 switch (MD.getMetadataID()) { 903 default: 904 llvm_unreachable("Invalid MDNode subclass"); 905 case Metadata::MDTupleKind: 906 break; 907 #define HANDLE_SPECIALIZED_MDNODE_LEAF(CLASS) \ 908 case Metadata::CLASS##Kind: \ 909 visit##CLASS(cast<CLASS>(MD)); \ 910 break; 911 #include "llvm/IR/Metadata.def" 912 } 913 914 for (const Metadata *Op : MD.operands()) { 915 if (!Op) 916 continue; 917 Check(!isa<LocalAsMetadata>(Op), "Invalid operand for global metadata!", 918 &MD, Op); 919 CheckDI(!isa<DILocation>(Op) || AllowLocs == AreDebugLocsAllowed::Yes, 920 "DILocation not allowed within this metadata node", &MD, Op); 921 if (auto *N = dyn_cast<MDNode>(Op)) { 922 visitMDNode(*N, AllowLocs); 923 continue; 924 } 925 if (auto *V = dyn_cast<ValueAsMetadata>(Op)) { 926 visitValueAsMetadata(*V, nullptr); 927 continue; 928 } 929 } 930 931 // Check these last, so we diagnose problems in operands first. 932 Check(!MD.isTemporary(), "Expected no forward declarations!", &MD); 933 Check(MD.isResolved(), "All nodes should be resolved!", &MD); 934 } 935 936 void Verifier::visitValueAsMetadata(const ValueAsMetadata &MD, Function *F) { 937 Check(MD.getValue(), "Expected valid value", &MD); 938 Check(!MD.getValue()->getType()->isMetadataTy(), 939 "Unexpected metadata round-trip through values", &MD, MD.getValue()); 940 941 auto *L = dyn_cast<LocalAsMetadata>(&MD); 942 if (!L) 943 return; 944 945 Check(F, "function-local metadata used outside a function", L); 946 947 // If this was an instruction, bb, or argument, verify that it is in the 948 // function that we expect. 949 Function *ActualF = nullptr; 950 if (Instruction *I = dyn_cast<Instruction>(L->getValue())) { 951 Check(I->getParent(), "function-local metadata not in basic block", L, I); 952 ActualF = I->getParent()->getParent(); 953 } else if (BasicBlock *BB = dyn_cast<BasicBlock>(L->getValue())) 954 ActualF = BB->getParent(); 955 else if (Argument *A = dyn_cast<Argument>(L->getValue())) 956 ActualF = A->getParent(); 957 assert(ActualF && "Unimplemented function local metadata case!"); 958 959 Check(ActualF == F, "function-local metadata used in wrong function", L); 960 } 961 962 void Verifier::visitMetadataAsValue(const MetadataAsValue &MDV, Function *F) { 963 Metadata *MD = MDV.getMetadata(); 964 if (auto *N = dyn_cast<MDNode>(MD)) { 965 visitMDNode(*N, AreDebugLocsAllowed::No); 966 return; 967 } 968 969 // Only visit each node once. Metadata can be mutually recursive, so this 970 // avoids infinite recursion here, as well as being an optimization. 971 if (!MDNodes.insert(MD).second) 972 return; 973 974 if (auto *V = dyn_cast<ValueAsMetadata>(MD)) 975 visitValueAsMetadata(*V, F); 976 } 977 978 static bool isType(const Metadata *MD) { return !MD || isa<DIType>(MD); } 979 static bool isScope(const Metadata *MD) { return !MD || isa<DIScope>(MD); } 980 static bool isDINode(const Metadata *MD) { return !MD || isa<DINode>(MD); } 981 982 void Verifier::visitDILocation(const DILocation &N) { 983 CheckDI(N.getRawScope() && isa<DILocalScope>(N.getRawScope()), 984 "location requires a valid scope", &N, N.getRawScope()); 985 if (auto *IA = N.getRawInlinedAt()) 986 CheckDI(isa<DILocation>(IA), "inlined-at should be a location", &N, IA); 987 if (auto *SP = dyn_cast<DISubprogram>(N.getRawScope())) 988 CheckDI(SP->isDefinition(), "scope points into the type hierarchy", &N); 989 } 990 991 void Verifier::visitGenericDINode(const GenericDINode &N) { 992 CheckDI(N.getTag(), "invalid tag", &N); 993 } 994 995 void Verifier::visitDIScope(const DIScope &N) { 996 if (auto *F = N.getRawFile()) 997 CheckDI(isa<DIFile>(F), "invalid file", &N, F); 998 } 999 1000 void Verifier::visitDISubrange(const DISubrange &N) { 1001 CheckDI(N.getTag() == dwarf::DW_TAG_subrange_type, "invalid tag", &N); 1002 bool HasAssumedSizedArraySupport = dwarf::isFortran(CurrentSourceLang); 1003 CheckDI(HasAssumedSizedArraySupport || N.getRawCountNode() || 1004 N.getRawUpperBound(), 1005 "Subrange must contain count or upperBound", &N); 1006 CheckDI(!N.getRawCountNode() || !N.getRawUpperBound(), 1007 "Subrange can have any one of count or upperBound", &N); 1008 auto *CBound = N.getRawCountNode(); 1009 CheckDI(!CBound || isa<ConstantAsMetadata>(CBound) || 1010 isa<DIVariable>(CBound) || isa<DIExpression>(CBound), 1011 "Count must be signed constant or DIVariable or DIExpression", &N); 1012 auto Count = N.getCount(); 1013 CheckDI(!Count || !Count.is<ConstantInt *>() || 1014 Count.get<ConstantInt *>()->getSExtValue() >= -1, 1015 "invalid subrange count", &N); 1016 auto *LBound = N.getRawLowerBound(); 1017 CheckDI(!LBound || isa<ConstantAsMetadata>(LBound) || 1018 isa<DIVariable>(LBound) || isa<DIExpression>(LBound), 1019 "LowerBound must be signed constant or DIVariable or DIExpression", 1020 &N); 1021 auto *UBound = N.getRawUpperBound(); 1022 CheckDI(!UBound || isa<ConstantAsMetadata>(UBound) || 1023 isa<DIVariable>(UBound) || isa<DIExpression>(UBound), 1024 "UpperBound must be signed constant or DIVariable or DIExpression", 1025 &N); 1026 auto *Stride = N.getRawStride(); 1027 CheckDI(!Stride || isa<ConstantAsMetadata>(Stride) || 1028 isa<DIVariable>(Stride) || isa<DIExpression>(Stride), 1029 "Stride must be signed constant or DIVariable or DIExpression", &N); 1030 } 1031 1032 void Verifier::visitDIGenericSubrange(const DIGenericSubrange &N) { 1033 CheckDI(N.getTag() == dwarf::DW_TAG_generic_subrange, "invalid tag", &N); 1034 CheckDI(N.getRawCountNode() || N.getRawUpperBound(), 1035 "GenericSubrange must contain count or upperBound", &N); 1036 CheckDI(!N.getRawCountNode() || !N.getRawUpperBound(), 1037 "GenericSubrange can have any one of count or upperBound", &N); 1038 auto *CBound = N.getRawCountNode(); 1039 CheckDI(!CBound || isa<DIVariable>(CBound) || isa<DIExpression>(CBound), 1040 "Count must be signed constant or DIVariable or DIExpression", &N); 1041 auto *LBound = N.getRawLowerBound(); 1042 CheckDI(LBound, "GenericSubrange must contain lowerBound", &N); 1043 CheckDI(isa<DIVariable>(LBound) || isa<DIExpression>(LBound), 1044 "LowerBound must be signed constant or DIVariable or DIExpression", 1045 &N); 1046 auto *UBound = N.getRawUpperBound(); 1047 CheckDI(!UBound || isa<DIVariable>(UBound) || isa<DIExpression>(UBound), 1048 "UpperBound must be signed constant or DIVariable or DIExpression", 1049 &N); 1050 auto *Stride = N.getRawStride(); 1051 CheckDI(Stride, "GenericSubrange must contain stride", &N); 1052 CheckDI(isa<DIVariable>(Stride) || isa<DIExpression>(Stride), 1053 "Stride must be signed constant or DIVariable or DIExpression", &N); 1054 } 1055 1056 void Verifier::visitDIEnumerator(const DIEnumerator &N) { 1057 CheckDI(N.getTag() == dwarf::DW_TAG_enumerator, "invalid tag", &N); 1058 } 1059 1060 void Verifier::visitDIBasicType(const DIBasicType &N) { 1061 CheckDI(N.getTag() == dwarf::DW_TAG_base_type || 1062 N.getTag() == dwarf::DW_TAG_unspecified_type || 1063 N.getTag() == dwarf::DW_TAG_string_type, 1064 "invalid tag", &N); 1065 } 1066 1067 void Verifier::visitDIStringType(const DIStringType &N) { 1068 CheckDI(N.getTag() == dwarf::DW_TAG_string_type, "invalid tag", &N); 1069 CheckDI(!(N.isBigEndian() && N.isLittleEndian()), "has conflicting flags", 1070 &N); 1071 } 1072 1073 void Verifier::visitDIDerivedType(const DIDerivedType &N) { 1074 // Common scope checks. 1075 visitDIScope(N); 1076 1077 CheckDI(N.getTag() == dwarf::DW_TAG_typedef || 1078 N.getTag() == dwarf::DW_TAG_pointer_type || 1079 N.getTag() == dwarf::DW_TAG_ptr_to_member_type || 1080 N.getTag() == dwarf::DW_TAG_reference_type || 1081 N.getTag() == dwarf::DW_TAG_rvalue_reference_type || 1082 N.getTag() == dwarf::DW_TAG_const_type || 1083 N.getTag() == dwarf::DW_TAG_immutable_type || 1084 N.getTag() == dwarf::DW_TAG_volatile_type || 1085 N.getTag() == dwarf::DW_TAG_restrict_type || 1086 N.getTag() == dwarf::DW_TAG_atomic_type || 1087 N.getTag() == dwarf::DW_TAG_member || 1088 N.getTag() == dwarf::DW_TAG_inheritance || 1089 N.getTag() == dwarf::DW_TAG_friend || 1090 N.getTag() == dwarf::DW_TAG_set_type, 1091 "invalid tag", &N); 1092 if (N.getTag() == dwarf::DW_TAG_ptr_to_member_type) { 1093 CheckDI(isType(N.getRawExtraData()), "invalid pointer to member type", &N, 1094 N.getRawExtraData()); 1095 } 1096 1097 if (N.getTag() == dwarf::DW_TAG_set_type) { 1098 if (auto *T = N.getRawBaseType()) { 1099 auto *Enum = dyn_cast_or_null<DICompositeType>(T); 1100 auto *Basic = dyn_cast_or_null<DIBasicType>(T); 1101 CheckDI( 1102 (Enum && Enum->getTag() == dwarf::DW_TAG_enumeration_type) || 1103 (Basic && (Basic->getEncoding() == dwarf::DW_ATE_unsigned || 1104 Basic->getEncoding() == dwarf::DW_ATE_signed || 1105 Basic->getEncoding() == dwarf::DW_ATE_unsigned_char || 1106 Basic->getEncoding() == dwarf::DW_ATE_signed_char || 1107 Basic->getEncoding() == dwarf::DW_ATE_boolean)), 1108 "invalid set base type", &N, T); 1109 } 1110 } 1111 1112 CheckDI(isScope(N.getRawScope()), "invalid scope", &N, N.getRawScope()); 1113 CheckDI(isType(N.getRawBaseType()), "invalid base type", &N, 1114 N.getRawBaseType()); 1115 1116 if (N.getDWARFAddressSpace()) { 1117 CheckDI(N.getTag() == dwarf::DW_TAG_pointer_type || 1118 N.getTag() == dwarf::DW_TAG_reference_type || 1119 N.getTag() == dwarf::DW_TAG_rvalue_reference_type, 1120 "DWARF address space only applies to pointer or reference types", 1121 &N); 1122 } 1123 } 1124 1125 /// Detect mutually exclusive flags. 1126 static bool hasConflictingReferenceFlags(unsigned Flags) { 1127 return ((Flags & DINode::FlagLValueReference) && 1128 (Flags & DINode::FlagRValueReference)) || 1129 ((Flags & DINode::FlagTypePassByValue) && 1130 (Flags & DINode::FlagTypePassByReference)); 1131 } 1132 1133 void Verifier::visitTemplateParams(const MDNode &N, const Metadata &RawParams) { 1134 auto *Params = dyn_cast<MDTuple>(&RawParams); 1135 CheckDI(Params, "invalid template params", &N, &RawParams); 1136 for (Metadata *Op : Params->operands()) { 1137 CheckDI(Op && isa<DITemplateParameter>(Op), "invalid template parameter", 1138 &N, Params, Op); 1139 } 1140 } 1141 1142 void Verifier::visitDICompositeType(const DICompositeType &N) { 1143 // Common scope checks. 1144 visitDIScope(N); 1145 1146 CheckDI(N.getTag() == dwarf::DW_TAG_array_type || 1147 N.getTag() == dwarf::DW_TAG_structure_type || 1148 N.getTag() == dwarf::DW_TAG_union_type || 1149 N.getTag() == dwarf::DW_TAG_enumeration_type || 1150 N.getTag() == dwarf::DW_TAG_class_type || 1151 N.getTag() == dwarf::DW_TAG_variant_part || 1152 N.getTag() == dwarf::DW_TAG_namelist, 1153 "invalid tag", &N); 1154 1155 CheckDI(isScope(N.getRawScope()), "invalid scope", &N, N.getRawScope()); 1156 CheckDI(isType(N.getRawBaseType()), "invalid base type", &N, 1157 N.getRawBaseType()); 1158 1159 CheckDI(!N.getRawElements() || isa<MDTuple>(N.getRawElements()), 1160 "invalid composite elements", &N, N.getRawElements()); 1161 CheckDI(isType(N.getRawVTableHolder()), "invalid vtable holder", &N, 1162 N.getRawVTableHolder()); 1163 CheckDI(!hasConflictingReferenceFlags(N.getFlags()), 1164 "invalid reference flags", &N); 1165 unsigned DIBlockByRefStruct = 1 << 4; 1166 CheckDI((N.getFlags() & DIBlockByRefStruct) == 0, 1167 "DIBlockByRefStruct on DICompositeType is no longer supported", &N); 1168 1169 if (N.isVector()) { 1170 const DINodeArray Elements = N.getElements(); 1171 CheckDI(Elements.size() == 1 && 1172 Elements[0]->getTag() == dwarf::DW_TAG_subrange_type, 1173 "invalid vector, expected one element of type subrange", &N); 1174 } 1175 1176 if (auto *Params = N.getRawTemplateParams()) 1177 visitTemplateParams(N, *Params); 1178 1179 if (auto *D = N.getRawDiscriminator()) { 1180 CheckDI(isa<DIDerivedType>(D) && N.getTag() == dwarf::DW_TAG_variant_part, 1181 "discriminator can only appear on variant part"); 1182 } 1183 1184 if (N.getRawDataLocation()) { 1185 CheckDI(N.getTag() == dwarf::DW_TAG_array_type, 1186 "dataLocation can only appear in array type"); 1187 } 1188 1189 if (N.getRawAssociated()) { 1190 CheckDI(N.getTag() == dwarf::DW_TAG_array_type, 1191 "associated can only appear in array type"); 1192 } 1193 1194 if (N.getRawAllocated()) { 1195 CheckDI(N.getTag() == dwarf::DW_TAG_array_type, 1196 "allocated can only appear in array type"); 1197 } 1198 1199 if (N.getRawRank()) { 1200 CheckDI(N.getTag() == dwarf::DW_TAG_array_type, 1201 "rank can only appear in array type"); 1202 } 1203 } 1204 1205 void Verifier::visitDISubroutineType(const DISubroutineType &N) { 1206 CheckDI(N.getTag() == dwarf::DW_TAG_subroutine_type, "invalid tag", &N); 1207 if (auto *Types = N.getRawTypeArray()) { 1208 CheckDI(isa<MDTuple>(Types), "invalid composite elements", &N, Types); 1209 for (Metadata *Ty : N.getTypeArray()->operands()) { 1210 CheckDI(isType(Ty), "invalid subroutine type ref", &N, Types, Ty); 1211 } 1212 } 1213 CheckDI(!hasConflictingReferenceFlags(N.getFlags()), 1214 "invalid reference flags", &N); 1215 } 1216 1217 void Verifier::visitDIFile(const DIFile &N) { 1218 CheckDI(N.getTag() == dwarf::DW_TAG_file_type, "invalid tag", &N); 1219 Optional<DIFile::ChecksumInfo<StringRef>> Checksum = N.getChecksum(); 1220 if (Checksum) { 1221 CheckDI(Checksum->Kind <= DIFile::ChecksumKind::CSK_Last, 1222 "invalid checksum kind", &N); 1223 size_t Size; 1224 switch (Checksum->Kind) { 1225 case DIFile::CSK_MD5: 1226 Size = 32; 1227 break; 1228 case DIFile::CSK_SHA1: 1229 Size = 40; 1230 break; 1231 case DIFile::CSK_SHA256: 1232 Size = 64; 1233 break; 1234 } 1235 CheckDI(Checksum->Value.size() == Size, "invalid checksum length", &N); 1236 CheckDI(Checksum->Value.find_if_not(llvm::isHexDigit) == StringRef::npos, 1237 "invalid checksum", &N); 1238 } 1239 } 1240 1241 void Verifier::visitDICompileUnit(const DICompileUnit &N) { 1242 CheckDI(N.isDistinct(), "compile units must be distinct", &N); 1243 CheckDI(N.getTag() == dwarf::DW_TAG_compile_unit, "invalid tag", &N); 1244 1245 // Don't bother verifying the compilation directory or producer string 1246 // as those could be empty. 1247 CheckDI(N.getRawFile() && isa<DIFile>(N.getRawFile()), "invalid file", &N, 1248 N.getRawFile()); 1249 CheckDI(!N.getFile()->getFilename().empty(), "invalid filename", &N, 1250 N.getFile()); 1251 1252 CurrentSourceLang = (dwarf::SourceLanguage)N.getSourceLanguage(); 1253 1254 verifySourceDebugInfo(N, *N.getFile()); 1255 1256 CheckDI((N.getEmissionKind() <= DICompileUnit::LastEmissionKind), 1257 "invalid emission kind", &N); 1258 1259 if (auto *Array = N.getRawEnumTypes()) { 1260 CheckDI(isa<MDTuple>(Array), "invalid enum list", &N, Array); 1261 for (Metadata *Op : N.getEnumTypes()->operands()) { 1262 auto *Enum = dyn_cast_or_null<DICompositeType>(Op); 1263 CheckDI(Enum && Enum->getTag() == dwarf::DW_TAG_enumeration_type, 1264 "invalid enum type", &N, N.getEnumTypes(), Op); 1265 } 1266 } 1267 if (auto *Array = N.getRawRetainedTypes()) { 1268 CheckDI(isa<MDTuple>(Array), "invalid retained type list", &N, Array); 1269 for (Metadata *Op : N.getRetainedTypes()->operands()) { 1270 CheckDI( 1271 Op && (isa<DIType>(Op) || (isa<DISubprogram>(Op) && 1272 !cast<DISubprogram>(Op)->isDefinition())), 1273 "invalid retained type", &N, Op); 1274 } 1275 } 1276 if (auto *Array = N.getRawGlobalVariables()) { 1277 CheckDI(isa<MDTuple>(Array), "invalid global variable list", &N, Array); 1278 for (Metadata *Op : N.getGlobalVariables()->operands()) { 1279 CheckDI(Op && (isa<DIGlobalVariableExpression>(Op)), 1280 "invalid global variable ref", &N, Op); 1281 } 1282 } 1283 if (auto *Array = N.getRawImportedEntities()) { 1284 CheckDI(isa<MDTuple>(Array), "invalid imported entity list", &N, Array); 1285 for (Metadata *Op : N.getImportedEntities()->operands()) { 1286 CheckDI(Op && isa<DIImportedEntity>(Op), "invalid imported entity ref", 1287 &N, Op); 1288 } 1289 } 1290 if (auto *Array = N.getRawMacros()) { 1291 CheckDI(isa<MDTuple>(Array), "invalid macro list", &N, Array); 1292 for (Metadata *Op : N.getMacros()->operands()) { 1293 CheckDI(Op && isa<DIMacroNode>(Op), "invalid macro ref", &N, Op); 1294 } 1295 } 1296 CUVisited.insert(&N); 1297 } 1298 1299 void Verifier::visitDISubprogram(const DISubprogram &N) { 1300 CheckDI(N.getTag() == dwarf::DW_TAG_subprogram, "invalid tag", &N); 1301 CheckDI(isScope(N.getRawScope()), "invalid scope", &N, N.getRawScope()); 1302 if (auto *F = N.getRawFile()) 1303 CheckDI(isa<DIFile>(F), "invalid file", &N, F); 1304 else 1305 CheckDI(N.getLine() == 0, "line specified with no file", &N, N.getLine()); 1306 if (auto *T = N.getRawType()) 1307 CheckDI(isa<DISubroutineType>(T), "invalid subroutine type", &N, T); 1308 CheckDI(isType(N.getRawContainingType()), "invalid containing type", &N, 1309 N.getRawContainingType()); 1310 if (auto *Params = N.getRawTemplateParams()) 1311 visitTemplateParams(N, *Params); 1312 if (auto *S = N.getRawDeclaration()) 1313 CheckDI(isa<DISubprogram>(S) && !cast<DISubprogram>(S)->isDefinition(), 1314 "invalid subprogram declaration", &N, S); 1315 if (auto *RawNode = N.getRawRetainedNodes()) { 1316 auto *Node = dyn_cast<MDTuple>(RawNode); 1317 CheckDI(Node, "invalid retained nodes list", &N, RawNode); 1318 for (Metadata *Op : Node->operands()) { 1319 CheckDI(Op && (isa<DILocalVariable>(Op) || isa<DILabel>(Op)), 1320 "invalid retained nodes, expected DILocalVariable or DILabel", &N, 1321 Node, Op); 1322 } 1323 } 1324 CheckDI(!hasConflictingReferenceFlags(N.getFlags()), 1325 "invalid reference flags", &N); 1326 1327 auto *Unit = N.getRawUnit(); 1328 if (N.isDefinition()) { 1329 // Subprogram definitions (not part of the type hierarchy). 1330 CheckDI(N.isDistinct(), "subprogram definitions must be distinct", &N); 1331 CheckDI(Unit, "subprogram definitions must have a compile unit", &N); 1332 CheckDI(isa<DICompileUnit>(Unit), "invalid unit type", &N, Unit); 1333 if (N.getFile()) 1334 verifySourceDebugInfo(*N.getUnit(), *N.getFile()); 1335 } else { 1336 // Subprogram declarations (part of the type hierarchy). 1337 CheckDI(!Unit, "subprogram declarations must not have a compile unit", &N); 1338 } 1339 1340 if (auto *RawThrownTypes = N.getRawThrownTypes()) { 1341 auto *ThrownTypes = dyn_cast<MDTuple>(RawThrownTypes); 1342 CheckDI(ThrownTypes, "invalid thrown types list", &N, RawThrownTypes); 1343 for (Metadata *Op : ThrownTypes->operands()) 1344 CheckDI(Op && isa<DIType>(Op), "invalid thrown type", &N, ThrownTypes, 1345 Op); 1346 } 1347 1348 if (N.areAllCallsDescribed()) 1349 CheckDI(N.isDefinition(), 1350 "DIFlagAllCallsDescribed must be attached to a definition"); 1351 } 1352 1353 void Verifier::visitDILexicalBlockBase(const DILexicalBlockBase &N) { 1354 CheckDI(N.getTag() == dwarf::DW_TAG_lexical_block, "invalid tag", &N); 1355 CheckDI(N.getRawScope() && isa<DILocalScope>(N.getRawScope()), 1356 "invalid local scope", &N, N.getRawScope()); 1357 if (auto *SP = dyn_cast<DISubprogram>(N.getRawScope())) 1358 CheckDI(SP->isDefinition(), "scope points into the type hierarchy", &N); 1359 } 1360 1361 void Verifier::visitDILexicalBlock(const DILexicalBlock &N) { 1362 visitDILexicalBlockBase(N); 1363 1364 CheckDI(N.getLine() || !N.getColumn(), 1365 "cannot have column info without line info", &N); 1366 } 1367 1368 void Verifier::visitDILexicalBlockFile(const DILexicalBlockFile &N) { 1369 visitDILexicalBlockBase(N); 1370 } 1371 1372 void Verifier::visitDICommonBlock(const DICommonBlock &N) { 1373 CheckDI(N.getTag() == dwarf::DW_TAG_common_block, "invalid tag", &N); 1374 if (auto *S = N.getRawScope()) 1375 CheckDI(isa<DIScope>(S), "invalid scope ref", &N, S); 1376 if (auto *S = N.getRawDecl()) 1377 CheckDI(isa<DIGlobalVariable>(S), "invalid declaration", &N, S); 1378 } 1379 1380 void Verifier::visitDINamespace(const DINamespace &N) { 1381 CheckDI(N.getTag() == dwarf::DW_TAG_namespace, "invalid tag", &N); 1382 if (auto *S = N.getRawScope()) 1383 CheckDI(isa<DIScope>(S), "invalid scope ref", &N, S); 1384 } 1385 1386 void Verifier::visitDIMacro(const DIMacro &N) { 1387 CheckDI(N.getMacinfoType() == dwarf::DW_MACINFO_define || 1388 N.getMacinfoType() == dwarf::DW_MACINFO_undef, 1389 "invalid macinfo type", &N); 1390 CheckDI(!N.getName().empty(), "anonymous macro", &N); 1391 if (!N.getValue().empty()) { 1392 assert(N.getValue().data()[0] != ' ' && "Macro value has a space prefix"); 1393 } 1394 } 1395 1396 void Verifier::visitDIMacroFile(const DIMacroFile &N) { 1397 CheckDI(N.getMacinfoType() == dwarf::DW_MACINFO_start_file, 1398 "invalid macinfo type", &N); 1399 if (auto *F = N.getRawFile()) 1400 CheckDI(isa<DIFile>(F), "invalid file", &N, F); 1401 1402 if (auto *Array = N.getRawElements()) { 1403 CheckDI(isa<MDTuple>(Array), "invalid macro list", &N, Array); 1404 for (Metadata *Op : N.getElements()->operands()) { 1405 CheckDI(Op && isa<DIMacroNode>(Op), "invalid macro ref", &N, Op); 1406 } 1407 } 1408 } 1409 1410 void Verifier::visitDIArgList(const DIArgList &N) { 1411 CheckDI(!N.getNumOperands(), 1412 "DIArgList should have no operands other than a list of " 1413 "ValueAsMetadata", 1414 &N); 1415 } 1416 1417 void Verifier::visitDIModule(const DIModule &N) { 1418 CheckDI(N.getTag() == dwarf::DW_TAG_module, "invalid tag", &N); 1419 CheckDI(!N.getName().empty(), "anonymous module", &N); 1420 } 1421 1422 void Verifier::visitDITemplateParameter(const DITemplateParameter &N) { 1423 CheckDI(isType(N.getRawType()), "invalid type ref", &N, N.getRawType()); 1424 } 1425 1426 void Verifier::visitDITemplateTypeParameter(const DITemplateTypeParameter &N) { 1427 visitDITemplateParameter(N); 1428 1429 CheckDI(N.getTag() == dwarf::DW_TAG_template_type_parameter, "invalid tag", 1430 &N); 1431 } 1432 1433 void Verifier::visitDITemplateValueParameter( 1434 const DITemplateValueParameter &N) { 1435 visitDITemplateParameter(N); 1436 1437 CheckDI(N.getTag() == dwarf::DW_TAG_template_value_parameter || 1438 N.getTag() == dwarf::DW_TAG_GNU_template_template_param || 1439 N.getTag() == dwarf::DW_TAG_GNU_template_parameter_pack, 1440 "invalid tag", &N); 1441 } 1442 1443 void Verifier::visitDIVariable(const DIVariable &N) { 1444 if (auto *S = N.getRawScope()) 1445 CheckDI(isa<DIScope>(S), "invalid scope", &N, S); 1446 if (auto *F = N.getRawFile()) 1447 CheckDI(isa<DIFile>(F), "invalid file", &N, F); 1448 } 1449 1450 void Verifier::visitDIGlobalVariable(const DIGlobalVariable &N) { 1451 // Checks common to all variables. 1452 visitDIVariable(N); 1453 1454 CheckDI(N.getTag() == dwarf::DW_TAG_variable, "invalid tag", &N); 1455 CheckDI(isType(N.getRawType()), "invalid type ref", &N, N.getRawType()); 1456 // Check only if the global variable is not an extern 1457 if (N.isDefinition()) 1458 CheckDI(N.getType(), "missing global variable type", &N); 1459 if (auto *Member = N.getRawStaticDataMemberDeclaration()) { 1460 CheckDI(isa<DIDerivedType>(Member), 1461 "invalid static data member declaration", &N, Member); 1462 } 1463 } 1464 1465 void Verifier::visitDILocalVariable(const DILocalVariable &N) { 1466 // Checks common to all variables. 1467 visitDIVariable(N); 1468 1469 CheckDI(isType(N.getRawType()), "invalid type ref", &N, N.getRawType()); 1470 CheckDI(N.getTag() == dwarf::DW_TAG_variable, "invalid tag", &N); 1471 CheckDI(N.getRawScope() && isa<DILocalScope>(N.getRawScope()), 1472 "local variable requires a valid scope", &N, N.getRawScope()); 1473 if (auto Ty = N.getType()) 1474 CheckDI(!isa<DISubroutineType>(Ty), "invalid type", &N, N.getType()); 1475 } 1476 1477 void Verifier::visitDILabel(const DILabel &N) { 1478 if (auto *S = N.getRawScope()) 1479 CheckDI(isa<DIScope>(S), "invalid scope", &N, S); 1480 if (auto *F = N.getRawFile()) 1481 CheckDI(isa<DIFile>(F), "invalid file", &N, F); 1482 1483 CheckDI(N.getTag() == dwarf::DW_TAG_label, "invalid tag", &N); 1484 CheckDI(N.getRawScope() && isa<DILocalScope>(N.getRawScope()), 1485 "label requires a valid scope", &N, N.getRawScope()); 1486 } 1487 1488 void Verifier::visitDIExpression(const DIExpression &N) { 1489 CheckDI(N.isValid(), "invalid expression", &N); 1490 } 1491 1492 void Verifier::visitDIGlobalVariableExpression( 1493 const DIGlobalVariableExpression &GVE) { 1494 CheckDI(GVE.getVariable(), "missing variable"); 1495 if (auto *Var = GVE.getVariable()) 1496 visitDIGlobalVariable(*Var); 1497 if (auto *Expr = GVE.getExpression()) { 1498 visitDIExpression(*Expr); 1499 if (auto Fragment = Expr->getFragmentInfo()) 1500 verifyFragmentExpression(*GVE.getVariable(), *Fragment, &GVE); 1501 } 1502 } 1503 1504 void Verifier::visitDIObjCProperty(const DIObjCProperty &N) { 1505 CheckDI(N.getTag() == dwarf::DW_TAG_APPLE_property, "invalid tag", &N); 1506 if (auto *T = N.getRawType()) 1507 CheckDI(isType(T), "invalid type ref", &N, T); 1508 if (auto *F = N.getRawFile()) 1509 CheckDI(isa<DIFile>(F), "invalid file", &N, F); 1510 } 1511 1512 void Verifier::visitDIImportedEntity(const DIImportedEntity &N) { 1513 CheckDI(N.getTag() == dwarf::DW_TAG_imported_module || 1514 N.getTag() == dwarf::DW_TAG_imported_declaration, 1515 "invalid tag", &N); 1516 if (auto *S = N.getRawScope()) 1517 CheckDI(isa<DIScope>(S), "invalid scope for imported entity", &N, S); 1518 CheckDI(isDINode(N.getRawEntity()), "invalid imported entity", &N, 1519 N.getRawEntity()); 1520 } 1521 1522 void Verifier::visitComdat(const Comdat &C) { 1523 // In COFF the Module is invalid if the GlobalValue has private linkage. 1524 // Entities with private linkage don't have entries in the symbol table. 1525 if (TT.isOSBinFormatCOFF()) 1526 if (const GlobalValue *GV = M.getNamedValue(C.getName())) 1527 Check(!GV->hasPrivateLinkage(), "comdat global value has private linkage", 1528 GV); 1529 } 1530 1531 void Verifier::visitModuleIdents() { 1532 const NamedMDNode *Idents = M.getNamedMetadata("llvm.ident"); 1533 if (!Idents) 1534 return; 1535 1536 // llvm.ident takes a list of metadata entry. Each entry has only one string. 1537 // Scan each llvm.ident entry and make sure that this requirement is met. 1538 for (const MDNode *N : Idents->operands()) { 1539 Check(N->getNumOperands() == 1, 1540 "incorrect number of operands in llvm.ident metadata", N); 1541 Check(dyn_cast_or_null<MDString>(N->getOperand(0)), 1542 ("invalid value for llvm.ident metadata entry operand" 1543 "(the operand should be a string)"), 1544 N->getOperand(0)); 1545 } 1546 } 1547 1548 void Verifier::visitModuleCommandLines() { 1549 const NamedMDNode *CommandLines = M.getNamedMetadata("llvm.commandline"); 1550 if (!CommandLines) 1551 return; 1552 1553 // llvm.commandline takes a list of metadata entry. Each entry has only one 1554 // string. Scan each llvm.commandline entry and make sure that this 1555 // requirement is met. 1556 for (const MDNode *N : CommandLines->operands()) { 1557 Check(N->getNumOperands() == 1, 1558 "incorrect number of operands in llvm.commandline metadata", N); 1559 Check(dyn_cast_or_null<MDString>(N->getOperand(0)), 1560 ("invalid value for llvm.commandline metadata entry operand" 1561 "(the operand should be a string)"), 1562 N->getOperand(0)); 1563 } 1564 } 1565 1566 void Verifier::visitModuleFlags() { 1567 const NamedMDNode *Flags = M.getModuleFlagsMetadata(); 1568 if (!Flags) return; 1569 1570 // Scan each flag, and track the flags and requirements. 1571 DenseMap<const MDString*, const MDNode*> SeenIDs; 1572 SmallVector<const MDNode*, 16> Requirements; 1573 for (const MDNode *MDN : Flags->operands()) 1574 visitModuleFlag(MDN, SeenIDs, Requirements); 1575 1576 // Validate that the requirements in the module are valid. 1577 for (const MDNode *Requirement : Requirements) { 1578 const MDString *Flag = cast<MDString>(Requirement->getOperand(0)); 1579 const Metadata *ReqValue = Requirement->getOperand(1); 1580 1581 const MDNode *Op = SeenIDs.lookup(Flag); 1582 if (!Op) { 1583 CheckFailed("invalid requirement on flag, flag is not present in module", 1584 Flag); 1585 continue; 1586 } 1587 1588 if (Op->getOperand(2) != ReqValue) { 1589 CheckFailed(("invalid requirement on flag, " 1590 "flag does not have the required value"), 1591 Flag); 1592 continue; 1593 } 1594 } 1595 } 1596 1597 void 1598 Verifier::visitModuleFlag(const MDNode *Op, 1599 DenseMap<const MDString *, const MDNode *> &SeenIDs, 1600 SmallVectorImpl<const MDNode *> &Requirements) { 1601 // Each module flag should have three arguments, the merge behavior (a 1602 // constant int), the flag ID (an MDString), and the value. 