#include "config.h"#include "system.h"#include "coretypes.h"#include "tm.h"#include "ggc.h"#include "obstack.h"#include "bitmap.h"#include "sbitmap.h"#include "flags.h"#include "basic-block.h"#include "tree.h"#include "gimple.h"#include "gimple-ssa.h"#include "cgraph.h"#include "tree-ssanames.h"#include "tree-into-ssa.h"#include "tree-dfa.h"#include "tree-inline.h"#include "diagnostic-core.h"#include "hash-table.h"#include "function.h"#include "tree-pass.h"#include "alloc-pool.h"#include "splay-tree.h"#include "params.h"#include "alias.h"#include "pointer-set.h"
Data Structures | |
| struct | constraint_stats |
| struct | variable_info |
| struct | constraint_expr |
| struct | constraint |
| struct | constraint_graph |
| struct | scc_info |
| struct | topo_info |
| struct | equiv_class_label |
| struct | equiv_class_hasher |
| struct | fieldoff |
| struct | shared_bitmap_info |
| struct | shared_bitmap_hasher |
Macros | |
| #define | EXECUTE_IF_IN_NONNULL_BITMAP(a, b, c, d) |
| #define | UNKNOWN_OFFSET HOST_WIDE_INT_MIN |
| #define | FIRST_REF_NODE (varmap).length () |
| #define | LAST_REF_NODE (FIRST_REF_NODE + (FIRST_REF_NODE - 1)) |
Typedefs | |
| typedef struct constraint_graph * | constraint_graph_t |
| typedef struct constraint * | constraint_t |
| typedef struct variable_info * | varinfo_t |
| typedef struct constraint_expr | ce_s |
| typedef struct equiv_class_label * | equiv_class_label_t |
| typedef struct equiv_class_label * | const_equiv_class_label_t |
| typedef struct fieldoff | fieldoff_s |
| typedef struct shared_bitmap_info * | shared_bitmap_info_t |
| typedef struct shared_bitmap_info * | const_shared_bitmap_info_t |
Enumerations | |
| enum | { nothing_id = 1, anything_id = 2, readonly_id = 3, escaped_id = 4, nonlocal_id = 5, storedanything_id = 6, integer_id = 7 } |
| enum | constraint_expr_type { SCALAR, DEREF, ADDRESSOF } |
| enum | { fi_clobbers = 1, fi_uses = 2, fi_static_chain = 3, fi_result = 4, fi_parm_base = 5 } |
Macro Definition Documentation
| #define EXECUTE_IF_IN_NONNULL_BITMAP | ( | a, | |
| b, | |||
| c, | |||
| d | |||
| ) |
Referenced by free_scc_info().
| #define FIRST_REF_NODE (varmap).length () |
During variable substitution and the offline version of indirect cycle finding, we create nodes to represent dereferences and address taken constraints. These represent where these start and end.
Referenced by build_succ_graph(), dump_constraints(), and merge_node_constraints().
| #define LAST_REF_NODE (FIRST_REF_NODE + (FIRST_REF_NODE - 1)) |
| #define UNKNOWN_OFFSET HOST_WIDE_INT_MIN |
Use 0x8000... as special unknown offset.
Typedef Documentation
| typedef struct constraint_expr ce_s |
| typedef struct equiv_class_label* const_equiv_class_label_t |
| typedef struct shared_bitmap_info* const_shared_bitmap_info_t |
| typedef struct constraint_graph* constraint_graph_t |
| typedef struct constraint* constraint_t |
| typedef struct equiv_class_label * equiv_class_label_t |
Structure used to for hash value numbering of pointer equivalence classes.
| typedef struct fieldoff fieldoff_s |
| typedef struct shared_bitmap_info * shared_bitmap_info_t |
Structure used to put solution bitmaps in a hashtable so they can be shared among variables with the same points-to set.
| typedef struct variable_info* varinfo_t |
Enumeration Type Documentation
| anonymous enum |
| anonymous enum |
In IPA mode there are varinfos for different aspects of reach function designator. One for the points-to set of the return value, one for the variables that are clobbered by the function, one for its uses and one for each parameter (including a single glob for remaining variadic arguments).
| enum constraint_expr_type |
Function Documentation
|
static |
Add a graph edge to GRAPH, going from FROM to TO if it doesn't exist in the graph already. Return false if the edge already existed, true otherwise.
Referenced by do_sd_constraint(), and free_topo_info().
|
static |
Add an indirect graph edge to GRAPH, going from TO to FROM if it doesn't exist in the graph already.
References add_pred_graph_edge(), DEREF, constraint::lhs, constraint_expr::offset, constraint::rhs, SCALAR, constraint_expr::type, and constraint_expr::var.
|
static |
Add a predecessor graph edge to GRAPH, going from TO to FROM if it doesn't exist in the graph already. Return false if the edge already existed, true otherwise.
References bitmap_clear_bit(), constraint_graph::direct_nodes, constraint_expr::offset, SCALAR, and constraint_expr::type.
Referenced by add_implicit_graph_edge().
|
static |
Return a printable name for DECL
References get_constraint_for_rhs().
|
static |
Associate node with varinfo DATA. Worker for cgraph_for_node_and_aliases.
|
static |
Return the position, in bits, of FIELD_DECL from the beginning of its structure.
References anything_id, constraint_expr::offset, SCALAR, constraint_expr::type, and constraint_expr::var.
|
static |
Build a fake VAR_DECL acting as referrer to a DECL_UID.
Referenced by create_function_info_for().
|
static |
Build the constraint graph, adding only predecessor edges right now.
*x = y.
x = *y
x = &y
Implicitly, *x = y
All related variables are no longer direct nodes.
x = y
Implicitly, *x = *y
|
static |
Build the constraint graph, adding successor edges.
x = &y
Add edges from STOREDANYTHING to all non-direct nodes that can receive pointers. Everything stored to ANYTHING also potentially escapes.
References BITMAP_ALLOC, bitmap_first_set_bit(), bitmap_set_bit, scc_info::dfs, EXECUTE_IF_SET_IN_BITMAP, FIRST_REF_NODE, gcc_assert, constraint_graph::indirect_cycles, NULL, scc_info::scc_stack, unify_nodes(), and unite().
|
static |
Return true if FIELDSTACK contains fields that overlap. FIELDSTACK is assumed to be sorted by offset.
|
static |
Remove edges involving NODE from GRAPH.
| unsigned int compute_may_aliases | ( | void | ) |
Compute points-to information for every SSA_NAME pointer in the current function and compute the transitive closure of escaped variables to re-initialize the call-clobber states of local variables.
But still dump what we have remaining it.
For each pointer P_i, determine the sets of variables that P_i may point-to. Compute the reachability set of escaped and call-used variables. Debugging dumps.
Deallocate memory used by aliasing data structures and the internal points-to solution.
|
static |
Create points-to sets for the current function. See the comments at the start of the file for an algorithmic overview.
Now walk all statements and build the constraint set.
From the constraints compute the points-to sets.
Compute the points-to set for ESCAPED used for call-clobber analysis.
Make sure the ESCAPED solution (which is used as placeholder in other solutions) does not reference itself. This simplifies points-to solution queries.
Mark escaped HEAP variables as global.
Compute the points-to sets for pointer SSA_NAMEs.
Compute the call-used/clobbered sets.
Escaped (and thus nonlocal) variables are always
implicitly used by calls. ??? ESCAPED can be empty even though NONLOCAL
always escaped. If there is nothing special about this call then
we have made everything that is used also escape. Escaped (and thus nonlocal) variables are always
implicitly clobbered by calls. ??? ESCAPED can be empty even though NONLOCAL
always escaped. If there is nothing special about this call then
we have made everything that is used also escape.
|
static |
Compute a topological ordering for GRAPH, and store the result in the topo_info structure TI.
|
static |
Recursive routine to find strongly connected components in GRAPH, and label it's nodes with DFS numbers.
