1 //===- FlatternCFG.cpp - Code to perform CFG flattening -------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Reduce conditional branches in CFG.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "llvm/ADT/SmallPtrSet.h"
14 #include "llvm/Analysis/AliasAnalysis.h"
15 #include "llvm/Transforms/Utils/Local.h"
16 #include "llvm/Analysis/ValueTracking.h"
17 #include "llvm/IR/BasicBlock.h"
18 #include "llvm/IR/IRBuilder.h"
19 #include "llvm/IR/InstrTypes.h"
20 #include "llvm/IR/Instruction.h"
21 #include "llvm/IR/Instructions.h"
22 #include "llvm/IR/Value.h"
23 #include "llvm/Support/Casting.h"
24 #include "llvm/Support/Debug.h"
25 #include "llvm/Support/raw_ostream.h"
26 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
27 #include <cassert>
28 
29 using namespace llvm;
30 
31 #define DEBUG_TYPE "flattencfg"
32 
33 namespace {
34 
35 class FlattenCFGOpt {
36   AliasAnalysis *AA;
37 
38   /// Use parallel-and or parallel-or to generate conditions for
39   /// conditional branches.
40   bool FlattenParallelAndOr(BasicBlock *BB, IRBuilder<> &Builder);
41 
42   /// If \param BB is the merge block of an if-region, attempt to merge
43   /// the if-region with an adjacent if-region upstream if two if-regions
44   /// contain identical instructions.
45   bool MergeIfRegion(BasicBlock *BB, IRBuilder<> &Builder);
46 
47   /// Compare a pair of blocks: \p Block1 and \p Block2, which
48   /// are from two if-regions whose entry blocks are \p Head1 and \p
49   /// Head2.  \returns true if \p Block1 and \p Block2 contain identical
50   /// instructions, and have no memory reference alias with \p Head2.
51   /// This is used as a legality check for merging if-regions.
52   bool CompareIfRegionBlock(BasicBlock *Head1, BasicBlock *Head2,
53                             BasicBlock *Block1, BasicBlock *Block2);
54 
55 public:
56   FlattenCFGOpt(AliasAnalysis *AA) : AA(AA) {}
57 
58   bool run(BasicBlock *BB);
59 };
60 
61 } // end anonymous namespace
62 
63 /// If \param [in] BB has more than one predecessor that is a conditional
64 /// branch, attempt to use parallel and/or for the branch condition. \returns
65 /// true on success.
66 ///
67 /// Before:
68 ///   ......
69 ///   %cmp10 = fcmp une float %tmp1, %tmp2
70 ///   br i1 %cmp10, label %if.then, label %lor.rhs
71 ///
72 /// lor.rhs:
73 ///   ......
74 ///   %cmp11 = fcmp une float %tmp3, %tmp4
75 ///   br i1 %cmp11, label %if.then, label %ifend
76 ///
77 /// if.end:  // the merge block
78 ///   ......
79 ///
80 /// if.then: // has two predecessors, both of them contains conditional branch.
81 ///   ......
82 ///   br label %if.end;
83 ///
84 /// After:
85 ///  ......
86 ///  %cmp10 = fcmp une float %tmp1, %tmp2
87 ///  ......
88 ///  %cmp11 = fcmp une float %tmp3, %tmp4
89 ///  %cmp12 = or i1 %cmp10, %cmp11    // parallel-or mode.
90 ///  br i1 %cmp12, label %if.then, label %ifend
91 ///
92 ///  if.end:
93 ///    ......
94 ///
95 ///  if.then:
96 ///    ......
97 ///    br label %if.end;
98 ///
99 ///  Current implementation handles two cases.
100 ///  Case 1: \param BB is on the else-path.
101 ///
102 ///          BB1
103 ///        /     |
104 ///       BB2    |
105 ///      /   \   |
106 ///     BB3   \  |     where, BB1, BB2 contain conditional branches.
107 ///      \    |  /     BB3 contains unconditional branch.
108 ///       \   | /      BB4 corresponds to \param BB which is also the merge.
