[llvm-commits] [llvm] r115062 - in /llvm/trunk: include/llvm/Analysis/PointerTracking.h include/llvm/LinkAllPasses.h lib/Analysis/PointerTracking.cpp
Chris Lattner
sabre at nondot.org
Wed Sep 29 11:43:27 PDT 2010
Author: lattner
Date: Wed Sep 29 13:43:27 2010
New Revision: 115062
URL: http://llvm.org/viewvc/llvm-project?rev=115062&view=rev
Log:
remove PointerTracking from mainline, Edwin is going to move it out to ClamAV
for LLVM 2.9
Removed:
llvm/trunk/include/llvm/Analysis/PointerTracking.h
llvm/trunk/lib/Analysis/PointerTracking.cpp
Modified:
llvm/trunk/include/llvm/LinkAllPasses.h
Removed: llvm/trunk/include/llvm/Analysis/PointerTracking.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/include/llvm/Analysis/PointerTracking.h?rev=115061&view=auto
==============================================================================
--- llvm/trunk/include/llvm/Analysis/PointerTracking.h (original)
+++ llvm/trunk/include/llvm/Analysis/PointerTracking.h (removed)
@@ -1,132 +0,0 @@
-//===- PointerTracking.h - Pointer Bounds Tracking --------------*- C++ -*-===//
-//
-// The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-// This file implements tracking of pointer bounds.
-// It knows that the libc functions "calloc" and "realloc" allocate memory, thus
-// you should avoid using this pass if they mean something else for your
-// language.
-//
-// All methods assume that the pointer is not NULL, if it is then the returned
-// allocation size is wrong, and the result from checkLimits is wrong too.
-// It also assumes that pointers are valid, and that it is not analyzing a
-// use-after-free scenario.
-// Due to these limitations the "size" returned by these methods should be
-// considered as either 0 or the returned size.
-//
-// Another analysis pass should be used to find use-after-free/NULL dereference
-// bugs.
-//
-//===----------------------------------------------------------------------===//
-
-#ifndef LLVM_ANALYSIS_POINTERTRACKING_H
-#define LLVM_ANALYSIS_POINTERTRACKING_H
-
-#include "llvm/ADT/SmallPtrSet.h"
-#include "llvm/Analysis/Dominators.h"
-#include "llvm/Instructions.h"
-#include "llvm/Pass.h"
-#include "llvm/Support/PredIteratorCache.h"
-
-namespace llvm {
- class DominatorTree;
- class ScalarEvolution;
- class SCEV;
- class Loop;
- class LoopInfo;
- class TargetData;
-
- // Result from solver, assuming pointer is not NULL,
- // and it is not a use-after-free situation.
- enum SolverResult {
- AlwaysFalse,// always false with above constraints
- AlwaysTrue,// always true with above constraints
- Unknown // it can sometimes be true, sometimes false, or it is undecided
- };
-
- class PointerTracking : public FunctionPass {
- public:
- typedef ICmpInst::Predicate Predicate;
- static char ID;
- PointerTracking();
-
- virtual bool doInitialization(Module &M);
-
- // If this pointer directly points to an allocation, return
- // the number of elements of type Ty allocated.
- // Otherwise return CouldNotCompute.
- // Since allocations can fail by returning NULL, the real element count
- // for every allocation is either 0 or the value returned by this function.
- const SCEV *getAllocationElementCount(Value *P) const;
-
- // Same as getAllocationSize() but returns size in bytes.
- // We consider one byte as 8 bits.
- const SCEV *getAllocationSizeInBytes(Value *V) const;
-
- // Given a Pointer, determine a base pointer of known size, and an offset
- // therefrom.
- // When unable to determine, sets Base to NULL, and Limit/Offset to
- // CouldNotCompute.
- // BaseSize, and Offset are in bytes: Pointer == Base + Offset
- void getPointerOffset(Value *Pointer, Value *&Base, const SCEV *& BaseSize,
- const SCEV *&Offset) const;
-
- // Compares the 2 scalar evolution expressions according to predicate,
- // and if it can prove that the result is always true or always false
- // return AlwaysTrue/AlwaysFalse. Otherwise it returns Unknown.
