Index: lib/Analysis/MemoryBuiltins.cpp =================================================================== --- lib/Analysis/MemoryBuiltins.cpp +++ lib/Analysis/MemoryBuiltins.cpp @@ -42,39 +42,38 @@ }; struct AllocFnsTy { - LibFunc::Func Func; AllocType AllocTy; - unsigned char NumParams; + unsigned NumParams; // First and Second size parameters (or -1 if unused) - signed char FstParam, SndParam; + int FstParam, SndParam; }; // FIXME: certain users need more information. E.g., SimplifyLibCalls needs to // know which functions are nounwind, noalias, nocapture parameters, etc. -static const AllocFnsTy AllocationFnData[] = { - {LibFunc::malloc, MallocLike, 1, 0, -1}, - {LibFunc::valloc, MallocLike, 1, 0, -1}, - {LibFunc::Znwj, OpNewLike, 1, 0, -1}, // new(unsigned int) - {LibFunc::ZnwjRKSt9nothrow_t, MallocLike, 2, 0, -1}, // new(unsigned int, nothrow) - {LibFunc::Znwm, OpNewLike, 1, 0, -1}, // new(unsigned long) - {LibFunc::ZnwmRKSt9nothrow_t, MallocLike, 2, 0, -1}, // new(unsigned long, nothrow) - {LibFunc::Znaj, OpNewLike, 1, 0, -1}, // new[](unsigned int) - {LibFunc::ZnajRKSt9nothrow_t, MallocLike, 2, 0, -1}, // new[](unsigned int, nothrow) - {LibFunc::Znam, OpNewLike, 1, 0, -1}, // new[](unsigned long) - {LibFunc::ZnamRKSt9nothrow_t, MallocLike, 2, 0, -1}, // new[](unsigned long, nothrow) - {LibFunc::msvc_new_int, OpNewLike, 1, 0, -1}, // new(unsigned int) - {LibFunc::msvc_new_int_nothrow, MallocLike, 2, 0, -1}, // new(unsigned int, nothrow) - {LibFunc::msvc_new_longlong, OpNewLike, 1, 0, -1}, // new(unsigned long long) - {LibFunc::msvc_new_longlong_nothrow, MallocLike, 2, 0, -1}, // new(unsigned long long, nothrow) - {LibFunc::msvc_new_array_int, OpNewLike, 1, 0, -1}, // new[](unsigned int) - {LibFunc::msvc_new_array_int_nothrow, MallocLike, 2, 0, -1}, // new[](unsigned int, nothrow) - {LibFunc::msvc_new_array_longlong, OpNewLike, 1, 0, -1}, // new[](unsigned long long) - {LibFunc::msvc_new_array_longlong_nothrow, MallocLike, 2, 0, -1}, // new[](unsigned long long, nothrow) - {LibFunc::calloc, CallocLike, 2, 0, 1}, - {LibFunc::realloc, ReallocLike, 2, 1, -1}, - {LibFunc::reallocf, ReallocLike, 2, 1, -1}, - {LibFunc::strdup, StrDupLike, 1, -1, -1}, - {LibFunc::strndup, StrDupLike, 2, 1, -1} +static const std::pair AllocationFnData[] = { + {LibFunc::malloc, {MallocLike, 1, 0, -1}}, + {LibFunc::valloc, {MallocLike, 1, 0, -1}}, + {LibFunc::Znwj, {OpNewLike, 1, 0, -1}}, // new(unsigned int) + {LibFunc::ZnwjRKSt9nothrow_t, {MallocLike, 2, 0, -1}}, // new(unsigned int, nothrow) + {LibFunc::Znwm, {OpNewLike, 1, 0, -1}}, // new(unsigned long) + {LibFunc::ZnwmRKSt9nothrow_t, {MallocLike, 2, 0, -1}}, // new(unsigned long, nothrow) + {LibFunc::Znaj, {OpNewLike, 1, 0, -1}}, // new[](unsigned int) + {LibFunc::ZnajRKSt9nothrow_t, {MallocLike, 2, 0, -1}}, // new[](unsigned int, nothrow) + {LibFunc::Znam, {OpNewLike, 1, 0, -1}}, // new[](unsigned long) + {LibFunc::ZnamRKSt9nothrow_t, {MallocLike, 2, 0, -1}}, // new[](unsigned long, nothrow) + {LibFunc::msvc_new_int, {OpNewLike, 1, 0, -1}}, // new(unsigned int) + {LibFunc::msvc_new_int_nothrow, {MallocLike, 2, 0, -1}}, // new(unsigned int, nothrow) + {LibFunc::msvc_new_longlong, {OpNewLike, 1, 0, -1}}, // new(unsigned long long) + {LibFunc::msvc_new_longlong_nothrow, {MallocLike, 2, 0, -1}}, // new(unsigned