[lld:elf] Weaken the requirement for a computed binding to be STB_LOCAL

[lanza]

Summary

Given the following scenario:

// Cat.cpp
struct Animal { virtual void makeNoise() const = 0; };
struct Cat : Animal { void makeNoise() const override; };

extern "C" int puts(char const *);
void Cat::makeNoise() const { puts("Meow"); }
void doThingWithCat(Animal *a) { static_cast<Cat *>(a)->makeNoise(); }

// CatUser.cpp
struct Animal { virtual void makeNoise() const = 0; };
struct Cat : Animal { void makeNoise() const override; };

void doThingWithCat(Animal *a);

void useDoThingWithCat() {
  Cat *d = new Cat;
  doThingWithCat(d);
}

// cat.ver
{
  global: _Z17useDoThingWithCatv;
  local: *;
};

$ clang++ Cat.cpp CatUser.cpp -fpic -flto=thin -fwhole-program-vtables -shared -O3 -fuse-ld=lld -Wl,--lto-whole-program-visibility -Wl,--version-script,cat.ver

We cannot devirtualize Cat::makeNoise. The issue is complex:

Due to -fsplit-lto-unit and usage of type metadata, we place the Cat vtable declaration into module 0 and the Cat vtable definition with type metadata into module 1, causing duplicate entries (Undefined followed by Defined) in the lto::InputFile::symbols() output.
In BitcodeFile::parse, after processing the Undefined then the Defined, the final state is Defined.
In BitcodeCompiler::add, for the first symbol, computeBinding returns STB_LOCAL, then we reset it to Undefined because it is prevailing (versionId is preserved). For the second symbol, because the state is now Undefined, computeBinding returns STB_GLOBAL, causing ExportDynamic to be true and suppressing devirtualization.

In D77280, the computeBinding change used a stricter isDefined() condition to make weak`Lazy symbol work.
This patch relaxes the condition to weaker !isLazy() to keep it working while making the devirtualization work as well.

[smeenai]

The summary says !isLocal but the code says !isLazy. I'm assuming the code is correct.

Can you add a test case?

[lanza]

The summary says !isLocal but the code says !isLazy. I'm assuming the code is correct.

Correct, typo.

Can you add a test case?

Yea of course, just want Fangrui's feedback before I finish minimizing my larger c++ test case.

[smeenai]

Sounds good. I'll let Fangrui take a look then :)

[MaskRay]

b.cpp being part of the link causes the vtbl for _ZTV3Cat to be STB_GLOBAL since it's external.

Can you elaborate what happens? b.o has only one symbol _Z14doThingWithCatP3Cat. There is no vtable symbol...

Only canBeVersioned symbols can have a versionId value not equal to VER_NDX_GLOBAL. How does the isDefined() -> !isLazy() change affect behaviors?

The isDefined() requirement is to make version-script-weak.s work: a STB_WEAK lazy symbol, if not fetched, should be treated similar to an undefined weak symbol. An undefined symbol should not have non-VER_NDX_GLOBAL versionId values.

[lanza]

The isDefined() requirement is to make version-script-weak.s work: a STB_WEAK lazy symbol, if not fetched, should be treated similar to an undefined weak symbol. An undefined symbol should not have non-VER_NDX_GLOBAL versionId values.

Can you elaborate what happens? b.o has only one symbol _Z14doThingWithCatP3Cat. There is no vtable symbol...

Yup, sorry, my minimized case was too minimized. Here's one that performs devirtualization with my change present and does not without it.

a.cpp

struct Animal {
  virtual void makeNoise() const = 0;
};

struct Cat : public Animal {
  void makeNoise() const override;
};

extern "C" int puts(char const *);

void Cat::makeNoise() const { puts("Meow"); }

void doThingWithCat(Animal *a) {
  if (auto d = reinterpret_cast<Cat *>(a))
    d->makeNoise();
}

`b.cpp

struct Animal {
  virtual void makeNoise() const = 0;
};

struct Cat : public Animal {
  void makeNoise() const override;
};

void doThingWithCat(Animal *a);

void useDoThingWithCat() {
  Cat *d = new Cat;
  doThingWithCat(d);
}

version.exp

{
  global:
    _Z17useDoThingWithCatv;
  local:
  *;
};

clang++-13 invocation

clang++ Cat.cpp CatUser.cpp -o libA.so -shared -std=c++20 -O3 -fuse-ld=lld \
                      -fwhole-program-vtables -flto=thin \
                      -Wl,--lto-whole-program-visibility \
                      -Wl,--version-script,version.exp \
                      -Wl,--opt-remarks-format,yaml -Wl,--opt-remarks-filename,libA.yaml -fpic

_ZTV3Cat occurs 4 times here -- twice for each file due to split LTO. Two instances have isDefined() == true and two have isDefined() == false. My change instead tests !isLazy() which they are both non-lazy.