- enum SolverResult compareSCEV(const SCEV *A, Predicate Pred, const SCEV *B,
- const Loop *L);
-
- // Determines whether the condition LHS <Pred> RHS is sufficient
- // for the condition A <Pred> B to hold.
- // Currently only ULT/ULE is supported.
- // This errs on the side of returning false.
- bool conditionSufficient(const SCEV *LHS, Predicate Pred1, const SCEV *RHS,
- const SCEV *A, Predicate Pred2, const SCEV *B,
- const Loop *L);
-
- // Determines whether Offset is known to be always in [0, Limit) bounds.
- // This errs on the side of returning Unknown.
- enum SolverResult checkLimits(const SCEV *Offset, const SCEV *Limit,
- BasicBlock *BB);
-
- virtual bool runOnFunction(Function &F);
- virtual void getAnalysisUsage(AnalysisUsage &AU) const;
- void print(raw_ostream &OS, const Module* = 0) const;
- Value *computeAllocationCountValue(Value *P, const Type *&Ty) const;
- private:
- Function *FF;
- TargetData *TD;
- ScalarEvolution *SE;
- LoopInfo *LI;
- DominatorTree *DT;
-
- Function *callocFunc;
- Function *reallocFunc;
- PredIteratorCache predCache;
-
- SmallPtrSet<const SCEV*, 1> analyzing;
-
- enum SolverResult isLoopGuardedBy(const Loop *L, Predicate Pred,
- const SCEV *A, const SCEV *B) const;
- static bool isMonotonic(const SCEV *S);
- bool scevPositive(const SCEV *A, const Loop *L, bool strict=true) const;
- bool conditionSufficient(Value *Cond, bool negated,
- const SCEV *A, Predicate Pred, const SCEV *B);
- Value *getConditionToReach(BasicBlock *A,
- DomTreeNodeBase<BasicBlock> *B,
- bool &negated);
- Value *getConditionToReach(BasicBlock *A,
- BasicBlock *B,
- bool &negated);
- const SCEV *computeAllocationCount(Value *P, const Type *&Ty) const;
- const SCEV *computeAllocationCountForType(Value *P, const Type *Ty) const;
- };
-}
-#endif
-
Modified: llvm/trunk/include/llvm/LinkAllPasses.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/include/llvm/LinkAllPasses.h?rev=115062&r1=115061&r2=115062&view=diff
==============================================================================
--- llvm/trunk/include/llvm/LinkAllPasses.h (original)
+++ llvm/trunk/include/llvm/LinkAllPasses.h Wed Sep 29 13:43:27 2010
@@ -20,7 +20,6 @@
#include "llvm/Analysis/FindUsedTypes.h"
#include "llvm/Analysis/IntervalPartition.h"
#include "llvm/Analysis/Passes.h"
-#include "llvm/Analysis/PointerTracking.h"
#include "llvm/Analysis/PostDominators.h"
#include "llvm/Analysis/RegionPrinter.h"
#include "llvm/Analysis/ScalarEvolution.h"
@@ -152,7 +151,6 @@
(void)new llvm::IntervalPartition();
(void)new llvm::FindUsedTypes();
(void)new llvm::ScalarEvolution();
- (void)new llvm::PointerTracking();
((llvm::Function*)0)->viewCFGOnly();
llvm::AliasSetTracker X(*(llvm::AliasAnalysis*)0);
X.add((llvm::Value*)0, 0); // for -print-alias-sets
Removed: llvm/trunk/lib/Analysis/PointerTracking.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Analysis/PointerTracking.cpp?rev=115061&view=auto
==============================================================================
--- llvm/trunk/lib/Analysis/PointerTracking.cpp (original)
+++ llvm/trunk/lib/Analysis/PointerTracking.cpp (removed)
@@ -1,316 +0,0 @@
-//===- PointerTracking.cpp - Pointer Bounds Tracking ------------*- C++ -*-===//
-//
-// The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-// This file implements tracking of pointer bounds.