1603 Check(Op->getNumOperands() == 3, 1604 "incorrect number of operands in module flag", Op); 1605 Module::ModFlagBehavior MFB; 1606 if (!Module::isValidModFlagBehavior(Op->getOperand(0), MFB)) { 1607 Check(mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(0)), 1608 "invalid behavior operand in module flag (expected constant integer)", 1609 Op->getOperand(0)); 1610 Check(false, 1611 "invalid behavior operand in module flag (unexpected constant)", 1612 Op->getOperand(0)); 1613 } 1614 MDString *ID = dyn_cast_or_null<MDString>(Op->getOperand(1)); 1615 Check(ID, "invalid ID operand in module flag (expected metadata string)", 1616 Op->getOperand(1)); 1617 1618 // Check the values for behaviors with additional requirements. 1619 switch (MFB) { 1620 case Module::Error: 1621 case Module::Warning: 1622 case Module::Override: 1623 // These behavior types accept any value. 1624 break; 1625 1626 case Module::Min: { 1627 Check(mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(2)), 1628 "invalid value for 'min' module flag (expected constant integer)", 1629 Op->getOperand(2)); 1630 break; 1631 } 1632 1633 case Module::Max: { 1634 Check(mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(2)), 1635 "invalid value for 'max' module flag (expected constant integer)", 1636 Op->getOperand(2)); 1637 break; 1638 } 1639 1640 case Module::Require: { 1641 // The value should itself be an MDNode with two operands, a flag ID (an 1642 // MDString), and a value. 1643 MDNode *Value = dyn_cast<MDNode>(Op->getOperand(2)); 1644 Check(Value && Value->getNumOperands() == 2, 1645 "invalid value for 'require' module flag (expected metadata pair)", 1646 Op->getOperand(2)); 1647 Check(isa<MDString>(Value->getOperand(0)), 1648 ("invalid value for 'require' module flag " 1649 "(first value operand should be a string)"), 1650 Value->getOperand(0)); 1651 1652 // Append it to the list of requirements, to check once all module flags are 1653 // scanned. 1654 Requirements.push_back(Value); 1655 break; 1656 } 1657 1658 case Module::Append: 1659 case Module::AppendUnique: { 1660 // These behavior types require the operand be an MDNode. 1661 Check(isa<MDNode>(Op->getOperand(2)), 1662 "invalid value for 'append'-type module flag " 1663 "(expected a metadata node)", 1664 Op->getOperand(2)); 1665 break; 1666 } 1667 } 1668 1669 // Unless this is a "requires" flag, check the ID is unique. 1670 if (MFB != Module::Require) { 1671 bool Inserted = SeenIDs.insert(std::make_pair(ID, Op)).second; 1672 Check(Inserted, 1673 "module flag identifiers must be unique (or of 'require' type)", ID); 1674 } 1675 1676 if (ID->getString() == "wchar_size") { 1677 ConstantInt *Value 1678 = mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(2)); 1679 Check(Value, "wchar_size metadata requires constant integer argument"); 1680 } 1681 1682 if (ID->getString() == "Linker Options") { 1683 // If the llvm.linker.options named metadata exists, we assume that the 1684 // bitcode reader has upgraded the module flag. Otherwise the flag might 1685 // have been created by a client directly. 1686 Check(M.getNamedMetadata("llvm.linker.options"), 1687 "'Linker Options' named metadata no longer supported"); 1688 } 1689 1690 if (ID->getString() == "SemanticInterposition") { 1691 ConstantInt *Value = 1692 mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(2)); 1693 Check(Value, 1694 "SemanticInterposition metadata requires constant integer argument"); 1695 } 1696 1697 if (ID->getString() == "CG Profile") { 1698 for (const MDOperand &MDO : cast<MDNode>(Op->getOperand(2))->operands()) 1699 visitModuleFlagCGProfileEntry(MDO); 1700 } 1701 } 1702 1703 void Verifier::visitModuleFlagCGProfileEntry(const MDOperand &MDO) { 1704 auto CheckFunction = [&](const MDOperand &FuncMDO) { 1705 if (!FuncMDO) 1706 return; 1707 auto F = dyn_cast<ValueAsMetadata>(FuncMDO); 1708 Check(F && isa<Function>(F->getValue()->stripPointerCasts()), 1709 "expected a Function or null", FuncMDO); 1710 }; 1711 auto Node = dyn_cast_or_null<MDNode>(MDO); 1712 Check(Node && Node->getNumOperands() == 3, "expected a MDNode triple", MDO); 1713 CheckFunction(Node->getOperand(0)); 1714 CheckFunction(Node->getOperand(1)); 1715 auto Count = dyn_cast_or_null<ConstantAsMetadata>(Node->getOperand(2)); 1716 Check(Count && Count->getType()->isIntegerTy(), 1717 "expected an integer constant", Node->getOperand(2)); 1718 } 1719 1720 void Verifier::verifyAttributeTypes(AttributeSet Attrs, const Value *V) { 1721 for (Attribute A : Attrs) { 1722 1723 if (A.isStringAttribute()) { 1724 #define GET_ATTR_NAMES 1725 #define ATTRIBUTE_ENUM(ENUM_NAME, DISPLAY_NAME) 1726 #define ATTRIBUTE_STRBOOL(ENUM_NAME, DISPLAY_NAME) \ 1727 if (A.getKindAsString() == #DISPLAY_NAME) { \ 1728 auto V = A.getValueAsString(); \ 1729 if (!(V.empty() || V == "true" || V == "false")) \ 1730 CheckFailed("invalid value for '" #DISPLAY_NAME "' attribute: " + V + \ 1731 ""); \ 1732 } 1733 1734 #include "llvm/IR/Attributes.inc" 1735 continue; 1736 } 1737 1738 if (A.isIntAttribute() != Attribute::isIntAttrKind(A.getKindAsEnum())) { 1739 CheckFailed("Attribute '" + A.getAsString() + "' should have an Argument", 1740 V); 1741 return; 1742 } 1743 } 1744 } 1745 1746 // VerifyParameterAttrs - Check the given attributes for an argument or return 1747 // value of the specified type. The value V is printed in error messages. 1748 void Verifier::verifyParameterAttrs(AttributeSet Attrs, Type *Ty, 1749 const Value *V) { 1750 if (!Attrs.hasAttributes()) 1751 return; 1752 1753 verifyAttributeTypes(Attrs, V); 1754 1755 for (Attribute Attr : Attrs) 1756 Check(Attr.isStringAttribute() || 1757 Attribute::canUseAsParamAttr(Attr.getKindAsEnum()), 1758 "Attribute '" + Attr.getAsString() + "' does not apply to parameters", 1759 V); 1760 1761 if (Attrs.hasAttribute(Attribute::ImmArg)) { 1762 Check(Attrs.getNumAttributes() == 1, 1763 "Attribute 'immarg' is incompatible with other attributes", V); 1764 } 1765 1766 // Check for mutually incompatible attributes. Only inreg is compatible with 1767 // sret. 1768 unsigned AttrCount = 0; 1769 AttrCount += Attrs.hasAttribute(Attribute::ByVal); 1770 AttrCount += Attrs.hasAttribute(Attribute::InAlloca); 1771 AttrCount += Attrs.hasAttribute(Attribute::Preallocated); 1772 AttrCount += Attrs.hasAttribute(Attribute::StructRet) || 1773 Attrs.hasAttribute(Attribute::InReg); 1774 AttrCount += Attrs.hasAttribute(Attribute::Nest); 1775 AttrCount += Attrs.hasAttribute(Attribute::ByRef); 1776 Check(AttrCount <= 1, 1777 "Attributes 'byval', 'inalloca', 'preallocated', 'inreg', 'nest', " 1778 "'byref', and 'sret' are incompatible!", 1779 V); 1780 1781 Check(!(Attrs.hasAttribute(Attribute::InAlloca) && 1782 Attrs.hasAttribute(Attribute::ReadOnly)), 1783 "Attributes " 1784 "'inalloca and readonly' are incompatible!", 1785 V); 1786 1787 Check(!(Attrs.hasAttribute(Attribute::StructRet) && 1788 Attrs.hasAttribute(Attribute::Returned)), 1789 "Attributes " 1790 "'sret and returned' are incompatible!", 1791 V); 1792 1793 Check(!(Attrs.hasAttribute(Attribute::ZExt) && 1794 Attrs.hasAttribute(Attribute::SExt)), 1795 "Attributes " 1796 "'zeroext and signext' are incompatible!", 1797 V); 1798 1799 Check(!(Attrs.hasAttribute(Attribute::ReadNone) && 1800 Attrs.hasAttribute(Attribute::ReadOnly)), 1801 "Attributes " 1802 "'readnone and readonly' are incompatible!", 1803 V); 1804 1805 Check(!(Attrs.hasAttribute(Attribute::ReadNone) && 1806 Attrs.hasAttribute(Attribute::WriteOnly)), 1807 "Attributes " 1808 "'readnone and writeonly' are incompatible!", 1809 V); 1810 1811 Check(!(Attrs.hasAttribute(Attribute::ReadOnly) && 1812 Attrs.hasAttribute(Attribute::WriteOnly)), 1813 "Attributes " 1814 "'readonly and writeonly' are incompatible!", 1815 V); 1816 1817 Check(!(Attrs.hasAttribute(Attribute::NoInline) && 1818 Attrs.hasAttribute(Attribute::AlwaysInline)), 1819 "Attributes " 1820 "'noinline and alwaysinline' are incompatible!", 1821 V); 1822 1823 AttributeMask IncompatibleAttrs = AttributeFuncs::typeIncompatible(Ty); 1824 for (Attribute Attr : Attrs) { 1825 if (!Attr.isStringAttribute() && 1826 IncompatibleAttrs.contains(Attr.getKindAsEnum())) { 1827 CheckFailed("Attribute '" + Attr.getAsString() + 1828 "' applied to incompatible type!", V); 1829 return; 1830 } 1831 } 1832 1833 if (PointerType *PTy = dyn_cast<PointerType>(Ty)) { 1834 if (Attrs.hasAttribute(Attribute::ByVal)) { 1835 if (Attrs.hasAttribute(Attribute::Alignment)) { 1836 Align AttrAlign = Attrs.getAlignment().valueOrOne(); 1837 Align MaxAlign(ParamMaxAlignment); 1838 Check(AttrAlign <= MaxAlign, 1839 "Attribute 'align' exceed the max size 2^14", V); 1840 } 1841 SmallPtrSet<Type *, 4> Visited; 1842 Check(Attrs.getByValType()->isSized(&Visited), 1843 "Attribute 'byval' does not support unsized types!", V); 1844 } 1845 if (Attrs.hasAttribute(Attribute::ByRef)) { 1846 SmallPtrSet<Type *, 4> Visited; 1847 Check(Attrs.getByRefType()->isSized(&Visited), 1848 "Attribute 'byref' does not support unsized types!", V); 1849 } 1850 if (Attrs.hasAttribute(Attribute::InAlloca)) { 1851 SmallPtrSet<Type *, 4> Visited; 1852 Check(Attrs.getInAllocaType()->isSized(&Visited), 1853 "Attribute 'inalloca' does not support unsized types!", V); 1854 } 1855 if (Attrs.hasAttribute(Attribute::Preallocated)) { 1856 SmallPtrSet<Type *, 4> Visited; 1857 Check(Attrs.getPreallocatedType()->isSized(&Visited), 1858 "Attribute 'preallocated' does not support unsized types!", V); 1859 } 1860 if (!PTy->isOpaque()) { 1861 if (!isa<PointerType>(PTy->getNonOpaquePointerElementType())) 1862 Check(!Attrs.hasAttribute(Attribute::SwiftError), 1863 "Attribute 'swifterror' only applies to parameters " 1864 "with pointer to pointer type!", 1865 V); 1866 if (Attrs.hasAttribute(Attribute::ByRef)) { 1867 Check(Attrs.getByRefType() == PTy->getNonOpaquePointerElementType(), 1868 "Attribute 'byref' type does not match parameter!", V); 1869 } 1870 1871 if (Attrs.hasAttribute(Attribute::ByVal) && Attrs.getByValType()) { 1872 Check(Attrs.getByValType() == PTy->getNonOpaquePointerElementType(), 1873 "Attribute 'byval' type does not match parameter!", V); 1874 } 1875 1876 if (Attrs.hasAttribute(Attribute::Preallocated)) { 1877 Check(Attrs.getPreallocatedType() == 1878 PTy->getNonOpaquePointerElementType(), 1879 "Attribute 'preallocated' type does not match parameter!", V); 1880 } 1881 1882 if (Attrs.hasAttribute(Attribute::InAlloca)) { 1883 Check(Attrs.getInAllocaType() == PTy->getNonOpaquePointerElementType(), 1884 "Attribute 'inalloca' type does not match parameter!", V); 1885 } 1886 1887 if (Attrs.hasAttribute(Attribute::ElementType)) { 1888 Check(Attrs.getElementType() == PTy->getNonOpaquePointerElementType(), 1889 "Attribute 'elementtype' type does not match parameter!", V); 1890 } 1891 } 1892 } 1893 } 1894 1895 void Verifier::checkUnsignedBaseTenFuncAttr(AttributeList Attrs, StringRef Attr, 1896 const Value *V) { 1897 if (Attrs.hasFnAttr(Attr)) { 1898 StringRef S = Attrs.getFnAttr(Attr).getValueAsString(); 1899 unsigned N; 1900 if (S.getAsInteger(10, N)) 1901 CheckFailed("\"" + Attr + "\" takes an unsigned integer: " + S, V); 1902 } 1903 } 1904 1905 // Check parameter attributes against a function type. 1906 // The value V is printed in error messages. 1907 void Verifier::verifyFunctionAttrs(FunctionType *FT, AttributeList Attrs, 1908 const Value *V, bool IsIntrinsic, 1909 bool IsInlineAsm) { 1910 if (Attrs.isEmpty()) 1911 return; 1912 1913 if (AttributeListsVisited.insert(Attrs.getRawPointer()).second) { 1914 Check(Attrs.hasParentContext(Context), 1915 "Attribute list does not match Module context!", &Attrs, V); 1916 for (const auto &AttrSet : Attrs) { 1917 Check(!AttrSet.hasAttributes() || AttrSet.hasParentContext(Context), 1918 "Attribute set does not match Module context!", &AttrSet, V); 1919 for (const auto &A : AttrSet) { 1920 Check(A.hasParentContext(Context), 1921 "Attribute does not match Module context!", &A, V); 1922 } 1923 } 1924 } 1925 1926 bool SawNest = false; 1927 bool SawReturned = false; 1928 bool SawSRet = false; 1929 bool SawSwiftSelf = false; 1930 bool SawSwiftAsync = false; 1931 bool SawSwiftError = false; 1932 1933 // Verify return value attributes. 1934 AttributeSet RetAttrs = Attrs.getRetAttrs(); 1935 for (Attribute RetAttr : RetAttrs) 1936 Check(RetAttr.isStringAttribute() || 1937 Attribute::canUseAsRetAttr(RetAttr.getKindAsEnum()), 1938 "Attribute '" + RetAttr.getAsString() + 1939 "' does not apply to function return values", 1940 V); 1941 1942 verifyParameterAttrs(RetAttrs, FT->getReturnType(), V); 1943 1944 // Verify parameter attributes. 1945 for (unsigned i = 0, e = FT->getNumParams(); i != e; ++i) { 1946 Type *Ty = FT->getParamType(i); 1947 AttributeSet ArgAttrs = Attrs.getParamAttrs(i); 1948 1949 if (!IsIntrinsic) { 1950 Check(!ArgAttrs.hasAttribute(Attribute::ImmArg), 1951 "immarg attribute only applies to intrinsics", V); 1952 if (!IsInlineAsm) 1953 Check(!ArgAttrs.hasAttribute(Attribute::ElementType), 1954 "Attribute 'elementtype' can only be applied to intrinsics" 1955 " and inline asm.", 1956 V); 1957 } 1958 1959 verifyParameterAttrs(ArgAttrs, Ty, V); 1960 1961 if (ArgAttrs.hasAttribute(Attribute::Nest)) { 1962 Check(!SawNest, "More than one parameter has attribute nest!", V); 1963 SawNest = true; 1964 } 1965 1966 if (ArgAttrs.hasAttribute(Attribute::Returned)) { 1967 Check(!SawReturned, "More than one parameter has attribute returned!", V); 1968 Check(Ty->canLosslesslyBitCastTo(FT->getReturnType()), 1969 "Incompatible argument and return types for 'returned' attribute", 1970 V); 1971 SawReturned = true; 1972 } 1973 1974 if (ArgAttrs.hasAttribute(Attribute::StructRet)) { 1975 Check(!SawSRet, "Cannot have multiple 'sret' parameters!", V); 1976 Check(i == 0 || i == 1, 1977 "Attribute 'sret' is not on first or second parameter!", V); 1978 SawSRet = true; 1979 } 1980 1981 if (ArgAttrs.hasAttribute(Attribute::SwiftSelf)) { 1982 Check(!SawSwiftSelf, "Cannot have multiple 'swiftself' parameters!", V); 1983 SawSwiftSelf = true; 1984 } 1985 1986 if (ArgAttrs.hasAttribute(Attribute::SwiftAsync)) { 1987 Check(!SawSwiftAsync, "Cannot have multiple 'swiftasync' parameters!", V); 1988 SawSwiftAsync = true; 1989 } 1990 1991 if (ArgAttrs.hasAttribute(Attribute::SwiftError)) { 1992 Check(!SawSwiftError, "Cannot have multiple 'swifterror' parameters!", V); 1993 SawSwiftError = true; 1994 } 1995 1996 if (ArgAttrs.hasAttribute(Attribute::InAlloca)) { 1997 Check(i == FT->getNumParams() - 1, 1998 "inalloca isn't on the last parameter!", V); 1999 } 2000 } 2001 2002 if (!Attrs.hasFnAttrs()) 2003 return; 2004 2005 verifyAttributeTypes(Attrs.getFnAttrs(), V); 2006 for (Attribute FnAttr : Attrs.getFnAttrs()) 2007 Check(FnAttr.isStringAttribute() || 2008 Attribute::canUseAsFnAttr(FnAttr.getKindAsEnum()), 2009 "Attribute '" + FnAttr.getAsString() + 2010 "' does not apply to functions!", 2011 V); 2012 2013 Check(!(Attrs.hasFnAttr(Attribute::ReadNone) && 2014 Attrs.hasFnAttr(Attribute::ReadOnly)), 2015 "Attributes 'readnone and readonly' are incompatible!", V); 2016 2017 Check(!(Attrs.hasFnAttr(Attribute::ReadNone) && 2018 Attrs.hasFnAttr(Attribute::WriteOnly)), 2019 "Attributes 'readnone and writeonly' are incompatible!", V); 2020 2021 Check(!(Attrs.hasFnAttr(Attribute::ReadOnly) && 2022 Attrs.hasFnAttr(Attribute::WriteOnly)), 2023 "Attributes 'readonly and writeonly' are incompatible!", V); 2024 2025 Check(!(Attrs.hasFnAttr(Attribute::ReadNone) && 2026 Attrs.hasFnAttr(Attribute::InaccessibleMemOrArgMemOnly)), 2027 "Attributes 'readnone and inaccessiblemem_or_argmemonly' are " 2028 "incompatible!", 2029 V); 2030 2031 Check(!(Attrs.hasFnAttr(Attribute::ReadNone) && 2032 Attrs.hasFnAttr(Attribute::InaccessibleMemOnly)), 2033 "Attributes 'readnone and inaccessiblememonly' are incompatible!", V); 2034 2035 Check(!(Attrs.hasFnAttr(Attribute::NoInline) && 2036 Attrs.hasFnAttr(Attribute::AlwaysInline)), 2037 "Attributes 'noinline and alwaysinline' are incompatible!", V); 2038 2039 if (Attrs.hasFnAttr(Attribute::OptimizeNone)) { 2040 Check(Attrs.hasFnAttr(Attribute::NoInline), 2041 "Attribute 'optnone' requires 'noinline'!", V); 2042 2043 Check(!Attrs.hasFnAttr(Attribute::OptimizeForSize), 2044 "Attributes 'optsize and optnone' are incompatible!", V); 2045 2046 Check(!Attrs.hasFnAttr(Attribute::MinSize), 2047 "Attributes 'minsize and optnone' are incompatible!", V); 2048 } 2049 2050 if (Attrs.hasFnAttr(Attribute::JumpTable)) { 2051 const GlobalValue *GV = cast<GlobalValue>(V); 2052 Check(GV->hasGlobalUnnamedAddr(), 2053 "Attribute 'jumptable' requires 'unnamed_addr'", V); 2054 } 2055 2056 if (Attrs.hasFnAttr(Attribute::AllocSize)) { 2057 std::pair<unsigned, Optional<unsigned>> Args = 2058 Attrs.getFnAttrs().getAllocSizeArgs(); 2059 2060 auto CheckParam = [&](StringRef Name, unsigned ParamNo) { 2061 if (ParamNo >= FT->getNumParams()) { 2062 CheckFailed("'allocsize' " + Name + " argument is out of bounds", V); 2063 return false; 2064 } 2065 2066 if (!FT->getParamType(ParamNo)->isIntegerTy()) { 2067 CheckFailed("'allocsize' " + Name + 2068 " argument must refer to an integer parameter", 2069 V); 2070 return false; 2071 } 2072 2073 return true; 2074 }; 2075 2076 if (!CheckParam("element size", Args.first)) 2077 return; 2078 2079 if (Args.second && !CheckParam("number of elements", *Args.second)) 2080 return; 2081 } 2082 2083 if (Attrs.hasFnAttr(Attribute::AllocKind)) { 2084 AllocFnKind K = Attrs.getAllocKind(); 2085 AllocFnKind Type = 2086 K & (AllocFnKind::Alloc | AllocFnKind::Realloc | AllocFnKind::Free); 2087 if (!is_contained( 2088 {AllocFnKind::Alloc, AllocFnKind::Realloc, AllocFnKind::Free}, 2089 Type)) 2090 CheckFailed( 2091 "'allockind()' requires exactly one of alloc, realloc, and free"); 2092 if ((Type == AllocFnKind::Free) && 2093 ((K & (AllocFnKind::Uninitialized | AllocFnKind::Zeroed | 2094 AllocFnKind::Aligned)) != AllocFnKind::Unknown)) 2095 CheckFailed("'allockind(\"free\")' doesn't allow uninitialized, zeroed, " 2096 "or aligned modifiers."); 2097 AllocFnKind ZeroedUninit = AllocFnKind::Uninitialized | AllocFnKind::Zeroed; 2098 if ((K & ZeroedUninit) == ZeroedUninit) 2099 CheckFailed("'allockind()' can't be both zeroed and uninitialized"); 2100 } 2101 2102 if (Attrs.hasFnAttr(Attribute::VScaleRange)) { 2103 unsigned VScaleMin = Attrs.getFnAttrs().getVScaleRangeMin(); 2104 if (VScaleMin == 0) 2105 CheckFailed("'vscale_range' minimum must be greater than 0", V); 2106 2107 Optional<unsigned> VScaleMax = Attrs.getFnAttrs().getVScaleRangeMax(); 2108 if (VScaleMax && VScaleMin > VScaleMax) 2109 CheckFailed("'vscale_range' minimum cannot be greater than maximum", V); 2110 } 2111 2112 if (Attrs.hasFnAttr("frame-pointer")) { 2113 StringRef FP = Attrs.getFnAttr("frame-pointer").getValueAsString(); 2114 if (FP != "all" && FP != "non-leaf" && FP != "none") 2115 CheckFailed("invalid value for 'frame-pointer' attribute: " + FP, V); 2116 } 2117 2118 checkUnsignedBaseTenFuncAttr(Attrs, "patchable-function-prefix", V); 2119 checkUnsignedBaseTenFuncAttr(Attrs, "patchable-function-entry", V); 2120 checkUnsignedBaseTenFuncAttr(Attrs, "warn-stack-size", V); 2121 } 2122 2123 void Verifier::verifyFunctionMetadata( 2124 ArrayRef<std::pair<unsigned, MDNode *>> MDs) { 2125 for (const auto &Pair : MDs) { 2126 if (Pair.first == LLVMContext::MD_prof) { 2127 MDNode *MD = Pair.second; 2128 Check(MD->getNumOperands() >= 2, 2129 "!prof annotations should have no less than 2 operands", MD); 2130 2131 // Check first operand. 2132 Check(MD->getOperand(0) != nullptr, "first operand should not be null", 2133 MD); 2134 Check(isa<MDString>(MD->getOperand(0)), 2135 "expected string with name of the !prof annotation", MD); 2136 MDString *MDS = cast<MDString>(MD->getOperand(0)); 2137 StringRef ProfName = MDS->getString(); 2138 Check(ProfName.equals("function_entry_count") || 2139 ProfName.equals("synthetic_function_entry_count"), 2140 "first operand should be 'function_entry_count'" 2141 " or 'synthetic_function_entry_count'", 2142 MD); 2143 2144 // Check second operand. 2145 Check(MD->getOperand(1) != nullptr, "second operand should not be null", 2146 MD); 2147 Check(isa<ConstantAsMetadata>(MD->getOperand(1)), 2148 "expected integer argument to function_entry_count", MD); 2149 } 2150 } 2151 } 2152 2153 void Verifier::visitConstantExprsRecursively(const Constant *EntryC) { 2154 if (!ConstantExprVisited.insert(EntryC).second) 2155 return; 2156 2157 SmallVector<const Constant *, 16> Stack; 2158 Stack.push_back(EntryC); 2159 2160 while (!Stack.empty()) { 2161 const Constant *C = Stack.pop_back_val(); 2162 2163 // Check this constant expression. 2164 if (const auto *CE = dyn_cast<ConstantExpr>(C)) 2165 visitConstantExpr(CE); 2166 2167 if (const auto *GV = dyn_cast<GlobalValue>(C)) { 2168 // Global Values get visited separately, but we do need to make sure 2169 // that the global value is in the correct module 2170 Check(GV->getParent() == &M, "Referencing global in another module!", 2171 EntryC, &M, GV, GV->getParent()); 2172 continue; 2173 } 2174 2175 // Visit all sub-expressions. 2176 for (const Use &U : C->operands()) { 2177 const auto *OpC = dyn_cast<Constant>(U); 2178 if (!OpC) 2179 continue; 2180 if (!ConstantExprVisited.insert(OpC).second) 2181 continue; 2182 Stack.push_back(OpC); 2183 } 2184 } 2185 } 2186 2187 void Verifier::visitConstantExpr(const ConstantExpr *CE) { 2188 if (CE->getOpcode() == Instruction::BitCast) 2189 Check(CastInst::castIsValid(Instruction::BitCast, CE->getOperand(0), 2190 CE->getType()), 2191 "Invalid bitcast", CE); 2192 } 2193 2194 bool Verifier::verifyAttributeCount(AttributeList Attrs, unsigned Params) { 2195 // There shouldn't be more attribute sets than there are parameters plus the 2196 // function and return value. 2197 return Attrs.getNumAttrSets() <= Params + 2; 2198 } 2199 2200 void Verifier::verifyInlineAsmCall(const CallBase &Call) { 2201 const InlineAsm *IA = cast<InlineAsm>(Call.getCalledOperand()); 2202 unsigned ArgNo = 0; 2203 for (const InlineAsm::ConstraintInfo &CI : IA->ParseConstraints()) { 2204 // Only deal with constraints that correspond to call arguments. 2205 if (!CI.hasArg()) 2206 continue; 2207 2208 if (CI.isIndirect) { 2209 const Value *Arg = Call.getArgOperand(ArgNo); 2210 Check(Arg->getType()->isPointerTy(), 2211 "Operand for indirect constraint must have pointer type", &Call); 2212 2213 Check(Call.getParamElementType(ArgNo), 2214 "Operand for indirect constraint must have elementtype attribute", 2215 &Call); 2216 } else { 2217 Check(!Call.paramHasAttr(ArgNo, Attribute::ElementType), 2218 "Elementtype attribute can only be applied for indirect " 2219 "constraints", 2220 &Call); 2221 } 2222 2223 ArgNo++; 2224 } 2225 } 2226 2227 /// Verify that statepoint intrinsic is well formed. 2228 void Verifier::verifyStatepoint(const CallBase &Call) { 2229 assert(Call.getCalledFunction() && 2230 Call.getCalledFunction()->getIntrinsicID() == 2231 Intrinsic::experimental_gc_statepoint); 2232 2233 Check(!Call.doesNotAccessMemory() && !Call.onlyReadsMemory() && 2234 !Call.onlyAccessesArgMemory(), 2235 "gc.statepoint must read and write all memory to preserve " 2236 "reordering restrictions required by safepoint semantics", 2237 Call); 2238 2239 const int64_t NumPatchBytes = 2240 cast<ConstantInt>(Call.getArgOperand(1))->getSExtValue(); 2241 assert(isInt<32>(NumPatchBytes) && "NumPatchBytesV is an i32!"); 2242 Check(NumPatchBytes >= 0, 2243 "gc.statepoint number of patchable bytes must be " 2244 "positive", 2245 Call); 2246 2247 Type *TargetElemType = Call.getParamElementType(2); 2248 Check(TargetElemType, 2249 "gc.statepoint callee argument must have elementtype attribute", Call); 2250 FunctionType *TargetFuncType = dyn_cast<FunctionType>(TargetElemType); 2251 Check(TargetFuncType, 2252 "gc.statepoint callee elementtype must be function type", Call); 2253 2254 const int NumCallArgs = cast<ConstantInt>(Call.getArgOperand(3))->getZExtValue(); 2255 Check(NumCallArgs >= 0, 2256 "gc.statepoint number of arguments to underlying call " 2257 "must be positive", 2258 Call); 2259 const int NumParams = (int)TargetFuncType->getNumParams(); 2260 if (TargetFuncType->isVarArg()) { 2261 Check(NumCallArgs >= NumParams, 2262 "gc.statepoint mismatch in number of vararg call args", Call); 2263 2264 // TODO: Remove this limitation 2265 Check(TargetFuncType->getReturnType()->isVoidTy(), 2266 "gc.statepoint doesn't support wrapping non-void " 2267 "vararg functions yet", 2268 Call); 2269 } else 2270 Check(NumCallArgs == NumParams, 2271 "gc.statepoint mismatch in number of call args", Call); 2272 2273 const uint64_t Flags 2274 = cast<ConstantInt>(Call.getArgOperand(4))->getZExtValue(); 2275 Check((Flags & ~(uint64_t)StatepointFlags::MaskAll) == 0, 2276 "unknown flag used in gc.statepoint flags argument", Call); 2277 2278 // Verify that the types of the call parameter arguments match 2279 // the type of the wrapped callee. 2280 AttributeList Attrs = Call.getAttributes(); 2281 for (int i = 0; i < NumParams; i++) { 2282 Type *ParamType = TargetFuncType->getParamType(i); 2283 Type *ArgType = Call.getArgOperand(5 + i)->getType(); 2284 Check(ArgType == ParamType, 2285 "gc.statepoint call argument does not match wrapped " 2286 "function type", 2287 Call); 2288 2289 if (TargetFuncType->isVarArg()) { 2290 AttributeSet ArgAttrs = Attrs.getParamAttrs(5 + i); 2291 Check(!ArgAttrs.hasAttribute(Attribute::StructRet), 2292 "Attribute 'sret' cannot be used for vararg call arguments!", Call); 2293 } 2294 } 2295 2296 const int EndCallArgsInx = 4 + NumCallArgs; 2297 2298 const Value *NumTransitionArgsV = Call.getArgOperand(EndCallArgsInx + 1); 2299 Check(isa<ConstantInt>(NumTransitionArgsV), 2300 "gc.statepoint number of transition arguments " 2301 "must be constant integer", 2302 Call); 2303 const int NumTransitionArgs = 2304 cast<ConstantInt>(NumTransitionArgsV)->getZExtValue(); 2305 Check(NumTransitionArgs == 0, 2306 "gc.statepoint w/inline transition bundle is deprecated", Call); 2307 const int EndTransitionArgsInx = EndCallArgsInx + 1 + NumTransitionArgs; 2308 2309 const Value *NumDeoptArgsV = Call.getArgOperand(EndTransitionArgsInx + 1); 2310 Check(isa<ConstantInt>(NumDeoptArgsV), 2311 "gc.statepoint number of deoptimization arguments " 2312 "must be constant integer", 2313 Call); 2314 const int NumDeoptArgs = cast<ConstantInt>(NumDeoptArgsV)->getZExtValue(); 2315 Check(NumDeoptArgs == 0, 2316 "gc.statepoint w/inline deopt operands is deprecated", Call); 2317 2318 const int ExpectedNumArgs = 7 + NumCallArgs; 2319 Check(ExpectedNumArgs == (int)Call.arg_size(), 2320 "gc.statepoint too many arguments", Call); 2321 2322 // Check that the only uses of this gc.statepoint are gc.result or 2323 // gc.relocate calls which are tied to this statepoint and thus part 2324 // of the same statepoint sequence 2325 for (const User *U : Call.users()) { 2326 const CallInst *UserCall = dyn_cast<const CallInst>(U); 2327 Check(UserCall, "illegal use of statepoint token", Call, U); 2328 if (!UserCall) 2329 continue; 2330 Check(isa<GCRelocateInst>(UserCall) || isa<GCResultInst>(UserCall), 2331 "gc.result or gc.relocate are the only value uses " 2332 "of a gc.statepoint", 2333 Call, U); 2334 if (isa<GCResultInst>(UserCall)) { 2335 Check(UserCall->getArgOperand(0) == &Call, 2336 "gc.result connected to wrong gc.statepoint", Call, UserCall); 2337 } else if (isa<GCRelocateInst>(Call)) { 2338 Check(UserCall->getArgOperand(0) == &Call, 2339 "gc.relocate connected to wrong gc.statepoint", Call, UserCall); 2340 } 2341 } 2342 2343 // Note: It is legal for a single derived pointer to be listed multiple 2344 // times. It's non-optimal, but it is legal. It can also happen after 2345 // insertion if we strip a bitcast away. 2346 // Note: It is really tempting to check that each base is relocated and 2347 // that a derived pointer is never reused as a base pointer. This turns 2348 // out to be problematic since optimizations run after safepoint insertion 2349 // can recognize equality properties that the insertion logic doesn't know 2350 // about. See example statepoint.ll in the verifier subdirectory 2351 } 2352 2353 void Verifier::verifyFrameRecoverIndices() { 2354 for (auto &Counts : FrameEscapeInfo) { 2355 Function *F = Counts.first; 2356 unsigned EscapedObjectCount = Counts.second.first; 2357 unsigned MaxRecoveredIndex = Counts.second.second; 2358 Check(MaxRecoveredIndex <= EscapedObjectCount, 2359 "all indices passed to llvm.localrecover must be less than the " 2360 "number of arguments passed to llvm.localescape in the parent " 2361 "function", 2362 F); 2363 } 2364 } 2365 2366 static Instruction *getSuccPad(Instruction *Terminator) { 2367 BasicBlock *UnwindDest; 2368 if (auto *II = dyn_cast<InvokeInst>(Terminator)) 2369 UnwindDest = II->getUnwindDest(); 2370 else if (auto *CSI = dyn_cast<CatchSwitchInst>(Terminator)) 2371 UnwindDest = CSI->getUnwindDest(); 2372 else 2373 UnwindDest = cast<CleanupReturnInst>(Terminator)->getUnwindDest(); 2374 return UnwindDest->getFirstNonPHI(); 2375 } 2376 2377 void Verifier::verifySiblingFuncletUnwinds() { 2378 SmallPtrSet<Instruction *, 8> Visited; 2379 SmallPtrSet<Instruction *, 8> Active; 2380 for (const auto &Pair : SiblingFuncletInfo) { 2381 Instruction *PredPad = Pair.first; 2382 if (Visited.count(PredPad)) 2383 continue; 2384 Active.insert(PredPad); 2385 Instruction *Terminator = Pair.second; 2386 do { 2387 Instruction *SuccPad = getSuccPad(Terminator); 2388 if (Active.count(SuccPad)) { 2389 // Found a cycle; report error 2390 Instruction *CyclePad = SuccPad; 2391 SmallVector<Instruction *, 8> CycleNodes; 2392 do { 2393 CycleNodes.push_back(CyclePad); 2394 Instruction *CycleTerminator = SiblingFuncletInfo[CyclePad]; 2395 if (CycleTerminator != CyclePad) 2396 CycleNodes.push_back(CycleTerminator); 2397 CyclePad = getSuccPad(CycleTerminator); 2398 } while (CyclePad != SuccPad); 2399 Check(false, "EH pads can't handle each other's exceptions", 2400 ArrayRef<Instruction *>(CycleNodes)); 2401 } 2402 // Don't re-walk a node we've already checked 2403 if (!Visited.insert(SuccPad).second) 2404 break; 2405 // Walk to this successor if it has a map entry. 