Prevent devirtualization of calls to un-instantiated functions.

[Sunil_Srivastava]

Summary

This review is for a fix for PR 27895, but it requires some discussion. The bugzilla and the email exchange with Richard Smith in http://lists.llvm.org/pipermail/cfe-commits/Week-of-Mon-20160530/161107.html contain more details.

The basic problem: When the front end sees a call to a virtual function of a template class, it treats that as an odr use, therefore requiring the instantiation; except, for some reason, when it is an operator and used with an operator syntax. In those cases, if the call gets devirtualized later, it will generate a direct call to a function that has not been instantiated. Most of the time it will still work because someone else will instantiate it for some other reason, but if not, then we have converted a potentially dead code to a link time error of a missing definition.

As discussed in the email exchange, there are two alternative ways to fix the problem. Either will be sufficient, but we want to do both.

The first fix will be in the front end to force the instantiation on virtual calls that are potentially devirtualizable. For reasons described below I plan on submitting this in a later checkin.

The second fix, the matter of this review, is to avoid devirtualization under certain conditions. The conditions that I am choosing is to prevent devirtualization if the function could be implicitly instantiated but front end chose to not mark it for instantiation. I welcome any suggestions about improvement to this condition.

The reason I am planning on submitting them in this order, is that, once the first fix is checked in, there will be no way, known to me, to write a test for the second, devirtualization fix.

Now some discussion about the way I am testing the avoid-devirtualization condition: I have added a bit to FunctionDecl that I am setting whenever a function is put on the PendingInstantiations list. Then, at the time of devirtualization, if the target function isImplictlyInstantiable and does not have that bit set, I avoid the devirtualization. This change adds one bit to FunctionDecl, but the test is quite fast. However, it duplicates the information between this bit and the PendingInstantiationsList.

We have considered an alternate implementation which replaces the call (in CGClass.cpp) to
isMarkedForPendingInstantiation with

• explcitly-test-whether-it-is-on-the-PendingInstations-list ||
• has-already-been-instantiated.

This alternate implementation does not add anything to FunctionDecl, avoids information duplication, but the test for its presence in the list will be expensive; it will require a search in the list. It will be done only for devirtualizable calls though, which is not that common.

A related point that I am not sure about is: Are there circumstances where a function on the PendingInstantiations list can fails to be instantiated for reasons other than errors? If so then this checkin is not perfect, though it is still better than nothing.

I am open to suggestion as to which of these implementations makes more sense.

Once this change has been approved and submitted, I will open another review for the first fix, which will force the instantiation of functions that are target of potentially devirtualizable calls.

[Sunil_Srivastava]

Ping.

[rsmith]

include/clang/AST/Decl.h

1602 ↗

(On Diff #62907)

Drop the MarkedFor here. This flag *is* the mark from the point of view of a user of the AST.

This flag also seems very similar to the Used flag on the Decl base class, so a documentation comment might help. Something like "Indicates that an instantiation of this function has been required but may not yet have been performed. If the function has already been instantiated, the value of this flag is unspecified."

... though it would be nicer if the value of the flag were always correct, even in the case where the function has already been instantiated.

1877–1878 ↗

(On Diff #62907)

The fact that we have a separate list is an implementation detail of Sema; drop that from this comment.

lib/CodeGen/CGClass.cpp

2884–2886 ↗

(On Diff #62907)

If the function is already defined (if we instantiated it already for some reason), we should be able to devirtualize calls to it.

lib/Sema/Sema.cpp

683–685 ↗

(On Diff #62907)

Please add a test that we handle this properly if instantiation is triggered in a PCH.

[• Quuxplusone]

test/CodeGen/no-devirt.cpp

16 ↗

(On Diff #62907)

This is a really dumb question from the peanut gallery, but, could you explain why these two cases (lines 15 and 16) should differ? It really seems like both calls should be able to be devirtualized, because the compiler statically knows what they should call.

