[llvm] b3b6ede - [hwasan] Update (Post-)DominatorTreeAnalysis and LoopAnalysis incrementally (#66935)
via llvm-commits
llvm-commits at lists.llvm.org
Thu Sep 28 09:09:43 PDT 2023
Author: Thurston Dang
Date: 2023-09-28T09:09:38-07:00
New Revision: b3b6edefdb7ae77e4b2344c9a64fd1d486c91405
URL: https://github.com/llvm/llvm-project/commit/b3b6edefdb7ae77e4b2344c9a64fd1d486c91405
DIFF: https://github.com/llvm/llvm-project/commit/b3b6edefdb7ae77e4b2344c9a64fd1d486c91405.diff
LOG: [hwasan] Update (Post-)DominatorTreeAnalysis and LoopAnalysis incrementally (#66935)
HWAddressSanitizerPass::run sanitizes functions one by one. The
sanitization of each function - which may split blocks via
insertShadowTagCheck - may result in some cached analyses are invalid.
This matters because sanitizeFunction(F', FAM) may indirectly call the
global stack safety analysis, hence we need to make sure the analyses of
F are up to date.
Bug report: https://github.com/llvm/llvm-project/issues/66934
Added:
Modified:
llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
Removed:
################################################################################
diff --git a/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
index 29770ece9c61eb2..472b3ac396bded3 100644
--- a/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
@@ -17,6 +17,7 @@
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/StringExtras.h"
#include "llvm/ADT/StringRef.h"
+#include "llvm/Analysis/DomTreeUpdater.h"
#include "llvm/Analysis/GlobalsModRef.h"
#include "llvm/Analysis/PostDominators.h"
#include "llvm/Analysis/StackSafetyAnalysis.h"
@@ -303,17 +304,20 @@ class HWAddressSanitizer {
Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
int64_t getAccessInfo(bool IsWrite, unsigned AccessSizeIndex);
- ShadowTagCheckInfo insertShadowTagCheck(Value *Ptr,
- Instruction *InsertBefore);
+ ShadowTagCheckInfo insertShadowTagCheck(Value *Ptr, Instruction *InsertBefore,
+ DomTreeUpdater &DTU, LoopInfo &LI);
void instrumentMemAccessOutline(Value *Ptr, bool IsWrite,
unsigned AccessSizeIndex,
- Instruction *InsertBefore);
+ Instruction *InsertBefore,
+ DomTreeUpdater &DTU, LoopInfo &LI);
void instrumentMemAccessInline(Value *Ptr, bool IsWrite,
unsigned AccessSizeIndex,
- Instruction *InsertBefore);
+ Instruction *InsertBefore, DomTreeUpdater &DTU,
+ LoopInfo &LI);
bool ignoreMemIntrinsic(MemIntrinsic *MI);
void instrumentMemIntrinsic(MemIntrinsic *MI);
- bool instrumentMemAccess(InterestingMemoryOperand &O);
+ bool instrumentMemAccess(InterestingMemoryOperand &O, DomTreeUpdater &DTU,
+ LoopInfo &LI);
bool ignoreAccess(Instruction *Inst, Value *Ptr);
void getInterestingMemoryOperands(
Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting);
@@ -434,6 +438,12 @@ PreservedAnalyses HWAddressSanitizerPass::run(Module &M,
HWASan.sanitizeFunction(F, FAM);
PreservedAnalyses PA = PreservedAnalyses::none();
+ // DominatorTreeAnalysis, PostDominatorTreeAnalysis, and LoopAnalysis
+ // are incrementally updated throughout this pass whenever
+ // SplitBlockAndInsertIfThen is called.
+ PA.preserve<DominatorTreeAnalysis>();
+ PA.preserve<PostDominatorTreeAnalysis>();
+ PA.preserve<LoopAnalysis>();
// GlobalsAA is considered stateless and does not get invalidated unless
// explicitly invalidated; PreservedAnalyses::none() is not enough. Sanitizers
// make changes that require GlobalsAA to be invalidated.
