Introduce bitset metadata format and bitset lowering pass.

[pcc]

Summary

This patch introduces a new mechanism that allows IR modules to co-operatively
build pointer sets corresponding to addresses within a given set of
globals. One particular use case for this is to allow a C++ program to
efficiently verify (at each call site) that a vtable pointer is in the set
of valid vtable pointers for the class or its derived classes. One way of
doing this is for a toolchain component to build, for each class, a bit set
that maps to the memory region allocated for the vtables, such that each 1
bit in the bit set maps to a valid vtable for that class, and lay out the
vtables next to each other, to minimize the total size of the bit sets.

The patch introduces a metadata format for representing pointer sets, an
'@llvm.bitset.test' intrinsic and an LTO lowering pass that lays out the globals
and builds the bitsets, and documents the new feature.

Design discussion: http://lists.cs.uiuc.edu/pipermail/llvmdev/2015-January/081285.html

[silvas]

My overarching concern here is extending the IR and bitcode for a feature whose utility hasn't been demonstrated. There doesn't seem to be consensus on llvmdev that this feature is worth the maintenance cost.

[pcc]

• Correctly handle multiple calls to llvm.bitset.test for a single bitset

[pcc]

• Use metadata instead of introducing the bitset global feature
• Move bitcode format updates to separate patch

[kcc]

Do you want to also change the patch summary?

[pcc]

Do you want to also change the patch summary?

Done.

[pcc]

Unfortunately I've found that this won't work if a pass (such as globaldce) calls removeDeadConstantUsers on the vtable global, as this will cause the getelementptr to be deleted and replaced with null in the metadata.

I'll try to fix this by changing the metadata format to be of the form:

{ bitset name, global, byte offset }

[pcc]

• Switch to metadata format { bitset name, global, byte offset } to avoid removeDeadConstantUsers issue

[kcc]

Two comments on the doc so far.

docs/LangRef.rst

1866

two elements... and the third is ...

1889

I'd suggest you to have an example that has a non-zero offset (otherwise it's not clear why you need offsets)

[pcc]

docs/LangRef.rst

1866

Done.

1889

Done.

[pcc]

• Documentation fixes

[silvas]

Can you please break the docs for this into a separate document? This is what we have been doing lately for "large" new IR features, like stackmaps, statepoints and inalloca. I think this feature qualifies. The separate document format gives a bit more breathing room for discussing the design and rationale of the feature, along with providing more in-depth explanation and examples.

[kcc]

+1 for a separate doc file

[pcc]

• Move documentation to separate page

[kcc]

lib/Transforms/IPO/LowerBitSets.cpp

44

} // namespace

54

I wonder if you could split this 300 LOC function into several smaller ones.

[jfb]

I haven't looked at the big function or tests in-depth yet, agreed with @kcc that breaking up the function would make it easier to review.

Could you also add stats to the pass? I'd like Chrome to be able to have a sanity check test that this pass does something.

lib/Transforms/IPO/LowerBitSets.cpp

58

Shouldn't it be an error to try to run the bit set test pass without a module containing the llvm.bitset.test intrinsic?

75

What other valid uses of the intrinsic are there?

89

I'm not sure I get what's going on here :-)

181

UNINT64_MIN or std::numeric_limits<uint64_t>::min() is nicer.

[pcc]

• Address review comments

lib/Transforms/IPO/LowerBitSets.cpp

44

Done.

54

Done.

58

This pass should work with any module, including modules that happen not to contain calls to the intrinsic.

75

There shouldn't be any (or at least the verifier should have errored on them). I've changed this to a cast.

89

I've added a comment which should hopefully clarify things here.

181

(I think you mean ::max) Done.

[pcc]

• s/constants/metadata/

[pcc]

• Add statistics

[kcc]

Few comments in random places, more to go

lib/Transforms/IPO/LowerBitSets.cpp

11

are we going to handle InvokeInst?
Check llvm/IR/CallSite.h

56

SmallVector maybe

107

I'd prefer if we report_fatal_error w/o DL, just like in AddressSanitizer.cpp

[kcc]

Few comments in random places, more to go

[kcc]

lib/Transforms/IPO/LowerBitSets.cpp

116

I wonder if this thing is unit-testable separately?
We are not doing these things frequently, but I think we should.
E.g. see ASanStackFrameLayoutTest.cpp

122

SmallVector, here and maybe in other places.

211

Clever!

223

Do we really want a separate BB here?
On valid programs, i.e. in 99.9999% cases both checks will pass, so it might be better to do this w/o branches.

[pcc]

This also introduces a couple of optimizations which yielded a binary size
improvement of about 0.5% in a certain medium size (~14MB) binary.

• Enforce availability of data layout
• Check if the pointer is statically a member of the bitset; if so, remove the check
• Add fast check for case where bitset contains single element
• Use SmallVector

[pcc]

lib/Transforms/IPO/LowerBitSets.cpp

11

It isn't normally possible to invoke an intrinsic -- I think this is only possible for two specific intrinsics. In any case, this intrinsic cannot unwind.

56

I don't think we can make any prediction one way or another how large these are going to get. For vptr CFI it depends on the number of virtual calls made using a particular class, which is essentially unbounded. In the absence of any evidence I'd prefer to leave this as a std::vector.

107

Done.

116

Most likely. I think this already has enough test coverage for the moment though.

122

Done. This is probably better as a SmallVector since it lives on the stack and we can probably make an educated guess on its size.

223

It seems better to have separate BBs for the llvm.bitset.test intrinsic at least. Without the separate BBs, we could segv on out-of-bounds addresses, and it's possible that the caller might always need the boolean result (say if it wanted to print a diagnostic message if the check fails). If we do introduce intrinsics that are required to abort the program if the address is out of bounds, we could probably do both checks in the same BB, as either way the program would abort (but it would be harder to distinguish CFI failures from other types of crashes).

[kcc]

lib/Transforms/IPO/LowerBitSets.cpp

169

do you need M here?

198

I'd split this function into two at this point.
Then the second part of the function will become easily unit-testable.

202

This part is the key to understanding what we are doing here.
It would be nice to have examples of input (array of offsets) and output (bitset).
But then, a unit tests would be a better example than comments.
I do not agree with you here that we have enough test coverage and hence do not need more tests.
unit tests are not necessarily required only for test coverage -- they are also a good way to provide examples.

294

the code gen seems to generate the BT instruction sometimes.

It's may be better to just create an instruction sequence that will be lowered to BT.
Example:

void foo(unsigned char a, unsigned long b) {

if (a & (1 << b))
  __builtin_trap();

}

0:	0f a3 f7             	bt     %esi,%edi
3:	72 01                	jb     6 <_Z3foohm+0x6>
5:	c3                   	retq   
6:	0f 0b                	ud2

[pcc]

lib/Transforms/IPO/LowerBitSets.cpp

169

No, I'll remove it.