I think you mention the difference between lines 15 and 16 here:

except, for some reason, when it is an operator and used with an operator syntax

but you don't explain *why* the difference is desirable. Shouldn't we just fix that difference, then?

Is your first fix (

The first fix will be in the front end to force the instantiation on virtual calls that are potentially devirtualizable.

) basically "fix the difference between lines 15 and 16", or is it talking about something else entirely?

[Sunil_Srivastava]

test/CodeGen/no-devirt.cpp

16 ↗

(On Diff #62907)

AFAICS, The two cases (line 15 and 16) should not differ.

The first fix will "fix the difference between line 15 and 16". I have the change for that ready, but once we do that, there will be no way (known to me) of testing the second "fix". Hence the second "fix" is being proposed for commit before the first.

[• Quuxplusone]

test/CodeGen/no-devirt.cpp

16 ↗

(On Diff #62907)

Okay, makes sense to me now. (As long as the comment on line 15 gets updated in the "first fix". I believe you'll be touching this test case again anyway in the "first fix", because the expected output will change.)
Question answered. :)

[Prazek]

lib/Sema/Sema.cpp

684 ↗

(On Diff #62907)

Dry. Use auto

[Sunil_Srivastava]

This is an update to address points raised by Richard Smith:

1. The bit and the access functions have been renamed from MarkedForPendingInstantiation to InstantiationIsPending.
2. It closely, though not entirely, tracks whether the function is on the PendingInstantiations list. More on this point below.
3. The test explicitly allows devirtualization if Function->isDefined(). This is also needed by the change in point 2 above.
4. The test has been enhanced to have PCH tests.

Now: Why the InstantiationIsPending bit is not precisely tracking the presence in the PendingInstantiations list?

Basically this is because I think that the call to Func2 in the test SHOULD get devirtualized. Func2 is not defined in this TU, an uncommon but possible situation. Given that, the compiler had no way to instantiate it, and it is a user error if Func2 does not get instantiated somewhere else. If Func2 does get instantiated somewhere else, then it is safe to devirtualize calls to it.

In contrast, operator[] is defined by the user, but for some reason (which will be removed by my next checkin, in situations we know of) the compiler has decided to not instantiate it (or rather, not decided to instantiate it, to be precise). In this case we do not want to devirtualize call to it, because the definition is not required to exist somewhere else. The whole motivation of this commit is to prevent such calls from devirtualization.

The instantiation loop removes items from the PendingInstantiations list and instantiates them, if the body is present. In the case of Func2, the body is not present, the function has already been removed from the list, yet it is not isDefined(). We need some way to distinguish this from the contrasting case of operator[], where the function was never put on the PendingInstantiations list. Hence in cases like Func2, I am not unsetting the InstantiationIsPending bit at the time of its removal from the list. Loosely speaking, we can say that the instantiation is indeed pending, though in some other TU.

Comments in Decls.h explain this behavior, though not in such details.

The expected behavior of the test will change by my next “first fix” commit, of course; in that the operator[] will get instantiated, and the call will be devirtualized.

[Sunil_Srivastava]

Ping

[Sunil_Srivastava]

ping

[Sunil_Srivastava]

A friendly ping.

[Sunil_Srivastava]

Ping

[Prazek]

I have read the patch, but I don't have enough knowledge about C++ rules and fronted to accept it. Richard?

lib/Sema/Sema.cpp

684 ↗

(On Diff #62907)

auto *

[rsmith]

In D22057#543199, @Sunil_Srivastava wrote:

Now: Why the InstantiationIsPending bit is not precisely tracking the presence in the PendingInstantiations list?

[...]

The instantiation loop removes items from the PendingInstantiations list and instantiates them, if the body is present. In the case of Func2, the body is not present, the function has already been removed from the list, yet it is not isDefined().