-//
-//===----------------------------------------------------------------------===//
-
-#include "llvm/Analysis/ConstantFolding.h"
-#include "llvm/Analysis/Dominators.h"
-#include "llvm/Analysis/LoopInfo.h"
-#include "llvm/Analysis/MemoryBuiltins.h"
-#include "llvm/Analysis/PointerTracking.h"
-#include "llvm/Analysis/ScalarEvolution.h"
-#include "llvm/Analysis/ScalarEvolutionExpressions.h"
-#include "llvm/Constants.h"
-#include "llvm/Module.h"
-#include "llvm/Value.h"
-#include "llvm/Support/CallSite.h"
-#include "llvm/Support/InstIterator.h"
-#include "llvm/Support/raw_ostream.h"
-#include "llvm/Target/TargetData.h"
-using namespace llvm;
-
-char PointerTracking::ID = 0;
-PointerTracking::PointerTracking() : FunctionPass(ID) {}
-
-bool PointerTracking::runOnFunction(Function &F) {
- predCache.clear();
- assert(analyzing.empty());
- FF = &F;
- TD = getAnalysisIfAvailable<TargetData>();
- SE = &getAnalysis<ScalarEvolution>();
- LI = &getAnalysis<LoopInfo>();
- DT = &getAnalysis<DominatorTree>();
- return false;
-}
-
-void PointerTracking::getAnalysisUsage(AnalysisUsage &AU) const {
- AU.addRequiredTransitive<DominatorTree>();
- AU.addRequiredTransitive<LoopInfo>();
- AU.addRequiredTransitive<ScalarEvolution>();
- AU.setPreservesAll();
-}
-
-bool PointerTracking::doInitialization(Module &M) {
- const Type *PTy = Type::getInt8PtrTy(M.getContext());
-
- // Find calloc(i64, i64) or calloc(i32, i32).
- callocFunc = M.getFunction("calloc");
- if (callocFunc) {
- const FunctionType *Ty = callocFunc->getFunctionType();
-
- std::vector<const Type*> args, args2;
- args.push_back(Type::getInt64Ty(M.getContext()));
- args.push_back(Type::getInt64Ty(M.getContext()));
- args2.push_back(Type::getInt32Ty(M.getContext()));
- args2.push_back(Type::getInt32Ty(M.getContext()));
- const FunctionType *Calloc1Type =
- FunctionType::get(PTy, args, false);
- const FunctionType *Calloc2Type =
- FunctionType::get(PTy, args2, false);
- if (Ty != Calloc1Type && Ty != Calloc2Type)
- callocFunc = 0; // Give up
- }
-
- // Find realloc(i8*, i64) or realloc(i8*, i32).
- reallocFunc = M.getFunction("realloc");
- if (reallocFunc) {
- const FunctionType *Ty = reallocFunc->getFunctionType();
- std::vector<const Type*> args, args2;
- args.push_back(PTy);
- args.push_back(Type::getInt64Ty(M.getContext()));
- args2.push_back(PTy);
- args2.push_back(Type::getInt32Ty(M.getContext()));
-
- const FunctionType *Realloc1Type =
- FunctionType::get(PTy, args, false);
- const FunctionType *Realloc2Type =
- FunctionType::get(PTy, args2, false);
- if (Ty != Realloc1Type && Ty != Realloc2Type)
- reallocFunc = 0; // Give up
- }
- return false;
-}
-
-// Calculates the number of elements allocated for pointer P,
-// the type of the element is stored in Ty.
-const SCEV *PointerTracking::computeAllocationCount(Value *P,
- const Type *&Ty) const {
- Value *V = P->stripPointerCasts();
- if (AllocaInst *AI = dyn_cast<AllocaInst>(V)) {
- Value *arraySize = AI->getArraySize();
- Ty = AI->getAllocatedType();
- // arraySize elements of type Ty.
- return SE->getSCEV(arraySize);
- }
-
- if (CallInst *CI = extractMallocCall(V)) {
- Value *arraySize = getMallocArraySize(CI, TD);
- const Type* AllocTy = getMallocAllocatedType(CI);
- if (!AllocTy || !arraySize) return SE->getCouldNotCompute();
- Ty = AllocTy;
- // arraySize elements of type Ty.
