1 /* String length optimization
2 Copyright (C) 2011-2020 Free Software Foundation, Inc.
3 Contributed by Jakub Jelinek <jakub@redhat.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3, or (at your option)
12 GCC is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
23 #include "coretypes.h"
28 #include "alloc-pool.h"
29 #include "tree-pass.h"
32 #include "gimple-pretty-print.h"
33 #include "gimple-ssa-warn-restrict.h"
34 #include "fold-const.h"
35 #include "stor-layout.h"
36 #include "gimple-fold.h"
39 #include "gimple-iterator.h"
40 #include "gimplify-me.h"
45 #include "tree-ssa-alias.h"
46 #include "tree-ssa-propagate.h"
47 #include "tree-ssa-strlen.h"
48 #include "tree-hash-traits.h"
49 #include "tree-object-size.h"
52 #include "diagnostic-core.h"
53 #include "diagnostic.h"
58 #include "tree-ssa-loop.h"
59 #include "tree-scalar-evolution.h"
61 #include "vr-values.h"
62 #include "gimple-ssa-evrp-analyze.h"
64 /* A vector indexed by SSA_NAME_VERSION. 0 means unknown, positive value
65 is an index into strinfo vector, negative value stands for
66 string length of a string literal (~strlen). */
67 static vec
<int> ssa_ver_to_stridx
;
69 /* Number of currently active string indexes plus one. */
70 static int max_stridx
;
72 /* Set to true to optimize, false when just checking. */
73 static bool strlen_optimize
;
75 /* String information record. */
78 /* Number of leading characters that are known to be nonzero. This is
79 also the length of the string if FULL_STRING_P.
81 The values in a list of related string pointers must be consistent;
82 that is, if strinfo B comes X bytes after strinfo A, it must be
83 the case that A->nonzero_chars == X + B->nonzero_chars. */
85 /* Any of the corresponding pointers for querying alias oracle. */
87 /* STMT is used for two things:
89 - To record the statement that should be used for delayed length
90 computations. We maintain the invariant that all related strinfos
91 have delayed lengths or none do.
93 - To record the malloc or calloc call that produced this result
94 to optimize away malloc/memset sequences. STMT is reset after
95 a calloc-allocated object has been stored a non-zero value into. */
97 /* Set to the dynamic allocation statement for the object (alloca,
98 calloc, malloc, or VLA). Unlike STMT, once set for a strinfo
99 object, ALLOC doesn't change. */
101 /* Pointer to '\0' if known, if NULL, it can be computed as
104 /* Reference count. Any changes to strinfo entry possibly shared
105 with dominating basic blocks need unshare_strinfo first, except
106 for dont_invalidate which affects only the immediately next
109 /* Copy of index. get_strinfo (si->idx) should return si; */
111 /* These 3 fields are for chaining related string pointers together.
113 bl = strlen (b); dl = strlen (d); strcpy (a, b); c = a + bl;
114 strcpy (c, d); e = c + dl;
115 strinfo(a) -> strinfo(c) -> strinfo(e)
116 All have ->first field equal to strinfo(a)->idx and are doubly
117 chained through prev/next fields. The later strinfos are required
118 to point into the same string with zero or more bytes after
119 the previous pointer and all bytes in between the two pointers
120 must be non-zero. Functions like strcpy or memcpy are supposed
121 to adjust all previous strinfo lengths, but not following strinfo
122 lengths (those are uncertain, usually invalidated during
123 maybe_invalidate, except when the alias oracle knows better).
124 Functions like strcat on the other side adjust the whole
125 related strinfo chain.
126 They are updated lazily, so to use the chain the same first fields
127 and si->prev->next == si->idx needs to be verified. */
131 /* A flag whether the string is known to be written in the current
134 /* A flag for the next maybe_invalidate that this strinfo shouldn't
135 be invalidated. Always cleared by maybe_invalidate. */
136 bool dont_invalidate
;
137 /* True if the string is known to be nul-terminated after NONZERO_CHARS
138 characters. False is useful when detecting strings that are built
139 up via successive memcpys. */
143 /* Pool for allocating strinfo_struct entries. */
144 static object_allocator
<strinfo
> strinfo_pool ("strinfo pool");
146 /* Vector mapping positive string indexes to strinfo, for the
147 current basic block. The first pointer in the vector is special,
148 it is either NULL, meaning the vector isn't shared, or it is
149 a basic block pointer to the owner basic_block if shared.
150 If some other bb wants to modify the vector, the vector needs
151 to be unshared first, and only the owner bb is supposed to free it. */
152 static vec
<strinfo
*, va_heap
, vl_embed
> *stridx_to_strinfo
;
154 /* One OFFSET->IDX mapping. */
157 struct stridxlist
*next
;
158 HOST_WIDE_INT offset
;
162 /* Hash table entry, mapping a DECL to a chain of OFFSET->IDX mappings. */
163 struct decl_stridxlist_map
165 struct tree_map_base base
;
166 struct stridxlist list
;
169 /* Hash table for mapping decls to a chained list of offset -> idx
171 typedef hash_map
<tree_decl_hash
, stridxlist
> decl_to_stridxlist_htab_t
;
172 static decl_to_stridxlist_htab_t
*decl_to_stridxlist_htab
;
174 /* Hash table mapping strlen (or strnlen with constant bound and return
175 smaller than bound) calls to stridx instances describing
176 the calls' arguments. Non-null only when warn_stringop_truncation
178 typedef std::pair
<int, location_t
> stridx_strlenloc
;
179 static hash_map
<tree
, stridx_strlenloc
> *strlen_to_stridx
;
181 /* Obstack for struct stridxlist and struct decl_stridxlist_map. */
182 static struct obstack stridx_obstack
;
184 /* Last memcpy statement if it could be adjusted if the trailing
185 '\0' written is immediately overwritten, or
186 *x = '\0' store that could be removed if it is immediately overwritten. */
187 struct laststmt_struct
194 static int get_stridx_plus_constant (strinfo
*, unsigned HOST_WIDE_INT
, tree
);
195 static void handle_builtin_stxncpy (built_in_function
, gimple_stmt_iterator
*);
197 /* Sets MINMAX to either the constant value or the range VAL is in
198 and returns either the constant value or VAL on success or null
199 when the range couldn't be determined. Uses RVALS when nonnull
200 to determine the range, otherwise get_range_info. */
203 get_range (tree val
, wide_int minmax
[2], const vr_values
*rvals
/* = NULL */)
205 if (TREE_CODE (val
) == INTEGER_CST
)
207 minmax
[0] = minmax
[1] = wi::to_wide (val
);
211 if (TREE_CODE (val
) != SSA_NAME
)
216 /* The range below may be "inaccurate" if a constant has been
217 substituted earlier for VAL by this pass that hasn't been
218 propagated through the CFG. This shoud be fixed by the new
219 on-demand VRP if/when it becomes available (hopefully in
221 const value_range
*vr
222 = (CONST_CAST (class vr_values
*, rvals
)->get_value_range (val
));
223 value_range_kind rng
= vr
->kind ();
224 if (rng
!= VR_RANGE
|| !range_int_cst_p (vr
))
227 minmax
[0] = wi::to_wide (vr
->min ());
228 minmax
[1] = wi::to_wide (vr
->max ());
232 value_range_kind rng
= get_range_info (val
, minmax
, minmax
+ 1);
236 /* Do not handle anti-ranges and instead make use of the on-demand
237 VRP if/when it becomes available (hopefully in GCC 11). */
243 * +1 if SI is known to start with more than OFF nonzero characters.
245 * 0 if SI is known to start with exactly OFF nonzero characters.
247 * -1 if SI either does not start with OFF nonzero characters
248 or the relationship between the number of leading nonzero
249 characters in SI and OFF is unknown. */
252 compare_nonzero_chars (strinfo
*si
, unsigned HOST_WIDE_INT off
)
254 if (si
->nonzero_chars
255 && TREE_CODE (si
->nonzero_chars
) == INTEGER_CST
)
256 return compare_tree_int (si
->nonzero_chars
, off
);
261 /* Same as above but suitable also for strings with non-constant lengths.
262 Uses RVALS to determine length range. */
265 compare_nonzero_chars (strinfo
*si
, unsigned HOST_WIDE_INT off
,
266 const vr_values
*rvals
)
268 if (!si
->nonzero_chars
)
271 if (TREE_CODE (si
->nonzero_chars
) == INTEGER_CST
)
272 return compare_tree_int (si
->nonzero_chars
, off
);
274 if (!rvals
|| TREE_CODE (si
->nonzero_chars
) != SSA_NAME
)
277 const value_range_equiv
*vr
278 = (CONST_CAST (class vr_values
*, rvals
)
279 ->get_value_range (si
->nonzero_chars
));
281 value_range_kind rng
= vr
->kind ();
282 if (rng
!= VR_RANGE
|| !range_int_cst_p (vr
))
285 /* If the offset is less than the minimum length or if the bounds
286 of the length range are equal return the result of the comparison
287 same as in the constant case. Otherwise return a conservative
289 int cmpmin
= compare_tree_int (vr
->min (), off
);
290 if (cmpmin
> 0 || tree_int_cst_equal (vr
->min (), vr
->max ()))
296 /* Return true if SI is known to be a zero-length string. */
299 zero_length_string_p (strinfo
*si
)
301 return si
->full_string_p
&& integer_zerop (si
->nonzero_chars
);
304 /* Return strinfo vector entry IDX. */
306 static inline strinfo
*
307 get_strinfo (int idx
)
309 if (vec_safe_length (stridx_to_strinfo
) <= (unsigned int) idx
)
311 return (*stridx_to_strinfo
)[idx
];
314 /* Get the next strinfo in the chain after SI, or null if none. */
316 static inline strinfo
*
317 get_next_strinfo (strinfo
*si
)
321 strinfo
*nextsi
= get_strinfo (si
->next
);
322 if (nextsi
== NULL
|| nextsi
->first
!= si
->first
|| nextsi
->prev
!= si
->idx
)
327 /* Helper function for get_stridx. Return the strinfo index of the address
328 of EXP, which is available in PTR if nonnull. If OFFSET_OUT, it is
329 OK to return the index for some X <= &EXP and store &EXP - X in
330 *OFFSET_OUT. When nonnull uses RVALS to determine range information. */
333 get_addr_stridx (tree exp
, tree ptr
, unsigned HOST_WIDE_INT
*offset_out
,
334 const vr_values
*rvals
= NULL
)
337 struct stridxlist
*list
, *last
= NULL
;
340 if (!decl_to_stridxlist_htab
)
344 base
= get_addr_base_and_unit_offset (exp
, &poff
);
345 if (base
== NULL
|| !DECL_P (base
) || !poff
.is_constant (&off
))
348 list
= decl_to_stridxlist_htab
->get (base
);
354 if (list
->offset
== off
)
360 if (list
->offset
> off
)
367 if ((offset_out
|| ptr
) && last
&& last
->idx
> 0)
369 unsigned HOST_WIDE_INT rel_off
370 = (unsigned HOST_WIDE_INT
) off
- last
->offset
;
371 strinfo
*si
= get_strinfo (last
->idx
);
372 if (si
&& compare_nonzero_chars (si
, rel_off
, rvals
) >= 0)
376 *offset_out
= rel_off
;
380 return get_stridx_plus_constant (si
, rel_off
, ptr
);
386 /* Returns string index for EXP. When EXP is an SSA_NAME that refers
387 to a known strinfo with an offset and OFFRNG is non-null, sets
388 both elements of the OFFRNG array to the range of the offset and
389 returns the index of the known strinfo. In this case the result
390 must not be used in for functions that modify the string.
391 When nonnull, uses RVALS to determine range information. */
394 get_stridx (tree exp
, wide_int offrng
[2] = NULL
, const vr_values
*rvals
= NULL
)
397 offrng
[0] = offrng
[1] = wi::zero (TYPE_PRECISION (ptrdiff_type_node
));
399 if (TREE_CODE (exp
) == SSA_NAME
)
401 if (ssa_ver_to_stridx
[SSA_NAME_VERSION (exp
)])
402 return ssa_ver_to_stridx
[SSA_NAME_VERSION (exp
)];
406 HOST_WIDE_INT offset
= 0;
407 /* Follow a chain of at most 5 assignments. */
408 for (int i
= 0; i
< 5; i
++)
410 gimple
*def_stmt
= SSA_NAME_DEF_STMT (e
);
411 if (!is_gimple_assign (def_stmt
))
414 tree_code rhs_code
= gimple_assign_rhs_code (def_stmt
);
417 if (rhs_code
== ADDR_EXPR
)
419 /* Handle indices/offsets into VLAs which are implemented
420 as pointers to arrays. */
421 ptr
= gimple_assign_rhs1 (def_stmt
);
422 ptr
= TREE_OPERAND (ptr
, 0);
424 /* Handle also VLAs of types larger than char. */
425 if (tree eltsize
= TYPE_SIZE_UNIT (TREE_TYPE (ptr
)))
427 if (TREE_CODE (ptr
) == ARRAY_REF
)
429 off
= TREE_OPERAND (ptr
, 1);
430 ptr
= TREE_OPERAND (ptr
, 0);
431 if (!integer_onep (eltsize
))
433 /* Scale the array index by the size of the element
434 type in the rare case that it's greater than
435 the typical 1 for char, making sure both operands
436 have the same type. */
437 eltsize
= fold_convert (ssizetype
, eltsize
);
438 off
= fold_convert (ssizetype
, off
);
439 off
= fold_build2 (MULT_EXPR
, ssizetype
, off
, eltsize
);
443 off
= integer_zero_node
;
448 if (TREE_CODE (ptr
) != MEM_REF
)
451 /* Add the MEM_REF byte offset. */
452 tree mem_off
= TREE_OPERAND (ptr
, 1);
453 off
= fold_build2 (PLUS_EXPR
, TREE_TYPE (off
), off
, mem_off
);
454 ptr
= TREE_OPERAND (ptr
, 0);
456 else if (rhs_code
== POINTER_PLUS_EXPR
)
458 ptr
= gimple_assign_rhs1 (def_stmt
);
459 off
= gimple_assign_rhs2 (def_stmt
);
464 if (TREE_CODE (ptr
) != SSA_NAME
)
467 if (!tree_fits_shwi_p (off
))
469 if (int idx
= ssa_ver_to_stridx
[SSA_NAME_VERSION (ptr
)])
472 /* Only when requested by setting OFFRNG to non-null,
473 return the index corresponding to the SSA_NAME.
