1//===- TypeBasedAliasAnalysis.cpp - Type-Based Alias Analysis -------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines the TypeBasedAliasAnalysis pass, which implements
10// metadata-based TBAA.
11//
12// In LLVM IR, memory does not have types, so LLVM's own type system is not
13// suitable for doing TBAA. Instead, metadata is added to the IR to describe
14// a type system of a higher level language. This can be used to implement
15// typical C/C++ TBAA, but it can also be used to implement custom alias
16// analysis behavior for other languages.
17//
18// Scalar type nodes have up to three fields, e.g.:
19// !0 = !{ !"an example type tree" }
20// !1 = !{ !"int", !0 }
21// !2 = !{ !"float", !0 }
22// !3 = !{ !"const float", !2, i64 1 }
23//
24// The first field is an identity field. It can be any value, usually
25// an MDString, which uniquely identifies the type. The most important
26// name in the tree is the name of the root node. Two trees with
27// different root node names are entirely disjoint, even if they
28// have leaves with common names.
29//
30// The second field identifies the type's parent node in the tree, or
31// is null or omitted for a root node. A type is considered to alias
32// all of its descendants and all of its ancestors in the tree. Also,
33// a type is considered to alias all types in other trees, so that
34// bitcode produced from multiple front-ends is handled conservatively.
35//
36// If the third field is present, it's an integer which if equal to 1
37// indicates that the type is "constant" (meaning pointsToConstantMemory
38// should return true; see
39// http://llvm.org/docs/AliasAnalysis.html#OtherItfs).
40//
41// The MDNodes attached to an instruction using "!tbaa" are not plain type
42// nodes, but path tag nodes.
43//
44// The path tag node has 4 fields with the last field being optional.
45//
46// The first field is the base type node, it can be a struct type node
47// or a scalar type node. The second field is the access type node, it
48// must be a scalar type node. The third field is the offset into the base type.
49// The last field has the same meaning as the last field of our scalar TBAA:
50// it's an integer which if equal to 1 indicates that the access is "constant".
51//
52// The struct type node has a name and a list of pairs, one pair for each member
53// of the struct. The first element of each pair is a type node (a struct type
54// node or a scalar type node), specifying the type of the member, the second
55// element of each pair is the offset of the member.
56//
57// Given an example
58// typedef struct {
59// short s;
60// } A;
61// typedef struct {
62// uint16_t s;
63// A a;
64// } B;
65//
66// For an access to B.a.s, we attach !5 (a path tag node) to the load/store
67// instruction. The base type is !4 (struct B), the access type is !2 (scalar
68// type short) and the offset is 4.
69//
70// !0 = !{!"Simple C/C++ TBAA"}
71// !1 = !{!"omnipotent char", !0} // Scalar type node
72// !2 = !{!"short", !1} // Scalar type node
73// !3 = !{!"A", !2, i64 0} // Struct type node
74// !4 = !{!"B", !2, i64 0, !3, i64 4}
75// // Struct type node
76// !5 = !{!4, !2, i64 4} // Path tag node
77//
78// The struct type nodes and the scalar type nodes form a type DAG.
79// Root (!0)
80// char (!1) -- edge to Root
81// short (!2) -- edge to char
82// A (!3) -- edge with offset 0 to short
83// B (!4) -- edge with offset 0 to short and edge with offset 4 to A
84//
85// To check if two tags (tagX and tagY) can alias, we start from the base type
86// of tagX, follow the edge with the correct offset in the type DAG and adjust
87// the offset until we reach the base type of tagY or until we reach the Root
88// node.
89// If we reach the base type of tagY, compare the adjusted offset with
90// offset of tagY, return Alias if the offsets are the same, return NoAlias
91// otherwise.
92// If we reach the Root node, perform the above starting from base type of tagY
93// to see if we reach base type of tagX.
94//
95// If they have different roots, they're part of different potentially
96// unrelated type systems, so we return Alias to be conservative.
97// If neither node is an ancestor of the other and they have the same root,
98// then we say NoAlias.
99//
100//===----------------------------------------------------------------------===//
101
102#include "llvm/Analysis/TypeBasedAliasAnalysis.h"
103#include "llvm/ADT/SetVector.h"
104#include "llvm/Analysis/AliasAnalysis.h"
105#include "llvm/Analysis/MemoryLocation.h"
106#include "llvm/IR/Constants.h"
107#include "llvm/IR/DataLayout.h"
108#include "llvm/IR/DerivedTypes.h"
109#include "llvm/IR/InstrTypes.h"
110#include "llvm/IR/LLVMContext.h"
111#include "llvm/IR/Metadata.h"
112#include "llvm/IR/Module.h"
113#include "llvm/InitializePasses.h"
114#include "llvm/Pass.h"
115#include "llvm/Support/Casting.h"
116#include "llvm/Support/CommandLine.h"
117#include "llvm/Support/ErrorHandling.h"
118#include <cassert>
119#include <cstdint>
120
121using namespace llvm;
122
123// A handy option for disabling TBAA functionality. The same effect can also be
124// achieved by stripping the !tbaa tags from IR, but this option is sometimes
125// more convenient.