long long, nothrow) + {LibFunc::msvc_new_array_int, {OpNewLike, 1, 0, -1}}, // new[](unsigned int) + {LibFunc::msvc_new_array_int_nothrow, {MallocLike, 2, 0, -1}}, // new[](unsigned int, nothrow) + {LibFunc::msvc_new_array_longlong, {OpNewLike, 1, 0, -1}}, // new[](unsigned long long) + {LibFunc::msvc_new_array_longlong_nothrow, {MallocLike, 2, 0, -1}}, // new[](unsigned long long, nothrow) + {LibFunc::calloc, {CallocLike, 2, 0, 1}}, + {LibFunc::realloc, {ReallocLike, 2, 1, -1}}, + {LibFunc::reallocf, {ReallocLike, 2, 1, -1}}, + {LibFunc::strdup, {StrDupLike, 1, -1, -1}}, + {LibFunc::strndup, {StrDupLike, 2, 1, -1}} // TODO: Handle "int posix_memalign(void **, size_t, size_t)" }; @@ -96,34 +95,57 @@ return Callee; } -/// \brief Returns the allocation data for the given value if it is a call to a -/// known allocation function, and NULL otherwise. -static const AllocFnsTy *getAllocationData(const Value *V, AllocType AllocTy, - const TargetLibraryInfo *TLI, - bool LookThroughBitCast = false) { +/// Returns the allocation data for the given value if it's either a call to a +/// known allocation function, or a call to a function with the allocsize +/// attribute. +static Optional getAllocationData(const Value *V, AllocType AllocTy, + const TargetLibraryInfo *TLI, + bool LookThroughBitCast = false) { // Skip intrinsics if (isa(V)) - return nullptr; + return None; - Function *Callee = getCalledFunction(V, LookThroughBitCast); + const Function *Callee = getCalledFunction(V, LookThroughBitCast); if (!Callee) - return nullptr; + return None; + + // If it has allocsize, we can skip checking if it's a known function. + // + // MallocLike is chosen here because allocsize makes no guarantees about the + // nullness of the result of the function, nor does it deal with strings, nor + // does it require that the memory returned is zeroed out. + LLVM_CONSTEXPR auto AllocSizeAllocTy = MallocLike; + if ((AllocTy & AllocSizeAllocTy) == AllocSizeAllocTy && + Callee->hasFnAttribute(Attribute::AllocSize)) { + Attribute Attr = Callee->getFnAttribute(Attribute::AllocSize); + std::pair> Args = Attr.getAllocSizeArgs(); + + AllocFnsTy Result; + Result.AllocTy = AllocSizeAllocTy; + Result.NumParams = Callee->getNumOperands(); + Result.FstParam = Args.first; + Result.SndParam = Args.second.getValueOr(-1); + return Result; + } // Make sure that the function is available. StringRef FnName = Callee->getName(); LibFunc::Func TLIFn; if (!TLI || !TLI->getLibFunc(FnName, TLIFn) || !TLI->has(TLIFn)) - return nullptr; + return None; - const AllocFnsTy *FnData = + const auto *Iter = std::find_if(std::begin(AllocationFnData), std::end(AllocationFnData), - [TLIFn](const AllocFnsTy &Fn) { return Fn.Func == TLIFn; }); + [TLIFn](const std::pair &P) { + return P.first == TLIFn; + }); - if (FnData == std::end(AllocationFnData)) - return nullptr; + if (Iter == std::end(AllocationFnData)) + return None; + const AllocFnsTy *FnData = &Iter->second; if ((FnData->AllocTy & AllocTy) != FnData->AllocTy) - return nullptr; + return None; // Check function prototype. int FstParam = FnData->FstParam; @@ -138,8 +160,8 @@ (SndParam < 0 || FTy->getParamType(SndParam)->isIntegerTy(32) || FTy->getParamType(SndParam)->isIntegerTy(64))) - return FnData; - return nullptr; + return *FnData; + return None; } static bool hasNoAliasAttr(const Value *V, bool LookThroughBitCast) { @@ -153,7 +175,7 @@ /// like). bool llvm::isAllocationFn(const Value *V, const TargetLibraryInfo *TLI, bool LookThroughBitCast) { - return getAllocationData(V, AnyAlloc, TLI, LookThroughBitCast); + return getAllocationData(V, AnyAlloc, TLI, LookThroughBitCast).hasValue(); } /// \brief Tests if a value is a call or invoke to a function that returns a @@ -170,21 +192,21 @@ /// allocates uninitialized memory (such as malloc). bool llvm::isMallocLikeFn(const Value *V, const TargetLibraryInfo *TLI, bool LookThroughBitCast) { - return getAllocationData(V, MallocLike, TLI, LookThroughBitCast); + return getAllocationData(V, MallocLike, TLI, LookThroughBitCast).hasValue(); } /// \brief Tests if a value is a call or invoke to a library function that /// allocates zero-filled memory (such as calloc). bool llvm::isCallocLikeFn(const Value *V, const TargetLibraryInfo *TLI, bool LookThroughBitCast) { - return getAllocationData(V, CallocLike, TLI, LookThroughBitCast); + return getAllocationData(V, CallocLike, TLI, LookThroughBitCast).hasValue(); } /// \brief Tests if a value is a call or invoke to a library function that /// allocates memory (either malloc, calloc, or strdup like). bool llvm::isAllocLikeFn(const Value *V, const TargetLibraryInfo *TLI, bool LookThroughBitCast) { - return getAllocationData(V, AllocLike, TLI, LookThroughBitCast); + return getAllocationData(V, AllocLike, TLI, LookThroughBitCast).hasValue(); } /// extractMallocCall - Returns the corresponding CallInst if the instruction @@ -454,8 +476,8 @@ } SizeOffsetType ObjectSizeOffsetVisitor::visitCallSite(CallSite CS) { - const AllocFnsTy *FnData = getAllocationData(CS.getInstruction(), AnyAlloc, - TLI); + Optional FnData = + getAllocationData(CS.getInstruction(), AnyAlloc, TLI); if (!FnData) return unknown(); @@ -467,7 +489,8 @@ // strndup limits strlen if (FnData->FstParam > 0) { - ConstantInt *Arg= dyn_cast(CS.getArgument(FnData->FstParam)); + ConstantInt *Arg = + dyn_cast(CS.getArgument(FnData->FstParam)); if (!Arg) return unknown(); @@ -482,7 +505,25 @@ if (!Arg) return unknown(); - APInt Size = Arg->getValue().zextOrSelf(IntTyBits); + // When we're compiling N-bit code, and the user uses parameters that are + // greater than N bits (e.g. uint64_t on a 32-bit build), we can run into + // trouble with APInt size issues. This function handles resizing + overflow + // checks for us. + auto CheckedZextOrTrunc = [&](APInt &I) { + // More bits than we can handle. Checking the bit width isn't necessary, but + // it's faster than checking active bits, and should give `false` in the + // vast majority of cases. + if (I.getBitWidth() > IntTyBits && I.getActiveBits() > IntTyBits) + return false; + if (I.getBitWidth() != IntTyBits) + I = I.zextOrTrunc(IntTyBits); + return true; + }; + + APInt Size = Arg->getValue(); + if (!CheckedZextOrTrunc(Size)) + return unknown(); + // size determined by just 1 parameter if (FnData->SndParam < 0) return std::make_pair(Size, Zero); @@ -491,8 +532,13 @@ if (!Arg) return unknown(); - Size *= Arg->getValue().zextOrSelf(IntTyBits); - return std::make_pair(Size, Zero); + APInt NumElems = Arg->getValue(); + if (!CheckedZextOrTrunc(NumElems)) + return unknown(); + + bool