I see, so the only case in which the list and the flag differs is when we're doing the final instantiation step at the end of the TU? (In all other cases, we'd put the function back on the list for later instantiations to retry.) That seems fine.

cfe/trunk/include/clang/AST/Decl.h

private:
   unsigned HasWrittenPrototype : 1;
   unsigned IsDeleted : 1;
   unsigned IsTrivial : 1; // sunk from CXXMethodDecl
   unsigned IsDefaulted : 1; // sunk from CXXMethoDecl
   unsigned IsExplicitlyDefaulted : 1; //sunk from CXXMethodDecl
   unsigned HasImplicitReturnZero : 1;
   unsigned IsLateTemplateParsed : 1;
   unsigned IsConstexpr : 1;
+  unsigned InstantiationIsPending:1;
 
   /// \brief Indicates if the function uses __try.
   unsigned UsesSEHTry : 1;
 
   /// \brief Indicates if the function was a definition but its body was
   /// skipped.
   unsigned HasSkippedBody : 1;
 
FunctionDecl(Kind DK, ASTContext &C, DeclContext *DC, SourceLocation StartLoc,
         DeclContext(DK), redeclarable_base(C), ParamInfo(nullptr), Body(),
         SClass(S), IsInline(isInlineSpecified),
         IsInlineSpecified(isInlineSpecified), IsExplicitSpecified(false),
         IsVirtualAsWritten(false), IsPure(false),
         HasInheritedPrototype(false), HasWrittenPrototype(true),
         IsDeleted(false), IsTrivial(false), IsDefaulted(false),
         IsExplicitlyDefaulted(false), HasImplicitReturnZero(false),
         IsLateTemplateParsed(false), IsConstexpr(isConstexprSpecified),
+        InstantiationIsPending(false),
         UsesSEHTry(false), HasSkippedBody(false), WillHaveBody(false),
         EndRangeLoc(NameInfo.getEndLoc()), TemplateOrSpecialization(),
         DNLoc(NameInfo.getInfo()) {}
 
   typedef Redeclarable<FunctionDecl> redeclarable_base;
   FunctionDecl *getNextRedeclarationImpl() override {
     return getNextRedeclaration();
   }
public:
   /// previous declaration.
   bool hasInheritedPrototype() const { return HasInheritedPrototype; }
   void setHasInheritedPrototype(bool P = true) { HasInheritedPrototype = P; }
 
   /// Whether this is a (C++11) constexpr function or constexpr constructor.
   bool isConstexpr() const { return IsConstexpr; }
   void setConstexpr(bool IC) { IsConstexpr = IC; }
 
+  /// \brief Whether the instantiation of this function is pending.
+  /// This bit is set when the decision to instantiate this function is made
+  /// and unset if and when the function body is created. That leaves out
+  /// cases where instantiation did not happen because the template definition
+  /// was not seen in this TU. This bit remains set in those cases, under the
+  /// assumption that the instantiation will happen in some other TU.
+  bool instantiationIsPending() const { return InstantiationIsPending; }
+  void setInstantiationIsPending(bool IC) { InstantiationIsPending = IC; }
+
   /// \brief Indicates the function uses __try.
   bool usesSEHTry() const { return UsesSEHTry; }
   void setUsesSEHTry(bool UST) { UsesSEHTry = UST; }
 
   /// \brief Whether this function has been deleted.
   ///
   /// A function that is "deleted" (via the C++0x "= delete" syntax)
   /// acts like a normal function, except that it cannot actually be

cfe/trunk/lib/CodeGen/CGClass.cpp

if (const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
       return VD->getType()->isRecordType();
     }
 
     return false;
   }
 
   // We can devirtualize calls on an object accessed by a class member access
   // expression, since by C++11 [basic.life]p6 we know that it can't refer to
-  // a derived class object constructed in the same location.
+  // a derived class object constructed in the same location. However, we avoid
+  // devirtualizing a call to a template function that we could instantiate
+  // implicitly, but have not decided to do so. This is needed because if this
+  // function does not get instantiated, the devirtualization will create a
+  // direct call to a function whose body may not exist. In contrast, calls to
+  // template functions that are not defined in this TU are allowed to be 
+  // devirtualized under assumption that it is user responsibility to
+  // instantiate them in some other TU.
   if (const MemberExpr *ME = dyn_cast<MemberExpr>(Base))
     if (const ValueDecl *VD = dyn_cast<ValueDecl>(ME->getMemberDecl()))
-      return VD->getType()->isRecordType();
+      return VD->getType()->isRecordType() && 
+             (MD->instantiationIsPending() || MD->isDefined() ||
+               !MD->isImplicitlyInstantiable());
 