126static cl::opt<bool> EnableTBAA("enable-tbaa", cl::init(Val: true), cl::Hidden);
127
128namespace {
129
130/// isNewFormatTypeNode - Return true iff the given type node is in the new
131/// size-aware format.
132static bool isNewFormatTypeNode(const MDNode *N) {
133 if (N->getNumOperands() < 3)
134 return false;
135 // In the old format the first operand is a string.
136 if (!isa<MDNode>(Val: N->getOperand(I: 0)))
137 return false;
138 return true;
139}
140
141/// This is a simple wrapper around an MDNode which provides a higher-level
142/// interface by hiding the details of how alias analysis information is encoded
143/// in its operands.
144template<typename MDNodeTy>
145class TBAANodeImpl {
146 MDNodeTy *Node = nullptr;
147
148public:
149 TBAANodeImpl() = default;
150 explicit TBAANodeImpl(MDNodeTy *N) : Node(N) {}
151
152 /// getNode - Get the MDNode for this TBAANode.
153 MDNodeTy *getNode() const { return Node; }
154
155 /// isNewFormat - Return true iff the wrapped type node is in the new
156 /// size-aware format.
157 bool isNewFormat() const { return isNewFormatTypeNode(Node); }
158
159 /// getParent - Get this TBAANode's Alias tree parent.
160 TBAANodeImpl<MDNodeTy> getParent() const {
161 if (isNewFormat())
162 return TBAANodeImpl(cast<MDNodeTy>(Node->getOperand(0)));
163
164 if (Node->getNumOperands() < 2)
165 return TBAANodeImpl<MDNodeTy>();
166 MDNodeTy *P = dyn_cast_or_null<MDNodeTy>(Node->getOperand(1));
167 if (!P)
168 return TBAANodeImpl<MDNodeTy>();
169 // Ok, this node has a valid parent. Return it.
170 return TBAANodeImpl<MDNodeTy>(P);
171 }
172};
173
174/// \name Specializations of \c TBAANodeImpl for const and non const qualified
175/// \c MDNode.
176/// @{
177using TBAANode = TBAANodeImpl<const MDNode>;
178using MutableTBAANode = TBAANodeImpl<MDNode>;
179/// @}
180
181/// This is a simple wrapper around an MDNode which provides a
182/// higher-level interface by hiding the details of how alias analysis
183/// information is encoded in its operands.
184template<typename MDNodeTy>
185class TBAAStructTagNodeImpl {
186 /// This node should be created with createTBAAAccessTag().
187 MDNodeTy *Node;
188
189public:
190 explicit TBAAStructTagNodeImpl(MDNodeTy *N) : Node(N) {}
191
192 /// Get the MDNode for this TBAAStructTagNode.
193 MDNodeTy *getNode() const { return Node; }
194
195 /// isNewFormat - Return true iff the wrapped access tag is in the new
196 /// size-aware format.
197 bool isNewFormat() const {
198 if (Node->getNumOperands() < 4)
199 return false;
200 if (MDNodeTy *AccessType = getAccessType())
201 if (!TBAANodeImpl<MDNodeTy>(AccessType).isNewFormat())
202 return false;
203 return true;
204 }
205
206 MDNodeTy *getBaseType() const {
207 return dyn_cast_or_null<MDNode>(Node->getOperand(0));
208 }
209
210 MDNodeTy *getAccessType() const {
211 return dyn_cast_or_null<MDNode>(Node->getOperand(1));
212 }
213
214 uint64_t getOffset() const {
215 return mdconst::extract<ConstantInt>(Node->getOperand(2))->getZExtValue();
216 }
217
218 uint64_t getSize() const {
219 if (!isNewFormat())
220 return UINT64_MAX;
221 return mdconst::extract<ConstantInt>(Node->getOperand(3))->getZExtValue();
222 }
223
224 /// Test if this TBAAStructTagNode represents a type for objects
225 /// which are not modified (by any means) in the context where this
226 /// AliasAnalysis is relevant.
