LLVM  14.0.0git
CaptureTracking.cpp
Go to the documentation of this file.
1 //===--- CaptureTracking.cpp - Determine whether a pointer is captured ----===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file contains routines that help determine which pointers are captured.
10 // A pointer value is captured if the function makes a copy of any part of the
11 // pointer that outlives the call. Not being captured means, more or less, that
12 // the pointer is only dereferenced and not stored in a global. Returning part
13 // of the pointer as the function return value may or may not count as capturing
14 // the pointer, depending on the context.
15 //
16 //===----------------------------------------------------------------------===//
17 
19 #include "llvm/ADT/SmallSet.h"
20 #include "llvm/ADT/SmallVector.h"
21 #include "llvm/ADT/Statistic.h"
23 #include "llvm/Analysis/CFG.h"
25 #include "llvm/IR/Constants.h"
26 #include "llvm/IR/Dominators.h"
27 #include "llvm/IR/Instructions.h"
28 #include "llvm/IR/IntrinsicInst.h"
30 
31 using namespace llvm;
32 
33 #define DEBUG_TYPE "capture-tracking"
34 
35 STATISTIC(NumCaptured, "Number of pointers maybe captured");
36 STATISTIC(NumNotCaptured, "Number of pointers not captured");
37 STATISTIC(NumCapturedBefore, "Number of pointers maybe captured before");
38 STATISTIC(NumNotCapturedBefore, "Number of pointers not captured before");
39 
40 /// The default value for MaxUsesToExplore argument. It's relatively small to
41 /// keep the cost of analysis reasonable for clients like BasicAliasAnalysis,
42 /// where the results can't be cached.
43 /// TODO: we should probably introduce a caching CaptureTracking analysis and
44 /// use it where possible. The caching version can use much higher limit or
45 /// don't have this cap at all.
46 static cl::opt<unsigned>
47 DefaultMaxUsesToExplore("capture-tracking-max-uses-to-explore", cl::Hidden,
48  cl::desc("Maximal number of uses to explore."),
49  cl::init(20));
50 
53 }
54 
56 
57 bool CaptureTracker::shouldExplore(const Use *U) { return true; }
58 
60  // An inbounds GEP can either be a valid pointer (pointing into
61  // or to the end of an allocation), or be null in the default
62  // address space. So for an inbounds GEP there is no way to let
63  // the pointer escape using clever GEP hacking because doing so
64  // would make the pointer point outside of the allocated object
65  // and thus make the GEP result a poison value. Similarly, other
66  // dereferenceable pointers cannot be manipulated without producing
67  // poison.
68  if (auto *GEP = dyn_cast<GetElementPtrInst>(O))
69  if (GEP->isInBounds())
70  return true;
71  bool CanBeNull, CanBeFreed;
72  return O->getPointerDereferenceableBytes(DL, CanBeNull, CanBeFreed);
73 }
74 
75 namespace {
76  struct SimpleCaptureTracker : public CaptureTracker {
77  explicit SimpleCaptureTracker(bool ReturnCaptures)
78  : ReturnCaptures(ReturnCaptures), Captured(false) {}
79 
80  void tooManyUses() override { Captured = true; }
81 
82  bool captured(const Use *U) override {
83  if (isa<ReturnInst>(U->getUser()) && !ReturnCaptures)
84  return false;
85 
86  Captured = true;
87  return true;
88  }
89 
90  bool ReturnCaptures;
91 
92  bool Captured;
93  };
94 
95  /// Only find pointer captures which happen before the given instruction. Uses
96  /// the dominator tree to determine whether one instruction is before another.
97  /// Only support the case where the Value is defined in the same basic block
98  /// as the given instruction and the use.
99  struct CapturesBefore : public CaptureTracker {
100 
101  CapturesBefore(bool ReturnCaptures, const Instruction *I,
102  const DominatorTree *DT, bool IncludeI, const LoopInfo *LI)
103  : BeforeHere(I), DT(DT), ReturnCaptures(ReturnCaptures),
104  IncludeI(IncludeI), Captured(false), LI(LI) {}
105 
106  void tooManyUses() override { Captured = true; }
107 
108  bool isSafeToPrune(Instruction *I) {
109  if (BeforeHere == I)
110  return !IncludeI;
111 
112  // We explore this usage only if the usage can reach "BeforeHere".
113  // If use is not reachable from entry, there is no need to explore.
