1//===-- CodeGenTBAA.cpp - TBAA information for LLVM CodeGen ---------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This is the code that manages TBAA information and defines the TBAA policy
10// for the optimizer to use. Relevant standards text includes:
11//
12// C99 6.5p7
13// C++ [basic.lval] (p10 in n3126, p15 in some earlier versions)
14//
15//===----------------------------------------------------------------------===//
16
17#include "CodeGenTBAA.h"
18#include "clang/AST/ASTContext.h"
19#include "clang/AST/Attr.h"
20#include "clang/AST/Mangle.h"
21#include "clang/AST/RecordLayout.h"
22#include "clang/Basic/CodeGenOptions.h"
23#include "llvm/ADT/SmallSet.h"
24#include "llvm/IR/Constants.h"
25#include "llvm/IR/LLVMContext.h"
26#include "llvm/IR/Metadata.h"
27#include "llvm/IR/Module.h"
28#include "llvm/IR/Type.h"
29using namespace clang;
30using namespace CodeGen;
31
32CodeGenTBAA::CodeGenTBAA(ASTContext &Ctx, llvm::Module &M,
33 const CodeGenOptions &CGO,
34 const LangOptions &Features, MangleContext &MContext)
35 : Context(Ctx), Module(M), CodeGenOpts(CGO),
36 Features(Features), MContext(MContext), MDHelper(M.getContext()),
37 Root(nullptr), Char(nullptr)
38{}
39
40CodeGenTBAA::~CodeGenTBAA() {
41}
42
43llvm::MDNode *CodeGenTBAA::getRoot() {
44 // Define the root of the tree. This identifies the tree, so that
45 // if our LLVM IR is linked with LLVM IR from a different front-end
46 // (or a different version of this front-end), their TBAA trees will
47 // remain distinct, and the optimizer will treat them conservatively.
48 if (!Root) {
49 if (Features.CPlusPlus)
50 Root = MDHelper.createTBAARoot(Name: "Simple C++ TBAA");
51 else
52 Root = MDHelper.createTBAARoot(Name: "Simple C/C++ TBAA");
53 }
54
55 return Root;
56}
57
58llvm::MDNode *CodeGenTBAA::createScalarTypeNode(StringRef Name,
59 llvm::MDNode *Parent,
60 uint64_t Size) {
61 if (CodeGenOpts.NewStructPathTBAA) {
62 llvm::Metadata *Id = MDHelper.createString(Str: Name);
63 return MDHelper.createTBAATypeNode(Parent, Size, Id);
64 }
65 return MDHelper.createTBAAScalarTypeNode(Name, Parent);
66}
67
68llvm::MDNode *CodeGenTBAA::getChar() {
69 // Define the root of the tree for user-accessible memory. C and C++
70 // give special powers to char and certain similar types. However,
71 // these special powers only cover user-accessible memory, and doesn't
72 // include things like vtables.
73 if (!Char)
74 Char = createScalarTypeNode(Name: "omnipotent char", Parent: getRoot(), /* Size= */ 1);
75
76 return Char;
77}
78
79static bool TypeHasMayAlias(QualType QTy) {
80 // Tagged types have declarations, and therefore may have attributes.
81 if (auto *TD = QTy->getAsTagDecl())
82 if (TD->hasAttr<MayAliasAttr>())
83 return true;
84
85 // Also look for may_alias as a declaration attribute on a typedef.
86 // FIXME: We should follow GCC and model may_alias as a type attribute
87 // rather than as a declaration attribute.
88 while (auto *TT = QTy->getAs<TypedefType>()) {
89 if (TT->getDecl()->hasAttr<MayAliasAttr>())
90 return true;
91 QTy = TT->desugar();
92 }
93 return false;
94}
95
96/// Check if the given type is a valid base type to be used in access tags.
97static bool isValidBaseType(QualType QTy) {
98 if (QTy->isReferenceType())
99 return false;
100 if (const RecordType *TTy = QTy->getAs<RecordType>()) {
101 const RecordDecl *RD = TTy->getDecl()->getDefinition();
102 // Incomplete types are not valid base access types.