227 bool isTypeImmutable() const {
228 unsigned OpNo = isNewFormat() ? 4 : 3;
229 if (Node->getNumOperands() < OpNo + 1)
230 return false;
231 ConstantInt *CI = mdconst::dyn_extract<ConstantInt>(Node->getOperand(OpNo));
232 if (!CI)
233 return false;
234 return CI->getValue()[0];
235 }
236};
237
238/// \name Specializations of \c TBAAStructTagNodeImpl for const and non const
239/// qualified \c MDNods.
240/// @{
241using TBAAStructTagNode = TBAAStructTagNodeImpl<const MDNode>;
242using MutableTBAAStructTagNode = TBAAStructTagNodeImpl<MDNode>;
243/// @}
244
245/// This is a simple wrapper around an MDNode which provides a
246/// higher-level interface by hiding the details of how alias analysis
247/// information is encoded in its operands.
248class TBAAStructTypeNode {
249 /// This node should be created with createTBAATypeNode().
250 const MDNode *Node = nullptr;
251
252public:
253 TBAAStructTypeNode() = default;
254 explicit TBAAStructTypeNode(const MDNode *N) : Node(N) {}
255
256 /// Get the MDNode for this TBAAStructTypeNode.
257 const MDNode *getNode() const { return Node; }
258
259 /// isNewFormat - Return true iff the wrapped type node is in the new
260 /// size-aware format.
261 bool isNewFormat() const { return isNewFormatTypeNode(N: Node); }
262
263 bool operator==(const TBAAStructTypeNode &Other) const {
264 return getNode() == Other.getNode();
265 }
266
267 /// getId - Return type identifier.
268 Metadata *getId() const {
269 return Node->getOperand(I: isNewFormat() ? 2 : 0);
270 }
271
272 unsigned getNumFields() const {
273 unsigned FirstFieldOpNo = isNewFormat() ? 3 : 1;
274 unsigned NumOpsPerField = isNewFormat() ? 3 : 2;
275 return (getNode()->getNumOperands() - FirstFieldOpNo) / NumOpsPerField;
276 }
277
278 TBAAStructTypeNode getFieldType(unsigned FieldIndex) const {
279 unsigned FirstFieldOpNo = isNewFormat() ? 3 : 1;
280 unsigned NumOpsPerField = isNewFormat() ? 3 : 2;
281 unsigned OpIndex = FirstFieldOpNo + FieldIndex * NumOpsPerField;
282 auto *TypeNode = cast<MDNode>(Val: getNode()->getOperand(I: OpIndex));
283 return TBAAStructTypeNode(TypeNode);
284 }
285
286 /// Get this TBAAStructTypeNode's field in the type DAG with
287 /// given offset. Update the offset to be relative to the field type.
288 TBAAStructTypeNode getField(uint64_t &Offset) const {
289 bool NewFormat = isNewFormat();
290 const ArrayRef<MDOperand> Operands = Node->operands();
291 const unsigned NumOperands = Operands.size();
292
293 if (NewFormat) {
294 // New-format root and scalar type nodes have no fields.
295 if (NumOperands < 6)
296 return TBAAStructTypeNode();
297 } else {
298 // Parent can be omitted for the root node.
299 if (NumOperands < 2)
300 return TBAAStructTypeNode();
301
302 // Fast path for a scalar type node and a struct type node with a single
303 // field.
304 if (NumOperands <= 3) {
305 uint64_t Cur =
306 NumOperands == 2
307 ? 0
308 : mdconst::extract<ConstantInt>(MD: Operands[2])->getZExtValue();
309 Offset -= Cur;
310 MDNode *P = dyn_cast_or_null<MDNode>(Val: Operands[1]);
311 if (!P)
312 return TBAAStructTypeNode();
313 return TBAAStructTypeNode(P);
314 }
315 }
316
317 // Assume the offsets are in order. We return the previous field if
318 // the current offset is bigger than the given offset.
319 unsigned FirstFieldOpNo = NewFormat ? 3 : 1;
320 unsigned NumOpsPerField = NewFormat ? 3 : 2;
321 unsigned TheIdx = 0;
322
323 for (unsigned Idx = FirstFieldOpNo; Idx < NumOperands;
324 Idx += NumOpsPerField) {
325 uint64_t Cur =
326 mdconst::extract<ConstantInt>(MD: Operands[Idx + 1])->getZExtValue();
327 if (Cur > Offset) {
328 assert(Idx >= FirstFieldOpNo + NumOpsPerField &&
329 "TBAAStructTypeNode::getField should have an offset match!");
330 TheIdx = Idx - NumOpsPerField;
331 break;
332 }
333 }
334 // Move along the last field.
