// // Method: calculateGraphs() // // Description: // Perform recursive bottom-up inlining of DSGraphs from callee to caller. // // Inputs: // F - The function which should have its callees' DSGraphs merged into its // own DSGraph. // Stack - The stack used for Tarjan's SCC-finding algorithm. // NextID - The nextID value used for Tarjan's SCC-finding algorithm. // ValMap - The map used for Tarjan's SCC-finding algorithm. // // Return value: // unsigned BUDataStructures::calculateGraphs (const Function *F, TarjanStack & Stack, unsigned & NextID, TarjanMap & ValMap) { assert(!ValMap.count(F) && "Shouldn't revisit functions!"); unsigned Min = NextID++, MyID = Min; ValMap[F] = Min; Stack.push_back(F); // // FIXME: This test should be generalized to be any function that we have // already processed in the case when there isn't a main() or there are // unreachable functions! // if (F->isDeclaration()) { // sprintf, fprintf, sscanf, etc... // No callees! Stack.pop_back(); ValMap[F] = ~0; return Min; } // // Get the DSGraph of the current function. Make one if one doesn't exist. // DSGraph* Graph = getOrCreateGraph(F); // // Find all callee functions. Use the DSGraph for this (do not use the call // graph (DSCallgraph) as we're still in the process of constructing it). // FuncSet CalleeFunctions; getAllAuxCallees(Graph, CalleeFunctions); // // Iterate through each call target (these are the edges out of the current // node (i.e., the current function) in Tarjan graph parlance). Find the // minimum assigned ID. // for (FuncSet::iterator I = CalleeFunctions.begin(), E = CalleeFunctions.end(); I != E; ++I) { const Function *Callee = *I; unsigned M; // // If we have not visited this callee before, visit it now (this is the // post-order component of the Bottom-Up algorithm). Otherwise, look up // the assigned ID value from the Tarjan Value Map. // TarjanMap::iterator It = ValMap.find(Callee); if (It == ValMap.end()) // No, visit it now. M = calculateGraphs(Callee, Stack, NextID, ValMap); else // Yes, get it's number. M = It->second; // // If we've found a function with a smaller ID than this funtion, record // that ID as the minimum ID. // if (M < Min) Min = M; } assert(ValMap[F] == MyID && "SCC construction assumption wrong!"); // // If the minimum ID found is not this function's ID, then this function is // part of a larger SCC. // if (Min != MyID) return Min; // // If this is a new SCC, process it now. // if (Stack.back() == F) { // Special case the single "SCC" case here. DEBUG(errs() << "Visiting single node SCC #: " << MyID << " fn: " << F->getName() << "\n"); Stack.pop_back(); DEBUG(errs() << " [BU] Calculating graph for: " << F->getName()<< "\n"); DSGraph* G = getOrCreateGraph(F); calculateGraph(G); DEBUG(errs() << " [BU] Done inlining: " << F->getName() << " [" << G->getGraphSize() << "+" << G->getAuxFunctionCalls().size() << "]\n"); if (MaxSCC < 1) MaxSCC = 1; // // Should we revisit the graph? Only do it if there are now new resolvable // callees. FuncSet NewCallees; getAllAuxCallees(G, NewCallees); if (!NewCallees.empty()) { if (hasNewCallees(NewCallees, CalleeFunctions)) { DEBUG(errs() << "Recalculating " << F->getName() << " due to new knowledge\n"); ValMap.erase(F); ++NumRecalculations; return calculateGraphs(F, Stack, NextID, ValMap); } ++NumRecalculationsSkipped; } ValMap[F] = ~0U; return MyID; } else { unsigned SCCSize = 1; const Function *NF = Stack.back(); if(NF != F) ValMap[NF] = ~0U; DSGraph* SCCGraph = getDSGraph(*NF); // // First thing first: collapse all of the DSGraphs into a single graph for // the entire SCC. Splice all of the graphs into one and discard all of // the old graphs. // while (NF != F) { Stack.pop_back(); NF = Stack.back(); if(NF != F) ValMap[NF] = ~0U; DSGraph* NFG = getDSGraph(*NF); if (NFG != SCCGraph) { // Update the Function -> DSG map. for (DSGraph::retnodes_iterator I = NFG->retnodes_begin(), E = NFG->retnodes_end(); I != E; ++I) setDSGraph(*I->first, SCCGraph); SCCGraph->spliceFrom(NFG); delete NFG; ++SCCSize; } } Stack.pop_back(); DEBUG(errs() << "Calculating graph for SCC #: " << MyID << " of size: " << SCCSize << "\n"); // Compute the Max SCC Size. if (MaxSCC < SCCSize) MaxSCC = SCCSize; // Clean up the graph before we start inlining a bunch again... SCCGraph->removeDeadNodes(DSGraph::KeepUnreachableGlobals); // Now that we have one big happy family, resolve all of the call sites in // the graph... calculateGraph(SCCGraph); DEBUG(errs() << " [BU] Done inlining SCC [" << SCCGraph->getGraphSize() << "+" << SCCGraph->getAuxFunctionCalls().size() << "]\n" << "DONE with SCC #: " << MyID << "\n"); FuncSet NewCallees; getAllAuxCallees(SCCGraph, NewCallees); if (!NewCallees.empty()) { if (hasNewCallees(NewCallees, CalleeFunctions)) { DEBUG(errs() << "Recalculating SCC Graph " << F->getName() << " due to new knowledge\n"); ValMap.erase(F); ++NumRecalculations; return calculateGraphs(F, Stack, NextID, ValMap); } ++NumRecalculationsSkipped; } ValMap[F] = ~0U; return MyID; } }
// // Method: postOrderInline() // // Description: // This methods does a post order traversal of the call graph and performs // bottom-up inlining of the DSGraphs. // void BUDataStructures::postOrderInline (Module & M) { // Variables used for Tarjan SCC-finding algorithm. These are passed into // the recursive function used to find SCCs. std::vector<const Function*> Stack; std::map<const Function*, unsigned> ValMap; unsigned NextID = 1; // Do post order traversal on the global ctors. Use this information to update // the globals graph. const char *Name = "llvm.global_ctors"; GlobalVariable *GV = M.getNamedGlobal(Name); if (GV && !(GV->isDeclaration()) && !(GV->hasLocalLinkage())) { // Should be an array of '{ int, void ()* }' structs. The first value is // the init priority, which we ignore. ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer()); if (InitList) { for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) if (ConstantStruct *CS = dyn_cast<ConstantStruct>(InitList->getOperand(i))) { if (CS->getNumOperands() != 2) break; // Not array of 2-element structs. Constant *FP = CS->getOperand(1); if (FP->isNullValue()) break; // Found a null terminator, exit. if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP)) if (CE->isCast()) FP = CE->getOperand(0); Function *F = dyn_cast<Function>(FP); if (F && !F->isDeclaration() && !ValMap.count(F)) { calculateGraphs(F, Stack, NextID, ValMap); CloneAuxIntoGlobal(getDSGraph(*F)); } } GlobalsGraph->removeTriviallyDeadNodes(); GlobalsGraph->maskIncompleteMarkers(); // Mark external globals incomplete. GlobalsGraph->markIncompleteNodes(DSGraph::IgnoreGlobals); GlobalsGraph->computeExternalFlags(DSGraph::DontMarkFormalsExternal); GlobalsGraph->computeIntPtrFlags(); // // Create equivalence classes for aliasing globals so that we only need to // record one global per DSNode. // formGlobalECs(); // propogte information calculated // from the globals graph to the other graphs. for (Module::iterator F = M.begin(); F != M.end(); ++F) { if (!