474 Do this irrespective of the whether the offset
476 if (get_range (off
, offrng
, rvals
))
478 /* When the offset range is known, increment it
479 it by the constant offset computed in prior
480 iterations and store it in the OFFRNG array. */
486 /* When the offset range cannot be determined
487 store [0, SIZE_MAX] and let the caller decide
488 if the offset matters. */
489 offrng
[1] = wi::to_wide (TYPE_MAX_VALUE (sizetype
));
490 offrng
[0] = wi::zero (offrng
[1].get_precision ());
497 HOST_WIDE_INT this_off
= tree_to_shwi (off
);
500 offrng
[0] += wi::shwi (this_off
, offrng
->get_precision ());
501 offrng
[1] += offrng
[0];
507 offset
= (unsigned HOST_WIDE_INT
) offset
+ this_off
;
511 if (int idx
= ssa_ver_to_stridx
[SSA_NAME_VERSION (ptr
)])
513 strinfo
*si
= get_strinfo (idx
);
516 if (compare_nonzero_chars (si
, offset
) >= 0)
517 return get_stridx_plus_constant (si
, offset
, exp
);
529 if (TREE_CODE (exp
) == ADDR_EXPR
)
531 int idx
= get_addr_stridx (TREE_OPERAND (exp
, 0), exp
, NULL
);
536 const char *p
= c_getstr (exp
);
538 return ~(int) strlen (p
);
543 /* Return true if strinfo vector is shared with the immediate dominator. */
546 strinfo_shared (void)
548 return vec_safe_length (stridx_to_strinfo
)
549 && (*stridx_to_strinfo
)[0] != NULL
;
552 /* Unshare strinfo vector that is shared with the immediate dominator. */
555 unshare_strinfo_vec (void)
560 gcc_assert (strinfo_shared ());
561 stridx_to_strinfo
= vec_safe_copy (stridx_to_strinfo
);
562 for (i
= 1; vec_safe_iterate (stridx_to_strinfo
, i
, &si
); ++i
)
565 (*stridx_to_strinfo
)[0] = NULL
;
568 /* Attempt to create a string index for exp, ADDR_EXPR's operand.
569 Return a pointer to the location where the string index can
570 be stored (if 0) or is stored, or NULL if this can't be tracked. */
573 addr_stridxptr (tree exp
)
578 tree base
= get_addr_base_and_unit_offset (exp
, &poff
);
579 if (base
== NULL_TREE
|| !DECL_P (base
) || !poff
.is_constant (&off
))
582 if (!decl_to_stridxlist_htab
)
584 decl_to_stridxlist_htab
585 = new hash_map
<tree_decl_hash
, stridxlist
> (64);
586 gcc_obstack_init (&stridx_obstack
);
590 stridxlist
*list
= &decl_to_stridxlist_htab
->get_or_insert (base
, &existed
);
594 stridxlist
*before
= NULL
;
595 for (i
= 0; i
< 32; i
++)
597 if (list
->offset
== off
)
599 if (list
->offset
> off
&& before
== NULL
)
601 if (list
->next
== NULL
)
610 before
= XOBNEW (&stridx_obstack
, struct stridxlist
);
617 list
->next
= XOBNEW (&stridx_obstack
, struct stridxlist
);
627 /* Create a new string index, or return 0 if reached limit. */
630 new_stridx (tree exp
)
633 if (max_stridx
>= param_max_tracked_strlens
)
635 if (TREE_CODE (exp
) == SSA_NAME
)
637 if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (exp
))
640 ssa_ver_to_stridx
[SSA_NAME_VERSION (exp
)] = idx
;
643 if (TREE_CODE (exp
) == ADDR_EXPR
)
645 int *pidx
= addr_stridxptr (TREE_OPERAND (exp
, 0));
648 gcc_assert (*pidx
== 0);
649 *pidx
= max_stridx
++;
656 /* Like new_stridx, but for ADDR_EXPR's operand instead. */
659 new_addr_stridx (tree exp
)
662 if (max_stridx
>= param_max_tracked_strlens
)
664 pidx
= addr_stridxptr (exp
);
667 gcc_assert (*pidx
== 0);
668 *pidx
= max_stridx
++;
674 /* Create a new strinfo. */
677 new_strinfo (tree ptr
, int idx
, tree nonzero_chars
, bool full_string_p
)
679 strinfo
*si
= strinfo_pool
.allocate ();
680 si
->nonzero_chars
= nonzero_chars
;
684 si
->endptr
= NULL_TREE
;
690 si
->writable
= false;
691 si
->dont_invalidate
= false;
692 si
->full_string_p
= full_string_p
;
696 /* Decrease strinfo refcount and free it if not referenced anymore. */
699 free_strinfo (strinfo
*si
)
701 if (si
&& --si
->refcount
== 0)
702 strinfo_pool
.remove (si
);
705 /* Set strinfo in the vector entry IDX to SI. */
708 set_strinfo (int idx
, strinfo
*si
)
710 if (vec_safe_length (stridx_to_strinfo
) && (*stridx_to_strinfo
)[0])
711 unshare_strinfo_vec ();
712 if (vec_safe_length (stridx_to_strinfo
) <= (unsigned int) idx
)
713 vec_safe_grow_cleared (stridx_to_strinfo
, idx
+ 1);
714 (*stridx_to_strinfo
)[idx
] = si
;
717 /* Return the first strinfo in the related strinfo chain
718 if all strinfos in between belong to the chain, otherwise NULL. */
721 verify_related_strinfos (strinfo
*origsi
)
723 strinfo
*si
= origsi
, *psi
;
725 if (origsi
->first
== 0)
727 for (; si
->prev
; si
= psi
)
729 if (si
->first
!= origsi
->first
)
731 psi
= get_strinfo (si
->prev
);
734 if (psi
->next
!= si
->idx
)
737 if (si
->idx
!= si
->first
)
742 /* Set SI's endptr to ENDPTR and compute its length based on SI->ptr.
743 Use LOC for folding. */
746 set_endptr_and_length (location_t loc
, strinfo
*si
, tree endptr
)
750 tree start_as_size
= fold_convert_loc (loc
, size_type_node
, si
->ptr
);
751 tree end_as_size
= fold_convert_loc (loc
, size_type_node
, endptr
);
752 si
->nonzero_chars
= fold_build2_loc (loc
, MINUS_EXPR
, size_type_node
,
753 end_as_size
, start_as_size
);
754 si
->full_string_p
= true;
757 /* Return the string length, or NULL if it can't be computed.
758 The length may but need not be constant. Instead, it might be
759 the result of a strlen() call. */
762 get_string_length (strinfo
*si
)
764 /* If the length has already been computed return it if it's exact
765 (i.e., the string is nul-terminated at NONZERO_CHARS), or return
767 if (si
->nonzero_chars
)
768 return si
->full_string_p
? si
->nonzero_chars
: NULL
;
770 /* If the string is the result of one of the built-in calls below
771 attempt to compute the length from the call statement. */
774 gimple
*stmt
= si
->stmt
, *lenstmt
;
775 tree callee
, lhs
, fn
, tem
;
777 gimple_stmt_iterator gsi
;
779 gcc_assert (is_gimple_call (stmt
));
780 callee
= gimple_call_fndecl (stmt
);
781 gcc_assert (callee
&& fndecl_built_in_p (callee
, BUILT_IN_NORMAL
));
782 lhs
= gimple_call_lhs (stmt
);
783 /* unshare_strinfo is intentionally not called here. The (delayed)
784 transformation of strcpy or strcat into stpcpy is done at the place
785 of the former strcpy/strcat call and so can affect all the strinfos
786 with the same stmt. If they were unshared before and transformation
787 has been already done, the handling of BUILT_IN_STPCPY{,_CHK} should
788 just compute the right length. */
789 switch (DECL_FUNCTION_CODE (callee
))
791 case BUILT_IN_STRCAT
:
792 case BUILT_IN_STRCAT_CHK
:
793 gsi
= gsi_for_stmt (stmt
);
794 fn
= builtin_decl_implicit (BUILT_IN_STRLEN
);
795 gcc_assert (lhs
== NULL_TREE
);
796 tem
= unshare_expr (gimple_call_arg (stmt
, 0));
797 lenstmt
= gimple_build_call (fn
, 1, tem
);
798 lhs
= make_ssa_name (TREE_TYPE (TREE_TYPE (fn
)), lenstmt
);
799 gimple_call_set_lhs (lenstmt
, lhs
);
800 gimple_set_vuse (lenstmt
, gimple_vuse (stmt
));
801 gsi_insert_before (&gsi
, lenstmt
, GSI_SAME_STMT
);
802 tem
= gimple_call_arg (stmt
, 0);
803 if (!ptrofftype_p (TREE_TYPE (lhs
)))
805 lhs
= convert_to_ptrofftype (lhs
);
806 lhs
= force_gimple_operand_gsi (&gsi
, lhs
, true, NULL_TREE
,
807 true, GSI_SAME_STMT
);
809 lenstmt
= gimple_build_assign
810 (make_ssa_name (TREE_TYPE (gimple_call_arg (stmt
, 0))),
811 POINTER_PLUS_EXPR
,tem
, lhs
);
812 gsi_insert_before (&gsi
, lenstmt
, GSI_SAME_STMT
);
813 gimple_call_set_arg (stmt
, 0, gimple_assign_lhs (lenstmt
));
816 case BUILT_IN_STRCPY
:
817 case BUILT_IN_STRCPY_CHK
:
818 gcc_assert (builtin_decl_implicit_p (BUILT_IN_STPCPY
));
819 if (gimple_call_num_args (stmt
) == 2)
820 fn
= builtin_decl_implicit (BUILT_IN_STPCPY
);
822 fn
= builtin_decl_explicit (BUILT_IN_STPCPY_CHK
);
823 gcc_assert (lhs
== NULL_TREE
);
824 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
826 fprintf (dump_file
, "Optimizing: ");
827 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
829 gimple_call_set_fndecl (stmt
, fn
);
830 lhs
= make_ssa_name (TREE_TYPE (TREE_TYPE (fn
)), stmt
);
831 gimple_call_set_lhs (stmt
, lhs
);
833 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
835 fprintf (dump_file
, "into: ");
836 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
839 case BUILT_IN_STPCPY
:
840 case BUILT_IN_STPCPY_CHK
:
841 gcc_assert (lhs
!= NULL_TREE
);
842 loc
= gimple_location (stmt
);
843 set_endptr_and_length (loc
, si
, lhs
);
844 for (strinfo
*chainsi
= verify_related_strinfos (si
);
846 chainsi
= get_next_strinfo (chainsi
))
847 if (chainsi
->nonzero_chars
== NULL
)
848 set_endptr_and_length (loc
, chainsi
, lhs
);
850 case BUILT_IN_ALLOCA
:
851 case BUILT_IN_ALLOCA_WITH_ALIGN
:
852 case BUILT_IN_MALLOC
:
854 /* BUILT_IN_CALLOC always has si->nonzero_chars set. */
861 return si
->nonzero_chars
;
864 /* Dump strlen data to FP for statement STMT. When non-null, RVALS
865 points to EVRP info and is used to dump strlen range for non-constant
869 dump_strlen_info (FILE *fp
, gimple
*stmt
, const vr_values
*rvals
)
873 fprintf (fp
, "\nDumping strlen pass data after ");
874 print_gimple_expr (fp
, stmt
, TDF_LINENO
);
878 fprintf (fp
, "\nDumping strlen pass data\n");
880 fprintf (fp
, "max_stridx = %i\n", max_stridx
);
881 fprintf (fp
, "ssa_ver_to_stridx has %u elements\n",
882 ssa_ver_to_stridx
.length ());
883 fprintf (fp
, "stridx_to_strinfo");
884 if (stridx_to_strinfo
)
886 fprintf (fp
, " has %u elements\n", stridx_to_strinfo
->length ());
887 for (unsigned i
= 0; i
!= stridx_to_strinfo
->length (); ++i
)
889 if (strinfo
*si
= (*stridx_to_strinfo
)[i
])
893 fprintf (fp
, " idx = %i", si
->idx
);
896 fprintf (fp
, ", ptr = ");
897 print_generic_expr (fp
, si
->ptr
);
900 if (si
->nonzero_chars
)
902 fprintf (fp
, ", nonzero_chars = ");
903 print_generic_expr (fp
, si
->nonzero_chars
);
904 if (TREE_CODE (si
->nonzero_chars
) == SSA_NAME
)
906 value_range_kind rng
= VR_UNDEFINED
;
910 const value_range
*vr
911 = CONST_CAST (class vr_values
*, rvals
)
912 ->get_value_range (si
->nonzero_chars
);
914 if (range_int_cst_p (vr
))
916 min
= wi::to_wide (vr
->min ());
917 max
= wi::to_wide (vr
->max ());
923 rng
= get_range_info (si
->nonzero_chars
, &min
, &max
);
925 if (rng
== VR_RANGE
|| rng
== VR_ANTI_RANGE
)
927 fprintf (fp
, " %s[%llu, %llu]",
928 rng
== VR_RANGE
? "" : "~",
929 (long long) min
.to_uhwi (),
930 (long long) max
.to_uhwi ());
935 fprintf (fp
, ", refcount = %i", si
->refcount
);
938 fprintf (fp
, ", stmt = ");
939 print_gimple_expr (fp
, si
->stmt
, 0);
943 fprintf (fp
, ", alloc = ");
944 print_gimple_expr (fp
, si
->alloc
, 0);
947 fprintf (fp
, ", writable");
948 if (si
->dont_invalidate
)
949 fprintf (fp
, ", dont_invalidate");
950 if (si
->full_string_p
)
951 fprintf (fp
, ", full_string_p");
952 if (strinfo
*next
= get_next_strinfo (si
))
956 fprintf (fp
, "%i%s", next
->idx
, next
->first
? ", " : "");
957 while ((next
= get_next_strinfo (next
)));
965 fprintf (fp
, " = null\n");
967 fprintf (fp
, "decl_to_stridxlist_htab");
968 if (decl_to_stridxlist_htab
)
971 typedef decl_to_stridxlist_htab_t::iterator iter_t
;
972 for (iter_t it
= decl_to_stridxlist_htab
->begin ();
973 it
!= decl_to_stridxlist_htab
->end (); ++it
)
975 tree decl
= (*it
).first
;
976 stridxlist
*list
= &(*it
).second
;
977 fprintf (fp
, " decl = ");
978 print_generic_expr (fp
, decl
);
981 fprintf (fp
, ", offsets = {");
982 for (; list
; list
= list
->next
)
983 fprintf (fp
, "%lli%s", (long long) list
->offset
,
984 list
->next
? ", " : "");
991 fprintf (fp
, " = null\n");
995 fprintf (fp
, "laststmt = ");
996 print_gimple_expr (fp
, laststmt
.stmt
, 0);
997 fprintf (fp
, ", len = ");
998 print_generic_expr (fp
, laststmt
.len
);
999 fprintf (fp
, ", stridx = %i\n", laststmt
.stridx
);
1003 /* Attempt to determine the length of the string SRC. On success, store
1004 the length in *PDATA and return true. Otherwise, return false.
