[SimplifyLibCalls] Simplify __strlen_chk

[george.burgess.iv]

Summary

Bionic has had __strlen_chk for quite a while; its goal is to catch overflows of unterminated strings.

This CL allows LLVM to optimize that to strlen where appropriate.

[jdoerfert]

llvm/lib/Transforms/Utils/SimplifyLibCalls.cpp

3099

I don't understand this change. Why is this necessary, e.g., why is __strlen_chk different from functions we optimize already?

[george.burgess.iv]

llvm/lib/Transforms/Utils/SimplifyLibCalls.cpp

3099

Yeah, this is a bit subtle. :/

In general, it looks like LibCallSimplifier depends on Use information being complete in quite a few places. If we don't RAUW here, SimplifiedCI will incorrectly be considered to have no users.

This patch cares because __strlen_chk may return a newly-added call @strlen(). optimizeStringMemoryLibCall checks to see if all Users of strlen(s) just compare its result to 0. If so, strlen(s) gets converted into *s. This optimization fires unconditionally for instructions with no Users.

[jdoerfert]

LGTM.

llvm/lib/Transforms/Utils/SimplifyLibCalls.cpp

3099

I see (, I think). Thanks.

[george.burgess.iv]

Thanks for the review!

llvm/include/llvm/Analysis/TargetLibraryInfo.def

 /// size_t __strlcat_chk(char *dst, const char *src, size_t size,
 ///                      size_t dstsize);
 TLI_DEFINE_ENUM_INTERNAL(strlcat_chk)
 TLI_DEFINE_STRING_INTERNAL("__strlcat_chk")
 /// size_t __strlcpy_chk(char *dst, const char *src, size_t size,
 ///                      size_t dstsize);
 TLI_DEFINE_ENUM_INTERNAL(strlcpy_chk)
 TLI_DEFINE_STRING_INTERNAL("__strlcpy_chk")
+/// char *__strlen_chk(const char *s1, size_t s1size);
+TLI_DEFINE_ENUM_INTERNAL(strlen_chk)
+TLI_DEFINE_STRING_INTERNAL("__strlen_chk")
 /// char *strncat_chk(char *s1, const char *s2, size_t n, size_t s1size);
 TLI_DEFINE_ENUM_INTERNAL(strncat_chk)
 TLI_DEFINE_STRING_INTERNAL("__strncat_chk")
 /// char *__strncpy_chk(char *s1, const char *s2, size_t n, size_t s1size);
 TLI_DEFINE_ENUM_INTERNAL(strncpy_chk)
 TLI_DEFINE_STRING_INTERNAL("__strncpy_chk")
 /// char *__strndup(const char *s, size_t n);
 TLI_DEFINE_ENUM_INTERNAL(dunder_strndup)

llvm/include/llvm/Transforms/Utils/SimplifyLibCalls.h

 private:
   Value *optimizeMemCpyChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeMemMoveChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeMemSetChk(CallInst *CI, IRBuilder<> &B);
 
   /// Str/Stp cpy are similar enough to be handled in the same functions.
   Value *optimizeStrpCpyChk(CallInst *CI, IRBuilder<> &B, LibFunc Func);
   Value *optimizeStrpNCpyChk(CallInst *CI, IRBuilder<> &B, LibFunc Func);
+  Value *optimizeStrLenChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeMemCCpyChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeSNPrintfChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeSPrintfChk(CallInst *CI,IRBuilder<> &B);
   Value *optimizeStrCatChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrLCat(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrNCatChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeStrLCpyChk(CallInst *CI, IRBuilder<> &B);
   Value *optimizeVSNPrintfChk(CallInst *CI, IRBuilder<> &B);