103 if (!RD)
104 return false;
105 if (RD->hasFlexibleArrayMember())
106 return false;
107 // RD can be struct, union, class, interface or enum.
108 // For now, we only handle struct and class.
109 if (RD->isStruct() || RD->isClass())
110 return true;
111 }
112 return false;
113}
114
115llvm::MDNode *CodeGenTBAA::getTypeInfoHelper(const Type *Ty) {
116 uint64_t Size = Context.getTypeSizeInChars(T: Ty).getQuantity();
117
118 // Handle builtin types.
119 if (const BuiltinType *BTy = dyn_cast<BuiltinType>(Val: Ty)) {
120 switch (BTy->getKind()) {
121 // Character types are special and can alias anything.
122 // In C++, this technically only includes "char" and "unsigned char",
123 // and not "signed char". In C, it includes all three. For now,
124 // the risk of exploiting this detail in C++ seems likely to outweigh
125 // the benefit.
126 case BuiltinType::Char_U:
127 case BuiltinType::Char_S:
128 case BuiltinType::UChar:
129 case BuiltinType::SChar:
130 return getChar();
131
132 // Unsigned types can alias their corresponding signed types.
133 case BuiltinType::UShort:
134 return getTypeInfo(QTy: Context.ShortTy);
135 case BuiltinType::UInt:
136 return getTypeInfo(QTy: Context.IntTy);
137 case BuiltinType::ULong:
138 return getTypeInfo(QTy: Context.LongTy);
139 case BuiltinType::ULongLong:
140 return getTypeInfo(QTy: Context.LongLongTy);
141 case BuiltinType::UInt128:
142 return getTypeInfo(QTy: Context.Int128Ty);
143
144 case BuiltinType::UShortFract:
145 return getTypeInfo(QTy: Context.ShortFractTy);
146 case BuiltinType::UFract:
147 return getTypeInfo(QTy: Context.FractTy);
148 case BuiltinType::ULongFract:
149 return getTypeInfo(QTy: Context.LongFractTy);
150
151 case BuiltinType::SatUShortFract:
152 return getTypeInfo(QTy: Context.SatShortFractTy);
153 case BuiltinType::SatUFract:
154 return getTypeInfo(QTy: Context.SatFractTy);
155 case BuiltinType::SatULongFract:
156 return getTypeInfo(QTy: Context.SatLongFractTy);
157
158 case BuiltinType::UShortAccum:
159 return getTypeInfo(QTy: Context.ShortAccumTy);
160 case BuiltinType::UAccum:
161 return getTypeInfo(QTy: Context.AccumTy);
162 case BuiltinType::ULongAccum:
163 return getTypeInfo(QTy: Context.LongAccumTy);
164
165 case BuiltinType::SatUShortAccum:
166 return getTypeInfo(QTy: Context.SatShortAccumTy);
167 case BuiltinType::SatUAccum:
168 return getTypeInfo(QTy: Context.SatAccumTy);
169 case BuiltinType::SatULongAccum:
170 return getTypeInfo(QTy: Context.SatLongAccumTy);
171
172 // Treat all other builtin types as distinct types. This includes
173 // treating wchar_t, char16_t, and char32_t as distinct from their
174 // "underlying types".
175 default:
176 return createScalarTypeNode(Name: BTy->getName(Policy: Features), Parent: getChar(), Size);
177 }
178 }
179
180 // C++1z [basic.lval]p10: "If a program attempts to access the stored value of
181 // an object through a glvalue of other than one of the following types the
182 // behavior is undefined: [...] a char, unsigned char, or std::byte type."
183 if (Ty->isStdByteType())
184 return getChar();
185
186 // Handle pointers and references.
187 // TODO: Implement C++'s type "similarity" and consider dis-"similar"
188 // pointers distinct.