1005 VISITED is a bitmap of visited PHI nodes. RVALS points to EVRP info
1006 and PSSA_DEF_MAX to an SSA_NAME assignment limit used to prevent runaway
1010 get_range_strlen_dynamic (tree src
, c_strlen_data
*pdata
, bitmap
*visited
,
1011 const vr_values
*rvals
, unsigned *pssa_def_max
)
1013 int idx
= get_stridx (src
);
1016 if (TREE_CODE (src
) == SSA_NAME
)
1018 gimple
*def_stmt
= SSA_NAME_DEF_STMT (src
);
1019 if (gimple_code (def_stmt
) == GIMPLE_PHI
)
1022 *visited
= BITMAP_ALLOC (NULL
);
1024 if (!bitmap_set_bit (*visited
, SSA_NAME_VERSION (src
)))
1027 if (*pssa_def_max
== 0)
1032 /* Iterate over the PHI arguments and determine the minimum
1033 and maximum length/size of each and incorporate them into
1034 the overall result. */
1035 gphi
*phi
= as_a
<gphi
*> (def_stmt
);
1036 for (unsigned i
= 0; i
!= gimple_phi_num_args (phi
); ++i
)
1038 tree arg
= gimple_phi_arg_def (phi
, i
);
1039 if (arg
== gimple_phi_result (def_stmt
))
1042 c_strlen_data argdata
= { };
1043 if (get_range_strlen_dynamic (arg
, &argdata
, visited
, rvals
,
1046 /* Set the DECL of an unterminated array this argument
1047 refers to if one hasn't been found yet. */
1048 if (!pdata
->decl
&& argdata
.decl
)
1049 pdata
->decl
= argdata
.decl
;
1052 || (integer_zerop (argdata
.minlen
)
1053 && (!argdata
.maxbound
1054 || integer_all_onesp (argdata
.maxbound
))
1055 && integer_all_onesp (argdata
.maxlen
)))
1057 /* Set the upper bound of the length to unbounded. */
1058 pdata
->maxlen
= build_all_ones_cst (size_type_node
);
1062 /* Adjust the minimum and maximum length determined
1063 so far and the upper bound on the array size. */
1065 || tree_int_cst_lt (argdata
.minlen
, pdata
->minlen
))
1066 pdata
->minlen
= argdata
.minlen
;
1069 && tree_int_cst_lt (pdata
->maxlen
, argdata
.maxlen
)))
1070 pdata
->maxlen
= argdata
.maxlen
;
1071 if (!pdata
->maxbound
1072 || TREE_CODE (pdata
->maxbound
) != INTEGER_CST
1073 || (argdata
.maxbound
1074 && tree_int_cst_lt (pdata
->maxbound
,
1076 && !integer_all_onesp (argdata
.maxbound
)))
1077 pdata
->maxbound
= argdata
.maxbound
;
1080 pdata
->maxlen
= build_all_ones_cst (size_type_node
);
1087 /* Return success regardless of the result and handle *PDATA
1089 get_range_strlen (src
, pdata
, 1);
1095 /* SRC is a string of constant length. */
1096 pdata
->minlen
= build_int_cst (size_type_node
, ~idx
);
1097 pdata
->maxlen
= pdata
->minlen
;
1098 pdata
->maxbound
= pdata
->maxlen
;
1102 if (strinfo
*si
= get_strinfo (idx
))
1104 pdata
->minlen
= get_string_length (si
);
1105 if (!pdata
->minlen
&& si
->nonzero_chars
)
1107 if (TREE_CODE (si
->nonzero_chars
) == INTEGER_CST
)
1108 pdata
->minlen
= si
->nonzero_chars
;
1109 else if (TREE_CODE (si
->nonzero_chars
) == SSA_NAME
)
1111 const value_range_equiv
*vr
1112 = CONST_CAST (class vr_values
*, rvals
)
1113 ->get_value_range (si
->nonzero_chars
);
1114 if (vr
->kind () == VR_RANGE
1115 && range_int_cst_p (vr
))
1117 pdata
->minlen
= vr
->min ();
1118 pdata
->maxlen
= vr
->max ();
1121 pdata
->minlen
= build_zero_cst (size_type_node
);
1124 pdata
->minlen
= build_zero_cst (size_type_node
);
1126 tree base
= si
->ptr
;
1127 if (TREE_CODE (base
) == ADDR_EXPR
)
1128 base
= TREE_OPERAND (base
, 0);
1132 base
= get_addr_base_and_unit_offset (base
, &poff
);
1135 && TREE_CODE (TREE_TYPE (base
)) == ARRAY_TYPE
1136 && TYPE_SIZE_UNIT (TREE_TYPE (base
))
1137 && poff
.is_constant (&off
))
1139 tree basetype
= TREE_TYPE (base
);
1140 tree size
= TYPE_SIZE_UNIT (basetype
);
1141 ++off
; /* Increment for the terminating nul. */
1142 pdata
->maxlen
= fold_build2 (MINUS_EXPR
, size_type_node
, size
,
1143 build_int_cst (size_type_node
, off
));
1144 pdata
->maxbound
= pdata
->maxlen
;
1147 pdata
->maxlen
= build_all_ones_cst (size_type_node
);
1149 else if (pdata
->minlen
&& TREE_CODE (pdata
->minlen
) == SSA_NAME
)
1151 const value_range_equiv
*vr
1152 = CONST_CAST (class vr_values
*, rvals
)
1153 ->get_value_range (si
->nonzero_chars
);
1154 if (vr
->kind () == VR_RANGE
1155 && range_int_cst_p (vr
))
1157 pdata
->minlen
= vr
->min ();
1158 pdata
->maxlen
= vr
->max ();
1159 pdata
->maxbound
= pdata
->maxlen
;
1163 pdata
->minlen
= build_zero_cst (size_type_node
);
1164 pdata
->maxlen
= build_all_ones_cst (size_type_node
);
1167 else if (pdata
->minlen
&& TREE_CODE (pdata
->minlen
) == INTEGER_CST
)
1169 pdata
->maxlen
= pdata
->minlen
;
1170 pdata
->maxbound
= pdata
->minlen
;
1174 /* For PDATA->MINLEN that's a non-constant expression such
1175 as PLUS_EXPR whose value range is unknown, set the bounds
1176 to zero and SIZE_MAX. */
1177 pdata
->minlen
= build_zero_cst (size_type_node
);
1178 pdata
->maxlen
= build_all_ones_cst (size_type_node
);
1187 /* Analogous to get_range_strlen but for dynamically created strings,
1188 i.e., those created by calls to strcpy as opposed to just string
1190 Try to obtain the range of the lengths of the string(s) referenced
1191 by SRC, or the size of the largest array SRC refers to if the range
1192 of lengths cannot be determined, and store all in *PDATA. RVALS
1193 points to EVRP info. */
1196 get_range_strlen_dynamic (tree src
, c_strlen_data
*pdata
,
1197 const vr_values
*rvals
)
1199 bitmap visited
= NULL
;
1200 tree maxbound
= pdata
->maxbound
;
1202 unsigned limit
= param_ssa_name_def_chain_limit
;
1203 if (!get_range_strlen_dynamic (src
, pdata
, &visited
, rvals
, &limit
))
1205 /* On failure extend the length range to an impossible maximum
1206 (a valid MAXLEN must be less than PTRDIFF_MAX - 1). Other
1207 members can stay unchanged regardless. */
1208 pdata
->minlen
= ssize_int (0);
1209 pdata
->maxlen
= build_all_ones_cst (size_type_node
);
1211 else if (!pdata
->minlen
)
1212 pdata
->minlen
= ssize_int (0);
1214 /* If it's unchanged from it initial non-null value, set the conservative
1215 MAXBOUND to SIZE_MAX. Otherwise leave it null (if it is null). */
1216 if (maxbound
&& pdata
->maxbound
== maxbound
)
1217 pdata
->maxbound
= build_all_ones_cst (size_type_node
);
1220 BITMAP_FREE (visited
);
1223 /* Invalidate string length information for strings whose length might
1224 change due to stores in STMT, except those marked DONT_INVALIDATE.
1225 For string-modifying statements, ZERO_WRITE is set when the statement
1227 Returns true if any STRIDX_TO_STRINFO entries were considered
1228 for invalidation. */
1231 maybe_invalidate (gimple
*stmt
, bool zero_write
= false)
1233 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1235 fprintf (dump_file
, "%s called for ", __func__
);
1236 print_gimple_stmt (dump_file
, stmt
, TDF_LINENO
);
1240 bool nonempty
= false;
1242 for (unsigned i
= 1; vec_safe_iterate (stridx_to_strinfo
, i
, &si
); ++i
)
1244 if (si
== NULL
|| !POINTER_TYPE_P (TREE_TYPE (si
->ptr
)))
1249 /* Unconditionally reset DONT_INVALIDATE. */
1250 bool dont_invalidate
= si
->dont_invalidate
;
1251 si
->dont_invalidate
= false;
1253 if (dont_invalidate
)
1257 tree size
= NULL_TREE
;
1258 if (si
->nonzero_chars
)
1260 /* Include the terminating nul in the size of the string
1261 to consider when determining possible clobber. */
1262 tree type
= TREE_TYPE (si
->nonzero_chars
);
1263 size
= fold_build2 (PLUS_EXPR
, type
, si
->nonzero_chars
,
1264 build_int_cst (type
, 1));
1266 ao_ref_init_from_ptr_and_size (&r
, si
->ptr
, size
);
1267 if (stmt_may_clobber_ref_p_1 (stmt
, &r
))
1269 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1271 fputs (" statement may clobber object ", dump_file
);
1272 print_generic_expr (dump_file
, si
->ptr
);
1273 if (size
&& tree_fits_uhwi_p (size
))
1274 fprintf (dump_file
, " " HOST_WIDE_INT_PRINT_UNSIGNED
1275 " bytes in size", tree_to_uhwi (size
));
1276 fputc ('\n', dump_file
);
1279 set_strinfo (i
, NULL
);
1287 && is_gimple_call (si
->stmt
)
1288 && (DECL_FUNCTION_CODE (gimple_call_fndecl (si
->stmt
))
1289 == BUILT_IN_CALLOC
))
1291 /* If the clobber test above considered the length of
1292 the string (including the nul), then for (potentially)
1293 non-zero writes that might modify storage allocated by
1294 calloc consider the whole object and if it might be
1295 clobbered by the statement reset the statement. */
1296 ao_ref_init_from_ptr_and_size (&r
, si
->ptr
, NULL_TREE
);
1297 if (stmt_may_clobber_ref_p_1 (stmt
, &r
))
1302 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1303 fprintf (dump_file
, "%s returns %i\n", __func__
, nonempty
);
1308 /* Unshare strinfo record SI, if it has refcount > 1 or
1309 if stridx_to_strinfo vector is shared with some other
1313 unshare_strinfo (strinfo
*si
)
1317 if (si
->refcount
== 1 && !strinfo_shared ())
1320 nsi
= new_strinfo (si
->ptr
, si
->idx
, si
->nonzero_chars
, si
->full_string_p
);
1321 nsi
->stmt
= si
->stmt
;
1322 nsi
->alloc
= si
->alloc
;
1323 nsi
->endptr
= si
->endptr
;
1324 nsi
->first
= si
->first
;
1325 nsi
->prev
= si
->prev
;
1326 nsi
->next
= si
->next
;
1327 nsi
->writable
= si
->writable
;
1328 set_strinfo (si
->idx
, nsi
);
1333 /* Attempt to create a new strinfo for BASESI + OFF, or find existing
1334 strinfo if there is any. Return it's idx, or 0 if no strinfo has
1338 get_stridx_plus_constant (strinfo
*basesi
, unsigned HOST_WIDE_INT off
,
1341 if (TREE_CODE (ptr
) == SSA_NAME
&& SSA_NAME_OCCURS_IN_ABNORMAL_PHI (ptr
))
1344 if (compare_nonzero_chars (basesi
, off
) < 0
1345 || !tree_fits_uhwi_p (basesi
->nonzero_chars
))
1348 unsigned HOST_WIDE_INT nonzero_chars
1349 = tree_to_uhwi (basesi
->nonzero_chars
) - off
;
1350 strinfo
*si
= basesi
, *chainsi
;
1351 if (si
->first
|| si
->prev
|| si
->next
)
1352 si
= verify_related_strinfos (basesi
);
1354 || si
->nonzero_chars
== NULL_TREE
1355 || TREE_CODE (si
->nonzero_chars
) != INTEGER_CST
)
1358 if (TREE_CODE (ptr
) == SSA_NAME
1359 && ssa_ver_to_stridx
.length () <= SSA_NAME_VERSION (ptr
))
1360 ssa_ver_to_stridx
.safe_grow_cleared (num_ssa_names
);
1362 gcc_checking_assert (compare_tree_int (si
->nonzero_chars
, off
) != -1);
1363 for (chainsi
= si
; chainsi
->next
; chainsi
= si
)
1365 si
= get_next_strinfo (chainsi
);
1367 || si
->nonzero_chars
== NULL_TREE
1368 || TREE_CODE (si
->nonzero_chars
) != INTEGER_CST
)
1370 int r
= compare_tree_int (si
->nonzero_chars
, nonzero_chars
);
1375 if (TREE_CODE (ptr
) == SSA_NAME
)
1376 ssa_ver_to_stridx
[SSA_NAME_VERSION (ptr
)] = si
->idx
;
1379 int *pidx
= addr_stridxptr (TREE_OPERAND (ptr
, 0));
1380 if (pidx
!= NULL
&& *pidx
== 0)
1389 int idx
= new_stridx (ptr
);
1392 si
= new_strinfo (ptr
, idx
, build_int_cst (size_type_node
, nonzero_chars
),
1393 basesi
->full_string_p
);
1394 set_strinfo (idx
, si
);
1395 if (strinfo
*nextsi
= get_strinfo (chainsi
->next
))
1397 nextsi
= unshare_strinfo (nextsi
);
1398 si
->next
= nextsi
->idx
;
1401 chainsi
= unshare_strinfo (chainsi
);
1402 if (chainsi
->first
== 0)
1403 chainsi
->first
= chainsi
->idx
;
1404 chainsi
->next
= idx
;
1405 if (chainsi
->endptr
== NULL_TREE
&& zero_length_string_p (si
))
1406 chainsi
->endptr
= ptr
;
1407 si
->endptr
= chainsi
->endptr
;
1408 si
->prev
= chainsi
->idx
;
1409 si
->first
= chainsi
->first
;
1410 si
->writable
= chainsi
->writable
;
1414 /* Note that PTR, a pointer SSA_NAME initialized in the current stmt, points
1415 to a zero-length string and if possible chain it to a related strinfo
1416 chain whose part is or might be CHAINSI. */
1419 zero_length_string (tree ptr
, strinfo
*chainsi
)
1423 if (ssa_ver_to_stridx
.length () <= SSA_NAME_VERSION (ptr
))
1424 ssa_ver_to_stridx
.safe_grow_cleared (num_ssa_names
);
1425 gcc_checking_assert (TREE_CODE (ptr
) == SSA_NAME
1426 && ssa_ver_to_stridx
[SSA_NAME_VERSION (ptr