   // Likewise for calls on an object accessed by a (non-reference) pointer to
   // member access.
   if (auto *BO = dyn_cast<BinaryOperator>(Base)) {
     if (BO->isPtrMemOp()) {
       auto *MPT = BO->getRHS()->getType()->castAs<MemberPointerType>();
       if (MPT->getPointeeType()->isRecordType())
         return true;

cfe/trunk/lib/Sema/Sema.cpp

if (TUKind != TU_Prefix) {
     // instantiation will always happen at the end of the translation unit,
     // so it will find some names that are not required to be found. This is
     // valid, but we could do better by diagnosing if an instantiation uses a
     // name that was not visible at its first point of instantiation.
     if (ExternalSource) {
       // Load pending instantiations from the external source.
       SmallVector<PendingImplicitInstantiation, 4> Pending;
       ExternalSource->ReadPendingInstantiations(Pending);
+      for (auto PII : Pending)
+        if (auto Func = dyn_cast<FunctionDecl>(PII.first))
+          Func->setInstantiationIsPending(true);
       PendingInstantiations.insert(PendingInstantiations.begin(),
                                    Pending.begin(), Pending.end());
     }
     PerformPendingInstantiations();
 
     if (LateTemplateParserCleanup)
       LateTemplateParserCleanup(OpaqueParser);
 

cfe/trunk/lib/Sema/SemaExpr.cpp

if (!AlreadyInstantiated || Func->isConstexpr()) {
         PendingLocalImplicitInstantiations.push_back(
             std::make_pair(Func, PointOfInstantiation));
       else if (Func->isConstexpr())
         // Do not defer instantiations of constexpr functions, to avoid the
         // expression evaluator needing to call back into Sema if it sees a
         // call to such a function.
         InstantiateFunctionDefinition(PointOfInstantiation, Func);
       else {
+        Func->setInstantiationIsPending(true);
         PendingInstantiations.push_back(std::make_pair(Func,
                                                        PointOfInstantiation));
         // Notify the consumer that a function was implicitly instantiated.
         Consumer.HandleCXXImplicitFunctionInstantiation(Func);
       }
     }
   } else {
     // Walk redefinitions, as some of them may be instantiable.

cfe/trunk/lib/Sema/SemaTemplateInstantiateDecl.cpp

if (DiagnoseUninstantiableTemplate(PointOfInstantiation, Function,
                                      PatternDecl, PatternDef, TSK,
                                      /*Complain*/DefinitionRequired)) {
     if (DefinitionRequired)
       Function->setInvalidDecl();
     else if (TSK == TSK_ExplicitInstantiationDefinition) {
       // Try again at the end of the translation unit (at which point a
       // definition will be required).
       assert(!Recursive);
+      Function->setInstantiationIsPending(true);
       PendingInstantiations.push_back(
         std::make_pair(Function, PointOfInstantiation));
     } else if (TSK == TSK_ImplicitInstantiation) {
       if (AtEndOfTU && !getDiagnostics().hasErrorOccurred()) {
         Diag(PointOfInstantiation, diag::warn_func_template_missing)
           << Function;
         Diag(PatternDecl->getLocation(), diag::note_forward_template_decl);
         if (getLangOpts().CPlusPlus11)
           Diag(PointOfInstantiation, diag::note_inst_declaration_hint)
             << Function;
       }
     }
 
     return;
   }
 
   // Postpone late parsed template instantiations.
   if (PatternDecl->isLateTemplateParsed() &&
       !LateTemplateParser) {
+    Function->setInstantiationIsPending(true);
     PendingInstantiations.push_back(
       std::make_pair(Function, PointOfInstantiation));
     return;
   }
 