2406 PredPad = SuccPad; 2407 auto TermI = SiblingFuncletInfo.find(PredPad); 2408 if (TermI == SiblingFuncletInfo.end()) 2409 break; 2410 Terminator = TermI->second; 2411 Active.insert(PredPad); 2412 } while (true); 2413 // Each node only has one successor, so we've walked all the active 2414 // nodes' successors. 2415 Active.clear(); 2416 } 2417 } 2418 2419 // visitFunction - Verify that a function is ok. 2420 // 2421 void Verifier::visitFunction(const Function &F) { 2422 visitGlobalValue(F); 2423 2424 // Check function arguments. 2425 FunctionType *FT = F.getFunctionType(); 2426 unsigned NumArgs = F.arg_size(); 2427 2428 Check(&Context == &F.getContext(), 2429 "Function context does not match Module context!", &F); 2430 2431 Check(!F.hasCommonLinkage(), "Functions may not have common linkage", &F); 2432 Check(FT->getNumParams() == NumArgs, 2433 "# formal arguments must match # of arguments for function type!", &F, 2434 FT); 2435 Check(F.getReturnType()->isFirstClassType() || 2436 F.getReturnType()->isVoidTy() || F.getReturnType()->isStructTy(), 2437 "Functions cannot return aggregate values!", &F); 2438 2439 Check(!F.hasStructRetAttr() || F.getReturnType()->isVoidTy(), 2440 "Invalid struct return type!", &F); 2441 2442 AttributeList Attrs = F.getAttributes(); 2443 2444 Check(verifyAttributeCount(Attrs, FT->getNumParams()), 2445 "Attribute after last parameter!", &F); 2446 2447 bool IsIntrinsic = F.isIntrinsic(); 2448 2449 // Check function attributes. 2450 verifyFunctionAttrs(FT, Attrs, &F, IsIntrinsic, /* IsInlineAsm */ false); 2451 2452 // On function declarations/definitions, we do not support the builtin 2453 // attribute. We do not check this in VerifyFunctionAttrs since that is 2454 // checking for Attributes that can/can not ever be on functions. 2455 Check(!Attrs.hasFnAttr(Attribute::Builtin), 2456 "Attribute 'builtin' can only be applied to a callsite.", &F); 2457 2458 Check(!Attrs.hasAttrSomewhere(Attribute::ElementType), 2459 "Attribute 'elementtype' can only be applied to a callsite.", &F); 2460 2461 // Check that this function meets the restrictions on this calling convention. 2462 // Sometimes varargs is used for perfectly forwarding thunks, so some of these 2463 // restrictions can be lifted. 2464 switch (F.getCallingConv()) { 2465 default: 2466 case CallingConv::C: 2467 break; 2468 case CallingConv::X86_INTR: { 2469 Check(F.arg_empty() || Attrs.hasParamAttr(0, Attribute::ByVal), 2470 "Calling convention parameter requires byval", &F); 2471 break; 2472 } 2473 case CallingConv::AMDGPU_KERNEL: 2474 case CallingConv::SPIR_KERNEL: 2475 Check(F.getReturnType()->isVoidTy(), 2476 "Calling convention requires void return type", &F); 2477 LLVM_FALLTHROUGH; 2478 case CallingConv::AMDGPU_VS: 2479 case CallingConv::AMDGPU_HS: 2480 case CallingConv::AMDGPU_GS: 2481 case CallingConv::AMDGPU_PS: 2482 case CallingConv::AMDGPU_CS: 2483 Check(!F.hasStructRetAttr(), "Calling convention does not allow sret", &F); 2484 if (F.getCallingConv() != CallingConv::SPIR_KERNEL) { 2485 const unsigned StackAS = DL.getAllocaAddrSpace(); 2486 unsigned i = 0; 2487 for (const Argument &Arg : F.args()) { 2488 Check(!Attrs.hasParamAttr(i, Attribute::ByVal), 2489 "Calling convention disallows byval", &F); 2490 Check(!Attrs.hasParamAttr(i, Attribute::Preallocated), 2491 "Calling convention disallows preallocated", &F); 2492 Check(!Attrs.hasParamAttr(i, Attribute::InAlloca), 2493 "Calling convention disallows inalloca", &F); 2494 2495 if (Attrs.hasParamAttr(i, Attribute::ByRef)) { 2496 // FIXME: Should also disallow LDS and GDS, but we don't have the enum 2497 // value here. 2498 Check(Arg.getType()->getPointerAddressSpace() != StackAS, 2499 "Calling convention disallows stack byref", &F); 2500 } 2501 2502 ++i; 2503 } 2504 } 2505 2506 LLVM_FALLTHROUGH; 2507 case CallingConv::Fast: 2508 case CallingConv::Cold: 2509 case CallingConv::Intel_OCL_BI: 2510 case CallingConv::PTX_Kernel: 2511 case CallingConv::PTX_Device: 2512 Check(!F.isVarArg(), 2513 "Calling convention does not support varargs or " 2514 "perfect forwarding!", 2515 &F); 2516 break; 2517 } 2518 2519 // Check that the argument values match the function type for this function... 2520 unsigned i = 0; 2521 for (const Argument &Arg : F.args()) { 2522 Check(Arg.getType() == FT->getParamType(i), 2523 "Argument value does not match function argument type!", &Arg, 2524 FT->getParamType(i)); 2525 Check(Arg.getType()->isFirstClassType(), 2526 "Function arguments must have first-class types!", &Arg); 2527 if (!IsIntrinsic) { 2528 Check(!Arg.getType()->isMetadataTy(), 2529 "Function takes metadata but isn't an intrinsic", &Arg, &F); 2530 Check(!Arg.getType()->isTokenTy(), 2531 "Function takes token but isn't an intrinsic", &Arg, &F); 2532 Check(!Arg.getType()->isX86_AMXTy(), 2533 "Function takes x86_amx but isn't an intrinsic", &Arg, &F); 2534 } 2535 2536 // Check that swifterror argument is only used by loads and stores. 2537 if (Attrs.hasParamAttr(i, Attribute::SwiftError)) { 2538 verifySwiftErrorValue(&Arg); 2539 } 2540 ++i; 2541 } 2542 2543 if (!IsIntrinsic) { 2544 Check(!F.getReturnType()->isTokenTy(), 2545 "Function returns a token but isn't an intrinsic", &F); 2546 Check(!F.getReturnType()->isX86_AMXTy(), 2547 "Function returns a x86_amx but isn't an intrinsic", &F); 2548 } 2549 2550 // Get the function metadata attachments. 2551 SmallVector<std::pair<unsigned, MDNode *>, 4> MDs; 2552 F.getAllMetadata(MDs); 2553 assert(F.hasMetadata() != MDs.empty() && "Bit out-of-sync"); 2554 verifyFunctionMetadata(MDs); 2555 2556 // Check validity of the personality function 2557 if (F.hasPersonalityFn()) { 2558 auto *Per = dyn_cast<Function>(F.getPersonalityFn()->stripPointerCasts()); 2559 if (Per) 2560 Check(Per->getParent() == F.getParent(), 2561 "Referencing personality function in another module!", &F, 2562 F.getParent(), Per, Per->getParent()); 2563 } 2564 2565 if (F.isMaterializable()) { 2566 // Function has a body somewhere we can't see. 2567 Check(MDs.empty(), "unmaterialized function cannot have metadata", &F, 2568 MDs.empty() ? nullptr : MDs.front().second); 2569 } else if (F.isDeclaration()) { 2570 for (const auto &I : MDs) { 2571 // This is used for call site debug information. 2572 CheckDI(I.first != LLVMContext::MD_dbg || 2573 !cast<DISubprogram>(I.second)->isDistinct(), 2574 "function declaration may only have a unique !dbg attachment", 2575 &F); 2576 Check(I.first != LLVMContext::MD_prof, 2577 "function declaration may not have a !prof attachment", &F); 2578 2579 // Verify the metadata itself. 2580 visitMDNode(*I.second, AreDebugLocsAllowed::Yes); 2581 } 2582 Check(!F.hasPersonalityFn(), 2583 "Function declaration shouldn't have a personality routine", &F); 2584 } else { 2585 // Verify that this function (which has a body) is not named "llvm.*". It 2586 // is not legal to define intrinsics. 2587 Check(!IsIntrinsic, "llvm intrinsics cannot be defined!", &F); 2588 2589 // Check the entry node 2590 const BasicBlock *Entry = &F.getEntryBlock(); 2591 Check(pred_empty(Entry), 2592 "Entry block to function must not have predecessors!", Entry); 2593 2594 // The address of the entry block cannot be taken, unless it is dead. 2595 if (Entry->hasAddressTaken()) { 2596 Check(!BlockAddress::lookup(Entry)->isConstantUsed(), 2597 "blockaddress may not be used with the entry block!", Entry); 2598 } 2599 2600 unsigned NumDebugAttachments = 0, NumProfAttachments = 0; 2601 // Visit metadata attachments. 2602 for (const auto &I : MDs) { 2603 // Verify that the attachment is legal. 2604 auto AllowLocs = AreDebugLocsAllowed::No; 2605 switch (I.first) { 2606 default: 2607 break; 2608 case LLVMContext::MD_dbg: { 2609 ++NumDebugAttachments; 2610 CheckDI(NumDebugAttachments == 1, 2611 "function must have a single !dbg attachment", &F, I.second); 2612 CheckDI(isa<DISubprogram>(I.second), 2613 "function !dbg attachment must be a subprogram", &F, I.second); 2614 CheckDI(cast<DISubprogram>(I.second)->isDistinct(), 2615 "function definition may only have a distinct !dbg attachment", 2616 &F); 2617 2618 auto *SP = cast<DISubprogram>(I.second); 2619 const Function *&AttachedTo = DISubprogramAttachments[SP]; 2620 CheckDI(!AttachedTo || AttachedTo == &F, 2621 "DISubprogram attached to more than one function", SP, &F); 2622 AttachedTo = &F; 2623 AllowLocs = AreDebugLocsAllowed::Yes; 2624 break; 2625 } 2626 case LLVMContext::MD_prof: 2627 ++NumProfAttachments; 2628 Check(NumProfAttachments == 1, 2629 "function must have a single !prof attachment", &F, I.second); 2630 break; 2631 } 2632 2633 // Verify the metadata itself. 2634 visitMDNode(*I.second, AllowLocs); 2635 } 2636 } 2637 2638 // If this function is actually an intrinsic, verify that it is only used in 2639 // direct call/invokes, never having its "address taken". 2640 // Only do this if the module is materialized, otherwise we don't have all the 2641 // uses. 2642 if (F.isIntrinsic() && F.getParent()->isMaterialized()) { 2643 const User *U; 2644 if (F.hasAddressTaken(&U, false, true, false, 2645 /*IgnoreARCAttachedCall=*/true)) 2646 Check(false, "Invalid user of intrinsic instruction!", U); 2647 } 2648 2649 // Check intrinsics' signatures. 2650 switch (F.getIntrinsicID()) { 2651 case Intrinsic::experimental_gc_get_pointer_base: { 2652 FunctionType *FT = F.getFunctionType(); 2653 Check(FT->getNumParams() == 1, "wrong number of parameters", F); 2654 Check(isa<PointerType>(F.getReturnType()), 2655 "gc.get.pointer.base must return a pointer", F); 2656 Check(FT->getParamType(0) == F.getReturnType(), 2657 "gc.get.pointer.base operand and result must be of the same type", F); 2658 break; 2659 } 2660 case Intrinsic::experimental_gc_get_pointer_offset: { 2661 FunctionType *FT = F.getFunctionType(); 2662 Check(FT->getNumParams() == 1, "wrong number of parameters", F); 2663 Check(isa<PointerType>(FT->getParamType(0)), 2664 "gc.get.pointer.offset operand must be a pointer", F); 2665 Check(F.getReturnType()->isIntegerTy(), 2666 "gc.get.pointer.offset must return integer", F); 2667 break; 2668 } 2669 } 2670 2671 auto *N = F.getSubprogram(); 2672 HasDebugInfo = (N != nullptr); 2673 if (!HasDebugInfo) 2674 return; 2675 2676 // Check that all !dbg attachments lead to back to N. 2677 // 2678 // FIXME: Check this incrementally while visiting !dbg attachments. 2679 // FIXME: Only check when N is the canonical subprogram for F. 2680 SmallPtrSet<const MDNode *, 32> Seen; 2681 auto VisitDebugLoc = [&](const Instruction &I, const MDNode *Node) { 2682 // Be careful about using DILocation here since we might be dealing with 2683 // broken code (this is the Verifier after all). 2684 const DILocation *DL = dyn_cast_or_null<DILocation>(Node); 2685 if (!DL) 2686 return; 2687 if (!Seen.insert(DL).second) 2688 return; 2689 2690 Metadata *Parent = DL->getRawScope(); 2691 CheckDI(Parent && isa<DILocalScope>(Parent), 2692 "DILocation's scope must be a DILocalScope", N, &F, &I, DL, Parent); 2693 2694 DILocalScope *Scope = DL->getInlinedAtScope(); 2695 Check(Scope, "Failed to find DILocalScope", DL); 2696 2697 if (!Seen.insert(Scope).second) 2698 return; 2699 2700 DISubprogram *SP = Scope->getSubprogram(); 2701 2702 // Scope and SP could be the same MDNode and we don't want to skip 2703 // validation in that case 2704 if (SP && ((Scope != SP) && !Seen.insert(SP).second)) 2705 return; 2706 2707 CheckDI(SP->describes(&F), 2708 "!dbg attachment points at wrong subprogram for function", N, &F, 2709 &I, DL, Scope, SP); 2710 }; 2711 for (auto &BB : F) 2712 for (auto &I : BB) { 2713 VisitDebugLoc(I, I.getDebugLoc().getAsMDNode()); 2714 // The llvm.loop annotations also contain two DILocations. 2715 if (auto MD = I.getMetadata(LLVMContext::MD_loop)) 2716 for (unsigned i = 1; i < MD->getNumOperands(); ++i) 2717 VisitDebugLoc(I, dyn_cast_or_null<MDNode>(MD->getOperand(i))); 2718 if (BrokenDebugInfo) 2719 return; 2720 } 2721 } 2722 2723 // verifyBasicBlock - Verify that a basic block is well formed... 2724 // 2725 void Verifier::visitBasicBlock(BasicBlock &BB) { 2726 InstsInThisBlock.clear(); 2727 2728 // Ensure that basic blocks have terminators! 2729 Check(BB.getTerminator(), "Basic Block does not have terminator!", &BB); 2730 2731 // Check constraints that this basic block imposes on all of the PHI nodes in 2732 // it. 2733 if (isa<PHINode>(BB.front())) { 2734 SmallVector<BasicBlock *, 8> Preds(predecessors(&BB)); 2735 SmallVector<std::pair<BasicBlock*, Value*>, 8> Values; 2736 llvm::sort(Preds); 2737 for (const PHINode &PN : BB.phis()) { 2738 Check(PN.getNumIncomingValues() == Preds.size(), 2739 "PHINode should have one entry for each predecessor of its " 2740 "parent basic block!", 2741 &PN); 2742 2743 // Get and sort all incoming values in the PHI node... 2744 Values.clear(); 2745 Values.reserve(PN.getNumIncomingValues()); 2746 for (unsigned i = 0, e = PN.getNumIncomingValues(); i != e; ++i) 2747 Values.push_back( 2748 std::make_pair(PN.getIncomingBlock(i), PN.getIncomingValue(i))); 2749 llvm::sort(Values); 2750 2751 for (unsigned i = 0, e = Values.size(); i != e; ++i) { 2752 // Check to make sure that if there is more than one entry for a 2753 // particular basic block in this PHI node, that the incoming values are 2754 // all identical. 2755 // 2756 Check(i == 0 || Values[i].first != Values[i - 1].first || 2757 Values[i].second == Values[i - 1].second, 2758 "PHI node has multiple entries for the same basic block with " 2759 "different incoming values!", 2760 &PN, Values[i].first, Values[i].second, Values[i - 1].second); 2761 2762 // Check to make sure that the predecessors and PHI node entries are 2763 // matched up. 2764 Check(Values[i].first == Preds[i], 2765 "PHI node entries do not match predecessors!", &PN, 2766 Values[i].first, Preds[i]); 2767 } 2768 } 2769 } 2770 2771 // Check that all instructions have their parent pointers set up correctly. 2772 for (auto &I : BB) 2773 { 2774 Check(I.getParent() == &BB, "Instruction has bogus parent pointer!"); 2775 } 2776 } 2777 2778 void Verifier::visitTerminator(Instruction &I) { 2779 // Ensure that terminators only exist at the end of the basic block. 2780 Check(&I == I.getParent()->getTerminator(), 2781 "Terminator found in the middle of a basic block!", I.getParent()); 2782 visitInstruction(I); 2783 } 2784 2785 void Verifier::visitBranchInst(BranchInst &BI) { 2786 if (BI.isConditional()) { 2787 Check(BI.getCondition()->getType()->isIntegerTy(1), 2788 "Branch condition is not 'i1' type!", &BI, BI.getCondition()); 2789 } 2790 visitTerminator(BI); 2791 } 2792 2793 void Verifier::visitReturnInst(ReturnInst &RI) { 2794 Function *F = RI.getParent()->getParent(); 2795 unsigned N = RI.getNumOperands(); 2796 if (F->getReturnType()->isVoidTy()) 2797 Check(N == 0, 2798 "Found return instr that returns non-void in Function of void " 2799 "return type!", 2800 &RI, F->getReturnType()); 2801 else 2802 Check(N == 1 && F->getReturnType() == RI.getOperand(0)->getType(), 2803 "Function return type does not match operand " 2804 "type of return inst!", 2805 &RI, F->getReturnType()); 2806 2807 // Check to make sure that the return value has necessary properties for 2808 // terminators... 2809 visitTerminator(RI); 2810 } 2811 2812 void Verifier::visitSwitchInst(SwitchInst &SI) { 2813 Check(SI.getType()->isVoidTy(), "Switch must have void result type!", &SI); 2814 // Check to make sure that all of the constants in the switch instruction 2815 // have the same type as the switched-on value. 2816 Type *SwitchTy = SI.getCondition()->getType(); 2817 SmallPtrSet<ConstantInt*, 32> Constants; 2818 for (auto &Case : SI.cases()) { 2819 Check(Case.getCaseValue()->getType() == SwitchTy, 2820 "Switch constants must all be same type as switch value!", &SI); 2821 Check(Constants.insert(Case.getCaseValue()).second, 2822 "Duplicate integer as switch case", &SI, Case.getCaseValue()); 2823 } 2824 2825 visitTerminator(SI); 2826 } 2827 2828 void Verifier::visitIndirectBrInst(IndirectBrInst &BI) { 2829 Check(BI.getAddress()->getType()->isPointerTy(), 2830 "Indirectbr operand must have pointer type!", &BI); 2831 for (unsigned i = 0, e = BI.getNumDestinations(); i != e; ++i) 2832 Check(BI.getDestination(i)->getType()->isLabelTy(), 2833 "Indirectbr destinations must all have pointer type!", &BI); 2834 2835 visitTerminator(BI); 2836 } 2837 2838 void Verifier::visitCallBrInst(CallBrInst &CBI) { 2839 Check(CBI.isInlineAsm(), "Callbr is currently only used for asm-goto!", &CBI); 2840 const InlineAsm *IA = cast<InlineAsm>(CBI.getCalledOperand()); 2841 Check(!IA->canThrow(), "Unwinding from Callbr is not allowed"); 2842 for (unsigned i = 0, e = CBI.getNumSuccessors(); i != e; ++i) 2843 Check(CBI.getSuccessor(i)->getType()->isLabelTy(), 2844 "Callbr successors must all have pointer type!", &CBI); 2845 for (unsigned i = 0, e = CBI.getNumOperands(); i != e; ++i) { 2846 Check(i >= CBI.arg_size() || !isa<BasicBlock>(CBI.getOperand(i)), 2847 "Using an unescaped label as a callbr argument!", &CBI); 2848 if (isa<BasicBlock>(CBI.getOperand(i))) 2849 for (unsigned j = i + 1; j != e; ++j) 2850 Check(CBI.getOperand(i) != CBI.getOperand(j), 2851 "Duplicate callbr destination!", &CBI); 2852 } 2853 { 2854 SmallPtrSet<BasicBlock *, 4> ArgBBs; 2855 for (Value *V : CBI.args()) 2856 if (auto *BA = dyn_cast<BlockAddress>(V)) 2857 ArgBBs.insert(BA->getBasicBlock()); 2858 for (BasicBlock *BB : CBI.getIndirectDests()) 2859 Check(ArgBBs.count(BB), "Indirect label missing from arglist.", &CBI); 2860 } 2861 2862 verifyInlineAsmCall(CBI); 2863 visitTerminator(CBI); 2864 } 2865 2866 void Verifier::visitSelectInst(SelectInst &SI) { 2867 Check(!SelectInst::areInvalidOperands(SI.getOperand(0), SI.getOperand(1), 2868 SI.getOperand(2)), 2869 "Invalid operands for select instruction!", &SI); 2870 2871 Check(SI.getTrueValue()->getType() == SI.getType(), 2872 "Select values must have same type as select instruction!", &SI); 2873 visitInstruction(SI); 2874 } 2875 2876 /// visitUserOp1 - User defined operators shouldn't live beyond the lifetime of 2877 /// a pass, if any exist, it's an error. 2878 /// 2879 void Verifier::visitUserOp1(Instruction &I) { 2880 Check(false, "User-defined operators should not live outside of a pass!", &I); 2881 } 2882 2883 void Verifier::visitTruncInst(TruncInst &I) { 2884 // Get the source and destination types 2885 Type *SrcTy = I.getOperand(0)->getType(); 2886 Type *DestTy = I.getType(); 2887 2888 // Get the size of the types in bits, we'll need this later 2889 unsigned SrcBitSize = SrcTy->getScalarSizeInBits(); 2890 unsigned DestBitSize = DestTy->getScalarSizeInBits(); 2891 2892 Check(SrcTy->isIntOrIntVectorTy(), "Trunc only operates on integer", &I); 2893 Check(DestTy->isIntOrIntVectorTy(), "Trunc only produces integer", &I); 2894 Check(SrcTy->isVectorTy() == DestTy->isVectorTy(), 2895 "trunc source and destination must both be a vector or neither", &I); 2896 Check(SrcBitSize > DestBitSize, "DestTy too big for Trunc", &I); 2897 2898 visitInstruction(I); 2899 } 2900 2901 void Verifier::visitZExtInst(ZExtInst &I) { 2902 // Get the source and destination types 2903 Type *SrcTy = I.getOperand(0)->getType(); 2904 Type *DestTy = I.getType(); 2905 2906 // Get the size of the types in bits, we'll need this later 2907 Check(SrcTy->isIntOrIntVectorTy(), "ZExt only operates on integer", &I); 2908 Check(DestTy->isIntOrIntVectorTy(), "ZExt only produces an integer", &I); 2909 Check(SrcTy->isVectorTy() == DestTy->isVectorTy(), 2910 "zext source and destination must both be a vector or neither", &I); 2911 unsigned SrcBitSize = SrcTy->getScalarSizeInBits(); 2912 unsigned DestBitSize = DestTy->getScalarSizeInBits(); 2913 2914 Check(SrcBitSize < DestBitSize, "Type too small for ZExt", &I); 2915 2916 visitInstruction(I); 2917 } 2918 2919 void Verifier::visitSExtInst(SExtInst &I) { 2920 // Get the source and destination types 2921 Type *SrcTy = I.getOperand(0)->getType(); 2922 Type *DestTy = I.getType(); 2923 2924 // Get the size of the types in bits, we'll need this later 2925 unsigned SrcBitSize = SrcTy->getScalarSizeInBits(); 2926 unsigned DestBitSize = DestTy->getScalarSizeInBits(); 2927 2928 Check(SrcTy->isIntOrIntVectorTy(), "SExt only operates on integer", &I); 2929 Check(DestTy->isIntOrIntVectorTy(), "SExt only produces an integer", &I); 2930 Check(SrcTy->isVectorTy() == DestTy->isVectorTy(), 2931 "sext source and destination must both be a vector or neither", &I); 2932 Check(SrcBitSize < DestBitSize, "Type too small for SExt", &I); 2933 2934 visitInstruction(I); 2935 } 2936 2937 void Verifier::visitFPTruncInst(FPTruncInst &I) { 2938 // Get the source and destination types 2939 Type *SrcTy = I.getOperand(0)->getType(); 2940 Type *DestTy = I.getType(); 2941 // Get the size of the types in bits, we'll need this later 2942 unsigned SrcBitSize = SrcTy->getScalarSizeInBits(); 2943 unsigned DestBitSize = DestTy->getScalarSizeInBits(); 2944 2945 Check(SrcTy->isFPOrFPVectorTy(), "FPTrunc only operates on FP", &I); 2946 Check(DestTy->isFPOrFPVectorTy(), "FPTrunc only produces an FP", &I); 2947 Check(SrcTy->isVectorTy() == DestTy->isVectorTy(), 2948 "fptrunc source and destination must both be a vector or neither", &I); 2949 Check(SrcBitSize > DestBitSize, "DestTy too big for FPTrunc", &I); 2950 2951 visitInstruction(I); 2952 } 2953 2954 void Verifier::visitFPExtInst(FPExtInst &I) { 2955 // Get the source and destination types 2956 Type *SrcTy = I.getOperand(0)->getType(); 2957 Type *DestTy = I.getType(); 2958 2959 // Get the size of the types in bits, we'll need this later 2960 unsigned SrcBitSize = SrcTy->getScalarSizeInBits(); 2961 unsigned DestBitSize = DestTy->getScalarSizeInBits(); 2962 2963 Check(SrcTy->isFPOrFPVectorTy(), "FPExt only operates on FP", &I); 2964 Check(DestTy->isFPOrFPVectorTy(), "FPExt only produces an FP", &I); 2965 Check(SrcTy->isVectorTy() == DestTy->isVectorTy(), 2966 "fpext source and destination must both be a vector or neither", &I); 2967 Check(SrcBitSize < DestBitSize, "DestTy too small for FPExt", &I); 2968 2969 visitInstruction(I); 2970 } 2971 2972 void Verifier::visitUIToFPInst(UIToFPInst &I) { 2973 // Get the source and destination types 2974 Type *SrcTy = I.getOperand(0)->getType(); 2975 Type *DestTy = I.getType(); 2976 2977 bool SrcVec = SrcTy->isVectorTy(); 2978 bool DstVec = DestTy->isVectorTy(); 2979 2980 Check(SrcVec == DstVec, 2981 "UIToFP source and dest must both be vector or scalar", &I); 2982 Check(SrcTy->isIntOrIntVectorTy(), 2983 "UIToFP source must be integer or integer vector", &I); 2984 Check(DestTy->isFPOrFPVectorTy(), "UIToFP result must be FP or FP vector", 2985 &I); 2986 2987 if (SrcVec && DstVec) 2988 Check(cast<VectorType>(SrcTy)->getElementCount() == 2989 cast<VectorType>(DestTy)->getElementCount(), 2990 "UIToFP source and dest vector length mismatch", &I); 2991 2992 visitInstruction(I); 2993 } 2994 2995 void Verifier::visitSIToFPInst(SIToFPInst &I) { 2996 // Get the source and destination types 2997 Type *SrcTy = I.getOperand(0)->getType(); 2998 Type *DestTy = I.getType(); 2999 3000 bool SrcVec = SrcTy->isVectorTy(); 3001 bool DstVec = DestTy->isVectorTy(); 3002 3003 Check(SrcVec == DstVec, 3004 "SIToFP source and dest must both be vector or scalar", &I); 3005 Check(SrcTy->isIntOrIntVectorTy(), 3006 "SIToFP source must be integer or integer vector", &I); 3007 Check(DestTy->isFPOrFPVectorTy(), "SIToFP result must be FP or FP vector", 3008 &I); 3009 3010 if (SrcVec && DstVec) 3011 Check(cast<VectorType>(SrcTy)->getElementCount() == 3012 cast<VectorType>(DestTy)->getElementCount(), 3013 "SIToFP source and dest vector length mismatch", &I); 3014 3015 visitInstruction(I); 3016 } 3017 3018 void Verifier::visitFPToUIInst(FPToUIInst &I) { 3019 // Get the source and destination types 3020 Type *SrcTy = I.getOperand(0)->getType(); 3021 Type *DestTy = I.getType(); 3022 3023 bool SrcVec = SrcTy->isVectorTy(); 3024 bool DstVec = DestTy->isVectorTy(); 3025 3026 Check(SrcVec == DstVec, 3027 "FPToUI source and dest must both be vector or scalar", &I); 3028 Check(SrcTy->isFPOrFPVectorTy(), "FPToUI source must be FP or FP vector", &I); 3029 Check(DestTy->isIntOrIntVectorTy(), 3030 "FPToUI result must be integer or integer vector", &I); 3031 3032 if (SrcVec && DstVec) 3033 Check(cast<VectorType>(SrcTy)->getElementCount() == 3034 cast<VectorType>(DestTy)->getElementCount(), 3035 "FPToUI source and dest vector length mismatch", &I); 3036 3037 visitInstruction(I); 3038 } 3039 3040 void Verifier::visitFPToSIInst(FPToSIInst &I) { 3041 // Get the source and destination types 3042 Type *SrcTy = I.getOperand(0)->getType(); 3043 Type *DestTy = I.getType(); 3044 3045 bool SrcVec = SrcTy->isVectorTy(); 3046 bool DstVec = DestTy->isVectorTy(); 3047 3048 Check(SrcVec == DstVec, 3049 "FPToSI source and dest must both be vector or scalar", &I); 3050 Check(SrcTy->isFPOrFPVectorTy(), "FPToSI source must be FP or FP vector", &I); 3051 Check(DestTy->isIntOrIntVectorTy(), 3052 "FPToSI result must be integer or integer vector", &I); 3053 3054 if (SrcVec && DstVec) 3055 Check(cast<VectorType>(SrcTy)->getElementCount() == 3056 cast<VectorType>(DestTy)->getElementCount(), 3057 "FPToSI source and dest vector length mismatch", &I); 3058 3059 visitInstruction(I); 3060 } 3061 3062 void Verifier::visitPtrToIntInst(PtrToIntInst &I) { 3063 // Get the source and destination types 3064 Type *SrcTy = I.getOperand(0)->getType(); 3065 Type *DestTy = I.getType(); 3066 3067 Check(SrcTy->isPtrOrPtrVectorTy(), "PtrToInt source must be pointer", &I); 3068 3069 Check(DestTy->isIntOrIntVectorTy(), "PtrToInt result must be integral", &I); 3070 Check(SrcTy->isVectorTy() == DestTy->isVectorTy(), "PtrToInt type mismatch", 3071 &I); 3072 3073 if (SrcTy->isVectorTy()) { 3074 auto *VSrc = cast<VectorType>(SrcTy); 3075 auto *VDest = cast<VectorType>(DestTy); 3076 Check(VSrc->getElementCount() == VDest->getElementCount(), 3077 "PtrToInt Vector width mismatch", &I); 3078 } 3079 3080 visitInstruction(I); 3081 } 3082 3083 void Verifier::visitIntToPtrInst(IntToPtrInst &I) { 3084 // Get the source and destination types 3085 Type *SrcTy = I.getOperand(0)->getType(); 3086 Type *DestTy = I.getType(); 3087 3088 Check(SrcTy->isIntOrIntVectorTy(), "IntToPtr source must be an integral", &I); 3089 Check(DestTy->isPtrOrPtrVectorTy(), "IntToPtr result must be a pointer", &I); 3090 3091 Check(SrcTy->isVectorTy() == DestTy->isVectorTy(), "IntToPtr type mismatch", 3092 &I); 3093 if (SrcTy->isVectorTy()) { 3094 auto *VSrc = cast<VectorType>(SrcTy); 3095 auto *VDest = cast<VectorType>(DestTy); 3096 Check(VSrc->getElementCount() == VDest->getElementCount(), 3097 "IntToPtr Vector width mismatch", &I); 3098 } 3099 visitInstruction(I); 3100 } 3101 3102 void Verifier::visitBitCastInst(BitCastInst &I) { 3103 Check( 3104 CastInst::castIsValid(Instruction::BitCast, I.getOperand(0), I.getType()), 3105 "Invalid bitcast", &I); 3106 visitInstruction(I); 3107 } 3108 3109 void Verifier::visitAddrSpaceCastInst(AddrSpaceCastInst &I) { 3110 Type *SrcTy = I.getOperand(0)->getType(); 3111 Type *DestTy = I.getType(); 3112 3113 Check(SrcTy->isPtrOrPtrVectorTy(), "AddrSpaceCast source must be a pointer", 3114 &I); 3115 Check(DestTy->isPtrOrPtrVectorTy(), "AddrSpaceCast result must be a pointer", 3116 &I); 3117 Check(SrcTy->getPointerAddressSpace() != DestTy->getPointerAddressSpace(), 3118 "AddrSpaceCast must be between different address spaces", &I); 3119 if (auto *SrcVTy = dyn_cast<VectorType>(SrcTy)) 3120 Check(SrcVTy->getElementCount() == 3121 cast<VectorType>(DestTy)->getElementCount(), 3122 "AddrSpaceCast vector pointer number of elements mismatch", &I); 3123 visitInstruction(I); 3124 } 3125 3126 /// visitPHINode - Ensure that a PHI node is well formed. 