109 ///  BB => BB4
110 ///
111 ///
112 ///  Corresponding source code:
113 ///
114 ///  if (a == b && c == d)
115 ///    statement; // BB3
116 ///
117 ///  Case 2: \param BB BB is on the then-path.
118 ///
119 ///             BB1
120 ///          /      |
121 ///         |      BB2
122 ///         \    /    |  where BB1, BB2 contain conditional branches.
123 ///  BB =>   BB3      |  BB3 contains unconditiona branch and corresponds
124 ///           \     /    to \param BB.  BB4 is the merge.
125 ///             BB4
126 ///
127 ///  Corresponding source code:
128 ///
129 ///  if (a == b || c == d)
130 ///    statement;  // BB3
131 ///
132 ///  In both cases,  \param BB is the common successor of conditional branches.
133 ///  In Case 1, \param BB (BB4) has an unconditional branch (BB3) as
134 ///  its predecessor.  In Case 2, \param BB (BB3) only has conditional branches
135 ///  as its predecessors.
136 bool FlattenCFGOpt::FlattenParallelAndOr(BasicBlock *BB, IRBuilder<> &Builder) {
137   PHINode *PHI = dyn_cast<PHINode>(BB->begin());
138   if (PHI)
139     return false; // For simplicity, avoid cases containing PHI nodes.
140 
141   BasicBlock *LastCondBlock = nullptr;
142   BasicBlock *FirstCondBlock = nullptr;
143   BasicBlock *UnCondBlock = nullptr;
144   int Idx = -1;
145 
146   // Check predecessors of \param BB.
147   SmallPtrSet<BasicBlock *, 16> Preds(pred_begin(BB), pred_end(BB));
148   for (SmallPtrSetIterator<BasicBlock *> PI = Preds.begin(), PE = Preds.end();
149        PI != PE; ++PI) {
150     BasicBlock *Pred = *PI;
151     BranchInst *PBI = dyn_cast<BranchInst>(Pred->getTerminator());
152 
153     // All predecessors should terminate with a branch.
154     if (!PBI)
155       return false;
156 
157     BasicBlock *PP = Pred->getSinglePredecessor();
158 
159     if (PBI->isUnconditional()) {
160       // Case 1: Pred (BB3) is an unconditional block, it should
161       // have a single predecessor (BB2) that is also a predecessor
162       // of \param BB (BB4) and should not have address-taken.
163       // There should exist only one such unconditional
164       // branch among the predecessors.
165       if (UnCondBlock || !PP || (Preds.count(PP) == 0) ||
166           Pred->hasAddressTaken())
167         return false;
168 
169       UnCondBlock = Pred;
170       continue;
171     }
172 
173     // Only conditional branches are allowed beyond this point.
174     assert(PBI->isConditional());
175 
176     // Condition's unique use should be the branch instruction.
177     Value *PC = PBI->getCondition();
178     if (!PC || !PC->hasOneUse())
179       return false;
180 
181     if (PP && Preds.count(PP)) {
182       // These are internal condition blocks to be merged from, e.g.,
183       // BB2 in both cases.
184       // Should not be address-taken.
185       if (Pred->hasAddressTaken())
186         return false;
187 
188       // Instructions in the internal condition blocks should be safe
189       // to hoist up.
190       for (BasicBlock::iterator BI = Pred->begin(), BE = PBI->getIterator();
191            BI != BE;) {
192         Instruction *CI = &*BI++;
193         if (isa<PHINode>(CI) || !isSafeToSpeculativelyExecute(CI))
194           return false;
195       }
196     } else {
197       // This is the condition block to be merged into, e.g. BB1 in
198       // both cases.
199       if (FirstCondBlock)
200         return false;
201       FirstCondBlock = Pred;
202     }
203 
204     // Find whether BB is uniformly on the true (or false) path
205     // for all of its predecessors.
206     BasicBlock *PS1 = PBI->getSuccessor(0);
207     BasicBlock *PS2 = PBI->getSuccessor(1);
208     BasicBlock *PS = (PS1 == BB) ? PS2 : PS1;
209     int CIdx = (PS1 == BB) ? 0 : 1;
210 
211     if (Idx == -1)
212       Idx = CIdx;
213     else if (CIdx != Idx)
214       return false;
215 
216     // PS is the successor which is not BB. Check successors to identify
217     // the last conditional branch.