   // If we're performing recursive template instantiation, create our own
   // queue of pending implicit instantiations that we will instantiate later,
   // while we're still within our own instantiation context.
while (!PendingLocalImplicitInstantiations.empty() ||
     }
 
     // Instantiate function definitions
     if (FunctionDecl *Function = dyn_cast<FunctionDecl>(Inst.first)) {
       bool DefinitionRequired = Function->getTemplateSpecializationKind() ==
                                 TSK_ExplicitInstantiationDefinition;
       InstantiateFunctionDefinition(/*FIXME:*/Inst.second, Function, true,
                                     DefinitionRequired, true);
+      if (Function->isDefined())
+        Function->setInstantiationIsPending(false);
       continue;
     }
 
     // Instantiate variable definitions
     VarDecl *Var = cast<VarDecl>(Inst.first);
 
     assert((Var->isStaticDataMember() ||
             isa<VarTemplateSpecializationDecl>(Var)) &&

cfe/trunk/test/CodeGen/no-devirt.cpp

+// RUN: %clang_cc1 %s -DUSEIT -triple %itanium_abi_triple -emit-llvm -o - |  FileCheck %s
+
+// Test with decls and template defs in pch, and just use in .cpp
+// RUN:  %clang_cc1 %s -DTMPL_DEF_IN_HEADER -triple %itanium_abi_triple -emit-pch -o %t
+// RUN:  %clang_cc1 %s -DTMPL_DEF_IN_HEADER -DUSEIT -triple %itanium_abi_triple -include-pch %t -emit-llvm -o - | FileCheck %s
+
+// Test with A in pch, and B and C in main
+// Test with just decls in pch, and template defs and use in .cpp
+// RUN:  %clang_cc1 %s -triple %itanium_abi_triple -emit-pch -o %t
+// RUN:  %clang_cc1 %s -DUSEIT -triple %itanium_abi_triple -include-pch %t -emit-llvm -o - | FileCheck %s
+
+#ifndef HEADER
+#define HEADER
+template < typename T, int N = 0 > class TmplWithArray {
+public:
+  virtual T& operator [] (int idx);
+  virtual T& func1 (int idx);
+  virtual T& func2 (int idx);
+  T ar[N+1];
+};
+struct Wrapper {
+  TmplWithArray<bool, 10> data;
+  bool indexIt(int a) {
+    if (a > 6) return data[a] ;      // Should not devirtualize
+    if (a > 4) return data.func1(a); // Should devirtualize
+    return data.func2(a);            // Should devirtualize
+  }
+};
+
+#ifdef TMPL_DEF_IN_HEADER
+template <typename T, int N> T& TmplWithArray<T, N >::operator[](int idx) {
+  return ar[idx];
+}
+template <typename T, int N> T& TmplWithArray<T, N >::func1(int idx) {
+  return ar[idx];
+}
+#endif // TMPL_DEF_IN_HEADER
+#endif // HEADER
+
+#ifdef USEIT
+#ifndef TMPL_DEF_IN_HEADER
+template <typename T, int N> T& TmplWithArray<T, N >::operator[](int idx) {
+  return ar[idx];
+}
+template <typename T, int N> T& TmplWithArray<T, N >::func1(int idx) {
+  return ar[idx];
+}
+#endif // !TMPL_DEF_IN_HEADER
+extern Wrapper ew;
+bool stuff(int p)
+{
+  return ew.indexIt(p);
+}
+#endif
+
+// CHECK-NOT: call {{.*}} @_ZN13TmplWithArrayIbLi10EEixEi
+// CHECK-DAG: call {{.*}} @_ZN13TmplWithArrayIbLi10EE5func1Ei
+// CHECK-DAG: call {{.*}} @_ZN13TmplWithArrayIbLi10EE5func2Ei
+