)] == 0);
1428 if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (ptr
))
1430 if (chainsi
!= NULL
)
1432 si
= verify_related_strinfos (chainsi
);
1437 /* We shouldn't mix delayed and non-delayed lengths. */
1438 gcc_assert (si
->full_string_p
);
1439 if (si
->endptr
== NULL_TREE
)
1441 si
= unshare_strinfo (si
);
1445 si
= get_next_strinfo (si
);
1448 if (zero_length_string_p (chainsi
))
1452 chainsi
= unshare_strinfo (chainsi
);
1455 ssa_ver_to_stridx
[SSA_NAME_VERSION (ptr
)] = chainsi
->idx
;
1461 /* We shouldn't mix delayed and non-delayed lengths. */
1462 gcc_assert (chainsi
->full_string_p
);
1463 if (chainsi
->first
|| chainsi
->prev
|| chainsi
->next
)
1465 chainsi
= unshare_strinfo (chainsi
);
1472 idx
= new_stridx (ptr
);
1475 si
= new_strinfo (ptr
, idx
, build_int_cst (size_type_node
, 0), true);
1476 set_strinfo (idx
, si
);
1478 if (chainsi
!= NULL
)
1480 chainsi
= unshare_strinfo (chainsi
);
1481 if (chainsi
->first
== 0)
1482 chainsi
->first
= chainsi
->idx
;
1483 chainsi
->next
= idx
;
1484 if (chainsi
->endptr
== NULL_TREE
)
1485 chainsi
->endptr
= ptr
;
1486 si
->prev
= chainsi
->idx
;
1487 si
->first
= chainsi
->first
;
1488 si
->writable
= chainsi
->writable
;
1493 /* For strinfo ORIGSI whose length has been just updated, adjust other
1494 related strinfos so that they match the new ORIGSI. This involves:
1496 - adding ADJ to the nonzero_chars fields
1497 - copying full_string_p from the new ORIGSI. */
1500 adjust_related_strinfos (location_t loc
, strinfo
*origsi
, tree adj
)
1502 strinfo
*si
= verify_related_strinfos (origsi
);
1515 si
= unshare_strinfo (si
);
1516 /* We shouldn't see delayed lengths here; the caller must
1517 have calculated the old length in order to calculate
1519 gcc_assert (si
->nonzero_chars
);
1520 tem
= fold_convert_loc (loc
, TREE_TYPE (si
->nonzero_chars
), adj
);
1521 si
->nonzero_chars
= fold_build2_loc (loc
, PLUS_EXPR
,
1522 TREE_TYPE (si
->nonzero_chars
),
1523 si
->nonzero_chars
, tem
);
1524 si
->full_string_p
= origsi
->full_string_p
;
1526 si
->endptr
= NULL_TREE
;
1527 si
->dont_invalidate
= true;
1529 nsi
= get_next_strinfo (si
);
1536 /* Find if there are other SSA_NAME pointers equal to PTR
1537 for which we don't track their string lengths yet. If so, use
1541 find_equal_ptrs (tree ptr
, int idx
)
1543 if (TREE_CODE (ptr
) != SSA_NAME
)
1547 gimple
*stmt
= SSA_NAME_DEF_STMT (ptr
);
1548 if (!is_gimple_assign (stmt
))
1550 ptr
= gimple_assign_rhs1 (stmt
);
1551 switch (gimple_assign_rhs_code (stmt
))
1556 if (!POINTER_TYPE_P (TREE_TYPE (ptr
)))
1558 if (TREE_CODE (ptr
) == SSA_NAME
)
1560 if (TREE_CODE (ptr
) != ADDR_EXPR
)
1565 int *pidx
= addr_stridxptr (TREE_OPERAND (ptr
, 0));
1566 if (pidx
!= NULL
&& *pidx
== 0)
1574 /* We might find an endptr created in this pass. Grow the
1575 vector in that case. */
1576 if (ssa_ver_to_stridx
.length () <= SSA_NAME_VERSION (ptr
))
1577 ssa_ver_to_stridx
.safe_grow_cleared (num_ssa_names
);
1579 if (ssa_ver_to_stridx
[SSA_NAME_VERSION (ptr
)] != 0)
1581 ssa_ver_to_stridx
[SSA_NAME_VERSION (ptr
)] = idx
;
1585 /* Return true if STMT is a call to a builtin function with the right
1586 arguments and attributes that should be considered for optimization
1590 valid_builtin_call (gimple
*stmt
)
1592 if (!gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
1595 tree callee
= gimple_call_fndecl (stmt
);
1596 tree decl
= builtin_decl_explicit (DECL_FUNCTION_CODE (callee
));
1599 && !gimple_builtin_call_types_compatible_p (stmt
, decl
))
1602 switch (DECL_FUNCTION_CODE (callee
))
1604 case BUILT_IN_MEMCMP
:
1605 case BUILT_IN_MEMCMP_EQ
:
1606 case BUILT_IN_STRCMP
:
1607 case BUILT_IN_STRNCMP
:
1608 case BUILT_IN_STRCHR
:
1609 case BUILT_IN_STRLEN
:
1610 case BUILT_IN_STRNLEN
:
1611 /* The above functions should be pure. Punt if they aren't. */
1612 if (gimple_vdef (stmt
) || gimple_vuse (stmt
) == NULL_TREE
)
1616 case BUILT_IN_ALLOCA
:
1617 case BUILT_IN_ALLOCA_WITH_ALIGN
:
1618 case BUILT_IN_CALLOC
:
1619 case BUILT_IN_MALLOC
:
1620 case BUILT_IN_MEMCPY
:
1621 case BUILT_IN_MEMCPY_CHK
:
1622 case BUILT_IN_MEMPCPY
:
1623 case BUILT_IN_MEMPCPY_CHK
:
1624 case BUILT_IN_MEMSET
:
1625 case BUILT_IN_STPCPY
:
1626 case BUILT_IN_STPCPY_CHK
:
1627 case BUILT_IN_STPNCPY
:
1628 case BUILT_IN_STPNCPY_CHK
:
1629 case BUILT_IN_STRCAT
:
1630 case BUILT_IN_STRCAT_CHK
:
1631 case BUILT_IN_STRCPY
:
1632 case BUILT_IN_STRCPY_CHK
:
1633 case BUILT_IN_STRNCAT
:
1634 case BUILT_IN_STRNCAT_CHK
:
1635 case BUILT_IN_STRNCPY
:
1636 case BUILT_IN_STRNCPY_CHK
:
1637 /* The above functions should be neither const nor pure. Punt if they
1639 if (gimple_vdef (stmt
) == NULL_TREE
|| gimple_vuse (stmt
) == NULL_TREE
)
1650 /* If the last .MEM setter statement before STMT is
1651 memcpy (x, y, strlen (y) + 1), the only .MEM use of it is STMT
1652 and STMT is known to overwrite x[strlen (x)], adjust the last memcpy to
1653 just memcpy (x, y, strlen (y)). SI must be the zero length
1657 adjust_last_stmt (strinfo
*si
, gimple
*stmt
, bool is_strcat
)
1659 tree vuse
, callee
, len
;
1660 struct laststmt_struct last
= laststmt
;
1661 strinfo
*lastsi
, *firstsi
;
1662 unsigned len_arg_no
= 2;
1664 laststmt
.stmt
= NULL
;
1665 laststmt
.len
= NULL_TREE
;
1666 laststmt
.stridx
= 0;
1668 if (last
.stmt
== NULL
)
1671 vuse
= gimple_vuse (stmt
);
1672 if (vuse
== NULL_TREE
1673 || SSA_NAME_DEF_STMT (vuse
) != last
.stmt
1674 || !has_single_use (vuse
))
1677 gcc_assert (last
.stridx
> 0);
1678 lastsi
= get_strinfo (last
.stridx
);
1684 if (lastsi
->first
== 0 || lastsi
->first
!= si
->first
)
1687 firstsi
= verify_related_strinfos (si
);
1688 if (firstsi
== NULL
)
1690 while (firstsi
!= lastsi
)
1692 firstsi
= get_next_strinfo (firstsi
);
1693 if (firstsi
== NULL
)
1698 if (!is_strcat
&& !zero_length_string_p (si
))
1701 if (is_gimple_assign (last
.stmt
))
1703 gimple_stmt_iterator gsi
;
1705 if (!integer_zerop (gimple_assign_rhs1 (last
.stmt
)))
1707 if (stmt_could_throw_p (cfun
, last
.stmt
))
1709 gsi
= gsi_for_stmt (last
.stmt
);
1710 unlink_stmt_vdef (last
.stmt
);
1711 release_defs (last
.stmt
);
1712 gsi_remove (&gsi
, true);
1716 if (!valid_builtin_call (last
.stmt
))
1719 callee
= gimple_call_fndecl (last
.stmt
);
1720 switch (DECL_FUNCTION_CODE (callee
))
1722 case BUILT_IN_MEMCPY
:
1723 case BUILT_IN_MEMCPY_CHK
:
1729 len
= gimple_call_arg (last
.stmt
, len_arg_no
);
1730 if (tree_fits_uhwi_p (len
))
1732 if (!tree_fits_uhwi_p (last
.len
)
1733 || integer_zerop (len
)
1734 || tree_to_uhwi (len
) != tree_to_uhwi (last
.len
) + 1)
1736 /* Don't adjust the length if it is divisible by 4, it is more efficient
1737 to store the extra '\0' in that case. */
1738 if ((tree_to_uhwi (len
) & 3) == 0)
1741 /* Don't fold away an out of bounds access, as this defeats proper
1743 tree dst
= gimple_call_arg (last
.stmt
, 0);
1744 tree size
= compute_objsize (dst
, 0);
1745 if (size
&& tree_int_cst_lt (size
, len
))
1748 else if (TREE_CODE (len
) == SSA_NAME
)
1750 gimple
*def_stmt
= SSA_NAME_DEF_STMT (len
);
1751 if (!is_gimple_assign (def_stmt
)
1752 || gimple_assign_rhs_code (def_stmt
) != PLUS_EXPR
1753 || gimple_assign_rhs1 (def_stmt
) != last
.len
1754 || !integer_onep (gimple_assign_rhs2 (def_stmt
)))
1760 gimple_call_set_arg (last
.stmt
, len_arg_no
, last
.len
);
1761 update_stmt (last
.stmt
);
1764 /* For an LHS that is an SSA_NAME that is the result of a strlen()
1765 call, or when BOUND is non-null, of a strnlen() call, set LHS
1766 range info to [0, min (MAX, BOUND)] when the range includes more
1767 than one value and return LHS. Otherwise, when the range
1768 [MIN, MAX] is such that MIN == MAX, return the tree representation
1769 of (MIN). The latter allows callers to fold suitable strnlen() calls
1773 set_strlen_range (tree lhs
, wide_int min
, wide_int max
,
1774 tree bound
/* = NULL_TREE */)
1776 if (TREE_CODE (lhs
) != SSA_NAME
1777 || !INTEGRAL_TYPE_P (TREE_TYPE (lhs
)))
1782 /* For strnlen, adjust MIN and MAX as necessary. If the bound
1783 is less than the size of the array set MAX to it. It it's
1784 greater than MAX and MAX is non-zero bump MAX down to account
1785 for the necessary terminating nul. Otherwise leave it alone. */
1786 if (TREE_CODE (bound
) == INTEGER_CST
)
1788 wide_int wibnd
= wi::to_wide (bound
);
1789 int cmp
= wi::cmpu (wibnd
, max
);
1792 else if (cmp
&& wi::ne_p (max
, min
))
1795 else if (TREE_CODE (bound
) == SSA_NAME
)
1797 wide_int minbound
, maxbound
;
1798 value_range_kind rng
= get_range_info (bound
, &minbound
, &maxbound
);
1799 if (rng
== VR_RANGE
)
1801 /* For a bound in a known range, adjust the range determined
1802 above as necessary. For a bound in some anti-range or
1803 in an unknown range, use the range determined by callers. */
1804 if (wi::ltu_p (minbound
, min
))
1806 if (wi::ltu_p (maxbound
, max
))
1813 return wide_int_to_tree (size_type_node
, min
);
1815 set_range_info (lhs
, VR_RANGE
, min
, max
);
1819 /* For an LHS that is an SSA_NAME and for strlen() or strnlen() argument
1820 SRC, set LHS range info to [0, min (N, BOUND)] if SRC refers to
1821 a character array A[N] with unknown length bounded by N, and for
1822 strnlen(), by min (N, BOUND). */
1825 maybe_set_strlen_range (tree lhs
, tree src
, tree bound
)
1827 if (TREE_CODE (lhs
) != SSA_NAME
1828 || !INTEGRAL_TYPE_P (TREE_TYPE (lhs
)))
1831 if (TREE_CODE (src
) == SSA_NAME
)
1833 gimple
*def
= SSA_NAME_DEF_STMT (src
);
1834 if (is_gimple_assign (def
)
1835 && gimple_assign_rhs_code (def
) == ADDR_EXPR
)
1836 src
= gimple_assign_rhs1 (def
);
1839 /* The longest string is PTRDIFF_MAX - 1 bytes including the final
1840 NUL so that the difference between a pointer to just past it and
1841 one to its beginning is positive. */
1842 wide_int max
= wi::to_wide (TYPE_MAX_VALUE (ptrdiff_type_node
)) - 2;
1844 if (TREE_CODE (src
) == ADDR_EXPR
)
1846 /* The last array member of a struct can be bigger than its size
1847 suggests if it's treated as a poor-man's flexible array member. */
1848 src
= TREE_OPERAND (src
, 0);
1849 if (TREE_CODE (src
) != MEM_REF
1850 && !array_at_struct_end_p (src
))
1852 tree type
= TREE_TYPE (src
);
1853 tree size
= TYPE_SIZE_UNIT (type
);
1855 && TREE_CODE (size
) == INTEGER_CST
1856 && !integer_zerop (size
))
1858 /* Even though such uses of strlen would be undefined,
1859 avoid relying on arrays of arrays in case some genius
1860 decides to call strlen on an unterminated array element
1861 that's followed by a terminated one. Likewise, avoid
1862 assuming that a struct array member is necessarily
1863 nul-terminated (the nul may be in the member that
1864 follows). In those cases, assume that the length
1865 of the string stored in such an array is bounded
1866 by the size of the enclosing object if one can be
1868 tree base
= get_base_address (src
);
1871 if (tree size
= DECL_SIZE_UNIT (base
))
1873 && TREE_CODE (size
) == INTEGER_CST
1874 && TREE_CODE (TREE_TYPE (base
)) != POINTER_TYPE
)
1875 max
= wi::to_wide (size
);
1879 /* For strlen() the upper bound above is equal to
1880 the longest string that can be stored in the array
1881 (i.e., it accounts for the terminating nul. For
1882 strnlen() bump up the maximum by one since the array
1883 need not be nul-terminated. */
1884 if (!bound
&& max
!= 0)
1889 wide_int min
= wi::zero (max
.get_precision ());
1890 return set_strlen_range (lhs
, min
, max
, bound
);
1893 /* Diagnose buffer overflow by a STMT writing LEN + PLUS_ONE bytes,
1894 either into a region allocated for the object SI when non-null,
1895 or into an object designated by the LHS of STMT otherwise.
