Emit invariant.group.barrier when using union field

[Prazek]

Summary

We need to emit barrier if the union field
is CXXRecordDecl because it might have vptrs. The testcode
was wrongly devirtualized. It also proves that having different
groups for different dynamic types is not sufficient.

[Prazek]

ping

[Prazek]

ping

[rjmccall]

lib/CodeGen/CGExpr.cpp

3597

Checking for v-table pointers recursively isn't really that difficult, but if you really don't want to do that, please at least check for non-POD-ness or something so that this isn't kicking in for literally every struct type.

[Prazek]

lib/CodeGen/CGExpr.cpp

3597

ok, I am also planning to fix this in the later patch, because the same problem arise when comparing 2 pointers to dynamic classe.
I would like to have a bit in CXXRecordDecl to remember if it has any vptr inside that would calculate durring the construction.
My biggest fear is that if I won't cache it then it will be very slow.

[rjmccall]

lib/CodeGen/CGExpr.cpp

3597

We could repeat this work from scratch on every single union field access done by IRGen and it would still be way, way faster than doing anything extra on every record definition in the program. The latter is done orders of magnitude more frequently than the former.

[Prazek]

lib/CodeGen/CGExpr.cpp

3597

This is a good point, and actually I don't need to check if class holds any vptrs for the example I refered (comparing 2 pointers).
Hovewer I still need to do it when someone casts pointer to class holding vptrs to something that doesn't hold vptrs, and any pointer casts are much more frequent than Record declarations.

[rjmccall]

lib/CodeGen/CGExpr.cpp

3597

What are you planning to do if someone casts to a pointer to incomplete type?

I am concerned that what these problems are really telling us is that this representation is not very good.

[Prazek]

lib/CodeGen/CGExpr.cpp

3597

In this case we also need to add the barrier. I might be wrong, but I think this in general should be pretty rare and even more rare if it would limit the devirtualization.
For example cases like:

Derived *d;
(Base*)d;

will not limit devirtualization if Derived is complete type (because base will be also).

The other thing is that with my recent patches, adding more barriers will not limit any memory optimizations.

[Prazek]

• Checking for vptrs

[Prazek]

For now I will check if it has any vptrs. It will be probably soon stored in the CXXRecordDecl because it will be used much more frequently when generating barriers for pointer casts.

[Prazek]

• format

[Prazek]

• Inserting barrier with -O0

[Prazek]

Ping

[rjmccall]

lib/CodeGen/CGExpr.cpp

3545

You need to recurse into base classes (to check their fields), and if you write this to take a QualType you won't have to eagerly extract RD below.

3597

You don't need the .getTypePtr() here.

[Prazek]

• changed to QualType, now it is much cleaner

[Prazek]

lib/CodeGen/CGExpr.cpp

3545

Cool, thanks for the tip

[rjmccall]

Looks great, thanks. One request for additional tests, but feel free to commit when that's ready.

test/CodeGenCXX/strict-vtable-pointers.cpp

258

Please include test cases involving classes that only have a virtual pointer in a field of a base class — e.g. something that inherits from HoldingVirtuals. And be sure to cover both normal and virtual inheritance.

[Prazek]

Add test

[rjmccall]

test/CodeGenCXX/strict-vtable-pointers.cpp

263

"virtual" applies to an individual base, not to all following bases. You need "virtual HoldingVirtuals" here.

Although, come to think of it, having a virtual base should already ensure that the class has a v-table, even if it has no other reason for one. (You should add a test for that!)

[Prazek]

Extra test

[rjmccall]

Thanks, LGTM.

lib/CodeGen/CGExpr.cpp

if (idx != 0) {
     auto &recLayout = CGF.getContext().getASTRecordLayout(rec);
     auto offsetInBits = recLayout.getFieldOffset(field->getFieldIndex());
     offset = CGF.getContext().toCharUnitsFromBits(offsetInBits);
   }
 
   return CGF.Builder.CreateStructGEP(base, idx, offset, field->getName());
 }
 
+static bool hasAnyVptr(const QualType Type, const ASTContext &Context) {
+  const auto *RD = Type.getTypePtr()->getAsCXXRecordDecl();
+  if (!RD)
+    return false;
+
+  if (RD->isDynamicClass())
+    return true;
+
+  for (const auto &Base : RD->bases())
+    if (hasAnyVptr(Base.getType(), Context))
+      return true;
+
+  for (const FieldDecl *Field : RD->fields())
+    if (hasAnyVptr(Field->getType(), Context))
+      return true;
+
+  return false;
+}
+
 LValue CodeGenFunction::EmitLValueForField(LValue base,
                                            const FieldDecl *field) {
   LValueBaseInfo BaseInfo = base.getBaseInfo();
   AlignmentSource fieldAlignSource =
     getFieldAlignmentSource(BaseInfo.getAlignmentSource());
   LValueBaseInfo FieldBaseInfo(fieldAlignSource, BaseInfo.getMayAlias());
 
   if (field->isBitField()) {
LValue CodeGenFunction::EmitLValueForField(LValue base,
   Address addr = base.getAddress();
   unsigned cvr = base.getVRQualifiers();
   bool TBAAPath = CGM.getCodeGenOpts().StructPathTBAA;
   if (rec->isUnion()) {
     // For unions, there is no pointer adjustment.
     assert(!type->isReferenceType() && "union has reference member");
     // TODO: handle path-aware TBAA for union.
     TBAAPath = false;
+
+    const auto FieldType = field->getType();
+    if (CGM.getCodeGenOpts().StrictVTablePointers &&
+        hasAnyVptr(FieldType, getContext()))
+      // Because unions can easily skip invariant.barriers, we need to add
+      // a barrier every time CXXRecord field with vptr is referenced.
+      addr = Address(Builder.CreateInvariantGroupBarrier(addr.getPointer()),
+                     addr.getAlignment());
   } else {
     // For structs, we GEP to the field that the record layout suggests.
     addr = emitAddrOfFieldStorage(*this, addr, field);
 