114  if (!DT->isReachableFromEntry(I->getParent()))
115  return true;
116 
117  // Check whether there is a path from I to BeforeHere.
118  return !isPotentiallyReachable(I, BeforeHere, nullptr, DT, LI);
119  }
120 
121  bool captured(const Use *U) override {
122  Instruction *I = cast<Instruction>(U->getUser());
123  if (isa<ReturnInst>(I) && !ReturnCaptures)
124  return false;
125 
126  // Check isSafeToPrune() here rather than in shouldExplore() to avoid
127  // an expensive reachability query for every instruction we look at.
128  // Instead we only do one for actual capturing candidates.
129  if (isSafeToPrune(I))
130  return false;
131 
132  Captured = true;
133  return true;
134  }
135 
136  const Instruction *BeforeHere;
137  const DominatorTree *DT;
138 
139  bool ReturnCaptures;
140  bool IncludeI;
141 
142  bool Captured;
143 
144  const LoopInfo *LI;
145  };
146 }
147 
148 /// PointerMayBeCaptured - Return true if this pointer value may be captured
149 /// by the enclosing function (which is required to exist). This routine can
150 /// be expensive, so consider caching the results. The boolean ReturnCaptures
151 /// specifies whether returning the value (or part of it) from the function
152 /// counts as capturing it or not. The boolean StoreCaptures specified whether
153 /// storing the value (or part of it) into memory anywhere automatically
154 /// counts as capturing it or not.
156  bool ReturnCaptures, bool StoreCaptures,
157  unsigned MaxUsesToExplore) {
158  assert(!isa<GlobalValue>(V) &&
159  "It doesn't make sense to ask whether a global is captured.");
160 
161  // TODO: If StoreCaptures is not true, we could do Fancy analysis
162  // to determine whether this store is not actually an escape point.
163  // In that case, BasicAliasAnalysis should be updated as well to
164  // take advantage of this.
165  (void)StoreCaptures;
166 
167  SimpleCaptureTracker SCT(ReturnCaptures);
168  PointerMayBeCaptured(V, &SCT, MaxUsesToExplore);
169  if (SCT.Captured)
170  ++NumCaptured;
171  else
172  ++NumNotCaptured;
173  return SCT.Captured;
174 }
175 
176 /// PointerMayBeCapturedBefore - Return true if this pointer value may be
177 /// captured by the enclosing function (which is required to exist). If a
178 /// DominatorTree is provided, only captures which happen before the given
179 /// instruction are considered. This routine can be expensive, so consider
180 /// caching the results. The boolean ReturnCaptures specifies whether
181 /// returning the value (or part of it) from the function counts as capturing
182 /// it or not. The boolean StoreCaptures specified whether storing the value
183 /// (or part of it) into memory anywhere automatically counts as capturing it
184 /// or not.
185 bool llvm::PointerMayBeCapturedBefore(const Value *V, bool ReturnCaptures,
186  bool StoreCaptures, const Instruction *I,
187  const DominatorTree *DT, bool IncludeI,
188  unsigned MaxUsesToExplore,
189  const LoopInfo *LI) {
190  assert(!isa<GlobalValue>(V) &&
191  "It doesn't make sense to ask whether a global is captured.");
192 
193  if (!DT)
194  return PointerMayBeCaptured(V, ReturnCaptures, StoreCaptures,
195  MaxUsesToExplore);
196 
197  // TODO: See comment in PointerMayBeCaptured regarding what could be done
198  // with StoreCaptures.
199 
200  CapturesBefore CB(ReturnCaptures, I, DT, IncludeI, LI);
201  PointerMayBeCaptured(V, &CB, MaxUsesToExplore);
202  if (CB.Captured)
203  ++NumCapturedBefore;
204  else
205  ++NumNotCapturedBefore;
206  return CB.Captured;
207 }
208 
210  unsigned MaxUsesToExplore) {
211  assert(V->getType()->isPointerTy() && "Capture is for pointers only!");
212  if (MaxUsesToExplore == 0)
213  MaxUsesToExplore = DefaultMaxUsesToExplore;
214 
218 
219  auto AddUses = [&](const Value *V) {
220  unsigned Count = 0;
221  for (const Use &U : V->uses()) {
222  // If there are lots of uses, conservatively say that the value
223  // is captured to avoid taking too much compile time.