1896 When nonnull uses RVALS to determine range information.
1897 RAWMEM may be set by memcpy and other raw memory functions
1898 to allow accesses across subobject boundaries. */
1901 maybe_warn_overflow (gimple
*stmt
, tree len
,
1902 const vr_values
*rvals
= NULL
,
1903 strinfo
*si
= NULL
, bool plus_one
= false,
1904 bool rawmem
= false)
1906 if (!len
|| gimple_no_warning_p (stmt
))
1909 /* The DECL of the function performing the write if it is done
1911 tree writefn
= NULL_TREE
;
1912 /* The destination expression involved in the store STMT. */
1913 tree dest
= NULL_TREE
;
1915 if (is_gimple_assign (stmt
))
1916 dest
= gimple_assign_lhs (stmt
);
1917 else if (is_gimple_call (stmt
))
1919 dest
= gimple_call_arg (stmt
, 0);
1920 writefn
= gimple_call_fndecl (stmt
);
1923 if (TREE_NO_WARNING (dest
))
1926 /* The offset into the destination object computed below and not
1927 reflected in DESTSIZE. */
1929 const int off_prec
= TYPE_PRECISION (ptrdiff_type_node
);
1930 offrng
[0] = offrng
[1] = wi::zero (off_prec
);
1934 /* If no destination STRINFO was provided try to get it from
1935 the DEST argument. */
1937 if (TREE_CODE (ref
) == ARRAY_REF
)
1939 /* Handle stores to VLAs (represented as
1940 ARRAY_REF (MEM_REF (vlaptr, 0), N]. */
1941 tree off
= TREE_OPERAND (ref
, 1);
1942 ref
= TREE_OPERAND (ref
, 0);
1943 if (get_range (off
, offrng
, rvals
))
1945 offrng
[0] = offrng
[0].from (offrng
[0], off_prec
, SIGNED
);
1946 offrng
[1] = offrng
[1].from (offrng
[1], off_prec
, SIGNED
);
1950 offrng
[0] = wi::to_wide (TYPE_MIN_VALUE (ptrdiff_type_node
));
1951 offrng
[1] = wi::to_wide (TYPE_MAX_VALUE (ptrdiff_type_node
));
1955 if (TREE_CODE (ref
) == MEM_REF
)
1957 tree mem_off
= TREE_OPERAND (ref
, 1);
1958 ref
= TREE_OPERAND (ref
, 0);
1959 wide_int memoffrng
[2];
1960 if (get_range (mem_off
, memoffrng
, rvals
))
1962 offrng
[0] += memoffrng
[0];
1963 offrng
[1] += memoffrng
[1];
1967 offrng
[0] = wi::to_wide (TYPE_MIN_VALUE (ptrdiff_type_node
));
1968 offrng
[1] = wi::to_wide (TYPE_MAX_VALUE (ptrdiff_type_node
));
1972 wide_int stroffrng
[2];
1973 if (int idx
= get_stridx (ref
, stroffrng
, rvals
))
1975 si
= get_strinfo (idx
);
1976 offrng
[0] += stroffrng
[0];
1977 offrng
[1] += stroffrng
[1];
1981 /* The allocation call if the destination object was allocated
1983 gimple
*alloc_call
= NULL
;
1984 /* The DECL of the destination object if known and not dynamically
1986 tree destdecl
= NULL_TREE
;
1987 /* The offset into the destination object set by compute_objsize
1988 but already reflected in DESTSIZE. */
1989 tree destoff
= NULL_TREE
;
1990 /* The size of the destination region (which is smaller than
1991 the destination object for stores at a non-zero offset). */
1992 tree destsize
= NULL_TREE
;
1994 /* Compute the range of sizes of the destination object. The range
1995 is constant for declared objects but may be a range for allocated
1997 const int siz_prec
= TYPE_PRECISION (size_type_node
);
2001 destsize
= gimple_call_alloc_size (si
->alloc
, sizrng
, rvals
);
2002 alloc_call
= si
->alloc
;
2005 offrng
[0] = offrng
[1] = wi::zero (off_prec
);
2009 /* If there is no STRINFO for DEST, fall back on compute_objsize. */
2010 tree off
= NULL_TREE
;
2011 destsize
= compute_objsize (dest
, rawmem
? 0 : 1, &destdecl
, &off
, rvals
);
2014 /* Remember OFF but clear OFFRNG that may have been set above. */
2016 offrng
[0] = offrng
[1] = wi::zero (off_prec
);
2018 if (destdecl
&& TREE_CODE (destdecl
) == SSA_NAME
)
2020 gimple
*stmt
= SSA_NAME_DEF_STMT (destdecl
);
2021 if (is_gimple_call (stmt
))
2023 destdecl
= NULL_TREE
;
2026 if (!get_range (destsize
, sizrng
, rvals
))
2028 /* On failure, rather than failing, set the maximum range
2029 so that overflow in allocated objects whose size depends
2030 on the strlen of the source can still be diagnosed
2032 sizrng
[0] = wi::zero (siz_prec
);
2033 sizrng
[1] = wi::to_wide (TYPE_MAX_VALUE (sizetype
));
2040 sizrng
[0] = wi::zero (siz_prec
);
2041 sizrng
[1] = wi::to_wide (TYPE_MAX_VALUE (sizetype
));
2044 sizrng
[0] = sizrng
[0].from (sizrng
[0], siz_prec
, UNSIGNED
);
2045 sizrng
[1] = sizrng
[1].from (sizrng
[1], siz_prec
, UNSIGNED
);
2047 /* Return early if the DESTSIZE size expression is the same as LEN
2048 and the offset into the destination is zero. This might happen
2049 in the case of a pair of malloc and memset calls to allocate
2050 an object and clear it as if by calloc. */
2051 if (destsize
== len
&& !plus_one
&& offrng
[0] == 0 && offrng
[0] == offrng
[1])
2055 if (!get_range (len
, lenrng
, rvals
))
2064 /* The size of the remaining space in the destination computed
2065 as the size of the latter minus the offset into it. */
2066 wide_int spcrng
[2] = { sizrng
[0], sizrng
[1] };
2067 if (wi::neg_p (offrng
[0]) && wi::neg_p (offrng
[1]))
2069 /* When the offset is negative and the size of the destination
2070 object unknown there is little to do.
2071 FIXME: Detect offsets that are necessarily invalid regardless
2072 of the size of the object. */
2076 /* The remaining space is necessarily zero. */
2077 spcrng
[0] = spcrng
[1] = wi::zero (spcrng
->get_precision ());
2079 else if (wi::neg_p (offrng
[0]))
2081 /* When the lower bound of the offset is negative but the upper
2082 bound is not, reduce the upper bound of the remaining space
2083 by the upper bound of the offset but leave the lower bound
2084 unchanged. If that makes the upper bound of the space less
2085 than the lower bound swap the two. */
2086 spcrng
[1] -= wi::ltu_p (offrng
[1], spcrng
[1]) ? offrng
[1] : spcrng
[1];
2087 if (wi::ltu_p (spcrng
[1], spcrng
[0]))
2088 std::swap (spcrng
[1], spcrng
[0]);
2092 /* When the offset is positive reduce the remaining space by
2093 the lower bound of the offset or clear it if the offset is
2095 spcrng
[0] -= wi::ltu_p (offrng
[0], spcrng
[0]) ? offrng
[0] : spcrng
[0];
2096 spcrng
[1] -= wi::ltu_p (offrng
[0], spcrng
[1]) ? offrng
[0] : spcrng
[1];
2099 if (wi::leu_p (lenrng
[0], spcrng
[0])
2100 && wi::leu_p (lenrng
[1], spcrng
[1]))
2103 if (lenrng
[0] == spcrng
[1]
2105 || !si
|| !is_strlen_related_p (si
->ptr
, len
)))
2108 location_t loc
= gimple_nonartificial_location (stmt
);
2109 if (loc
== UNKNOWN_LOCATION
&& dest
&& EXPR_HAS_LOCATION (dest
))
2110 loc
= tree_nonartificial_location (dest
);
2111 loc
= expansion_point_location_if_in_system_header (loc
);
2113 bool warned
= false;
2114 if (wi::leu_p (lenrng
[0], spcrng
[1]))
2117 && (!si
|| !is_strlen_related_p (si
->ptr
, len
)))
2121 ? warning_at (loc
, OPT_Wstringop_overflow_
,
2122 "%G%qD writing one too many bytes into a region "
2123 "of a size that depends on %<strlen%>",
2125 : warning_at (loc
, OPT_Wstringop_overflow_
,
2126 "%Gwriting one too many bytes into a region "
2127 "of a size that depends on %<strlen%>",
2130 else if (lenrng
[0] == lenrng
[1])
2132 if (spcrng
[0] == spcrng
[1])
2134 ? warning_n (loc
, OPT_Wstringop_overflow_
,
2135 lenrng
[0].to_uhwi (),
2136 "%G%qD writing %wu byte into a region "
2138 "%G%qD writing %wu bytes into a region "
2140 stmt
, writefn
, lenrng
[0].to_uhwi (),
2141 spcrng
[0].to_uhwi ())
2142 : warning_n (loc
, OPT_Wstringop_overflow_
,
2143 lenrng
[0].to_uhwi (),
2144 "%Gwriting %wu byte into a region "
2146 "%Gwriting %wu bytes into a region "
2148 stmt
, lenrng
[0].to_uhwi (),
2149 spcrng
[0].to_uhwi ()));
2152 ? warning_n (loc
, OPT_Wstringop_overflow_
,
2153 lenrng
[0].to_uhwi (),
2154 "%G%qD writing %wu byte into a region "
2155 "of size between %wu and %wu",
2156 "%G%qD writing %wu bytes into a region "
2157 "of size between %wu and %wu",
2158 stmt
, writefn
, lenrng
[0].to_uhwi (),
2159 spcrng
[0].to_uhwi (), spcrng
[1].to_uhwi ())
2160 : warning_n (loc
, OPT_Wstringop_overflow_
,
2161 lenrng
[0].to_uhwi (),
2162 "%Gwriting %wu byte into a region "
2163 "of size between %wu and %wu",
2164 "%Gwriting %wu bytes into a region "
2165 "of size between %wu and %wu",
2166 stmt
, lenrng
[0].to_uhwi (),
2167 spcrng
[0].to_uhwi (), spcrng
[1].to_uhwi ()));
2169 else if (spcrng
[0] == spcrng
[1])
2171 ? warning_at (loc
, OPT_Wstringop_overflow_
,
2172 "%G%qD writing between %wu and %wu bytes "
2173 "into a region of size %wu",
2174 stmt
, writefn
, lenrng
[0].to_uhwi (),
2175 lenrng
[1].to_uhwi (),
2176 spcrng
[0].to_uhwi ())
2177 : warning_at (loc
, OPT_Wstringop_overflow_
,
2178 "%Gwriting between %wu and %wu bytes "
2179 "into a region of size %wu",
2180 stmt
, lenrng
[0].to_uhwi (),
2181 lenrng
[1].to_uhwi (),
2182 spcrng
[0].to_uhwi ()));
2185 ? warning_at (loc
, OPT_Wstringop_overflow_
,
2186 "%G%qD writing between %wu and %wu bytes "
2187 "into a region of size between %wu and %wu",
2188 stmt
, writefn
, lenrng
[0].to_uhwi (),
2189 lenrng
[1].to_uhwi (),
2190 spcrng
[0].to_uhwi (), spcrng
[1].to_uhwi ())
2191 : warning_at (loc
, OPT_Wstringop_overflow_
,
2192 "%Gwriting between %wu and %wu bytes "
2193 "into a region of size between %wu and %wu",
2194 stmt
, lenrng
[0].to_uhwi (),
2195 lenrng
[1].to_uhwi (),
2196 spcrng
[0].to_uhwi (), spcrng
[1].to_uhwi ()));
2201 gimple_set_no_warning (stmt
, true);
2203 /* If DESTOFF is not null, use it to format the offset value/range. */
2205 get_range (destoff
, offrng
);
2207 /* Format the offset to keep the number of inform calls from growing
2210 if (offrng
[0] == offrng
[1])
2211 sprintf (offstr
, "%lli", (long long) offrng
[0].to_shwi ());
2213 sprintf (offstr
, "[%lli, %lli]",
2214 (long long) offrng
[0].to_shwi (), (long long) offrng
[1].to_shwi ());
2218 if (tree size
= DECL_SIZE_UNIT (destdecl
))
2219 inform (DECL_SOURCE_LOCATION (destdecl
),
2220 "at offset %s to object %qD with size %E declared here",
2221 offstr
, destdecl
, size
);
2223 inform (DECL_SOURCE_LOCATION (destdecl
),
2224 "at offset %s to object %qD declared here",
2232 tree allocfn
= gimple_call_fndecl (alloc_call
);
2235 /* For an ALLOC_CALL via a function pointer make a small effort
2236 to determine the destination of the pointer. */
2237 allocfn
= gimple_call_fn (alloc_call
);
2238 if (TREE_CODE (allocfn
) == SSA_NAME
)
2240 gimple
*def
= SSA_NAME_DEF_STMT (allocfn
);
2241 if (gimple_assign_single_p (def
))
2243 tree rhs
= gimple_assign_rhs1 (def
);
2246 else if (TREE_CODE (rhs
) == COMPONENT_REF
)
2247 allocfn
= TREE_OPERAND (rhs
, 1);
2252 if (gimple_call_builtin_p (alloc_call
, BUILT_IN_ALLOCA_WITH_ALIGN
))
2254 if (sizrng
[0] == sizrng
[1])
2255 inform (gimple_location (alloc_call
),
2256 "at offset %s to an object with size %wu declared here",
2257 offstr
, sizrng
[0].to_uhwi ());
2258 else if (sizrng
[0] == 0)
2260 /* Avoid printing impossible sizes. */
2261 if (wi::ltu_p (sizrng
[1],
2262 wi::to_wide (TYPE_MAX_VALUE (ptrdiff_type_node
)) - 2))
2263 inform (gimple_location (alloc_call
),
2264 "at offset %s to an object with size at most %wu "
2266 offstr
, sizrng
[1].to_uhwi ());
2268 inform (gimple_location (alloc_call
),
2269 "at offset %s to an object declared here", offstr
);
2272 inform (gimple_location (alloc_call
),
2273 "at offset %s to an object with size between %wu and %wu "
2275 offstr
, sizrng
[0].to_uhwi (), sizrng
[1].to_uhwi ());
2279 if (sizrng
[0] == sizrng
[1])
2280 inform (gimple_location (alloc_call
),
2281 "at offset %s to an object with size %wu allocated by %qE here",
2282 offstr
, sizrng
[0].to_uhwi (), allocfn
);
2283 else if (sizrng
[0] == 0)
2285 /* Avoid printing impossible sizes. */
2286 if (wi::ltu_p (sizrng
[1],
2287 wi::to_wide (TYPE_MAX_VALUE (ptrdiff_type_node
)) - 2))