335 if (TheIdx == 0)
336 TheIdx = NumOperands - NumOpsPerField;
337 uint64_t Cur =
338 mdconst::extract<ConstantInt>(MD: Operands[TheIdx + 1])->getZExtValue();
339 Offset -= Cur;
340 MDNode *P = dyn_cast_or_null<MDNode>(Val: Operands[TheIdx]);
341 if (!P)
342 return TBAAStructTypeNode();
343 return TBAAStructTypeNode(P);
344 }
345};
346
347} // end anonymous namespace
348
349AliasResult TypeBasedAAResult::alias(const MemoryLocation &LocA,
350 const MemoryLocation &LocB,
351 AAQueryInfo &AAQI, const Instruction *) {
352 if (!shouldUseTBAA())
353 return AliasResult::MayAlias;
354
355 if (Aliases(A: LocA.AATags.TBAA, B: LocB.AATags.TBAA))
356 return AliasResult::MayAlias;
357
358 // Otherwise return a definitive result.
359 return AliasResult::NoAlias;
360}
361
362AliasResult TypeBasedAAResult::aliasErrno(const MemoryLocation &Loc,
363 const Instruction *CtxI) {
364 if (!shouldUseTBAA())
365 return AliasResult::MayAlias;
366
367 const auto *N = Loc.AATags.TBAA;
368 if (!N)
369 return AliasResult::MayAlias;
370
371 // There cannot be any alias with errno if TBAA proves the given memory
372 // location does not alias errno.
373 const auto *ErrnoTBAAMD =
374 CtxI->getModule()->getNamedMetadata(Name: "llvm.errno.tbaa");
375 if (!ErrnoTBAAMD || any_of(Range: ErrnoTBAAMD->operands(), P: [&](const auto *Node) {
376 return Aliases(A: N, B: Node);
377 }))
378 return AliasResult::MayAlias;
379 return AliasResult::NoAlias;
380}
381
382ModRefInfo TypeBasedAAResult::getModRefInfoMask(const MemoryLocation &Loc,
383 AAQueryInfo &AAQI,
384 bool IgnoreLocals) {
385 if (!shouldUseTBAA())
386 return ModRefInfo::ModRef;
387
388 const MDNode *M = Loc.AATags.TBAA;
389 if (!M)
390 return ModRefInfo::ModRef;
391
392 // If this is an "immutable" type, we can assume the pointer is pointing
393 // to constant memory.
394 if (TBAAStructTagNode(M).isTypeImmutable())
395 return ModRefInfo::NoModRef;
396
397 return ModRefInfo::ModRef;
398}
399
400MemoryEffects TypeBasedAAResult::getMemoryEffects(const CallBase *Call,
401 AAQueryInfo &AAQI) {
402 if (!shouldUseTBAA())
403 return MemoryEffects::unknown();
404
405 // If this is an "immutable" type, the access is not observable.
406 if (const MDNode *M = Call->getMetadata(KindID: LLVMContext::MD_tbaa))
407 if (TBAAStructTagNode(M).isTypeImmutable())
408 return MemoryEffects::none();
409
410 return MemoryEffects::unknown();
411}
412
413MemoryEffects TypeBasedAAResult::getMemoryEffects(const Function *F) {
414 // Functions don't have metadata.
415 return MemoryEffects::unknown();
416}
417
418ModRefInfo TypeBasedAAResult::getModRefInfo(const CallBase *Call,
419 const MemoryLocation &Loc,
420 AAQueryInfo &AAQI) {
421 if (!shouldUseTBAA())
422 return ModRefInfo::ModRef;
423
424 if (const MDNode *L = Loc.AATags.TBAA)
425 if (const MDNode *M = Call->getMetadata(KindID: LLVMContext::MD_tbaa))
426 if (!Aliases(A: L, B: M))
427 return ModRefInfo::NoModRef;
428
429 return ModRefInfo::ModRef;
430}
431
432ModRefInfo TypeBasedAAResult::getModRefInfo(const CallBase *Call1,
433 const CallBase *Call2,
434 AAQueryInfo &AAQI) {
435 if (!shouldUseTBAA())
436 return ModRefInfo::ModRef;
437
438 if (const MDNode *M1 = Call1->getMetadata(KindID: LLVMContext::MD_tbaa))
439 if (const MDNode *M2 = Call2->getMetadata(KindID: LLVMContext::MD_tbaa))
440 if (!Aliases(A: M1, B: M2))
441 return ModRefInfo::NoModRef;
442
443 return ModRefInfo::ModRef;
444}
445
446bool MDNode::isTBAAVtableAccess() const {
447 // For struct-path aware TBAA, we use the access type of the tag.