- return SE->getSCEV(arraySize);
- }
-
- if (GlobalVariable *GV = dyn_cast<GlobalVariable>(V)) {
- if (GV->hasDefinitiveInitializer()) {
- Constant *C = GV->getInitializer();
- if (const ArrayType *ATy = dyn_cast<ArrayType>(C->getType())) {
- Ty = ATy->getElementType();
- return SE->getConstant(Type::getInt32Ty(P->getContext()),
- ATy->getNumElements());
- }
- }
- Ty = GV->getType();
- return SE->getConstant(Type::getInt32Ty(P->getContext()), 1);
- //TODO: implement more tracking for globals
- }
-
- if (CallInst *CI = dyn_cast<CallInst>(V)) {
- CallSite CS(CI);
- Function *F = dyn_cast<Function>(CS.getCalledValue()->stripPointerCasts());
- const Loop *L = LI->getLoopFor(CI->getParent());
- if (F == callocFunc) {
- Ty = Type::getInt8Ty(P->getContext());
- // calloc allocates arg0*arg1 bytes.
- return SE->getSCEVAtScope(SE->getMulExpr(SE->getSCEV(CS.getArgument(0)),
- SE->getSCEV(CS.getArgument(1))),
- L);
- } else if (F == reallocFunc) {
- Ty = Type::getInt8Ty(P->getContext());
- // realloc allocates arg1 bytes.
- return SE->getSCEVAtScope(CS.getArgument(1), L);
- }
- }
-
- return SE->getCouldNotCompute();
-}
-
-Value *PointerTracking::computeAllocationCountValue(Value *P, const Type *&Ty) const
-{
- Value *V = P->stripPointerCasts();
- if (AllocaInst *AI = dyn_cast<AllocaInst>(V)) {
- Ty = AI->getAllocatedType();
- // arraySize elements of type Ty.
- return AI->getArraySize();
- }
-
- if (CallInst *CI = extractMallocCall(V)) {
- Ty = getMallocAllocatedType(CI);
- if (!Ty)
- return 0;
- Value *arraySize = getMallocArraySize(CI, TD);
- if (!arraySize) {
- Ty = Type::getInt8Ty(P->getContext());
- return CI->getArgOperand(0);
- }
- // arraySize elements of type Ty.
- return arraySize;
- }
-
- if (GlobalVariable *GV = dyn_cast<GlobalVariable>(V)) {
- if (GV->hasDefinitiveInitializer()) {
- Constant *C = GV->getInitializer();
- if (const ArrayType *ATy = dyn_cast<ArrayType>(C->getType())) {
- Ty = ATy->getElementType();
- return ConstantInt::get(Type::getInt32Ty(P->getContext()),
- ATy->getNumElements());
- }
- }
- Ty = cast<PointerType>(GV->getType())->getElementType();
- return ConstantInt::get(Type::getInt32Ty(P->getContext()), 1);
- //TODO: implement more tracking for globals
- }
-
- if (CallInst *CI = dyn_cast<CallInst>(V)) {
- CallSite CS(CI);
- Function *F = dyn_cast<Function>(CS.getCalledValue()->stripPointerCasts());
- if (F == reallocFunc) {
- Ty = Type::getInt8Ty(P->getContext());
- // realloc allocates arg1 bytes.
- return CS.getArgument(1);
- }
- }
-
- return 0;
-}
-
-// Calculates the number of elements of type Ty allocated for P.
