[BasicAA] Fix zext & sext handling

[njw45]

Summary

There are several unhandled edge cases in BasicAA's GetLinearExpression method. This changes fixes outstanding issues, including zext / sext of a constant with the sign bit set, and the refusal to decompose zexts or sexts of wrapping arithmetic.

[njw45]

wip

[njw45]

wip

[njw45]

wip

[njw45]

wip

[njw45]

wip

[hfinkel]

I think this is moving in the right direction.

lib/Analysis/BasicAliasAnalysis.cpp

205

nsw -> NSW, nuw -> NUW as per the coding convention.

286

And, generally speaking, you should clang-format the patch.

1134

Can you move this into a separate function?

[njw45]

wip

[njw45]

Hi @hfinkel - I've made the fixes you suggested and have added a couple more comments. Thanks -

Nick

[hfinkel]

lib/Analysis/BasicAliasAnalysis.cpp

217

Why do we always zero-extend here? Why not sign extend? There should at least be a comment explaining this.

226

You might want to add "see below" or some other hint to where this happens.

286

this -> This

289

we -> We

[njw45]

wip

[njw45]

Thanks for the review, @hfinkel - I've updated the commit.

[hfinkel]

LGTM, thanks!

[njw45]

Sorry I dropped the ball on this - could you commit it for me as I still
don't have commit access? Thanks -

Nick

[sanjoy]

Some drop-by-comments inline in case you find them useful. I see this patch has been LGTM'ed so feel free to ignore. :)

lib/Analysis/BasicAliasAnalysis.cpp

286

I'm not sure I understand the comment -- this clause looks like it is implementing sext(sext(X,a),b) == sext(X, a + b).

291

Why is the .zextOrSelf(OldWidth) or the .trunc(SmallWidth) needed? Isn't OldWidth always equal to SmallWidth?

945

Do you mean i3? Additions in i8 are modulo 256.

949

Minor: APIntOps::umin may be clearer here.

[hfinkel]

In D6682#151887, @sanjoy wrote:

Some drop-by-comments inline in case you find them useful. I see this patch has been LGTM'ed so feel free to ignore. :)

No, that's not how things work. All comments need to be addressed. Pre- or post-commit.

In any case, this patch needs to be rebased because it no longer applies cleanly to trunk.

[njw45]

[BasicAA] Fix zext & sext handling

There are several unhandled edge cases in BasicAA's GetLinearExpression method. This changes fixes outstanding issues, including zext / sext of a constant with the sign bit set, and the refusal to decompose zexts or sexts of wrapping arithmetic.

[njw45]

@sanjoy - thanks for the review; bugs in this class are rather hard to track down as they only really manifest themselves in later optimisations, so more eyes are definitely appreciated :). I've replied to all your comments in-line - let me know if anything's not clear.

Nick

lib/Analysis/BasicAliasAnalysis.cpp

286

My latest commit adds more comments to make this clearer - does that explain it well enough?

291

This method can call itself recursively, and so the operator width reduces as we look through zexts + sexts, but the offset always stays at the initial width.

945

You're right - and I've added several unit tests prefixed "constantOffsetHeuristic_" to q.bad.ll to explore this behaviour (and to verify that I'm picking the right scales to multiply by in the heuristic).

949

Thanks - code reviews are one of the best ways to discover new utility functions in the codebase :)

[njw45]

Remove dead code left from testing

[njw45]

Hi Sanjoy - have you had a chance to look at this yet? Thanks -

Nick

[sanjoy]

lib/Analysis/BasicAliasAnalysis.cpp

260

Note that currently in the LangRef, shl nsw X, Y is not the same as mul nsw X (1 << Y), the LangRef has a bug in this regard. David has an out of tree patch to fix this http://reviews.llvm.org/D8890 but meanwhile you might want to not propagate nuw and nsw for shifts.