Visit all the successors.
Visit all the implicit predecessors.
See if any components have been identified.
Unify our nodes.
|
static |
Return true if two constraints A and B are equal.
|
static |
SOLVER FUNCTIONS
The solver is a simple worklist solver, that works on the following algorithm:
sbitmap changed_nodes = all zeroes; changed_count = 0; For each node that is not already collapsed: changed_count++; set bit in changed nodes
while (changed_count > 0) { compute topological ordering for constraint graph
find and collapse cycles in the constraint graph (updating changed if necessary)
for each node (n) in the graph in topological order: changed_count–;
Process each complex constraint associated with the node, updating changed if necessary.
For each outgoing edge from n, propagate the solution from n to the destination of the edge, updating changed as necessary.
} Return true if two constraint expressions A and B are equal.
|
static |
Return true if constraint expression A is less than constraint expression B. This is just arbitrary, but consistent, in order to give them an ordering.
References bitmap_set_bit, get_varinfo(), variable_info::head, variable_info::is_artificial_var, and variable_info::is_full_var.
|
static |
Return true if constraint A is less than constraint B. This is just arbitrary, but consistent, in order to give them an ordering.
|
static |
Union two constraint vectors, TO and FROM. Put the result in TO.
|
static |
Find a constraint LOOKFOR in the sorted constraint vector VEC
|
static |
Count the number of arguments DECL has, and set IS_VARARGS to true if it is a varargs function.
Capture named arguments for K&R functions. They do not have a prototype and thus no TYPE_ARG_TYPES.
Check if the function has variadic arguments.
|
static |
Creation function node for DECL, using NAME, and return the index of the variable we've created for the function.
Create the variable info.
Create a variable for things the function clobbers and one for things the function uses.
And one for the static chain.
Create a variable for the return var.
Set up variables for each argument.
Add one representative for all further args.
We need sth that can be pointed to for va_start.
References ADDRESSOF, build_fake_var_decl(), cfun, create_variable_info_for_1(), DECL_ARGUMENTS, DECL_BY_REFERENCE, DECL_CHAIN, DECL_EXTERNAL, DECL_RESULT, get_vi_for_tree(), variable_info::id, insert_vi_for_tree(), make_constraint_from(), make_constraint_from_global_restrict(), make_copy_constraint(), variable_info::may_have_pointers, new_constraint(), constraint_expr::offset, variable_info::only_restrict_pointers, POINTER_TYPE_P, process_constraint(), SCALAR, TREE_CODE, TREE_TYPE, constraint_expr::type, type_contains_placeholder_p(), TYPE_RESTRICT, constraint_expr::var, and vi_next().
|
static |
|
static |
Create initial constraints for globals.
Mark global restrict qualified pointers.
In non-IPA mode the initializer from nonlocal is all we need.
In IPA mode parse the initializer and generate proper constraints
for it. For escaped variables initialize them from nonlocal.
If this is a global variable with an initializer and we are in
IPA mode generate constraints for it. If this is a variable that escapes from the unit
the initializer escapes as well.
|
static |
Create a varinfo structure for NAME and DECL, and add it to VARMAP. This will also create any varinfo structures necessary for fields of DECL.
Collect field information.
??? Force us to not use subfields for global initializers
in IPA mode. Else we'd have to parse arbitrary initializers. We can't sort them if we have a field with a variable sized type,
which will make notokay = true. In that case, we are going to return
without creating varinfos for the fields anyway, so sorting them is a
waste to boot. Due to some C++ FE issues, like PR 22488, we might end up
what appear to be overlapping fields even though they,
in reality, do not overlap. Until the C++ FE is fixed,
we will simply disable field-sensitivity for these cases. If we didn't end up collecting sub-variables create a full variable for the decl.
Referenced by create_function_info_for().
| void debug_constraint | ( | constraint_t | ) |
| DEBUG_FUNCTION void debug_constraint | ( | ) |
Print out constraint C to stderr.
| DEBUG_FUNCTION void debug_constraint_graph | ( | ) |
Print out the constraint graph to stderr.
| DEBUG_FUNCTION void debug_constraints | ( | ) |
Print out all constraints to stderr.
| DEBUG_FUNCTION void debug_sa_points_to_info | ( | ) |
Debug points-to information to stderr.
References dump_alias_info(), and dump_file.
| void debug_solution_for_var | ( | unsigned | int | ) |
| DEBUG_FUNCTION void debug_solution_for_var | ( | ) |
Print the points-to solution for VAR to stdout.
References pt_solution::anything, cfun, pt_solution::escaped, pt_solution::nonlocal, pt_solution_includes_global(), and pt_solution::vars_contains_global.
|
static |
Delete created points-to sets.
References execute(), gate_ipa_pta(), and ipa_pta_execute().
|
static |
Handle a non-simple (simple meaning requires no iteration), constraint (IE *x = &y, x = *y, *x = y, and x = y with offsets involved).
*x = y
x = *y
References bitmap_hash(), hash_table< Descriptor, Allocator >::find_slot_with_hash(), equiv_class_label::hashcode, and equiv_class_label::labels.
Referenced by handle_lhs_call(), handle_pure_call(), and handle_rhs_call().
|
static |
Dereference the constraint expression CONS, and return the result. DEREF (ADDRESSOF) = SCALAR DEREF (SCALAR) = DEREF DEREF (DEREF) = (temp = DEREF1; result = DEREF(temp)) This is needed so that we can handle dereferencing DEREF constraints.
References ADDRESSOF, anything_id, DEREF, gcc_assert, get_constraint_for(), get_constraint_for_rhs(), constraint_expr::type, constraint_expr::var, and vNULL.
|
static |
Process a constraint C that represents *(x + off) = y using DELTA as the starting solution for x.
Our IL does not allow this.
If the solution of y contains ANYTHING simply use the ANYTHING solution. This avoids needlessly increasing the points-to sets.
If the solution for x contains ANYTHING we have to merge the solution of y into all pointer variables which we do via STOREDANYTHING.
If we do not know at with offset the rhs is dereferenced compute the reachability set of DELTA, conservatively assuming it is dereferenced at all valid offsets.
For each member j of delta (Sol(x)), add an edge from y to j and union Sol(y) into Sol(j)
If the access is outside of the variable we can ignore it.
If v is a global variable then this is an escape point.
Enough to let rhs escape once.
If the variable is not exactly at the requested offset
we have to include the next one.
|
static |
Process a constraint C that represents x = *(y + off), using DELTA as the starting solution for y.
Our IL does not allow this.
If the solution of Y contains anything it is good enough to transfer this to the LHS.
If we do not know at with offset the rhs is dereferenced compute the reachability set of DELTA, conservatively assuming it is dereferenced at all valid offsets.
No further offset processing is necessary.
For each variable j in delta (Sol(y)), add an edge in the graph from j to x, and union Sol(j) into Sol(x).
If the access is outside of the variable we can ignore it.
Adding edges from the special vars is pointless.
They don't have sets that can change. Merging the solution from ESCAPED needlessly increases
the set. Use ESCAPED as representative instead. If the variable is not exactly at the requested offset
we have to include the next one. If the LHS solution changed, mark the var as changed.
References add_graph_edge(), bitmap_ior_into(), bitmap_set_bit, escaped_id, find(), get_varinfo(), HOST_WIDE_INT, variable_info::id, variable_info::is_global_var, variable_info::is_special_var, variable_info::may_have_pointers, variable_info::next, variable_info::offset, and vi_next().
|
static |
Handle aggregate copies by expanding into copies of the respective fields of the structures.
|
static |
Print out constraint C to FILE.