448 TBAAStructTagNode Tag(this);
449 TBAAStructTypeNode AccessType(Tag.getAccessType());
450 if(auto *Id = dyn_cast<MDString>(Val: AccessType.getId()))
451 if (Id->getString() == "vtable pointer")
452 return true;
453 return false;
454}
455
456static bool matchAccessTags(const MDNode *A, const MDNode *B,
457 const MDNode **GenericTag = nullptr);
458
459MDNode *MDNode::getMostGenericTBAA(MDNode *A, MDNode *B) {
460 const MDNode *GenericTag;
461 matchAccessTags(A, B, GenericTag: &GenericTag);
462 return const_cast<MDNode*>(GenericTag);
463}
464
465static const MDNode *getLeastCommonType(const MDNode *A, const MDNode *B) {
466 if (!A || !B)
467 return nullptr;
468
469 if (A == B)
470 return A;
471
472 SmallSetVector<const MDNode *, 4> PathA;
473 TBAANode TA(A);
474 while (TA.getNode()) {
475 if (!PathA.insert(X: TA.getNode()))
476 report_fatal_error(reason: "Cycle found in TBAA metadata.");
477 TA = TA.getParent();
478 }
479
480 SmallSetVector<const MDNode *, 4> PathB;
481 TBAANode TB(B);
482 while (TB.getNode()) {
483 if (!PathB.insert(X: TB.getNode()))
484 report_fatal_error(reason: "Cycle found in TBAA metadata.");
485 TB = TB.getParent();
486 }
487
488 int IA = PathA.size() - 1;
489 int IB = PathB.size() - 1;
490
491 const MDNode *Ret = nullptr;
492 while (IA >= 0 && IB >= 0) {
493 if (PathA[IA] == PathB[IB])
494 Ret = PathA[IA];
495 else
496 break;
497 --IA;
498 --IB;
499 }
500
501 return Ret;
502}
503
504AAMDNodes AAMDNodes::merge(const AAMDNodes &Other) const {
505 AAMDNodes Result;
506 Result.TBAA = MDNode::getMostGenericTBAA(A: TBAA, B: Other.TBAA);
507 Result.TBAAStruct = nullptr;
508 Result.Scope = MDNode::getMostGenericAliasScope(A: Scope, B: Other.Scope);
509 Result.NoAlias = MDNode::intersect(A: NoAlias, B: Other.NoAlias);
510 Result.NoAliasAddrSpace = MDNode::getMostGenericNoaliasAddrspace(
511 A: NoAliasAddrSpace, B: Other.NoAliasAddrSpace);
512 return Result;
513}
514
515AAMDNodes AAMDNodes::concat(const AAMDNodes &Other) const {
516 AAMDNodes Result;
517 Result.TBAA = Result.TBAAStruct = nullptr;
518 Result.Scope = MDNode::getMostGenericAliasScope(A: Scope, B: Other.Scope);
519 Result.NoAlias = MDNode::intersect(A: NoAlias, B: Other.NoAlias);
520 Result.NoAliasAddrSpace = MDNode::getMostGenericNoaliasAddrspace(
521 A: NoAliasAddrSpace, B: Other.NoAliasAddrSpace);
522 return Result;
523}
524
525static const MDNode *createAccessTag(const MDNode *AccessType) {
526 // If there is no access type or the access type is the root node, then
527 // we don't have any useful access tag to return.
528 if (!AccessType || AccessType->getNumOperands() < 2)
529 return nullptr;
530
531 Type *Int64 = IntegerType::get(C&: AccessType->getContext(), NumBits: 64);
532 auto *OffsetNode = ConstantAsMetadata::get(C: ConstantInt::get(Ty: Int64, V: 0));
533
534 if (TBAAStructTypeNode(AccessType).isNewFormat()) {
535 // TODO: Take access ranges into account when matching access tags and
536 // fix this code to generate actual access sizes for generic tags.
537 uint64_t AccessSize = UINT64_MAX;
538 auto *SizeNode =
539 ConstantAsMetadata::get(C: ConstantInt::get(Ty: Int64, V: AccessSize));
540 Metadata *Ops[] = {const_cast<MDNode*>(AccessType),
541 const_cast<MDNode*>(AccessType),
542 OffsetNode, SizeNode};
543 return MDNode::get(Context&: AccessType->getContext(), MDs: Ops);
544 }
545
546 Metadata *Ops[] = {const_cast<MDNode*>(AccessType),
547 const_cast<MDNode*>(AccessType),
548 OffsetNode};
549 return MDNode::get(Context&: AccessType->getContext(), MDs: Ops);
550}
551
552static bool hasField(TBAAStructTypeNode BaseType,
553 TBAAStructTypeNode FieldType) {
554 for (unsigned I = 0, E = BaseType.getNumFields(); I != E; ++I) {
555 TBAAStructTypeNode T = BaseType.getFieldType(FieldIndex: I);
556 if (T == FieldType || hasField(BaseType: T, FieldType))
557 return true;
558 }
559 return false;
560}
561
562/// Return true if for two given accesses, one of the accessed objects may be a
563/// subobject of the other. The \p BaseTag and \p SubobjectTag parameters
564/// describe the accesses to the base object and the subobject respectively.
