[GlobalsAA] Teach GlobalsAA about nocapture

[jmolloy]

Summary

Arguments to function calls marked "nocapture" can be marked as
non-escaping. However, nocapture is defined in terms of the lifetime
of the callee, and if the callee can directly or indirectly recurse to
the caller, the semantics of nocapture are invalid.

Therefore, we eagerly discover all known non-recursive functions and
then, in AnalyzeUsesOfPointer() we can query that set for nocapture
arguments.

This means that we can't be so optimistic in
getModRefInfo(ImmutableCallsite) - previously we assumed all call
arguments never aliased with an escaping global. Now we need to check,
because a global could now be passed as an argument but still not
escape.

This also solves a related conformance problem: MemCpyOptimizer can
turn non-escaping stores of globals into calls to intrinsics like
llvm.memcpy/llvm/memset. This confuses GlobalsAA, which knows the
global can't escape and so returns NoModRef when queried, when
obviously a memcpy/memset call does indeed reference and modify its
arguments.

This addresses PR24800, PR24801, and PR24802

[aadg]

Hi James,

See comment below.

lib/Analysis/GlobalsModRef.cpp

776–782

Shouldn't we also handle the isVolatile argument ? As anything could happen when this is a volatile operation, I think we should always return MRI_ModRef when it is set.

[hfinkel]

Actually, I wonder if the right solution here is somewhat more general. As I recall, generally speaking, GMR cannot use 'nocapture' attributes on functions parameters because:

1. It cannot use nocapture on the parent function's arguments because nocapture is a statement only about appearances to the caller, not a guarantee about what happens inside the function itself.
2. It cannot use nocapture on attributes on the call instructions because it is possible that the function is directly or indirectly recursive, and so (1) applies.

And, so, we can honor nocapture for any function calls which we can prove are not directly or indirectly recursive with the current function. This seems like something we could do given that we have a callgraph, and perhaps can assert more generally for all intrinsics?

lib/Analysis/GlobalsModRef.cpp

776–782

I agree with James's response (from the list, which is seems did not make it into Phabricator); volatility and aliasing are orthogonal concepts, and while we do imply aliasing affects to volatile operations (and atomics) in various places (for reasons that I'm sure seemed convenient at the time), it is really not a good thing, and I see no reason to do so here.

[sanjoy]

lib/Analysis/GlobalsModRef.cpp

771

I'd rather have this be a lambda that takes an argument index instead of an eagerly populated vector, given that for most intrinsics this isn't used.

776

Can we do something more precise here if the intrinsic is readonly or readnone?

[aadg]

lib/Analysis/GlobalsModRef.cpp

776–782

Ok, I agree checking the volatileness should not be done here, but at the place where the aliasing information is used.

[jmolloy]

Hi all,

Updated diff addressing Sanjoy's comments.

Cheers,

James

[jmolloy]

And update the test to specifically enable GMR in the pass pipeline now the switch has been flipped off again.

[jmolloy]

Hi Hal,

OK, what you said makes sense. I've updated this patch to handle nocapture properly, which indeed is a superset of the functionality in the previous patch.

Cheers,

James

[hfinkel]

I think that the check that you would really want to do is: are the caller and the callee in the same connected component? Can you cache enough information from the CallGraphSCC iteration to check that directly?

[jmolloy]

Hi Hal,

That makes sense, it'd be less conservative. This updated patch does that - it iterates through the SCCs, assigning a numeric ID to each and storing a map of Function -> SCC ID that we can query later.

Cheers,

James

[jmolloy]

Hi Hal,

Did you have any more comments on this?

Cheers,

James

[hfinkel]

lib/Analysis/GlobalsModRef.cpp

777

This check does not seem conservative enough. GetUnderlyingObject has a depth limit, and cannot look through PHIs/selects. Since we know that GV is not captured as a precondition of this function (which we should explicitly document), calling GetUnderlyingObjects with no depth limit might be conservatively correct, although I'm afraid of unbounded compile-time in that case, Alternatively, you can call GetUnderlyingObject (or better, GetUnderlyingObjects), but return conservatively if not all returned objects are such that isIdentifiedObject returns true.