3127 /// 3128 void Verifier::visitPHINode(PHINode &PN) { 3129 // Ensure that the PHI nodes are all grouped together at the top of the block. 3130 // This can be tested by checking whether the instruction before this is 3131 // either nonexistent (because this is begin()) or is a PHI node. If not, 3132 // then there is some other instruction before a PHI. 3133 Check(&PN == &PN.getParent()->front() || 3134 isa<PHINode>(--BasicBlock::iterator(&PN)), 3135 "PHI nodes not grouped at top of basic block!", &PN, PN.getParent()); 3136 3137 // Check that a PHI doesn't yield a Token. 3138 Check(!PN.getType()->isTokenTy(), "PHI nodes cannot have token type!"); 3139 3140 // Check that all of the values of the PHI node have the same type as the 3141 // result, and that the incoming blocks are really basic blocks. 3142 for (Value *IncValue : PN.incoming_values()) { 3143 Check(PN.getType() == IncValue->getType(), 3144 "PHI node operands are not the same type as the result!", &PN); 3145 } 3146 3147 // All other PHI node constraints are checked in the visitBasicBlock method. 3148 3149 visitInstruction(PN); 3150 } 3151 3152 void Verifier::visitCallBase(CallBase &Call) { 3153 Check(Call.getCalledOperand()->getType()->isPointerTy(), 3154 "Called function must be a pointer!", Call); 3155 PointerType *FPTy = cast<PointerType>(Call.getCalledOperand()->getType()); 3156 3157 Check(FPTy->isOpaqueOrPointeeTypeMatches(Call.getFunctionType()), 3158 "Called function is not the same type as the call!", Call); 3159 3160 FunctionType *FTy = Call.getFunctionType(); 3161 3162 // Verify that the correct number of arguments are being passed 3163 if (FTy->isVarArg()) 3164 Check(Call.arg_size() >= FTy->getNumParams(), 3165 "Called function requires more parameters than were provided!", Call); 3166 else 3167 Check(Call.arg_size() == FTy->getNumParams(), 3168 "Incorrect number of arguments passed to called function!", Call); 3169 3170 // Verify that all arguments to the call match the function type. 3171 for (unsigned i = 0, e = FTy->getNumParams(); i != e; ++i) 3172 Check(Call.getArgOperand(i)->getType() == FTy->getParamType(i), 3173 "Call parameter type does not match function signature!", 3174 Call.getArgOperand(i), FTy->getParamType(i), Call); 3175 3176 AttributeList Attrs = Call.getAttributes(); 3177 3178 Check(verifyAttributeCount(Attrs, Call.arg_size()), 3179 "Attribute after last parameter!", Call); 3180 3181 auto VerifyTypeAlign = [&](Type *Ty, const Twine &Message) { 3182 if (!Ty->isSized()) 3183 return; 3184 Align ABIAlign = DL.getABITypeAlign(Ty); 3185 Align MaxAlign(ParamMaxAlignment); 3186 Check(ABIAlign <= MaxAlign, 3187 "Incorrect alignment of " + Message + " to called function!", Call); 3188 }; 3189 3190 VerifyTypeAlign(FTy->getReturnType(), "return type"); 3191 for (unsigned i = 0, e = FTy->getNumParams(); i != e; ++i) { 3192 Type *Ty = FTy->getParamType(i); 3193 VerifyTypeAlign(Ty, "argument passed"); 3194 } 3195 3196 Function *Callee = 3197 dyn_cast<Function>(Call.getCalledOperand()->stripPointerCasts()); 3198 bool IsIntrinsic = Callee && Callee->isIntrinsic(); 3199 if (IsIntrinsic) 3200 Check(Callee->getValueType() == FTy, 3201 "Intrinsic called with incompatible signature", Call); 3202 3203 if (Attrs.hasFnAttr(Attribute::Speculatable)) { 3204 // Don't allow speculatable on call sites, unless the underlying function 3205 // declaration is also speculatable. 3206 Check(Callee && Callee->isSpeculatable(), 3207 "speculatable attribute may not apply to call sites", Call); 3208 } 3209 3210 if (Attrs.hasFnAttr(Attribute::Preallocated)) { 3211 Check(Call.getCalledFunction()->getIntrinsicID() == 3212 Intrinsic::call_preallocated_arg, 3213 "preallocated as a call site attribute can only be on " 3214 "llvm.call.preallocated.arg"); 3215 } 3216 3217 // Verify call attributes. 3218 verifyFunctionAttrs(FTy, Attrs, &Call, IsIntrinsic, Call.isInlineAsm()); 3219 3220 // Conservatively check the inalloca argument. 3221 // We have a bug if we can find that there is an underlying alloca without 3222 // inalloca. 3223 if (Call.hasInAllocaArgument()) { 3224 Value *InAllocaArg = Call.getArgOperand(FTy->getNumParams() - 1); 3225 if (auto AI = dyn_cast<AllocaInst>(InAllocaArg->stripInBoundsOffsets())) 3226 Check(AI->isUsedWithInAlloca(), 3227 "inalloca argument for call has mismatched alloca", AI, Call); 3228 } 3229 3230 // For each argument of the callsite, if it has the swifterror argument, 3231 // make sure the underlying alloca/parameter it comes from has a swifterror as 3232 // well. 3233 for (unsigned i = 0, e = FTy->getNumParams(); i != e; ++i) { 3234 if (Call.paramHasAttr(i, Attribute::SwiftError)) { 3235 Value *SwiftErrorArg = Call.getArgOperand(i); 3236 if (auto AI = dyn_cast<AllocaInst>(SwiftErrorArg->stripInBoundsOffsets())) { 3237 Check(AI->isSwiftError(), 3238 "swifterror argument for call has mismatched alloca", AI, Call); 3239 continue; 3240 } 3241 auto ArgI = dyn_cast<Argument>(SwiftErrorArg); 3242 Check(ArgI, "swifterror argument should come from an alloca or parameter", 3243 SwiftErrorArg, Call); 3244 Check(ArgI->hasSwiftErrorAttr(), 3245 "swifterror argument for call has mismatched parameter", ArgI, 3246 Call); 3247 } 3248 3249 if (Attrs.hasParamAttr(i, Attribute::ImmArg)) { 3250 // Don't allow immarg on call sites, unless the underlying declaration 3251 // also has the matching immarg. 3252 Check(Callee && Callee->hasParamAttribute(i, Attribute::ImmArg), 3253 "immarg may not apply only to call sites", Call.getArgOperand(i), 3254 Call); 3255 } 3256 3257 if (Call.paramHasAttr(i, Attribute::ImmArg)) { 3258 Value *ArgVal = Call.getArgOperand(i); 3259 Check(isa<ConstantInt>(ArgVal) || isa<ConstantFP>(ArgVal), 3260 "immarg operand has non-immediate parameter", ArgVal, Call); 3261 } 3262 3263 if (Call.paramHasAttr(i, Attribute::Preallocated)) { 3264 Value *ArgVal = Call.getArgOperand(i); 3265 bool hasOB = 3266 Call.countOperandBundlesOfType(LLVMContext::OB_preallocated) != 0; 3267 bool isMustTail = Call.isMustTailCall(); 3268 Check(hasOB != isMustTail, 3269 "preallocated operand either requires a preallocated bundle or " 3270 "the call to be musttail (but not both)", 3271 ArgVal, Call); 3272 } 3273 } 3274 3275 if (FTy->isVarArg()) { 3276 // FIXME? is 'nest' even legal here? 3277 bool SawNest = false; 3278 bool SawReturned = false; 3279 3280 for (unsigned Idx = 0; Idx < FTy->getNumParams(); ++Idx) { 3281 if (Attrs.hasParamAttr(Idx, Attribute::Nest)) 3282 SawNest = true; 3283 if (Attrs.hasParamAttr(Idx, Attribute::Returned)) 3284 SawReturned = true; 3285 } 3286 3287 // Check attributes on the varargs part. 3288 for (unsigned Idx = FTy->getNumParams(); Idx < Call.arg_size(); ++Idx) { 3289 Type *Ty = Call.getArgOperand(Idx)->getType(); 3290 AttributeSet ArgAttrs = Attrs.getParamAttrs(Idx); 3291 verifyParameterAttrs(ArgAttrs, Ty, &Call); 3292 3293 if (ArgAttrs.hasAttribute(Attribute::Nest)) { 3294 Check(!SawNest, "More than one parameter has attribute nest!", Call); 3295 SawNest = true; 3296 } 3297 3298 if (ArgAttrs.hasAttribute(Attribute::Returned)) { 3299 Check(!SawReturned, "More than one parameter has attribute returned!", 3300 Call); 3301 Check(Ty->canLosslesslyBitCastTo(FTy->getReturnType()), 3302 "Incompatible argument and return types for 'returned' " 3303 "attribute", 3304 Call); 3305 SawReturned = true; 3306 } 3307 3308 // Statepoint intrinsic is vararg but the wrapped function may be not. 3309 // Allow sret here and check the wrapped function in verifyStatepoint. 3310 if (!Call.getCalledFunction() || 3311 Call.getCalledFunction()->getIntrinsicID() != 3312 Intrinsic::experimental_gc_statepoint) 3313 Check(!ArgAttrs.hasAttribute(Attribute::StructRet), 3314 "Attribute 'sret' cannot be used for vararg call arguments!", 3315 Call); 3316 3317 if (ArgAttrs.hasAttribute(Attribute::InAlloca)) 3318 Check(Idx == Call.arg_size() - 1, 3319 "inalloca isn't on the last argument!", Call); 3320 } 3321 } 3322 3323 // Verify that there's no metadata unless it's a direct call to an intrinsic. 3324 if (!IsIntrinsic) { 3325 for (Type *ParamTy : FTy->params()) { 3326 Check(!ParamTy->isMetadataTy(), 3327 "Function has metadata parameter but isn't an intrinsic", Call); 3328 Check(!ParamTy->isTokenTy(), 3329 "Function has token parameter but isn't an intrinsic", Call); 3330 } 3331 } 3332 3333 // Verify that indirect calls don't return tokens. 3334 if (!Call.getCalledFunction()) { 3335 Check(!FTy->getReturnType()->isTokenTy(), 3336 "Return type cannot be token for indirect call!"); 3337 Check(!FTy->getReturnType()->isX86_AMXTy(), 3338 "Return type cannot be x86_amx for indirect call!"); 3339 } 3340 3341 if (Function *F = Call.getCalledFunction()) 3342 if (Intrinsic::ID ID = (Intrinsic::ID)F->getIntrinsicID()) 3343 visitIntrinsicCall(ID, Call); 3344 3345 // Verify that a callsite has at most one "deopt", at most one "funclet", at 3346 // most one "gc-transition", at most one "cfguardtarget", at most one 3347 // "preallocated" operand bundle, and at most one "ptrauth" operand bundle. 3348 bool FoundDeoptBundle = false, FoundFuncletBundle = false, 3349 FoundGCTransitionBundle = false, FoundCFGuardTargetBundle = false, 3350 FoundPreallocatedBundle = false, FoundGCLiveBundle = false, 3351 FoundPtrauthBundle = false, 3352 FoundAttachedCallBundle = false; 3353 for (unsigned i = 0, e = Call.getNumOperandBundles(); i < e; ++i) { 3354 OperandBundleUse BU = Call.getOperandBundleAt(i); 3355 uint32_t Tag = BU.getTagID(); 3356 if (Tag == LLVMContext::OB_deopt) { 3357 Check(!FoundDeoptBundle, "Multiple deopt operand bundles", Call); 3358 FoundDeoptBundle = true; 3359 } else if (Tag == LLVMContext::OB_gc_transition) { 3360 Check(!FoundGCTransitionBundle, "Multiple gc-transition operand bundles", 3361 Call); 3362 FoundGCTransitionBundle = true; 3363 } else if (Tag == LLVMContext::OB_funclet) { 3364 Check(!FoundFuncletBundle, "Multiple funclet operand bundles", Call); 3365 FoundFuncletBundle = true; 3366 Check(BU.Inputs.size() == 1, 3367 "Expected exactly one funclet bundle operand", Call); 3368 Check(isa<FuncletPadInst>(BU.Inputs.front()), 3369 "Funclet bundle operands should correspond to a FuncletPadInst", 3370 Call); 3371 } else if (Tag == LLVMContext::OB_cfguardtarget) { 3372 Check(!FoundCFGuardTargetBundle, "Multiple CFGuardTarget operand bundles", 3373 Call); 3374 FoundCFGuardTargetBundle = true; 3375 Check(BU.Inputs.size() == 1, 3376 "Expected exactly one cfguardtarget bundle operand", Call); 3377 } else if (Tag == LLVMContext::OB_ptrauth) { 3378 Check(!FoundPtrauthBundle, "Multiple ptrauth operand bundles", Call); 3379 FoundPtrauthBundle = true; 3380 Check(BU.Inputs.size() == 2, 3381 "Expected exactly two ptrauth bundle operands", Call); 3382 Check(isa<ConstantInt>(BU.Inputs[0]) && 3383 BU.Inputs[0]->getType()->isIntegerTy(32), 3384 "Ptrauth bundle key operand must be an i32 constant", Call); 3385 Check(BU.Inputs[1]->getType()->isIntegerTy(64), 3386 "Ptrauth bundle discriminator operand must be an i64", Call); 3387 } else if (Tag == LLVMContext::OB_preallocated) { 3388 Check(!FoundPreallocatedBundle, "Multiple preallocated operand bundles", 3389 Call); 3390 FoundPreallocatedBundle = true; 3391 Check(BU.Inputs.size() == 1, 3392 "Expected exactly one preallocated bundle operand", Call); 3393 auto Input = dyn_cast<IntrinsicInst>(BU.Inputs.front()); 3394 Check(Input && 3395 Input->getIntrinsicID() == Intrinsic::call_preallocated_setup, 3396 "\"preallocated\" argument must be a token from " 3397 "llvm.call.preallocated.setup", 3398 Call); 3399 } else if (Tag == LLVMContext::OB_gc_live) { 3400 Check(!FoundGCLiveBundle, "Multiple gc-live operand bundles", Call); 3401 FoundGCLiveBundle = true; 3402 } else if (Tag == LLVMContext::OB_clang_arc_attachedcall) { 3403 Check(!FoundAttachedCallBundle, 3404 "Multiple \"clang.arc.attachedcall\" operand bundles", Call); 3405 FoundAttachedCallBundle = true; 3406 verifyAttachedCallBundle(Call, BU); 3407 } 3408 } 3409 3410 // Verify that callee and callsite agree on whether to use pointer auth. 3411 Check(!(Call.getCalledFunction() && FoundPtrauthBundle), 3412 "Direct call cannot have a ptrauth bundle", Call); 3413 3414 // Verify that each inlinable callsite of a debug-info-bearing function in a 3415 // debug-info-bearing function has a debug location attached to it. Failure to 3416 // do so causes assertion failures when the inliner sets up inline scope info. 3417 if (Call.getFunction()->getSubprogram() && Call.getCalledFunction() && 3418 Call.getCalledFunction()->getSubprogram()) 3419 CheckDI(Call.getDebugLoc(), 3420 "inlinable function call in a function with " 3421 "debug info must have a !dbg location", 3422 Call); 3423 3424 if (Call.isInlineAsm()) 3425 verifyInlineAsmCall(Call); 3426 3427 visitInstruction(Call); 3428 } 3429 3430 void Verifier::verifyTailCCMustTailAttrs(const AttrBuilder &Attrs, 3431 StringRef Context) { 3432 Check(!Attrs.contains(Attribute::InAlloca), 3433 Twine("inalloca attribute not allowed in ") + Context); 3434 Check(!Attrs.contains(Attribute::InReg), 3435 Twine("inreg attribute not allowed in ") + Context); 3436 Check(!Attrs.contains(Attribute::SwiftError), 3437 Twine("swifterror attribute not allowed in ") + Context); 3438 Check(!Attrs.contains(Attribute::Preallocated), 3439 Twine("preallocated attribute not allowed in ") + Context); 3440 Check(!Attrs.contains(Attribute::ByRef), 3441 Twine("byref attribute not allowed in ") + Context); 3442 } 3443 3444 /// Two types are "congruent" if they are identical, or if they are both pointer 3445 /// types with different pointee types and the same address space. 3446 static bool isTypeCongruent(Type *L, Type *R) { 3447 if (L == R) 3448 return true; 3449 PointerType *PL = dyn_cast<PointerType>(L); 3450 PointerType *PR = dyn_cast<PointerType>(R); 3451 if (!PL || !PR) 3452 return false; 3453 return PL->getAddressSpace() == PR->getAddressSpace(); 3454 } 3455 3456 static AttrBuilder getParameterABIAttributes(LLVMContext& C, unsigned I, AttributeList Attrs) { 3457 static const Attribute::AttrKind ABIAttrs[] = { 3458 Attribute::StructRet, Attribute::ByVal, Attribute::InAlloca, 3459 Attribute::InReg, Attribute::StackAlignment, Attribute::SwiftSelf, 3460 Attribute::SwiftAsync, Attribute::SwiftError, Attribute::Preallocated, 3461 Attribute::ByRef}; 3462 AttrBuilder Copy(C); 3463 for (auto AK : ABIAttrs) { 3464 Attribute Attr = Attrs.getParamAttrs(I).getAttribute(AK); 3465 if (Attr.isValid()) 3466 Copy.addAttribute(Attr); 3467 } 3468 3469 // `align` is ABI-affecting only in combination with `byval` or `byref`. 3470 if (Attrs.hasParamAttr(I, Attribute::Alignment) && 3471 (Attrs.hasParamAttr(I, Attribute::ByVal) || 3472 Attrs.hasParamAttr(I, Attribute::ByRef))) 3473 Copy.addAlignmentAttr(Attrs.getParamAlignment(I)); 3474 return Copy; 3475 } 3476 3477 void Verifier::verifyMustTailCall(CallInst &CI) { 3478 Check(!CI.isInlineAsm(), "cannot use musttail call with inline asm", &CI); 3479 3480 Function *F = CI.getParent()->getParent(); 3481 FunctionType *CallerTy = F->getFunctionType(); 3482 FunctionType *CalleeTy = CI.getFunctionType(); 3483 Check(CallerTy->isVarArg() == CalleeTy->isVarArg(), 3484 "cannot guarantee tail call due to mismatched varargs", &CI); 3485 Check(isTypeCongruent(CallerTy->getReturnType(), CalleeTy->getReturnType()), 3486 "cannot guarantee tail call due to mismatched return types", &CI); 3487 3488 // - The calling conventions of the caller and callee must match. 3489 Check(F->getCallingConv() == CI.getCallingConv(), 3490 "cannot guarantee tail call due to mismatched calling conv", &CI); 3491 3492 // - The call must immediately precede a :ref:`ret <i_ret>` instruction, 3493 // or a pointer bitcast followed by a ret instruction. 3494 // - The ret instruction must return the (possibly bitcasted) value 3495 // produced by the call or void. 3496 Value *RetVal = &CI; 3497 Instruction *Next = CI.getNextNode(); 3498 3499 // Handle the optional bitcast. 3500 if (BitCastInst *BI = dyn_cast_or_null<BitCastInst>(Next)) { 3501 Check(BI->getOperand(0) == RetVal, 3502 "bitcast following musttail call must use the call", BI); 3503 RetVal = BI; 3504 Next = BI->getNextNode(); 3505 } 3506 3507 // Check the return. 3508 ReturnInst *Ret = dyn_cast_or_null<ReturnInst>(Next); 3509 Check(Ret, "musttail call must precede a ret with an optional bitcast", &CI); 3510 Check(!Ret->getReturnValue() || Ret->getReturnValue() == RetVal || 3511 isa<UndefValue>(Ret->getReturnValue()), 3512 "musttail call result must be returned", Ret); 3513 3514 AttributeList CallerAttrs = F->getAttributes(); 3515 AttributeList CalleeAttrs = CI.getAttributes(); 3516 if (CI.getCallingConv() == CallingConv::SwiftTail || 3517 CI.getCallingConv() == CallingConv::Tail) { 3518 StringRef CCName = 3519 CI.getCallingConv() == CallingConv::Tail ? "tailcc" : "swifttailcc"; 3520 3521 // - Only sret, byval, swiftself, and swiftasync ABI-impacting attributes 3522 // are allowed in swifttailcc call 3523 for (unsigned I = 0, E = CallerTy->getNumParams(); I != E; ++I) { 3524 AttrBuilder ABIAttrs = getParameterABIAttributes(F->getContext(), I, CallerAttrs); 3525 SmallString<32> Context{CCName, StringRef(" musttail caller")}; 3526 verifyTailCCMustTailAttrs(ABIAttrs, Context); 3527 } 3528 for (unsigned I = 0, E = CalleeTy->getNumParams(); I != E; ++I) { 3529 AttrBuilder ABIAttrs = getParameterABIAttributes(F->getContext(), I, CalleeAttrs); 3530 SmallString<32> Context{CCName, StringRef(" musttail callee")}; 3531 verifyTailCCMustTailAttrs(ABIAttrs, Context); 3532 } 3533 // - Varargs functions are not allowed 3534 Check(!CallerTy->isVarArg(), Twine("cannot guarantee ") + CCName + 3535 " tail call for varargs function"); 3536 return; 3537 } 3538 3539 // - The caller and callee prototypes must match. Pointer types of 3540 // parameters or return types may differ in pointee type, but not 3541 // address space. 3542 if (!CI.getCalledFunction() || !CI.getCalledFunction()->isIntrinsic()) { 3543 Check(CallerTy->getNumParams() == CalleeTy->getNumParams(), 3544 "cannot guarantee tail call due to mismatched parameter counts", &CI); 3545 for (unsigned I = 0, E = CallerTy->getNumParams(); I != E; ++I) { 3546 Check( 3547 isTypeCongruent(CallerTy->getParamType(I), CalleeTy->getParamType(I)), 3548 "cannot guarantee tail call due to mismatched parameter types", &CI); 3549 } 3550 } 3551 3552 // - All ABI-impacting function attributes, such as sret, byval, inreg, 3553 // returned, preallocated, and inalloca, must match. 3554 for (unsigned I = 0, E = CallerTy->getNumParams(); I != E; ++I) { 3555 AttrBuilder CallerABIAttrs = getParameterABIAttributes(F->getContext(), I, CallerAttrs); 3556 AttrBuilder CalleeABIAttrs = getParameterABIAttributes(F->getContext(), I, CalleeAttrs); 3557 Check(CallerABIAttrs == CalleeABIAttrs, 3558 "cannot guarantee tail call due to mismatched ABI impacting " 3559 "function attributes", 3560 &CI, CI.getOperand(I)); 3561 } 3562 } 3563 3564 void Verifier::visitCallInst(CallInst &CI) { 3565 visitCallBase(CI); 3566 3567 if (CI.isMustTailCall()) 3568 verifyMustTailCall(CI); 3569 } 3570 3571 void Verifier::visitInvokeInst(InvokeInst &II) { 3572 visitCallBase(II); 3573 3574 // Verify that the first non-PHI instruction of the unwind destination is an 3575 // exception handling instruction. 3576 Check( 3577 II.getUnwindDest()->isEHPad(), 3578 "The unwind destination does not have an exception handling instruction!", 3579 &II); 3580 3581 visitTerminator(II); 3582 } 3583 3584 /// visitUnaryOperator - Check the argument to the unary operator. 3585 /// 3586 void Verifier::visitUnaryOperator(UnaryOperator &U) { 3587 Check(U.getType() == U.getOperand(0)->getType(), 3588 "Unary operators must have same type for" 3589 "operands and result!", 3590 &U); 3591 3592 switch (U.getOpcode()) { 3593 // Check that floating-point arithmetic operators are only used with 3594 // floating-point operands. 3595 case Instruction::FNeg: 3596 Check(U.getType()->isFPOrFPVectorTy(), 3597 "FNeg operator only works with float types!", &U); 3598 break; 3599 default: 3600 llvm_unreachable("Unknown UnaryOperator opcode!"); 3601 } 3602 3603 visitInstruction(U); 3604 } 3605 3606 /// visitBinaryOperator - Check that both arguments to the binary operator are 3607 /// of the same type! 3608 /// 3609 void Verifier::visitBinaryOperator(BinaryOperator &B) { 3610 Check(B.getOperand(0)->getType() == B.getOperand(1)->getType(), 3611 "Both operands to a binary operator are not of the same type!", &B); 3612 3613 switch (B.getOpcode()) { 3614 // Check that integer arithmetic operators are only used with 3615 // integral operands. 3616 case Instruction::Add: 3617 case Instruction::Sub: 3618 case Instruction::Mul: 3619 case Instruction::SDiv: 3620 case Instruction::UDiv: 3621 case Instruction::SRem: 3622 case Instruction::URem: 3623 Check(B.getType()->isIntOrIntVectorTy(), 3624 "Integer arithmetic operators only work with integral types!", &B); 3625 Check(B.getType() == B.getOperand(0)->getType(), 3626 "Integer arithmetic operators must have same type " 3627 "for operands and result!", 3628 &B); 3629 break; 3630 // Check that floating-point arithmetic operators are only used with 3631 // floating-point operands. 3632 case Instruction::FAdd: 3633 case Instruction::FSub: 3634 case Instruction::FMul: 3635 case Instruction::FDiv: 3636 case Instruction::FRem: 3637 Check(B.getType()->isFPOrFPVectorTy(), 3638 "Floating-point arithmetic operators only work with " 3639 "floating-point types!", 3640 &B); 3641 Check(B.getType() == B.getOperand(0)->getType(), 3642 "Floating-point arithmetic operators must have same type " 3643 "for operands and result!", 3644 &B); 3645 break; 3646 // Check that logical operators are only used with integral operands. 3647 case Instruction::And: 3648 case Instruction::Or: 3649 case Instruction::Xor: 3650 Check(B.getType()->isIntOrIntVectorTy(), 3651 "Logical operators only work with integral types!", &B); 3652 Check(B.getType() == B.getOperand(0)->getType(), 3653 "Logical operators must have same type for operands and result!", &B); 3654 break; 3655 case Instruction::Shl: 3656 case Instruction::LShr: 3657 case Instruction::AShr: 3658 Check(B.getType()->isIntOrIntVectorTy(), 3659 "Shifts only work with integral types!", &B); 3660 Check(B.getType() == B.getOperand(0)->getType(), 3661 "Shift return type must be same as operands!", &B); 3662 break; 3663 default: 3664 llvm_unreachable("Unknown BinaryOperator opcode!"); 3665 } 3666 3667 visitInstruction(B); 3668 } 3669 3670 void Verifier::visitICmpInst(ICmpInst &IC) { 3671 // Check that the operands are the same type 3672 Type *Op0Ty = IC.getOperand(0)->getType(); 3673 Type *Op1Ty = IC.getOperand(1)->getType(); 3674 Check(Op0Ty == Op1Ty, 3675 "Both operands to ICmp instruction are not of the same type!", &IC); 3676 // Check that the operands are the right type 3677 Check(Op0Ty->isIntOrIntVectorTy() || Op0Ty->isPtrOrPtrVectorTy(), 3678 "Invalid operand types for ICmp instruction", &IC); 3679 // Check that the predicate is valid. 3680 Check(IC.isIntPredicate(), "Invalid predicate in ICmp instruction!", &IC); 3681 3682 visitInstruction(IC); 3683 } 3684 3685 void Verifier::visitFCmpInst(FCmpInst &FC) { 3686 // Check that the operands are the same type 3687 Type *Op0Ty = FC.getOperand(0)->getType(); 3688 Type *Op1Ty = FC.getOperand(1)->getType(); 3689 Check(Op0Ty == Op1Ty, 3690 "Both operands to FCmp instruction are not of the same type!", &FC); 3691 // Check that the operands are the right type 3692 Check(Op0Ty->isFPOrFPVectorTy(), "Invalid operand types for FCmp instruction", 3693 &FC); 3694 // Check that the predicate is valid. 