189 if (Ty->isPointerType() || Ty->isReferenceType())
190 return createScalarTypeNode(Name: "any pointer", Parent: getChar(), Size);
191
192 // Accesses to arrays are accesses to objects of their element types.
193 if (CodeGenOpts.NewStructPathTBAA && Ty->isArrayType())
194 return getTypeInfo(QTy: cast<ArrayType>(Val: Ty)->getElementType());
195
196 // Enum types are distinct types. In C++ they have "underlying types",
197 // however they aren't related for TBAA.
198 if (const EnumType *ETy = dyn_cast<EnumType>(Val: Ty)) {
199 if (!Features.CPlusPlus)
200 return getTypeInfo(QTy: ETy->getDecl()->getIntegerType());
201
202 // In C++ mode, types have linkage, so we can rely on the ODR and
203 // on their mangled names, if they're external.
204 // TODO: Is there a way to get a program-wide unique name for a
205 // decl with local linkage or no linkage?
206 if (!ETy->getDecl()->isExternallyVisible())
207 return getChar();
208
209 SmallString<256> OutName;
210 llvm::raw_svector_ostream Out(OutName);
211 MContext.mangleCanonicalTypeName(T: QualType(ETy, 0), Out);
212 return createScalarTypeNode(Name: OutName, Parent: getChar(), Size);
213 }
214
215 if (const auto *EIT = dyn_cast<BitIntType>(Val: Ty)) {
216 SmallString<256> OutName;
217 llvm::raw_svector_ostream Out(OutName);
218 // Don't specify signed/unsigned since integer types can alias despite sign
219 // differences.
220 Out << "_BitInt(" << EIT->getNumBits() << ')';
221 return createScalarTypeNode(Name: OutName, Parent: getChar(), Size);
222 }
223
224 // For now, handle any other kind of type conservatively.
225 return getChar();
226}
227
228llvm::MDNode *CodeGenTBAA::getTypeInfo(QualType QTy) {
229 // At -O0 or relaxed aliasing, TBAA is not emitted for regular types.
230 if (CodeGenOpts.OptimizationLevel == 0 || CodeGenOpts.RelaxedAliasing)
231 return nullptr;
232
233 // If the type has the may_alias attribute (even on a typedef), it is
234 // effectively in the general char alias class.
235 if (TypeHasMayAlias(QTy))
236 return getChar();
237
238 // We need this function to not fall back to returning the "omnipotent char"
239 // type node for aggregate and union types. Otherwise, any dereference of an
240 // aggregate will result into the may-alias access descriptor, meaning all
241 // subsequent accesses to direct and indirect members of that aggregate will
242 // be considered may-alias too.
243 // TODO: Combine getTypeInfo() and getBaseTypeInfo() into a single function.
244 if (isValidBaseType(QTy))
245 return getBaseTypeInfo(QTy);
246
247 const Type *Ty = Context.getCanonicalType(T: QTy).getTypePtr();
248 if (llvm::MDNode *N = MetadataCache[Ty])
249 return N;
250
251 // Note that the following helper call is allowed to add new nodes to the
252 // cache, which invalidates all its previously obtained iterators. So we
253 // first generate the node for the type and then add that node to the cache.
254 llvm::MDNode *TypeNode = getTypeInfoHelper(Ty);
255 return MetadataCache[Ty] = TypeNode;
256}
257
258TBAAAccessInfo CodeGenTBAA::getAccessInfo(QualType AccessType) {
259 // Pointee values may have incomplete types, but they shall never be
260 // dereferenced.