llvm/lib/Analysis/TargetLibraryInfo.cpp

return (NumParams == 2 && FTy.getParamType(0)->isPointerTy() &&
             FTy.getReturnType()->isIntegerTy(32));
   case LibFunc_execvP:
   case LibFunc_execvpe:
   case LibFunc_execve:
     return (NumParams == 3 && FTy.getParamType(0)->isPointerTy() &&
             FTy.getParamType(1)->isPointerTy() &&
             FTy.getParamType(2)->isPointerTy() &&
             FTy.getReturnType()->isIntegerTy(32));
+  case LibFunc_strlen_chk:
+    --NumParams;
+    if (!IsSizeTTy(FTy.getParamType(NumParams)))
+      return false;
+    LLVM_FALLTHROUGH;
   case LibFunc_strlen:
     return (NumParams == 1 && FTy.getParamType(0)->isPointerTy() &&
             FTy.getReturnType()->isIntegerTy());
 
   case LibFunc_strchr:
   case LibFunc_strrchr:
     return (NumParams == 2 && FTy.getReturnType()->isPointerTy() &&
             FTy.getParamType(0) == FTy.getReturnType() &&

llvm/lib/Transforms/Utils/SimplifyLibCalls.cpp

if (IntrinsicInst *II = dyn_cast<IntrinsicInst>(CI)) {
     }
   }
 
   // Also try to simplify calls to fortified library functions.
   if (Value *SimplifiedFortifiedCI = FortifiedSimplifier.optimizeCall(CI)) {
     // Try to further simplify the result.
     CallInst *SimplifiedCI = dyn_cast<CallInst>(SimplifiedFortifiedCI);
     if (SimplifiedCI && SimplifiedCI->getCalledFunction()) {
+      // Ensure that SimplifiedCI's uses are complete, since some calls have
+      // their uses analyzed.
+      replaceAllUsesWith(CI, SimplifiedCI);
+
       // Use an IR Builder from SimplifiedCI if available instead of CI
       // to guarantee we reach all uses we might replace later on.
       IRBuilder<> TmpBuilder(SimplifiedCI);
       if (Value *V = optimizeStringMemoryLibCall(SimplifiedCI, TmpBuilder)) {
         // If we were able to further simplify, remove the now redundant call.
         substituteInParent(SimplifiedCI, V);
         return V;
       }
Value *FortifiedLibCallSimplifier::optimizeStrpCpyChk(CallInst *CI,
   Value *Ret = emitMemCpyChk(Dst, Src, LenV, ObjSize, B, DL, TLI);
   // If the function was an __stpcpy_chk, and we were able to fold it into
   // a __memcpy_chk, we still need to return the correct end pointer.
   if (Ret && Func == LibFunc_stpcpy_chk)
     return B.CreateGEP(B.getInt8Ty(), Dst, ConstantInt::get(SizeTTy, Len - 1));
   return Ret;
 }
 
+Value *FortifiedLibCallSimplifier::optimizeStrLenChk(CallInst *CI,
+                                                     IRBuilder<> &B) {
+  if (isFortifiedCallFoldable(CI, 1, None, 0))
+    return emitStrLen(CI->getArgOperand(0), B, CI->getModule()->getDataLayout(),
+                      TLI);
+  return nullptr;
+}
+
 Value *FortifiedLibCallSimplifier::optimizeStrpNCpyChk(CallInst *CI,
                                                        IRBuilder<> &B,
                                                        LibFunc Func) {
   if (isFortifiedCallFoldable(CI, 3, 2)) {
     if (Func == LibFunc_strncpy_chk)
       return emitStrNCpy(CI->getArgOperand(0), CI->getArgOperand(1),
                                CI->getArgOperand(2), B, TLI);
     else
case LibFunc_memcpy_chk:
     return optimizeMemCpyChk(CI, Builder);
   case LibFunc_memmove_chk:
     return optimizeMemMoveChk(CI, Builder);
   case LibFunc_memset_chk:
     return optimizeMemSetChk(CI, Builder);
   case LibFunc_stpcpy_chk:
   case LibFunc_strcpy_chk:
     return optimizeStrpCpyChk(CI, Builder, Func);
+  case LibFunc_strlen_chk:
+    return optimizeStrLenChk(CI, Builder);
   case LibFunc_stpncpy_chk:
   case LibFunc_strncpy_chk:
     return optimizeStrpNCpyChk(CI, Builder, Func);
   case LibFunc_memccpy_chk:
     return optimizeMemCCpyChk(CI, Builder);
   case LibFunc_snprintf_chk:
     return optimizeSNPrintfChk(CI, Builder);
   case LibFunc_sprintf_chk:

llvm/test/Transforms/InstCombine/strlen_chk.ll

+; Test that __strlen_chk simplification works correctly.
+;
+; RUN: opt < %s -instcombine -S | FileCheck %s
+
+target datalayout = "e-p:32:32:32-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-f32:32:32-f64:32:64-v64:64:64-v128:128:128-a0:0:64-f80:128:128"
+
+@hello = constant [6 x i8] c"hello\00"
+@hello_no_nul = constant [5 x i8] c"hello"
+
+declare i32 @__strlen_chk(i8*, i32)
+
+; Check __strlen_chk(string constant) -> strlen or constants
+
+; CHECK-LABEL: @unknown_str_known_object_size
+define i32 @unknown_str_known_object_size(i8* %c) {
+  ; CHECK: call i32 @__strlen_chk
+  %1 = call i32 @__strlen_chk(i8* %c, i32 8)
+  ret i32 %1
+}
+
+; CHECK-LABEL: @known_str_known_object_size
+define i32 @known_str_known_object_size(i8* %c) {
+  ; CHECK: ret i32 5
+  %1 = call i32 @__strlen_chk(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @hello, i32 0, i32 0), i32 6)
+  ret i32 %1
+}
+
+; CHECK-LABEL: @known_str_too_small_object_size
+define i32 @known_str_too_small_object_size(i8* %c) {
+  ; CHECK: call i32 @__strlen_chk
+  %1 = call i32 @__strlen_chk(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @hello, i32 0, i32 0), i32 5)
+  ret i32 %1
+}
+
+; CHECK-LABEL: @known_str_no_nul
+define i32 @known_str_no_nul(i8* %c) {
+  ; CHECK: call i32 @__strlen_chk
+  %1 = call i32 @__strlen_chk(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @hello_no_nul, i32 0, i32 0), i32 5)
+  ret i32 %1
+}
+
+; CHECK-LABEL: @unknown_str_unknown_object_size
+define i32 @unknown_str_unknown_object_size(i8* %c) {
+  ; CHECK: call i32 @strlen
+  %1 = call i32 @__strlen_chk(i8* %c, i32 -1)
+  ret i32 %1
+}

llvm/unittests/Analysis/TargetLibraryInfoTest.cpp

parseAssembly(
       "declare i8* @__stpncpy_chk(i8*, i8*, i64, i64)\n"
       "declare i8* @__strcpy_chk(i8*, i8*, i64)\n"
       "declare i8* @__strncpy_chk(i8*, i8*, i64, i64)\n"
       "declare i8* @__memccpy_chk(i8*, i8*, i32, i64)\n"
       "declare i32 @__snprintf_chk(i8*, i64, i32, i64, i8*, ...)\n"
       "declare i32 @__sprintf_chk(i8*, i32, i64, i8*, ...)\n"
       "declare i8* @__strcat_chk(i8*, i8*, i64)\n"
       "declare i64 @__strlcat_chk(i8*, i8*, i64, i64)\n"
+      "declare i64 @__strlen_chk(i8*, i64)\n"
       "declare i8* @__strncat_chk(i8*, i8*, i64, i64)\n"
       "declare i64 @__strlcpy_chk(i8*, i8*, i64, i64)\n"
       "declare i32 @__vsnprintf_chk(i8*, i64, i32, i64, i8*, %struct*)\n"
       "declare i32 @__vsprintf_chk(i8*, i32, i64, i8*, %struct*)\n"
 
       "declare i8* @memalign(i64, i64)\n"
       "declare i8* @mempcpy(i8*, i8*, i64)\n"
       "declare i8* @memrchr(i8*, i32, i64)\n"