Only canBeVersioned symbols can have a versionId value not equal to VER_NDX_GLOBAL. How does the isDefine) -> !isLazy() change affect behaviors?

I'm guessing that since the symbol is seen and defined during the initial symbol collection from Cat.cpp.o that the vtbl is isDefined() by the time the parsing of the version-script happens. Thus the version is marked as local but it is marked as UndefinedKind.

[MaskRay]

In D98686#2630618, @lanza wrote:

clang++-13 invocation

clang++ Cat.cpp CatUser.cpp -o libA.so -shared -std=c++20 -O3 -fuse-ld=lld \
                      -fwhole-program-vtables -flto=thin \
                      -Wl,--lto-whole-program-visibility \
                      -Wl,--version-script,version.exp \
                      -Wl,--opt-remarks-format,yaml -Wl,--opt-remarks-filename,libA.yaml -fpic

_ZTV3Cat occurs 4 times here -- twice for each file due to split LTO. Two instances have isDefined() == true and two have isDefined() == false. My change instead tests !isLazy() which they are both non-lazy.

I see what you mean. With the change (the Cat vtable is now local) devirtualization can happen.

% fld.lld @response.txt -mllvm -pass-remarks=. --opt-remarks-format yaml --opt-remarks-filename xx.yaml
<unknown>:0:0: single-impl: devirtualized a call to _ZNK3Cat9makeNoiseEv
<unknown>:0:0: single-impl: devirtualized a call to _ZNK3Cat9makeNoiseEv
<unknown>:0:0: _ZNK3Cat9makeNoiseEv inlined into _Z14doThingWithCatP6Animal with (cost=0, threshold=375)
<unknown>:0:0: _ZNK3Cat9makeNoiseEv inlined into _Z14doThingWithCatP6Animal with (cost=0, threshold=375)
<unknown>:0:0: _Z14doThingWithCatP6Animal inlined into _Z17useDoThingWithCatv with (cost=0, threshold=375)

The problem is due to duplicate entries in the IR symbol table in -fsplit-lto-unit mode (default if -flto={thin,full} -fwhole-program-vtables)

I did notice that the IR symbol table can have duplicate entries in other cases (llvm-nm/lld will notice the issue; llvm-lto2 dump-symtab merges duplicate entries).
For example, with module level inline asm, the undefined symbols are placed in the end.
If a referenced symbol is defined in the IR, you may notice two entries.
It would not matter if IR symbol table can make sure defined symbols are always ordered before undefined ones. (That is still brittle.)

In this case, before the undefine symbol precedes the define one. The duplication is more harmful.

% fllvm-nm a.o
---------------- T _Z14doThingWithCatP6Animal
---------------- T _ZNK3Cat9makeNoiseEv
                 U _ZNK3Cat9makeNoiseEv
---------------- D _ZTI3Cat
                 U _ZTI3Cat  ## duplicate, but benign because defined precedes undefined
---------------- W _ZTI6Animal
---------------- D _ZTS3Cat
---------------- W _ZTS6Animal
                 U _ZTV3Cat
---------------- D _ZTV3Cat  ## duplicate and harmful, because undefined precedes defined
                 U _ZTVN10__cxxabiv117__class_type_infoE
                 U _ZTVN10__cxxabiv120__si_class_type_infoE
                 U puts

So I think this patch is a workaround. I will take a look at the IR symbol table issue.

Only canBeVersioned symbols can have a versionId value not equal to VER_NDX_GLOBAL. How does the isDefine) -> !isLazy() change affect behaviors?

I'm guessing that since the symbol is seen and defined during the initial symbol collection from Cat.cpp.o that the vtbl is isDefined() by the time the parsing of the version-script happens. Thus the version is marked as local but it is marked as UndefinedKind.