Referenced by unite().
|
static |
Print the constraint graph in dot format.
Only print the graph if it has already been initialized:
Prints the header of the dot file:
The next lines print the nodes in the graph together with the complex constraints attached to them.
Go over the edges.
Prints the tail of the dot file.
Referenced by pt_solution_includes_global().
|
static |
Print out all constraints to FILE
References find(), FIRST_REF_NODE, and get_varinfo().
Referenced by new_constraint().
|
static |
Print the pred graph in dot format.
Only print the graph if it has already been initialized:
Prints the header of the dot file:
The next lines print the nodes in the graph together with the complex constraints attached to them.
Go over the edges.
Prints the tail of the dot file.
| void dump_pta_stats | ( | ) |
|
static |
Dump points-to information to OUTFILE.
|
static |
Print out the points-to solution for VAR to FILE.
Dump the solution for unified vars anyway, this avoids difficulties in scanning dumps in the testsuite.
But note when the variable was unified.
Referenced by shared_bitmap_add().
|
static |
Eliminate indirect cycles involving NODE. Return true if NODE was part of an SCC, false otherwise.
We can't touch the solution set and call unify_nodes at the same time, because unify_nodes is going to do bitmap unions into it.
References NULL, and pointer_map_contains().
Referenced by unite_pointer_equivalences().
|
static |
Lookup a equivalence class in TABLE by the bitmap of LABELS with hash HAS it contains. Sets *REF_LABELS to the bitmap LABELS is equivalent to.
References BITMAP_ALLOC, bitmap_ior(), bitmap_ior_into(), and constraint_graph::points_to.
|
static |
|
static |
qsort comparison function for two fieldoff's PA and PB
|
static |
Return the representative node for NODE, if NODE has been unioned with another NODE. This function performs path compression along the way to finding the representative.
Referenced by do_sd_constraint(), dump_constraints(), free_topo_info(), free_var_substitution_info(), perform_var_substitution(), and unite_pointer_equivalences().
|
static |
Return an existing node that is equivalent to NODE, which has equivalence class LABEL, if one exists. Return NODE otherwise.
If the address version of this variable is unused, we can substitute it for anything else with the same label. Otherwise, we know the pointers are equivalent, but not the locations, and we can unite them later.
Unify the two variables since we know they are equivalent.
|
static |
Walk statement T setting up aliasing constraints according to the references found in T. This function is the main part of the constraint builder. AI points to auxiliary alias information used when building alias sets and computing alias grouping heuristics.
Now build constraints expressions.
For a phi node, assign all the arguments to
the result. In IPA mode, we need to generate constraints to pass call arguments through their calls. There are two cases, either a GIMPLE_CALL returning a value, or just a plain GIMPLE_CALL when we are not. In non-ipa mode, we need to generate constraints for each pointer passed by address.
Otherwise, just a regular assignment statement. Only care about operations with pointer result, others are dealt with as escape points if they have pointer operands.
Otherwise, just a regular assignment statement.
Ignore clobbers, they don't actually store anything into
the LHS. If the operation produces a floating point result then
assume the value is not produced to transfer a pointer. Aligning a pointer via a BIT_AND_EXPR is offsetting
the pointer. Handle it by offsetting it by UNKNOWN. The result is a merge of both COND_EXPR arms.
Truth value results are not pointer (parts). Or at least
very very unreasonable obfuscation of a part. All other operations are merges.
If there is a store to a global variable the rhs escapes.
Handle escapes through return.
Handle asms conservatively by adding escape constraints to everything.
A memory constraint makes the address of the operand escape.
The asm may read global memory, so outputs may point to
any global memory. A memory constraint makes the address of the operand escape.
Strictly we'd only need the constraint to ESCAPED if
the asm clobbers memory, otherwise using something
along the lines of per-call clobbers/uses would be enough.
Referenced by pt_solution_includes_1().
|
static |
Create constraints for the builtin call T. Return true if the call was handled, otherwise false.
??? All builtins that are handled here need to be handled in the alias-oracle query functions explicitly!
All the following functions return a pointer to the same object
as their first argument points to. The functions do not add
to the ESCAPED solution. The functions make the first argument
pointed to memory point to what the second argument pointed to
memory points to. All the following functions do not return pointers, do not
modify the points-to sets of memory reachable from their
arguments and do not add to the ESCAPED solution. String / character search functions return a pointer into the
source string or NULL. Trampolines are special - they set up passing the static
frame. Make the frame point to the function for
the trampoline adjustment call. Else fallthru to generic handling which will let
the frame escape. Variadic argument handling needs to be handled in IPA
mode as well. The va_list gets access to pointers in variadic
arguments. Which we know in the case of IPA analysis
and otherwise are just all nonlocal variables. va_list is clobbered.
va_end doesn't have any effect that matters.
Alternate return. Simply give up for now.
printf-style functions may have hooks to set pointers to
point to somewhere into the generated string. Leave them
for a later exercise... Fallthru to general call handling.
|
static |
Create constraints for the call T.
Const functions can return their arguments and addresses
of global memory but not of escaped memory.
Pure functions can return addresses in and of memory
reachable from their arguments, but they are not an escape
point for reachable memory of their arguments. Assign all the passed arguments to the appropriate incoming
parameters of the function. If we are returning a value, assign it to the result.
If we pass the result decl by reference, honor that.
If we use a static chain, pass it along.
|
static |
Walk statement T setting up clobber and use constraints according to the references found in T. This function is a main part of the IPA constraint builder.
Add constraints for clobbered/used in IPA mode. We are not interested in what automatic variables are clobbered or used as we only use the information in the caller to which they do not escape.
If the stmt refers to memory in any way it better had a VUSE.
We'd better have function information for the current function.
Account for stores in assignments and calls.
Account for uses in assigments and returns.
For builtins we do not have separate function info. For those
we do not generate escapes for we have to generate clobbers/uses. The following functions use and clobber memory pointed to
by their arguments. The following function clobbers memory pointed to by
its argument. The following functions clobber their second and third
arguments. The following functions clobber their second argument.
The following functions clobber their third argument.
The following functions neither read nor clobber memory.
Trampolines are of no interest to us.
printf-style functions may have hooks to set pointers to
point to somewhere into the generated string. Leave them
for a later exercise... Fallthru to general call handling.
Parameters passed by value are used.
Build constraints for propagating clobbers/uses along the
callgraph edges. For callees without function info (that's external functions),
ESCAPED is clobbered and used. Also honor the call statement use/clobber info.
Otherwise the caller clobbers and uses what the callee does.
??? This should use a new complex constraint that filters
local variables of the callee. ??? Ick. We can do better.
|
static |
Find indirect cycles in GRAPH that occur, using strongly connected components, and note them in the indirect cycles map.
This technique comes from Ben Hardekopf and Calvin Lin, "It Pays to be Lazy: Fast and Accurate Pointer Analysis for Millions of Lines of Code", submitted to PLDI 2007.
|
static |
Given a pointer variable P, fill in its points-to set.
For parameters, get at the points-to set for the actual parm decl.
Referenced by pt_solutions_intersect_1().
|
staticread |
Compute the points-to solution *PT for the variable VI.
This variable may have been collapsed, let's get the real variable.
See if we have already computed the solution and return it.
Translate artificial variables into SSA_NAME_PTR_INFO attributes.
We represent heapvars in the points-to set properly.
Nobody cares.
Instead of doing extra work, simply do not create elaborate points-to information for pt_anything pointers.
Share the final set of variables when possible.
|
static |
Find the first varinfo in the same variable as START that overlaps with OFFSET. If there is no such varinfo the varinfo directly preceding OFFSET is returned.
If we cannot reach offset from start, lookup the first field and start from there.
We may not find a variable in the field list with the actual offset when when we have glommed a structure to a variable. In that case, however, offset should still be within the size of the variable. If we got beyond the offset we look for return the field directly preceding offset which may be the last field.