565/// \p CommonType must be the metadata node describing the common type of the
566/// accessed objects. On return, \p MayAlias is set to true iff these accesses
567/// may alias and \p Generic, if not null, points to the most generic access
568/// tag for the given two.
569static bool mayBeAccessToSubobjectOf(TBAAStructTagNode BaseTag,
570 TBAAStructTagNode SubobjectTag,
571 const MDNode *CommonType,
572 const MDNode **GenericTag,
573 bool &MayAlias) {
574 // If the base object is of the least common type, then this may be an access
575 // to its subobject.
576 if (BaseTag.getAccessType() == BaseTag.getBaseType() &&
577 BaseTag.getAccessType() == CommonType) {
578 if (GenericTag)
579 *GenericTag = createAccessTag(AccessType: CommonType);
580 MayAlias = true;
581 return true;
582 }
583
584 // If the access to the base object is through a field of the subobject's
585 // type, then this may be an access to that field. To check for that we start
586 // from the base type, follow the edge with the correct offset in the type DAG
587 // and adjust the offset until we reach the field type or until we reach the
588 // access type.
589 bool NewFormat = BaseTag.isNewFormat();
590 TBAAStructTypeNode BaseType(BaseTag.getBaseType());
591 uint64_t OffsetInBase = BaseTag.getOffset();
592
593 for (;;) {
594 // In the old format there is no distinction between fields and parent
595 // types, so in this case we consider all nodes up to the root.
596 if (!BaseType.getNode()) {
597 assert(!NewFormat && "Did not see access type in access path!");
598 break;
599 }
600
601 if (BaseType.getNode() == SubobjectTag.getBaseType()) {
602 MayAlias = OffsetInBase == SubobjectTag.getOffset() ||
603 BaseType.getNode() == BaseTag.getAccessType() ||
604 SubobjectTag.getBaseType() == SubobjectTag.getAccessType();
605 if (GenericTag) {
606 if (!MayAlias) {
607 *GenericTag = createAccessTag(AccessType: CommonType);
608 } else if (SubobjectTag.isTypeImmutable() &&
609 !BaseTag.isTypeImmutable()) {
610 // The generic tag can only be immutable if both accesses are, so
611 // drop the flag and keep the rest of the tag.
612 const MDNode *Tag = SubobjectTag.getNode();
613 unsigned FlagOpNo = SubobjectTag.isNewFormat() ? 4 : 3;
614 SmallVector<Metadata *, 4> Ops(Tag->operands().take_front(N: FlagOpNo));
615 *GenericTag = MDNode::get(Context&: Tag->getContext(), MDs: Ops);
616 } else {
617 *GenericTag = SubobjectTag.getNode();
618 }
619 }
620 return true;
621 }
622
623 // With new-format nodes we stop at the access type.
624 if (NewFormat && BaseType.getNode() == BaseTag.getAccessType())
625 break;
626
627 // Follow the edge with the correct offset. Offset will be adjusted to
628 // be relative to the field type.
629 BaseType = BaseType.getField(Offset&: OffsetInBase);
630 }
631
632 // If the base object has a direct or indirect field of the subobject's type,
633 // then this may be an access to that field. We need this to check now that
634 // we support aggregates as access types.
635 if (NewFormat) {
636 // TBAAStructTypeNode BaseAccessType(BaseTag.getAccessType());
637 TBAAStructTypeNode FieldType(SubobjectTag.getBaseType());
638 if (hasField(BaseType, FieldType)) {
639 if (GenericTag)
640 *GenericTag = createAccessTag(AccessType: CommonType);
641 MayAlias = true;
642 return true;
643 }
644 }
645
646 return false;
647}
648
649/// matchTags - Return true if the given couple of accesses are allowed to
650/// overlap. If \arg GenericTag is not null, then on return it points to the
651/// most generic access descriptor for the given two.
