commit | bf6986f9f09f79da38006a83c339226c429bb686 | [log] [tgz] |
---|---|---|
author | Camsyn <camsyn@foxmail.com> | Thu Apr 17 16:09:07 2025 +0800 |
committer | GitHub <noreply@github.com> | Thu Apr 17 10:09:07 2025 +0200 |
tree | aefdf84937933a296becc3e3c44a0bf88120cf0d | |
parent | f351172d4a840dfbf533319b62925747a10b762f [diff] |
[TSan, SanitizerBinaryMetadata] Improve instrument for derived pointers via phis/selects (#132752) ThreadSanitizer.cpp and SanitizerBinaryMetadata.cpp previously used `getUnderlyingObject` to check if pointers originate from stack objects. However, `getUnderlyingObject()` by default only looks through linear chains, not selects/phis. In particular, this means that we miss cases involving pointer induction variables. For instance, ```llvm %stkobj = alloca [2 x i32], align 8 ; getUnderlyingObject(%derived) = %derived %derived = getelementptr inbounds i32, ptr %stkobj, i64 1 ``` This will result in redundant instrumentation of TSan, resulting in greater performance costs, especially when there are loops, referring to this [godbolt page](https://godbolt.org/z/eaT1fPjTW) for details. ```cpp char loop(int x) { char buf[10]; char *p = buf; for (int i = 0; i < x && i < 10; i++) { // Should not instrument, as its base object is a non-captured stack // variable. // However, currectly, it is instrumented due to %p = %phi ... *p++ = i; } // Use buf to prevent it from being eliminated by optimization return buf[9]; } ``` There are TWO APIs `getUnderlyingObjectAggressive` and `findAllocaForValue` that can backtrack the pointer via tree traversal, supporting phis/selects. This patch replaces `getUnderlyingObject` with `findAllocaForValue` which: 1. Properly tracks through PHINodes and select operations 2. Directly identifies if a pointer comes from a `AllocaInst` Performance impact: - Compilation: Moderate cost increase due to wider value tracing, but... - Runtime: Significant wins for code with pointer induction variables derived from stack allocas, especially for loop-heavy code, as instrumentation can now be safely omitted.
Welcome to the LLVM project!
This repository contains the source code for LLVM, a toolkit for the construction of highly optimized compilers, optimizers, and run-time environments.
The LLVM project has multiple components. The core of the project is itself called “LLVM”. This contains all of the tools, libraries, and header files needed to process intermediate representations and convert them into object files. Tools include an assembler, disassembler, bitcode analyzer, and bitcode optimizer.
C-like languages use the Clang frontend. This component compiles C, C++, Objective-C, and Objective-C++ code into LLVM bitcode -- and from there into object files, using LLVM.
Other components include: the libc++ C++ standard library, the LLD linker, and more.
Consult the Getting Started with LLVM page for information on building and running LLVM.
For information on how to contribute to the LLVM project, please take a look at the Contributing to LLVM guide.
Join the LLVM Discourse forums, Discord chat, LLVM Office Hours or Regular sync-ups.
The LLVM project has adopted a code of conduct for participants to all modes of communication within the project.