The issue here is due to IR symbol table's problem. If it is fixed, then we should have this invariant: between consecutive computeBinding calls on a symbol, a Defined cannot downgrade to others.

The only place where we change a Defined to an Undefined is in LTO.cpp when the symbol is prevailing, however, the Undefined will become Defined again when LTO has generated object files. computeBinding is not called in between.

[MaskRay]

OK, I think IR symbol table probably should not be fixed. isDefined -> !isLazy on lld side looks fine to me.

llvm::lto::InputFile::symbols() may return duplicate symbols because

(1) A symbol may appear in multiple modules in a regular LTO bitcode file (llvm-cat a.bc b.bc).
(2) Global values and assembly symbols are concatenated (ModuleSymbolTable::addModule) without deduplication.
(3) Due to -fsplit-lto-unit -flto={thin,full}, a symbol may appear as an undefined in module 0 and as an defined in module 1 (e.g. a vtable symbol with the !type metadata).

LTO::addRegularLTO and lto::InputFile::create need to be synchronized on the symbol table. The symbols from multiple modules are concatenated.
While I thought deduplicating the symbol table for (2) and (3) would be nice, (1) and (2) and the current symbol table representation make deduplication inconvenient.
In addition, the current symbol resolution communication from various customers (different ports of lld and LLVMgold.so) to lib/LTO can work around duplicate symbol table entries easily (the r.Prevailing = line, its comment is a bit outdated though).
(@tejohnson )

So I think we should just live with duplicate symbols and don't bother fix (2) and (3), at least before something more clumsy is known.
For -fwhole-program-vtables, (1) and (2) are special cases. (3) is a practical usage (-shared + local: version node in a version-script) and we should optimize it if we can.
And we can indeed optimize it with such a one-line change:)

You need to add the Cat/CatUser test as a new file (named devirt_vcall*.ll).

[lanza]

Add test case

[lanza]

Yea, I figured that this was likely a fragile ordering issue. I was thinking about an approach but didn't know enough about lld outside of the standard LTO code path, thus figured I should ask here first. Thanks for the feedback!

[MaskRay]

I'd completely rewrite the description. Consider this:

// Cat.cpp
struct Animal { virtual void makeNoise() const = 0; };
struct Cat : Animal { void makeNoise() const override; };

extern "C" int puts(char const *);
void Cat::makeNoise() const { puts("Meow"); }
void doThingWithCat(Animal *a) { static_cast<Cat *>(a)->makeNoise(); }

// CatUser.cpp
struct Animal { virtual void makeNoise() const = 0; };
struct Cat : Animal { void makeNoise() const override; };

void doThingWithCat(Animal *a);

void useDoThingWithCat() {
  Cat *d = new Cat;
  doThingWithCat(d);
}
// cat.ver
{
  global: _Z17useDoThingWithCatv;
  local: *;
};

clang++ Cat.cpp CatUser.cpp -fpic -flto=thin -fwhole-program-vtables -shared -O3 -fuse-ld=lld -Wl,--lto-whole-program-visibility -Wl,--version-script,cat.ver

We fail to devirtualize makeNoise. The issue is complex:

1. Due to -fsplit-lto-unit and usage of type metadata, we place the Cat vtable declaration into module 0 and the Cat vtable definition with type metadata into module 1, causing duplicate entries (Undefined followed by Defined) in the lto::InputFile::symbols() output.
2. In BitcodeFile::parse, after processing the Undefined then the Defined, the final state is Defined.
3. In BitcodeCompiler::add, for the first symbol, computeBinding returns STB_LOCAL, then we reset it to Undefined because it is prevailing (versionId is preserved). For the second symbol, because the state is now Undefined, computeBinding returns TB_GLOBAL, causing ExportDynamic to be true and suppressing devirtualization.

In D77280, the computeBinding change used a stricter isDefined() condition to make weak Lazy symbol work.
This patch relaxes the condition to weaker !isLazy() to keep it working while making computeBinding return true for the second symbol, thus enabling devirtualization.

lld/test/ELF/lto/devirt_extern_vtable.ll

6

You can use split-file to place auxiliary files in one file. See some newer tests for example.

11

nit: | \ (the previous line instead of the continuation line)

54

Can you compile with higher optimization and remove unneeded instructions?