(F->isDeclaration())){ DSGraph *Graph = getDSGraph(*F); cloneGlobalsInto(Graph, DSGraph::DontCloneCallNodes | DSGraph::DontCloneAuxCallNodes); Graph->buildCallGraph(callgraph, GlobalFunctionList, filterCallees); Graph->maskIncompleteMarkers(); Graph->markIncompleteNodes(DSGraph::MarkFormalArgs | DSGraph::IgnoreGlobals); Graph->computeExternalFlags(DSGraph::DontMarkFormalsExternal); Graph->computeIntPtrFlags(); } } } } // // Start the post order traversal with the main() function. If there is no // main() function, don't worry; we'll have a separate traversal for inlining // graphs for functions not reachable from main(). // Function *MainFunc = M.getFunction ("main"); if (MainFunc && !MainFunc->isDeclaration()) { calculateGraphs(MainFunc, Stack, NextID, ValMap); CloneAuxIntoGlobal(getDSGraph(*MainFunc)); } // // Calculate the graphs for any functions that are unreachable from main... // for (Function &F : M) if (!F.isDeclaration() && !ValMap.count(&F)) { if (MainFunc) DEBUG(errs() << debugname << ": Function unreachable from main: " << F.getName() << "\n"); calculateGraphs(&F, Stack, NextID, ValMap); // Calculate all graphs. CloneAuxIntoGlobal(getDSGraph(F)); // Mark this graph as processed. Do this by finding all functions // in the graph that map to it, and mark them visited. // Note that this really should be handled neatly by calculateGraphs // itself, not here. However this catches the worst offenders. DSGraph *G = getDSGraph(F); for(DSGraph::retnodes_iterator RI = G->retnodes_begin(), RE = G->retnodes_end(); RI != RE; ++RI) { if (getDSGraph(*RI->first) == G) { if (!ValMap.count(RI->first)) ValMap[RI->first] = ~0U; else assert(ValMap[RI->first] == ~0U); } } } return; }
static void printCollection(const Collection &C, llvm::raw_ostream &O, const Module *M, const std::string &Prefix) { if (M == 0) { O << "Null Module pointer, cannot continue!\n"; return; } unsigned TotalNumNodes = 0, TotalCallNodes = 0; for (Module::const_iterator I = M->begin(), E = M->end(); I != E; ++I) if (C.hasDSGraph(*I)) { DSGraph* Gr = C.getDSGraph((const Function&)*I); unsigned NumCalls = Gr->shouldUseAuxCalls() ? Gr->getAuxFunctionCalls().size() : Gr->getFunctionCalls().size(); bool IsDuplicateGraph = false; //if no only print options, print everything bool doPrint = OnlyPrint.begin() == OnlyPrint.end(); //otherwise check the name if (!doPrint) doPrint = OnlyPrint.end() != std::find(OnlyPrint.begin(), OnlyPrint.end(), I->getName().str()); if (doPrint) { const Function *SCCFn = Gr->retnodes_begin()->first; if (&*I == SCCFn) { Gr->writeGraphToFile(O, Prefix+I->getName().str()); } else { IsDuplicateGraph = true; // Don't double count node/call nodes. O << "Didn't write '" << Prefix+I->getName().str() << ".dot' - Graph already emitted to '" << Prefix+SCCFn->getName().str() << "\n"; } } else { const Function *SCCFn = Gr->retnodes_begin()->first; if (&*I == SCCFn) { //O << "Skipped Writing '" << Prefix+I->getName().str() << ".dot'... [" // << Gr->getGraphSize() << "+" << NumCalls << "]\n"; } else { IsDuplicateGraph = true; // Don't double count node/call nodes. } } if (!IsDuplicateGraph) { unsigned GraphSize = Gr->getGraphSize(); if (MaxGraphSize < GraphSize) MaxGraphSize = GraphSize; TotalNumNodes += Gr->getGraphSize(); TotalCallNodes += NumCalls; for (DSGraph::node_iterator NI = Gr->node_begin(), E = Gr->node_end(); NI != E; ++NI) if (NI->isNodeCompletelyFolded()) ++NumFoldedNodes; } } DSGraph* GG = C.getGlobalsGraph(); TotalNumNodes += GG->getGraphSize(); TotalCallNodes += GG->getFunctionCalls().size(); GG->writeGraphToFile(O, Prefix + "GlobalsGraph"); O << "\nGraphs contain [" << TotalNumNodes << "+" << TotalCallNodes << "] nodes total\n"; }