198

Makes sense, I'll do that.

202

Fair enough, I'll see if I can add a few unit tests.

294

Yes, we can do that. I did try before to emit the register variant of BT but I guess I wasn't using the correct pattern. I'll play around with the IR to see if I can get it to match.

I was also thinking more of the memory variant of BT that basically does exactly what we want given a bit offset.

[pcc]

• Use register variant of bt instruction on x86
• Move bitset lowering pass before simplifycfg
• If the bit set is sufficiently small, we can avoid a load by bit testing a constant
• Update test case
• Move part of implementation to testable location
• Add unit tests for BitSetBuilder
• Remove M parameter

[pcc]

Also implemented an optimization for bit sets of size <= 64 bits.

lib/Transforms/IPO/LowerBitSets.cpp

169

Done.

198

Done.

202

Done.

294

This now uses the register BT.

[pcc]

• Update comment with benchmark results for memory bt

[kcc]

lib/Transforms/IPO/LowerBitSets.cpp

176

You can get all of these, except for IntPtrTy, from the IRBuilder. Just FYI, this way is also fine, I think.

190

I would add comments for every non-trivial function.
In most cases, I understand what these things are doing, other readers (including myself in 6 months) will probably be puzzled.

293

split into a separate function?

[pcc]

• Remove Int8Ty field.
• Add function comments
• Factor out some code into a function

lib/Transforms/IPO/LowerBitSets.cpp

190

Done

293

Done

[jfb]

lib/Transforms/IPO/LowerBitSets.cpp

43

1 should technically be a uint64_t too, though if the current code triggered UB things would be awful in other ways!

237

I'm mildly disappointed that the optimizer doesn't do this by taking into account ISA-specific sizes (and then removing the dead global because its address isn't taken).

[pcc]

• Use a 64-bit shift, add unit tests for containsGlobalOffset

lib/Transforms/IPO/LowerBitSets.cpp

43

Thanks, fixed and added unit tests for this function.

237

This should in principle be possible, but this pass runs late so in any case it seems best to directly generate the IR we need.

[jfb]

lib/Transforms/IPO/LowerBitSets.cpp

237

Does it need to run that late? 8 may not be the right number on all architectures, and you should see a good binary size reduction by GC'ing unreferenced globals (especially if CFI+devirtualization occurs).

[pcc]

lib/Transforms/IPO/LowerBitSets.cpp

237

It seemed better to run the pass later because it splits basic blocks, which could pessimize things in other passes, and bitset creation essentially locks in the set of virtual tables that appear in the binary, preventing them from being GCd.

I'm not sure what the best way to deal with this might be. We might later want to split this pass into an early pass and a late pass, where the early pass uses bitset metadata to do devirtualization, a later globalopt pass GCs unused vtables and the late pass builds the actual bitsets.

[jfb]

lib/Transforms/IPO/LowerBitSets.cpp

237

Maybe I have a naive view, but shouldn't bitsets be GC'able if no test refers to them? This doesn't need to be an optimization that's specific to your code, LLVM can do this in general when a global doesn't escape and isn't address-taken (and in your case, is read-only). If this is correct, then I don't think you need to split up this pass, though I agree that you may want to do devirtualization earlier to expose more optimization opportunities.

Under the current setup, do redundant tests in the same function get eliminated and control flow merged?

This may be something that we can leave open for later changes: I think the current code is good in that it does what's required and is pretty efficient at it. I don't think the design will change substantially, but I do think there are further optimization opportunities here. WDYT?

[pcc]

lib/Transforms/IPO/LowerBitSets.cpp

237

Maybe I have a naive view, but shouldn't bitsets be GC'able if no test refers to them?

They could be, but the globals that the bitsets map onto (i.e. the vtables) cannot be GC'd because we lay them out in a specific order in this pass.

We only build bitset constants for bitsets that are referred to by tests. The loop near the start of LowerBitSets::buildBitSets identifies all such bitsets by looking through the uses of the llvm.bitset.test intrinsic. If a particular test is dead, LLVM should equally be able to remove the dead test (as it is a readonly intrinsic) or remove a dead load from a bitset as part of DCE (in fact the former would probably be easier because of the simpler control flow).

Another advantage of doing this late is that allowing the earlier passes to eliminate dead tests we potentially reduce the number of equivalence classes we need to create, which could result in smaller disjoint sets of classes and therefore smaller bitsets.

Under the current setup, do redundant tests in the same function get eliminated and control flow merged?

Are you referring to cases where a virtual call happens twice through the same pointer?

struct S {
  virtual void f();
};

[...]
S *p = ...;
p->f();
p->f();

The problem is that it will be difficult to remove redundant tests because of the semantics of C++. In this case the function f could overwrite the memory region that p refers to with an object of a different derived class without invoking undefined behavior. We might want a flag that a user can use to promise that such things will never happen though.

I don't think the design will change substantially, but I do think there are further optimization opportunities here. WDYT?

At a high level I do agree that there are optimization opportunities to pursue here. (I could elaborate, but this probably isn't the place.)

[jfb]

Comment at: lib/Transforms/IPO/LowerBitSets.cpp:236
@@ +235,3 @@
+ Value *BitOffset) {
+ if (BSI.Bits.size() <= 8) {
+ // If the bit set is sufficiently small, we can avoid a load by bit

testing

Maybe I have a naive view, but shouldn't bitsets be GC'able if no test

refers to them? This doesn't need to be an optimization that's specific to
your code, LLVM can do this in general when a global doesn't escape and
isn't address-taken (and in your case, is read-only). If this is correct,
then I don't think you need to split up this pass, though I agree that you
may want to do devirtualization earlier to expose more optimization
opportunities.

Under the current setup, do redundant tests in the same function get

eliminated and control flow merged?

This may be something that we can leave open for later changes: I think

the current code is good in that it does what's required and is pretty
efficient at it. I don't think the design will change substantially, but I
do think there are further optimization opportunities here. WDYT?

Maybe I have a naive view, but shouldn't bitsets be GC'able if no test

refers to them?

They could be, but the globals that the bitsets map onto (i.e. the
vtables) cannot be GC'd because we lay them out in a specific order in this
pass.

We only build bitset constants for bitsets that are referred to by tests.
The loop near the start of LowerBitSets::buildBitSets identifies all such
bitsets by looking through the uses of the llvm.bitset.test intrinsic. If
a particular test is dead, LLVM should equally be able to remove the dead
test (as it is a readonly intrinsic) or remove a dead load from a bitset as
part of DCE (in fact the former would probably be easier because of the
simpler control flow).