218     if (Preds.count(PS) == 0) {
219       // Case 2.
220       LastCondBlock = Pred;
221     } else {
222       // Case 1
223       BranchInst *BPS = dyn_cast<BranchInst>(PS->getTerminator());
224       if (BPS && BPS->isUnconditional()) {
225         // Case 1: PS(BB3) should be an unconditional branch.
226         LastCondBlock = Pred;
227       }
228     }
229   }
230 
231   if (!FirstCondBlock || !LastCondBlock || (FirstCondBlock == LastCondBlock))
232     return false;
233 
234   Instruction *TBB = LastCondBlock->getTerminator();
235   BasicBlock *PS1 = TBB->getSuccessor(0);
236   BasicBlock *PS2 = TBB->getSuccessor(1);
237   BranchInst *PBI1 = dyn_cast<BranchInst>(PS1->getTerminator());
238   BranchInst *PBI2 = dyn_cast<BranchInst>(PS2->getTerminator());
239 
240   // If PS1 does not jump into PS2, but PS2 jumps into PS1,
241   // attempt branch inversion.
242   if (!PBI1 || !PBI1->isUnconditional() ||
243       (PS1->getTerminator()->getSuccessor(0) != PS2)) {
244     // Check whether PS2 jumps into PS1.
245     if (!PBI2 || !PBI2->isUnconditional() ||
246         (PS2->getTerminator()->getSuccessor(0) != PS1))
247       return false;
248 
249     // Do branch inversion.
250     BasicBlock *CurrBlock = LastCondBlock;
251     bool EverChanged = false;
252     for (; CurrBlock != FirstCondBlock;
253          CurrBlock = CurrBlock->getSinglePredecessor()) {
254       auto *BI = cast<BranchInst>(CurrBlock->getTerminator());
255       auto *CI = dyn_cast<CmpInst>(BI->getCondition());
256       if (!CI)
257         continue;
258 
259       CmpInst::Predicate Predicate = CI->getPredicate();
260       // Canonicalize icmp_ne -> icmp_eq, fcmp_one -> fcmp_oeq
261       if ((Predicate == CmpInst::ICMP_NE) || (Predicate == CmpInst::FCMP_ONE)) {
262         CI->setPredicate(ICmpInst::getInversePredicate(Predicate));
263         BI->swapSuccessors();
264         EverChanged = true;
265       }
266     }
267     return EverChanged;
268   }
269 
270   // PS1 must have a conditional branch.
271   if (!PBI1 || !PBI1->isUnconditional())
272     return false;
273 
274   // PS2 should not contain PHI node.
275   PHI = dyn_cast<PHINode>(PS2->begin());
276   if (PHI)
277     return false;
278 
279   // Do the transformation.
280   BasicBlock *CB;
281   BranchInst *PBI = cast<BranchInst>(FirstCondBlock->getTerminator());
282   bool Iteration = true;
283   IRBuilder<>::InsertPointGuard Guard(Builder);
284   Value *PC = PBI->getCondition();
285 
286   do {
287     CB = PBI->getSuccessor(1 - Idx);
288     // Delete the conditional branch.
289     FirstCondBlock->getInstList().pop_back();
290     FirstCondBlock->getInstList()
291         .splice(FirstCondBlock->end(), CB->getInstList());
292     PBI = cast<BranchInst>(FirstCondBlock->getTerminator());
293     Value *CC = PBI->getCondition();
294     // Merge conditions.
295     Builder.SetInsertPoint(PBI);
296     Value *NC;
297     if (Idx == 0)
298       // Case 2, use parallel or.
299       NC = Builder.CreateOr(PC, CC);
300     else
301       // Case 1, use parallel and.
302       NC = Builder.CreateAnd(PC, CC);
303 
304     PBI->replaceUsesOfWith(CC, NC);
305     PC = NC;
306     if (CB == LastCondBlock)
307       Iteration = false;
308     // Remove internal conditional branches.
309     CB->dropAllReferences();
310     // make CB unreachable and let downstream to delete the block.