/// visitGraph - Visit the functions in the specified graph, updating the /// specified lattice values for all of their uses. /// void StructureFieldVisitorBase:: visitGraph(DSGraph &DSG, std::multimap<DSNode*, LatticeValue*> &NodeLVs) { assert(!NodeLVs.empty() && "No lattice values to compute!"); // To visit a graph, first step, we visit the instruction making up each // function in the graph, but ignore calls when processing them. We handle // call nodes explicitly by looking at call nodes in the graph if needed. We // handle instructions before calls to avoid interprocedural analysis if we // can drive lattice values to bottom early. // SFVInstVisitor IV(DSG, Callbacks, NodeLVs); for (DSGraph::retnodes_iterator FI = DSG.retnodes_begin(), E = DSG.retnodes_end(); FI != E; ++FI) for (Function::iterator BB = FI->first->begin(), E = FI->first->end(); BB != E; ++BB) for (BasicBlock::iterator I = BB->begin(), E = BB->end(); I != E; ++I) if (IV.visit(*I) && NodeLVs.empty()) return; // Nothing left to analyze. // Keep track of which actual direct callees are handled. std::set<Function*> CalleesHandled; // Once we have visited all of the instructions in the function bodies, if // there are lattice values that have not been driven to bottom, see if any of // the nodes involved are passed into function calls. If so, we potentially // have to recursively traverse the call graph. for (DSGraph::fc_iterator CS = DSG.fc_begin(), E = DSG.fc_end(); CS != E; ++CS) { // Figure out the mapping from a node in the caller (potentially several) // nodes in the callee. DSGraph::NodeMapTy CallNodeMap; Instruction *TheCall = CS->getCallSite().getInstruction(); // If this is an indirect function call, assume nothing gets passed through // it. FIXME: THIS IS BROKEN! Just get the ECG for the fn ptr if it's not // direct. if (CS->isIndirectCall()) continue; // If this is an external function call, it cannot be involved with this // node, because otherwise the node would be marked incomplete! if (CS->getCalleeFunc()->isExternal()) continue; // If we can handle this function call, remove it from the set of direct // calls found by the visitor. CalleesHandled.insert(CS->getCalleeFunc()); std::vector<DSNodeHandle> Args; DSGraph *CG = &ECG.getDSGraph(*CS->getCalleeFunc()); CG->getFunctionArgumentsForCall(CS->getCalleeFunc(), Args); if (!CS->getRetVal().isNull()) DSGraph::computeNodeMapping(Args[0], CS->getRetVal(), CallNodeMap); for (unsigned i = 0, e = CS->getNumPtrArgs(); i != e; ++i) { if (i == Args.size()-1) break; DSGraph::computeNodeMapping(Args[i+1], CS->getPtrArg(i), CallNodeMap); } Args.clear(); // The mapping we just computed maps from nodes in the callee to nodes in // the caller, so we can't query it efficiently. Instead of going through // the trouble of inverting the map to do this (linear time with the size of // the mapping), we just do a linear search to see if any affected nodes are // passed into this call. bool CallCanModifyDataFlow = false; for (DSGraph::NodeMapTy::iterator MI = CallNodeMap.begin(), E = CallNodeMap.end(); MI != E; ++MI) if (NodeLVs.count(MI->second.getNode())) // Okay, the node is passed in, check to see if the call might do // something interesting to it (i.e. if analyzing the call can produce // anything other than "top"). if ((CallCanModifyDataFlow = NodeCanPossiblyBeInteresting(MI->first, Callbacks))) break; // If this function call cannot impact the analysis (either because the // nodes we are tracking are not passed into the call, or the DSGraph for // the callee tells us that analysis of the callee can't provide interesting // information), ignore it. if (!CallCanModifyDataFlow) continue; // Okay, either compute analysis results for the callee function, or reuse // results previously computed. std::multimap<DSNode*, LatticeValue*> &CalleeFacts = getCalleeFacts(*CG); // Merge all of the facts for the callee into the facts for the caller. If // this reduces anything in the caller to 'bottom', remove them. for (DSGraph::NodeMapTy::iterator MI = CallNodeMap.begin(), E = CallNodeMap.end(); MI != E; ++MI) { // If we have Lattice facts in the caller for this node in the callee, // merge any information from the callee into the caller. // If the node is not accessed in the callee at all, don't