References DECL_CHAIN, and insert_vi_for_tree().
Referenced by new_scalar_tmp_constraint_exp().
Referenced by remove_preds_and_fake_succs().
|
static |
Find the first varinfo in the same variable as START that overlaps with OFFSET. Return NULL if we can't find one.
If the offset is outside of the variable, bail out.
If we cannot reach offset from start, lookup the first field and start from there.
We may not find a variable in the field list with the actual
offset when when we have glommed a structure to a variable.
In that case, however, offset should still be within the size
of the variable.
|
static |
Free an SCC info structure pointed to by SI
References bitmap_set_bit, scc_info::current_index, scc_info::dfs, EXECUTE_IF_IN_NONNULL_BITMAP, gcc_checking_assert, scc_info::node_mapping, constraint_graph::preds, and scc_info::visited.
|
static |
Free the topological sort info pointed to by TI.
References add_graph_edge(), bitmap_ior_into(), bitmap_set_bit, find(), get_varinfo(), and storedanything_id.
|
static |
|
static |
Return true if we should execute IPA PTA.
Don't bother doing anything if the program has errors.
Referenced by delete_points_to_sets().
|
static |
|
static |
Lookup or create the variable for the call statement CALL representing the clobbers.
|
static |
Lookup or create the variable for the call statement CALL representing the uses.
Referenced by make_heapvar().
|
static |
Lookup or create the variable for the call statement CALL.
Referenced by lookup_call_use_vi().
Referenced by do_deref(), handle_pure_call(), handle_rhs_call(), and make_constraint_from().
|
static |
Given a gimple tree T, return the constraint expression vector for it.
References fi_clobbers, fi_parm_base, fi_result, fi_static_chain, and fi_uses.
|
static |
Given a tree T, return the constraint expression for it.
x = integer is all glommed to a single variable, which doesn't point to anything by itself. That is, of course, unless it is an integer constant being treated as a pointer, in which case, we will return that this is really the addressof anything. This happens below, since it will fall into the default case. The only case we know something about an integer treated like a pointer is when it is the NULL pointer, and then we just say it points to NULL. Do not do that if -fno-delete-null-pointer-checks though, because in that case *NULL does not fail, so it <em>should</em> alias *anything. It is not worth adding a new option or renaming the existing one, since this case is relatively obscure.
The only valid CONSTRUCTORs in gimple with pointer typed
elements are zero-initializer. But in IPA mode we also
process global initializers, so verify at least. String constants are read-only.
If we are not taking the address then make sure to process
all subvariables we might access. For dereferences this means we have to defer it
to solving time. We are missing handling for TARGET_MEM_REF here.
We do not know whether the constructor was complete,
so technically we have to add &NOTHING or &ANYTHING
like we do for an empty constructor as well. We cannot refer to automatic variables through constants.
The default fallback is a constraint from anything.
|
static |
Given a tree T, return the constraint expression for taking the address of it.
Referenced by make_constraints_to().
|
static |
Given a COMPONENT_REF T, return the constraint_expr vector for it. If address_p is true the result will be taken its address of. If lhs_p is true then the constraint expression is assumed to be used as the lhs.
Some people like to do cute things like take the address of &0->a.b
Handle type-punning through unions. If we are extracting a pointer from a union via a possibly type-punning access that pointer points to anything, similar to a conversion of an integer to a pointer.
Pretend to take the address of the base, we'll take care of adding the required subset of sub-fields below.
For single-field vars do not bother about the offset.
In languages like C, you can access one past the end of an
array. You aren't allowed to dereference it, so we can
ignore this constraint. When we handle pointer subtraction,
we may have to do something cute here. It's also not true that the constraint will actually start at the
right offset, it may start in some padding. We only care about
setting the constraint to the first actual field it touches, so
walk to find it. If we are going to take the address of this field then
to be able to compute reachability correctly add at least
the last field of the variable. Assert that we found *some* field there. The user couldn't be
accessing *only* padding. Still the user could access one past the end of an array
embedded in a struct resulting in accessing *only* padding. Or accessing only padding via type-punning to a type
that has a filed just in padding space. If we do not know exactly where the access goes say so. Note
that only for non-structure accesses we know that we access
at most one subfiled of any variable. We can end up here for component references on a
VIEW_CONVERT_EXPR <>(&foobar).
Get constraint expressions for offsetting PTR by OFFSET. Stores the resulting constraint expressions in *RESULTS.
If we do not do field-sensitive PTA adding offsets to pointers does not change the points-to solution.
If the offset is not a non-negative integer constant that fits in a HOST_WIDE_INT, we have to fall back to a conservative solution which includes all sub-fields of all pointed-to variables of ptr.
Sign-extend the offset.
Make sure the bit-offset also fits.
As we are eventually appending to the solution do not use vec::iterate here.
If this varinfo represents a full variable just use it.
If we do not know the offset add all subfields.
Search the sub-field which overlaps with the
pointed-to offset. If the result is outside of the variable
we have to provide a conservative result, as the variable is
still reachable from the resulting pointer (even though it
technically cannot point to anything). The last and first
sub-fields are such conservative results.
??? If we always had a sub-field for &object + 1 then
we could represent this in a more precise way. If the found variable is not exactly at the pointed to
result, we have to include the next variable in the
solution as well. Otherwise two increments by offset / 2
do not result in the same or a conservative superset
solution.
Referenced by handle_lhs_call(), and handle_rhs_call().
Referenced by alias_get_name(), and do_deref().
|
static |
Given a gimple tree T, return the constraint expression vector for it to be used as the rhs of a constraint.
References anything_id, gcc_assert, in_ipa_mode, constraint_expr::offset, and constraint_expr::var.
|
static |
Get a constraint expression vector from an SSA_VAR_P node. If address_p is true, the result will be taken its address of.
We allow FUNCTION_DECLs here even though it doesn't make much sense.
For parameters, get at the points-to set for the actual parm decl.
For global variables resort to the alias target.
If we determine the result is "anything", and we know this is readonly, say it points to readonly memory instead.
If we are not taking the address of the constraint expr, add all sub-fiels of the variable as well.
References ADDRESSOF, variable_info::next, constraint_expr::offset, constraint_expr::type, and constraint_expr::var.
|
static |
Return the varinfo for the callee of CALL.
If we can directly resolve the function being called, do so. Otherwise, it must be some sort of indirect expression that we should still be able to handle.
If the function is anything other than a SSA name pointer we have no clue and should be getting ANYFN (well, ANYTHING for now).
References ADDRESSOF, cfun, get_function_part_constraint(), lookup_vi_for_tree(), and constraint_expr::type.
|
staticread |
Get a constraint for the requested part of a function designator FI when operating in IPA mode.
??? We probably should have a ANYFN special variable.
Referenced by get_fi_for_callee().
|
inlinestatic |
Return the varmap element N
Referenced by constraint_expr_less(), do_sd_constraint(), dump_constraints(), free_topo_info(), shared_bitmap_add(), and unite_pointer_equivalences().
|
static |
Find the variable id for tree T in the map. If T doesn't exist in the map, create an entry for it and return it.
References ADDRESSOF, variable_info::id, constraint_expr::offset, constraint_expr::type, constraint_expr::var, and vi_next().
Referenced by create_function_info_for().
|
static |
For non-IPA mode, generate constraints necessary for a call of a const function that returns a pointer in the statement STMT.
Treat nested const functions the same as pure functions as far as the static chain is concerned.
May return arguments.
May return addresses of globals.
|
static |
For non-IPA mode, generate constraints necessary for a call that returns a pointer and assigns it to LHS. This simply makes the LHS point to global and escaped variables.
If the store is to a global decl make sure to add proper escape constraints.