652static bool matchAccessTags(const MDNode *A, const MDNode *B,
653 const MDNode **GenericTag) {
654 if (A == B) {
655 if (GenericTag)
656 *GenericTag = A;
657 return true;
658 }
659
660 // Accesses with no TBAA information may alias with any other accesses.
661 if (!A || !B) {
662 if (GenericTag)
663 *GenericTag = nullptr;
664 return true;
665 }
666
667 TBAAStructTagNode TagA(A), TagB(B);
668 const MDNode *CommonType = getLeastCommonType(A: TagA.getAccessType(),
669 B: TagB.getAccessType());
670
671 // If the final access types have different roots, they're part of different
672 // potentially unrelated type systems, so we must be conservative.
673 if (!CommonType) {
674 if (GenericTag)
675 *GenericTag = nullptr;
676 return true;
677 }
678
679 // If one of the accessed objects may be a subobject of the other, then such
680 // accesses may alias.
681 bool MayAlias;
682 if (mayBeAccessToSubobjectOf(/* BaseTag= */ TagA, /* SubobjectTag= */ TagB,
683 CommonType, GenericTag, MayAlias) ||
684 mayBeAccessToSubobjectOf(/* BaseTag= */ TagB, /* SubobjectTag= */ TagA,
685 CommonType, GenericTag, MayAlias))
686 return MayAlias;
687
688 // Otherwise, we've proved there's no alias.
689 if (GenericTag)
690 *GenericTag = createAccessTag(AccessType: CommonType);
691 return false;
692}
693
694/// Aliases - Test whether the access represented by tag A may alias the
695/// access represented by tag B.
696bool TypeBasedAAResult::Aliases(const MDNode *A, const MDNode *B) const {
697 return matchAccessTags(A, B);
698}
699
700bool TypeBasedAAResult::shouldUseTBAA() const {
701 return EnableTBAA && !UsingTypeSanitizer;
702}
703
704AnalysisKey TypeBasedAA::Key;
705
706TypeBasedAAResult TypeBasedAA::run(Function &F, FunctionAnalysisManager &AM) {
707 return TypeBasedAAResult(F.hasFnAttribute(Kind: Attribute::SanitizeType));
708}
709
710char TypeBasedAAWrapperPass::ID = 0;
711INITIALIZE_PASS(TypeBasedAAWrapperPass, "tbaa", "Type-Based Alias Analysis",
712 false, true)
713
714ImmutablePass *llvm::createTypeBasedAAWrapperPass() {
715 return new TypeBasedAAWrapperPass();
716}
717
718TypeBasedAAWrapperPass::TypeBasedAAWrapperPass() : ImmutablePass(ID) {}
719
720bool TypeBasedAAWrapperPass::doInitialization(Module &M) {
721 Result.reset(p: new TypeBasedAAResult(/*UsingTypeSanitizer=*/false));
722 return false;
723}
724
725bool TypeBasedAAWrapperPass::doFinalization(Module &M) {
726 Result.reset();
727 return false;
728}
729
730void TypeBasedAAWrapperPass::getAnalysisUsage(AnalysisUsage &AU) const {
731 AU.setPreservesAll();
732}
733
734MDNode *AAMDNodes::shiftTBAA(MDNode *MD, size_t Offset) {
735 // Fast path if there's no offset
736 if (Offset == 0)
737 return MD;
738
739 // The correct behavior here is to add the offset into the TBAA
740 // struct node offset. The base type, however may not have defined
741 // a type at this additional offset, resulting in errors. Since
742 // this method is only used within a given load/store access
743 // the offset provided is only used to subdivide the previous load
744 // maintaining the validity of the previous TBAA.
745 //
746 // This, however, should be revisited in the future.
747 return MD;
748}
749
750// Read a !tbaa.struct field entry (an offset or a size) as a 64-bit value.
751// Returns std::nullopt if it does not fit in 64 bits.