84

Attributes need clean-up.

89

Delete unneeded module flags and !llvm.linker.options.

[MaskRay]

lld/test/ELF/lto/devirt_extern_vtable.ll

1

devirt-local-split-unit

[lanza]

I'd completely rewrite the description. Consider this:

👍

lld/test/ELF/lto/devirt_extern_vtable.ll

1

You mean for the file name?

[MaskRay]

lld/test/ELF/lto/devirt_extern_vtable.ll

1

yes, hmm may be devirt-split-unit-localize.ll

[lanza]

Address Fangrui's comments

[lanza]

Fix check in test

[MaskRay]

Thanks!

lld/ELF/Symbols.cpp

return CHECK(c.getMemoryBufferRef(),
                "could not get the buffer for the member defining symbol " +
                    toELFString(sym));
 }
 
 uint8_t Symbol::computeBinding() const {
   if (config->relocatable)
     return binding;
   if ((visibility != STV_DEFAULT && visibility != STV_PROTECTED) ||
-      (versionId == VER_NDX_LOCAL && isDefined()))
+      (versionId == VER_NDX_LOCAL && !isLazy()))
     return STB_LOCAL;
   if (!config->gnuUnique && binding == STB_GNU_UNIQUE)
     return STB_GLOBAL;
   return binding;
 }
 
 bool Symbol::includeInDynsym() const {
   if (!config->hasDynSymTab)

lld/test/ELF/lto/Inputs/devirt_extern_vtable.ll

+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+%struct.Cat = type { %struct.Animal }
+%struct.Animal = type { i32 (...)** }
+
+$_ZN3CatC2Ev = comdat any
+
+$_ZN6AnimalC2Ev = comdat any
+
+$_ZTV6Animal = comdat any
+
+$_ZTS6Animal = comdat any
+
+$_ZTI6Animal = comdat any
+
+@_ZTV3Cat = external dso_local unnamed_addr constant { [3 x i8*] }, align 8
+@_ZTV6Animal = linkonce_odr dso_local unnamed_addr constant { [3 x i8*] } { [3 x i8*] [i8* null, i8* bitcast ({ i8*, i8* }* @_ZTI6Animal to i8*), i8* bitcast (void ()* @__cxa_pure_virtual to i8*)] }, comdat, align 8, !type !0, !type !1
+@_ZTVN10__cxxabiv117__class_type_infoE = external dso_local global i8*
+@_ZTS6Animal = linkonce_odr dso_local constant [8 x i8] c"6Animal\00", comdat, align 1
+@_ZTI6Animal = linkonce_odr dso_local constant { i8*, i8* } { i8* bitcast (i8** getelementptr inbounds (i8*, i8** @_ZTVN10__cxxabiv117__class_type_infoE, i64 2) to i8*), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @_ZTS6Animal, i32 0, i32 0) }, comdat, align 8
+
+; Function Attrs: noinline optnone uwtable mustprogress
+define dso_local void @_Z17useDoThingWithCatv() #0 {
+entry:
+  %d = alloca %struct.Cat*, align 8
+  %call = call noalias nonnull i8* @_Znwm(i64 8) #4
+  %0 = bitcast i8* %call to %struct.Cat*