224  if (Count++ >= MaxUsesToExplore) {
225  Tracker->tooManyUses();
226  return false;
227  }
228  if (!Visited.insert(&U).second)
229  continue;
230  if (!Tracker->shouldExplore(&U))
231  continue;
232  Worklist.push_back(&U);
233  }
234  return true;
235  };
236  if (!AddUses(V))
237  return;
238 
239  while (!Worklist.empty()) {
240  const Use *U = Worklist.pop_back_val();
241  Instruction *I = cast<Instruction>(U->getUser());
242 
243  switch (I->getOpcode()) {
244  case Instruction::Call:
245  case Instruction::Invoke: {
246  auto *Call = cast<CallBase>(I);
247  // Not captured if the callee is readonly, doesn't return a copy through
248  // its return value and doesn't unwind (a readonly function can leak bits
249  // by throwing an exception or not depending on the input value).
250  if (Call->onlyReadsMemory() && Call->doesNotThrow() &&
251  Call->getType()->isVoidTy())
252  break;
253 
254  // The pointer is not captured if returned pointer is not captured.
255  // NOTE: CaptureTracking users should not assume that only functions
256  // marked with nocapture do not capture. This means that places like
257  // getUnderlyingObject in ValueTracking or DecomposeGEPExpression
258  // in BasicAA also need to know about this property.
260  true)) {
261  if (!AddUses(Call))
262  return;
263  break;
264  }
265 
266  // Volatile operations effectively capture the memory location that they
267  // load and store to.
268  if (auto *MI = dyn_cast<MemIntrinsic>(Call))
269  if (MI->isVolatile())
270  if (Tracker->captured(U))
271  return;
272 
273  // Not captured if only passed via 'nocapture' arguments. Note that
274  // calling a function pointer does not in itself cause the pointer to
275  // be captured. This is a subtle point considering that (for example)
276  // the callee might return its own address. It is analogous to saying
277  // that loading a value from a pointer does not cause the pointer to be
278  // captured, even though the loaded value might be the pointer itself
279  // (think of self-referential objects).
280  if (Call->isDataOperand(U) &&
281  !Call->doesNotCapture(Call->getDataOperandNo(U))) {
282  // The parameter is not marked 'nocapture' - captured.
283  if (Tracker->captured(U))
284  return;
285  }
286  break;
287  }
288  case Instruction::Load:
289  // Volatile loads make the address observable.
290  if (cast<LoadInst>(I)->isVolatile())
291  if (Tracker->captured(U))
292  return;
293  break;
294  case Instruction::VAArg:
295  // "va-arg" from a pointer does not cause it to be captured.
296  break;
297  case Instruction::Store:
298  // Stored the pointer - conservatively assume it may be captured.
299  // Volatile stores make the address observable.
300  if (U->getOperandNo() == 0 || cast<StoreInst>(I)->isVolatile())
301  if (Tracker->captured(U))
302  return;
303  break;
304  case Instruction::AtomicRMW: {
305  // atomicrmw conceptually includes both a load and store from
306  // the same location.
307  // As with a store, the location being accessed is not captured,
308  // but the value being stored is.
309  // Volatile stores make the address observable.
310  auto *ARMWI = cast<AtomicRMWInst>(I);
311  if (U->getOperandNo() == 1 || ARMWI->isVolatile())
312  if (Tracker->captured(U))
313  return;
314  break;
315  }
316  case Instruction::AtomicCmpXchg: {
317  // cmpxchg conceptually includes both a load and store from
318  // the same location.
319  // As with a store, the location being accessed is not captured,
320  // but the value being stored is.
321  // Volatile stores make the address observable.
322  auto *ACXI = cast<AtomicCmpXchgInst>(I);
323  if (U->getOperandNo() == 1 || U->getOperandNo() == 2 ||
324  ACXI->isVolatile())
325  if (Tracker->captured(U))
326  return;
327  break;
328  }
329  case Instruction::BitCast:
330  case Instruction::GetElementPtr:
331  case Instruction::PHI:
332  case Instruction::Select:
333  case Instruction::AddrSpaceCast:
334  // The original value is not captured via this if the new value isn't.
335  if (!AddUses(I))
336  return;
337  break;
338  case Instruction::ICmp: {
339  unsigned Idx = U->getOperandNo();
340  unsigned OtherIdx = 1 - Idx;
341  if (auto *CPN = dyn_cast<ConstantPointerNull>(I->getOperand(OtherIdx))) {
342  // Don't count comparisons of a no-alias return value against null as
343  // captures. This allows us to ignore comparisons of malloc results
344  // with null, for example.