OK, that's what I was hoping happens (I was afraid the optimization was
running too early to be able to do this).

Another advantage of doing this late is that allowing the earlier passes to

eliminate dead tests we potentially reduce the number of equivalence
classes we need to create, which could result in smaller disjoint sets of
classes and therefore smaller bitsets.

Agreed.

Under the current setup, do redundant tests in the same function get
eliminated and control flow merged?

Are you referring to cases where a virtual call happens twice through the
same pointer?

Yes, or any case where the test intrinsic is redundant (doesn't have to be
the same f).

The problem is that it will be difficult to remove redundant tests because

of the semantics of C++. In this case the function f could overwrite the
memory region that p refers to with an object of a different derived class
without invoking undefined behavior. We might want a flag that a user can
use to promise that such things will never happen though.

Good point, I hadn't thought through that. It may be worth adding to the
design doc?

I don't think the design will change substantially, but I do think there
are further optimization opportunities here. WDYT?

At a high level I do agree that there are optimization opportunities to
pursue here. (I could elaborate, but this probably isn't the place.)

OK, overall this lgtm, I think we're on the same page w.r.t. potential
optimizations.

[kcc]

LGTM

I think at this point it will become easier to continue reviews/improvements if the code is committed.
Let's give one more day to other reviewers -- if you don't hear significant objections please commit tomorrow.

lib/Transforms/IPO/LowerBitSets.cpp

363

remove {}

docs/BitSets.rst

+=======
+Bitsets
+=======
+
+This is a mechanism that allows IR modules to co-operatively build pointer
+sets corresponding to addresses within a given set of globals. One example
+of a use case for this is to allow a C++ program to efficiently verify (at
+each call site) that a vtable pointer is in the set of valid vtable pointers
+for the type of the class or its derived classes.
+
+To use the mechanism, a client creates a global metadata node named
+``llvm.bitsets``.  Each element is a metadata node with three elements:
+the first is a metadata string containing an identifier for the bitset,
+the second is a global variable and the third is a byte offset into the
+global variable.
+
+This will cause a link-time optimization pass to generate bitsets from the
+memory addresses referenced from the elements of the bitset metadata. The pass
+will lay out the referenced globals consecutively, so their definitions must
+be available at LTO time. An intrinsic, :ref:`llvm.bitset.test <bitset.test>`,
+generates code to test whether a given pointer is a member of a bitset.
+
+:Example:
+
+::
+
+    target datalayout = "e-p:32:32"
+
+    @a = internal global i32 0
+    @b = internal global i32 0
+    @c = internal global i32 0
+    @d = internal global [2 x i32] [i32 0, i32 0]
+
+    !llvm.bitsets = !{!0, !1, !2, !3, !4}
+
+    !0 = !{!"bitset1", i32* @a, i32 0}
+    !1 = !{!"bitset1", i32* @b, i32 0}
+    !2 = !{!"bitset2", i32* @b, i32 0}
+    !3 = !{!"bitset2", i32* @c, i32 0}
+    !4 = !{!"bitset2", i32* @d, i32 4}
+
+    declare i1 @llvm.bitset.test(i8* %ptr, metadata %bitset) nounwind readnone
+
+    define i1 @foo(i32* %p) {
+      %pi8 = bitcast i32* %p to i8*
+      %x = call i1 @llvm.bitset.test(i8* %pi8, metadata !"bitset1")
+      ret i1 %x
+    }
+
+    define i1 @bar(i32* %p) {
+      %pi8 = bitcast i32* %p to i8*
+      %x = call i1 @llvm.bitset.test(i8* %pi8, metadata !"bitset2")
+      ret i1 %x
+    }
+
+    define void @main() {
+      %a1 = call i1 @foo(i32* @a) ; returns 1
+      %b1 = call i1 @foo(i32* @b) ; returns 1
+      %c1 = call i1 @foo(i32* @c) ; returns 0
+      %a2 = call i1 @bar(i32* @a) ; returns 0
+      %b2 = call i1 @bar(i32* @b) ; returns 1
+      %c2 = call i1 @bar(i32* @c) ; returns 1
+      %d02 = call i1 @bar(i32* getelementptr ([2 x i32]* @d, i32 0, i32 0)) ; returns 0
+      %d12 = call i1 @bar(i32* getelementptr ([2 x i32]* @d, i32 0, i32 1)) ; returns 1
+      ret void
+    }

docs/LangRef.rst

 
 The LLVM type system is one of the most important features of the
 intermediate representation. Being typed enables a number of
 optimizations to be performed on the intermediate representation
 directly, without having to do extra analyses on the side before the
 transformation. A strong type system makes it easier to read the
 generated code and enables novel analyses and transformations that are
 not feasible to perform on normal three address code representations.
 
 .. _t_void:
 
 Void Type
 ---------
 
 :Overview:
 
 
 The void type does not represent any value and has no size.
 
 :Syntax:
 
 
 ::
 
       void
 
 
 .. _t_function:
 
 Function Type
 -------------
 
 :Overview:
 
 
 The function type can be thought of as a function signature. It consists of a
 return type and a list of formal parameter types. The return type of a function
 type is a void type or first class type --- except for :ref:`label <t_label>`
 and :ref:`metadata <t_metadata>` types.
 
inner.for.end:
      br i1 %exitcond, label %outer.for.end, label %outer.for.body, !llvm.loop !2
 
    outer.for.end:                                          ; preds = %for.body
    ...
    !0 = !{!1, !2} ; a list of loop identifiers
    !1 = !{!1} ; an identifier for the inner loop
    !2 = !{!2} ; an identifier for the outer loop
 
+'``llvm.bitsets``'
+^^^^^^^^^^^^^^^^^^
+
+The ``llvm.bitsets`` global metadata is used to implement
+:doc:`bitsets <BitSets>`.
+
 Module Flags Metadata
 =====================
 
 Information about the module as a whole is difficult to convey to LLVM's
 subsystems. The LLVM IR isn't sufficient to transmit this information.
 The ``llvm.module.flags`` named metadata exists in order to facilitate
 this. These flags are in the form of key / value pairs --- much like a
 dictionary --- making it easy for any subsystem who cares about a flag to

 used by the ``llvm.assume`` intrinsic in order to preserve the instructions
 only used to form the intrinsic's input argument. This might prove undesirable
 if the extra information provided by the ``llvm.assume`` intrinsic does not cause
 sufficient overall improvement in code quality. For this reason,
 ``llvm.assume`` should not be used to document basic mathematical invariants
 that the optimizer can otherwise deduce or facts that are of little use to the
 optimizer.
 