752static std::optional<uint64_t> getTBAAStructFieldAsInt64(const MDOperand &Op) {
753 return mdconst::extract<ConstantInt>(MD: Op)->getValue().tryZExtValue();
754}
755
756static bool isScalarAccessTag(const MDNode *Tag) {
757 TBAAStructTagNode T(Tag);
758 return T.getAccessType() == T.getBaseType();
759}
760
761MDNode *AAMDNodes::shiftTBAAStruct(MDNode *MD, size_t Offset) {
762 // Fast path if there's no offset
763 if (Offset == 0)
764 return MD;
765 SmallVector<Metadata *, 3> Sub;
766 for (size_t i = 0, size = MD->getNumOperands(); i < size; i += 3) {
767 ConstantInt *InnerOffset = mdconst::extract<ConstantInt>(MD: MD->getOperand(I: i));
768 ConstantInt *InnerSize =
769 mdconst::extract<ConstantInt>(MD: MD->getOperand(I: i + 1));
770 // Don't include any triples that aren't in bounds
771 if (InnerOffset->getZExtValue() + InnerSize->getZExtValue() <= Offset)
772 continue;
773
774 uint64_t NewSize = InnerSize->getZExtValue();
775 uint64_t NewOffset = InnerOffset->getZExtValue() - Offset;
776 if (InnerOffset->getZExtValue() < Offset) {
777 NewOffset = 0;
778 NewSize -= Offset - InnerOffset->getZExtValue();
779 }
780
781 // Shift the offset of the triple
782 Sub.push_back(Elt: ConstantAsMetadata::get(
783 C: ConstantInt::get(Ty: InnerOffset->getType(), V: NewOffset)));
784 Sub.push_back(Elt: ConstantAsMetadata::get(
785 C: ConstantInt::get(Ty: InnerSize->getType(), V: NewSize)));
786 Sub.push_back(Elt: MD->getOperand(I: i + 2));
787 }
788 return MDNode::get(Context&: MD->getContext(), MDs: Sub);
789}
790
791MDNode *AAMDNodes::extendToTBAA(MDNode *MD, ssize_t Len) {
792 // Fast path if 0-length
793 if (Len == 0)
794 return nullptr;
795
796 TBAAStructTagNode Tag(MD);
797
798 // Only new format TBAA has a size
799 if (!Tag.isNewFormat())
800 return MD;
801
802 // If unknown size, drop the TBAA.
803 if (Len == -1)
804 return nullptr;
805
806 // Otherwise, create TBAA with the new Len
807 ArrayRef<MDOperand> MDOperands = MD->operands();
808 SmallVector<Metadata *, 4> NextNodes(MDOperands);
809 ConstantInt *PreviousSize = mdconst::extract<ConstantInt>(MD&: NextNodes[3]);
810
811 // Don't create a new MDNode if it is the same length.
812 if (PreviousSize->equalsInt(V: Len))
813 return MD;
814
815 NextNodes[3] =
816 ConstantAsMetadata::get(C: ConstantInt::get(Ty: PreviousSize->getType(), V: Len));
817 return MDNode::get(Context&: MD->getContext(), MDs: NextNodes);
818}
819
820AAMDNodes AAMDNodes::adjustForAccess(unsigned AccessSize) {
821 AAMDNodes New = *this;
822 MDNode *M = New.TBAAStruct;
823
824 // The access may cover several !tbaa.struct fields (e.g. a {int, int} copy
825 // widened to an i64 load/store). If those fields share a single tag and tile
826 // [0, AccessSize) with no gaps, that tag still describes the whole access.
827 New.TBAAStruct = nullptr;
828 if (New.TBAA || !M)
829 return New;
830 MDNode *CommonTag = nullptr;
831 uint64_t Offset = 0;
832 for (size_t I = 0, E = M->getNumOperands(); I + 2 < E && Offset < AccessSize;
833 I += 3) {
834 std::optional<uint64_t> FieldOffset =
835 getTBAAStructFieldAsInt64(Op: M->getOperand(I));
836 std::optional<uint64_t> FieldSize =
837 getTBAAStructFieldAsInt64(Op: M->getOperand(I: I + 1));
838 MDNode *FieldTag = dyn_cast_or_null<MDNode>(Val: M->getOperand(I: I + 2));
839 if (!FieldOffset || !FieldSize || !FieldTag ||
840 !isScalarAccessTag(Tag: FieldTag) || *FieldOffset != Offset ||
841 (CommonTag && FieldTag != CommonTag))
842 break;
843 CommonTag = FieldTag;
844 Offset += *FieldSize;
845 }
846 if (Offset == AccessSize)
847 New.TBAA = CommonTag;
848 return New;
849}
850
851AAMDNodes AAMDNodes::adjustForAccess(size_t Offset, Type *AccessTy,
852 const DataLayout &DL) {
853 AAMDNodes New = shift(Offset);
854 if (!DL.typeSizeEqualsStoreSize(Ty: AccessTy))
855 return New;
856 TypeSize Size = DL.getTypeStoreSize(Ty: AccessTy);
857 if (Size.isScalable())
858 return New;
859
860 return New.adjustForAccess(AccessSize: Size.getKnownMinValue());
861}
862
863AAMDNodes AAMDNodes::adjustForAccess(size_t Offset, unsigned AccessSize) {
864 AAMDNodes New = shift(Offset);
865 return New.adjustForAccess(AccessSize);
866}
867