261 if (AccessType->isIncompleteType())
262 return TBAAAccessInfo::getIncompleteInfo();
263
264 if (TypeHasMayAlias(QTy: AccessType))
265 return TBAAAccessInfo::getMayAliasInfo();
266
267 uint64_t Size = Context.getTypeSizeInChars(T: AccessType).getQuantity();
268 return TBAAAccessInfo(getTypeInfo(QTy: AccessType), Size);
269}
270
271TBAAAccessInfo CodeGenTBAA::getVTablePtrAccessInfo(llvm::Type *VTablePtrType) {
272 llvm::DataLayout DL(&Module);
273 unsigned Size = DL.getPointerTypeSize(Ty: VTablePtrType);
274 return TBAAAccessInfo(createScalarTypeNode(Name: "vtable pointer", Parent: getRoot(), Size),
275 Size);
276}
277
278bool
279CodeGenTBAA::CollectFields(uint64_t BaseOffset,
280 QualType QTy,
281 SmallVectorImpl<llvm::MDBuilder::TBAAStructField> &
282 Fields,
283 bool MayAlias) {
284 /* Things not handled yet include: C++ base classes, bitfields, */
285
286 if (const RecordType *TTy = QTy->getAs<RecordType>()) {
287 const RecordDecl *RD = TTy->getDecl()->getDefinition();
288 if (RD->hasFlexibleArrayMember())
289 return false;
290
291 // TODO: Handle C++ base classes.
292 if (const CXXRecordDecl *Decl = dyn_cast<CXXRecordDecl>(Val: RD))
293 if (Decl->bases_begin() != Decl->bases_end())
294 return false;
295
296 const ASTRecordLayout &Layout = Context.getASTRecordLayout(D: RD);
297
298 unsigned idx = 0;
299 for (RecordDecl::field_iterator i = RD->field_begin(),
300 e = RD->field_end(); i != e; ++i, ++idx) {
301 if ((*i)->isZeroSize(Ctx: Context) || (*i)->isUnnamedBitfield())
302 continue;
303 uint64_t Offset = BaseOffset +
304 Layout.getFieldOffset(FieldNo: idx) / Context.getCharWidth();
305 QualType FieldQTy = i->getType();
306 if (!CollectFields(BaseOffset: Offset, QTy: FieldQTy, Fields,
307 MayAlias: MayAlias || TypeHasMayAlias(QTy: FieldQTy)))
308 return false;
309 }
310 return true;
311 }
312
313 /* Otherwise, treat whatever it is as a field. */
314 uint64_t Offset = BaseOffset;
315 uint64_t Size = Context.getTypeSizeInChars(T: QTy).getQuantity();
316 llvm::MDNode *TBAAType = MayAlias ? getChar() : getTypeInfo(QTy);
317 llvm::MDNode *TBAATag = getAccessTagInfo(Info: TBAAAccessInfo(TBAAType, Size));
318 Fields.push_back(Elt: llvm::MDBuilder::TBAAStructField(Offset, Size, TBAATag));
319 return true;
320}
321
322llvm::MDNode *
323CodeGenTBAA::getTBAAStructInfo(QualType QTy) {
324 const Type *Ty = Context.getCanonicalType(T: QTy).getTypePtr();
325
326 if (llvm::MDNode *N = StructMetadataCache[Ty])
327 return N;
328
329 SmallVector<llvm::MDBuilder::TBAAStructField, 4> Fields;
330 if (CollectFields(BaseOffset: 0, QTy, Fields, MayAlias: TypeHasMayAlias(QTy)))
331 return MDHelper.createTBAAStructNode(Fields);
332
333 // For now, handle any other kind of type conservatively.
334 return StructMetadataCache[Ty] = nullptr;
335}
336
337llvm::MDNode *CodeGenTBAA::getBaseTypeInfoHelper(const Type *Ty) {
338 if (auto *TTy = dyn_cast<RecordType>(Val: Ty)) {
339 const RecordDecl *RD = TTy->getDecl()->getDefinition();
340 const ASTRecordLayout &Layout = Context.getASTRecordLayout(D: RD);
341 using TBAAStructField = llvm::MDBuilder::TBAAStructField;
342 SmallVector<TBAAStructField, 4> Fields;
343 if (const CXXRecordDecl *CXXRD = dyn_cast<CXXRecordDecl>(Val: RD)) {
344 // Handle C++ base classes. Non-virtual bases can treated a kind of
345 // field. Virtual bases are more complex and omitted, but avoid an
346 // incomplete view for NewStructPathTBAA.