If the call returns an argument unmodified override the rhs constraints.
We delay marking allocated storage global until we know if
it escapes. If this is not a real malloc call assume the memory was
initialized and thus may point to global memory. All
builtin functions with the malloc attribute behave in a sane way.
References do_deref(), get_constraint_for_ptr_offset(), gimple_call_arg(), gimple_call_flags(), gimple_call_lhs(), NULL_TREE, process_all_all_constraints(), and vNULL.
|
static |
For non-IPA mode, generate constraints necessary for a call to a pure function in statement STMT.
Memory reached from pointer arguments is call-used.
The static chain is used as well.
Pure functions may return call-used and nonlocal memory.
References do_deref(), get_constraint_for(), gimple_call_arg(), and process_all_all_constraints().
|
static |
For non-IPA mode, generate constraints necessary for a call on the RHS.
If the argument is not used we can ignore it.
As we compute ESCAPED context-insensitive we do not gain
any precision with just EAF_NOCLOBBER but not EAF_NOESCAPE
set. The argument would still get clobbered through the
escape solution. Add *tem = nonlocal, do not add *tem = callused as
EAF_NOESCAPE parameters do not escape to other parameters
and all other uses appear in NONLOCAL as well. If we added to the calls uses solution make sure we account for pointers to it to be returned.
The static chain escapes as well.
And if we applied NRV the address of the return slot escapes as well.
Regular functions return nonlocal memory.
References DECL_FUNCTION_CODE, do_deref(), get_constraint_for(), get_constraint_for_ptr_offset(), gimple_call_arg(), gimple_call_lhs(), NULL_TREE, and process_all_all_constraints().
|
static |
Initialize things necessary to perform PTA
References cgraph_function_with_gimple_body_p(), cgraph_node_name(), cgraph_node::clone_of, symtab_node_base::decl, DECL_ASSEMBLER_NAME, DECL_ASSEMBLER_NAME_SET_P, DECL_STRUCT_FUNCTION, dump_file, symtab_node_base::externally_visible, symtab_node_base::force_output, IDENTIFIER_POINTER, intra_create_variable_infos(), push_cfun(), and symtab_node_base::used_from_other_partition.
|
static |
Initialize the always-existing constraint variables for NULL ANYTHING, READONLY, and INTEGER
Variable ID zero is reserved and should be NULL.
Create the NULL variable, used to represent that a variable points to NULL.
Create the ANYTHING variable, used to represent that a variable points to some unknown piece of memory.
Anything points to anything. This makes deref constraints just work in the presence of linked list and other p = *p type loops, by saying that *ANYTHING = ANYTHING.
This specifically does not use process_constraint because process_constraint ignores all anything = anything constraints, since all but this one are redundant.
Create the READONLY variable, used to represent that a variable points to readonly memory.
readonly memory points to anything, in order to make deref easier. In reality, it points to anything the particular readonly variable can point to, but we don't track this separately.
Create the ESCAPED variable, used to represent the set of escaped memory.
Create the NONLOCAL variable, used to represent the set of nonlocal memory.
ESCAPED = *ESCAPED, because escaped is may-deref'd at calls, etc.
ESCAPED = ESCAPED + UNKNOWN_OFFSET, because if a sub-field escapes the whole variable escapes.
*ESCAPED = NONLOCAL. This is true because we have to assume everything pointed to by escaped points to what global memory can point to.
NONLOCAL = &NONLOCAL, NONLOCAL = &ESCAPED. This is true because global memory may point to global memory and escaped memory.
Create the STOREDANYTHING variable, used to represent the set of variables stored to *ANYTHING.
Create the INTEGER variable, used to represent that a variable points to what an INTEGER "points to".
INTEGER = ANYTHING, because we don't know where a dereference of a random integer will point to.
|
static |
Initialize the constraint graph structure to contain SIZE nodes.
??? Macros do not support template types with multiple arguments, so we use a typedef to work around it.
|
staticread |
Initialize and return a new SCC info structure.
|
staticread |
Initialize and return a topological info structure.
|
static |
Insert constraint C into the list of complex constraints for graph node VAR.
Only insert constraints that do not already exist.
|
static |
Insert ID as the variable id for tree T in the vi_for_tree map.
References BITS_PER_UNIT, DECL_FIELD_BIT_OFFSET, DECL_FIELD_OFFSET, host_integerp(), and TREE_INT_CST_LOW.
Referenced by create_function_info_for(), and first_or_preceding_vi_for_offset().
|
static |
Create varinfo structures for all of the variables in the function for intraprocedural mode.
For each incoming pointer argument arg, create the constraint ARG = NONLOCAL or a dummy variable if it is a restrict qualified passed-by-reference argument.
For restrict qualified pointers to objects passed by
reference build a real representative for the pointed-to object.
Treat restrict qualified references the same. Add a constraint for a result decl that is passed by reference.
Add a constraint for the incoming static chain parameter.
Referenced by init_alias_vars().
|
static |
Execute the driver for IPA PTA.
Build the constraints.
Nodes without a body are not interesting. Especially do not
visit clones at this point for now - we get duplicate decls
there for inline clones at least. Create constraints for global variables and their initializers.
Nodes without a body are not interesting.
For externally visible or attribute used annotated functions use
local constraints for their arguments.
For local functions we see all callers and thus do not need initial
constraints for parameters. We also need to make function return values escape. Nothing
escapes by returning from main though. Build constriants for the function body.
From the constraints compute the points-to sets.
Compute the global points-to sets for ESCAPED. ??? Note that the computed escape set is not correct for the whole unit as we fail to consider graph edges to externally visible functions.
Make sure the ESCAPED solution (which is used as placeholder in other solutions) does not reference itself. This simplifies points-to solution queries.
Assign the points-to sets to the SSA names in the unit.
Nodes without a body are not interesting.
Compute the points-to sets for pointer SSA_NAMEs.
Compute the call-use and call-clobber sets for all direct calls.
Compute the call-use and call-clobber sets for indirect calls
and calls to external functions. Handle direct calls to external functions.
Escaped (and thus nonlocal) variables are always
implicitly used by calls. ??? ESCAPED can be empty even though NONLOCAL
always escaped. If there is nothing special about this call then
we have made everything that is used also escape. Escaped (and thus nonlocal) variables are always
implicitly clobbered by calls. ??? ESCAPED can be empty even though NONLOCAL
always escaped. If there is nothing special about this call then
we have made everything that is used also escape. Handle indirect calls.
We need to accumulate all clobbers/uses of all possible
callees. If we cannot constrain the set of functions we'll end up
calling we end up using/clobbering everything. ??? We could be more precise here?
Referenced by delete_points_to_sets().
|
static |
Label pointer equivalences.
Label and union our incoming edges's points to sets.
Skip unused edges
Indirect nodes get fresh variables and a new pointer equiv class.
If there was only a single non-empty predecessor the pointer equiv class is the same.
|
static |
Lookup the variable for the call statement CALL representing the clobbers. Returns NULL if there is nothing special about this call.
|
static |
Lookup the variable for the call statement CALL representing the uses. Returns NULL if there is nothing special about this call.
References get_call_vi(), and vi_next().
Referenced by get_fi_for_callee(), and remove_preds_and_fake_succs().
|
static |
Find the variable info for tree T in VI_FOR_TREE. If T does not exist in the map, return NULL, otherwise, return the varinfo we found.
References HOST_WIDE_INT, and use_field_sensitive.
|
static |
Create a constraint ID = &FROM.
References DECL_P, escaped_id, get_base_address(), get_constraint_for(), is_global_var(), constraint_expr::offset, SCALAR, constraint_expr::type, constraint_expr::var, and vNULL.