+  call void @_ZN3CatC2Ev(%struct.Cat* nonnull dereferenceable(8) %0) #5
+  store %struct.Cat* %0, %struct.Cat** %d, align 8
+  %1 = load %struct.Cat*, %struct.Cat** %d, align 8
+  %2 = bitcast %struct.Cat* %1 to %struct.Animal*
+  call void @_Z14doThingWithCatP6Animal(%struct.Animal* %2)
+  ret void
+}
+
+; Function Attrs: nobuiltin allocsize(0)
+declare dso_local nonnull i8* @_Znwm(i64) #1
+
+; Function Attrs: noinline nounwind optnone uwtable
+define linkonce_odr dso_local void @_ZN3CatC2Ev(%struct.Cat* nonnull dereferenceable(8) %this) unnamed_addr #2 comdat align 2 {
+entry:
+  %this.addr = alloca %struct.Cat*, align 8
+  store %struct.Cat* %this, %struct.Cat** %this.addr, align 8
+  %this1 = load %struct.Cat*, %struct.Cat** %this.addr, align 8
+  %0 = bitcast %struct.Cat* %this1 to %struct.Animal*
+  call void @_ZN6AnimalC2Ev(%struct.Animal* nonnull dereferenceable(8) %0) #5
+  %1 = bitcast %struct.Cat* %this1 to i32 (...)***
+  store i32 (...)** bitcast (i8** getelementptr inbounds ({ [3 x i8*] }, { [3 x i8*] }* @_ZTV3Cat, i32 0, inrange i32 0, i32 2) to i32 (...)**), i32 (...)*** %1, align 8
+  ret void
+}
+
+declare dso_local void @_Z14doThingWithCatP6Animal(%struct.Animal*) #3
+
+; Function Attrs: noinline nounwind optnone uwtable
+define linkonce_odr dso_local void @_ZN6AnimalC2Ev(%struct.Animal* nonnull dereferenceable(8) %this) unnamed_addr #2 comdat align 2 {
+entry:
+  %this.addr = alloca %struct.Animal*, align 8
+  store %struct.Animal* %this, %struct.Animal** %this.addr, align 8
+  %this1 = load %struct.Animal*, %struct.Animal** %this.addr, align 8
+  %0 = bitcast %struct.Animal* %this1 to i32 (...)***
+  store i32 (...)** bitcast (i8** getelementptr inbounds ({ [3 x i8*] }, { [3 x i8*] }* @_ZTV6Animal, i32 0, inrange i32 0, i32 2) to i32 (...)**), i32 (...)*** %0, align 8
+  ret void
+}
+
+declare dso_local void @__cxa_pure_virtual() unnamed_addr
+
+attributes #0 = { noinline optnone uwtable mustprogress "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #1 = { nobuiltin allocsize(0) "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #2 = { noinline nounwind optnone uwtable "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #3 = { "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #4 = { builtin allocsize(0) }
+attributes #5 = { nounwind }
+
+!llvm.linker.options = !{}
+!llvm.module.flags = !{!2, !3}
+
+!0 = !{i64 16, !"_ZTS6Animal"}
+!1 = !{i64 16, !"_ZTSM6AnimalKFvvE.virtual"}
+!2 = !{i32 1, !"wchar_size", i32 4}
+!3 = !{i32 1, !"Virtual Function Elim", i32 0}