+.. _bitset.test:
+
+'``llvm.bitset.test``' Intrinsic
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Syntax:
+"""""""
+
+::
+
+      declare i1 @llvm.bitset.test(i8* %ptr, metadata %bitset) nounwind readnone
+
+
+Arguments:
+""""""""""
+
+The first argument is a pointer to be tested. The second argument is a
+metadata string containing the name of a :doc:`bitset <BitSets>`.
+
+Overview:
+"""""""""
+
+The ``llvm.bitset.test`` intrinsic tests whether the given pointer is a
+member of the given bitset.
+
 '``llvm.donothing``' Intrinsic
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Syntax:
 """""""
 
 ::
 

docs/index.rst

.. toctree::
    NVPTXUsage
    R600Usage
    StackMaps
    InAlloca
    BigEndianNEON
    CoverageMappingFormat
    Statepoints
    MergeFunctions
+   BitSets
 
 :doc:`WritingAnLLVMPass`
    Information on how to write LLVM transformations and analyses.
 
 :doc:`WritingAnLLVMBackend`
    Information on how to write LLVM backends for machine targets.
 
 :doc:`CodeGenerator`

include/llvm/ADT/EquivalenceClasses.h

public:
 
     explicit member_iterator() {}
     explicit member_iterator(const ECValue *N) : Node(N) {}
 
     reference operator*() const {
       assert(Node != nullptr && "Dereferencing end()!");
       return Node->getData();
     }
-    reference operator->() const { return operator*(); }
+    pointer operator->() const { return &operator*(); }
 
     member_iterator &operator++() {
       assert(Node != nullptr && "++'d off the end of the list!");
       Node = Node->getNext();
       return *this;
     }
 
     member_iterator operator++(int) {    // postincrement operators.

include/llvm/ADT/PointerUnion.h

namespace llvm {
   }
 
   template<typename PT1, typename PT2>
   static bool operator!=(PointerUnion<PT1, PT2> lhs,
                          PointerUnion<PT1, PT2> rhs) {
     return lhs.getOpaqueValue() != rhs.getOpaqueValue();
   }
 
+  template<typename PT1, typename PT2>
+  static bool operator<(PointerUnion<PT1, PT2> lhs,
+                        PointerUnion<PT1, PT2> rhs) {
+    return lhs.getOpaqueValue() < rhs.getOpaqueValue();
+  }
+
   // Teach SmallPtrSet that PointerUnion is "basically a pointer", that has
   // # low bits available = min(PT1bits,PT2bits)-1.
   template<typename PT1, typename PT2>
   class PointerLikeTypeTraits<PointerUnion<PT1, PT2> > {
   public:
     static inline void *
     getAsVoidPointer(const PointerUnion<PT1, PT2> &P) {
       return P.getOpaqueValue();

include/llvm/IR/Intrinsics.td

def int_masked_store : Intrinsic<[], [llvm_anyvector_ty, LLVMPointerTo<0>,
                                       llvm_i32_ty,
                                       LLVMVectorSameWidth<0, llvm_i1_ty>],
                                  [IntrReadWriteArgMem]>;
 
 def int_masked_load  : Intrinsic<[llvm_anyvector_ty],
                                  [LLVMPointerTo<0>, llvm_i32_ty,
                                   LLVMVectorSameWidth<0, llvm_i1_ty>, LLVMMatchType<0>],
                                  [IntrReadArgMem]>;
+
+// Intrinsics to support bit sets.
+def int_bitset_test : Intrinsic<[llvm_i1_ty], [llvm_ptr_ty, llvm_metadata_ty],
+                                [IntrNoMem]>;
+
 //===----------------------------------------------------------------------===//
 // Target-specific intrinsics
 //===----------------------------------------------------------------------===//
 
 include "llvm/IR/IntrinsicsPowerPC.td"
 include "llvm/IR/IntrinsicsX86.td"
 include "llvm/IR/IntrinsicsARM.td"
 include "llvm/IR/IntrinsicsAArch64.td"
 include "llvm/IR/IntrinsicsXCore.td"
 include "llvm/IR/IntrinsicsHexagon.td"
 include "llvm/IR/IntrinsicsNVVM.td"
 include "llvm/IR/IntrinsicsMips.td"
 include "llvm/IR/IntrinsicsR600.td"
 include "llvm/IR/IntrinsicsBPF.td"

include/llvm/InitializePasses.h

 void initializeLoopSimplifyPass(PassRegistry&);
 void initializeLoopStrengthReducePass(PassRegistry&);
 void initializeGlobalMergePass(PassRegistry&);
 void initializeLoopRerollPass(PassRegistry&);
 void initializeLoopUnrollPass(PassRegistry&);
 void initializeLoopUnswitchPass(PassRegistry&);
 void initializeLoopIdiomRecognizePass(PassRegistry&);
 void initializeLowerAtomicPass(PassRegistry&);
+void initializeLowerBitSetsPass(PassRegistry&);
 void initializeLowerExpectIntrinsicPass(PassRegistry&);
 void initializeLowerIntrinsicsPass(PassRegistry&);
 void initializeLowerInvokePass(PassRegistry&);
 void initializeLowerSwitchPass(PassRegistry&);
 void initializeMachineBlockFrequencyInfoPass(PassRegistry&);
 void initializeMachineBlockPlacementPass(PassRegistry&);
 void initializeMachineBlockPlacementStatsPass(PassRegistry&);
 void initializeMachineBranchProbabilityInfoPass(PassRegistry&);

include/llvm/Transforms/IPO.h

 //
 ModulePass *createMetaRenamerPass();
 
 //===----------------------------------------------------------------------===//
 /// createBarrierNoopPass - This pass is purely a module pass barrier in a pass
 /// manager.
 ModulePass *createBarrierNoopPass();
 
+/// \brief This pass lowers bitset metadata and the llvm.bitset.test intrinsic
+/// to bitsets.
+ModulePass *createLowerBitSetsPass();
+
 } // End llvm namespace
 
