[BasicAA] Fix handling of invariant group launders

[amharc]

Summary

A recent patch (rL331587) to Capture Tracking taught it that the launder_invariant_group intrinsic captures its argument only by returning it. Unfortunately, BasicAA still considered every call instruction as a possible escape source and hence concluded that the result of a launder_invariant_group call cannot alias any local non-escaping value. This led to bug 37458.

This patch updates the relevant check for escape sources in BasicAA.

[Prazek]

I went throught it and it looks good to me, I didn't expect that fixing CaptureTracking can lead Alias Analisis to return NoAlias instead of MustAlias. It would be nice if the code would check for such assumptions, but I have no ideas how it could be implemented.

[hfinkel]

We should also have a direct AA test (something like test/Analysis/BasicAA/cs-cs.ll).

Also, let's not repeat this problem in the future. Please add a comment both here and in CaptureTracking to remind people that intrinsics added to once place must be added to the other place.

llvm/lib/Analysis/BasicAliasAnalysis.cpp

138

Don't need the { } here.

[amharc]

Added a direct AA test and cautionary comments in both BasicAA and CaptureTracking, removed unnecessary { }.

[amharc]

Removed unnecessary { }.

[hfinkel]

LGTM

llvm/lib/Analysis/BasicAliasAnalysis.cpp

if (A->hasByValAttr() || A->hasNoAliasAttr())
       return !PointerMayBeCaptured(V, false, /*StoreCaptures=*/true);
 
   return false;
 }
 
 /// Returns true if the pointer is one which would have been considered an
 /// escape by isNonEscapingLocalObject.
 static bool isEscapeSource(const Value *V) {
-  if (isa<CallInst>(V) || isa<InvokeInst>(V) || isa<Argument>(V))
+  if (auto CS = ImmutableCallSite(V)) {
+    // launder_invariant_group captures its argument only by returning it,
+    // so it might not be considered an escape by isNonEscapingLocalObject
+    if (CS.getIntrinsicID() == Intrinsic::launder_invariant_group) {
+      return false;
+    }
+
+    return true;
+  }
+
+  if (isa<Argument>(V))
     return true;
 
   // The load case works because isNonEscapingLocalObject considers all
   // stores to be escapes (it passes true for the StoreCaptures argument
   // to PointerMayBeCaptured).
   if (isa<LoadInst>(V))
     return true;
 

llvm/test/Analysis/BasicAA/invariant_group.ll

+; RUN: opt < %s -basicaa -gvn -S | FileCheck %s
+
+; The input *.ll had been adapted from bug 37458:
+;
+; struct A { virtual void f(); int n; };
+;
+; int h() {
+;     A a;
+;     a.n = 42;
+;     return __builtin_launder(&a)->n;
+; }
+
+%struct.A = type <{ i8*, i8 }>
+
+; CHECK: testLaunderInvariantGroupIsNotEscapeSource
+define i8 @testLaunderInvariantGroupIsNotEscapeSource() {
+entry:
+  %a = alloca %struct.A, align 8
+  %a.bitcast = bitcast %struct.A* %a to i8*
+  %n = getelementptr inbounds %struct.A, %struct.A* %a, i64 0, i32 1
+  store i8 42, i8* %n
+  %a.laundered = call i8* @llvm.launder.invariant.group.p0i8(i8* nonnull %a.bitcast)
+  %n.laundered = getelementptr inbounds i8, i8* %a.laundered, i64 8
+  %v = load i8, i8* %n.laundered
+; make sure that the load from %n.laundered to %v aliases the store of 42 to %n
+; CHECK: ret i8 42
+  ret i8 %v
+}
+
+declare i8* @llvm.launder.invariant.group.p0i8(i8*)