2288 inform (gimple_location (alloc_call
),
2289 "at offset %s to an object with size at most %wu allocated "
2291 offstr
, sizrng
[1].to_uhwi (), allocfn
);
2293 inform (gimple_location (alloc_call
),
2294 "at offset %s to an object allocated by %qE here",
2298 inform (gimple_location (alloc_call
),
2299 "at offset %s to an object with size between %wu and %wu "
2300 "allocated by %qE here",
2301 offstr
, sizrng
[0].to_uhwi (), sizrng
[1].to_uhwi (), allocfn
);
2304 /* Convenience wrapper for the above. */
2307 maybe_warn_overflow (gimple
*stmt
, unsigned HOST_WIDE_INT len
,
2308 const vr_values
*rvals
= NULL
, strinfo
*si
= NULL
,
2309 bool plus_one
= false, bool rawmem
= false)
2311 maybe_warn_overflow (stmt
, build_int_cst (size_type_node
, len
), rvals
,
2312 si
, plus_one
, rawmem
);
2315 /* Handle a strlen call. If strlen of the argument is known, replace
2316 the strlen call with the known value, otherwise remember that strlen
2317 of the argument is stored in the lhs SSA_NAME. */
2320 handle_builtin_strlen (gimple_stmt_iterator
*gsi
)
2322 gimple
*stmt
= gsi_stmt (*gsi
);
2323 tree lhs
= gimple_call_lhs (stmt
);
2325 if (lhs
== NULL_TREE
)
2328 location_t loc
= gimple_location (stmt
);
2329 tree callee
= gimple_call_fndecl (stmt
);
2330 tree src
= gimple_call_arg (stmt
, 0);
2331 tree bound
= (DECL_FUNCTION_CODE (callee
) == BUILT_IN_STRNLEN
2332 ? gimple_call_arg (stmt
, 1) : NULL_TREE
);
2333 int idx
= get_stridx (src
);
2334 if (idx
|| (bound
&& integer_zerop (bound
)))
2340 rhs
= build_int_cst (TREE_TYPE (lhs
), ~idx
);
2346 si
= get_strinfo (idx
);
2349 rhs
= get_string_length (si
);
2350 /* For strnlen, if bound is constant, even if si is not known
2351 to be zero terminated, if we know at least bound bytes are
2352 not zero, the return value will be bound. */
2353 if (rhs
== NULL_TREE
2354 && bound
!= NULL_TREE
2355 && TREE_CODE (bound
) == INTEGER_CST
2356 && si
->nonzero_chars
!= NULL_TREE
2357 && TREE_CODE (si
->nonzero_chars
) == INTEGER_CST
2358 && tree_int_cst_le (bound
, si
->nonzero_chars
))
2362 if (rhs
!= NULL_TREE
)
2364 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2366 fprintf (dump_file
, "Optimizing: ");
2367 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2369 rhs
= unshare_expr (rhs
);
2370 if (!useless_type_conversion_p (TREE_TYPE (lhs
), TREE_TYPE (rhs
)))
2371 rhs
= fold_convert_loc (loc
, TREE_TYPE (lhs
), rhs
);
2374 rhs
= fold_build2_loc (loc
, MIN_EXPR
, TREE_TYPE (rhs
), rhs
, bound
);
2376 if (!update_call_from_tree (gsi
, rhs
))
2377 gimplify_and_update_call_from_tree (gsi
, rhs
);
2378 stmt
= gsi_stmt (*gsi
);
2380 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2382 fprintf (dump_file
, "into: ");
2383 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2387 /* Don't update anything for strnlen. */
2388 && bound
== NULL_TREE
2389 && TREE_CODE (si
->nonzero_chars
) != SSA_NAME
2390 && TREE_CODE (si
->nonzero_chars
) != INTEGER_CST
2391 && !SSA_NAME_OCCURS_IN_ABNORMAL_PHI (lhs
))
2393 si
= unshare_strinfo (si
);
2394 si
->nonzero_chars
= lhs
;
2395 gcc_assert (si
->full_string_p
);
2398 if (strlen_to_stridx
2399 && (bound
== NULL_TREE
2400 /* For strnlen record this only if the call is proven
2401 to return the same value as strlen would. */
2402 || (TREE_CODE (bound
) == INTEGER_CST
2403 && TREE_CODE (rhs
) == INTEGER_CST
2404 && tree_int_cst_lt (rhs
, bound
))))
2405 strlen_to_stridx
->put (lhs
, stridx_strlenloc (idx
, loc
));
2410 if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (lhs
))
2414 idx
= new_stridx (src
);
2417 strinfo
*si
= get_strinfo (idx
);
2420 if (!si
->full_string_p
&& !si
->stmt
)
2422 /* Until now we only had a lower bound on the string length.
2423 Install LHS as the actual length. */
2424 si
= unshare_strinfo (si
);
2425 tree old
= si
->nonzero_chars
;
2426 si
->nonzero_chars
= lhs
;
2427 si
->full_string_p
= true;
2428 if (old
&& TREE_CODE (old
) == INTEGER_CST
)
2430 old
= fold_convert_loc (loc
, TREE_TYPE (lhs
), old
);
2431 tree adj
= fold_build2_loc (loc
, MINUS_EXPR
,
2432 TREE_TYPE (lhs
), lhs
, old
);
2433 adjust_related_strinfos (loc
, si
, adj
);
2434 /* Use the constant minimum length as the lower bound
2435 of the non-constant length. */
2436 wide_int min
= wi::to_wide (old
);
2438 = wi::to_wide (TYPE_MAX_VALUE (ptrdiff_type_node
)) - 2;
2439 set_strlen_range (lhs
, min
, max
);
2455 /* Only store the new length information for calls to strlen(),
2456 not for those to strnlen(). */
2457 strinfo
*si
= new_strinfo (src
, idx
, lhs
, true);
2458 set_strinfo (idx
, si
);
2459 find_equal_ptrs (src
, idx
);
2462 /* For SRC that is an array of N elements, set LHS's range
2463 to [0, min (N, BOUND)]. A constant return value means
2464 the range would have consisted of a single value. In
2465 that case, fold the result into the returned constant. */
2466 if (tree ret
= maybe_set_strlen_range (lhs
, src
, bound
))
2467 if (TREE_CODE (ret
) == INTEGER_CST
)
2469 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2471 fprintf (dump_file
, "Optimizing: ");
2472 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2474 if (!useless_type_conversion_p (TREE_TYPE (lhs
), TREE_TYPE (ret
)))
2475 ret
= fold_convert_loc (loc
, TREE_TYPE (lhs
), ret
);
2476 if (!update_call_from_tree (gsi
, ret
))
2477 gimplify_and_update_call_from_tree (gsi
, ret
);
2478 stmt
= gsi_stmt (*gsi
);
2480 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2482 fprintf (dump_file
, "into: ");
2483 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2487 if (strlen_to_stridx
&& !bound
)
2488 strlen_to_stridx
->put (lhs
, stridx_strlenloc (idx
, loc
));
2492 /* Handle a strchr call. If strlen of the first argument is known, replace
2493 the strchr (x, 0) call with the endptr or x + strlen, otherwise remember
2494 that lhs of the call is endptr and strlen of the argument is endptr - x. */
2497 handle_builtin_strchr (gimple_stmt_iterator
*gsi
)
2499 gimple
*stmt
= gsi_stmt (*gsi
);
2500 tree lhs
= gimple_call_lhs (stmt
);
2502 if (lhs
== NULL_TREE
)
2505 if (!integer_zerop (gimple_call_arg (stmt
, 1)))
2508 tree src
= gimple_call_arg (stmt
, 0);
2510 /* Avoid folding if the first argument is not a nul-terminated array.
2511 Defer warning until later. */
2512 if (!check_nul_terminated_array (NULL_TREE
, src
))
2515 int idx
= get_stridx (src
);
2522 rhs
= build_int_cst (size_type_node
, ~idx
);
2526 si
= get_strinfo (idx
);
2528 rhs
= get_string_length (si
);
2530 if (rhs
!= NULL_TREE
)
2532 location_t loc
= gimple_location (stmt
);
2534 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2536 fprintf (dump_file
, "Optimizing: ");
2537 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2539 if (si
!= NULL
&& si
->endptr
!= NULL_TREE
)
2541 rhs
= unshare_expr (si
->endptr
);
2542 if (!useless_type_conversion_p (TREE_TYPE (lhs
),
2544 rhs
= fold_convert_loc (loc
, TREE_TYPE (lhs
), rhs
);
2548 rhs
= fold_convert_loc (loc
, sizetype
, unshare_expr (rhs
));
2549 rhs
= fold_build2_loc (loc
, POINTER_PLUS_EXPR
,
2550 TREE_TYPE (src
), src
, rhs
);
2551 if (!useless_type_conversion_p (TREE_TYPE (lhs
),
2553 rhs
= fold_convert_loc (loc
, TREE_TYPE (lhs
), rhs
);
2555 if (!update_call_from_tree (gsi
, rhs
))
2556 gimplify_and_update_call_from_tree (gsi
, rhs
);
2557 stmt
= gsi_stmt (*gsi
);
2559 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2561 fprintf (dump_file
, "into: ");
2562 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2565 && si
->endptr
== NULL_TREE
2566 && !SSA_NAME_OCCURS_IN_ABNORMAL_PHI (lhs
))
2568 si
= unshare_strinfo (si
);
2571 zero_length_string (lhs
, si
);
2575 if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (lhs
))
2577 if (TREE_CODE (src
) != SSA_NAME
|| !SSA_NAME_OCCURS_IN_ABNORMAL_PHI (src
))
2580 idx
= new_stridx (src
);
2581 else if (get_strinfo (idx
) != NULL
)
2583 zero_length_string (lhs
, NULL
);
2588 location_t loc
= gimple_location (stmt
);
2589 tree lhsu
= fold_convert_loc (loc
, size_type_node
, lhs
);
2590 tree srcu
= fold_convert_loc (loc
, size_type_node
, src
);
2591 tree length
= fold_build2_loc (loc
, MINUS_EXPR
,
2592 size_type_node
, lhsu
, srcu
);
2593 strinfo
*si
= new_strinfo (src
, idx
, length
, true);
2595 set_strinfo (idx
, si
);
2596 find_equal_ptrs (src
, idx
);
2597 zero_length_string (lhs
, si
);
2601 zero_length_string (lhs
, NULL
);
2604 /* Handle a strcpy-like ({st{r,p}cpy,__st{r,p}cpy_chk}) call.
2605 If strlen of the second argument is known, strlen of the first argument
2606 is the same after this call. Furthermore, attempt to convert it to
2607 memcpy. Uses RVALS to determine range information. */
2610 handle_builtin_strcpy (enum built_in_function bcode
, gimple_stmt_iterator
*gsi
,
2611 const vr_values
*rvals
)
2614 tree src
, dst
, srclen
, len
, lhs
, type
, fn
, oldlen
;
2616 gimple
*stmt
= gsi_stmt (*gsi
);
2617 strinfo
*si
, *dsi
, *olddsi
, *zsi
;
2620 src
= gimple_call_arg (stmt
, 1);
2621 dst
= gimple_call_arg (stmt
, 0);
2622 lhs
= gimple_call_lhs (stmt
);
2623 idx
= get_stridx (src
);
2626 si
= get_strinfo (idx
);
2628 didx
= get_stridx (dst
);
2632 olddsi
= get_strinfo (didx
);
2637 adjust_last_stmt (olddsi
, stmt
, false);
2641 srclen
= get_string_length (si
);
2643 srclen
= build_int_cst (size_type_node
, ~idx
);
2645 maybe_warn_overflow (stmt
, srclen
, rvals
, olddsi
, true);
2648 adjust_last_stmt (olddsi
, stmt
, false);
2650 loc
= gimple_location (stmt
);
2651 if (srclen
== NULL_TREE
)
2654 case BUILT_IN_STRCPY
:
2655 case BUILT_IN_STRCPY_CHK
:
2656 if (lhs
!= NULL_TREE
|| !builtin_decl_implicit_p (BUILT_IN_STPCPY
))
2659 case BUILT_IN_STPCPY
:
2660 case BUILT_IN_STPCPY_CHK
:
2661 if (lhs
== NULL_TREE
)
2665 tree lhsuint
= fold_convert_loc (loc
, size_type_node
, lhs
);
2666 srclen
= fold_convert_loc (loc
, size_type_node
, dst
);
2667 srclen
= fold_build2_loc (loc
, MINUS_EXPR
, size_type_node
,
2677 didx
= new_stridx (dst
);
2683 oldlen
= olddsi
->nonzero_chars
;
2684 dsi
= unshare_strinfo (olddsi
);
2685 dsi
->nonzero_chars
= srclen
;
2686 dsi
->full_string_p
= (srclen
!= NULL_TREE
);
2687 /* Break the chain, so adjust_related_strinfo on later pointers in
2688 the chain won't adjust this one anymore. */
2691 dsi
->endptr
= NULL_TREE
;
2695 dsi
= new_strinfo (dst
, didx
, srclen
, srclen
!= NULL_TREE
);
2696 set_strinfo (didx
, dsi
);
2697 find_equal_ptrs (dst
, didx
);
2699 dsi
->writable
= true;
2700 dsi
->dont_invalidate
= true;
2702 if (dsi
->nonzero_chars
== NULL_TREE
)
2706 /* If string length of src is unknown, use delayed length
2707 computation. If string length of dst will be needed, it
2708 can be computed by transforming this strcpy call into
2709 stpcpy and subtracting dst from the return value. */
2711 /* Look for earlier strings whose length could be determined if
2712 this strcpy is turned into an stpcpy. */
2714 if (dsi
->prev
!= 0 && (chainsi
= verify_related_strinfos (dsi
)) != NULL
)
2716 for (; chainsi
&& chainsi
!= dsi
; chainsi
= get_strinfo (chainsi
->next
))
2718 /* When setting a stmt for delayed length computation
2719 prevent all strinfos through dsi from being
2721 chainsi
= unshare_strinfo (chainsi
);
2722 chainsi
->stmt
= stmt
;
2723 chainsi
->nonzero_chars
= NULL_TREE
;
2724 chainsi
->full_string_p
= false;
2725 chainsi
->endptr
= NULL_TREE
;
2726 chainsi
->dont_invalidate
= true;
2731 /* Try to detect overlap before returning. This catches cases
2732 like strcpy (d, d + n) where n is non-constant whose range
2733 is such that (n <= strlen (d) holds).