347 if (CodeGenOpts.NewStructPathTBAA && CXXRD->getNumVBases() != 0)
348 return nullptr;
349 for (const CXXBaseSpecifier &B : CXXRD->bases()) {
350 if (B.isVirtual())
351 continue;
352 QualType BaseQTy = B.getType();
353 const CXXRecordDecl *BaseRD = BaseQTy->getAsCXXRecordDecl();
354 if (BaseRD->isEmpty())
355 continue;
356 llvm::MDNode *TypeNode = isValidBaseType(QTy: BaseQTy)
357 ? getBaseTypeInfo(QTy: BaseQTy)
358 : getTypeInfo(QTy: BaseQTy);
359 if (!TypeNode)
360 return nullptr;
361 uint64_t Offset = Layout.getBaseClassOffset(Base: BaseRD).getQuantity();
362 uint64_t Size =
363 Context.getASTRecordLayout(BaseRD).getDataSize().getQuantity();
364 Fields.push_back(
365 Elt: llvm::MDBuilder::TBAAStructField(Offset, Size, TypeNode));
366 }
367 // The order in which base class subobjects are allocated is unspecified,
368 // so may differ from declaration order. In particular, Itanium ABI will
369 // allocate a primary base first.
370 // Since we exclude empty subobjects, the objects are not overlapping and
371 // their offsets are unique.
372 llvm::sort(C&: Fields,
373 Comp: [](const TBAAStructField &A, const TBAAStructField &B) {
374 return A.Offset < B.Offset;
375 });
376 }
377 for (FieldDecl *Field : RD->fields()) {
378 if (Field->isZeroSize(Ctx: Context) || Field->isUnnamedBitfield())
379 continue;
380 QualType FieldQTy = Field->getType();
381 llvm::MDNode *TypeNode = isValidBaseType(QTy: FieldQTy) ?
382 getBaseTypeInfo(QTy: FieldQTy) : getTypeInfo(QTy: FieldQTy);
383 if (!TypeNode)
384 return nullptr;
385
386 uint64_t BitOffset = Layout.getFieldOffset(FieldNo: Field->getFieldIndex());
387 uint64_t Offset = Context.toCharUnitsFromBits(BitSize: BitOffset).getQuantity();
388 uint64_t Size = Context.getTypeSizeInChars(T: FieldQTy).getQuantity();
389 Fields.push_back(Elt: llvm::MDBuilder::TBAAStructField(Offset, Size,
390 TypeNode));
391 }
392
393 SmallString<256> OutName;
394 if (Features.CPlusPlus) {
395 // Don't use the mangler for C code.
396 llvm::raw_svector_ostream Out(OutName);
397 MContext.mangleCanonicalTypeName(T: QualType(Ty, 0), Out);
398 } else {
399 OutName = RD->getName();
400 }
401
402 if (CodeGenOpts.NewStructPathTBAA) {
403 llvm::MDNode *Parent = getChar();
404 uint64_t Size = Context.getTypeSizeInChars(T: Ty).getQuantity();
405 llvm::Metadata *Id = MDHelper.createString(Str: OutName);
406 return MDHelper.createTBAATypeNode(Parent, Size, Id, Fields);
407 }
408
409 // Create the struct type node with a vector of pairs (offset, type).
410 SmallVector<std::pair<llvm::MDNode*, uint64_t>, 4> OffsetsAndTypes;
411 for (const auto &Field : Fields)
412 OffsetsAndTypes.push_back(Elt: std::make_pair(x: Field.Type, y: Field.Offset));
413 return MDHelper.createTBAAStructTypeNode(Name: OutName, Fields: OffsetsAndTypes);
414 }
415
416 return nullptr;
417}
418
419llvm::MDNode *CodeGenTBAA::getBaseTypeInfo(QualType QTy) {
420 if (!isValidBaseType(QTy))
421 return nullptr;
422
423 const Type *Ty = Context.getCanonicalType(T: QTy).getTypePtr();
424
425 // nullptr is a valid value in the cache, so use find rather than []
426 auto I = BaseTypeMetadataCache.find(Val: Ty);
427 if (I != BaseTypeMetadataCache.end())
428 return I->second;
429
430 // First calculate the metadata, before recomputing the insertion point, as
431 // the helper can recursively call us.