 #endif

lib/Transforms/IPO/CMakeLists.txt

 add_llvm_library(LLVMipo
   ArgumentPromotion.cpp
   BarrierNoopPass.cpp
   ConstantMerge.cpp
   DeadArgumentElimination.cpp
   ExtractGV.cpp
   FunctionAttrs.cpp
   GlobalDCE.cpp
   GlobalOpt.cpp
   IPConstantPropagation.cpp
   IPO.cpp
   InlineAlways.cpp
   InlineSimple.cpp
   Inliner.cpp
   Internalize.cpp
   LoopExtractor.cpp
+  LowerBitSets.cpp
   MergeFunctions.cpp
   PartialInlining.cpp
   PassManagerBuilder.cpp
   PruneEH.cpp
   StripDeadPrototypes.cpp
   StripSymbols.cpp
   )
 
 add_dependencies(LLVMipo intrinsics_gen)

lib/Transforms/IPO/IPO.cpp

void llvm::initializeIPO(PassRegistry &Registry) {
   initializeGlobalOptPass(Registry);
   initializeIPCPPass(Registry);
   initializeAlwaysInlinerPass(Registry);
   initializeSimpleInlinerPass(Registry);
   initializeInternalizePassPass(Registry);
   initializeLoopExtractorPass(Registry);
   initializeBlockExtractorPassPass(Registry);
   initializeSingleLoopExtractorPass(Registry);
+  initializeLowerBitSetsPass(Registry);
   initializeMergeFunctionsPass(Registry);
   initializePartialInlinerPass(Registry);
   initializePruneEHPass(Registry);
   initializeStripDeadPrototypesPassPass(Registry);
   initializeStripSymbolsPass(Registry);
   initializeStripDebugDeclarePass(Registry);
   initializeStripDeadDebugInfoPass(Registry);
   initializeStripNonDebugSymbolsPass(Registry);