Overflow; + Size = Size.umul_ov(NumElems, Overflow); + return Overflow ? unknown() : std::make_pair(Size, Zero); // TODO: handle more standard functions (+ wchar cousins): // - strdup / strndup @@ -670,8 +716,8 @@ } SizeOffsetEvalType ObjectSizeOffsetEvaluator::visitCallSite(CallSite CS) { - const AllocFnsTy *FnData = getAllocationData(CS.getInstruction(), AnyAlloc, - TLI); + Optional FnData = + getAllocationData(CS.getInstruction(), AnyAlloc, TLI); if (!FnData) return unknown(); Index: test/Transforms/InstCombine/allocsize-32.ll =================================================================== --- /dev/null +++ test/Transforms/InstCombine/allocsize-32.ll @@ -0,0 +1,29 @@ +; RUN: opt < %s -instcombine -S | FileCheck %s +; +; The idea is that we want to have sane semantics (e.g. not assertion failures) +; when given an allocsize function that takes a 64-bit argument in the face of +; 32-bit pointers. + +target datalayout="e-p:32:32:32" + +declare i8* @my_malloc(i8*, i64) allocsize(1) + +define void @test_malloc(i8** %p, i32* %r) { + %1 = call i8* @my_malloc(i8* null, i64 100) + store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed + + %2 = call i32 @llvm.objectsize.i32.p0i8(i8* %1, i1 false) + ; CHECK: store i32 100 + store i32 %2, i32* %r, align 8 + + ; Big number is 5 billion. + %3 = call i8* @my_malloc(i8* null, i64 5000000000) + store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed + + ; CHECK: call i32 @llvm.objectsize + %4 = call i32 @llvm.objectsize.i32.p0i8(i8* %3, i1 false) + store i32 %4, i32* %r, align 8 + ret void +} + +declare i32 @llvm.objectsize.i32.p0i8(i8*, i1) Index: test/Transforms/InstCombine/allocsize.ll =================================================================== --- /dev/null +++ test/Transforms/InstCombine/allocsize.ll @@ -0,0 +1,141 @@ +; RUN: opt < %s -instcombine -S | FileCheck %s +; +; Test that instcombine folds allocsize function calls properly. +; Dummy arguments are inserted to verify that allocsize is picking the right +; args, and to prove that arbitrary unfoldable values don't interfere with +; allocsize if they're not used by allocsize. + +declare i8* @my_malloc(i8*, i32) allocsize(1) +declare i8* @my_calloc(i8*, i8*, i32, i32) allocsize(2, 3) + +; CHECK-LABEL: define void @test_malloc +define void @test_malloc(i8** %p, i64* %r) { + %1 = call i8* @my_malloc(i8* null, i32 100) + store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed + + %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false) + ; CHECK: store i64 100 + store i64 %2, i64* %r, align 8 + ret void +} + +; CHECK-LABEL: define void @test_calloc +define void @test_calloc(i8** %p, i64* %r) { + %1 = call i8* @my_calloc(i8* null, i8* null, i32 100, i32 5) + store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed + + %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false) + ; CHECK: store i64 500 + store i64 %2, i64* %r, align 8 + ret void +} + +; Failure cases with non-constant values... +; CHECK-LABEL: define void @test_malloc_fails +define void @test_malloc_fails(i8** %p, i64* %r, i32 %n) { + %1 = call i8* @my_malloc(i8* null, i32 %n) + store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed + + ; CHECK: @llvm.objectsize.i64.p0i8 + %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false) + store