Referenced by create_function_info_for().
|
static |
Create a new artificial heap variable with NAME and make a constraint from it to LHS. Set flags according to a tag used for tracking restrict pointers and make the artificial heap point to global memory.
References variable_info::id, constraint_expr::offset, SCALAR, constraint_expr::type, and constraint_expr::var.
Referenced by create_function_info_for().
|
static |
Create a new artificial heap variable with NAME and make a constraint from it to LHS. Set flags according to a tag used for tracking restrict pointers.
|
static |
Create a constraint ID = OP.
|
static |
Create constraints ID = { rhsc }.
References escaped_id, FOR_EACH_VEC_ELT, get_constraint_for_address_of(), gimple_call_lhs(), new_constraint(), constraint_expr::offset, process_constraint(), SCALAR, constraint_expr::type, constraint_expr::var, and vNULL.
|
static |
Create a constraint ID = FROM.
Referenced by create_function_info_for().
|
static |
Make constraints necessary to make OP escape.
|
static |
Create a new artificial heap variable with NAME. Return the created variable.
References get_call_use_vi(), gimple_call_arg(), gimple_call_num_args(), make_transitive_closure_constraints(), and NULL.
| gimple_opt_pass* make_pass_build_alias | ( | ) |
| gimple_opt_pass* make_pass_build_ealias | ( | ) |
| simple_ipa_opt_pass* make_pass_ipa_pta | ( | ) |
|
static |
Add constraints to that the solution of VI is transitively closed.
VAR = *VAR;
VAR = VAR + UNKNOWN;
Referenced by make_heapvar().
|
static |
Merge GRAPH nodes FROM and TO into node TO.
If we have indirect cycles with the from node, and we have none on the to node, the to node has indirect cycles from the from node now that they are unified. If indirect cycles exist on both, unify the nodes that they are in a cycle with, since we know they are in a cycle with each other.
Merge all the successor edges.
References constraint_graph::indirect_cycles, constraint_graph::pe_rep, and constraint_graph::rep.
|
static |
Condense two variable nodes into a single variable node, by moving all associated info from SRC to TO.
Move all complex constraints from src node into to node
In complex constraints for node src, we may have either
a = *src, and *src = a, or an offseted constraint which are
always added to the rhs node's constraints.
References BITMAP_ALLOC, bitmap_set_bit, FIRST_REF_NODE, constraint_stats::num_edges, stats, and constraint_graph::succs.
|
static |
Move complex constraints to the GRAPH nodes they belong to.
|
static |
Create a new constraint consisting of LHS and RHS expressions.
References dump_constraints().
Referenced by create_function_info_for(), make_constraints_to(), and remove_preds_and_fake_succs().
|
staticread |
Get a scalar constraint expression for a new temporary variable.
References first_or_preceding_vi_for_offset(), HOST_WIDE_INT, and variable_info::offset.
|
static |
Return a new variable info structure consisting for a variable named NAME, and using constraint graph node NODE. Append it to the vector of variable info structures.
Vars without decl are artificial and do not have sub-variables.
We have to treat even local register variables
as escape points.
Referenced by set_uids_in_ptset().
|
staticread |
Perform offline variable substitution, discovering equivalence classes, and eliminating non-pointer variables.
Condense the nodes, which means to find SCC's, count incoming predecessors, and unite nodes in SCC's.
Actually the label the nodes for pointer equivalences
Calculate location equivalence labels.
Translate the pointed-by mapping for pointer equivalence
labels. The original pointed_by is now dead.
Look up the location equivalence label if one exists, or make
one otherwise. Quickly eliminate our non-pointer variables.
References find(), constraint_graph::pe, constraint_graph::pe_rep, unify_nodes(), and unite().
Efficiently generates constraints from all entries in *RHSC to all entries in *LHSC.
Referenced by handle_lhs_call(), handle_pure_call(), and handle_rhs_call().
|
static |
Process constraint T, performing various simplifications and then adding it to our list of overall constraints.
If we didn't get any useful constraint from the lhs we get &ANYTHING as fallback from get_constraint_for. Deal with it here by turning it into *ANYTHING.
ADDRESSOF on the lhs is invalid.
We shouldn't add constraints from things that cannot have pointers. It's not completely trivial to avoid in the callers, so do it here.
Likewise adding to the solution of a non-pointer var isn't useful.
This can happen in our IR with things like n->a = *p
Split into tmp = *rhs, *lhs = tmp
Split into tmp = &rhs, *lhs = tmp
Referenced by create_function_info_for(), make_constraints_to(), and remove_preds_and_fake_succs().
|
static |
Create a constraint adding to the clobber set of FI the memory pointed to by PTR.
| bool pt_solution_empty_p | ( | ) |
Return true if the points-to solution *PT is empty.
If the solution includes ESCAPED, check if that is empty.
If the solution includes ESCAPED, check if that is empty.
| bool pt_solution_includes | ( | ) |
|
static |
Return true if the points-to solution *PT includes the variable declaration DECL.
If the solution includes ESCAPED, check it.
If the solution includes ESCAPED, check it.
References find_func_aliases(), gimple_phi_result(), gsi_end_p(), gsi_next(), gsi_start_bb(), gsi_start_phis(), gsi_stmt(), and virtual_operand_p().
| bool pt_solution_includes_global | ( | ) |
Return true if the points-to solution *PT includes global memory.
??? This predicate is not correct for the IPA-PTA solution as we do not properly distinguish between unit escape points and global variables.
References dump_constraint_graph(), and dump_file.
|
static |
Computes the union of the points-to solutions *DEST and *SRC and stores the result in *DEST. This changes the points-to bitmap of *DEST and thus may not be used if that might be shared. The points-to bitmap of *SRC and *DEST will not be shared after this function if they were not before.
| void pt_solution_reset | ( | ) |
Reset the points-to solution *PT to a conservative default (point to anything).
| void pt_solution_set | ( | ) |
Set the points-to solution *PT to point only to the variables in VARS. VARS_CONTAINS_GLOBAL specifies whether that contains global variables and VARS_CONTAINS_RESTRICT specifies whether it contains restrict tag variables.
| void pt_solution_set_var | ( | ) |
Set the points-to solution *PT to point only to the variable VAR.
References bitmap_clear_range(), and constraint_graph::succs.
| bool pt_solution_singleton_p | ( | ) |
Return true if the points-to solution *PT only point to a single var, and return the var uid in *UID.
| bool pt_solutions_intersect | ( | ) |
|
static |
Return true if both points-to solutions PT1 and PT2 have a non-empty intersection.
If either points to unknown global memory and the other points to any global memory they alias.
Check the escaped solution if required.
If both point to escaped memory and that solution
is not empty they alias. If either points to escaped memory see if the escaped solution
intersects with the other. Check the escaped solution if required. ??? Do we need to check the local against the IPA escaped sets?
If both point to escaped memory and that solution
is not empty they alias. If either points to escaped memory see if the escaped solution
intersects with the other. Now both pointers alias if their points-to solution intersects.
References find_what_p_points_to(), POINTER_TYPE_P, ssa_name, and TREE_TYPE.
Referenced by shared_bitmap_hasher::equal().
|
static |
Given a TYPE, and a vector of field offsets FIELDSTACK, push all the fields of TYPE onto fieldstack, recording their offsets along the way.
OFFSET is used to keep track of the offset in this entire structure, rather than just the immediately containing structure. Returns false if the caller is supposed to handle the field we recursed for.
If the vector of fields is growing too big, bail out early. Callers check for vec::length <= MAX_FIELDS_FOR_FIELD_SENSITIVE, make sure this fails.
Empty structures may have actual size, like in C++. So
see if we didn't push any subfields and the size is
nonzero, push the field onto the stack. If there isn't anything at offset zero, create sth.
If adjacent fields do not contain pointers merge them.