lib/Transforms/IPO/LowerBitSets.cpp

+//===-- LowerBitSets.cpp - Bitset lowering pass ---------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This pass lowers bitset metadata and calls to the llvm.bitset.test intrinsic.
+// See http://llvm.org/docs/LangRef.html#bitsets for more information.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/Transforms/IPO.h"
+#include "llvm/ADT/EquivalenceClasses.h"
+#include "llvm/IR/Constant.h"
+#include "llvm/IR/Constants.h"
+#include "llvm/IR/GlobalVariable.h"
+#include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/Instructions.h"
+#include "llvm/IR/Intrinsics.h"
+#include "llvm/IR/Module.h"
+#include "llvm/IR/Operator.h"
+#include "llvm/Pass.h"
+#include "llvm/Transforms/Utils/BasicBlockUtils.h"
+
+using namespace llvm;
+
+namespace {
+
+struct LowerBitSets : public ModulePass {
+  static char ID;
+  LowerBitSets() : ModulePass(ID) {
+    initializeLowerBitSetsPass(*PassRegistry::getPassRegistry());
+  }
+
+  bool buildBitSets(Module &M, const DataLayout *DL);
+  bool eraseBitSetMetadata(Module &M);
+
+  bool runOnModule(Module &M) override;
+};
+
+}
+
+INITIALIZE_PASS_BEGIN(LowerBitSets, "lowerbitsets",
+                "Lower bitset metadata", false, false)
+INITIALIZE_PASS_END(LowerBitSets, "lowerbitsets",
+                "Lower bitset metadata", false, false)
+char LowerBitSets::ID = 0;
+
+ModulePass *llvm::createLowerBitSetsPass() { return new LowerBitSets; }
+
+bool LowerBitSets::buildBitSets(Module &M, const DataLayout *DL) {
+  Function *BitSetTestFunc =
+      M.getFunction(Intrinsic::getName(Intrinsic::bitset_test));
+  if (!BitSetTestFunc)
+    return false;
+
+  // Equivalence class set containing bitsets and the globals they reference.
+  // This is used to partition the set of bitsets in the module into disjoint
+  // sets.
+  typedef EquivalenceClasses<PointerUnion<GlobalVariable *, MDString *>>
+      GlobalClassesTy;
+  GlobalClassesTy GlobalClasses;
+
+  // Mapping from bitset mdstrings to the call sites that test them.
+  DenseMap<MDString *, std::vector<CallInst *>> BitSetTestCallSites;
+
+  NamedMDNode *BitSetNM = M.getNamedMetadata("llvm.bitsets");
+
+  for (const Use &U : BitSetTestFunc->uses()) {
+    auto CI = dyn_cast<CallInst>(U.getUser());
+    if (!CI)
+      continue;
+
+    auto BitSetMDVal = dyn_cast<MetadataAsValue>(CI->getArgOperand(1));
+    if (!BitSetMDVal || !isa<MDString>(BitSetMDVal->getMetadata()))
+      report_fatal_error(
+          "Second argument of llvm.bitset.test must be metadata string");
+    auto BitSet = cast<MDString>(BitSetMDVal->getMetadata());
+
+    std::pair<DenseMap<MDString *, std::vector<CallInst *>>::iterator,
+              bool> Ins =
+        BitSetTestCallSites.insert(
+            std::make_pair(BitSet, std::vector<CallInst *>()));
+    Ins.first->second.push_back(CI);
+    if (!Ins.second)
+      continue;
+
+    GlobalClassesTy::iterator GCI = GlobalClasses.insert(BitSet);
+    GlobalClassesTy::member_iterator CurSet = GlobalClasses.findLeader(GCI);
+
+    if (!BitSetNM)
+      continue;
+
+    for (MDNode *Op : BitSetNM->operands()) {
+      if (Op->getNumOperands() != 3)
+        report_fatal_error(
+            "All operands of llvm.bitsets metadata must have 3 elements");
+
+      if (Op->getOperand(0) != BitSet || !Op->getOperand(1))
+        continue;
+
+      auto OpConstMD = dyn_cast<ConstantAsMetadata>(Op->getOperand(1));
+      if (!OpConstMD)
+        report_fatal_error("Bit set element must be a constant");
+      auto OpGlobal = dyn_cast<GlobalVariable>(OpConstMD->getValue());
+      if (!OpGlobal)
+        report_fatal_error("Bit set element must refer to global");
+
+      auto OffsetConstMD = dyn_cast<ConstantAsMetadata>(Op->getOperand(2));
+      if (!OffsetConstMD)
+        report_fatal_error("Bit set element offset must be a constant");
+      auto OffsetInt = dyn_cast<ConstantInt>(OffsetConstMD->getValue());
+      if (!OffsetInt)
+        report_fatal_error(
+            "Bit set element offset must be an integer constant");
+
+      CurSet = GlobalClasses.unionSets(
+          CurSet, GlobalClasses.findLeader(GlobalClasses.insert(OpGlobal)));
+    }
+  }
+
+  if (GlobalClasses.empty())
+    return false;
+
+  for (GlobalClassesTy::iterator I = GlobalClasses.begin(),
+                                 E = GlobalClasses.end();
+       I != E; ++I) {
+    if (!I->isLeader()) continue;
+
+    // Build the list of bitsets and referenced globals in this disjoint set.
+    std::vector<MDString *> BitSets;
+    std::vector<GlobalVariable *> Globals;
+    for (GlobalClassesTy::member_iterator MI = GlobalClasses.member_begin(I);
+         MI != GlobalClasses.member_end(); ++MI) {
+      if ((*MI).is<MDString *>())
+        BitSets.push_back(MI->get<MDString *>());
+      else
+        Globals.push_back(MI->get<GlobalVariable *>());
+    }
+
+    // Order bitsets and globals by name for determinism. TODO: We may later
+    // want to use a more sophisticated ordering that lays out globals so as to
+    // minimize the sizes of the bitsets.
+    std::sort(BitSets.begin(), BitSets.end(), [](MDString *S1, MDString *S2) {
+      return S1->getString() < S2->getString();
+    });
+    std::sort(Globals.begin(), Globals.end(),
+              [](GlobalVariable *GV1, GlobalVariable *GV2) {
+                return GV1->getName() < GV2->getName();
+              });
+
+    // Build a new global with the combined contents of the referenced globals.
+    std::vector<Constant *> GlobalInits;
+    for (GlobalVariable *G : Globals)
+      GlobalInits.push_back(G->getInitializer());
+    Constant *NewInit = ConstantStruct::getAnon(M.getContext(), GlobalInits);
+    auto NewGlobal =
+        new GlobalVariable(M, NewInit->getType(), /*isConstant=*/true,
+                           GlobalValue::PrivateLinkage, NewInit);
+
+    const StructLayout *NewGlobalLayout =
+        DL->getStructLayout(cast<StructType>(NewInit->getType()));
+
+    // Compute the offsets of the original globals within the new global.
+    DenseMap<GlobalVariable *, uint64_t> GlobalLayout;
+    for (unsigned I = 0; I != Globals.size(); ++I) {
+      GlobalLayout[Globals[I]] = NewGlobalLayout->getElementOffset(I);
+    }
+
+    Type *Int1Ty = Type::getInt1Ty(M.getContext());
+    Type *Int8Ty = Type::getInt8Ty(M.getContext());
+    Type *Int32Ty = Type::getInt32Ty(M.getContext());
+    Type *IntPtrTy = DL->getIntPtrType(M.getContext(), 0);
+
+    // For each bitset in this disjoint set...
+    for (MDString *BS : BitSets) {
+      std::vector<uint64_t> Offsets;
+      uint64_t Min = ~0UL, Max = 0;
+
+      // Compute the byte offset of each element of this bitset.