3695 Check(FC.isFPPredicate(), "Invalid predicate in FCmp instruction!", &FC); 3696 3697 visitInstruction(FC); 3698 } 3699 3700 void Verifier::visitExtractElementInst(ExtractElementInst &EI) { 3701 Check(ExtractElementInst::isValidOperands(EI.getOperand(0), EI.getOperand(1)), 3702 "Invalid extractelement operands!", &EI); 3703 visitInstruction(EI); 3704 } 3705 3706 void Verifier::visitInsertElementInst(InsertElementInst &IE) { 3707 Check(InsertElementInst::isValidOperands(IE.getOperand(0), IE.getOperand(1), 3708 IE.getOperand(2)), 3709 "Invalid insertelement operands!", &IE); 3710 visitInstruction(IE); 3711 } 3712 3713 void Verifier::visitShuffleVectorInst(ShuffleVectorInst &SV) { 3714 Check(ShuffleVectorInst::isValidOperands(SV.getOperand(0), SV.getOperand(1), 3715 SV.getShuffleMask()), 3716 "Invalid shufflevector operands!", &SV); 3717 visitInstruction(SV); 3718 } 3719 3720 void Verifier::visitGetElementPtrInst(GetElementPtrInst &GEP) { 3721 Type *TargetTy = GEP.getPointerOperandType()->getScalarType(); 3722 3723 Check(isa<PointerType>(TargetTy), 3724 "GEP base pointer is not a vector or a vector of pointers", &GEP); 3725 Check(GEP.getSourceElementType()->isSized(), "GEP into unsized type!", &GEP); 3726 3727 SmallVector<Value *, 16> Idxs(GEP.indices()); 3728 Check( 3729 all_of(Idxs, [](Value *V) { return V->getType()->isIntOrIntVectorTy(); }), 3730 "GEP indexes must be integers", &GEP); 3731 Type *ElTy = 3732 GetElementPtrInst::getIndexedType(GEP.getSourceElementType(), Idxs); 3733 Check(ElTy, "Invalid indices for GEP pointer type!", &GEP); 3734 3735 Check(GEP.getType()->isPtrOrPtrVectorTy() && 3736 GEP.getResultElementType() == ElTy, 3737 "GEP is not of right type for indices!", &GEP, ElTy); 3738 3739 if (auto *GEPVTy = dyn_cast<VectorType>(GEP.getType())) { 3740 // Additional checks for vector GEPs. 3741 ElementCount GEPWidth = GEPVTy->getElementCount(); 3742 if (GEP.getPointerOperandType()->isVectorTy()) 3743 Check( 3744 GEPWidth == 3745 cast<VectorType>(GEP.getPointerOperandType())->getElementCount(), 3746 "Vector GEP result width doesn't match operand's", &GEP); 3747 for (Value *Idx : Idxs) { 3748 Type *IndexTy = Idx->getType(); 3749 if (auto *IndexVTy = dyn_cast<VectorType>(IndexTy)) { 3750 ElementCount IndexWidth = IndexVTy->getElementCount(); 3751 Check(IndexWidth == GEPWidth, "Invalid GEP index vector width", &GEP); 3752 } 3753 Check(IndexTy->isIntOrIntVectorTy(), 3754 "All GEP indices should be of integer type"); 3755 } 3756 } 3757 3758 if (auto *PTy = dyn_cast<PointerType>(GEP.getType())) { 3759 Check(GEP.getAddressSpace() == PTy->getAddressSpace(), 3760 "GEP address space doesn't match type", &GEP); 3761 } 3762 3763 visitInstruction(GEP); 3764 } 3765 3766 static bool isContiguous(const ConstantRange &A, const ConstantRange &B) { 3767 return A.getUpper() == B.getLower() || A.getLower() == B.getUpper(); 3768 } 3769 3770 void Verifier::visitRangeMetadata(Instruction &I, MDNode *Range, Type *Ty) { 3771 assert(Range && Range == I.getMetadata(LLVMContext::MD_range) && 3772 "precondition violation"); 3773 3774 unsigned NumOperands = Range->getNumOperands(); 3775 Check(NumOperands % 2 == 0, "Unfinished range!", Range); 3776 unsigned NumRanges = NumOperands / 2; 3777 Check(NumRanges >= 1, "It should have at least one range!", Range); 3778 3779 ConstantRange LastRange(1, true); // Dummy initial value 3780 for (unsigned i = 0; i < NumRanges; ++i) { 3781 ConstantInt *Low = 3782 mdconst::dyn_extract<ConstantInt>(Range->getOperand(2 * i)); 3783 Check(Low, "The lower limit must be an integer!", Low); 3784 ConstantInt *High = 3785 mdconst::dyn_extract<ConstantInt>(Range->getOperand(2 * i + 1)); 3786 Check(High, "The upper limit must be an integer!", High); 3787 Check(High->getType() == Low->getType() && High->getType() == Ty, 3788 "Range types must match instruction type!", &I); 3789 3790 APInt HighV = High->getValue(); 3791 APInt LowV = Low->getValue(); 3792 ConstantRange CurRange(LowV, HighV); 3793 Check(!CurRange.isEmptySet() && !CurRange.isFullSet(), 3794 "Range must not be empty!", Range); 3795 if (i != 0) { 3796 Check(CurRange.intersectWith(LastRange).isEmptySet(), 3797 "Intervals are overlapping", Range); 3798 Check(LowV.sgt(LastRange.getLower()), "Intervals are not in order", 3799 Range); 3800 Check(!isContiguous(CurRange, LastRange), "Intervals are contiguous", 3801 Range); 3802 } 3803 LastRange = ConstantRange(LowV, HighV); 3804 } 3805 if (NumRanges > 2) { 3806 APInt FirstLow = 3807 mdconst::dyn_extract<ConstantInt>(Range->getOperand(0))->getValue(); 3808 APInt FirstHigh = 3809 mdconst::dyn_extract<ConstantInt>(Range->getOperand(1))->getValue(); 3810 ConstantRange FirstRange(FirstLow, FirstHigh); 3811 Check(FirstRange.intersectWith(LastRange).isEmptySet(), 3812 "Intervals are overlapping", Range); 3813 Check(!isContiguous(FirstRange, LastRange), "Intervals are contiguous", 3814 Range); 3815 } 3816 } 3817 3818 void Verifier::checkAtomicMemAccessSize(Type *Ty, const Instruction *I) { 3819 unsigned Size = DL.getTypeSizeInBits(Ty); 3820 Check(Size >= 8, "atomic memory access' size must be byte-sized", Ty, I); 3821 Check(!(Size & (Size - 1)), 3822 "atomic memory access' operand must have a power-of-two size", Ty, I); 3823 } 3824 3825 void Verifier::visitLoadInst(LoadInst &LI) { 3826 PointerType *PTy = dyn_cast<PointerType>(LI.getOperand(0)->getType()); 3827 Check(PTy, "Load operand must be a pointer.", &LI); 3828 Type *ElTy = LI.getType(); 3829 if (MaybeAlign A = LI.getAlign()) { 3830 Check(A->value() <= Value::MaximumAlignment, 3831 "huge alignment values are unsupported", &LI); 3832 } 3833 Check(ElTy->isSized(), "loading unsized types is not allowed", &LI); 3834 if (LI.isAtomic()) { 3835 Check(LI.getOrdering() != AtomicOrdering::Release && 3836 LI.getOrdering() != AtomicOrdering::AcquireRelease, 3837 "Load cannot have Release ordering", &LI); 3838 Check(ElTy->isIntOrPtrTy() || ElTy->isFloatingPointTy(), 3839 "atomic load operand must have integer, pointer, or floating point " 3840 "type!", 3841 ElTy, &LI); 3842 checkAtomicMemAccessSize(ElTy, &LI); 3843 } else { 3844 Check(LI.getSyncScopeID() == SyncScope::System, 3845 "Non-atomic load cannot have SynchronizationScope specified", &LI); 3846 } 3847 3848 visitInstruction(LI); 3849 } 3850 3851 void Verifier::visitStoreInst(StoreInst &SI) { 3852 PointerType *PTy = dyn_cast<PointerType>(SI.getOperand(1)->getType()); 3853 Check(PTy, "Store operand must be a pointer.", &SI); 3854 Type *ElTy = SI.getOperand(0)->getType(); 3855 Check(PTy->isOpaqueOrPointeeTypeMatches(ElTy), 3856 "Stored value type does not match pointer operand type!", &SI, ElTy); 3857 if (MaybeAlign A = SI.getAlign()) { 3858 Check(A->value() <= Value::MaximumAlignment, 3859 "huge alignment values are unsupported", &SI); 3860 } 3861 Check(ElTy->isSized(), "storing unsized types is not allowed", &SI); 3862 if (SI.isAtomic()) { 3863 Check(SI.getOrdering() != AtomicOrdering::Acquire && 3864 SI.getOrdering() != AtomicOrdering::AcquireRelease, 3865 "Store cannot have Acquire ordering", &SI); 3866 Check(ElTy->isIntOrPtrTy() || ElTy->isFloatingPointTy(), 3867 "atomic store operand must have integer, pointer, or floating point " 3868 "type!", 3869 ElTy, &SI); 3870 checkAtomicMemAccessSize(ElTy, &SI); 3871 } else { 3872 Check(SI.getSyncScopeID() == SyncScope::System, 3873 "Non-atomic store cannot have SynchronizationScope specified", &SI); 3874 } 3875 visitInstruction(SI); 3876 } 3877 3878 /// Check that SwiftErrorVal is used as a swifterror argument in CS. 3879 void Verifier::verifySwiftErrorCall(CallBase &Call, 3880 const Value *SwiftErrorVal) { 3881 for (const auto &I : llvm::enumerate(Call.args())) { 3882 if (I.value() == SwiftErrorVal) { 3883 Check(Call.paramHasAttr(I.index(), Attribute::SwiftError), 3884 "swifterror value when used in a callsite should be marked " 3885 "with swifterror attribute", 3886 SwiftErrorVal, Call); 3887 } 3888 } 3889 } 3890 3891 void Verifier::verifySwiftErrorValue(const Value *SwiftErrorVal) { 3892 // Check that swifterror value is only used by loads, stores, or as 3893 // a swifterror argument. 3894 for (const User *U : SwiftErrorVal->users()) { 3895 Check(isa<LoadInst>(U) || isa<StoreInst>(U) || isa<CallInst>(U) || 3896 isa<InvokeInst>(U), 3897 "swifterror value can only be loaded and stored from, or " 3898 "as a swifterror argument!", 3899 SwiftErrorVal, U); 3900 // If it is used by a store, check it is the second operand. 3901 if (auto StoreI = dyn_cast<StoreInst>(U)) 3902 Check(StoreI->getOperand(1) == SwiftErrorVal, 3903 "swifterror value should be the second operand when used " 3904 "by stores", 3905 SwiftErrorVal, U); 3906 if (auto *Call = dyn_cast<CallBase>(U)) 3907 verifySwiftErrorCall(*const_cast<CallBase *>(Call), SwiftErrorVal); 3908 } 3909 } 3910 3911 void Verifier::visitAllocaInst(AllocaInst &AI) { 3912 SmallPtrSet<Type*, 4> Visited; 3913 Check(AI.getAllocatedType()->isSized(&Visited), 3914 "Cannot allocate unsized type", &AI); 3915 Check(AI.getArraySize()->getType()->isIntegerTy(), 3916 "Alloca array size must have integer type", &AI); 3917 if (MaybeAlign A = AI.getAlign()) { 3918 Check(A->value() <= Value::MaximumAlignment, 3919 "huge alignment values are unsupported", &AI); 3920 } 3921 3922 if (AI.isSwiftError()) { 3923 Check(AI.getAllocatedType()->isPointerTy(), 3924 "swifterror alloca must have pointer type", &AI); 3925 Check(!AI.isArrayAllocation(), 3926 "swifterror alloca must not be array allocation", &AI); 3927 verifySwiftErrorValue(&AI); 3928 } 3929 3930 visitInstruction(AI); 3931 } 3932 3933 void Verifier::visitAtomicCmpXchgInst(AtomicCmpXchgInst &CXI) { 3934 Type *ElTy = CXI.getOperand(1)->getType(); 3935 Check(ElTy->isIntOrPtrTy(), 3936 "cmpxchg operand must have integer or pointer type", ElTy, &CXI); 3937 checkAtomicMemAccessSize(ElTy, &CXI); 3938 visitInstruction(CXI); 3939 } 3940 3941 void Verifier::visitAtomicRMWInst(AtomicRMWInst &RMWI) { 3942 Check(RMWI.getOrdering() != AtomicOrdering::Unordered, 3943 "atomicrmw instructions cannot be unordered.", &RMWI); 3944 auto Op = RMWI.getOperation(); 3945 Type *ElTy = RMWI.getOperand(1)->getType(); 3946 if (Op == AtomicRMWInst::Xchg) { 3947 Check(ElTy->isIntegerTy() || ElTy->isFloatingPointTy() || 3948 ElTy->isPointerTy(), 3949 "atomicrmw " + AtomicRMWInst::getOperationName(Op) + 3950 " operand must have integer or floating point type!", 3951 &RMWI, ElTy); 3952 } else if (AtomicRMWInst::isFPOperation(Op)) { 3953 Check(ElTy->isFloatingPointTy(), 3954 "atomicrmw " + AtomicRMWInst::getOperationName(Op) + 3955 " operand must have floating point type!", 3956 &RMWI, ElTy); 3957 } else { 3958 Check(ElTy->isIntegerTy(), 3959 "atomicrmw " + AtomicRMWInst::getOperationName(Op) + 3960 " operand must have integer type!", 3961 &RMWI, ElTy); 3962 } 3963 checkAtomicMemAccessSize(ElTy, &RMWI); 3964 Check(AtomicRMWInst::FIRST_BINOP <= Op && Op <= AtomicRMWInst::LAST_BINOP, 3965 "Invalid binary operation!", &RMWI); 3966 visitInstruction(RMWI); 3967 } 3968 3969 void Verifier::visitFenceInst(FenceInst &FI) { 3970 const AtomicOrdering Ordering = FI.getOrdering(); 3971 Check(Ordering == AtomicOrdering::Acquire || 3972 Ordering == AtomicOrdering::Release || 3973 Ordering == AtomicOrdering::AcquireRelease || 3974 Ordering == AtomicOrdering::SequentiallyConsistent, 3975 "fence instructions may only have acquire, release, acq_rel, or " 3976 "seq_cst ordering.", 3977 &FI); 3978 visitInstruction(FI); 3979 } 3980 3981 void Verifier::visitExtractValueInst(ExtractValueInst &EVI) { 3982 Check(ExtractValueInst::getIndexedType(EVI.getAggregateOperand()->getType(), 3983 EVI.getIndices()) == EVI.getType(), 3984 "Invalid ExtractValueInst operands!", &EVI); 3985 3986 visitInstruction(EVI); 3987 } 3988 3989 void Verifier::visitInsertValueInst(InsertValueInst &IVI) { 3990 Check(ExtractValueInst::getIndexedType(IVI.getAggregateOperand()->getType(), 3991 IVI.getIndices()) == 3992 IVI.getOperand(1)->getType(), 3993 "Invalid InsertValueInst operands!", &IVI); 3994 3995 visitInstruction(IVI); 3996 } 3997 3998 static Value *getParentPad(Value *EHPad) { 3999 if (auto *FPI = dyn_cast<FuncletPadInst>(EHPad)) 4000 return FPI->getParentPad(); 4001 4002 return cast<CatchSwitchInst>(EHPad)->getParentPad(); 4003 } 4004 4005 void Verifier::visitEHPadPredecessors(Instruction &I) { 4006 assert(I.isEHPad()); 4007 4008 BasicBlock *BB = I.getParent(); 4009 Function *F = BB->getParent(); 4010 4011 Check(BB != &F->getEntryBlock(), "EH pad cannot be in entry block.", &I); 4012 4013 if (auto *LPI = dyn_cast<LandingPadInst>(&I)) { 4014 // The landingpad instruction defines its parent as a landing pad block. The 4015 // landing pad block may be branched to only by the unwind edge of an 4016 // invoke. 4017 for (BasicBlock *PredBB : predecessors(BB)) { 4018 const auto *II = dyn_cast<InvokeInst>(PredBB->getTerminator()); 4019 Check(II && II->getUnwindDest() == BB && II->getNormalDest() != BB, 4020 "Block containing LandingPadInst must be jumped to " 4021 "only by the unwind edge of an invoke.", 4022 LPI); 4023 } 4024 return; 4025 } 4026 if (auto *CPI = dyn_cast<CatchPadInst>(&I)) { 4027 if (!pred_empty(BB)) 4028 Check(BB->getUniquePredecessor() == CPI->getCatchSwitch()->getParent(), 4029 "Block containg CatchPadInst must be jumped to " 4030 "only by its catchswitch.", 4031 CPI); 4032 Check(BB != CPI->getCatchSwitch()->getUnwindDest(), 4033 "Catchswitch cannot unwind to one of its catchpads", 4034 CPI->getCatchSwitch(), CPI); 4035 return; 4036 } 4037 4038 // Verify that each pred has a legal terminator with a legal to/from EH 4039 // pad relationship. 4040 Instruction *ToPad = &I; 4041 Value *ToPadParent = getParentPad(ToPad); 4042 for (BasicBlock *PredBB : predecessors(BB)) { 4043 Instruction *TI = PredBB->getTerminator(); 4044 Value *FromPad; 4045 if (auto *II = dyn_cast<InvokeInst>(TI)) { 4046 Check(II->getUnwindDest() == BB && II->getNormalDest() != BB, 4047 "EH pad must be jumped to via an unwind edge", ToPad, II); 4048 if (auto Bundle = II->getOperandBundle(LLVMContext::OB_funclet)) 4049 FromPad = Bundle->Inputs[0]; 4050 else 4051 FromPad = ConstantTokenNone::get(II->getContext()); 4052 } else if (auto *CRI = dyn_cast<CleanupReturnInst>(TI)) { 4053 FromPad = CRI->getOperand(0); 4054 Check(FromPad != ToPadParent, "A cleanupret must exit its cleanup", CRI); 4055 } else if (auto *CSI = dyn_cast<CatchSwitchInst>(TI)) { 4056 FromPad = CSI; 4057 } else { 4058 Check(false, "EH pad must be jumped to via an unwind edge", ToPad, TI); 4059 } 4060 4061 // The edge may exit from zero or more nested pads. 4062 SmallSet<Value *, 8> Seen; 4063 for (;; FromPad = getParentPad(FromPad)) { 4064 Check(FromPad != ToPad, 4065 "EH pad cannot handle exceptions raised within it", FromPad, TI); 4066 if (FromPad == ToPadParent) { 4067 // This is a legal unwind edge. 4068 break; 4069 } 4070 Check(!isa<ConstantTokenNone>(FromPad), 4071 "A single unwind edge may only enter one EH pad", TI); 4072 Check(Seen.insert(FromPad).second, "EH pad jumps through a cycle of pads", 4073 FromPad); 4074 4075 // This will be diagnosed on the corresponding instruction already. We 4076 // need the extra check here to make sure getParentPad() works. 4077 Check(isa<FuncletPadInst>(FromPad) || isa<CatchSwitchInst>(FromPad), 4078 "Parent pad must be catchpad/cleanuppad/catchswitch", TI); 4079 } 4080 } 4081 } 4082 4083 void Verifier::visitLandingPadInst(LandingPadInst &LPI) { 4084 // The landingpad instruction is ill-formed if it doesn't have any clauses and 4085 // isn't a cleanup. 4086 Check(LPI.getNumClauses() > 0 || LPI.isCleanup(), 4087 "LandingPadInst needs at least one clause or to be a cleanup.", &LPI); 4088 4089 visitEHPadPredecessors(LPI); 4090 4091 if (!LandingPadResultTy) 4092 LandingPadResultTy = LPI.getType(); 4093 else 4094 Check(LandingPadResultTy == LPI.getType(), 4095 "The landingpad instruction should have a consistent result type " 4096 "inside a function.", 4097 &LPI); 4098 4099 Function *F = LPI.getParent()->getParent(); 4100 Check(F->hasPersonalityFn(), 4101 "LandingPadInst needs to be in a function with a personality.", &LPI); 4102 4103 // The landingpad instruction must be the first non-PHI instruction in the 4104 // block. 4105 Check(LPI.getParent()->getLandingPadInst() == &LPI, 4106 "LandingPadInst not the first non-PHI instruction in the block.", &LPI); 4107 4108 for (unsigned i = 0, e = LPI.getNumClauses(); i < e; ++i) { 4109 Constant *Clause = LPI.getClause(i); 4110 if (LPI.isCatch(i)) { 4111 Check(isa<PointerType>(Clause->getType()), 4112 "Catch operand does not have pointer type!", &LPI); 4113 } else { 4114 Check(LPI.isFilter(i), "Clause is neither catch nor filter!", &LPI); 4115 Check(isa<ConstantArray>(Clause) || isa<ConstantAggregateZero>(Clause), 4116 "Filter operand is not an array of constants!", &LPI); 4117 } 4118 } 4119 4120 visitInstruction(LPI); 4121 } 4122 4123 void Verifier::visitResumeInst(ResumeInst &RI) { 4124 Check(RI.getFunction()->hasPersonalityFn(), 4125 "ResumeInst needs to be in a function with a personality.", &RI); 4126 4127 if (!LandingPadResultTy) 4128 LandingPadResultTy = RI.getValue()->getType(); 4129 else 4130 Check(LandingPadResultTy == RI.getValue()->getType(), 4131 "The resume instruction should have a consistent result type " 4132 "inside a function.", 4133 &RI); 4134 4135 visitTerminator(RI); 4136 } 4137 4138 void Verifier::visitCatchPadInst(CatchPadInst &CPI) { 4139 BasicBlock *BB = CPI.getParent(); 4140 4141 Function *F = BB->getParent(); 4142 Check(F->hasPersonalityFn(), 4143 "CatchPadInst needs to be in a function with a personality.", &CPI); 4144 4145 Check(isa<CatchSwitchInst>(CPI.getParentPad()), 4146 "CatchPadInst needs to be directly nested in a CatchSwitchInst.", 4147 CPI.getParentPad()); 4148 4149 // The catchpad instruction must be the first non-PHI instruction in the 4150 // block. 4151 Check(BB->getFirstNonPHI() == &CPI, 4152 "CatchPadInst not the first non-PHI instruction in the block.", &CPI); 4153 4154 visitEHPadPredecessors(CPI); 4155 visitFuncletPadInst(CPI); 4156 } 4157 4158 void Verifier::visitCatchReturnInst(CatchReturnInst &CatchReturn) { 4159 Check(isa<CatchPadInst>(CatchReturn.getOperand(0)), 4160 "CatchReturnInst needs to be provided a CatchPad", &CatchReturn, 4161 CatchReturn.getOperand(0)); 4162 4163 visitTerminator(CatchReturn); 4164 } 4165 4166 void Verifier::visitCleanupPadInst(CleanupPadInst &CPI) { 4167 BasicBlock *BB = CPI.getParent(); 4168 4169 Function *F = BB->getParent(); 4170 Check(F->hasPersonalityFn(), 4171 "CleanupPadInst needs to be in a function with a personality.", &CPI); 4172 4173 // The cleanuppad instruction must be the first non-PHI instruction in the 4174 // block. 4175 Check(BB->getFirstNonPHI() == &CPI, 4176 "CleanupPadInst not the first non-PHI instruction in the block.", &CPI); 4177 4178 auto *ParentPad = CPI.getParentPad(); 4179 Check(isa<ConstantTokenNone>(ParentPad) || isa<FuncletPadInst>(ParentPad), 4180 "CleanupPadInst has an invalid parent.", &CPI); 4181 4182 visitEHPadPredecessors(CPI); 4183 visitFuncletPadInst(CPI); 4184 } 4185 4186 void Verifier::visitFuncletPadInst(FuncletPadInst &FPI) { 4187 User *FirstUser = nullptr; 4188 Value *FirstUnwindPad = nullptr; 4189 SmallVector<FuncletPadInst *, 8> Worklist({&FPI}); 4190 SmallSet<FuncletPadInst *, 8> Seen; 4191 4192 while (!Worklist.empty()) { 4193 FuncletPadInst *CurrentPad = Worklist.pop_back_val(); 4194 Check(Seen.insert(CurrentPad).second, 4195 "FuncletPadInst must not be nested within itself", CurrentPad); 4196 Value *UnresolvedAncestorPad = nullptr; 4197 for (User *U : CurrentPad->users()) { 4198 BasicBlock *UnwindDest; 4199 if (auto *CRI = dyn_cast<CleanupReturnInst>(U)) { 4200 UnwindDest = CRI->getUnwindDest(); 4201 } else if (auto *CSI = dyn_cast<CatchSwitchInst>(U)) { 4202 // We allow catchswitch unwind to caller to nest 4203 // within an outer pad that unwinds somewhere else, 4204 // because catchswitch doesn't have a nounwind variant. 4205 // See e.g. SimplifyCFGOpt::SimplifyUnreachable. 4206 if (CSI->unwindsToCaller()) 4207 continue; 4208 UnwindDest = CSI->getUnwindDest(); 4209 } else if (auto *II = dyn_cast<InvokeInst>(U)) { 4210 UnwindDest = II->getUnwindDest(); 4211 } else if (isa<CallInst>(U)) { 4212 // Calls which don't unwind may be found inside funclet 4213 // pads that unwind somewhere else. We don't *require* 4214 // such calls to be annotated nounwind. 4215 continue; 4216 } else if (auto *CPI = dyn_cast<CleanupPadInst>(U)) { 4217 // The unwind dest for a cleanup can only be found by 4218 // recursive search. Add it to the worklist, and we'll 4219 // search for its first use that determines where it unwinds. 4220 Worklist.push_back(CPI); 4221 continue; 4222 } else { 4223 Check(isa<CatchReturnInst>(U), "Bogus funclet pad use", U); 4224 continue; 4225 } 4226 4227 Value *UnwindPad; 4228 bool ExitsFPI; 4229 if (UnwindDest) { 4230 UnwindPad = UnwindDest->getFirstNonPHI(); 4231 if (!cast<Instruction>(UnwindPad)->isEHPad()) 4232 continue; 4233 Value *UnwindParent = getParentPad(UnwindPad); 4234 // Ignore unwind edges that don't exit CurrentPad. 4235 if (UnwindParent == CurrentPad) 4236 continue; 4237 // Determine whether the original funclet pad is exited, 4238 // and if we are scanning nested pads determine how many 4239 // of them are exited so we can stop searching their 4240 // children. 4241 Value *ExitedPad = CurrentPad; 4242 ExitsFPI = false; 4243 do { 4244 if (ExitedPad == &FPI) { 4245 ExitsFPI = true; 4246 // Now we can resolve any ancestors of CurrentPad up to 4247 // FPI, but not including FPI since we need to make sure 4248 // to check all direct users of FPI for consistency. 4249 UnresolvedAncestorPad = &FPI; 4250 break; 4251 } 4252 Value *ExitedParent = getParentPad(ExitedPad); 4253 if (ExitedParent == UnwindParent) { 4254 // ExitedPad is the ancestor-most pad which this unwind 4255 // edge exits, so we can resolve up to it, meaning that 4256 // ExitedParent is the first ancestor still unresolved. 4257 UnresolvedAncestorPad = ExitedParent; 4258 break; 4259 } 4260 ExitedPad = ExitedParent; 4261 } while (!isa<ConstantTokenNone>(ExitedPad)); 4262 } else { 4263 // Unwinding to caller exits all pads. 4264 UnwindPad = ConstantTokenNone::get(FPI.getContext()); 4265 ExitsFPI = true; 4266 UnresolvedAncestorPad = &FPI; 4267 } 4268 4269 if (ExitsFPI) { 4270 // This unwind edge exits FPI. Make sure it agrees with other 4271 // such edges. 4272 if (FirstUser) { 4273 Check(UnwindPad == FirstUnwindPad, 4274 "Unwind edges out of a funclet " 4275 "pad must have the same unwind " 4276 "dest", 4277 &FPI, U, FirstUser); 4278 } else { 4279 FirstUser = U; 4280 FirstUnwindPad = UnwindPad; 4281 // Record cleanup sibling unwinds for verifySiblingFuncletUnwinds 4282 if (isa<CleanupPadInst>(&FPI) && !isa<ConstantTokenNone>(UnwindPad) && 4283 getParentPad(UnwindPad) == getParentPad(&FPI)) 4284 SiblingFuncletInfo[&FPI] = cast<Instruction>(U); 4285 } 4286 } 4287 // Make sure we visit all uses of FPI, but for nested pads stop as 4288 // soon as we know where they unwind to. 4289 if (CurrentPad != &FPI) 4290 break; 4291 } 4292 if (UnresolvedAncestorPad) { 4293 if (CurrentPad == UnresolvedAncestorPad) { 4294 // When CurrentPad is FPI itself, we don't mark it as resolved even if 4295 // we've found an unwind edge that exits it, because we need to verify 4296 // all direct uses of FPI. 4297 assert(CurrentPad == &FPI); 4298 continue; 4299 } 4300 // Pop off the worklist any nested pads that we've found an unwind 4301 // destination for. The pads on the worklist are the uncles, 4302 // great-uncles, etc. of CurrentPad. We've found an unwind destination 4303 // for all ancestors of CurrentPad up to but not including 4304 // UnresolvedAncestorPad. 4305 Value *ResolvedPad = CurrentPad; 4306 while (!Worklist.empty()) { 4307 Value *UnclePad = Worklist.back(); 4308 Value *AncestorPad = getParentPad(UnclePad); 4309 // Walk ResolvedPad up the ancestor list until we either find the 4310 // uncle's parent or the last resolved ancestor. 4311 while (ResolvedPad != AncestorPad) { 4312 Value *ResolvedParent = getParentPad(ResolvedPad); 4313 if (ResolvedParent == UnresolvedAncestorPad) { 4314 break; 4315 } 4316 ResolvedPad = ResolvedParent; 4317 } 4318 // If the resolved ancestor search didn't find the uncle's parent, 4319 // then the uncle is not yet resolved. 4320 if (ResolvedPad != AncestorPad) 4321 break; 4322 // This uncle is resolved, so pop it from the worklist. 4323 Worklist.pop_back(); 4324 } 4325 } 4326 } 4327 4328 if (FirstUnwindPad) { 4329 if (auto *CatchSwitch = dyn_cast<CatchSwitchInst>(FPI.getParentPad())) { 4330 BasicBlock *SwitchUnwindDest = CatchSwitch->getUnwindDest(); 4331 Value *SwitchUnwindPad; 4332 if (SwitchUnwindDest) 4333 SwitchUnwindPad = SwitchUnwindDest->getFirstNonPHI(); 4334 else 4335 SwitchUnwindPad = ConstantTokenNone::get(FPI.getContext()); 4336 Check(SwitchUnwindPad == FirstUnwindPad, 4337 "Unwind edges out of a catch must have the same unwind dest as " 4338 "the parent catchswitch", 4339 &FPI, FirstUser, CatchSwitch); 4340 } 4341 } 4342 4343 visitInstruction(FPI); 4344 } 4345 4346 void Verifier::visitCatchSwitchInst(CatchSwitchInst &CatchSwitch) { 4347 BasicBlock *BB = CatchSwitch.getParent(); 4348 4349 Function *F = BB->getParent(); 4350 Check(F->hasPersonalityFn(), 4351 "CatchSwitchInst needs to be in a function with a personality.", 4352 &CatchSwitch); 4353 4354 // The catchswitch instruction must be the first non-PHI instruction in the 4355 // block. 4356 Check(BB->getFirstNonPHI() == &CatchSwitch, 4357 "CatchSwitchInst not the first non-PHI instruction in the block.", 4358 &CatchSwitch); 4359 4360 auto *ParentPad = CatchSwitch.getParentPad(); 4361 Check(isa<ConstantTokenNone>(ParentPad) || isa<FuncletPadInst>(ParentPad), 4362 "CatchSwitchInst has an invalid parent.", ParentPad); 4363 4364 if (BasicBlock *UnwindDest = CatchSwitch.getUnwindDest()) { 4365 Instruction *I = UnwindDest->getFirstNonPHI(); 4366 Check(I->isEHPad() && !isa<LandingPadInst>(I), 4367 "CatchSwitchInst must unwind to an EH block which is not a " 4368 "landingpad.", 4369 &CatchSwitch); 4370 4371 // Record catchswitch sibling unwinds for verifySiblingFuncletUnwinds 4372 if (getParentPad(I) == ParentPad) 4373 SiblingFuncletInfo[&CatchSwitch] = &CatchSwitch; 4374 } 4375 4376 Check(CatchSwitch.getNumHandlers() != 0, 4377 "CatchSwitchInst cannot have empty handler list", &CatchSwitch); 4378 4379 for (BasicBlock *Handler : CatchSwitch.handlers()) { 4380 Check(isa<CatchPadInst>(Handler->getFirstNonPHI()), 4381 "CatchSwitchInst handlers must be catchpads", &CatchSwitch, Handler); 4382 } 4383 4384 visitEHPadPredecessors(CatchSwitch); 4385 visitTerminator(CatchSwitch); 4386 } 4387 4388 void Verifier::visitCleanupReturnInst(CleanupReturnInst &CRI) { 4389 Check(isa<CleanupPadInst>(CRI.getOperand(0)), 4390 "CleanupReturnInst needs to be provided a CleanupPad", &CRI, 4391 CRI.getOperand(0)); 4392 4393 if (BasicBlock *UnwindDest = CRI.getUnwindDest()) { 4394 Instruction *I = UnwindDest->getFirstNonPHI(); 4395 Check(I->isEHPad() && !isa<LandingPadInst>(I), 4396 "CleanupReturnInst must unwind to an EH block which is not a " 4397 "landingpad.", 4398 &CRI); 4399 } 4400 4401 visitTerminator(CRI); 4402 } 4403 4404 void Verifier::verifyDominatesUse(Instruction &I, unsigned i) { 4405 Instruction *Op = cast<Instruction>(I.getOperand(i)); 4406 // If the we have an invalid invoke, don't try to compute the dominance. 4407 // We already reject it in the invoke specific checks and the dominance 4408 // computation doesn't handle multiple edges. 4409 if (InvokeInst *II = dyn_cast<InvokeInst>(Op)) { 4410 if (II->getNormalDest() == II->getUnwindDest()) 4411 return; 4412 } 4413 4414 // Quick check whether the def has already been encountered in the same block. 4415 // PHI nodes are not checked to prevent accepting preceding PHIs, because PHI 4416 // uses are defined to happen on the incoming edge, not at the instruction. 4417 // 4418 // FIXME: If this operand is a MetadataAsValue (wrapping a LocalAsMetadata) 4419 // wrapping an SSA value, assert that we've already encountered it. See 4420 // related FIXME in Mapper::mapLocalAsMetadata in ValueMapper.cpp. 4421 if (!isa<PHINode>(I) && InstsInThisBlock.count(Op)) 4422 return; 4423 4424 const Use &U = I.getOperandUse(i); 4425 Check(DT.dominates(Op, U), "Instruction does not dominate all uses!", Op, &I); 4426 } 4427 4428 void Verifier::visitDereferenceableMetadata(Instruction& I, MDNode* MD) { 4429 Check(I.getType()->isPointerTy(), 4430 "dereferenceable, dereferenceable_or_null " 4431 "apply only to pointer types", 4432 &I); 4433 Check((isa<LoadInst>(I) || isa<IntToPtrInst>(I)), 4434 "dereferenceable, dereferenceable_or_null apply only to load" 4435 " and inttoptr instructions, use attributes for calls or invokes", 4436 &I); 4437 Check(MD->getNumOperands() == 1, 4438 "dereferenceable, dereferenceable_or_null " 4439 "take one operand!", 4440 &I); 4441 ConstantInt *CI = mdconst::dyn_extract<ConstantInt>(MD->getOperand(0)); 4442 Check(CI && CI->getType()->isIntegerTy(64), 4443 "dereferenceable, " 4444 "dereferenceable_or_null metadata value must be an i64!", 4445 &I); 4446 } 4447 4448 void Verifier::visitProfMetadata(Instruction &I, MDNode *MD) { 4449 Check(MD->getNumOperands() >= 2, 4450 "!prof annotations should have no less than 2 operands", MD); 4451 4452 // Check first operand. 4453 Check(MD->getOperand(0) != nullptr, "first operand should not be null", MD); 4454 Check(isa<MDString>(MD->getOperand(0)), 4455 "expected string with name of the !prof annotation", MD); 4456 MDString *MDS = cast<MDString>(MD->getOperand(0)); 4457 StringRef ProfName = MDS->getString(); 4458 4459 // Check consistency of !prof branch_weights metadata. 