288

Very minor, but I think it will be clearer if you just add an annotation to each branch of the if statement:

if (is<SEXtInst>(V) && ZExtBits == 0) {
  // sext(sext(A)) == sext(A)

etc. instead of a comprehensive meta comment.

[njw45]

Address review comments

[njw45]

Hi @sanjoy - I've revised the patch to incorporate your suggestions. Is it OK now? Thanks -

Nick

lib/Analysis/BasicAliasAnalysis.cpp

260

That's interesting - I've added an early escape for the Shl that sets NSW & NUW to false in the latest version of this patch so they won't be propagated.

288

I've changed this in my latest revision of this patch.

[sanjoy]

LGTM, please check in.

[njw45]

Thanks @sanjoy - however I don't have commit rights to the repo so could you (or @hfinkel) commit it for me? Thanks -

Nick

[sanjoy]

I'll take care of it.

lib/Analysis/BasicAliasAnalysis.cpp

namespace {
   enum ExtensionKind {
     EK_NotExtended,
     EK_SignExt,
     EK_ZeroExt
   };
 
   struct VariableGEPIndex {
     const Value *V;
+
+    // We need to track what extensions we've done as we consider the same Value
+    // with different extensions as different variables in a GEP's linear expression;
+    // e.g.: if V == -1, then sext(x) != zext(x)
     ExtensionKind Extension;
     int64_t Scale;
 
     bool operator==(const VariableGEPIndex &Other) const {
       return V == Other.V && Extension == Other.Extension &&
         Scale == Other.Scale;
     }
 

 ///
 /// Note that this looks through extends, so the high bits may not be
 /// represented in the result.
 static Value *GetLinearExpression(Value *V, APInt &Scale, APInt &Offset,
                                   ExtensionKind &Extension,
                                   const DataLayout &DL, unsigned Depth,
                                   AssumptionTracker *AT,
                                   DominatorTree *DT) {
   assert(V->getType()->isIntegerTy() && "Not an integer value");
 
   // Limit our recursion depth.
   if (Depth == 6) {
     Scale = 1;
     Offset = 0;
     return V;
   }
 
   if (ConstantInt *Const = dyn_cast<ConstantInt>(V)) {
     // if it's a constant, just convert it to an offset
     // and remove the variable.
     Offset += Const->getValue();
     assert(Scale == 0 && "Constant values don't have a scale");
     return V;
   }
 
-  if (BinaryOperator *BOp = dyn_cast<BinaryOperator>(V)) {
+  if (Extension == EK_NotExtended) {
+    if(BinaryOperator *BOp = dyn_cast<BinaryOperator>(V)) {
       if (ConstantInt *RHSC = dyn_cast<ConstantInt>(BOp->getOperand(1))) {
         switch (BOp->getOpcode()) {
         default: break;
         case Instruction::Or:
           // X|C == X+C if all the bits in C are unset in X.  Otherwise we can't
           // analyze it.
           if (!MaskedValueIsZero(BOp->getOperand(0), RHSC->getValue(), &DL, 0,
                                  AT, BOp, DT))
             break;
           // FALL THROUGH.
         case Instruction::Add:
           V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
                                   DL, Depth+1, AT, DT);
           Offset += RHSC->getValue();
           return V;
+        case Instruction::Sub:
+          V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
+                                  DL, Depth+1, AT, DT);
+          Offset -= RHSC->getValue();
+          return V;
         case Instruction::Mul:
           V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
                                   DL, Depth+1, AT, DT);
           Offset *= RHSC->getValue();
           Scale *= RHSC->getValue();
           return V;
         case Instruction::Shl:
           V = GetLinearExpression(BOp->getOperand(0), Scale, Offset, Extension,
                                   DL, Depth+1, AT, DT);
           Offset <<= RHSC->getValue().getLimitedValue();
           Scale <<= RHSC->getValue().getLimitedValue();
           return V;
         }
       }
     }
+  }
 
