[MemoryLocation] strcat/strncat/strcpy read/write after their args.

[fhahn]

Summary

strcpy/strcat/strncat access memory starting from the passed in
pointers. Construct memory locations for their args using getAfter.

Discussed in D114872.

[xbolva00]

llvm/lib/Analysis/MemoryLocation.cpp

218

For strncat we can do better analysis.

GetAfter - uppearBound(N + 1)

[reames]

LGTM. I agree we can refine strncat, but that can be done separately.

llvm/lib/Analysis/MemoryLocation.cpp

MemoryLocation MemoryLocation::getForArgument(const CallBase *Call,
 
   // We can bound the aliasing properties of memset_pattern16 just as we can
   // for memcpy/memset.  This is particularly important because the
   // LoopIdiomRecognizer likes to turn loops into calls to memset_pattern16
   // whenever possible.
   LibFunc F;
   if (TLI && TLI->getLibFunc(*Call, F) && TLI->has(F)) {
     switch (F) {
+    case LibFunc_strcpy:
+    case LibFunc_strcat:
+    case LibFunc_strncat:
+      assert((ArgIdx == 0 || ArgIdx == 1) && "Invalid argument index for str function");
+      return MemoryLocation::getAfter(Arg, AATags);
+
     case LibFunc_memset_chk: {
       assert(ArgIdx == 0 && "Invalid argument index for memset_chk");
       LocationSize Size = LocationSize::afterPointer();
       if (const auto *Len = dyn_cast<ConstantInt>(Call->getArgOperand(2))) {
         // memset_chk writes at most Len bytes. It may write less, if Len
         // exceeds the specified max size and aborts.
         Size = LocationSize::upperBound(Len->getZExtValue());
       }

llvm/test/Analysis/BasicAA/libfuncs.ll

entry:
   store i8 3, i8* %b.gep.5
   ret i8* %res
 }
 
 declare i8* @strcat(i8*, i8*)
 
 define i8* @test_strcat_read_write_after(i8* noalias %a, i8* noalias %b) {
 ; CHECK-LABEL: Function: test_strcat_read_write_after
-; CHECK:       Both ModRef:  Ptr: i8* %a  <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
-; CHECK-NEXT:  Just Ref:  Ptr: i8* %b <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
+; CHECK:       NoModRef:  Ptr: i8* %a <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
+; CHECK-NEXT:  NoModRef:  Ptr: i8* %b <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Both ModRef:  Ptr: i8* %a.gep.1  <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Just Ref:  Ptr: i8* %b.gep.1 <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Both ModRef:  Ptr: i8* %res  <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Both ModRef:  Ptr: i8* %a.gep.5  <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Just Ref:  Ptr: i8* %b.gep.5 <->  %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
 ;
 entry:
   store i8 0, i8* %a
   store i8 2, i8* %b
   %a.gep.1 = getelementptr i8, i8* %a, i32 1
   %b.gep.1 = getelementptr i8, i8* %b, i32 1
   %res = tail call i8* @strcat(i8* %a.gep.1, i8* %b.gep.1)
   %a.gep.5 = getelementptr i8, i8* %a, i32 5
   store i8 1, i8* %a.gep.5
   %b.gep.5 = getelementptr i8, i8* %b, i32 5
   store i8 3, i8* %b.gep.5
   ret i8* %res
 }
 
 declare i8* @strncat(i8*, i8*, i64)
 
 define i8* @test_strncat_read_write_after(i8* noalias %a, i8* noalias %b, i64 %n) {
 ; CHECK-LABEL: Function: test_strncat_read_write_after
-; CHECK:       Both ModRef:  Ptr: i8* %a  <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
-; CHECK-NEXT:  Just Ref:  Ptr: i8* %b <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
+; CHECK:       NoModRef:  Ptr: i8* %a <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
+; CHECK-NEXT:  NoModRef:  Ptr: i8* %b <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
 ; CHECK-NEXT:  Both ModRef:  Ptr: i8* %a.gep.1  <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
 ; CHECK-NEXT:  Just Ref:  Ptr: i8* %b.gep.1 <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
 ; CHECK-NEXT:  Both ModRef:  Ptr: i8* %res  <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
 ; CHECK-NEXT:  Both ModRef:  Ptr: i8* %a.gep.5  <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
 ; CHECK-NEXT:  Just Ref:  Ptr: i8* %b.gep.5 <->  %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
 ;
 entry:
   store i8 0, i8* %a
   store i8 2, i8* %b
   %a.gep.1 = getelementptr i8, i8* %a, i32 1
   %b.gep.1 = getelementptr i8, i8* %b, i32 1
   %res = tail call i8* @strncat(i8* %a.gep.1, i8* %b.gep.1, i64 %n)
   %a.gep.5 = getelementptr i8, i8* %a, i32 5
   store i8 1, i8* %a.gep.5
   %b.gep.5 = getelementptr i8, i8* %b, i32 5
   store i8 3, i8* %b.gep.5
   ret i8* %res
 }
 
 declare i8* @strcpy(i8*, i8*)
 
 define i8* @test_strcpy_read_write_after(i8* noalias %a, i8* noalias %b) {
 ; CHECK-LABEL: Function: test_strcpy_read_write_after
-; CHECK:       Just Mod:  Ptr: i8* %a <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
-; CHECK-NEXT:  Just Ref:  Ptr: i8* %b <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
+; CHECK:       NoModRef:  Ptr: i8* %a <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
+; CHECK-NEXT:  NoModRef:  Ptr: i8* %b <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Just Mod:  Ptr: i8* %a.gep.1 <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Just Ref:  Ptr: i8* %b.gep.1 <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Just Mod:  Ptr: i8* %res <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Just Mod:  Ptr: i8* %a.gep.5 <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
 ; CHECK-NEXT:  Just Ref:  Ptr: i8* %b.gep.5 <->  %res = tail call i8* @strcpy(i8* %a.gep.1, i8* %b.gep.1)
 ;
 entry:
   store i8 0, i8* %a

llvm/test/Transforms/DeadStoreElimination/libcalls.ll

;
   %dest = getelementptr inbounds [16 x i8], [16 x i8]* %B, i64 0, i64 0
   %call = call i8* @strcpy(i8* %dest, i8* %src)
   ret void
 }
 
 define void @strcpy_reads_after(i8* noalias %dest, i8* %src) {
 ; CHECK-LABEL: @strcpy_reads_after(
 ; CHECK-NEXT:    [[SRC_2:%.*]] = getelementptr inbounds i8, i8* [[SRC:%.*]], i64 1
-; CHECK-NEXT:    store i8 1, i8* [[SRC]], align 1
 ; CHECK-NEXT:    store i8 99, i8* [[SRC_2]], align 1
 ; CHECK-NEXT:    [[SRC_1:%.*]] = getelementptr inbounds i8, i8* [[SRC]], i64 1
 ; CHECK-NEXT:    [[CALL:%.*]] = call i8* @strcpy(i8* [[DEST:%.*]], i8* [[SRC_1]])
 ; CHECK-NEXT:    store i8 2, i8* [[SRC]], align 1
 ; CHECK-NEXT:    store i8 2, i8* [[SRC_2]], align 1
 ; CHECK-NEXT:    ret void
 ;
   %src.2 = getelementptr inbounds i8, i8* %src, i64 1