4460 if (ProfName.equals("branch_weights")) { 4461 if (isa<InvokeInst>(&I)) { 4462 Check(MD->getNumOperands() == 2 || MD->getNumOperands() == 3, 4463 "Wrong number of InvokeInst branch_weights operands", MD); 4464 } else { 4465 unsigned ExpectedNumOperands = 0; 4466 if (BranchInst *BI = dyn_cast<BranchInst>(&I)) 4467 ExpectedNumOperands = BI->getNumSuccessors(); 4468 else if (SwitchInst *SI = dyn_cast<SwitchInst>(&I)) 4469 ExpectedNumOperands = SI->getNumSuccessors(); 4470 else if (isa<CallInst>(&I)) 4471 ExpectedNumOperands = 1; 4472 else if (IndirectBrInst *IBI = dyn_cast<IndirectBrInst>(&I)) 4473 ExpectedNumOperands = IBI->getNumDestinations(); 4474 else if (isa<SelectInst>(&I)) 4475 ExpectedNumOperands = 2; 4476 else 4477 CheckFailed("!prof branch_weights are not allowed for this instruction", 4478 MD); 4479 4480 Check(MD->getNumOperands() == 1 + ExpectedNumOperands, 4481 "Wrong number of operands", MD); 4482 } 4483 for (unsigned i = 1; i < MD->getNumOperands(); ++i) { 4484 auto &MDO = MD->getOperand(i); 4485 Check(MDO, "second operand should not be null", MD); 4486 Check(mdconst::dyn_extract<ConstantInt>(MDO), 4487 "!prof brunch_weights operand is not a const int"); 4488 } 4489 } 4490 } 4491 4492 void Verifier::visitAnnotationMetadata(MDNode *Annotation) { 4493 Check(isa<MDTuple>(Annotation), "annotation must be a tuple"); 4494 Check(Annotation->getNumOperands() >= 1, 4495 "annotation must have at least one operand"); 4496 for (const MDOperand &Op : Annotation->operands()) 4497 Check(isa<MDString>(Op.get()), "operands must be strings"); 4498 } 4499 4500 void Verifier::visitAliasScopeMetadata(const MDNode *MD) { 4501 unsigned NumOps = MD->getNumOperands(); 4502 Check(NumOps >= 2 && NumOps <= 3, "scope must have two or three operands", 4503 MD); 4504 Check(MD->getOperand(0).get() == MD || isa<MDString>(MD->getOperand(0)), 4505 "first scope operand must be self-referential or string", MD); 4506 if (NumOps == 3) 4507 Check(isa<MDString>(MD->getOperand(2)), 4508 "third scope operand must be string (if used)", MD); 4509 4510 MDNode *Domain = dyn_cast<MDNode>(MD->getOperand(1)); 4511 Check(Domain != nullptr, "second scope operand must be MDNode", MD); 4512 4513 unsigned NumDomainOps = Domain->getNumOperands(); 4514 Check(NumDomainOps >= 1 && NumDomainOps <= 2, 4515 "domain must have one or two operands", Domain); 4516 Check(Domain->getOperand(0).get() == Domain || 4517 isa<MDString>(Domain->getOperand(0)), 4518 "first domain operand must be self-referential or string", Domain); 4519 if (NumDomainOps == 2) 4520 Check(isa<MDString>(Domain->getOperand(1)), 4521 "second domain operand must be string (if used)", Domain); 4522 } 4523 4524 void Verifier::visitAliasScopeListMetadata(const MDNode *MD) { 4525 for (const MDOperand &Op : MD->operands()) { 4526 const MDNode *OpMD = dyn_cast<MDNode>(Op); 4527 Check(OpMD != nullptr, "scope list must consist of MDNodes", MD); 4528 visitAliasScopeMetadata(OpMD); 4529 } 4530 } 4531 4532 void Verifier::visitAccessGroupMetadata(const MDNode *MD) { 4533 auto IsValidAccessScope = [](const MDNode *MD) { 4534 return MD->getNumOperands() == 0 && MD->isDistinct(); 4535 }; 4536 4537 // It must be either an access scope itself... 4538 if (IsValidAccessScope(MD)) 4539 return; 4540 4541 // ...or a list of access scopes. 4542 for (const MDOperand &Op : MD->operands()) { 4543 const MDNode *OpMD = dyn_cast<MDNode>(Op); 4544 Check(OpMD != nullptr, "Access scope list must consist of MDNodes", MD); 4545 Check(IsValidAccessScope(OpMD), 4546 "Access scope list contains invalid access scope", MD); 4547 } 4548 } 4549 4550 /// verifyInstruction - Verify that an instruction is well formed. 4551 /// 4552 void Verifier::visitInstruction(Instruction &I) { 4553 BasicBlock *BB = I.getParent(); 4554 Check(BB, "Instruction not embedded in basic block!", &I); 4555 4556 if (!isa<PHINode>(I)) { // Check that non-phi nodes are not self referential 4557 for (User *U : I.users()) { 4558 Check(U != (User *)&I || !DT.isReachableFromEntry(BB), 4559 "Only PHI nodes may reference their own value!", &I); 4560 } 4561 } 4562 4563 // Check that void typed values don't have names 4564 Check(!I.getType()->isVoidTy() || !I.hasName(), 4565 "Instruction has a name, but provides a void value!", &I); 4566 4567 // Check that the return value of the instruction is either void or a legal 4568 // value type. 4569 Check(I.getType()->isVoidTy() || I.getType()->isFirstClassType(), 4570 "Instruction returns a non-scalar type!", &I); 4571 4572 // Check that the instruction doesn't produce metadata. Calls are already 4573 // checked against the callee type. 4574 Check(!I.getType()->isMetadataTy() || isa<CallInst>(I) || isa<InvokeInst>(I), 4575 "Invalid use of metadata!", &I); 4576 4577 // Check that all uses of the instruction, if they are instructions 4578 // themselves, actually have parent basic blocks. If the use is not an 4579 // instruction, it is an error! 4580 for (Use &U : I.uses()) { 4581 if (Instruction *Used = dyn_cast<Instruction>(U.getUser())) 4582 Check(Used->getParent() != nullptr, 4583 "Instruction referencing" 4584 " instruction not embedded in a basic block!", 4585 &I, Used); 4586 else { 4587 CheckFailed("Use of instruction is not an instruction!", U); 4588 return; 4589 } 4590 } 4591 4592 // Get a pointer to the call base of the instruction if it is some form of 4593 // call. 4594 const CallBase *CBI = dyn_cast<CallBase>(&I); 4595 4596 for (unsigned i = 0, e = I.getNumOperands(); i != e; ++i) { 4597 Check(I.getOperand(i) != nullptr, "Instruction has null operand!", &I); 4598 4599 // Check to make sure that only first-class-values are operands to 4600 // instructions. 4601 if (!I.getOperand(i)->getType()->isFirstClassType()) { 4602 Check(false, "Instruction operands must be first-class values!", &I); 4603 } 4604 4605 if (Function *F = dyn_cast<Function>(I.getOperand(i))) { 4606 // This code checks whether the function is used as the operand of a 4607 // clang_arc_attachedcall operand bundle. 4608 auto IsAttachedCallOperand = [](Function *F, const CallBase *CBI, 4609 int Idx) { 4610 return CBI && CBI->isOperandBundleOfType( 4611 LLVMContext::OB_clang_arc_attachedcall, Idx); 4612 }; 4613 4614 // Check to make sure that the "address of" an intrinsic function is never 4615 // taken. Ignore cases where the address of the intrinsic function is used 4616 // as the argument of operand bundle "clang.arc.attachedcall" as those 4617 // cases are handled in verifyAttachedCallBundle. 4618 Check((!F->isIntrinsic() || 4619 (CBI && &CBI->getCalledOperandUse() == &I.getOperandUse(i)) || 4620 IsAttachedCallOperand(F, CBI, i)), 4621 "Cannot take the address of an intrinsic!", &I); 4622 Check(!F->isIntrinsic() || isa<CallInst>(I) || 4623 F->getIntrinsicID() == Intrinsic::donothing || 4624 F->getIntrinsicID() == Intrinsic::seh_try_begin || 4625 F->getIntrinsicID() == Intrinsic::seh_try_end || 4626 F->getIntrinsicID() == Intrinsic::seh_scope_begin || 4627 F->getIntrinsicID() == Intrinsic::seh_scope_end || 4628 F->getIntrinsicID() == Intrinsic::coro_resume || 4629 F->getIntrinsicID() == Intrinsic::coro_destroy || 4630 F->getIntrinsicID() == 4631 Intrinsic::experimental_patchpoint_void || 4632 F->getIntrinsicID() == Intrinsic::experimental_patchpoint_i64 || 4633 F->getIntrinsicID() == Intrinsic::experimental_gc_statepoint || 4634 F->getIntrinsicID() == Intrinsic::wasm_rethrow || 4635 IsAttachedCallOperand(F, CBI, i), 4636 "Cannot invoke an intrinsic other than donothing, patchpoint, " 4637 "statepoint, coro_resume, coro_destroy or clang.arc.attachedcall", 4638 &I); 4639 Check(F->getParent() == &M, "Referencing function in another module!", &I, 4640 &M, F, F->getParent()); 4641 } else if (BasicBlock *OpBB = dyn_cast<BasicBlock>(I.getOperand(i))) { 4642 Check(OpBB->getParent() == BB->getParent(), 4643 "Referring to a basic block in another function!", &I); 4644 } else if (Argument *OpArg = dyn_cast<Argument>(I.getOperand(i))) { 4645 Check(OpArg->getParent() == BB->getParent(), 4646 "Referring to an argument in another function!", &I); 4647 } else if (GlobalValue *GV = dyn_cast<GlobalValue>(I.getOperand(i))) { 4648 Check(GV->getParent() == &M, "Referencing global in another module!", &I, 4649 &M, GV, GV->getParent()); 4650 } else if (isa<Instruction>(I.getOperand(i))) { 4651 verifyDominatesUse(I, i); 4652 } else if (isa<InlineAsm>(I.getOperand(i))) { 4653 Check(CBI && &CBI->getCalledOperandUse() == &I.getOperandUse(i), 4654 "Cannot take the address of an inline asm!", &I); 4655 } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(I.getOperand(i))) { 4656 if (CE->getType()->isPtrOrPtrVectorTy()) { 4657 // If we have a ConstantExpr pointer, we need to see if it came from an 4658 // illegal bitcast. 4659 visitConstantExprsRecursively(CE); 4660 } 4661 } 4662 } 4663 4664 if (MDNode *MD = I.getMetadata(LLVMContext::MD_fpmath)) { 4665 Check(I.getType()->isFPOrFPVectorTy(), 4666 "fpmath requires a floating point result!", &I); 4667 Check(MD->getNumOperands() == 1, "fpmath takes one operand!", &I); 4668 if (ConstantFP *CFP0 = 4669 mdconst::dyn_extract_or_null<ConstantFP>(MD->getOperand(0))) { 4670 const APFloat &Accuracy = CFP0->getValueAPF(); 4671 Check(&Accuracy.getSemantics() == &APFloat::IEEEsingle(), 4672 "fpmath accuracy must have float type", &I); 4673 Check(Accuracy.isFiniteNonZero() && !Accuracy.isNegative(), 4674 "fpmath accuracy not a positive number!", &I); 4675 } else { 4676 Check(false, "invalid fpmath accuracy!", &I); 4677 } 4678 } 4679 4680 if (MDNode *Range = I.getMetadata(LLVMContext::MD_range)) { 4681 Check(isa<LoadInst>(I) || isa<CallInst>(I) || isa<InvokeInst>(I), 4682 "Ranges are only for loads, calls and invokes!", &I); 4683 visitRangeMetadata(I, Range, I.getType()); 4684 } 4685 4686 if (I.hasMetadata(LLVMContext::MD_invariant_group)) { 4687 Check(isa<LoadInst>(I) || isa<StoreInst>(I), 4688 "invariant.group metadata is only for loads and stores", &I); 4689 } 4690 4691 if (I.getMetadata(LLVMContext::MD_nonnull)) { 4692 Check(I.getType()->isPointerTy(), "nonnull applies only to pointer types", 4693 &I); 4694 Check(isa<LoadInst>(I), 4695 "nonnull applies only to load instructions, use attributes" 4696 " for calls or invokes", 4697 &I); 4698 } 4699 4700 if (MDNode *MD = I.getMetadata(LLVMContext::MD_dereferenceable)) 4701 visitDereferenceableMetadata(I, MD); 4702 4703 if (MDNode *MD = I.getMetadata(LLVMContext::MD_dereferenceable_or_null)) 4704 visitDereferenceableMetadata(I, MD); 4705 4706 if (MDNode *TBAA = I.getMetadata(LLVMContext::MD_tbaa)) 4707 TBAAVerifyHelper.visitTBAAMetadata(I, TBAA); 4708 4709 if (MDNode *MD = I.getMetadata(LLVMContext::MD_noalias)) 4710 visitAliasScopeListMetadata(MD); 4711 if (MDNode *MD = I.getMetadata(LLVMContext::MD_alias_scope)) 4712 visitAliasScopeListMetadata(MD); 4713 4714 if (MDNode *MD = I.getMetadata(LLVMContext::MD_access_group)) 4715 visitAccessGroupMetadata(MD); 4716 4717 if (MDNode *AlignMD = I.getMetadata(LLVMContext::MD_align)) { 4718 Check(I.getType()->isPointerTy(), "align applies only to pointer types", 4719 &I); 4720 Check(isa<LoadInst>(I), 4721 "align applies only to load instructions, " 4722 "use attributes for calls or invokes", 4723 &I); 4724 Check(AlignMD->getNumOperands() == 1, "align takes one operand!", &I); 4725 ConstantInt *CI = mdconst::dyn_extract<ConstantInt>(AlignMD->getOperand(0)); 4726 Check(CI && CI->getType()->isIntegerTy(64), 4727 "align metadata value must be an i64!", &I); 4728 uint64_t Align = CI->getZExtValue(); 4729 Check(isPowerOf2_64(Align), "align metadata value must be a power of 2!", 4730 &I); 4731 Check(Align <= Value::MaximumAlignment, 4732 "alignment is larger that implementation defined limit", &I); 4733 } 4734 4735 if (MDNode *MD = I.getMetadata(LLVMContext::MD_prof)) 4736 visitProfMetadata(I, MD); 4737 4738 if (MDNode *Annotation = I.getMetadata(LLVMContext::MD_annotation)) 4739 visitAnnotationMetadata(Annotation); 4740 4741 if (MDNode *N = I.getDebugLoc().getAsMDNode()) { 4742 CheckDI(isa<DILocation>(N), "invalid !dbg metadata attachment", &I, N); 4743 visitMDNode(*N, AreDebugLocsAllowed::Yes); 4744 } 4745 4746 if (auto *DII = dyn_cast<DbgVariableIntrinsic>(&I)) { 4747 verifyFragmentExpression(*DII); 4748 verifyNotEntryValue(*DII); 4749 } 4750 4751 SmallVector<std::pair<unsigned, MDNode *>, 4> MDs; 4752 I.getAllMetadata(MDs); 4753 for (auto Attachment : MDs) { 4754 unsigned Kind = Attachment.first; 4755 auto AllowLocs = 4756 (Kind == LLVMContext::MD_dbg || Kind == LLVMContext::MD_loop) 4757 ? AreDebugLocsAllowed::Yes 4758 : AreDebugLocsAllowed::No; 4759 visitMDNode(*Attachment.second, AllowLocs); 4760 } 4761 4762 InstsInThisBlock.insert(&I); 4763 } 4764 4765 /// Allow intrinsics to be verified in different ways. 4766 void Verifier::visitIntrinsicCall(Intrinsic::ID ID, CallBase &Call) { 4767 Function *IF = Call.getCalledFunction(); 4768 Check(IF->isDeclaration(), "Intrinsic functions should never be defined!", 4769 IF); 4770 4771 // Verify that the intrinsic prototype lines up with what the .td files 4772 // describe. 4773 FunctionType *IFTy = IF->getFunctionType(); 4774 bool IsVarArg = IFTy->isVarArg(); 4775 4776 SmallVector<Intrinsic::IITDescriptor, 8> Table; 4777 getIntrinsicInfoTableEntries(ID, Table); 4778 ArrayRef<Intrinsic::IITDescriptor> TableRef = Table; 4779 4780 // Walk the descriptors to extract overloaded types. 4781 SmallVector<Type *, 4> ArgTys; 4782 Intrinsic::MatchIntrinsicTypesResult Res = 4783 Intrinsic::matchIntrinsicSignature(IFTy, TableRef, ArgTys); 4784 Check(Res != Intrinsic::MatchIntrinsicTypes_NoMatchRet, 4785 "Intrinsic has incorrect return type!", IF); 4786 Check(Res != Intrinsic::MatchIntrinsicTypes_NoMatchArg, 4787 "Intrinsic has incorrect argument type!", IF); 4788 4789 // Verify if the intrinsic call matches the vararg property. 4790 if (IsVarArg) 4791 Check(!Intrinsic::matchIntrinsicVarArg(IsVarArg, TableRef), 4792 "Intrinsic was not defined with variable arguments!", IF); 4793 else 4794 Check(!Intrinsic::matchIntrinsicVarArg(IsVarArg, TableRef), 4795 "Callsite was not defined with variable arguments!", IF); 4796 4797 // All descriptors should be absorbed by now. 4798 Check(TableRef.empty(), "Intrinsic has too few arguments!", IF); 4799 4800 // Now that we have the intrinsic ID and the actual argument types (and we 4801 // know they are legal for the intrinsic!) get the intrinsic name through the 4802 // usual means. This allows us to verify the mangling of argument types into 4803 // the name. 4804 const std::string ExpectedName = 4805 Intrinsic::getName(ID, ArgTys, IF->getParent(), IFTy); 4806 Check(ExpectedName == IF->getName(), 4807 "Intrinsic name not mangled correctly for type arguments! " 4808 "Should be: " + 4809 ExpectedName, 4810 IF); 4811 4812 // If the intrinsic takes MDNode arguments, verify that they are either global 4813 // or are local to *this* function. 4814 for (Value *V : Call.args()) { 4815 if (auto *MD = dyn_cast<MetadataAsValue>(V)) 4816 visitMetadataAsValue(*MD, Call.getCaller()); 4817 if (auto *Const = dyn_cast<Constant>(V)) 4818 Check(!Const->getType()->isX86_AMXTy(), 4819 "const x86_amx is not allowed in argument!"); 4820 } 4821 4822 switch (ID) { 4823 default: 4824 break; 4825 case Intrinsic::assume: { 4826 for (auto &Elem : Call.bundle_op_infos()) { 4827 Check(Elem.Tag->getKey() == "ignore" || 4828 Attribute::isExistingAttribute(Elem.Tag->getKey()), 4829 "tags must be valid attribute names", Call); 4830 Attribute::AttrKind Kind = 4831 Attribute::getAttrKindFromName(Elem.Tag->getKey()); 4832 unsigned ArgCount = Elem.End - Elem.Begin; 4833 if (Kind == Attribute::Alignment) { 4834 Check(ArgCount <= 3 && ArgCount >= 2, 4835 "alignment assumptions should have 2 or 3 arguments", Call); 4836 Check(Call.getOperand(Elem.Begin)->getType()->isPointerTy(), 4837 "first argument should be a pointer", Call); 4838 Check(Call.getOperand(Elem.Begin + 1)->getType()->isIntegerTy(), 4839 "second argument should be an integer", Call); 4840 if (ArgCount == 3) 4841 Check(Call.getOperand(Elem.Begin + 2)->getType()->isIntegerTy(), 4842 "third argument should be an integer if present", Call); 4843 return; 4844 } 4845 Check(ArgCount <= 2, "too many arguments", Call); 4846 if (Kind == Attribute::None) 4847 break; 4848 if (Attribute::isIntAttrKind(Kind)) { 4849 Check(ArgCount == 2, "this attribute should have 2 arguments", Call); 4850 Check(isa<ConstantInt>(Call.getOperand(Elem.Begin + 1)), 4851 "the second argument should be a constant integral value", Call); 4852 } else if (Attribute::canUseAsParamAttr(Kind)) { 4853 Check((ArgCount) == 1, "this attribute should have one argument", Call); 4854 } else if (Attribute::canUseAsFnAttr(Kind)) { 4855 Check((ArgCount) == 0, "this attribute has no argument", Call); 4856 } 4857 } 4858 break; 4859 } 4860 case Intrinsic::coro_id: { 4861 auto *InfoArg = Call.getArgOperand(3)->stripPointerCasts(); 4862 if (isa<ConstantPointerNull>(InfoArg)) 4863 break; 4864 auto *GV = dyn_cast<GlobalVariable>(InfoArg); 4865 Check(GV && GV->isConstant() && GV->hasDefinitiveInitializer(), 4866 "info argument of llvm.coro.id must refer to an initialized " 4867 "constant"); 4868 Constant *Init = GV->getInitializer(); 4869 Check(isa<ConstantStruct>(Init) || isa<ConstantArray>(Init), 4870 "info argument of llvm.coro.id must refer to either a struct or " 4871 "an array"); 4872 break; 4873 } 4874 case Intrinsic::fptrunc_round: { 4875 // Check the rounding mode 4876 Metadata *MD = nullptr; 4877 auto *MAV = dyn_cast<MetadataAsValue>(Call.getOperand(1)); 4878 if (MAV) 4879 MD = MAV->getMetadata(); 4880 4881 Check(MD != nullptr, "missing rounding mode argument", Call); 4882 4883 Check(isa<MDString>(MD), 4884 ("invalid value for llvm.fptrunc.round metadata operand" 4885 " (the operand should be a string)"), 4886 MD); 4887 4888 Optional<RoundingMode> RoundMode = 4889 convertStrToRoundingMode(cast<MDString>(MD)->getString()); 4890 Check(RoundMode && *RoundMode != RoundingMode::Dynamic, 4891 "unsupported rounding mode argument", Call); 4892 break; 4893 } 4894 #define BEGIN_REGISTER_VP_INTRINSIC(VPID, ...) case Intrinsic::VPID: 4895 #include "llvm/IR/VPIntrinsics.def" 4896 visitVPIntrinsic(cast<VPIntrinsic>(Call)); 4897 break; 4898 #define INSTRUCTION(NAME, NARGS, ROUND_MODE, INTRINSIC) \ 4899 case Intrinsic::INTRINSIC: 4900 #include "llvm/IR/ConstrainedOps.def" 4901 visitConstrainedFPIntrinsic(cast<ConstrainedFPIntrinsic>(Call)); 4902 break; 4903 case Intrinsic::dbg_declare: // llvm.dbg.declare 4904 Check(isa<MetadataAsValue>(Call.getArgOperand(0)), 4905 "invalid llvm.dbg.declare intrinsic call 1", Call); 4906 visitDbgIntrinsic("declare", cast<DbgVariableIntrinsic>(Call)); 4907 break; 4908 case Intrinsic::dbg_addr: // llvm.dbg.addr 4909 visitDbgIntrinsic("addr", cast<DbgVariableIntrinsic>(Call)); 4910 break; 4911 case Intrinsic::dbg_value: // llvm.dbg.value 4912 visitDbgIntrinsic("value", cast<DbgVariableIntrinsic>(Call)); 4913 break; 4914 case Intrinsic::dbg_label: // llvm.dbg.label 4915 visitDbgLabelIntrinsic("label", cast<DbgLabelInst>(Call)); 4916 break; 4917 case Intrinsic::memcpy: 4918 case Intrinsic::memcpy_inline: 4919 case Intrinsic::memmove: 4920 case Intrinsic::memset: 4921 case Intrinsic::memset_inline: { 4922 const auto *MI = cast<MemIntrinsic>(&Call); 4923 auto IsValidAlignment = [&](unsigned Alignment) -> bool { 4924 return Alignment == 0 || isPowerOf2_32(Alignment); 4925 }; 4926 Check(IsValidAlignment(MI->getDestAlignment()), 4927 "alignment of arg 0 of memory intrinsic must be 0 or a power of 2", 4928 Call); 4929 if (const auto *MTI = dyn_cast<MemTransferInst>(MI)) { 4930 Check(IsValidAlignment(MTI->getSourceAlignment()), 4931 "alignment of arg 1 of memory intrinsic must be 0 or a power of 2", 4932 Call); 4933 } 4934 4935 break; 4936 } 4937 case Intrinsic::memcpy_element_unordered_atomic: 4938 case Intrinsic::memmove_element_unordered_atomic: 4939 case Intrinsic::memset_element_unordered_atomic: { 4940 const auto *AMI = cast<AtomicMemIntrinsic>(&Call); 4941 4942 ConstantInt *ElementSizeCI = 4943 cast<ConstantInt>(AMI->getRawElementSizeInBytes()); 4944 const APInt &ElementSizeVal = ElementSizeCI->getValue(); 4945 Check(ElementSizeVal.isPowerOf2(), 4946 "element size of the element-wise atomic memory intrinsic " 4947 "must be a power of 2", 4948 Call); 4949 4950 auto IsValidAlignment = [&](uint64_t Alignment) { 4951 return isPowerOf2_64(Alignment) && ElementSizeVal.ule(Alignment); 4952 }; 4953 uint64_t DstAlignment = AMI->getDestAlignment(); 4954 Check(IsValidAlignment(DstAlignment), 4955 "incorrect alignment of the destination argument", Call); 4956 if (const auto *AMT = dyn_cast<AtomicMemTransferInst>(AMI)) { 4957 uint64_t SrcAlignment = AMT->getSourceAlignment(); 4958 Check(IsValidAlignment(SrcAlignment), 4959 "incorrect alignment of the source argument", Call); 4960 } 4961 break; 4962 } 4963 case Intrinsic::call_preallocated_setup: { 4964 auto *NumArgs = dyn_cast<ConstantInt>(Call.getArgOperand(0)); 4965 Check(NumArgs != nullptr, 4966 "llvm.call.preallocated.setup argument must be a constant"); 4967 bool FoundCall = false; 4968 for (User *U : Call.users()) { 4969 auto *UseCall = dyn_cast<CallBase>(U); 4970 Check(UseCall != nullptr, 4971 "Uses of llvm.call.preallocated.setup must be calls"); 4972 const Function *Fn = UseCall->getCalledFunction(); 4973 if (Fn && Fn->getIntrinsicID() == Intrinsic::call_preallocated_arg) { 4974 auto *AllocArgIndex = dyn_cast<ConstantInt>(UseCall->getArgOperand(1)); 4975 Check(AllocArgIndex != nullptr, 4976 "llvm.call.preallocated.alloc arg index must be a constant"); 4977 auto AllocArgIndexInt = AllocArgIndex->getValue(); 4978 Check(AllocArgIndexInt.sge(0) && 4979 AllocArgIndexInt.slt(NumArgs->getValue()), 4980 "llvm.call.preallocated.alloc arg index must be between 0 and " 4981 "corresponding " 4982 "llvm.call.preallocated.setup's argument count"); 4983 } else if (Fn && Fn->getIntrinsicID() == 4984 Intrinsic::call_preallocated_teardown) { 4985 // nothing to do 4986 } else { 4987 Check(!FoundCall, "Can have at most one call corresponding to a " 4988 "llvm.call.preallocated.setup"); 4989 FoundCall = true; 4990 size_t NumPreallocatedArgs = 0; 4991 for (unsigned i = 0; i < UseCall->arg_size(); i++) { 4992 if (UseCall->paramHasAttr(i, Attribute::Preallocated)) { 4993 ++NumPreallocatedArgs; 4994 } 4995 } 4996 Check(NumPreallocatedArgs != 0, 4997 "cannot use preallocated intrinsics on a call without " 4998 "preallocated arguments"); 4999 Check(NumArgs->equalsInt(NumPreallocatedArgs), 5000 "llvm.call.preallocated.setup arg size must be equal to number " 5001 "of preallocated arguments " 5002 "at call site", 5003 Call, *UseCall); 5004 // getOperandBundle() cannot be called if more than one of the operand 5005 // bundle exists. There is already a check elsewhere for this, so skip 5006 // here if we see more than one. 5007 if (UseCall->countOperandBundlesOfType(LLVMContext::OB_preallocated) > 5008 1) { 5009 return; 5010 } 5011 auto PreallocatedBundle = 5012 UseCall->getOperandBundle(LLVMContext::OB_preallocated); 5013 Check(PreallocatedBundle, 5014 "Use of llvm.call.preallocated.setup outside intrinsics " 5015 "must be in \"preallocated\" operand bundle"); 5016 Check(PreallocatedBundle->Inputs.front().get() == &Call, 5017 "preallocated bundle must have token from corresponding " 5018 "llvm.call.preallocated.setup"); 5019 } 5020 } 5021 break; 5022 } 5023 case Intrinsic::call_preallocated_arg: { 5024 auto *Token = dyn_cast<CallBase>(Call.getArgOperand(0)); 5025 Check(Token && Token->getCalledFunction()->getIntrinsicID() == 5026 Intrinsic::call_preallocated_setup, 5027 "llvm.call.preallocated.arg token argument must be a " 5028 "llvm.call.preallocated.setup"); 5029 Check(Call.hasFnAttr(Attribute::Preallocated), 5030 "llvm.call.preallocated.arg must be called with a \"preallocated\" " 5031 "call site attribute"); 5032 break; 5033 } 5034 case Intrinsic::call_preallocated_teardown: { 5035 auto *Token = dyn_cast<CallBase>(Call.getArgOperand(0)); 5036 Check(Token && Token->getCalledFunction()->getIntrinsicID() == 5037 Intrinsic::call_preallocated_setup, 5038 "llvm.call.preallocated.teardown token argument must be a " 5039 "llvm.call.preallocated.setup"); 5040 break; 5041 } 5042 case Intrinsic::gcroot: 5043 case Intrinsic::gcwrite: 5044 case Intrinsic::gcread: 5045 if (ID == Intrinsic::gcroot) { 5046 AllocaInst *AI = 5047 dyn_cast<AllocaInst>(Call.getArgOperand(0)->stripPointerCasts()); 5048 Check(AI, "llvm.gcroot parameter #1 must be an alloca.", Call); 5049 Check(isa<Constant>(Call.getArgOperand(1)), 5050 "llvm.gcroot parameter #2 must be a constant.", Call); 5051 if (!AI->getAllocatedType()->isPointerTy()) { 5052 Check(!isa<ConstantPointerNull>(Call.getArgOperand(1)), 5053 "llvm.gcroot parameter #1 must either be a pointer alloca, " 5054 "or argument #2 must be a non-null constant.", 5055 Call); 5056 } 5057 } 5058 5059 Check(Call.getParent()->getParent()->hasGC(), 5060 "Enclosing function does not use GC.", Call); 5061 break; 5062 case Intrinsic::init_trampoline: 5063 Check(isa<Function>(Call.getArgOperand(1)->stripPointerCasts()), 5064 "llvm.init_trampoline parameter #2 must resolve to a function.", 5065 Call); 5066 break; 5067 case Intrinsic::prefetch: 5068 Check(cast<ConstantInt>(Call.getArgOperand(1))->getZExtValue() < 2 && 5069 cast<ConstantInt>(Call.getArgOperand(2))->getZExtValue() < 4, 5070 "invalid arguments to llvm.prefetch", Call); 5071 break; 5072 case Intrinsic::stackprotector: 5073 Check(isa<AllocaInst>(Call.getArgOperand(1)->stripPointerCasts()), 5074 "llvm.stackprotector parameter #2 must resolve to an alloca.", Call); 5075 break; 5076 case Intrinsic::localescape: { 5077 BasicBlock *BB = Call.getParent(); 5078 Check(BB == &BB->getParent()->front(), 5079 "llvm.localescape used outside of entry block", Call); 5080 Check(!SawFrameEscape, "multiple calls to llvm.localescape in one function", 5081 Call); 5082 for (Value *Arg : Call.args()) { 5083 if (isa<ConstantPointerNull>(Arg)) 5084 continue; // Null values are allowed as placeholders. 5085 auto *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts()); 5086 Check(AI && AI->isStaticAlloca(), 5087 "llvm.localescape only accepts static allocas", Call); 5088 } 5089 FrameEscapeInfo[BB->getParent()].first = Call.arg_size(); 5090 SawFrameEscape = true; 5091 break; 5092 } 5093 case Intrinsic::localrecover: { 5094 Value *FnArg = Call.getArgOperand(0)->stripPointerCasts(); 5095 Function *Fn = dyn_cast<Function>(FnArg); 5096 Check(Fn && !Fn->isDeclaration(), 5097 "llvm.localrecover first " 5098 "argument must be function defined in this module", 5099 Call); 5100 auto *IdxArg = cast<ConstantInt>(Call.getArgOperand(2)); 5101 auto &Entry = FrameEscapeInfo[Fn]; 5102 Entry.second = unsigned( 5103 std::max(uint64_t(Entry.second), IdxArg->getLimitedValue(~0U) + 1)); 5104 break; 5105 } 5106 5107 case Intrinsic::experimental_gc_statepoint: 5108 if (auto *CI = dyn_cast<CallInst>(&Call)) 5109 Check(!CI->isInlineAsm(), 5110 "gc.statepoint support for inline assembly unimplemented", CI); 5111 Check(Call.getParent()->getParent()->hasGC(), 5112 "Enclosing function does not use GC.", Call); 5113 5114 verifyStatepoint(Call); 5115 break; 5116 case Intrinsic::experimental_gc_result: { 5117 Check(Call.getParent()->getParent()->hasGC(), 5118 "Enclosing function does not use GC.", Call); 5119 // Are we tied to a statepoint properly? 5120 const auto *StatepointCall = dyn_cast<CallBase>(Call.getArgOperand(0)); 5121 const Function *StatepointFn = 5122 StatepointCall ? StatepointCall->getCalledFunction() : nullptr; 5123 Check(StatepointFn && StatepointFn->isDeclaration() && 5124 StatepointFn->getIntrinsicID() == 5125 Intrinsic::experimental_gc_statepoint, 5126 "gc.result operand #1 must be from a statepoint", Call, 5127 Call.getArgOperand(0)); 5128 5129 // Check that result type matches wrapped callee. 5130 auto *TargetFuncType = 5131 cast<FunctionType>(StatepointCall->getParamElementType(2)); 5132 Check(Call.getType() == TargetFuncType->getReturnType(), 5133 "gc.result result type does not match wrapped callee", Call); 5134 break; 5135 } 5136 case Intrinsic::experimental_gc_relocate: { 5137 Check(Call.arg_size() == 3, "wrong number of arguments", Call); 5138 5139 Check(isa<PointerType>(Call.getType()->getScalarType()), 5140 "gc.relocate must return a pointer or a vector of pointers", Call); 5141 5142 // Check that this relocate is correctly tied to the statepoint 5143 5144 // This is case for relocate on the unwinding path of an invoke statepoint 5145 if (LandingPadInst *LandingPad = 5146 dyn_cast<LandingPadInst>(Call.getArgOperand(0))) { 5147 5148 const BasicBlock *InvokeBB = 5149 LandingPad->getParent()->getUniquePredecessor(); 5150 5151 // Landingpad relocates should have only one predecessor with invoke 5152 // statepoint terminator 5153 Check(InvokeBB, "safepoints should have unique landingpads", 5154 LandingPad->getParent()); 5155 Check(InvokeBB->getTerminator(), "safepoint block should be well formed", 5156 InvokeBB); 5157 Check(isa<GCStatepointInst>(InvokeBB->getTerminator()), 5158 "gc relocate should be linked to a statepoint", InvokeBB); 5159 } else { 5160 // In all other cases relocate should be tied to the statepoint directly. 