     // If this is a reference field, load the reference right now.
     if (const ReferenceType *refType = type->getAs<ReferenceType>()) {
       llvm::LoadInst *load = Builder.CreateLoad(addr, "ref");
       if (cvr & Qualifiers::Volatile) load->setVolatile(true);

test/CodeGenCXX/strict-vtable-pointers.cpp

-// RUN: %clang_cc1 %s -I%S -triple=x86_64-apple-darwin10 -fstrict-vtable-pointers -disable-llvm-passes -O2 -emit-llvm -o %t.ll
+// RUN: %clang_cc1 %s -I%S -triple=x86_64-apple-darwin10 -fstrict-vtable-pointers -std=c++11 -disable-llvm-passes -O2 -emit-llvm -o %t.ll
 // RUN: FileCheck --check-prefix=CHECK-CTORS %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-NEW %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-DTORS %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-LINK-REQ %s < %t.ll
 
 typedef __typeof__(sizeof(0)) size_t;
 void *operator new(size_t, void*) throw();
 

 // CHECK-CTORS: store {{.*}} @_ZTV22DynamicDerivedMultiple, i32 0, inrange i32 1, i32 2) {{.*}} %[[THIS12]]
 // CHECK-CTORS-LABEL: {{^}}}
 
 struct DynamicFromStatic;
 // CHECK-CTORS-LABEL: define linkonce_odr void @_ZN17DynamicFromStaticC2Ev(
 // CHECK-CTORS-NOT: @llvm.invariant.group.barrier(
 // CHECK-CTORS-LABEL: {{^}}}
 
+struct A {
+  virtual void foo();
+};
+struct B : A {
+  virtual void foo();
+};
+
+union U {
+  A a;
+  B b;
+};
+
+void changeToB(U *u);
+void changeToA(U *u);
+
+void g2(A *a) {
+  a->foo();
+}
+// We have to guard access to union fields with invariant.group, because
+// it is very easy to skip the barrier with unions. In this example the inlined
+// g2 will produce loads with the same !invariant.group metadata, and
+// u->a and u->b would use the same pointer.
+// CHECK-NEW-LABEL: define void @_Z14UnionsBarriersP1U
+void UnionsBarriers(U *u) {
+  // CHECK-NEW: call void @_Z9changeToBP1U(
+  changeToB(u);
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z2g2P1A(%struct.A*
+  g2(&u->b);
+  // CHECK-NEW: call void @_Z9changeToAP1U(%union.U* %6)
+  changeToA(u);
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // call void @_Z2g2P1A(%struct.A* %a)
+  g2(&u->a);
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+}
+
+struct HoldingVirtuals {
+  A a;
+};
+
+struct Empty {};
+struct AnotherEmpty {
+  Empty e;
+};
+union NoVptrs {
+  int a;
+  AnotherEmpty empty;
+};
+void take(AnotherEmpty &);
+
+// CHECK-NEW-LABEL: noBarriers
+void noBarriers(NoVptrs &noVptrs) {
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: 42
+  noVptrs.a += 42;
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z4takeR12AnotherEmpty(
+  take(noVptrs.empty);
+}
+
+union U2 {
+  HoldingVirtuals h;
+  int z;
+};
+void take(HoldingVirtuals &);
+
+// CHECK-NEW-LABEL: define void @_Z15UnionsBarriers2R2U2
+void UnionsBarriers2(U2 &u) {
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: 42
+  u.z += 42;
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z4takeR15HoldingVirtuals(
+  take(u.h);
+}
+
+struct VirtualInBase : HoldingVirtuals, Empty {
+};
+
+struct VirtualInVBase : virtual Empty, HoldingVirtuals {
+};
+
+union U3 {
+  VirtualInBase v1;
+  VirtualInBase v2;
+  int z;
+};
+
+void take(VirtualInBase &);
+void take(VirtualInVBase &);
+
+void UnionsBarrier3(U3 &u) {
+  // CHECK-NEW-NOT: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: 42
+  u.z += 42;
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z4takeR13VirtualInBase(
+  take(u.v1);
+  // CHECK-NEW: call i8* @llvm.invariant.group.barrier(i8*
+  // CHECK-NEW: call void @_Z4takeR13VirtualInBase(
+  take(u.v2);
+}
+
+
+
 
 /** DTORS **/
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN10StaticBaseD2Ev(
 // CHECK-DTORS-NOT: call i8* @llvm.invariant.group.barrier(
 // CHECK-DTORS-LABEL: {{^}}}
 
 
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN25DynamicFromVirtualStatic2D2Ev(