2735 OLDDSI->NONZERO_chars may have been reset by this point with
2736 oldlen holding it original value. */
2737 if (olddsi
&& oldlen
)
2739 /* Add 1 for the terminating NUL. */
2740 tree type
= TREE_TYPE (oldlen
);
2741 oldlen
= fold_build2 (PLUS_EXPR
, type
, oldlen
,
2742 build_int_cst (type
, 1));
2743 check_bounds_or_overlap (stmt
, olddsi
->ptr
, src
, oldlen
, NULL_TREE
);
2751 tree adj
= NULL_TREE
;
2752 if (oldlen
== NULL_TREE
)
2754 else if (integer_zerop (oldlen
))
2756 else if (TREE_CODE (oldlen
) == INTEGER_CST
2757 || TREE_CODE (srclen
) == INTEGER_CST
)
2758 adj
= fold_build2_loc (loc
, MINUS_EXPR
,
2759 TREE_TYPE (srclen
), srclen
,
2760 fold_convert_loc (loc
, TREE_TYPE (srclen
),
2762 if (adj
!= NULL_TREE
)
2763 adjust_related_strinfos (loc
, dsi
, adj
);
2767 /* strcpy src may not overlap dst, so src doesn't need to be
2768 invalidated either. */
2770 si
->dont_invalidate
= true;
2776 case BUILT_IN_STRCPY
:
2777 fn
= builtin_decl_implicit (BUILT_IN_MEMCPY
);
2779 ssa_ver_to_stridx
[SSA_NAME_VERSION (lhs
)] = didx
;
2781 case BUILT_IN_STRCPY_CHK
:
2782 fn
= builtin_decl_explicit (BUILT_IN_MEMCPY_CHK
);
2784 ssa_ver_to_stridx
[SSA_NAME_VERSION (lhs
)] = didx
;
2786 case BUILT_IN_STPCPY
:
2787 /* This would need adjustment of the lhs (subtract one),
2788 or detection that the trailing '\0' doesn't need to be
2789 written, if it will be immediately overwritten.
2790 fn = builtin_decl_explicit (BUILT_IN_MEMPCPY); */
2794 zsi
= zero_length_string (lhs
, dsi
);
2797 case BUILT_IN_STPCPY_CHK
:
2798 /* This would need adjustment of the lhs (subtract one),
2799 or detection that the trailing '\0' doesn't need to be
2800 written, if it will be immediately overwritten.
2801 fn = builtin_decl_explicit (BUILT_IN_MEMPCPY_CHK); */
2805 zsi
= zero_length_string (lhs
, dsi
);
2812 zsi
->dont_invalidate
= true;
2816 tree args
= TYPE_ARG_TYPES (TREE_TYPE (fn
));
2817 type
= TREE_VALUE (TREE_CHAIN (TREE_CHAIN (args
)));
2820 type
= size_type_node
;
2822 len
= fold_convert_loc (loc
, type
, unshare_expr (srclen
));
2823 len
= fold_build2_loc (loc
, PLUS_EXPR
, type
, len
, build_int_cst (type
, 1));
2825 /* Set the no-warning bit on the transformed statement? */
2826 bool set_no_warning
= false;
2828 if (const strinfo
*chksi
= olddsi
? olddsi
: dsi
)
2830 && check_bounds_or_overlap (stmt
, chksi
->ptr
, si
->ptr
, NULL_TREE
, len
))
2832 gimple_set_no_warning (stmt
, true);
2833 set_no_warning
= true;
2836 if (fn
== NULL_TREE
)
2839 len
= force_gimple_operand_gsi (gsi
, len
, true, NULL_TREE
, true,
2841 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2843 fprintf (dump_file
, "Optimizing: ");
2844 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2846 if (gimple_call_num_args (stmt
) == 2)
2847 success
= update_gimple_call (gsi
, fn
, 3, dst
, src
, len
);
2849 success
= update_gimple_call (gsi
, fn
, 4, dst
, src
, len
,
2850 gimple_call_arg (stmt
, 2));
2853 stmt
= gsi_stmt (*gsi
);
2855 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2857 fprintf (dump_file
, "into: ");
2858 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
2860 /* Allow adjust_last_stmt to decrease this memcpy's size. */
2861 laststmt
.stmt
= stmt
;
2862 laststmt
.len
= srclen
;
2863 laststmt
.stridx
= dsi
->idx
;
2865 else if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
2866 fprintf (dump_file
, "not possible.\n");
2869 gimple_set_no_warning (stmt
, true);
2872 /* Check the size argument to the built-in forms of stpncpy and strncpy
2873 for out-of-bounds offsets or overlapping access, and to see if the
2874 size argument is derived from a call to strlen() on the source argument,
2875 and if so, issue an appropriate warning. */
2878 handle_builtin_strncat (built_in_function bcode
, gimple_stmt_iterator
*gsi
)
2880 /* Same as stxncpy(). */
2881 handle_builtin_stxncpy (bcode
, gsi
);
2884 /* Return true if LEN depends on a call to strlen(SRC) in an interesting
2885 way. LEN can either be an integer expression, or a pointer (to char).
2886 When it is the latter (such as in recursive calls to self) is is
2887 assumed to be the argument in some call to strlen() whose relationship
2888 to SRC is being ascertained. */
2891 is_strlen_related_p (tree src
, tree len
)
2893 if (TREE_CODE (TREE_TYPE (len
)) == POINTER_TYPE
2894 && operand_equal_p (src
, len
, 0))
2897 if (TREE_CODE (len
) != SSA_NAME
)
2900 if (TREE_CODE (src
) == SSA_NAME
)
2902 gimple
*srcdef
= SSA_NAME_DEF_STMT (src
);
2903 if (is_gimple_assign (srcdef
))
2905 /* Handle bitwise AND used in conversions from wider size_t
2906 to narrower unsigned types. */
2907 tree_code code
= gimple_assign_rhs_code (srcdef
);
2908 if (code
== BIT_AND_EXPR
2909 || code
== NOP_EXPR
)
2910 return is_strlen_related_p (gimple_assign_rhs1 (srcdef
), len
);
2915 if (gimple_call_builtin_p (srcdef
, BUILT_IN_NORMAL
))
2917 /* If SRC is the result of a call to an allocation function
2918 or strlen, use the function's argument instead. */
2919 tree func
= gimple_call_fndecl (srcdef
);
2920 built_in_function code
= DECL_FUNCTION_CODE (func
);
2921 if (code
== BUILT_IN_ALLOCA
2922 || code
== BUILT_IN_ALLOCA_WITH_ALIGN
2923 || code
== BUILT_IN_MALLOC
2924 || code
== BUILT_IN_STRLEN
)
2925 return is_strlen_related_p (gimple_call_arg (srcdef
, 0), len
);
2927 /* FIXME: Handle other functions with attribute alloc_size. */
2932 gimple
*lendef
= SSA_NAME_DEF_STMT (len
);
2936 if (is_gimple_call (lendef
))
2938 tree func
= gimple_call_fndecl (lendef
);
2939 if (!valid_builtin_call (lendef
)
2940 || DECL_FUNCTION_CODE (func
) != BUILT_IN_STRLEN
)
2943 tree arg
= gimple_call_arg (lendef
, 0);
2944 return is_strlen_related_p (src
, arg
);
2947 if (!is_gimple_assign (lendef
))
2950 tree_code code
= gimple_assign_rhs_code (lendef
);
2951 tree rhs1
= gimple_assign_rhs1 (lendef
);
2952 tree rhstype
= TREE_TYPE (rhs1
);
2954 if ((TREE_CODE (rhstype
) == POINTER_TYPE
&& code
== POINTER_PLUS_EXPR
)
2955 || (INTEGRAL_TYPE_P (rhstype
)
2956 && (code
== BIT_AND_EXPR
2957 || code
== NOP_EXPR
)))
2959 /* Pointer plus (an integer), and truncation are considered among
2960 the (potentially) related expressions to strlen. */
2961 return is_strlen_related_p (src
, rhs1
);
2964 if (tree rhs2
= gimple_assign_rhs2 (lendef
))
2966 /* Integer subtraction is considered strlen-related when both
2967 arguments are integers and second one is strlen-related. */
2968 rhstype
= TREE_TYPE (rhs2
);
2969 if (INTEGRAL_TYPE_P (rhstype
) && code
== MINUS_EXPR
)
2970 return is_strlen_related_p (src
, rhs2
);
2976 /* Called by handle_builtin_stxncpy and by gimple_fold_builtin_strncpy
2978 Check to see if the specified bound is a) equal to the size of
2979 the destination DST and if so, b) if it's immediately followed by
2980 DST[CNT - 1] = '\0'. If a) holds and b) does not, warn. Otherwise,
2981 do nothing. Return true if diagnostic has been issued.
2983 The purpose is to diagnose calls to strncpy and stpncpy that do
2984 not nul-terminate the copy while allowing for the idiom where
2985 such a call is immediately followed by setting the last element
2988 strncpy (a, s, sizeof a);
2989 a[sizeof a - 1] = '\0';
2993 maybe_diag_stxncpy_trunc (gimple_stmt_iterator gsi
, tree src
, tree cnt
)
2995 gimple
*stmt
= gsi_stmt (gsi
);
2996 if (gimple_no_warning_p (stmt
))
2999 wide_int cntrange
[2];
3001 if (TREE_CODE (cnt
) == INTEGER_CST
)
3002 cntrange
[0] = cntrange
[1] = wi::to_wide (cnt
);
3003 else if (TREE_CODE (cnt
) == SSA_NAME
)
3005 enum value_range_kind rng
= get_range_info (cnt
, cntrange
, cntrange
+ 1);
3006 if (rng
== VR_RANGE
)
3008 else if (rng
== VR_ANTI_RANGE
)
3010 wide_int maxobjsize
= wi::to_wide (TYPE_MAX_VALUE (ptrdiff_type_node
));
3012 if (wi::ltu_p (cntrange
[1], maxobjsize
))
3014 cntrange
[0] = cntrange
[1] + 1;
3015 cntrange
[1] = maxobjsize
;
3019 cntrange
[1] = cntrange
[0] - 1;
3020 cntrange
[0] = wi::zero (TYPE_PRECISION (TREE_TYPE (cnt
)));
3029 /* Negative value is the constant string length. If it's less than
3030 the lower bound there is no truncation. Avoid calling get_stridx()
3031 when ssa_ver_to_stridx is empty. That implies the caller isn't
3032 running under the control of this pass and ssa_ver_to_stridx hasn't
3033 been created yet. */
3034 int sidx
= ssa_ver_to_stridx
.length () ? get_stridx (src
) : 0;
3035 if (sidx
< 0 && wi::gtu_p (cntrange
[0], ~sidx
))
3038 tree dst
= gimple_call_arg (stmt
, 0);
3040 if (TREE_CODE (dstdecl
) == ADDR_EXPR
)
3041 dstdecl
= TREE_OPERAND (dstdecl
, 0);
3043 tree ref
= NULL_TREE
;
3047 /* If the source is a non-string return early to avoid warning
3048 for possible truncation (if the truncation is certain SIDX
3050 tree srcdecl
= gimple_call_arg (stmt
, 1);
3051 if (TREE_CODE (srcdecl
) == ADDR_EXPR
)
3052 srcdecl
= TREE_OPERAND (srcdecl
, 0);
3053 if (get_attr_nonstring_decl (srcdecl
, &ref
))
3057 /* Likewise, if the destination refers to a an array/pointer declared
3058 nonstring return early. */
3059 if (get_attr_nonstring_decl (dstdecl
, &ref
))
3062 /* Look for dst[i] = '\0'; after the stxncpy() call and if found
3063 avoid the truncation warning. */
3064 gsi_next_nondebug (&gsi
);
3065 gimple
*next_stmt
= gsi_stmt (gsi
);
3068 /* When there is no statement in the same basic block check
3069 the immediate successor block. */
3070 if (basic_block bb
= gimple_bb (stmt
))
3072 if (single_succ_p (bb
))
3074 /* For simplicity, ignore blocks with multiple outgoing
3075 edges for now and only consider successor blocks along
3077 edge e
= EDGE_SUCC (bb
, 0);
3078 if (!(e
->flags
& EDGE_ABNORMAL
))
3080 gsi
= gsi_start_bb (e
->dest
);
3081 next_stmt
= gsi_stmt (gsi
);
3082 if (next_stmt
&& is_gimple_debug (next_stmt
))
3084 gsi_next_nondebug (&gsi
);
3085 next_stmt
= gsi_stmt (gsi
);
3092 if (next_stmt
&& is_gimple_assign (next_stmt
))
3094 tree lhs
= gimple_assign_lhs (next_stmt
);
3095 tree_code code
= TREE_CODE (lhs
);
3096 if (code
== ARRAY_REF
|| code
== MEM_REF
)
3097 lhs
= TREE_OPERAND (lhs
, 0);
3099 tree func
= gimple_call_fndecl (stmt
);
3100 if (DECL_FUNCTION_CODE (func
) == BUILT_IN_STPNCPY
)
3102 tree ret
= gimple_call_lhs (stmt
);
3103 if (ret
&& operand_equal_p (ret
, lhs
, 0))
3107 /* Determine the base address and offset of the reference,
3108 ignoring the innermost array index. */
3109 if (TREE_CODE (ref
) == ARRAY_REF
)
3110 ref
= TREE_OPERAND (ref
, 0);
3113 tree dstbase
= get_addr_base_and_unit_offset (ref
, &dstoff
);
3116 tree lhsbase
= get_addr_base_and_unit_offset (lhs
, &lhsoff
);
3119 && known_eq (dstoff
, lhsoff
)
3120 && operand_equal_p (dstbase
, lhsbase
, 0))
3124 int prec
= TYPE_PRECISION (TREE_TYPE (cnt
));
3125 wide_int lenrange
[2];
3126 if (strinfo
*sisrc
= sidx
> 0 ? get_strinfo (sidx
) : NULL
)
3128 lenrange
[0] = (sisrc
->nonzero_chars
3129 && TREE_CODE (sisrc
->nonzero_chars
) == INTEGER_CST
3130 ? wi::to_wide (sisrc
->nonzero_chars
)
3132 lenrange
[1] = lenrange
[0];
3135 lenrange
[0] = lenrange
[1] = wi::shwi (~sidx
, prec
);
3138 c_strlen_data lendata
= { };
3139 /* Set MAXBOUND to an arbitrary non-null non-integer node as a request
3140 to have it set to the length of the longest string in a PHI. */
3141 lendata
.maxbound
= src
;
3142 get_range_strlen (src
, &lendata
, /* eltsize = */1);