Referenced by type_can_have_subvars().
|
static |
Remove the REF and ADDRESS edges from GRAPH, as well as all the predecessor edges.
Clear the implicit ref and address nodes from the successor lists.
Free the successor list for the non-ref nodes.
Now reallocate the size of the successor list as, and blow away the predecessor bitmaps.
References symtab_node_base::decl, escaped_id, fi_result, first_vi_for_offset(), variable_info::id, lookup_vi_for_tree(), new_constraint(), variable_info::offset, constraint_expr::offset, process_constraint(), SCALAR, constraint_expr::type, and constraint_expr::var.
|
static |
Optimize and rewrite complex constraints while performing collapsing of equivalent nodes. SI is the SCC_INFO that is the result of perform_variable_substitution.
See if it is really a non-pointer variable, and if so, ignore the constraint.
|
static |
Recursive routine to find strongly connected components in GRAPH. SI is the SCC info to store the information in, and N is the id of current graph node we are processing.
This is Tarjan's strongly connected component finding algorithm, as modified by Nuutila to keep only non-root nodes on the stack. The algorithm can be found in "On finding the strongly connected connected components in a directed graph" by Esko Nuutila and Eljas Soisalon-Soininen, in Information Processing Letters volume 49, number 1, pages 9-14.
Visit all the successors.
See if any components have been identified.
Collapse the SCC nodes into a single node, and mark the
indirect cycles.
References topo_info::topo_order, and topo_info::visited.
|
static |
Set bits in INTO corresponding to the variable uids in solution set FROM.
The only artificial variables that are allowed in a may-alias
set are heap variables.
If we are in IPA mode we will not recompute points-to
sets after inlining so make sure they stay valid. Add the decl to the points-to set. Note that the points-to
set contains global variables.
References variable_info::fullsize, gcc_assert, variable_info::id, variable_info::is_artificial_var, variable_info::is_global_var, variable_info::is_special_var, variable_info::may_have_pointers, new_var_info(), nothing_id, NULL, variable_info::offset, and variable_info::size.
|
static |
Union solution sets TO and FROM, and add INC to each member of FROM in the process.
If the solution of FROM contains anything it is good enough to transfer this to TO.
For zero offset simply union the solution into the destination.
If the offset is unknown we have to expand the solution to all subfields.
For non-zero offset union the offsetted solution into the destination.
If this is a variable with just one field just set its bit
in the result. If the offset makes the pointer point to before the
variable use offset zero for the field lookup. If the result is not exactly at fieldoffset include the next
field as well. See get_constraint_for_ptr_offset for more
rationale.
References DEREF, constraint::lhs, constraint::rhs, constraint_expr::type, and constraint_expr::var.
|
static |
Add a bitmap to the shared bitmap hashtable.
References dump_solution_for_var(), get_varinfo(), and variable_info::may_have_pointers.
|
static |
Lookup a bitmap in the shared bitmap hashtable, and return an already existing instance if there is one, NULL otherwise.
|
static |
Expands the solution in SET to all sub-fields of variables included.
In a first pass expand to the head of the variables we need to add all sub-fields off. This avoids quadratic behavior.
In the second pass now expand all head variables with subfields.
Referenced by unify_nodes().
|
static |
Solve the constraint set.
Attach complex constraints to graph nodes.
Implicit nodes and predecessors are no longer necessary at this point.
|
static |
Solve the constraint graph GRAPH using our worklist solver. This is based on the PW* family of solvers from the "Efficient Field Sensitive Pointer Analysis for C" paper. It works by iterating over all the graph nodes, processing the complex constraints and propagating the copy constraints, until everything stops changed. This corresponds to steps 6-8 in the solving list given above.
Mark all initial non-collapsed nodes as changed.
Allocate a bitmap to be used to store the changed bits.
If this variable is not a representative, skip it.
In certain indirect cycle cases, we may merge this
variable to another. If the node has changed, we need to process the
complex constraints and outgoing edges again. Compute the changed set of solution bits. If anything
is in the solution just propagate that. If anything is also in the old solution there is
nothing to do.
??? But we shouldn't ended up with "changed" set ... Process the complex constraints
XXX: This is going to unsort the constraints in
some cases, which will occasionally add duplicate
constraints during unification. This does not
affect correctness. The only complex constraint that can change our
solution to non-empty, given an empty solution,
is a constraint where the lhs side is receiving
some set from elsewhere. Propagate solution to all successors.
Don't try to propagate to ourselves.
If we propagate from ESCAPED use ESCAPED as
placeholder.
References ggc_strdup.
|
static |
Sort a fieldstack according to the field offset and sizes.
|
static |
Visit the graph in topological order, and store the order in the topo_info structure.
|
inlinestatic |
|
inlinestatic |
Return true if T is a type that can have subvars.
Aggregates without overlapping fields can have subvars.
References NULL, and push_fields_onto_fieldstack().
|
static |
Return true if T is a type that does contain pointers.
A function or method can have pointers as arguments, so track those separately.
|
static |
Unify node FROM into node TO, updating the changed count if necessary when UPDATE_CHANGED is true.
Mark TO as changed if FROM was changed. If TO was already marked as changed, decrease the changed count.
If the solution changes because of the merging, we need to mark
the variable as changed.
References solution_set_expand().
Referenced by build_succ_graph(), and perform_var_substitution().
|
static |
Union the TO and FROM nodes to the TO nodes. Note that at some point in the future, we may want to do union-by-rank, in which case we are going to have to return the node we unified to.
References dump_constraint().
Referenced by build_succ_graph(), free_var_substitution_info(), and perform_var_substitution().
|
static |
Unite pointer equivalent but not location equivalent nodes in GRAPH. This may only be performed once variable substitution is finished.
Go through the pointer equivalences and unite them to their representative, if they aren't already.
References anything_id, bitmap_bit_p, bitmap_clear_bit(), constraint_graph::complex, eliminate_indirect_cycles(), find(), get_varinfo(), variable_info::solution, and topo_info::topo_order.
|
inlinestatic |
Return true if V is a tree that we can have subvars for. Normally, this is any aggregate type. Also complex types which are not gimple registers can have subvars.
Volatile variables should never have subvars.
Non decls or memory tags can never have subvars.
|
inlinestatic |
Return the next variable in the list of sub-variables of VI or NULL if VI is the last sub-variable.
Referenced by create_function_info_for(), do_sd_constraint(), get_vi_for_tree(), and lookup_call_use_vi().
Variable Documentation
|
static |
A map mapping call statements to per-stmt variables for uses and clobbers specific to the call.
|
static |
Changed variables on the last iteration.
Referenced by bitmap_and(), bitmap_and_into(), bitmap_vector_clear(), build_and_add_sum(), cleanup_tree_cfg_1(), contains_hot_call_p(), df_get_eh_block_artificial_uses(), find_src_set_src(), fixup_noreturn_call(), get_addr_from_local_cache(), get_expr_type(), initial_value_entry(), make_pass_df_finish(), mark_regno_live(), pre_insert_copies(), propagate_controlled_uses(), replace_locals_op(), rewrite_use_compare(), set_rename(), and tree_unswitch_single_loop().
|
static |
|
static |
List of constraints that we use to build the constraint graph from.
| struct obstack fake_var_decl_obstack |
Temporary storage for fake var decls.
|
static |
Map varinfo to final pt_solution.
| struct obstack final_solutions_obstack |
|
static |
Referenced by coalesce_partitions().
|
static |
Referenced by get_constraint_for_rhs().
IPA PTA solutions for ESCAPED.
|
static |
Used for per-solver-iteration bitmaps.
|
static |
Current maximum location equivalence class id.
|
static |
A hashtable for mapping a bitmap of labels->location equivalence classes.
|
static |
Used for oldsolution members of variables.
|
static |
Perform offline variable substitution.