   // Since GEP indices are sign extended anyway, we don't care about the high
   // bits of a sign or zero extended value - just scales and offsets.  The
   // extensions have to be consistent though.
   if ((isa<SExtInst>(V) && Extension != EK_ZeroExt) ||
       (isa<ZExtInst>(V) && Extension != EK_SignExt)) {
     Value *CastOp = cast<CastInst>(V)->getOperand(0);
     unsigned OldWidth = Scale.getBitWidth();
     unsigned SmallWidth = CastOp->getType()->getPrimitiveSizeInBits();
     Scale = Scale.trunc(SmallWidth);
     Offset = Offset.trunc(SmallWidth);
     Extension = isa<SExtInst>(V) ? EK_SignExt : EK_ZeroExt;
 
     Value *Result = GetLinearExpression(CastOp, Scale, Offset, Extension,
                                         DL, Depth+1, AT, DT);
     Scale = Scale.zext(OldWidth);
 
-    // We have to sign-extend even if Extension == EK_ZeroExt as we can't
-    // decompose a sign extension (i.e. zext(x - 1) != zext(x) - zext(-1)).
-    Offset = Offset.sext(OldWidth);
+    // We have to be careful if Extension == EK_ZeroExt as we can't
+    // decompose a sign extension, e.g. zext(x - 1) != zext(x) - zext(-1).
+    // This isn't true in all cases though, as zext(-1) != sext(-1).
+    Offset = isa<SExtInst>(V)
+      ? Offset.sext(OldWidth)
+      : Offset.zext(OldWidth);
 
     return Result;
   }
 
   Scale = 1;
   Offset = 0;
   return V;
 }
 
 /// DecomposeGEPExpression - If V is a symbolic pointer expression, decompose it
 /// into a base pointer with a constant offset and a number of scaled symbolic
 /// offsets.
 ///
 /// The scaled symbolic offsets (represented by pairs of a Value* and a scale in
 /// the VarIndices vector) are Value*'s that are known to be scaled by the
 /// specified amount, but which may have other unrepresented high bits. As such,
 /// the gep cannot necessarily be reconstructed from its decomposed form.
if (const GEPOperator *GEP2 = dyn_cast<GEPOperator>(V2)) {
     if ((BaseAlias == MayAlias) && V1Size == V2Size) {
       // Do the base pointers alias assuming type and size.
       AliasResult PreciseBaseAlias = aliasCheck(UnderlyingV1, V1Size,
                                                 V1AAInfo, UnderlyingV2,
                                                 V2Size, V2AAInfo);
       if (PreciseBaseAlias == NoAlias) {
         // See if the computed offset from the common pointer tells us about the
         // relation of the resulting pointer.
         int64_t GEP2BaseOffset;
         bool GEP2MaxLookupReached;
         SmallVector<VariableGEPIndex, 4> GEP2VariableIndices;
         const Value *GEP2BasePtr =
           DecomposeGEPExpression(GEP2, GEP2BaseOffset, GEP2VariableIndices,
                                  GEP2MaxLookupReached, DL, AT, DT);
         const Value *GEP1BasePtr =
           DecomposeGEPExpression(GEP1, GEP1BaseOffset, GEP1VariableIndices,
                                  GEP1MaxLookupReached, DL, AT, DT);
         // DecomposeGEPExpression and GetUnderlyingObject should return the
         // same result except when DecomposeGEPExpression has no DataLayout.
         if (GEP1BasePtr != UnderlyingV1 || GEP2BasePtr != UnderlyingV2) {
           assert(!DL &&
if (V1Size != UnknownSize && V2Size != UnknownSize &&
       return NoAlias;
 
     // If we know all the variables are positive, then GEP1 >= GEP1BasePtr.
     // If GEP1BasePtr > V2 (GEP1BaseOffset > 0) then we know the pointers
     // don't alias if V2Size can fit in the gap between V2 and GEP1BasePtr.
     if (AllPositive && GEP1BaseOffset > 0 && V2Size <= (uint64_t) GEP1BaseOffset)
       return NoAlias;
   }
 