i64 %2, i64* %r, align 8 + ret void +} + +; CHECK-LABEL: define void @test_calloc_fails +define void @test_calloc_fails(i8** %p, i64* %r, i32 %n) { + %1 = call i8* @my_calloc(i8* null, i8* null, i32 %n, i32 5) + store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed + + ; CHECK: @llvm.objectsize.i64.p0i8 + %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false) + store i64 %2, i64* %r, align 8 + + + %3 = call i8* @my_calloc(i8* null, i8* null, i32 100, i32 %n) + store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed + + ; CHECK: @llvm.objectsize.i64.p0i8 + %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false) + store i64 %4, i64* %r, align 8 + ret void +} + +declare i8* @my_malloc_outofline(i8*, i32) #0 +declare i8* @my_calloc_outofline(i8*, i8*, i32, i32) #1 + +; Verifying that out of line allocsize is parsed correctly +; CHECK-LABEL: define void @test_outofline +define void @test_outofline(i8** %p, i64* %r) { + %1 = call i8* @my_malloc_outofline(i8* null, i32 100) + store i8* %1, i8** %p, align 8 ; To ensure objectsize isn't killed + + %2 = call i64 @llvm.objectsize.i64.p0i8(i8* %1, i1 false) + ; CHECK: store i64 100 + store i64 %2, i64* %r, align 8 + + + %3 = call i8* @my_calloc_outofline(i8* null, i8* null, i32 100, i32 5) + store i8* %3, i8** %p, align 8 ; To ensure objectsize isn't killed + + %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %3, i1 false) + ; CHECK: store i64 500 + store i64 %4, i64* %r, align 8 + ret void +} + +declare i8* @my_malloc_i64(i8*, i64) #0 +declare i8* @my_tiny_calloc(i8*, i8*, i8, i8) #1 +declare i8* @my_varied_calloc(i8*, i8*, i32, i8) #1 + +; CHECK-LABEL: define void @test_overflow +define void @test_overflow(i8** %p, i32* %r) { + %r64 = bitcast i32* %r to i64* + + ; (2**31 + 1) * 2 > 2**31. So overflow. Yay. + %big_malloc = call i8* @my_calloc(i8* null, i8* null, i32 2147483649, i32 2) + store i8* %big_malloc, i8** %p, align 8 + + ; CHECK: @llvm.objectsize + %1 = call i32 @llvm.objectsize.i32.p0i8(i8* %big_malloc, i1 false) + store i32 %1, i32* %r, align 4 + + + %big_little_malloc = call i8* @my_tiny_calloc(i8* null, i8* null, i8 127, i8 4) + store i8* %big_little_malloc, i8** %p, align 8 + + ; CHECK: store i32 508 + %2 = call i32 @llvm.objectsize.i32.p0i8(i8* %big_little_malloc, i1 false) + store i32 %2, i32* %r, align 4 + + + ; malloc(2**33) + %big_malloc_i64 = call i8* @my_malloc_i64(i8* null, i64 8589934592) + store i8* %big_malloc_i64, i8** %p, align 8 + + ; CHECK: @llvm.objectsize + %3 = call i32 @llvm.objectsize.i32.p0i8(i8* %big_malloc_i64, i1 false) + store i32 %3, i32* %r, align 4 + + + %4 = call i64 @llvm.objectsize.i64.p0i8(i8* %big_malloc_i64, i1 false) + ; CHECK: store i64 8589934592 + store i64 %4, i64* %r64, align 8 + + + ; Just intended to ensure that we properly handle args of different types... + %varied_calloc = call i8* @my_varied_calloc(i8* null, i8* null, i32 1000, i8 5) + store i8* %varied_calloc, i8** %p, align 8 + + ; CHECK: store i32 5000 + %5 = call i32 @llvm.objectsize.i32.p0i8(i8* %varied_calloc, i1 false) + store i32 %5, i32* %r, align 4 + + ret void +} + +attributes #0 = { allocsize(1) } +attributes #1 = { allocsize(2, 3) } + +declare i32 @llvm.objectsize.i32.p0i8(i8*, i1) +declare i64 @llvm.objectsize.i64.p0i8(i8*, i1)