+      if (BitSetNM) {
+        for (MDNode *Op : BitSetNM->operands()) {
+          if (Op->getOperand(0) != BS || !Op->getOperand(1))
+            continue;
+          auto OpGlobal = cast<GlobalVariable>(
+              cast<ConstantAsMetadata>(Op->getOperand(1))->getValue());
+          uint64_t Offset =
+              cast<ConstantInt>(cast<ConstantAsMetadata>(Op->getOperand(2))
+                                    ->getValue())->getZExtValue();
+
+          Offset += GlobalLayout[OpGlobal];
+
+          if (Min > Offset)
+            Min = Offset;
+          if (Max < Offset)
+            Max = Offset;
+
+          Offsets.push_back(Offset);
+        }
+      }
+
+      if (Min > Max)
+        Min = 0;
+
+      // Normalize each offset against the minimum observed offset, and compute
+      // the bitwise OR of each of the offsets. The number of trailing zeros
+      // in the mask gives us the log2 of the alignment of all offsets, which
+      // allows us to compress the bitset by only storing one bit per aligned
+      // address.
+      uint64_t Mask = 0;
+      for (uint64_t &Offset : Offsets) {
+        Offset -= Min;
+        Mask |= Offset;
+      }
+
+      unsigned AlignPow2 = 0;
+      // FIXME: Can probably do something smarter if all offsets are 0.
+      if (Mask != 0)
+        AlignPow2 = countTrailingZeros(Mask, ZB_Undefined);
+
+      // Build the compressed bitset while normalizing the offsets against the
+      // computed alignment.
+      uint64_t BitSize = ((Max - Min) >> AlignPow2) + 1;
+      uint64_t ByteSize = (BitSize + 7) / 8;
+      std::vector<uint8_t> Bits(ByteSize);
+      for (uint64_t Offset : Offsets) {
+        Offset >>= AlignPow2;
+        Bits[Offset / 8] |= 1 << (Offset % 8);
+      }
+
+      Constant *BitsConst = ConstantDataArray::get(M.getContext(), Bits);
+      auto BitSetGlobal = new GlobalVariable(
+          M, BitsConst->getType(), /*isConstant=*/true,
+          GlobalValue::PrivateLinkage, BitsConst, BS->getString() + ".bits");
+
+      Constant *GlobalAsInt = ConstantExpr::getPtrToInt(NewGlobal, IntPtrTy);
+      Constant *GlobalMinAsInt =
+          ConstantExpr::getAdd(GlobalAsInt, ConstantInt::get(IntPtrTy, Min));
+      Constant *BitSizeConst = ConstantInt::get(IntPtrTy, BitSize);
+
+      // Generate code to test the bitset for each call to llvm.bitset.test for
+      // this bitset.
+      for (CallInst *CI : BitSetTestCallSites[BS]) {
+        Value *Ptr = CI->getArgOperand(0);
+        BasicBlock *InitialBB = CI->getParent();
+
+        IRBuilder<> B(CI);
+
+        Value *PtrAsInt = B.CreatePtrToInt(Ptr, IntPtrTy);
+
+        Value *PtrOffset = B.CreateSub(PtrAsInt, GlobalMinAsInt);
+
+        Value *BitOffset;
+        if (AlignPow2 == 0) {
+          BitOffset = PtrOffset;
+        } else {
+          // We need to check that the offset both falls within our range
+          // and is suitably aligned. We can check both properties at the
+          // same time by performing a right rotate by log2(alignment)
+          // followed by an integer comparison against the bitset size. The
+          // rotate will move the lower order bits that need to be zero into
+          // the higher order bits of the result, causing the comparison to
+          // fail if they are nonzero. The rotate also conveniently gives
+          // us a bit offset to use during the load from the bitset.
+          Value *OffsetSHR =
+              B.CreateLShr(PtrOffset, ConstantInt::get(IntPtrTy, AlignPow2));
+          Value *OffsetSHL = B.CreateShl(
+              PtrOffset,
+              ConstantInt::get(IntPtrTy,
+                               DL->getPointerSizeInBits(0) - AlignPow2));
+          BitOffset = B.CreateOr(OffsetSHR, OffsetSHL);
+        }
+
+        Value *OffsetInRange = B.CreateICmpULT(BitOffset, BitSizeConst);
+
+        TerminatorInst *Term =
+            SplitBlockAndInsertIfThen(OffsetInRange, CI, false);
+        IRBuilder<> ThenB(Term);
+
+        // Now that we know that the offset is in range and aligned, load
+        // the appropriate bit from the bitset. TODO: We might want to use the
+        // bt instruction with the previously computed bit offset; LLVM does
+        // not currently expose this instruction.
+        Value *BitSetGlobalOffset = ThenB.CreateLShr(
+            PtrOffset, ConstantInt::get(IntPtrTy, AlignPow2 + 3));
+        Value *Idxs[] = {ConstantInt::get(Int32Ty, 0), BitSetGlobalOffset};
+        Value *BitSetGlobalAddr = ThenB.CreateGEP(BitSetGlobal, Idxs);
+        Value *BitSetGlobalVal = ThenB.CreateLoad(BitSetGlobalAddr);
+
+        Value *BitSetShift = ThenB.CreateTrunc(BitOffset, Int8Ty);
+        BitSetShift = ThenB.CreateAnd(BitSetShift, ConstantInt::get(Int8Ty, 7));
+
+        Value *Bit = ThenB.CreateLShr(BitSetGlobalVal, BitSetShift);
+        Bit = ThenB.CreateTrunc(Bit, Int1Ty);
+
+        // The value we want is 0 if we came directly from the initial block
+        // (having failed the range or alignment checks), or the loaded bit if
+        // we came from the block in which we loaded it.
+        B.SetInsertPoint(CI);
+        PHINode *P = B.CreatePHI(Int1Ty, 2);
+        P->addIncoming(ConstantInt::get(Int1Ty, 0), InitialBB);
+        P->addIncoming(Bit, ThenB.GetInsertBlock());
+
+        CI->replaceAllUsesWith(P);
+        CI->eraseFromParent();
+      }
+    }
+
+    // Build aliases pointing to offsets into the combined global for each
+    // global from which we built the combined global, and replace references
+    // to the original globals with references to the aliases.
+    for (unsigned I = 0; I != Globals.size(); ++I) {
+      Constant *NewGlobalIdxs[] = {ConstantInt::get(Int32Ty, 0),
+                                   ConstantInt::get(Int32Ty, I)};
+      Constant *NewGlobalElemPtr =
+          ConstantExpr::getGetElementPtr(NewGlobal, NewGlobalIdxs);
+      GlobalAlias *GAlias = GlobalAlias::create(
+          Globals[I]->getType()->getElementType(),
+          Globals[I]->getType()->getAddressSpace(), Globals[I]->getLinkage(),
+          "", NewGlobalElemPtr, &M);
+      GAlias->takeName(Globals[I]);
+      Globals[I]->replaceAllUsesWith(GAlias);
+      Globals[I]->eraseFromParent();
+    }
+  }
+
+  return true;
+}
+
+bool LowerBitSets::eraseBitSetMetadata(Module &M) {
+  NamedMDNode *MD = M.getNamedMetadata("llvm.bitsets");
+  if (!MD)
+    return false;
+
+  M.eraseNamedMetadata(MD);
+  return true;
+}
+
+bool LowerBitSets::runOnModule(Module &M) {
+  const DataLayout *DL = M.getDataLayout();
+  if (!DL)
+    return false;
+
+  bool Changed = buildBitSets(M, DL);
+  Changed |= eraseBitSetMetadata(M);
+  return Changed;
+}