@@ -861,8 +871,8 @@ int64_t HWAddressSanitizer::getAccessInfo(bool IsWrite,
}
HWAddressSanitizer::ShadowTagCheckInfo
-HWAddressSanitizer::insertShadowTagCheck(Value *Ptr,
- Instruction *InsertBefore) {
+HWAddressSanitizer::insertShadowTagCheck(Value *Ptr, Instruction *InsertBefore,
+ DomTreeUpdater &DTU, LoopInfo &LI) {
ShadowTagCheckInfo R;
IRBuilder<> IRB(InsertBefore);
@@ -881,21 +891,24 @@ HWAddressSanitizer::insertShadowTagCheck(Value *Ptr,
TagMismatch = IRB.CreateAnd(TagMismatch, TagNotIgnored);
}
- R.TagMismatchTerm =
- SplitBlockAndInsertIfThen(TagMismatch, InsertBefore, false,
- MDBuilder(*C).createBranchWeights(1, 100000));
+ R.TagMismatchTerm = SplitBlockAndInsertIfThen(
+ TagMismatch, InsertBefore, false,
+ MDBuilder(*C).createBranchWeights(1, 100000), &DTU, &LI);
return R;
}
void HWAddressSanitizer::instrumentMemAccessOutline(Value *Ptr, bool IsWrite,
unsigned AccessSizeIndex,
- Instruction *InsertBefore) {
+ Instruction *InsertBefore,
+ DomTreeUpdater &DTU,
+ LoopInfo &LI) {
assert(!UsePageAliases);
const int64_t AccessInfo = getAccessInfo(IsWrite, AccessSizeIndex);
if (InlineFastPath)
- InsertBefore = insertShadowTagCheck(Ptr, InsertBefore).TagMismatchTerm;
+ InsertBefore =
+ insertShadowTagCheck(Ptr, InsertBefore, DTU, LI).TagMismatchTerm;
IRBuilder<> IRB(InsertBefore);
Module *M = IRB.GetInsertBlock()->getParent()->getParent();
@@ -909,18 +922,20 @@ void HWAddressSanitizer::instrumentMemAccessOutline(Value *Ptr, bool IsWrite,
void HWAddressSanitizer::instrumentMemAccessInline(Value *Ptr, bool IsWrite,
unsigned AccessSizeIndex,
- Instruction *InsertBefore) {
+ Instruction *InsertBefore,
+ DomTreeUpdater &DTU,
+ LoopInfo &LI) {
assert(!UsePageAliases);
const int64_t AccessInfo = getAccessInfo(IsWrite, AccessSizeIndex);
- ShadowTagCheckInfo TCI = insertShadowTagCheck(Ptr, InsertBefore);
+ ShadowTagCheckInfo TCI = insertShadowTagCheck(Ptr, InsertBefore, DTU, LI);
IRBuilder<> IRB(TCI.TagMismatchTerm);
Value *OutOfShortGranuleTagRange =
IRB.CreateICmpUGT(TCI.MemTag, ConstantInt::get(Int8Ty, 15));
Instruction *CheckFailTerm = SplitBlockAndInsertIfThen(
OutOfShortGranuleTagRange, TCI.TagMismatchTerm, !Recover,
- MDBuilder(*C).createBranchWeights(1, 100000));
+ MDBuilder(*C).createBranchWeights(1, 100000), &DTU, &LI);
IRB.SetInsertPoint(TCI.TagMismatchTerm);
Value *PtrLowBits = IRB.CreateTrunc(IRB.CreateAnd(TCI.PtrLong, 15), Int8Ty);
@@ -928,9 +943,8 @@ void HWAddressSanitizer::instrumentMemAccessInline(Value *Ptr, bool IsWrite,
PtrLowBits, ConstantInt::get(Int8Ty, (1 << AccessSizeIndex) - 1));