311     new UnreachableInst(CB->getContext(), CB);
312   } while (Iteration);
313 
314   LLVM_DEBUG(dbgs() << "Use parallel and/or in:\n" << *FirstCondBlock);
315   return true;
316 }
317 
318 /// Compare blocks from two if-regions, where \param Head1 is the entry of the
319 /// 1st if-region. \param Head2 is the entry of the 2nd if-region. \param
320 /// Block1 is a block in the 1st if-region to compare. \param Block2 is a block
321 //  in the 2nd if-region to compare.  \returns true if \param Block1 and \param
322 /// Block2 have identical instructions and do not have memory reference alias
323 /// with \param Head2.
324 bool FlattenCFGOpt::CompareIfRegionBlock(BasicBlock *Head1, BasicBlock *Head2,
325                                          BasicBlock *Block1,
326                                          BasicBlock *Block2) {
327   Instruction *PTI2 = Head2->getTerminator();
328   Instruction *PBI2 = &Head2->front();
329 
330   bool eq1 = (Block1 == Head1);
331   bool eq2 = (Block2 == Head2);
332   if (eq1 || eq2) {
333     // An empty then-path or else-path.
334     return (eq1 == eq2);
335   }
336 
337   // Check whether instructions in Block1 and Block2 are identical
338   // and do not alias with instructions in Head2.
339   BasicBlock::iterator iter1 = Block1->begin();
340   BasicBlock::iterator end1 = Block1->getTerminator()->getIterator();
341   BasicBlock::iterator iter2 = Block2->begin();
342   BasicBlock::iterator end2 = Block2->getTerminator()->getIterator();
343 
344   while (true) {
345     if (iter1 == end1) {
346       if (iter2 != end2)
347         return false;
348       break;
349     }
350 
351     if (!iter1->isIdenticalTo(&*iter2))
352       return false;
353 
354     // Illegal to remove instructions with side effects except
355     // non-volatile stores.
356     if (iter1->mayHaveSideEffects()) {
357       Instruction *CurI = &*iter1;
358       StoreInst *SI = dyn_cast<StoreInst>(CurI);
359       if (!SI || SI->isVolatile())
360         return false;
361     }
362 
363     // For simplicity and speed, data dependency check can be
364     // avoided if read from memory doesn't exist.
365     if (iter1->mayReadFromMemory())
366       return false;
367 
368     if (iter1->mayWriteToMemory()) {
369       for (BasicBlock::iterator BI(PBI2), BE(PTI2); BI != BE; ++BI) {
370         if (BI->mayReadFromMemory() || BI->mayWriteToMemory()) {
371           // Check alias with Head2.
372           if (!AA || AA->alias(&*iter1, &*BI))
373             return false;
374         }
375       }
376     }
377     ++iter1;
378     ++iter2;
379   }
380 
381   return true;
382 }
383 
384 /// Check whether \param BB is the merge block of a if-region.  If yes, check
385 /// whether there exists an adjacent if-region upstream, the two if-regions
386 /// contain identical instructions and can be legally merged.  \returns true if
387 /// the two if-regions are merged.
388 ///
389 /// From:
390 /// if (a)
391 ///   statement;
392 /// if (b)
393 ///   statement;
394 ///
395 /// To:
396 /// if (a || b)
397 ///   statement;
398 bool FlattenCFGOpt::MergeIfRegion(BasicBlock *BB, IRBuilder<> &Builder) {
399   BasicBlock *IfTrue2, *IfFalse2;
400   Value *IfCond2 = GetIfCondition(BB, IfTrue2, IfFalse2);
401   Instruction *CInst2 = dyn_cast_or_null<Instruction>(IfCond2);
402   if (!CInst2)
403     return false;
404 
405   BasicBlock *SecondEntryBlock = CInst2->getParent();
406   if (SecondEntryBlock->hasAddressTaken())
407     return false;
408 
409   BasicBlock *IfTrue1, *IfFalse1;
410   Value *IfCond1 = GetIfCondition(SecondEntryBlock, IfTrue1, IfFalse1);
411   Instruction *CInst1 = dyn_cast_or_null<Instruction>(IfCond1);
412   if (!CInst1)
413     return false;
414 
415   BasicBlock *FirstEntryBlock = CInst1->getParent();
416 
417   // Either then-path or else-path should be empty.