[jmolloy]

Hi Hal,

That makes total sense. This new patch makes sure all objects were identified and if not, returns ConservativeResult.

Cheers,

James

[hfinkel]

LGTM.

[jmolloy]

Thanks, r248576.

include/llvm/Analysis/GlobalsModRef.h

private:
   void AnalyzeCallGraph(CallGraph &CG, Module &M);
   bool AnalyzeUsesOfPointer(Value *V,
                             SmallPtrSetImpl<Function *> *Readers = nullptr,
                             SmallPtrSetImpl<Function *> *Writers = nullptr,
                             GlobalValue *OkayStoreDest = nullptr);
   bool AnalyzeIndirectGlobalMemory(GlobalValue *GV);
 
   bool isNonEscapingGlobalNoAlias(const GlobalValue *GV, const Value *V);
+  ModRefInfo getModRefInfoForIntrinsic(ImmutableCallSite CS,
+                                       const GlobalValue *GV);
 };
 
 /// Analysis pass providing a never-invalidated alias analysis result.
 class GlobalsAA {
 public:
   typedef GlobalsAAResult Result;
 
   /// \brief Opaque, unique identifier for this analysis pass.

lib/Analysis/GlobalsModRef.cpp

AliasResult GlobalsAAResult::alias(const MemoryLocation &LocA,
   // This does not appear to be a common problem in practice.
   if (EnableUnsafeGlobalsModRefAliasResults)
     if ((GV1 || GV2) && GV1 != GV2)
       return NoAlias;
 
   return AAResultBase::alias(LocA, LocB);
 }
 
+ModRefInfo GlobalsAAResult::getModRefInfoForIntrinsic(ImmutableCallSite CS,
+                                                      const GlobalValue *GV) {
+  auto IsGV = [&](unsigned OpIdx) {
+    return GetUnderlyingObject(CS.getArgument(OpIdx), DL) == GV;
+  };
+
+  switch (CS.getCalledFunction()->getIntrinsicID()) {
+  default:
+    // We don't know the intrinsic, but if it's readnone, it doesn't modify
+    // or reference anything...
+    if (CS.doesNotAccessMemory())
+      return MRI_NoModRef;
+    // ... and if it's readonly it only references.
+    if (CS.onlyReadsMemory())
+      return MRI_Ref;
+    // Fallback - we don't know anything about this intrinsic.
+    return MRI_ModRef;
+  case Intrinsic::memset:
+    return (IsGV(0) ? MRI_Mod : MRI_NoModRef);
+  case Intrinsic::memcpy:
+  case Intrinsic::memmove:
+    return static_cast<ModRefInfo>((IsGV(0) ? MRI_Mod : MRI_NoModRef) |
+                                   (IsGV(1) ? MRI_Ref : MRI_NoModRef));
+  }
+}
+
 ModRefInfo GlobalsAAResult::getModRefInfo(ImmutableCallSite CS,
                                           const MemoryLocation &Loc) {
   unsigned Known = MRI_ModRef;
 
   // If we are asking for mod/ref info of a direct call with a pointer to a
   // global we are tracking, return information if we have it.
   if (const GlobalValue *GV =
           dyn_cast<GlobalValue>(GetUnderlyingObject(Loc.Ptr, DL)))
     if (GV->hasLocalLinkage())
       if (const Function *F = CS.getCalledFunction())
         if (NonAddressTakenGlobals.count(GV))
           if (const FunctionInfo *FI = getFunctionInfo(F))
-            Known = FI->getModRefInfoForGlobal(*GV);
+            Known = FI->getModRefInfoForGlobal(*GV) |
+              getModRefInfoForIntrinsic(CS, GV);
 
   if (Known == MRI_NoModRef)
     return MRI_NoModRef; // No need to query other mod/ref analyses
   return ModRefInfo(Known & AAResultBase::getModRefInfo(CS, Loc));
 }
 