432 llvm::MDNode *TypeNode = getBaseTypeInfoHelper(Ty);
433 LLVM_ATTRIBUTE_UNUSED auto inserted =
434 BaseTypeMetadataCache.insert(KV: {Ty, TypeNode});
435 assert(inserted.second && "BaseType metadata was already inserted");
436
437 return TypeNode;
438}
439
440llvm::MDNode *CodeGenTBAA::getAccessTagInfo(TBAAAccessInfo Info) {
441 assert(!Info.isIncomplete() && "Access to an object of an incomplete type!");
442
443 if (Info.isMayAlias())
444 Info = TBAAAccessInfo(getChar(), Info.Size);
445
446 if (!Info.AccessType)
447 return nullptr;
448
449 if (!CodeGenOpts.StructPathTBAA)
450 Info = TBAAAccessInfo(Info.AccessType, Info.Size);
451
452 llvm::MDNode *&N = AccessTagMetadataCache[Info];
453 if (N)
454 return N;
455
456 if (!Info.BaseType) {
457 Info.BaseType = Info.AccessType;
458 assert(!Info.Offset && "Nonzero offset for an access with no base type!");
459 }
460 if (CodeGenOpts.NewStructPathTBAA) {
461 return N = MDHelper.createTBAAAccessTag(BaseType: Info.BaseType, AccessType: Info.AccessType,
462 Offset: Info.Offset, Size: Info.Size);
463 }
464 return N = MDHelper.createTBAAStructTagNode(BaseType: Info.BaseType, AccessType: Info.AccessType,
465 Offset: Info.Offset);
466}
467
468TBAAAccessInfo CodeGenTBAA::mergeTBAAInfoForCast(TBAAAccessInfo SourceInfo,
469 TBAAAccessInfo TargetInfo) {
470 if (SourceInfo.isMayAlias() || TargetInfo.isMayAlias())
471 return TBAAAccessInfo::getMayAliasInfo();
472 return TargetInfo;
473}
474
475TBAAAccessInfo
476CodeGenTBAA::mergeTBAAInfoForConditionalOperator(TBAAAccessInfo InfoA,
477 TBAAAccessInfo InfoB) {
478 if (InfoA == InfoB)
479 return InfoA;
480
481 if (!InfoA || !InfoB)
482 return TBAAAccessInfo();
483
484 if (InfoA.isMayAlias() || InfoB.isMayAlias())
485 return TBAAAccessInfo::getMayAliasInfo();
486
487 // TODO: Implement the rest of the logic here. For example, two accesses
488 // with same final access types result in an access to an object of that final
489 // access type regardless of their base types.
490 return TBAAAccessInfo::getMayAliasInfo();
491}
492
493TBAAAccessInfo
494CodeGenTBAA::mergeTBAAInfoForMemoryTransfer(TBAAAccessInfo DestInfo,
495 TBAAAccessInfo SrcInfo) {
496 if (DestInfo == SrcInfo)
497 return DestInfo;
498
499 if (!DestInfo || !SrcInfo)
500 return TBAAAccessInfo();
501
502 if (DestInfo.isMayAlias() || SrcInfo.isMayAlias())
503 return TBAAAccessInfo::getMayAliasInfo();
504
505 // TODO: Implement the rest of the logic here. For example, two accesses
506 // with same final access types result in an access to an object of that final
507 // access type regardless of their base types.
508 return TBAAAccessInfo::getMayAliasInfo();
509}
510

source code of clang/lib/CodeGen/CodeGenTBAA.cpp