418   if ((IfTrue1 != FirstEntryBlock) && (IfFalse1 != FirstEntryBlock))
419     return false;
420   if ((IfTrue2 != SecondEntryBlock) && (IfFalse2 != SecondEntryBlock))
421     return false;
422 
423   Instruction *PTI2 = SecondEntryBlock->getTerminator();
424   Instruction *PBI2 = &SecondEntryBlock->front();
425 
426   if (!CompareIfRegionBlock(FirstEntryBlock, SecondEntryBlock, IfTrue1,
427                             IfTrue2))
428     return false;
429 
430   if (!CompareIfRegionBlock(FirstEntryBlock, SecondEntryBlock, IfFalse1,
431                             IfFalse2))
432     return false;
433 
434   // Check whether \param SecondEntryBlock has side-effect and is safe to
435   // speculate.
436   for (BasicBlock::iterator BI(PBI2), BE(PTI2); BI != BE; ++BI) {
437     Instruction *CI = &*BI;
438     if (isa<PHINode>(CI) || CI->mayHaveSideEffects() ||
439         !isSafeToSpeculativelyExecute(CI))
440       return false;
441   }
442 
443   // Merge \param SecondEntryBlock into \param FirstEntryBlock.
444   FirstEntryBlock->getInstList().pop_back();
445   FirstEntryBlock->getInstList()
446       .splice(FirstEntryBlock->end(), SecondEntryBlock->getInstList());
447   BranchInst *PBI = cast<BranchInst>(FirstEntryBlock->getTerminator());
448   Value *CC = PBI->getCondition();
449   BasicBlock *SaveInsertBB = Builder.GetInsertBlock();
450   BasicBlock::iterator SaveInsertPt = Builder.GetInsertPoint();
451   Builder.SetInsertPoint(PBI);
452   Value *NC = Builder.CreateOr(CInst1, CC);
453   PBI->replaceUsesOfWith(CC, NC);
454   Builder.SetInsertPoint(SaveInsertBB, SaveInsertPt);
455 
456   // Handle PHI node to replace its predecessors to FirstEntryBlock.
457   for (BasicBlock *Succ : successors(PBI)) {
458     for (PHINode &Phi : Succ->phis()) {
459       for (unsigned i = 0, e = Phi.getNumIncomingValues(); i != e; ++i) {
460         if (Phi.getIncomingBlock(i) == SecondEntryBlock)
461           Phi.setIncomingBlock(i, FirstEntryBlock);
462       }
463     }
464   }
465 
466   // Remove IfTrue1
467   if (IfTrue1 != FirstEntryBlock) {
468     IfTrue1->dropAllReferences();
469     IfTrue1->eraseFromParent();
470   }
471 
472   // Remove IfFalse1
473   if (IfFalse1 != FirstEntryBlock) {
474     IfFalse1->dropAllReferences();
475     IfFalse1->eraseFromParent();
476   }
477 
478   // Remove \param SecondEntryBlock
479   SecondEntryBlock->dropAllReferences();
480   SecondEntryBlock->eraseFromParent();
481   LLVM_DEBUG(dbgs() << "If conditions merged into:\n" << *FirstEntryBlock);
482   return true;
483 }
484 
485 bool FlattenCFGOpt::run(BasicBlock *BB) {
486   assert(BB && BB->getParent() && "Block not embedded in function!");
487   assert(BB->getTerminator() && "Degenerate basic block encountered!");
488 
489   IRBuilder<> Builder(BB);
490 
491   if (FlattenParallelAndOr(BB, Builder) || MergeIfRegion(BB, Builder))
492     return true;
493   return false;
494 }
495 
496 /// FlattenCFG - This function is used to flatten a CFG.  For
497 /// example, it uses parallel-and and parallel-or mode to collapse
498 /// if-conditions and merge if-regions with identical statements.
499 bool llvm::FlattenCFG(BasicBlock *BB, AliasAnalysis *AA) {
500   return FlattenCFGOpt(AA).run(BB);
501 }
502