lib/Transforms/IPO/PassManagerBuilder.cpp

void PassManagerBuilder::addLTOOptimizationPasses(PassManagerBase &PM) {
 
   // Now that we have optimized the program, discard unreachable functions.
   PM.add(createGlobalDCEPass());
 
   // FIXME: this is profitable (for compiler time) to do at -O0 too, but
   // currently it damages debug info.
   if (MergeFunctions)
     PM.add(createMergeFunctionsPass());
+
+  // Lower bitset constants to bitsets.
+  PM.add(createLowerBitSetsPass());
 }
 
 void PassManagerBuilder::populateLTOPassManager(PassManagerBase &PM) {
   if (LibraryInfo)
     PM.add(new TargetLibraryInfoWrapperPass(*LibraryInfo));
 
   if (VerifyInput)
     PM.add(createVerifierPass());

test/Transforms/LowerBitSets/simple.ll

+; RUN: opt -S -lowerbitsets < %s | FileCheck %s
+; RUN: opt -S -O3 < %s | FileCheck -check-prefix=CHECK-NODISCARD %s
+
+target datalayout = "e-p:32:32"
+
+; CHECK: [[G:@[^ ]*]] = private constant { i32, i32, i32, [2 x i32] } { i32 1, i32 2, i32 3, [2 x i32] [i32 4, i32 5] }
+@a = constant i32 1
+@b = constant i32 2
+@c = constant i32 3
+@d = constant [2 x i32] [i32 4, i32 5]
+
+; Offset 0, 4 byte alignment
+; CHECK: @bitset1.bits = private constant [1 x i8] c"\13"
+!0 = !{!"bitset1", i32* @a, i32 0}
+; CHECK-NODISCARD-DAG: !{!"bitset1", i32* @a, i32 0}
+!1 = !{!"bitset1", i32* @b, i32 0}
+; CHECK-NODISCARD-DAG: !{!"bitset1", i32* @b, i32 0}
+!2 = !{!"bitset1", [2 x i32]* @d, i32 4}
+; CHECK-NODISCARD-DAG: !{!"bitset1", [2 x i32]* @d, i32 4}
+
+; Offset 4, 4 byte alignment
+; CHECK: @bitset2.bits = private constant [1 x i8] c"\03"
+!3 = !{!"bitset2", i32* @b, i32 0}
+; CHECK-NODISCARD-DAG: !{!"bitset2", i32* @b, i32 0}
+!4 = !{!"bitset2", i32* @c, i32 0}
+; CHECK-NODISCARD-DAG: !{!"bitset2", i32* @c, i32 0}
+
+; Offset 0, 8 byte alignment
+; CHECK: @bitset3.bits = private constant [1 x i8] c"\03"
+!5 = !{!"bitset3", i32* @a, i32 0}
+; CHECK-NODISCARD-DAG: !{!"bitset3", i32* @a, i32 0}
+!6 = !{!"bitset3", i32* @c, i32 0}
+; CHECK-NODISCARD-DAG: !{!"bitset3", i32* @c, i32 0}
+
+; Entries whose second operand is null (the result of a global being DCE'd)
+; should be ignored.
+!7 = !{!"bitset2", null, i32 0}
+
+!llvm.bitsets = !{ !0, !1, !2, !3, !4, !5, !6, !7 }
+
+; CHECK: @a = alias getelementptr inbounds ({ i32, i32, i32, [2 x i32] }* [[G]], i32 0, i32 0)
+; CHECK: @b = alias getelementptr inbounds ({ i32, i32, i32, [2 x i32] }* [[G]], i32 0, i32 1)
+; CHECK: @c = alias getelementptr inbounds ({ i32, i32, i32, [2 x i32] }* [[G]], i32 0, i32 2)
+; CHECK: @d = alias getelementptr inbounds ({ i32, i32, i32, [2 x i32] }* [[G]], i32 0, i32 3)
+
+declare i1 @llvm.bitset.test(i8* %ptr, metadata %bitset) nounwind readnone
+
+; CHECK: @foo(i32* [[A0:%[^ ]*]])
+define i1 @foo(i32* %p) {
+  ; CHECK-NOT: llvm.bitset.test
+
+  ; CHECK: [[R0:%[^ ]*]] = bitcast i32* [[A0]] to i8*
+  %pi8 = bitcast i32* %p to i8*
+  ; CHECK: [[R1:%[^ ]*]] = ptrtoint i8* [[R0]] to i32
+  ; CHECK: [[R2:%[^ ]*]] = sub i32 [[R1]], ptrtoint ({ i32, i32, i32, [2 x i32] }* [[G]] to i32)
+  ; CHECK: [[R3:%[^ ]*]] = lshr i32 [[R2]], 2
+  ; CHECK: [[R4:%[^ ]*]] = shl i32 [[R2]], 30
+  ; CHECK: [[R5:%[^ ]*]] = or i32 [[R3]], [[R4]]
+  ; CHECK: [[R6:%[^ ]*]] = icmp ult i32 [[R5]], 5
+  ; CHECK: br i1 [[R6]]
+
+  ; CHECK: [[R8:%[^ ]*]] = lshr i32 [[R2]], 5
+  ; CHECK: [[R9:%[^ ]*]] = getelementptr [1 x i8]* @bitset1.bits, i32 0, i32 [[R8]]
+  ; CHECK: [[R10:%[^ ]*]] = load i8* [[R9]]
+  ; CHECK: [[R11:%[^ ]*]] = trunc i32 [[R5]] to i8
+  ; CHECK: [[R12:%[^ ]*]] = and i8 [[R11]], 7
+  ; CHECK: [[R13:%[^ ]*]] = lshr i8 [[R10]], [[R12]]
+  ; CHECK: [[R14:%[^ ]*]] = trunc i8 [[R13]] to i1
+
+  ; CHECK: [[R16:%[^ ]*]] = phi i1 [ false, {{%[^ ]*}} ], [ [[R14]], {{%[^ ]*}} ]
+  %x = call i1 @llvm.bitset.test(i8* %pi8, metadata !"bitset1")
+
+  ; CHECK-NOT: llvm.bitset.test
+  %y = call i1 @llvm.bitset.test(i8* %pi8, metadata !"bitset1")
+
+  ; CHECK: ret i1 [[R16]]
+  ret i1 %x
+}
+
+; CHECK: @bar(i32* [[B0:%[^ ]*]])
+define i1 @bar(i32* %p) {
+  ; CHECK: [[S0:%[^ ]*]] = bitcast i32* [[B0]] to i8*
+  %pi8 = bitcast i32* %p to i8*
+  ; CHECK: [[S1:%[^ ]*]] = ptrtoint i8* [[S0]] to i32
+  ; CHECK: [[S2:%[^ ]*]] = sub i32 [[S1]], add (i32 ptrtoint ({ i32, i32, i32, [2 x i32] }* [[G]] to i32), i32 4)
+  ; CHECK: [[S3:%[^ ]*]] = lshr i32 [[S2]], 2
+  ; CHECK: [[S4:%[^ ]*]] = shl i32 [[S2]], 30
+  ; CHECK: [[S5:%[^ ]*]] = or i32 [[S3]], [[S4]]
+  ; CHECK: [[S6:%[^ ]*]] = icmp ult i32 [[S5]], 2
+  ; CHECK: br i1 [[S6]]
+
+  ; CHECK: [[S8:%[^ ]*]] = lshr i32 [[S2]], 5
+  ; CHECK: [[S9:%[^ ]*]] = getelementptr [1 x i8]* @bitset2.bits, i32 0, i32 [[S8]]
+  ; CHECK: [[S10:%[^ ]*]] = load i8* [[S9]]
+  ; CHECK: [[S11:%[^ ]*]] = trunc i32 [[S5]] to i8
+  ; CHECK: [[S12:%[^ ]*]] = and i8 [[S11]], 7
+  ; CHECK: [[S13:%[^ ]*]] = lshr i8 [[S10]], [[S12]]
+  ; CHECK: [[S14:%[^ ]*]] = trunc i8 [[S13]] to i1
+
+  ; CHECK: [[S16:%[^ ]*]] = phi i1 [ false, {{%[^ ]*}} ], [ [[S14]], {{%[^ ]*}} ]
+  %x = call i1 @llvm.bitset.test(i8* %pi8, metadata !"bitset2")
+  ; CHECK: ret i1 [[S16]]
+  ret i1 %x
+}
+
+; CHECK: @baz(i32* [[C0:%[^ ]*]])
+define i1 @baz(i32* %p) {
+  ; CHECK: [[T0:%[^ ]*]] = bitcast i32* [[C0]] to i8*
+  %pi8 = bitcast i32* %p to i8*
+  ; CHECK: [[T1:%[^ ]*]] = ptrtoint i8* [[T0]] to i32
+  ; CHECK: [[T2:%[^ ]*]] = sub i32 [[T1]], ptrtoint ({ i32, i32, i32, [2 x i32] }* [[G]] to i32)
+  ; CHECK: [[T3:%[^ ]*]] = lshr i32 [[T2]], 3
+  ; CHECK: [[T4:%[^ ]*]] = shl i32 [[T2]], 29
+  ; CHECK: [[T5:%[^ ]*]] = or i32 [[T3]], [[T4]]
+  ; CHECK: [[T6:%[^ ]*]] = icmp ult i32 [[T5]], 2
+  ; CHECK: br i1 [[T6]]
+
+  ; CHECK: [[T8:%[^ ]*]] = lshr i32 [[T2]], 6
+  ; CHECK: [[T9:%[^ ]*]] = getelementptr [1 x i8]* @bitset3.bits, i32 0, i32 [[T8]]
+  ; CHECK: [[T10:%[^ ]*]] = load i8* [[T9]]
+  ; CHECK: [[T11:%[^ ]*]] = trunc i32 [[T5]] to i8
+  ; CHECK: [[T12:%[^ ]*]] = and i8 [[T11]], 7
+  ; CHECK: [[T13:%[^ ]*]] = lshr i8 [[T10]], [[T12]]
+  ; CHECK: [[T14:%[^ ]*]] = trunc i8 [[T13]] to i1
+
+  ; CHECK: [[T16:%[^ ]*]] = phi i1 [ false, {{%[^ ]*}} ], [ [[T14]], {{%[^ ]*}} ]
+  %x = call i1 @llvm.bitset.test(i8* %pi8, metadata !"bitset3")
+  ; CHECK: ret i1 [[T16]]
+  ret i1 %x
+}
+
+; CHECK-NOT: !llvm.bitsets