5161 // This covers relocates on a normal return path of invoke statepoint and 5162 // relocates of a call statepoint. 5163 auto Token = Call.getArgOperand(0); 5164 Check(isa<GCStatepointInst>(Token), 5165 "gc relocate is incorrectly tied to the statepoint", Call, Token); 5166 } 5167 5168 // Verify rest of the relocate arguments. 5169 const CallBase &StatepointCall = 5170 *cast<GCRelocateInst>(Call).getStatepoint(); 5171 5172 // Both the base and derived must be piped through the safepoint. 5173 Value *Base = Call.getArgOperand(1); 5174 Check(isa<ConstantInt>(Base), 5175 "gc.relocate operand #2 must be integer offset", Call); 5176 5177 Value *Derived = Call.getArgOperand(2); 5178 Check(isa<ConstantInt>(Derived), 5179 "gc.relocate operand #3 must be integer offset", Call); 5180 5181 const uint64_t BaseIndex = cast<ConstantInt>(Base)->getZExtValue(); 5182 const uint64_t DerivedIndex = cast<ConstantInt>(Derived)->getZExtValue(); 5183 5184 // Check the bounds 5185 if (auto Opt = StatepointCall.getOperandBundle(LLVMContext::OB_gc_live)) { 5186 Check(BaseIndex < Opt->Inputs.size(), 5187 "gc.relocate: statepoint base index out of bounds", Call); 5188 Check(DerivedIndex < Opt->Inputs.size(), 5189 "gc.relocate: statepoint derived index out of bounds", Call); 5190 } 5191 5192 // Relocated value must be either a pointer type or vector-of-pointer type, 5193 // but gc_relocate does not need to return the same pointer type as the 5194 // relocated pointer. It can be casted to the correct type later if it's 5195 // desired. However, they must have the same address space and 'vectorness' 5196 GCRelocateInst &Relocate = cast<GCRelocateInst>(Call); 5197 Check(Relocate.getDerivedPtr()->getType()->isPtrOrPtrVectorTy(), 5198 "gc.relocate: relocated value must be a gc pointer", Call); 5199 5200 auto ResultType = Call.getType(); 5201 auto DerivedType = Relocate.getDerivedPtr()->getType(); 5202 Check(ResultType->isVectorTy() == DerivedType->isVectorTy(), 5203 "gc.relocate: vector relocates to vector and pointer to pointer", 5204 Call); 5205 Check( 5206 ResultType->getPointerAddressSpace() == 5207 DerivedType->getPointerAddressSpace(), 5208 "gc.relocate: relocating a pointer shouldn't change its address space", 5209 Call); 5210 break; 5211 } 5212 case Intrinsic::eh_exceptioncode: 5213 case Intrinsic::eh_exceptionpointer: { 5214 Check(isa<CatchPadInst>(Call.getArgOperand(0)), 5215 "eh.exceptionpointer argument must be a catchpad", Call); 5216 break; 5217 } 5218 case Intrinsic::get_active_lane_mask: { 5219 Check(Call.getType()->isVectorTy(), 5220 "get_active_lane_mask: must return a " 5221 "vector", 5222 Call); 5223 auto *ElemTy = Call.getType()->getScalarType(); 5224 Check(ElemTy->isIntegerTy(1), 5225 "get_active_lane_mask: element type is not " 5226 "i1", 5227 Call); 5228 break; 5229 } 5230 case Intrinsic::masked_load: { 5231 Check(Call.getType()->isVectorTy(), "masked_load: must return a vector", 5232 Call); 5233 5234 Value *Ptr = Call.getArgOperand(0); 5235 ConstantInt *Alignment = cast<ConstantInt>(Call.getArgOperand(1)); 5236 Value *Mask = Call.getArgOperand(2); 5237 Value *PassThru = Call.getArgOperand(3); 5238 Check(Mask->getType()->isVectorTy(), "masked_load: mask must be vector", 5239 Call); 5240 Check(Alignment->getValue().isPowerOf2(), 5241 "masked_load: alignment must be a power of 2", Call); 5242 5243 PointerType *PtrTy = cast<PointerType>(Ptr->getType()); 5244 Check(PtrTy->isOpaqueOrPointeeTypeMatches(Call.getType()), 5245 "masked_load: return must match pointer type", Call); 5246 Check(PassThru->getType() == Call.getType(), 5247 "masked_load: pass through and return type must match", Call); 5248 Check(cast<VectorType>(Mask->getType())->getElementCount() == 5249 cast<VectorType>(Call.getType())->getElementCount(), 5250 "masked_load: vector mask must be same length as return", Call); 5251 break; 5252 } 5253 case Intrinsic::masked_store: { 5254 Value *Val = Call.getArgOperand(0); 5255 Value *Ptr = Call.getArgOperand(1); 5256 ConstantInt *Alignment = cast<ConstantInt>(Call.getArgOperand(2)); 5257 Value *Mask = Call.getArgOperand(3); 5258 Check(Mask->getType()->isVectorTy(), "masked_store: mask must be vector", 5259 Call); 5260 Check(Alignment->getValue().isPowerOf2(), 5261 "masked_store: alignment must be a power of 2", Call); 5262 5263 PointerType *PtrTy = cast<PointerType>(Ptr->getType()); 5264 Check(PtrTy->isOpaqueOrPointeeTypeMatches(Val->getType()), 5265 "masked_store: storee must match pointer type", Call); 5266 Check(cast<VectorType>(Mask->getType())->getElementCount() == 5267 cast<VectorType>(Val->getType())->getElementCount(), 5268 "masked_store: vector mask must be same length as value", Call); 5269 break; 5270 } 5271 5272 case Intrinsic::masked_gather: { 5273 const APInt &Alignment = 5274 cast<ConstantInt>(Call.getArgOperand(1))->getValue(); 5275 Check(Alignment.isZero() || Alignment.isPowerOf2(), 5276 "masked_gather: alignment must be 0 or a power of 2", Call); 5277 break; 5278 } 5279 case Intrinsic::masked_scatter: { 5280 const APInt &Alignment = 5281 cast<ConstantInt>(Call.getArgOperand(2))->getValue(); 5282 Check(Alignment.isZero() || Alignment.isPowerOf2(), 5283 "masked_scatter: alignment must be 0 or a power of 2", Call); 5284 break; 5285 } 5286 5287 case Intrinsic::experimental_guard: { 5288 Check(isa<CallInst>(Call), "experimental_guard cannot be invoked", Call); 5289 Check(Call.countOperandBundlesOfType(LLVMContext::OB_deopt) == 1, 5290 "experimental_guard must have exactly one " 5291 "\"deopt\" operand bundle"); 5292 break; 5293 } 5294 5295 case Intrinsic::experimental_deoptimize: { 5296 Check(isa<CallInst>(Call), "experimental_deoptimize cannot be invoked", 5297 Call); 5298 Check(Call.countOperandBundlesOfType(LLVMContext::OB_deopt) == 1, 5299 "experimental_deoptimize must have exactly one " 5300 "\"deopt\" operand bundle"); 5301 Check(Call.getType() == Call.getFunction()->getReturnType(), 5302 "experimental_deoptimize return type must match caller return type"); 5303 5304 if (isa<CallInst>(Call)) { 5305 auto *RI = dyn_cast<ReturnInst>(Call.getNextNode()); 5306 Check(RI, 5307 "calls to experimental_deoptimize must be followed by a return"); 5308 5309 if (!Call.getType()->isVoidTy() && RI) 5310 Check(RI->getReturnValue() == &Call, 5311 "calls to experimental_deoptimize must be followed by a return " 5312 "of the value computed by experimental_deoptimize"); 5313 } 5314 5315 break; 5316 } 5317 case Intrinsic::vector_reduce_and: 5318 case Intrinsic::vector_reduce_or: 5319 case Intrinsic::vector_reduce_xor: 5320 case Intrinsic::vector_reduce_add: 5321 case Intrinsic::vector_reduce_mul: 5322 case Intrinsic::vector_reduce_smax: 5323 case Intrinsic::vector_reduce_smin: 5324 case Intrinsic::vector_reduce_umax: 5325 case Intrinsic::vector_reduce_umin: { 5326 Type *ArgTy = Call.getArgOperand(0)->getType(); 5327 Check(ArgTy->isIntOrIntVectorTy() && ArgTy->isVectorTy(), 5328 "Intrinsic has incorrect argument type!"); 5329 break; 5330 } 5331 case Intrinsic::vector_reduce_fmax: 5332 case Intrinsic::vector_reduce_fmin: { 5333 Type *ArgTy = Call.getArgOperand(0)->getType(); 5334 Check(ArgTy->isFPOrFPVectorTy() && ArgTy->isVectorTy(), 5335 "Intrinsic has incorrect argument type!"); 5336 break; 5337 } 5338 case Intrinsic::vector_reduce_fadd: 5339 case Intrinsic::vector_reduce_fmul: { 5340 // Unlike the other reductions, the first argument is a start value. The 5341 // second argument is the vector to be reduced. 5342 Type *ArgTy = Call.getArgOperand(1)->getType(); 5343 Check(ArgTy->isFPOrFPVectorTy() && ArgTy->isVectorTy(), 5344 "Intrinsic has incorrect argument type!"); 5345 break; 5346 } 5347 case Intrinsic::smul_fix: 5348 case Intrinsic::smul_fix_sat: 5349 case Intrinsic::umul_fix: 5350 case Intrinsic::umul_fix_sat: 5351 case Intrinsic::sdiv_fix: 5352 case Intrinsic::sdiv_fix_sat: 5353 case Intrinsic::udiv_fix: 5354 case Intrinsic::udiv_fix_sat: { 5355 Value *Op1 = Call.getArgOperand(0); 5356 Value *Op2 = Call.getArgOperand(1); 5357 Check(Op1->getType()->isIntOrIntVectorTy(), 5358 "first operand of [us][mul|div]_fix[_sat] must be an int type or " 5359 "vector of ints"); 5360 Check(Op2->getType()->isIntOrIntVectorTy(), 5361 "second operand of [us][mul|div]_fix[_sat] must be an int type or " 5362 "vector of ints"); 5363 5364 auto *Op3 = cast<ConstantInt>(Call.getArgOperand(2)); 5365 Check(Op3->getType()->getBitWidth() <= 32, 5366 "third argument of [us][mul|div]_fix[_sat] must fit within 32 bits"); 5367 5368 if (ID == Intrinsic::smul_fix || ID == Intrinsic::smul_fix_sat || 5369 ID == Intrinsic::sdiv_fix || ID == Intrinsic::sdiv_fix_sat) { 5370 Check(Op3->getZExtValue() < Op1->getType()->getScalarSizeInBits(), 5371 "the scale of s[mul|div]_fix[_sat] must be less than the width of " 5372 "the operands"); 5373 } else { 5374 Check(Op3->getZExtValue() <= Op1->getType()->getScalarSizeInBits(), 5375 "the scale of u[mul|div]_fix[_sat] must be less than or equal " 5376 "to the width of the operands"); 5377 } 5378 break; 5379 } 5380 case Intrinsic::lround: 5381 case Intrinsic::llround: 5382 case Intrinsic::lrint: 5383 case Intrinsic::llrint: { 5384 Type *ValTy = Call.getArgOperand(0)->getType(); 5385 Type *ResultTy = Call.getType(); 5386 Check(!ValTy->isVectorTy() && !ResultTy->isVectorTy(), 5387 "Intrinsic does not support vectors", &Call); 5388 break; 5389 } 5390 case Intrinsic::bswap: { 5391 Type *Ty = Call.getType(); 5392 unsigned Size = Ty->getScalarSizeInBits(); 5393 Check(Size % 16 == 0, "bswap must be an even number of bytes", &Call); 5394 break; 5395 } 5396 case Intrinsic::invariant_start: { 5397 ConstantInt *InvariantSize = dyn_cast<ConstantInt>(Call.getArgOperand(0)); 5398 Check(InvariantSize && 5399 (!InvariantSize->isNegative() || InvariantSize->isMinusOne()), 5400 "invariant_start parameter must be -1, 0 or a positive number", 5401 &Call); 5402 break; 5403 } 5404 case Intrinsic::matrix_multiply: 5405 case Intrinsic::matrix_transpose: 5406 case Intrinsic::matrix_column_major_load: 5407 case Intrinsic::matrix_column_major_store: { 5408 Function *IF = Call.getCalledFunction(); 5409 ConstantInt *Stride = nullptr; 5410 ConstantInt *NumRows; 5411 ConstantInt *NumColumns; 5412 VectorType *ResultTy; 5413 Type *Op0ElemTy = nullptr; 5414 Type *Op1ElemTy = nullptr; 5415 switch (ID) { 5416 case Intrinsic::matrix_multiply: 5417 NumRows = cast<ConstantInt>(Call.getArgOperand(2)); 5418 NumColumns = cast<ConstantInt>(Call.getArgOperand(4)); 5419 ResultTy = cast<VectorType>(Call.getType()); 5420 Op0ElemTy = 5421 cast<VectorType>(Call.getArgOperand(0)->getType())->getElementType(); 5422 Op1ElemTy = 5423 cast<VectorType>(Call.getArgOperand(1)->getType())->getElementType(); 5424 break; 5425 case Intrinsic::matrix_transpose: 5426 NumRows = cast<ConstantInt>(Call.getArgOperand(1)); 5427 NumColumns = cast<ConstantInt>(Call.getArgOperand(2)); 5428 ResultTy = cast<VectorType>(Call.getType()); 5429 Op0ElemTy = 5430 cast<VectorType>(Call.getArgOperand(0)->getType())->getElementType(); 5431 break; 5432 case Intrinsic::matrix_column_major_load: { 5433 Stride = dyn_cast<ConstantInt>(Call.getArgOperand(1)); 5434 NumRows = cast<ConstantInt>(Call.getArgOperand(3)); 5435 NumColumns = cast<ConstantInt>(Call.getArgOperand(4)); 5436 ResultTy = cast<VectorType>(Call.getType()); 5437 5438 PointerType *Op0PtrTy = 5439 cast<PointerType>(Call.getArgOperand(0)->getType()); 5440 if (!Op0PtrTy->isOpaque()) 5441 Op0ElemTy = Op0PtrTy->getNonOpaquePointerElementType(); 5442 break; 5443 } 5444 case Intrinsic::matrix_column_major_store: { 5445 Stride = dyn_cast<ConstantInt>(Call.getArgOperand(2)); 5446 NumRows = cast<ConstantInt>(Call.getArgOperand(4)); 5447 NumColumns = cast<ConstantInt>(Call.getArgOperand(5)); 5448 ResultTy = cast<VectorType>(Call.getArgOperand(0)->getType()); 5449 Op0ElemTy = 5450 cast<VectorType>(Call.getArgOperand(0)->getType())->getElementType(); 5451 5452 PointerType *Op1PtrTy = 5453 cast<PointerType>(Call.getArgOperand(1)->getType()); 5454 if (!Op1PtrTy->isOpaque()) 5455 Op1ElemTy = Op1PtrTy->getNonOpaquePointerElementType(); 5456 break; 5457 } 5458 default: 5459 llvm_unreachable("unexpected intrinsic"); 5460 } 5461 5462 Check(ResultTy->getElementType()->isIntegerTy() || 5463 ResultTy->getElementType()->isFloatingPointTy(), 5464 "Result type must be an integer or floating-point type!", IF); 5465 5466 if (Op0ElemTy) 5467 Check(ResultTy->getElementType() == Op0ElemTy, 5468 "Vector element type mismatch of the result and first operand " 5469 "vector!", 5470 IF); 5471 5472 if (Op1ElemTy) 5473 Check(ResultTy->getElementType() == Op1ElemTy, 5474 "Vector element type mismatch of the result and second operand " 5475 "vector!", 5476 IF); 5477 5478 Check(cast<FixedVectorType>(ResultTy)->getNumElements() == 5479 NumRows->getZExtValue() * NumColumns->getZExtValue(), 5480 "Result of a matrix operation does not fit in the returned vector!"); 5481 5482 if (Stride) 5483 Check(Stride->getZExtValue() >= NumRows->getZExtValue(), 5484 "Stride must be greater or equal than the number of rows!", IF); 5485 5486 break; 5487 } 5488 case Intrinsic::experimental_vector_splice: { 5489 VectorType *VecTy = cast<VectorType>(Call.getType()); 5490 int64_t Idx = cast<ConstantInt>(Call.getArgOperand(2))->getSExtValue(); 5491 int64_t KnownMinNumElements = VecTy->getElementCount().getKnownMinValue(); 5492 if (Call.getParent() && Call.getParent()->getParent()) { 5493 AttributeList Attrs = Call.getParent()->getParent()->getAttributes(); 5494 if (Attrs.hasFnAttr(Attribute::VScaleRange)) 5495 KnownMinNumElements *= Attrs.getFnAttrs().getVScaleRangeMin(); 5496 } 5497 Check((Idx < 0 && std::abs(Idx) <= KnownMinNumElements) || 5498 (Idx >= 0 && Idx < KnownMinNumElements), 5499 "The splice index exceeds the range [-VL, VL-1] where VL is the " 5500 "known minimum number of elements in the vector. For scalable " 5501 "vectors the minimum number of elements is determined from " 5502 "vscale_range.", 5503 &Call); 5504 break; 5505 } 5506 case Intrinsic::experimental_stepvector: { 5507 VectorType *VecTy = dyn_cast<VectorType>(Call.getType()); 5508 Check(VecTy && VecTy->getScalarType()->isIntegerTy() && 5509 VecTy->getScalarSizeInBits() >= 8, 5510 "experimental_stepvector only supported for vectors of integers " 5511 "with a bitwidth of at least 8.", 5512 &Call); 5513 break; 5514 } 5515 case Intrinsic::vector_insert: { 5516 Value *Vec = Call.getArgOperand(0); 5517 Value *SubVec = Call.getArgOperand(1); 5518 Value *Idx = Call.getArgOperand(2); 5519 unsigned IdxN = cast<ConstantInt>(Idx)->getZExtValue(); 5520 5521 VectorType *VecTy = cast<VectorType>(Vec->getType()); 5522 VectorType *SubVecTy = cast<VectorType>(SubVec->getType()); 5523 5524 ElementCount VecEC = VecTy->getElementCount(); 5525 ElementCount SubVecEC = SubVecTy->getElementCount(); 5526 Check(VecTy->getElementType() == SubVecTy->getElementType(), 5527 "vector_insert parameters must have the same element " 5528 "type.", 5529 &Call); 5530 Check(IdxN % SubVecEC.getKnownMinValue() == 0, 5531 "vector_insert index must be a constant multiple of " 5532 "the subvector's known minimum vector length."); 5533 5534 // If this insertion is not the 'mixed' case where a fixed vector is 5535 // inserted into a scalable vector, ensure that the insertion of the 5536 // subvector does not overrun the parent vector. 5537 if (VecEC.isScalable() == SubVecEC.isScalable()) { 5538 Check(IdxN < VecEC.getKnownMinValue() && 5539 IdxN + SubVecEC.getKnownMinValue() <= VecEC.getKnownMinValue(), 5540 "subvector operand of vector_insert would overrun the " 5541 "vector being inserted into."); 5542 } 5543 break; 5544 } 5545 case Intrinsic::vector_extract: { 5546 Value *Vec = Call.getArgOperand(0); 5547 Value *Idx = Call.getArgOperand(1); 5548 unsigned IdxN = cast<ConstantInt>(Idx)->getZExtValue(); 5549 5550 VectorType *ResultTy = cast<VectorType>(Call.getType()); 5551 VectorType *VecTy = cast<VectorType>(Vec->getType()); 5552 5553 ElementCount VecEC = VecTy->getElementCount(); 5554 ElementCount ResultEC = ResultTy->getElementCount(); 5555 5556 Check(ResultTy->getElementType() == VecTy->getElementType(), 5557 "vector_extract result must have the same element " 5558 "type as the input vector.", 5559 &Call); 5560 Check(IdxN % ResultEC.getKnownMinValue() == 0, 5561 "vector_extract index must be a constant multiple of " 5562 "the result type's known minimum vector length."); 5563 5564 // If this extraction is not the 'mixed' case where a fixed vector is is 5565 // extracted from a scalable vector, ensure that the extraction does not 5566 // overrun the parent vector. 5567 if (VecEC.isScalable() == ResultEC.isScalable()) { 5568 Check(IdxN < VecEC.getKnownMinValue() && 5569 IdxN + ResultEC.getKnownMinValue() <= VecEC.getKnownMinValue(), 5570 "vector_extract would overrun."); 5571 } 5572 break; 5573 } 5574 case Intrinsic::experimental_noalias_scope_decl: { 5575 NoAliasScopeDecls.push_back(cast<IntrinsicInst>(&Call)); 5576 break; 5577 } 5578 case Intrinsic::preserve_array_access_index: 5579 case Intrinsic::preserve_struct_access_index: 5580 case Intrinsic::aarch64_ldaxr: 5581 case Intrinsic::aarch64_ldxr: 5582 case Intrinsic::arm_ldaex: 5583 case Intrinsic::arm_ldrex: { 5584 Type *ElemTy = Call.getParamElementType(0); 5585 Check(ElemTy, "Intrinsic requires elementtype attribute on first argument.", 5586 &Call); 5587 break; 5588 } 5589 case Intrinsic::aarch64_stlxr: 5590 case Intrinsic::aarch64_stxr: 5591 case Intrinsic::arm_stlex: 5592 case Intrinsic::arm_strex: { 5593 Type *ElemTy = Call.getAttributes().getParamElementType(1); 5594 Check(ElemTy, 5595 "Intrinsic requires elementtype attribute on second argument.", 5596 &Call); 5597 break; 5598 } 5599 }; 5600 } 5601 5602 /// Carefully grab the subprogram from a local scope. 5603 /// 5604 /// This carefully grabs the subprogram from a local scope, avoiding the 5605 /// built-in assertions that would typically fire. 5606 static DISubprogram *getSubprogram(Metadata *LocalScope) { 5607 if (!LocalScope) 5608 return nullptr; 5609 5610 if (auto *SP = dyn_cast<DISubprogram>(LocalScope)) 5611 return SP; 5612 5613 if (auto *LB = dyn_cast<DILexicalBlockBase>(LocalScope)) 5614 return getSubprogram(LB->getRawScope()); 5615 5616 // Just return null; broken scope chains are checked elsewhere. 5617 assert(!isa<DILocalScope>(LocalScope) && "Unknown type of local scope"); 5618 return nullptr; 5619 } 5620 5621 void Verifier::visitVPIntrinsic(VPIntrinsic &VPI) { 5622 if (auto *VPCast = dyn_cast<VPCastIntrinsic>(&VPI)) { 5623 auto *RetTy = cast<VectorType>(VPCast->getType()); 5624 auto *ValTy = cast<VectorType>(VPCast->getOperand(0)->getType()); 5625 Check(RetTy->getElementCount() == ValTy->getElementCount(), 5626 "VP cast intrinsic first argument and result vector lengths must be " 5627 "equal", 5628 *VPCast); 5629 5630 switch (VPCast->getIntrinsicID()) { 5631 default: 5632 llvm_unreachable("Unknown VP cast intrinsic"); 5633 case Intrinsic::vp_trunc: 5634 Check(RetTy->isIntOrIntVectorTy() && ValTy->isIntOrIntVectorTy(), 5635 "llvm.vp.trunc intrinsic first argument and result element type " 5636 "must be integer", 5637 *VPCast); 5638 Check(RetTy->getScalarSizeInBits() < ValTy->getScalarSizeInBits(), 5639 "llvm.vp.trunc intrinsic the bit size of first argument must be " 5640 "larger than the bit size of the return type", 5641 *VPCast); 5642 break; 5643 case Intrinsic::vp_zext: 5644 case Intrinsic::vp_sext: 5645 Check(RetTy->isIntOrIntVectorTy() && ValTy->isIntOrIntVectorTy(), 5646 "llvm.vp.zext or llvm.vp.sext intrinsic first argument and result " 5647 "element type must be integer", 5648 *VPCast); 5649 Check(RetTy->getScalarSizeInBits() > ValTy->getScalarSizeInBits(), 5650 "llvm.vp.zext or llvm.vp.sext intrinsic the bit size of first " 5651 "argument must be smaller than the bit size of the return type", 5652 *VPCast); 5653 break; 5654 case Intrinsic::vp_fptoui: 5655 case Intrinsic::vp_fptosi: 5656 Check( 5657 RetTy->isIntOrIntVectorTy() && ValTy->isFPOrFPVectorTy(), 5658 "llvm.vp.fptoui or llvm.vp.fptosi intrinsic first argument element " 5659 "type must be floating-point and result element type must be integer", 5660 *VPCast); 5661 break; 5662 case Intrinsic::vp_uitofp: 5663 case Intrinsic::vp_sitofp: 5664 Check( 5665 RetTy->isFPOrFPVectorTy() && ValTy->isIntOrIntVectorTy(), 5666 "llvm.vp.uitofp or llvm.vp.sitofp intrinsic first argument element " 5667 "type must be integer and result element type must be floating-point", 5668 *VPCast); 5669 break; 5670 case Intrinsic::vp_fptrunc: 5671 Check(RetTy->isFPOrFPVectorTy() && ValTy->isFPOrFPVectorTy(), 5672 "llvm.vp.fptrunc intrinsic first argument and result element type " 5673 "must be floating-point", 5674 *VPCast); 5675 Check(RetTy->getScalarSizeInBits() < ValTy->getScalarSizeInBits(), 5676 "llvm.vp.fptrunc intrinsic the bit size of first argument must be " 5677 "larger than the bit size of the return type", 5678 *VPCast); 5679 break; 5680 case Intrinsic::vp_fpext: 5681 Check(RetTy->isFPOrFPVectorTy() && ValTy->isFPOrFPVectorTy(), 5682 "llvm.vp.fpext intrinsic first argument and result element type " 5683 "must be floating-point", 5684 *VPCast); 5685 Check(RetTy->getScalarSizeInBits() > ValTy->getScalarSizeInBits(), 5686 "llvm.vp.fpext intrinsic the bit size of first argument must be " 5687 "smaller than the bit size of the return type", 5688 *VPCast); 5689 break; 5690 case Intrinsic::vp_ptrtoint: 5691 Check(RetTy->isIntOrIntVectorTy() && ValTy->isPtrOrPtrVectorTy(), 5692 "llvm.vp.ptrtoint intrinsic first argument element type must be " 5693 "pointer and result element type must be integer", 5694 *VPCast); 5695 break; 5696 case Intrinsic::vp_inttoptr: 5697 Check(RetTy->isPtrOrPtrVectorTy() && ValTy->isIntOrIntVectorTy(), 5698 "llvm.vp.inttoptr intrinsic first argument element type must be " 5699 "integer and result element type must be pointer", 5700 *VPCast); 5701 break; 5702 } 5703 } 5704 if (VPI.getIntrinsicID() == Intrinsic::vp_fcmp) { 5705 auto Pred = cast<VPCmpIntrinsic>(&VPI)->getPredicate(); 5706 Check(CmpInst::isFPPredicate(Pred), 5707 "invalid predicate for VP FP comparison intrinsic", &VPI); 5708 } 5709 if (VPI.getIntrinsicID() == Intrinsic::vp_icmp) { 5710 auto Pred = cast<VPCmpIntrinsic>(&VPI)->getPredicate(); 5711 Check(CmpInst::isIntPredicate(Pred), 5712 "invalid predicate for VP integer comparison intrinsic", &VPI); 5713 } 5714 } 5715 5716 void Verifier::visitConstrainedFPIntrinsic(ConstrainedFPIntrinsic &FPI) { 5717 unsigned NumOperands; 5718 bool HasRoundingMD; 5719 switch (FPI.getIntrinsicID()) { 5720 #define INSTRUCTION(NAME, NARG, ROUND_MODE, INTRINSIC) \ 5721 case Intrinsic::INTRINSIC: \ 5722 NumOperands = NARG; \ 5723 HasRoundingMD = ROUND_MODE; \ 5724 break; 5725 #include "llvm/IR/ConstrainedOps.def" 5726 default: 5727 llvm_unreachable("Invalid constrained FP intrinsic!"); 5728 } 5729 NumOperands += (1 + HasRoundingMD); 5730 // Compare intrinsics carry an extra predicate metadata operand. 5731 if (isa<ConstrainedFPCmpIntrinsic>(FPI)) 5732 NumOperands += 1; 5733 Check((FPI.arg_size() == NumOperands), 5734 "invalid arguments for constrained FP intrinsic", &FPI); 5735 5736 switch (FPI.getIntrinsicID()) { 5737 case Intrinsic::experimental_constrained_lrint: 5738 case Intrinsic::experimental_constrained_llrint: { 5739 Type *ValTy = FPI.getArgOperand(0)->getType(); 5740 Type *ResultTy = FPI.getType(); 5741 Check(!ValTy->isVectorTy() && !ResultTy->isVectorTy(), 5742 "Intrinsic does not support vectors", &FPI); 5743 } 5744 break; 5745 5746 case Intrinsic::experimental_constrained_lround: 5747 case Intrinsic::experimental_constrained_llround: { 5748 Type *ValTy = FPI.getArgOperand(0)->getType(); 5749 Type *ResultTy = FPI.getType(); 5750 Check(!ValTy->isVectorTy() && !ResultTy->isVectorTy(), 5751 "Intrinsic does not support vectors", &FPI); 5752 break; 5753 } 5754 5755 case Intrinsic::experimental_constrained_fcmp: 5756 case Intrinsic::experimental_constrained_fcmps: { 5757 auto Pred = cast<ConstrainedFPCmpIntrinsic>(&FPI)->getPredicate(); 5758 Check(CmpInst::isFPPredicate(Pred), 5759 "invalid predicate for constrained FP comparison intrinsic", &FPI); 5760 break; 5761 } 5762 5763 case Intrinsic::experimental_constrained_fptosi: 5764 case Intrinsic::experimental_constrained_fptoui: { 5765 Value *Operand = FPI.getArgOperand(0); 5766 uint64_t NumSrcElem = 0; 5767 Check(Operand->getType()->isFPOrFPVectorTy(), 5768 "Intrinsic first argument must be floating point", &FPI); 5769 if (auto *OperandT = dyn_cast<VectorType>(Operand->getType())) { 5770 NumSrcElem = cast<FixedVectorType>(OperandT)->getNumElements(); 5771 } 5772 5773 Operand = &FPI; 5774 Check((NumSrcElem > 0) == Operand->getType()->isVectorTy(), 5775 "Intrinsic first argument and result disagree on vector use", &FPI); 5776 Check(Operand->getType()->isIntOrIntVectorTy(), 5777 "Intrinsic result must be an integer", &FPI); 5778 if (auto *OperandT = dyn_cast<VectorType>(Operand->getType())) { 5779 Check(NumSrcElem == cast<FixedVectorType>(OperandT)->getNumElements(), 5780 "Intrinsic first argument and result vector lengths must be equal", 5781 &FPI); 5782 } 5783 } 5784 break; 5785 5786 case Intrinsic::experimental_constrained_sitofp: 5787 case Intrinsic::experimental_constrained_uitofp: { 5788 Value *Operand = FPI.getArgOperand(0); 5789 uint64_t NumSrcElem = 0; 5790 Check(Operand->getType()->isIntOrIntVectorTy(), 5791 "Intrinsic first argument must be integer", &FPI); 5792 if (auto *OperandT = dyn_cast<VectorType>(Operand->getType())) { 5793 NumSrcElem = cast<FixedVectorType>(OperandT)->getNumElements(); 5794 } 5795 5796 Operand = &FPI; 5797 Check((NumSrcElem > 0) == Operand->getType()->isVectorTy(), 5798 "Intrinsic first argument and result disagree on vector use", &FPI); 5799 Check(Operand->getType()->isFPOrFPVectorTy(), 5800 "Intrinsic result must be a floating point", &FPI); 5801 if (auto *OperandT = dyn_cast<VectorType>(Operand->getType())) { 5802 Check(NumSrcElem == cast<FixedVectorType>(OperandT)->getNumElements(), 5803 "Intrinsic first argument and result vector lengths must be equal", 5804 &FPI); 5805 } 5806 } break; 5807 5808 case Intrinsic::experimental_constrained_fptrunc: 5809 case Intrinsic::experimental_constrained_fpext: { 5810 Value *Operand = FPI.getArgOperand(0); 5811 Type *OperandTy = Operand->getType(); 5812 Value *Result = &FPI; 5813 Type *ResultTy = Result->getType(); 5814 Check(OperandTy->isFPOrFPVectorTy(), 5815 "Intrinsic first argument must be FP or FP vector", &FPI); 5816 Check(ResultTy->isFPOrFPVectorTy(), 5817 "Intrinsic result must be FP or FP vector", &FPI); 5818 Check(OperandTy->isVectorTy() == ResultTy->isVectorTy(), 5819 "Intrinsic first argument and result disagree on vector use", &FPI); 5820 if (OperandTy->isVectorTy()) { 5821 Check(cast<FixedVectorType>(OperandTy)->getNumElements() == 5822 cast<FixedVectorType>(ResultTy)->getNumElements(), 5823 "Intrinsic first argument and result vector lengths must be equal", 5824 &FPI); 5825 } 5826 if (FPI.getIntrinsicID() == Intrinsic::experimental_constrained_fptrunc) { 5827 Check(OperandTy->getScalarSizeInBits() > ResultTy->getScalarSizeInBits(), 5828 "Intrinsic first argument's type must be larger than result type", 5829 &FPI); 5830 } else { 5831 Check(OperandTy->getScalarSizeInBits() < ResultTy->getScalarSizeInBits(), 5832 "Intrinsic first argument's type must be smaller than result type", 5833 &FPI); 5834 } 5835 } 5836 break; 5837 5838 default: 5839 break; 5840 } 5841 5842 // If a non-metadata argument is passed in a metadata slot then the 5843 // error will be caught earlier when the incorrect argument doesn't 5844 // match the specification in the intrinsic call table. Thus, no 5845 // argument type check is needed here. 5846 5847 Check(FPI.getExceptionBehavior().has_value(), 5848 "invalid exception behavior argument", &FPI); 5849 if (HasRoundingMD) { 5850 Check(FPI.getRoundingMode().has_value(), "invalid rounding mode argument", 5851 &FPI); 5852 } 5853 } 5854 5855 void Verifier::visitDbgIntrinsic(StringRef Kind, DbgVariableIntrinsic &DII) { 5856 auto *MD = DII.getRawLocation(); 5857 CheckDI(isa<ValueAsMetadata>(MD) || isa<DIArgList>(MD) || 5858 (isa<MDNode>(MD) && !cast<MDNode>(MD)->getNumOperands()), 5859 "invalid llvm.dbg." + Kind + " intrinsic address/value", &DII, MD); 5860 CheckDI(isa<DILocalVariable>(DII.getRawVariable()), 5861 "invalid llvm.dbg." + Kind + " intrinsic variable", &DII, 5862 DII.getRawVariable()); 5863 CheckDI(isa<DIExpression>(DII.getRawExpression()), 5864 "invalid llvm.dbg." + Kind + " intrinsic expression", &DII, 5865 DII.getRawExpression()); 5866 5867 // Ignore broken !dbg attachments; they're checked elsewhere. 