lld/test/ELF/lto/devirt_extern_vtable.ll

+; REQUIRES: x86
+;; Test that that a vtable defined locally in one module but external in another
+;; does not prevent devirtualization.
+
+;; Hybrid WPD
+; RUN: opt --thinlto-bc --thinlto-split-lto-unit -o %t1.o %s
+; RUN: opt --thinlto-bc --thinlto-split-lto-unit %S/Inputs/devirt_extern_vtable.ll -o %t2.o
+; RUN: echo '{ global: _Z17useDoThingWithCatv; local: *; };' > %t.ver
+
+; RUN: ld.lld %t1.o %t2.o -shared -o %t3 -save-temps --lto-whole-program-visibility \
+; RUN:   -mllvm -pass-remarks=. --version-script %t.ver 2>&1 \
+; RUN:   | FileCheck %s --check-prefix=REMARK
+
+; REMARK-DAG: <unknown>:0:0: devirtualized _ZNK3Cat9makeNoiseEv
+; REMARK-DAG: <unknown>:0:0: single-impl: devirtualized a call to _ZNK3Cat9makeNoiseEv
+
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+%struct.Cat = type { %struct.Animal }
+%struct.Animal = type { i32 (...)** }
+
+$_ZTS6Animal = comdat any
+
+$_ZTI6Animal = comdat any
+
+@.str = private unnamed_addr constant [5 x i8] c"Meow\00", align 1
+@_ZTV3Cat = dso_local unnamed_addr constant { [3 x i8*] } { [3 x i8*] [i8* null, i8* bitcast ({ i8*, i8*, i8* }* @_ZTI3Cat to i8*), i8* bitcast (void (%struct.Cat*)* @_ZNK3Cat9makeNoiseEv to i8*)] }, align 8, !type !0, !type !1, !type !2, !type !3
+@_ZTVN10__cxxabiv120__si_class_type_infoE = external dso_local global i8*
+@_ZTS3Cat = dso_local constant [5 x i8] c"3Cat\00", align 1
+@_ZTVN10__cxxabiv117__class_type_infoE = external dso_local global i8*
+@_ZTS6Animal = linkonce_odr dso_local constant [8 x i8] c"6Animal\00", comdat, align 1
+@_ZTI6Animal = linkonce_odr dso_local constant { i8*, i8* } { i8* bitcast (i8** getelementptr inbounds (i8*, i8** @_ZTVN10__cxxabiv117__class_type_infoE, i64 2) to i8*), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @_ZTS6Animal, i32 0, i32 0) }, comdat, align 8
+@_ZTI3Cat = dso_local constant { i8*, i8*, i8* } { i8* bitcast (i8** getelementptr inbounds (i8*, i8** @_ZTVN10__cxxabiv120__si_class_type_infoE, i64 2) to i8*), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @_ZTS3Cat, i32 0, i32 0), i8* bitcast ({ i8*, i8* }* @_ZTI6Animal to i8*) }, align 8
+
+; Function Attrs: noinline optnone uwtable mustprogress
+define dso_local void @_ZNK3Cat9makeNoiseEv(%struct.Cat* nonnull dereferenceable(8) %this) unnamed_addr #0 align 2 {
+entry:
+  %this.addr = alloca %struct.Cat*, align 8
+  store %struct.Cat* %this, %struct.Cat** %this.addr, align 8
+  %this1 = load %struct.Cat*, %struct.Cat** %this.addr, align 8
+  %call = call i32 @puts(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
+  ret void
+}
+
+declare dso_local i32 @puts(i8*) #1
+
+; Function Attrs: noinline optnone uwtable mustprogress
+define dso_local void @_Z14doThingWithCatP6Animal(%struct.Animal* %a) #0 {
+entry:
+  %a.addr = alloca %struct.Animal*, align 8
+  %d = alloca %struct.Cat*, align 8
+  store %struct.Animal* %a, %struct.Animal** %a.addr, align 8
+  %0 = load %struct.Animal*, %struct.Animal** %a.addr, align 8
+  %1 = bitcast %struct.Animal* %0 to %struct.Cat*
+  store %struct.Cat* %1, %struct.Cat** %d, align 8
+  %2 = load %struct.Cat*, %struct.Cat** %d, align 8
+  %tobool = icmp ne %struct.Cat* %2, null
+  br i1 %tobool, label %if.then, label %if.end
+
+if.then:                                          ; preds = %entry
+  %3 = load %struct.Cat*, %struct.Cat** %d, align 8
+  %4 = bitcast %struct.Cat* %3 to void (%struct.Cat*)***
+  %vtable = load void (%struct.Cat*)**, void (%struct.Cat*)*** %4, align 8
+  %5 = bitcast void (%struct.Cat*)** %vtable to i8*
+  %6 = call i1 @llvm.type.test(i8* %5, metadata !"_ZTS3Cat")
+  call void @llvm.assume(i1 %6)
+  %vfn = getelementptr inbounds void (%struct.Cat*)*, void (%struct.Cat*)** %vtable, i64 0
+  %7 = load void (%struct.Cat*)*, void (%struct.Cat*)** %vfn, align 8
+  call void %7(%struct.Cat* nonnull dereferenceable(8) %3)
+  br label %if.end
+
+if.end:                                           ; preds = %if.then, %entry
+  ret void
+}
+
+; Function Attrs: nofree nosync nounwind readnone willreturn
+declare i1 @llvm.type.test(i8*, metadata) #2
+
+; Function Attrs: nofree nosync nounwind willreturn
+declare void @llvm.assume(i1 noundef) #3
+
+attributes #0 = { noinline optnone uwtable mustprogress "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #1 = { "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+attributes #2 = { nofree nosync nounwind readnone willreturn }
+attributes #3 = { nofree nosync nounwind willreturn }
+
+!llvm.linker.options = !{}
+!llvm.module.flags = !{!4, !5}
+
+!0 = !{i64 16, !"_ZTS3Cat"}
+!1 = !{i64 16, !"_ZTSM3CatKFvvE.virtual"}
+!2 = !{i64 16, !"_ZTS6Animal"}
+!3 = !{i64 16, !"_ZTSM6AnimalKFvvE.virtual"}
+!4 = !{i32 1, !"wchar_size", i32 4}
+!5 = !{i32 1, !"Virtual Function Elim", i32 0}