 GlobalsAAResult::GlobalsAAResult(const DataLayout &DL,
                                  const TargetLibraryInfo &TLI)

lib/Analysis/ScalarEvolution.cpp

void ScalarEvolution::print(raw_ostream &OS) const {
   // observable from outside the class though, so casting away the
   // const isn't dangerous.
   ScalarEvolution &SE = *const_cast<ScalarEvolution *>(this);
 
   OS << "Classifying expressions for: ";
   F.printAsOperand(OS, /*PrintType=*/false);
   OS << "\n";
   for (inst_iterator I = inst_begin(F), E = inst_end(F); I != E; ++I)
-    if (isSCEVable(I->getType()) && !isa<CmpInst>(*I)) {
+    if (isSCEVable(I->getType()) /*&& !isa<CmpInst>(*I)*/) {
       OS << *I << '\n';
       OS << "  -->  ";
       const SCEV *SV = SE.getSCEV(&*I);
       SV->print(OS);
       if (!isa<SCEVCouldNotCompute>(SV)) {
         OS << " U: ";
         SE.getUnsignedRange(SV).print(OS);
         OS << " S: ";

test/Analysis/GlobalsModRef/memset-escape.ll

+; RUN: opt < %s -O1 -S -enable-non-lto-gmr=true | FileCheck %s
+
+target datalayout = "e-m:o-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-apple-macosx10.10.0"
+
+@a = internal global [3 x i32] zeroinitializer, align 4
+@b = common global i32 0, align 4
+
+; The important thing we're checking for here is the reload of (some element of)
+; @a after the memset.
+
+; CHECK-LABEL: @main
+; CHECK: call void @llvm.memset.p0i8.i64{{.*}} @a
+; CHECK: store i32 3
+; CHECK: load i32, i32* getelementptr {{.*}} @a
+; CHECK: icmp eq i32
+; CHECK: br i1
+
+define i32 @main() {
+entry:
+  %retval = alloca i32, align 4
+  %c = alloca [1 x i32], align 4
+  store i32 0, i32* %retval, align 4
+  %0 = bitcast [1 x i32]* %c to i8*
+  call void @llvm.memset.p0i8.i64(i8* %0, i8 0, i64 4, i32 4, i1 false)
+  store i32 1, i32* getelementptr inbounds ([3 x i32], [3 x i32]* @a, i64 0, i64 2), align 4
+  store i32 0, i32* @b, align 4
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.inc, %entry
+  %1 = load i32, i32* @b, align 4
+  %cmp = icmp slt i32 %1, 3
+  br i1 %cmp, label %for.body, label %for.end
+
+for.body:                                         ; preds = %for.cond
+  %2 = load i32, i32* @b, align 4
+  %idxprom = sext i32 %2 to i64
+  %arrayidx = getelementptr inbounds [3 x i32], [3 x i32]* @a, i64 0, i64 %idxprom
+  store i32 0, i32* %arrayidx, align 4
+  br label %for.inc
+
+for.inc:                                          ; preds = %for.body
+  %3 = load i32, i32* @b, align 4
+  %inc = add nsw i32 %3, 1
+  store i32 %inc, i32* @b, align 4
+  br label %for.cond
+
+for.end:                                          ; preds = %for.cond
+  %4 = load i32, i32* getelementptr inbounds ([3 x i32], [3 x i32]* @a, i64 0, i64 2), align 4
+  %cmp1 = icmp ne i32 %4, 0
+  br i1 %cmp1, label %if.then, label %if.end
+
+if.then:                                          ; preds = %for.end
+  call void @abort() #3
+  unreachable
+
+if.end:                                           ; preds = %for.end
+  ret i32 0
+}
+
+; Function Attrs: nounwind argmemonly
+declare void @llvm.memset.p0i8.i64(i8* nocapture, i8, i64, i32, i1) nounwind argmemonly
+
+; Function Attrs: noreturn nounwind
+declare void @abort() noreturn nounwind