update. if (MI->first->getType() == Type::VoidTy) continue; // If there are no data-flow facts live in the caller for this node, don't // both processing it. std::multimap<DSNode*, LatticeValue*>::iterator NLVI = NodeLVs.find(MI->second.getNode()); if (NLVI == NodeLVs.end()) continue; // Iterate over all of the lattice values that have corresponding fields // in the callee, merging in information as we go. Be careful about the // fact that the callee may get passed the address of a substructure and // other funny games. //if (CalleeFacts.count(const_cast<DSNode*>(MI->first)) == 0) { DSNode *CalleeNode = const_cast<DSNode*>(MI->first); unsigned CalleeNodeOffset = MI->second.getOffset(); while (NLVI->first == MI->second.getNode()) { // Figure out what offset in the callee this field would land. unsigned FieldOff = NLVI->second->getFieldOffset()+CalleeNodeOffset; // If the field is not within the callee node, ignore it. if (FieldOff >= CalleeNode->getSize()) { ++NLVI; continue; } // Okay, check to see if we have a lattice value for the field at offset // FieldOff in the callee node. const LatticeValue *CalleeLV = 0; std::multimap<DSNode*, LatticeValue*>::iterator CFI = CalleeFacts.lower_bound(CalleeNode); for (; CFI != CalleeFacts.end() && CFI->first == CalleeNode; ++CFI) if (CFI->second->getFieldOffset() == FieldOff) { CalleeLV = CFI->second; // Found it! break; } // If we don't, the lattice value hit bottom and we should remove the // lattice value in the caller. if (!CalleeLV) { delete NLVI->second; // The lattice value hit bottom. NodeLVs.erase(NLVI++); continue; } // Finally, if we did find a corresponding entry, merge the information // into the caller's lattice value and keep going. if (NLVI->second->mergeInValue(CalleeLV)) { // Okay, merging these two caused the caller value to hit bottom. // Remove it. delete NLVI->second; // The lattice value hit bottom. NodeLVs.erase(NLVI++); } ++NLVI; // We successfully merged in some information! } // If we ran out of facts to prove, just exit. if (NodeLVs.empty()) return; } } // The local analysis pass inconveniently discards many local function calls // from the graph if they are to known functions. Loop over direct function // calls not handled above and visit them as appropriate. while (!IV.DirectCallSites.empty()) { Instruction *Call = *IV.DirectCallSites.begin(); IV.DirectCallSites.erase(IV.DirectCallSites.begin()); // Is this one actually handled by DSA? if (CalleesHandled.count(cast<Function>(Call->getOperand(0)))) continue; // Collect the pointers involved in this call. std::vector<Value*> Pointers; if (isa<PointerType>(Call->getType())) Pointers.push_back(Call); for (unsigned i = 1, e = Call->getNumOperands(); i != e; ++i) if (isa<PointerType>(Call->getOperand(i)->getType())) Pointers.push_back(Call->getOperand(i)); // If this is an intrinsic function call, figure out which one. unsigned IID = cast<Function>(Call->getOperand(0))->getIntrinsicID(); for (unsigned i = 0, e = Pointers.size(); i != e; ++i) { // If any of our lattice values are passed into this call, which is // specially handled by the local analyzer, inform the lattice function. DSNode *N = DSG.getNodeForValue(Pointers[i]).getNode(); for (std::multimap<DSNode*, LatticeValue*>::iterator LVI = NodeLVs.lower_bound(N); LVI != NodeLVs.end() && LVI->first == N;) { bool AtBottom = false; switch (IID) { default: AtBottom = LVI->second->visitRecognizedCall(*Call); break; case Intrinsic::memset: if (Callbacks & Visit::Stores) AtBottom = LVI->second->visitMemSet(*cast<CallInst>(Call)); break; } if (AtBottom) { delete LVI->second; NodeLVs.erase(LVI++); } else { ++LVI; } } } } }