This is a worst case quadratic time way of identifying variables that must have equivalent points-to sets, including those caused by static cycles, and single entry subgraphs, in the constraint graph.
The technique is described in "Exploiting Pointer and Location Equivalence to Optimize Pointer Analysis. In the 14th International Static Analysis Symposium (SAS), August 2007." It is known as the "HU" algorithm, and is equivalent to value numbering the collapsed constraint graph including evaluating unions.
The general method of finding equivalence classes is as follows: Add fake nodes (REF nodes) and edges for *a = b and a = *b constraints. Initialize all non-REF nodes to be direct nodes. For each constraint a = a U {b}, we set pts(a) = pts(a) u {fresh variable} For each constraint containing the dereference, we also do the same thing.
We then compute SCC's in the graph and unify nodes in the same SCC, including pts sets.
For each non-collapsed node x: Visit all unvisited explicit incoming edges. Ignoring all non-pointers, set pts(x) = Union of pts(a) for y where y->x. Lookup the equivalence class for pts(x). If we found one, equivalence_class(x) = found class. Otherwise, equivalence_class(x) = new class, and new_class is added to the lookup table.
All direct nodes with the same equivalence class can be replaced with a single representative node. All unlabeled nodes (label == 0) are not pointers and all edges involving them can be eliminated. We perform these optimizations during rewrite_constraints
In addition to pointer equivalence class finding, we also perform location equivalence class finding. This is the set of variables that always appear together in points-to sets. We use this to compress the size of the points-to sets. Current maximum pointer equivalence class id.
|
static |
A hashtable for mapping a bitmap of labels->pointer equivalence classes.
|
static |
Used for predecessor bitmaps.
| unsigned HOST_WIDE_INT pt_solution_includes_may_alias |
| unsigned HOST_WIDE_INT pt_solution_includes_no_alias |
| unsigned HOST_WIDE_INT pt_solutions_intersect_may_alias |
| unsigned HOST_WIDE_INT pt_solutions_intersect_no_alias |
|
static |
Used for points-to sets.
| struct { ... } pta_stats |
Query statistics for points-to solutions.
Referenced by shared_bitmap_hasher::equal().
|
static |
Shared_bitmap hashtable.
|
static |
Referenced by merge_node_constraints().
Tree based points-to analysis Copyright (C) 2005-2013 Free Software Foundation, Inc. Contributed by Daniel Berlin dberlin@dberlin.org
This file is part of GCC.
GCC is free software; you can redistribute it and/or modify under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see http://www.gnu.org/licenses/. The idea behind this analyzer is to generate set constraints from the program, then solve the resulting constraints in order to generate the points-to sets.
Set constraints are a way of modeling program analysis problems that involve sets. They consist of an inclusion constraint language, describing the variables (each variable is a set) and operations that are involved on the variables, and a set of rules that derive facts from these operations. To solve a system of set constraints, you derive all possible facts under the rules, which gives you the correct sets as a consequence.
See "Efficient Field-sensitive pointer analysis for C" by "David J. Pearce and Paul H. J. Kelly and Chris Hankin, at http://citeseer.ist.psu.edu/pearce04efficient.html
Also see "Ultra-fast Aliasing Analysis using CLA: A Million Lines of C Code in a Second" by ""Nevin Heintze and Olivier Tardieu" at http://citeseer.ist.psu.edu/heintze01ultrafast.html
There are three types of real constraint expressions, DEREF, ADDRESSOF, and SCALAR. Each constraint expression consists of a constraint type, a variable, and an offset.
SCALAR is a constraint expression type used to represent x, whether it appears on the LHS or the RHS of a statement. DEREF is a constraint expression type used to represent *x, whether it appears on the LHS or the RHS of a statement. ADDRESSOF is a constraint expression used to represent &x, whether it appears on the LHS or the RHS of a statement.
Each pointer variable in the program is assigned an integer id, and each field of a structure variable is assigned an integer id as well.
Structure variables are linked to their list of fields through a "next field" in each variable that points to the next field in offset order. Each variable for a structure field has
- "size", that tells the size in bits of that field.
- "fullsize, that tells the size in bits of the entire structure. 3. "offset", that tells the offset in bits from the beginning of the structure to this field.
Thus, struct f { int a; int b; } foo; int *bar;
looks like
foo.a -> id 1, size 32, offset 0, fullsize 64, next foo.b foo.b -> id 2, size 32, offset 32, fullsize 64, next NULL bar -> id 3, size 32, offset 0, fullsize 32, next NULL
In order to solve the system of set constraints, the following is done:
- Each constraint variable x has a solution set associated with it, Sol(x).
- Constraints are separated into direct, copy, and complex. Direct constraints are ADDRESSOF constraints that require no extra processing, such as P = &Q Copy constraints are those of the form P = Q. Complex constraints are all the constraints involving dereferences and offsets (including offsetted copies).
- All direct constraints of the form P = &Q are processed, such that Q is added to Sol(P)
- All complex constraints for a given constraint variable are stored in a linked list attached to that variable's node.
- A directed graph is built out of the copy constraints. Each constraint variable is a node in the graph, and an edge from Q to P is added for each copy constraint of the form P = Q
- The graph is then walked, and solution sets are propagated along the copy edges, such that an edge from Q to P causes Sol(P) <- Sol(P) union Sol(Q).
- As we visit each node, all complex constraints associated with that node are processed by adding appropriate copy edges to the graph, or the appropriate variables to the solution set.
- The process of walking the graph is iterated until no solution sets change.
Prior to walking the graph in steps 6 and 7, We perform static cycle elimination on the constraint graph, as well as off-line variable substitution.
TODO: Adding offsets to pointer-to-structures can be handled (IE not punted on and turned into anything), but isn't. You can just see what offset inside the pointed-to struct it's going to access.
TODO: Constant bounded arrays can be handled as if they were structs of the same number of elements.
TODO: Modeling heap and incoming pointers becomes much better if we add fields to them as we discover them, which we could do.
TODO: We could handle unions, but to be honest, it's probably not worth the pain or slowdown. IPA-PTA optimizations possible.
When the indirect function called is ANYTHING we can add disambiguation based on the function signatures (or simply the parameter count which is the varinfo size). We also do not need to consider functions that do not have their address taken.
The is_global_var bit which marks escape points is overly conservative in IPA mode. Split it to is_escape_point and is_global_var - only externally visible globals are escape points in IPA mode. This is also needed to fix the pt_solution_includes_global predicate (and thus ptr_deref_may_alias_global_p).
The way we introduce DECL_PT_UID to avoid fixing up all points-to sets in the translation unit when we copy a DECL during inlining pessimizes precision. The advantage is that the DECL_PT_UID keeps compile-time and memory usage overhead low - the points-to sets do not grow or get unshared as they would during a fixup phase. An alternative solution is to delay IPA PTA until after all inlining transformations have been applied.
The way we propagate clobber/use information isn't optimized. It should use a new complex constraint that properly filters out local variables of the callee (though that would make the sets invalid after inlining). OTOH we might as well admit defeat to WHOPR and simply do all the clobber/use analysis and propagation after PTA finished but before we threw away points-to information for memory variables. WHOPR and PTA do not play along well anyway - the whole constraint solving would need to be done in WPA phase and it will be very interesting to apply the results to local SSA names during LTRANS phase.
We probably should compute a per-function unit-ESCAPE solution propagating it simply like the clobber / uses solutions. The solution can go alongside the non-IPA espaced solution and be used to query which vars escape the unit through a function.
We never put function decls in points-to sets so we do not keep the set of called functions for indirect calls.
And probably more.
Referenced by lookup_vi_for_tree().
|
static |
Pool of variable info structures.
Table of variable info structures for constraint variables. Indexed directly by variable info id.
|
static |
Map from trees to variable infos.