345  if (CPN->getType()->getAddressSpace() == 0)
346  if (isNoAliasCall(U->get()->stripPointerCasts()))
347  break;
348  if (!I->getFunction()->nullPointerIsDefined()) {
349  auto *O = I->getOperand(Idx)->stripPointerCastsSameRepresentation();
350  // Comparing a dereferenceable_or_null pointer against null cannot
351  // lead to pointer escapes, because if it is not null it must be a
352  // valid (in-bounds) pointer.
353  if (Tracker->isDereferenceableOrNull(O, I->getModule()->getDataLayout()))
354  break;
355  }
356  }
357  // Comparison against value stored in global variable. Given the pointer
358  // does not escape, its value cannot be guessed and stored separately in a
359  // global variable.
360  auto *LI = dyn_cast<LoadInst>(I->getOperand(OtherIdx));
361  if (LI && isa<GlobalVariable>(LI->getPointerOperand()))
362  break;
363  // Otherwise, be conservative. There are crazy ways to capture pointers
364  // using comparisons.
365  if (Tracker->captured(U))
366  return;
367  break;
368  }
369  default:
370  // Something else - be conservative and say it is captured.
371  if (Tracker->captured(U))
372  return;
373  break;
374  }
375  }
376 
377  // All uses examined.
378 }
379 
381  const Value *V, SmallDenseMap<const Value *, bool, 8> *IsCapturedCache) {
383  if (IsCapturedCache) {
384  bool Inserted;
385  std::tie(CacheIt, Inserted) = IsCapturedCache->insert({V, false});
386  if (!Inserted)
387  // Found cached result, return it!
388  return CacheIt->second;
389  }
390 
391  // If this is an identified function-local object, check to see if it escapes.
392  if (isIdentifiedFunctionLocal(V)) {
393  // Set StoreCaptures to True so that we can assume in our callers that the
394  // pointer is not the result of a load instruction. Currently
395  // PointerMayBeCaptured doesn't have any special analysis for the
396  // StoreCaptures=false case; if it did, our callers could be refined to be
397  // more precise.
398  auto Ret = !PointerMayBeCaptured(V, false, /*StoreCaptures=*/true);
399  if (IsCapturedCache)
400  CacheIt->second = Ret;
401  return Ret;
402  }
403 
404  return false;
405 }
MI
IRTranslator LLVM IR MI
Definition: IRTranslator.cpp:103
llvm
---------------------— PointerInfo ------------------------------------—
Definition: AllocatorList.h:23
llvm::getDefaultMaxUsesToExploreForCaptureTracking
unsigned getDefaultMaxUsesToExploreForCaptureTracking()
getDefaultMaxUsesToExploreForCaptureTracking - Return default value of the maximal number of uses to ...
Definition: CaptureTracking.cpp:51
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:112
IntrinsicInst.h
llvm::Type::isPointerTy
bool isPointerTy() const
True if this is an instance of PointerType.
Definition: Type.h:228
llvm::isNonEscapingLocalObject
bool isNonEscapingLocalObject(const Value *V, SmallDenseMap< const Value *, bool, 8 > *IsCapturedCache=nullptr)
Returns true if the pointer is to a function-local object that never escapes from the function.
Definition: CaptureTracking.cpp:380
llvm::CaptureTracker
This callback is used in conjunction with PointerMayBeCaptured.
Definition: CaptureTracking.h:69
llvm::SmallVector
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1168
Statistic.h
CaptureTracking.h
llvm::CaptureTracker::captured
virtual bool captured(const Use *U)=0
captured - Information about the pointer was captured by the user of use U.
llvm::SmallDenseMap< const Value *, bool, 8 >
ValueTracking.h
llvm::DominatorTree
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:151
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:143
llvm::SmallSet
SmallSet - This maintains a set of unique values, optimizing for the case when the set is small (less...
Definition: SmallSet.h:134
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:116
llvm::SmallVectorImpl::pop_back_val
LLVM_NODISCARD T pop_back_val()
Definition: SmallVector.h:635
llvm::CaptureTracker::~CaptureTracker
virtual ~CaptureTracker()
Definition: CaptureTracking.cpp:55
AliasAnalysis.h
llvm::isIdentifiedFunctionLocal
bool isIdentifiedFunctionLocal(const Value *V)
Return true if V is umabigously identified at the function-level.