5868 if (MDNode *N = DII.getDebugLoc().getAsMDNode()) 5869 if (!isa<DILocation>(N)) 5870 return; 5871 5872 BasicBlock *BB = DII.getParent(); 5873 Function *F = BB ? BB->getParent() : nullptr; 5874 5875 // The scopes for variables and !dbg attachments must agree. 5876 DILocalVariable *Var = DII.getVariable(); 5877 DILocation *Loc = DII.getDebugLoc(); 5878 CheckDI(Loc, "llvm.dbg." + Kind + " intrinsic requires a !dbg attachment", 5879 &DII, BB, F); 5880 5881 DISubprogram *VarSP = getSubprogram(Var->getRawScope()); 5882 DISubprogram *LocSP = getSubprogram(Loc->getRawScope()); 5883 if (!VarSP || !LocSP) 5884 return; // Broken scope chains are checked elsewhere. 5885 5886 CheckDI(VarSP == LocSP, 5887 "mismatched subprogram between llvm.dbg." + Kind + 5888 " variable and !dbg attachment", 5889 &DII, BB, F, Var, Var->getScope()->getSubprogram(), Loc, 5890 Loc->getScope()->getSubprogram()); 5891 5892 // This check is redundant with one in visitLocalVariable(). 5893 CheckDI(isType(Var->getRawType()), "invalid type ref", Var, 5894 Var->getRawType()); 5895 verifyFnArgs(DII); 5896 } 5897 5898 void Verifier::visitDbgLabelIntrinsic(StringRef Kind, DbgLabelInst &DLI) { 5899 CheckDI(isa<DILabel>(DLI.getRawLabel()), 5900 "invalid llvm.dbg." + Kind + " intrinsic variable", &DLI, 5901 DLI.getRawLabel()); 5902 5903 // Ignore broken !dbg attachments; they're checked elsewhere. 5904 if (MDNode *N = DLI.getDebugLoc().getAsMDNode()) 5905 if (!isa<DILocation>(N)) 5906 return; 5907 5908 BasicBlock *BB = DLI.getParent(); 5909 Function *F = BB ? BB->getParent() : nullptr; 5910 5911 // The scopes for variables and !dbg attachments must agree. 5912 DILabel *Label = DLI.getLabel(); 5913 DILocation *Loc = DLI.getDebugLoc(); 5914 Check(Loc, "llvm.dbg." + Kind + " intrinsic requires a !dbg attachment", &DLI, 5915 BB, F); 5916 5917 DISubprogram *LabelSP = getSubprogram(Label->getRawScope()); 5918 DISubprogram *LocSP = getSubprogram(Loc->getRawScope()); 5919 if (!LabelSP || !LocSP) 5920 return; 5921 5922 CheckDI(LabelSP == LocSP, 5923 "mismatched subprogram between llvm.dbg." + Kind + 5924 " label and !dbg attachment", 5925 &DLI, BB, F, Label, Label->getScope()->getSubprogram(), Loc, 5926 Loc->getScope()->getSubprogram()); 5927 } 5928 5929 void Verifier::verifyFragmentExpression(const DbgVariableIntrinsic &I) { 5930 DILocalVariable *V = dyn_cast_or_null<DILocalVariable>(I.getRawVariable()); 5931 DIExpression *E = dyn_cast_or_null<DIExpression>(I.getRawExpression()); 5932 5933 // We don't know whether this intrinsic verified correctly. 5934 if (!V || !E || !E->isValid()) 5935 return; 5936 5937 // Nothing to do if this isn't a DW_OP_LLVM_fragment expression. 5938 auto Fragment = E->getFragmentInfo(); 5939 if (!Fragment) 5940 return; 5941 5942 // The frontend helps out GDB by emitting the members of local anonymous 5943 // unions as artificial local variables with shared storage. When SROA splits 5944 // the storage for artificial local variables that are smaller than the entire 5945 // union, the overhang piece will be outside of the allotted space for the 5946 // variable and this check fails. 5947 // FIXME: Remove this check as soon as clang stops doing this; it hides bugs. 5948 if (V->isArtificial()) 5949 return; 5950 5951 verifyFragmentExpression(*V, *Fragment, &I); 5952 } 5953 5954 template <typename ValueOrMetadata> 5955 void Verifier::verifyFragmentExpression(const DIVariable &V, 5956 DIExpression::FragmentInfo Fragment, 5957 ValueOrMetadata *Desc) { 5958 // If there's no size, the type is broken, but that should be checked 5959 // elsewhere. 5960 auto VarSize = V.getSizeInBits(); 5961 if (!VarSize) 5962 return; 5963 5964 unsigned FragSize = Fragment.SizeInBits; 5965 unsigned FragOffset = Fragment.OffsetInBits; 5966 CheckDI(FragSize + FragOffset <= *VarSize, 5967 "fragment is larger than or outside of variable", Desc, &V); 5968 CheckDI(FragSize != *VarSize, "fragment covers entire variable", Desc, &V); 5969 } 5970 5971 void Verifier::verifyFnArgs(const DbgVariableIntrinsic &I) { 5972 // This function does not take the scope of noninlined function arguments into 5973 // account. Don't run it if current function is nodebug, because it may 5974 // contain inlined debug intrinsics. 5975 if (!HasDebugInfo) 5976 return; 5977 5978 // For performance reasons only check non-inlined ones. 5979 if (I.getDebugLoc()->getInlinedAt()) 5980 return; 5981 5982 DILocalVariable *Var = I.getVariable(); 5983 CheckDI(Var, "dbg intrinsic without variable"); 5984 5985 unsigned ArgNo = Var->getArg(); 5986 if (!ArgNo) 5987 return; 5988 5989 // Verify there are no duplicate function argument debug info entries. 5990 // These will cause hard-to-debug assertions in the DWARF backend. 5991 if (DebugFnArgs.size() < ArgNo) 5992 DebugFnArgs.resize(ArgNo, nullptr); 5993 5994 auto *Prev = DebugFnArgs[ArgNo - 1]; 5995 DebugFnArgs[ArgNo - 1] = Var; 5996 CheckDI(!Prev || (Prev == Var), "conflicting debug info for argument", &I, 5997 Prev, Var); 5998 } 5999 6000 void Verifier::verifyNotEntryValue(const DbgVariableIntrinsic &I) { 6001 DIExpression *E = dyn_cast_or_null<DIExpression>(I.getRawExpression()); 6002 6003 // We don't know whether this intrinsic verified correctly. 6004 if (!E || !E->isValid()) 6005 return; 6006 6007 CheckDI(!E->isEntryValue(), "Entry values are only allowed in MIR", &I); 6008 } 6009 6010 void Verifier::verifyCompileUnits() { 6011 // When more than one Module is imported into the same context, such as during 6012 // an LTO build before linking the modules, ODR type uniquing may cause types 6013 // to point to a different CU. This check does not make sense in this case. 6014 if (M.getContext().isODRUniquingDebugTypes()) 6015 return; 6016 auto *CUs = M.getNamedMetadata("llvm.dbg.cu"); 6017 SmallPtrSet<const Metadata *, 2> Listed; 6018 if (CUs) 6019 Listed.insert(CUs->op_begin(), CUs->op_end()); 6020 for (auto *CU : CUVisited) 6021 CheckDI(Listed.count(CU), "DICompileUnit not listed in llvm.dbg.cu", CU); 6022 CUVisited.clear(); 6023 } 6024 6025 void Verifier::verifyDeoptimizeCallingConvs() { 6026 if (DeoptimizeDeclarations.empty()) 6027 return; 6028 6029 const Function *First = DeoptimizeDeclarations[0]; 6030 for (auto *F : makeArrayRef(DeoptimizeDeclarations).slice(1)) { 6031 Check(First->getCallingConv() == F->getCallingConv(), 6032 "All llvm.experimental.deoptimize declarations must have the same " 6033 "calling convention", 6034 First, F); 6035 } 6036 } 6037 6038 void Verifier::verifyAttachedCallBundle(const CallBase &Call, 6039 const OperandBundleUse &BU) { 6040 FunctionType *FTy = Call.getFunctionType(); 6041 6042 Check((FTy->getReturnType()->isPointerTy() || 6043 (Call.doesNotReturn() && FTy->getReturnType()->isVoidTy())), 6044 "a call with operand bundle \"clang.arc.attachedcall\" must call a " 6045 "function returning a pointer or a non-returning function that has a " 6046 "void return type", 6047 Call); 6048 6049 Check(BU.Inputs.size() == 1 && isa<Function>(BU.Inputs.front()), 6050 "operand bundle \"clang.arc.attachedcall\" requires one function as " 6051 "an argument", 6052 Call); 6053 6054 auto *Fn = cast<Function>(BU.Inputs.front()); 6055 Intrinsic::ID IID = Fn->getIntrinsicID(); 6056 6057 if (IID) { 6058 Check((IID == Intrinsic::objc_retainAutoreleasedReturnValue || 6059 IID == Intrinsic::objc_unsafeClaimAutoreleasedReturnValue), 6060 "invalid function argument", Call); 6061 } else { 6062 StringRef FnName = Fn->getName(); 6063 Check((FnName == "objc_retainAutoreleasedReturnValue" || 6064 FnName == "objc_unsafeClaimAutoreleasedReturnValue"), 6065 "invalid function argument", Call); 6066 } 6067 } 6068 6069 void Verifier::verifySourceDebugInfo(const DICompileUnit &U, const DIFile &F) { 6070 bool HasSource = F.getSource().has_value(); 6071 if (!HasSourceDebugInfo.count(&U)) 6072 HasSourceDebugInfo[&U] = HasSource; 6073 CheckDI(HasSource == HasSourceDebugInfo[&U], 6074 "inconsistent use of embedded source"); 6075 } 6076 6077 void Verifier::verifyNoAliasScopeDecl() { 6078 if (NoAliasScopeDecls.empty()) 6079 return; 6080 6081 // only a single scope must be declared at a time. 6082 for (auto *II : NoAliasScopeDecls) { 6083 assert(II->getIntrinsicID() == Intrinsic::experimental_noalias_scope_decl && 6084 "Not a llvm.experimental.noalias.scope.decl ?"); 6085 const auto *ScopeListMV = dyn_cast<MetadataAsValue>( 6086 II->getOperand(Intrinsic::NoAliasScopeDeclScopeArg)); 6087 Check(ScopeListMV != nullptr, 6088 "llvm.experimental.noalias.scope.decl must have a MetadataAsValue " 6089 "argument", 6090 II); 6091 6092 const auto *ScopeListMD = dyn_cast<MDNode>(ScopeListMV->getMetadata()); 6093 Check(ScopeListMD != nullptr, "!id.scope.list must point to an MDNode", II); 6094 Check(ScopeListMD->getNumOperands() == 1, 6095 "!id.scope.list must point to a list with a single scope", II); 6096 visitAliasScopeListMetadata(ScopeListMD); 6097 } 6098 6099 // Only check the domination rule when requested. Once all passes have been 6100 // adapted this option can go away. 6101 if (!VerifyNoAliasScopeDomination) 6102 return; 6103 6104 // Now sort the intrinsics based on the scope MDNode so that declarations of 6105 // the same scopes are next to each other. 6106 auto GetScope = [](IntrinsicInst *II) { 6107 const auto *ScopeListMV = cast<MetadataAsValue>( 6108 II->getOperand(Intrinsic::NoAliasScopeDeclScopeArg)); 6109 return &cast<MDNode>(ScopeListMV->getMetadata())->getOperand(0); 6110 }; 6111 6112 // We are sorting on MDNode pointers here. For valid input IR this is ok. 6113 // TODO: Sort on Metadata ID to avoid non-deterministic error messages. 6114 auto Compare = [GetScope](IntrinsicInst *Lhs, IntrinsicInst *Rhs) { 6115 return GetScope(Lhs) < GetScope(Rhs); 6116 }; 6117 6118 llvm::sort(NoAliasScopeDecls, Compare); 6119 6120 // Go over the intrinsics and check that for the same scope, they are not 6121 // dominating each other. 6122 auto ItCurrent = NoAliasScopeDecls.begin(); 6123 while (ItCurrent != NoAliasScopeDecls.end()) { 6124 auto CurScope = GetScope(*ItCurrent); 6125 auto ItNext = ItCurrent; 6126 do { 6127 ++ItNext; 6128 } while (ItNext != NoAliasScopeDecls.end() && 6129 GetScope(*ItNext) == CurScope); 6130 6131 // [ItCurrent, ItNext) represents the declarations for the same scope. 6132 // Ensure they are not dominating each other.. but only if it is not too 6133 // expensive. 6134 if (ItNext - ItCurrent < 32) 6135 for (auto *I : llvm::make_range(ItCurrent, ItNext)) 6136 for (auto *J : llvm::make_range(ItCurrent, ItNext)) 6137 if (I != J) 6138 Check(!DT.dominates(I, J), 6139 "llvm.experimental.noalias.scope.decl dominates another one " 6140 "with the same scope", 6141 I); 6142 ItCurrent = ItNext; 6143 } 6144 } 6145 6146 //===----------------------------------------------------------------------===// 6147 // Implement the public interfaces to this file... 6148 //===----------------------------------------------------------------------===// 6149 6150 bool llvm::verifyFunction(const Function &f, raw_ostream *OS) { 6151 Function &F = const_cast<Function &>(f); 6152 6153 // Don't use a raw_null_ostream. Printing IR is expensive. 6154 Verifier V(OS, /*ShouldTreatBrokenDebugInfoAsError=*/true, *f.getParent()); 6155 6156 // Note that this function's return value is inverted from what you would 6157 // expect of a function called "verify". 6158 return !V.verify(F); 6159 } 6160 6161 bool llvm::verifyModule(const Module &M, raw_ostream *OS, 6162 bool *BrokenDebugInfo) { 6163 // Don't use a raw_null_ostream. Printing IR is expensive. 6164 Verifier V(OS, /*ShouldTreatBrokenDebugInfoAsError=*/!BrokenDebugInfo, M); 6165 6166 bool Broken = false; 6167 for (const Function &F : M) 6168 Broken |= !V.verify(F); 6169 6170 Broken |= !V.verify(); 6171 if (BrokenDebugInfo) 6172 *BrokenDebugInfo = V.hasBrokenDebugInfo(); 6173 // Note that this function's return value is inverted from what you would 6174 // expect of a function called "verify". 6175 return Broken; 6176 } 6177 6178 namespace { 6179 6180 struct VerifierLegacyPass : public FunctionPass { 6181 static char ID; 6182 6183 std::unique_ptr<Verifier> V; 6184 bool FatalErrors = true; 6185 6186 VerifierLegacyPass() : FunctionPass(ID) { 6187 initializeVerifierLegacyPassPass(*PassRegistry::getPassRegistry()); 6188 } 6189 explicit VerifierLegacyPass(bool FatalErrors) 6190 : FunctionPass(ID), 6191 FatalErrors(FatalErrors) { 6192 initializeVerifierLegacyPassPass(*PassRegistry::getPassRegistry()); 6193 } 6194 6195 bool doInitialization(Module &M) override { 6196 V = std::make_unique<Verifier>( 6197 &dbgs(), /*ShouldTreatBrokenDebugInfoAsError=*/false, M); 6198 return false; 6199 } 6200 6201 bool runOnFunction(Function &F) override { 6202 if (!V->verify(F) && FatalErrors) { 6203 errs() << "in function " << F.getName() << '\n'; 6204 report_fatal_error("Broken function found, compilation aborted!"); 6205 } 6206 return false; 6207 } 6208 6209 bool doFinalization(Module &M) override { 6210 bool HasErrors = false; 6211 for (Function &F : M) 6212 if (F.isDeclaration()) 6213 HasErrors |= !V->verify(F); 6214 6215 HasErrors |= !V->verify(); 6216 if (FatalErrors && (HasErrors || V->hasBrokenDebugInfo())) 6217 report_fatal_error("Broken module found, compilation aborted!"); 6218 return false; 6219 } 6220 6221 void getAnalysisUsage(AnalysisUsage &AU) const override { 6222 AU.setPreservesAll(); 6223 } 6224 }; 6225 6226 } // end anonymous namespace 6227 6228 /// Helper to issue failure from the TBAA verification 6229 template <typename... Tys> void TBAAVerifier::CheckFailed(Tys &&... Args) { 6230 if (Diagnostic) 6231 return Diagnostic->CheckFailed(Args...); 6232 } 6233 6234 #define CheckTBAA(C, ...) \ 6235 do { \ 6236 if (!(C)) { \ 6237 CheckFailed(__VA_ARGS__); \ 6238 return false; \ 6239 } \ 6240 } while (false) 6241 6242 /// Verify that \p BaseNode can be used as the "base type" in the struct-path 6243 /// TBAA scheme. This means \p BaseNode is either a scalar node, or a 6244 /// struct-type node describing an aggregate data structure (like a struct). 6245 TBAAVerifier::TBAABaseNodeSummary 6246 TBAAVerifier::verifyTBAABaseNode(Instruction &I, const MDNode *BaseNode, 6247 bool IsNewFormat) { 6248 if (BaseNode->getNumOperands() < 2) { 6249 CheckFailed("Base nodes must have at least two operands", &I, BaseNode); 6250 return {true, ~0u}; 6251 } 6252 6253 auto Itr = TBAABaseNodes.find(BaseNode); 6254 if (Itr != TBAABaseNodes.end()) 6255 return Itr->second; 6256 6257 auto Result = verifyTBAABaseNodeImpl(I, BaseNode, IsNewFormat); 6258 auto InsertResult = TBAABaseNodes.insert({BaseNode, Result}); 6259 (void)InsertResult; 6260 assert(InsertResult.second && "We just checked!"); 6261 return Result; 6262 } 6263 6264 TBAAVerifier::TBAABaseNodeSummary 6265 TBAAVerifier::verifyTBAABaseNodeImpl(Instruction &I, const MDNode *BaseNode, 6266 bool IsNewFormat) { 6267 const TBAAVerifier::TBAABaseNodeSummary InvalidNode = {true, ~0u}; 6268 6269 if (BaseNode->getNumOperands() == 2) { 6270 // Scalar nodes can only be accessed at offset 0. 6271 return isValidScalarTBAANode(BaseNode) 6272 ? TBAAVerifier::TBAABaseNodeSummary({false, 0}) 6273 : InvalidNode; 6274 } 6275 6276 if (IsNewFormat) { 6277 if (BaseNode->getNumOperands() % 3 != 0) { 6278 CheckFailed("Access tag nodes must have the number of operands that is a " 6279 "multiple of 3!", BaseNode); 6280 return InvalidNode; 6281 } 6282 } else { 6283 if (BaseNode->getNumOperands() % 2 != 1) { 6284 CheckFailed("Struct tag nodes must have an odd number of operands!", 6285 BaseNode); 6286 return InvalidNode; 6287 } 6288 } 6289 6290 // Check the type size field. 6291 if (IsNewFormat) { 6292 auto *TypeSizeNode = mdconst::dyn_extract_or_null<ConstantInt>( 6293 BaseNode->getOperand(1)); 6294 if (!TypeSizeNode) { 6295 CheckFailed("Type size nodes must be constants!", &I, BaseNode); 6296 return InvalidNode; 6297 } 6298 } 6299 6300 // Check the type name field. In the new format it can be anything. 6301 if (!IsNewFormat && !isa<MDString>(BaseNode->getOperand(0))) { 6302 CheckFailed("Struct tag nodes have a string as their first operand", 6303 BaseNode); 6304 return InvalidNode; 6305 } 6306 6307 bool Failed = false; 6308 6309 Optional<APInt> PrevOffset; 6310 unsigned BitWidth = ~0u; 6311 6312 // We've already checked that BaseNode is not a degenerate root node with one 6313 // operand in \c verifyTBAABaseNode, so this loop should run at least once. 6314 unsigned FirstFieldOpNo = IsNewFormat ? 3 : 1; 6315 unsigned NumOpsPerField = IsNewFormat ? 3 : 2; 6316 for (unsigned Idx = FirstFieldOpNo; Idx < BaseNode->getNumOperands(); 6317 Idx += NumOpsPerField) { 6318 const MDOperand &FieldTy = BaseNode->getOperand(Idx); 6319 const MDOperand &FieldOffset = BaseNode->getOperand(Idx + 1); 6320 if (!isa<MDNode>(FieldTy)) { 6321 CheckFailed("Incorrect field entry in struct type node!", &I, BaseNode); 6322 Failed = true; 6323 continue; 6324 } 6325 6326 auto *OffsetEntryCI = 6327 mdconst::dyn_extract_or_null<ConstantInt>(FieldOffset); 6328 if (!OffsetEntryCI) { 6329 CheckFailed("Offset entries must be constants!", &I, BaseNode); 6330 Failed = true; 6331 continue; 6332 } 6333 6334 if (BitWidth == ~0u) 6335 BitWidth = OffsetEntryCI->getBitWidth(); 6336 6337 if (OffsetEntryCI->getBitWidth() != BitWidth) { 6338 CheckFailed( 6339 "Bitwidth between the offsets and struct type entries must match", &I, 6340 BaseNode); 6341 Failed = true; 6342 continue; 6343 } 6344 6345 // NB! As far as I can tell, we generate a non-strictly increasing offset 6346 // sequence only from structs that have zero size bit fields. When 6347 // recursing into a contained struct in \c getFieldNodeFromTBAABaseNode we 6348 // pick the field lexically the latest in struct type metadata node. This 6349 // mirrors the actual behavior of the alias analysis implementation. 6350 bool IsAscending = 6351 !PrevOffset || PrevOffset->ule(OffsetEntryCI->getValue()); 6352 6353 if (!IsAscending) { 6354 CheckFailed("Offsets must be increasing!", &I, BaseNode); 6355 Failed = true; 6356 } 6357 6358 PrevOffset = OffsetEntryCI->getValue(); 6359 6360 if (IsNewFormat) { 6361 auto *MemberSizeNode = mdconst::dyn_extract_or_null<ConstantInt>( 6362 BaseNode->getOperand(Idx + 2)); 6363 if (!MemberSizeNode) { 6364 CheckFailed("Member size entries must be constants!", &I, BaseNode); 6365 Failed = true; 6366 continue; 6367 } 6368 } 6369 } 6370 6371 return Failed ? InvalidNode 6372 : TBAAVerifier::TBAABaseNodeSummary(false, BitWidth); 6373 } 6374 6375 static bool IsRootTBAANode(const MDNode *MD) { 6376 return MD->getNumOperands() < 2; 6377 } 6378 6379 static bool IsScalarTBAANodeImpl(const MDNode *MD, 6380 SmallPtrSetImpl<const MDNode *> &Visited) { 6381 if (MD->getNumOperands() != 2 && MD->getNumOperands() != 3) 6382 return false; 6383 6384 if (!isa<MDString>(MD->getOperand(0))) 6385 return false; 6386 6387 if (MD->getNumOperands() == 3) { 6388 auto *Offset = mdconst::dyn_extract<ConstantInt>(MD->getOperand(2)); 6389 if (!(Offset && Offset->isZero() && isa<MDString>(MD->getOperand(0)))) 6390 return false; 6391 } 6392 6393 auto *Parent = dyn_cast_or_null<MDNode>(MD->getOperand(1)); 6394 return Parent && Visited.insert(Parent).second && 6395 (IsRootTBAANode(Parent) || IsScalarTBAANodeImpl(Parent, Visited)); 6396 } 6397 6398 bool TBAAVerifier::isValidScalarTBAANode(const MDNode *MD) { 6399 auto ResultIt = TBAAScalarNodes.find(MD); 6400 if (ResultIt != TBAAScalarNodes.end()) 6401 return ResultIt->second; 6402 6403 SmallPtrSet<const MDNode *, 4> Visited; 6404 bool Result = IsScalarTBAANodeImpl(MD, Visited); 6405 auto InsertResult = TBAAScalarNodes.insert({MD, Result}); 6406 (void)InsertResult; 6407 assert(InsertResult.second && "Just checked!"); 6408 6409 return Result; 6410 } 6411 6412 /// Returns the field node at the offset \p Offset in \p BaseNode. Update \p 6413 /// Offset in place to be the offset within the field node returned. 6414 /// 6415 /// We assume we've okayed \p BaseNode via \c verifyTBAABaseNode. 6416 MDNode *TBAAVerifier::getFieldNodeFromTBAABaseNode(Instruction &I, 6417 const MDNode *BaseNode, 6418 APInt &Offset, 6419 bool IsNewFormat) { 6420 assert(BaseNode->getNumOperands() >= 2 && "Invalid base node!"); 6421 6422 // Scalar nodes have only one possible "field" -- their parent in the access 6423 // hierarchy. Offset must be zero at this point, but our caller is supposed 6424 // to check that. 6425 if (BaseNode->getNumOperands() == 2) 6426 return cast<MDNode>(BaseNode->getOperand(1)); 6427 6428 unsigned FirstFieldOpNo = IsNewFormat ? 3 : 1; 6429 unsigned NumOpsPerField = IsNewFormat ? 3 : 2; 6430 for (unsigned Idx = FirstFieldOpNo; Idx < BaseNode->getNumOperands(); 6431 Idx += NumOpsPerField) { 6432 auto *OffsetEntryCI = 6433 mdconst::extract<ConstantInt>(BaseNode->getOperand(Idx + 1)); 6434 if (OffsetEntryCI->getValue().ugt(Offset)) { 6435 if (Idx == FirstFieldOpNo) { 6436 CheckFailed("Could not find TBAA parent in struct type node", &I, 6437 BaseNode, &Offset); 6438 return nullptr; 6439 } 6440 6441 unsigned PrevIdx = Idx - NumOpsPerField; 6442 auto *PrevOffsetEntryCI = 6443 mdconst::extract<ConstantInt>(BaseNode->getOperand(PrevIdx + 1)); 6444 Offset -= PrevOffsetEntryCI->getValue(); 6445 return cast<MDNode>(BaseNode->getOperand(PrevIdx)); 6446 } 6447 } 6448 6449 unsigned LastIdx = BaseNode->getNumOperands() - NumOpsPerField; 6450 auto *LastOffsetEntryCI = mdconst::extract<ConstantInt>( 6451 BaseNode->getOperand(LastIdx + 1)); 6452 Offset -= LastOffsetEntryCI->getValue(); 6453 return cast<MDNode>(BaseNode->getOperand(LastIdx)); 6454 } 6455 6456 static bool isNewFormatTBAATypeNode(llvm::MDNode *Type) { 6457 if (!Type || Type->getNumOperands() < 3) 6458 return false; 6459 6460 // In the new format type nodes shall have a reference to the parent type as 6461 // its first operand. 6462 return isa_and_nonnull<MDNode>(Type->getOperand(0)); 6463 } 6464 6465 bool TBAAVerifier::visitTBAAMetadata(Instruction &I, const MDNode *MD) { 6466 CheckTBAA(isa<LoadInst>(I) || isa<StoreInst>(I) || isa<CallInst>(I) || 6467 isa<VAArgInst>(I) || isa<AtomicRMWInst>(I) || 6468 isa<AtomicCmpXchgInst>(I), 6469 "This instruction shall not have a TBAA access tag!", &I); 6470 6471 bool IsStructPathTBAA = 6472 isa<MDNode>(MD->getOperand(0)) && MD->getNumOperands() >= 3; 6473 6474 CheckTBAA(IsStructPathTBAA, 6475 "Old-style TBAA is no longer allowed, use struct-path TBAA instead", 6476 &I); 6477 6478 MDNode *BaseNode = dyn_cast_or_null<MDNode>(MD->getOperand(0)); 6479 MDNode *AccessType = dyn_cast_or_null<MDNode>(MD->getOperand(1)); 6480 6481 bool IsNewFormat = isNewFormatTBAATypeNode(AccessType); 6482 6483 if (IsNewFormat) { 6484 CheckTBAA(MD->getNumOperands() == 4 || MD->getNumOperands() == 5, 6485 "Access tag metadata must have either 4 or 5 operands", &I, MD); 6486 } else { 6487 CheckTBAA(MD->getNumOperands() < 5, 6488 "Struct tag metadata must have either 3 or 4 operands", &I, MD); 6489 } 6490 6491 // Check the access size field. 6492 if (IsNewFormat) { 6493 auto *AccessSizeNode = mdconst::dyn_extract_or_null<ConstantInt>( 6494 MD->getOperand(3)); 6495 CheckTBAA(AccessSizeNode, "Access size field must be a constant", &I, MD); 6496 } 6497 6498 // Check the immutability flag. 6499 unsigned ImmutabilityFlagOpNo = IsNewFormat ? 4 : 3; 6500 if (MD->getNumOperands() == ImmutabilityFlagOpNo + 1) { 6501 auto *IsImmutableCI = mdconst::dyn_extract_or_null<ConstantInt>( 6502 MD->getOperand(ImmutabilityFlagOpNo)); 6503 CheckTBAA(IsImmutableCI, 6504 "Immutability tag on struct tag metadata must be a constant", &I, 6505 MD); 6506 CheckTBAA( 6507 IsImmutableCI->isZero() || IsImmutableCI->isOne(), 6508 "Immutability part of the struct tag metadata must be either 0 or 1", 6509 &I, MD); 6510 } 6511 6512 CheckTBAA(BaseNode && AccessType, 6513 "Malformed struct tag metadata: base and access-type " 6514 "should be non-null and point to Metadata nodes", 6515 &I, MD, BaseNode, AccessType); 6516 6517 if (!IsNewFormat) { 6518 CheckTBAA(isValidScalarTBAANode(AccessType), 6519 "Access type node must be a valid scalar type", &I, MD, 6520 AccessType); 6521 } 6522 6523 auto *OffsetCI = mdconst::dyn_extract_or_null<ConstantInt>(MD->getOperand(2)); 6524 CheckTBAA(OffsetCI, "Offset must be constant integer", &I, MD); 6525 6526 APInt Offset = OffsetCI->getValue(); 6527 bool SeenAccessTypeInPath = false; 6528 6529 SmallPtrSet<MDNode *, 4> StructPath; 6530 6531 for (/* empty */; BaseNode && !IsRootTBAANode(BaseNode); 6532 BaseNode = getFieldNodeFromTBAABaseNode(I, BaseNode, Offset, 6533 IsNewFormat)) { 6534 if (!StructPath.insert(BaseNode).second) { 6535 CheckFailed("Cycle detected in struct path", &I, MD); 6536 return false; 6537 } 6538 6539 bool Invalid; 6540 unsigned BaseNodeBitWidth; 6541 std::tie(Invalid, BaseNodeBitWidth) = verifyTBAABaseNode(I, BaseNode, 6542 IsNewFormat); 6543 6544 // If the base node is invalid in itself, then we've already printed all the 6545 // errors we wanted to print. 6546 if (Invalid) 6547 return false; 6548 6549 SeenAccessTypeInPath |= BaseNode == AccessType; 6550 6551 if (isValidScalarTBAANode(BaseNode) || BaseNode == AccessType) 6552 CheckTBAA(Offset == 0, "Offset not zero at the point of scalar access", 6553 &I, MD, &Offset); 6554 6555 CheckTBAA(BaseNodeBitWidth == Offset.getBitWidth() || 6556 (BaseNodeBitWidth == 0 && Offset == 0) || 6557 (IsNewFormat && BaseNodeBitWidth == ~0u), 6558 "Access bit-width not the same as description bit-width", &I, MD, 6559 BaseNodeBitWidth, Offset.getBitWidth()); 6560 6561 if (IsNewFormat && SeenAccessTypeInPath) 6562 break; 6563 } 6564 6565 CheckTBAA(SeenAccessTypeInPath, "Did not see access type in access path!", &I, 6566 MD); 6567 return true; 6568 } 6569 6570 char VerifierLegacyPass::ID = 0; 6571 INITIALIZE_PASS(VerifierLegacyPass, "verify", "Module Verifier", false, false) 6572 6573 FunctionPass *llvm::createVerifierPass(bool FatalErrors) { 6574 return new VerifierLegacyPass(FatalErrors); 6575 } 6576 6577 AnalysisKey VerifierAnalysis::Key; 6578 VerifierAnalysis::Result VerifierAnalysis::run(Module &M, 6579 ModuleAnalysisManager &) { 6580 Result Res; 6581 Res.IRBroken = llvm::verifyModule(M, &dbgs(), &Res.DebugInfoBroken); 6582 return Res; 6583 } 6584 6585 VerifierAnalysis::Result VerifierAnalysis::run(Function &F, 6586 FunctionAnalysisManager &) { 6587 return { llvm::verifyFunction(F, &dbgs()), false }; 6588 } 6589 6590 PreservedAnalyses VerifierPass::run(Module &M, ModuleAnalysisManager &AM) { 6591 auto Res = AM.getResult<VerifierAnalysis>(M); 6592 if (FatalErrors && (Res.IRBroken || Res.DebugInfoBroken)) 6593 report_fatal_error("Broken module found, compilation aborted!"); 6594 6595 return PreservedAnalyses::all(); 6596 } 6597 6598 PreservedAnalyses VerifierPass::run(Function &F, FunctionAnalysisManager &AM) { 6599 auto res = AM.getResult<VerifierAnalysis>(F); 6600 if (res.IRBroken && FatalErrors) 6601 report_fatal_error("Broken function found, compilation aborted!"); 6602 6603 return PreservedAnalyses::all(); 6604 } 6605