Value *PtrLowBitsOOB = IRB.CreateICmpUGE(PtrLowBits, TCI.MemTag);
SplitBlockAndInsertIfThen(PtrLowBitsOOB, TCI.TagMismatchTerm, false,
- MDBuilder(*C).createBranchWeights(1, 100000),
- (DomTreeUpdater *)nullptr, nullptr,
- CheckFailTerm->getParent());
+ MDBuilder(*C).createBranchWeights(1, 100000), &DTU,
+ &LI, CheckFailTerm->getParent());
IRB.SetInsertPoint(TCI.TagMismatchTerm);
Value *InlineTagAddr = IRB.CreateOr(TCI.AddrLong, 15);
@@ -938,9 +952,8 @@ void HWAddressSanitizer::instrumentMemAccessInline(Value *Ptr, bool IsWrite,
Value *InlineTag = IRB.CreateLoad(Int8Ty, InlineTagAddr);
Value *InlineTagMismatch = IRB.CreateICmpNE(TCI.PtrTag, InlineTag);
SplitBlockAndInsertIfThen(InlineTagMismatch, TCI.TagMismatchTerm, false,
- MDBuilder(*C).createBranchWeights(1, 100000),
- (DomTreeUpdater *)nullptr, nullptr,
- CheckFailTerm->getParent());
+ MDBuilder(*C).createBranchWeights(1, 100000), &DTU,
+ &LI, CheckFailTerm->getParent());
IRB.SetInsertPoint(CheckFailTerm);
InlineAsm *Asm;
@@ -1015,7 +1028,9 @@ void HWAddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
MI->eraseFromParent();
}
-bool HWAddressSanitizer::instrumentMemAccess(InterestingMemoryOperand &O) {
+bool HWAddressSanitizer::instrumentMemAccess(InterestingMemoryOperand &O,
+ DomTreeUpdater &DTU,
+ LoopInfo &LI) {
Value *Addr = O.getPtr();
LLVM_DEBUG(dbgs() << "Instrumenting: " << O.getInsn() << "\n");
@@ -1036,9 +1051,11 @@ bool HWAddressSanitizer::instrumentMemAccess(InterestingMemoryOperand &O) {
IRB.CreateCall(HwasanMemoryAccessCallback[O.IsWrite][AccessSizeIndex],
Args);
} else if (OutlinedChecks) {
- instrumentMemAccessOutline(Addr, O.IsWrite, AccessSizeIndex, O.getInsn());
+ instrumentMemAccessOutline(Addr, O.IsWrite, AccessSizeIndex, O.getInsn(),
+ DTU, LI);
} else {
- instrumentMemAccessInline(Addr, O.IsWrite, AccessSizeIndex, O.getInsn());
+ instrumentMemAccessInline(Addr, O.IsWrite, AccessSizeIndex, O.getInsn(),
+ DTU, LI);
}
} else {
SmallVector<Value *, 3> Args{
@@ -1542,8 +1559,13 @@ void HWAddressSanitizer::sanitizeFunction(Function &F,
}
}
+ DominatorTree *DT = FAM.getCachedResult<DominatorTreeAnalysis>(F);
+ PostDominatorTree *PDT = FAM.getCachedResult<PostDominatorTreeAnalysis>(F);
+ LoopInfo *LI = FAM.getCachedResult<LoopAnalysis>(F);
+ DomTreeUpdater DTU(DT, PDT, DomTreeUpdater::UpdateStrategy::Lazy);
for (auto &Operand : OperandsToInstrument)
- instrumentMemAccess(Operand);
+ instrumentMemAccess(Operand, DTU, *LI);
+ DTU.flush();
if (ClInstrumentMemIntrinsics && !IntrinToInstrument.empty()) {
for (auto *Inst : IntrinToInstrument)
More information about the llvm-commits
mailing list