Definition: AliasAnalysis.cpp:985
CommandLine.h
DefaultMaxUsesToExplore
static cl::opt< unsigned > DefaultMaxUsesToExplore("capture-tracking-max-uses-to-explore", cl::Hidden, cl::desc("Maximal number of uses to explore."), cl::init(20))
The default value for MaxUsesToExplore argument.
llvm::isNoAliasCall
bool isNoAliasCall(const Value *V)
Return true if this pointer is returned by a noalias function.
Definition: AliasAnalysis.cpp:961
Constants.h
llvm::CaptureTracker::shouldExplore
virtual bool shouldExplore(const Use *U)
shouldExplore - This is the use of a value derived from the pointer.
Definition: CaptureTracking.cpp:57
llvm::Value::uses
iterator_range< use_iterator > uses()
Definition: Value.h:377
false
Definition: StackSlotColoring.cpp:142
llvm::isPotentiallyReachable
bool isPotentiallyReachable(const Instruction *From, const Instruction *To, const SmallPtrSetImpl< BasicBlock * > *ExclusionSet=nullptr, const DominatorTree *DT=nullptr, const LoopInfo *LI=nullptr)
Determine whether instruction 'To' is reachable from 'From', without passing through any blocks in Ex...
Definition: CFG.cpp:236
llvm::Instruction
Definition: Instruction.h:45
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
llvm::CaptureTracker::isDereferenceableOrNull
virtual bool isDereferenceableOrNull(Value *O, const DataLayout &DL)
isDereferenceableOrNull - Overload to allow clients with additional knowledge about pointer dereferen...
Definition: CaptureTracking.cpp:59
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:153
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
llvm::cl::opt
Definition: CommandLine.h:1434
llvm::RISCVFenceField::O
@ O
Definition: RISCVBaseInfo.h:192
I
#define I(x, y, z)
Definition: MD5.cpp:59
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:443
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
CFG.h
llvm::LoopInfo
Definition: LoopInfo.h:1083
llvm::PointerMayBeCaptured
bool PointerMayBeCaptured(const Value *V, bool ReturnCaptures, bool StoreCaptures, unsigned MaxUsesToExplore=0)
PointerMayBeCaptured - Return true if this pointer value may be captured by the enclosing function (w...
Definition: CaptureTracking.cpp:155
llvm::Value::getType
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:256
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
llvm::SmallSet::insert
std::pair< NoneType, bool > insert(const T &V)
insert - Insert an element into the set if it isn't already there.
Definition: SmallSet.h:180
llvm::DenseMapBase::insert
std::pair< iterator, bool > insert(const std::pair< KeyT, ValueT > &KV)
Definition: DenseMap.h:207
llvm::Value::stripPointerCasts
const Value * stripPointerCasts() const
Strip off pointer casts, all-zero GEPs and address space casts.
Definition: Value.cpp:687
llvm::MCID::Select
@ Select
Definition: MCInstrDesc.h:162
Instructions.h
SmallVector.h
Dominators.h
llvm::CaptureTracker::tooManyUses
virtual void tooManyUses()=0
tooManyUses - The depth of traversal has breached a limit.
GEP
Hexagon Common GEP
Definition: HexagonCommonGEP.cpp:172
llvm::cl::desc
Definition: CommandLine.h:414
llvm::SmallVectorImpl::reserve
void reserve(size_type N)
Definition: SmallVector.h:624
llvm::PointerMayBeCapturedBefore
bool PointerMayBeCapturedBefore(const Value *V, bool ReturnCaptures, bool StoreCaptures, const Instruction *I, const DominatorTree *DT, bool IncludeI=false, unsigned MaxUsesToExplore=0, const LoopInfo *LI=nullptr)
PointerMayBeCapturedBefore - Return true if this pointer value may be captured by the enclosing funct...
Definition: CaptureTracking.cpp:185
llvm::Value
LLVM Value Representation.
Definition: Value.h:75
llvm::isIntrinsicReturningPointerAliasingArgumentWithoutCapturing
bool isIntrinsicReturningPointerAliasingArgumentWithoutCapturing(const CallBase *Call, bool MustPreserveNullness)
{launder,strip}.invariant.group returns pointer that aliases its argument, and it only captures point...
Definition: ValueTracking.cpp:4335
llvm::Use
A Use represents the edge between a Value definition and its users.
Definition: Use.h:44
SmallSet.h