-const SCEV *PointerTracking::computeAllocationCountForType(Value *P,
- const Type *Ty)
- const {
- const Type *elementTy;
- const SCEV *Count = computeAllocationCount(P, elementTy);
- if (isa<SCEVCouldNotCompute>(Count))
- return Count;
- if (elementTy == Ty)
- return Count;
-
- if (!TD) // need TargetData from this point forward
- return SE->getCouldNotCompute();
-
- uint64_t elementSize = TD->getTypeAllocSize(elementTy);
- uint64_t wantSize = TD->getTypeAllocSize(Ty);
- if (elementSize == wantSize)
- return Count;
- if (elementSize % wantSize) //fractional counts not possible
- return SE->getCouldNotCompute();
- return SE->getMulExpr(Count, SE->getConstant(Count->getType(),
- elementSize/wantSize));
-}
-
-const SCEV *PointerTracking::getAllocationElementCount(Value *V) const {
- // We only deal with pointers.
- const PointerType *PTy = cast<PointerType>(V->getType());
- return computeAllocationCountForType(V, PTy->getElementType());
-}
-
-const SCEV *PointerTracking::getAllocationSizeInBytes(Value *V) const {
- return computeAllocationCountForType(V, Type::getInt8Ty(V->getContext()));
-}
-
-// Helper for isLoopGuardedBy that checks the swapped and inverted predicate too
-enum SolverResult PointerTracking::isLoopGuardedBy(const Loop *L,
- Predicate Pred,
- const SCEV *A,
- const SCEV *B) const {
- if (SE->isLoopEntryGuardedByCond(L, Pred, A, B))
- return AlwaysTrue;
- Pred = ICmpInst::getSwappedPredicate(Pred);
- if (SE->isLoopEntryGuardedByCond(L, Pred, B, A))
- return AlwaysTrue;
-
- Pred = ICmpInst::getInversePredicate(Pred);
- if (SE->isLoopEntryGuardedByCond(L, Pred, B, A))
- return AlwaysFalse;
- Pred = ICmpInst::getSwappedPredicate(Pred);
- if (SE->isLoopEntryGuardedByCond(L, Pred, A, B))
- return AlwaysTrue;
- return Unknown;
-}
-
-enum SolverResult PointerTracking::checkLimits(const SCEV *Offset,
- const SCEV *Limit,
- BasicBlock *BB)
-{
- //FIXME: merge implementation
- return Unknown;
-}
-
-void PointerTracking::getPointerOffset(Value *Pointer, Value *&Base,
- const SCEV *&Limit,
- const SCEV *&Offset) const
-{
- Pointer = Pointer->stripPointerCasts();
- Base = Pointer->getUnderlyingObject();
- Limit = getAllocationSizeInBytes(Base);
- if (isa<SCEVCouldNotCompute>(Limit)) {
- Base = 0;
- Offset = Limit;
- return;
- }
-
- Offset = SE->getMinusSCEV(SE->getSCEV(Pointer), SE->getSCEV(Base));
- if (isa<SCEVCouldNotCompute>(Offset)) {
- Base = 0;
- Limit = Offset;
- }
-}
-
-void PointerTracking::print(raw_ostream &OS, const Module* M) const {
- // Calling some PT methods may cause caches to be updated, however
- // this should be safe for the same reason its safe for SCEV.
- PointerTracking &PT = *const_cast<PointerTracking*>(this);
- for (inst_iterator I=inst_begin(*FF), E=inst_end(*FF); I != E; ++I) {
- if (!I->getType()->isPointerTy())
- continue;
- Value *Base;
- const SCEV *Limit, *Offset;
- getPointerOffset(&*I, Base, Limit, Offset);
- if (!Base)
- continue;
-
- if (Base == &*I) {
- const SCEV *S = getAllocationElementCount(Base);
- OS << *Base << " ==> " << *S << " elements, ";
- OS << *Limit << " bytes allocated\n";
- continue;
- }
- OS << &*I << " -- base: " << *Base;
- OS << " offset: " << *Offset;
-
- enum SolverResult res = PT.checkLimits(Offset, Limit, I->getParent());
- switch (res) {
- case AlwaysTrue:
- OS << " always safe\n";
- break;
- case AlwaysFalse:
- OS << " always unsafe\n";
- break;
- case Unknown:
- OS << " <<unknown>>\n";
- break;
- }
- }
-}
-
-INITIALIZE_PASS(PointerTracking, "pointertracking",
- "Track pointer bounds", false, true);
More information about the llvm-commits
mailing list