unsigned BUDataStructures::calculateGraphs(const Function *F, std::vector<const Function*> &Stack, unsigned &NextID, hash_map<const Function*, unsigned> &ValMap) { assert(!ValMap.count(F) && "Shouldn't revisit functions!"); unsigned Min = NextID++, MyID = Min; ValMap[F] = Min; Stack.push_back(F); // FIXME! This test should be generalized to be any function that we have // already processed, in the case when there isn't a main or there are // unreachable functions! if (F->isDeclaration()) { // sprintf, fprintf, sscanf, etc... // No callees! Stack.pop_back(); ValMap[F] = ~0; return Min; } DSGraph* Graph = getOrFetchDSGraph(F); // Find all callee functions. std::vector<const Function*> CalleeFunctions; GetAllAuxCallees(Graph, CalleeFunctions); std::sort(CalleeFunctions.begin(), CalleeFunctions.end()); std::vector<const Function*>::iterator uid = std::unique(CalleeFunctions.begin(), CalleeFunctions.end()); CalleeFunctions.resize(uid - CalleeFunctions.begin()); // The edges out of the current node are the call site targets... for (unsigned i = 0, e = CalleeFunctions.size(); i != e; ++i) { const Function *Callee = CalleeFunctions[i]; unsigned M; // Have we visited the destination function yet? hash_map<const Function*, unsigned>::iterator It = ValMap.find(Callee); if (It == ValMap.end()) // No, visit it now. M = calculateGraphs(Callee, Stack, NextID, ValMap); else // Yes, get it's number. M = It->second; if (M < Min) Min = M; } assert(ValMap[F] == MyID && "SCC construction assumption wrong!"); if (Min != MyID) return Min; // This is part of a larger SCC! // If this is a new SCC, process it now. if (Stack.back() == F) { // Special case the single "SCC" case here. DEBUG(errs() << "Visiting single node SCC #: " << MyID << " fn: " << F->getName() << "\n"); Stack.pop_back(); DEBUG(errs() << " [BU] Calculating graph for: " << F->getName()<< "\n"); calculateGraph(Graph); DEBUG(errs() << " [BU] Done inlining: " << F->getName() << " [" << Graph->getGraphSize() << "+" << Graph->getAuxFunctionCalls().size() << "]\n"); if (MaxSCC < 1) MaxSCC = 1; // Should we revisit the graph? Only do it if there are now new resolvable // callees or new callees GetAllAuxCallees(Graph, CalleeFunctions); if (CalleeFunctions.size()) { DEBUG(errs() << "Recalculating " << F->getName() << " due to new knowledge\n"); ValMap.erase(F); return calculateGraphs(F, Stack, NextID, ValMap); } else { ValMap[F] = ~0U; return MyID; } } else { // SCCFunctions - Keep track of the functions in the current SCC // std::vector<DSGraph*> SCCGraphs; unsigned SCCSize = 1; const Function *NF = Stack.back(); ValMap[NF] = ~0U; DSGraph* SCCGraph = getDSGraph(NF); // First thing first, collapse all of the DSGraphs into a single graph for // the entire SCC. Splice all of the graphs into one and discard all of the // old graphs. // while (NF != F) { Stack.pop_back(); NF = Stack.back(); ValMap[NF] = ~0U; DSGraph* NFG = getDSGraph(NF); if (NFG != SCCGraph) { // Update the Function -> DSG map. for (DSGraph::retnodes_iterator I = NFG->retnodes_begin(), E = NFG->retnodes_end(); I != E; ++I) setDSGraph(I->first, SCCGraph); SCCGraph->spliceFrom(NFG); delete NFG; ++SCCSize; } } Stack.pop_back(); DEBUG(errs() << "Calculating graph for SCC #: " << MyID << " of size: " << SCCSize << "\n"); // Compute the Max SCC Size. if (MaxSCC < SCCSize) MaxSCC = SCCSize; // Clean up the graph before we start inlining a bunch again... SCCGraph->removeDeadNodes(DSGraph::KeepUnreachableGlobals); // Now that we have one big happy family, resolve all of the call sites in // the graph... calculateGraph(SCCGraph); DEBUG(errs() << " [BU] Done inlining SCC [" << SCCGraph->getGraphSize() << "+" << SCCGraph->getAuxFunctionCalls().size() << "]\n" << "DONE with SCC #: " << MyID << "\n"); // We never have to revisit "SCC" processed functions... return MyID; } return MyID; // == Min }