   // Statically, we can see that the base objects are the same, but the
   // pointers have dynamic offsets which we can't resolve. And none of our
   // little tricks above worked.
   //
   // TODO: Returning PartialAlias instead of MayAlias is a mild hack; the
   // practical effect of this is protecting TBAA in the case of dynamic
   // indices into arrays of unions or malloc'd memory.
   return PartialAlias;

test/Analysis/BasicAA/q.bad.ll

+; RUN: opt < %s -basicaa -aa-eval -print-all-alias-modref-info -disable-output 2>&1 | FileCheck %s
+target datalayout = "e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv7--linux-gnueabi"
+
+%struct.spec_fd_t = type { i32, i32, i32, i32, i32 }
+@spec_fd = common global [280 x %struct.spec_fd_t] zeroinitializer, align 4
+
+; CHECK-LABEL: test_path_dependence
+; CHECK: PartialAlias: i8* %a, i8* %b
+; CHECK: PartialAlias: i8* %a, i8* %c
+; CHECK: PartialAlias: i8* %a, i8* %d
+define void @test_path_dependence(i32 %p, i8* %mem) {
+  %p.minus1 = add i32 %p, -1 ; this will always wrap, unless %p == 0
+  %p.minus1.64 = zext i32 %p.minus1 to i64
+  %p.64.again = add i64 %p.minus1.64, 1 ; either %p (if we wrapped) or 4294967296 (if we didn't)
+
+  %p.nsw.nuw.minus1 = sub nsw nuw i32 %p, 1 ; as nuw we know %p >= 1
+  %p.nsw.nuw.minus1.64 = zext i32 %p.nsw.nuw.minus1 to i64
+  %p.nsw.nuw.64.again = add nsw nuw i64 %p.nsw.nuw.minus1.64, 1 ; ...so always exactly %p
+
+  %p.nsw.minus1 = sub nsw i32 %p, 1 ; only nsw, so can only guarantee %p != 0x10000000
+  %p.nsw.minus1.64 = zext i32 %p.nsw.minus1 to i64 ; when %p <= 0 then the zext will make this a huge positive number
+  %p.nsw.64.again = add nsw i64 %p.nsw.minus1.64, 1 ; ...and so when %p <= 0 this is very much != %p
+
+  %p.64 = zext i32 %p to i64
+  %a = getelementptr inbounds i8* %mem, i64 %p.64
+  %b = getelementptr inbounds i8* %mem, i64 %p.64.again
+  %c = getelementptr inbounds i8* %mem, i64 %p.nsw.nuw.64.again
+  %d = getelementptr inbounds i8* %mem, i64 %p.nsw.64.again
+  ret void
+}
+
+; CHECK-LABEL: uncompressStream
+; CHECK: MustAlias:  i32* %offset.a, i32* %offset.b
+; CHECK: PartialAlias:  [280 x %struct.spec_fd_t]* @spec_fd, i32* %offset.b
+; CHECK: NoAlias: [280 x %struct.spec_fd_t]* @spec_fd, i32* %offset.c
+; CHECK: NoAlias:  i32* %offset.b, i32* %offset.c
+define void @uncompressStream() {
+  %offset.a = getelementptr inbounds [280 x %struct.spec_fd_t]* @spec_fd, i32 0, i32 255, i32 2
+  %literal.255 = zext i8 255 to i32
+  %offset.b = getelementptr inbounds [280 x %struct.spec_fd_t]* @spec_fd, i32 0, i32 %literal.255, i32 2
+  %literal.minus1 = sext i8 255 to i32
+  %offset.c = getelementptr inbounds [280 x %struct.spec_fd_t]* @spec_fd, i32 0, i32 %literal.minus1, i32 2
+  ret void
+}