3143 if (TREE_CODE (lendata
.minlen
) == INTEGER_CST
3144 && TREE_CODE (lendata
.maxbound
) == INTEGER_CST
)
3146 /* When LENDATA.MAXLEN is unknown, reset LENDATA.MINLEN
3147 which stores the length of the shortest known string. */
3148 if (integer_all_onesp (lendata
.maxlen
))
3149 lenrange
[0] = wi::shwi (0, prec
);
3151 lenrange
[0] = wi::to_wide (lendata
.minlen
, prec
);
3152 lenrange
[1] = wi::to_wide (lendata
.maxbound
, prec
);
3156 lenrange
[0] = wi::shwi (0, prec
);
3157 lenrange
[1] = wi::shwi (-1, prec
);
3161 location_t callloc
= gimple_nonartificial_location (stmt
);
3162 callloc
= expansion_point_location_if_in_system_header (callloc
);
3164 tree func
= gimple_call_fndecl (stmt
);
3166 if (lenrange
[0] != 0 || !wi::neg_p (lenrange
[1]))
3168 /* If the longest source string is shorter than the lower bound
3169 of the specified count the copy is definitely nul-terminated. */
3170 if (wi::ltu_p (lenrange
[1], cntrange
[0]))
3173 if (wi::neg_p (lenrange
[1]))
3175 /* The length of one of the strings is unknown but at least
3176 one has non-zero length and that length is stored in
3177 LENRANGE[1]. Swap the bounds to force a "may be truncated"
3179 lenrange
[1] = lenrange
[0];
3180 lenrange
[0] = wi::shwi (0, prec
);
3183 /* Set to true for strncat whose bound is derived from the length
3184 of the destination (the expected usage pattern). */
3185 bool cat_dstlen_bounded
= false;
3186 if (DECL_FUNCTION_CODE (func
) == BUILT_IN_STRNCAT
)
3187 cat_dstlen_bounded
= is_strlen_related_p (dst
, cnt
);
3189 if (lenrange
[0] == cntrange
[1] && cntrange
[0] == cntrange
[1])
3190 return warning_n (callloc
, OPT_Wstringop_truncation
,
3191 cntrange
[0].to_uhwi (),
3192 "%G%qD output truncated before terminating "
3193 "nul copying %E byte from a string of the "
3195 "%G%qD output truncated before terminating nul "
3196 "copying %E bytes from a string of the same "
3199 else if (!cat_dstlen_bounded
)
3201 if (wi::geu_p (lenrange
[0], cntrange
[1]))
3203 /* The shortest string is longer than the upper bound of
3204 the count so the truncation is certain. */
3205 if (cntrange
[0] == cntrange
[1])
3206 return warning_n (callloc
, OPT_Wstringop_truncation
,
3207 cntrange
[0].to_uhwi (),
3208 "%G%qD output truncated copying %E byte "
3209 "from a string of length %wu",
3210 "%G%qD output truncated copying %E bytes "
3211 "from a string of length %wu",
3212 stmt
, func
, cnt
, lenrange
[0].to_uhwi ());
3214 return warning_at (callloc
, OPT_Wstringop_truncation
,
3215 "%G%qD output truncated copying between %wu "
3216 "and %wu bytes from a string of length %wu",
3217 stmt
, func
, cntrange
[0].to_uhwi (),
3218 cntrange
[1].to_uhwi (), lenrange
[0].to_uhwi ());
3220 else if (wi::geu_p (lenrange
[1], cntrange
[1]))
3222 /* The longest string is longer than the upper bound of
3223 the count so the truncation is possible. */
3224 if (cntrange
[0] == cntrange
[1])
3225 return warning_n (callloc
, OPT_Wstringop_truncation
,
3226 cntrange
[0].to_uhwi (),
3227 "%G%qD output may be truncated copying %E "
3228 "byte from a string of length %wu",
3229 "%G%qD output may be truncated copying %E "
3230 "bytes from a string of length %wu",
3231 stmt
, func
, cnt
, lenrange
[1].to_uhwi ());
3233 return warning_at (callloc
, OPT_Wstringop_truncation
,
3234 "%G%qD output may be truncated copying between "
3235 "%wu and %wu bytes from a string of length %wu",
3236 stmt
, func
, cntrange
[0].to_uhwi (),
3237 cntrange
[1].to_uhwi (), lenrange
[1].to_uhwi ());
3241 if (!cat_dstlen_bounded
3242 && cntrange
[0] != cntrange
[1]
3243 && wi::leu_p (cntrange
[0], lenrange
[0])
3244 && wi::leu_p (cntrange
[1], lenrange
[0] + 1))
3246 /* If the source (including the terminating nul) is longer than
3247 the lower bound of the specified count but shorter than the
3248 upper bound the copy may (but need not) be truncated. */
3249 return warning_at (callloc
, OPT_Wstringop_truncation
,
3250 "%G%qD output may be truncated copying between "
3251 "%wu and %wu bytes from a string of length %wu",
3252 stmt
, func
, cntrange
[0].to_uhwi (),
3253 cntrange
[1].to_uhwi (), lenrange
[0].to_uhwi ());
3257 if (tree dstsize
= compute_objsize (dst
, 1))
3259 /* The source length is unknown. Try to determine the destination
3260 size and see if it matches the specified bound. If not, bail.
3261 Otherwise go on to see if it should be diagnosed for possible
3266 if (wi::to_wide (dstsize
) != cntrange
[1])
3269 /* Avoid warning for strncpy(a, b, N) calls where the following
3271 N == sizeof a && N == sizeof b */
3272 if (tree srcsize
= compute_objsize (src
, 1))
3273 if (wi::to_wide (srcsize
) == cntrange
[1])
3276 if (cntrange
[0] == cntrange
[1])
3277 return warning_at (callloc
, OPT_Wstringop_truncation
,
3278 "%G%qD specified bound %E equals destination size",
3285 /* Check the arguments to the built-in forms of stpncpy and strncpy for
3286 out-of-bounds offsets or overlapping access, and to see if the size
3287 is derived from calling strlen() on the source argument, and if so,
3288 issue the appropriate warning. */
3291 handle_builtin_stxncpy (built_in_function
, gimple_stmt_iterator
*gsi
)
3293 if (!strlen_to_stridx
)
3296 gimple
*stmt
= gsi_stmt (*gsi
);
3298 tree dst
= gimple_call_arg (stmt
, 0);
3299 tree src
= gimple_call_arg (stmt
, 1);
3300 tree len
= gimple_call_arg (stmt
, 2);
3301 tree dstsize
= NULL_TREE
, srcsize
= NULL_TREE
;
3303 int didx
= get_stridx (dst
);
3304 if (strinfo
*sidst
= didx
> 0 ? get_strinfo (didx
) : NULL
)
3306 /* Compute the size of the destination string including the nul
3307 if it is known to be nul-terminated. */
3308 if (sidst
->nonzero_chars
)
3310 if (sidst
->full_string_p
)
3312 /* String is known to be nul-terminated. */
3313 tree type
= TREE_TYPE (sidst
->nonzero_chars
);
3314 dstsize
= fold_build2 (PLUS_EXPR
, type
, sidst
->nonzero_chars
,
3315 build_int_cst (type
, 1));
3318 dstsize
= sidst
->nonzero_chars
;
3324 int sidx
= get_stridx (src
);
3325 strinfo
*sisrc
= sidx
> 0 ? get_strinfo (sidx
) : NULL
;
3328 /* strncat() and strncpy() can modify the source string by writing
3329 over the terminating nul so SISRC->DONT_INVALIDATE must be left
3332 /* Compute the size of the source string including the terminating
3333 nul if its known to be nul-terminated. */
3334 if (sisrc
->nonzero_chars
)
3336 if (sisrc
->full_string_p
)
3338 tree type
= TREE_TYPE (sisrc
->nonzero_chars
);
3339 srcsize
= fold_build2 (PLUS_EXPR
, type
, sisrc
->nonzero_chars
,
3340 build_int_cst (type
, 1));
3343 srcsize
= sisrc
->nonzero_chars
;
3349 srcsize
= NULL_TREE
;
3351 if (check_bounds_or_overlap (stmt
, dst
, src
, dstsize
, srcsize
))
3353 gimple_set_no_warning (stmt
, true);
3357 /* If the length argument was computed from strlen(S) for some string
3358 S retrieve the strinfo index for the string (PSS->FIRST) along with
3359 the location of the strlen() call (PSS->SECOND). */
3360 stridx_strlenloc
*pss
= strlen_to_stridx
->get (len
);
3361 if (!pss
|| pss
->first
<= 0)
3363 if (maybe_diag_stxncpy_trunc (*gsi
, src
, len
))
3364 gimple_set_no_warning (stmt
, true);
3369 /* Retrieve the strinfo data for the string S that LEN was computed
3370 from as some function F of strlen (S) (i.e., LEN need not be equal
3372 strinfo
*silen
= get_strinfo (pss
->first
);
3374 location_t callloc
= gimple_nonartificial_location (stmt
);
3375 callloc
= expansion_point_location_if_in_system_header (callloc
);
3377 tree func
= gimple_call_fndecl (stmt
);
3379 bool warned
= false;
3381 /* When -Wstringop-truncation is set, try to determine truncation
3382 before diagnosing possible overflow. Truncation is implied by
3383 the LEN argument being equal to strlen(SRC), regardless of
3384 whether its value is known. Otherwise, issue the more generic
3385 -Wstringop-overflow which triggers for LEN arguments that in
3386 any meaningful way depend on strlen(SRC). */
3388 && is_strlen_related_p (src
, len
)
3389 && warning_at (callloc
, OPT_Wstringop_truncation
,
3390 "%G%qD output truncated before terminating nul "
3391 "copying as many bytes from a string as its length",
3394 else if (silen
&& is_strlen_related_p (src
, silen
->ptr
))
3395 warned
= warning_at (callloc
, OPT_Wstringop_overflow_
,
3396 "%G%qD specified bound depends on the length "
3397 "of the source argument",
3401 location_t strlenloc
= pss
->second
;
3402 if (strlenloc
!= UNKNOWN_LOCATION
&& strlenloc
!= callloc
)
3403 inform (strlenloc
, "length computed here");
3407 /* Handle a memcpy-like ({mem{,p}cpy,__mem{,p}cpy_chk}) call.
3408 If strlen of the second argument is known and length of the third argument
3409 is that plus one, strlen of the first argument is the same after this
3410 call. Uses RVALS to determine range information. */
3413 handle_builtin_memcpy (enum built_in_function bcode
, gimple_stmt_iterator
*gsi
,
3414 const vr_values
*rvals
)
3416 tree lhs
, oldlen
, newlen
;
3417 gimple
*stmt
= gsi_stmt (*gsi
);
3420 tree len
= gimple_call_arg (stmt
, 2);
3421 tree src
= gimple_call_arg (stmt
, 1);
3422 tree dst
= gimple_call_arg (stmt
, 0);
3424 int didx
= get_stridx (dst
);
3425 strinfo
*olddsi
= NULL
;
3427 olddsi
= get_strinfo (didx
);
3432 && !integer_zerop (len
))
3434 maybe_warn_overflow (stmt
, len
, rvals
, olddsi
, false, true);
3435 adjust_last_stmt (olddsi
, stmt
, false);
3438 int idx
= get_stridx (src
);
3447 /* Handle memcpy (x, y, l) where l's relationship with strlen (y)
3449 si
= get_strinfo (idx
);
3450 if (si
== NULL
|| si
->nonzero_chars
== NULL_TREE
)
3452 if (TREE_CODE (len
) == INTEGER_CST
3453 && TREE_CODE (si
->nonzero_chars
) == INTEGER_CST
)
3455 if (tree_int_cst_le (len
, si
->nonzero_chars
))
3457 /* Copying LEN nonzero characters, where LEN is constant. */
3459 full_string_p
= false;
3463 /* Copying the whole of the analyzed part of SI. */
3464 newlen
= si
->nonzero_chars
;
3465 full_string_p
= si
->full_string_p
;
3470 if (!si
->full_string_p
)
3472 if (TREE_CODE (len
) != SSA_NAME
)
3474 def_stmt
= SSA_NAME_DEF_STMT (len
);
3475 if (!is_gimple_assign (def_stmt
)
3476 || gimple_assign_rhs_code (def_stmt
) != PLUS_EXPR
3477 || gimple_assign_rhs1 (def_stmt
) != si
->nonzero_chars
3478 || !integer_onep (gimple_assign_rhs2 (def_stmt
)))
3480 /* Copying variable-length string SI (and no more). */
3481 newlen
= si
->nonzero_chars
;
3482 full_string_p
= true;
3488 /* Handle memcpy (x, "abcd", 5) or
3489 memcpy (x, "abc\0uvw", 7). */
3490 if (!tree_fits_uhwi_p (len
))
3493 unsigned HOST_WIDE_INT clen
= tree_to_uhwi (len
);
3494 unsigned HOST_WIDE_INT nonzero_chars
= ~idx
;
3495 newlen
= build_int_cst (size_type_node
, MIN (nonzero_chars
, clen
));
3496 full_string_p
= clen
> nonzero_chars
;
3501 && olddsi
->nonzero_chars
3502 && TREE_CODE (olddsi
->nonzero_chars
) == INTEGER_CST
3503 && tree_int_cst_le (newlen
, olddsi
->nonzero_chars
))
3505 /* The SRC substring being written strictly overlaps
3506 a subsequence of the existing string OLDDSI. */
3507 newlen
= olddsi
->nonzero_chars
;
3508 full_string_p
= olddsi
->full_string_p
;
3511 if (olddsi
!= NULL
&& TREE_CODE (len
) == SSA_NAME
)
3512 adjust_last_stmt (olddsi
, stmt
, false);
3516 didx
= new_stridx (dst
);
3523 dsi
= unshare_strinfo (olddsi
);
3524 oldlen
= olddsi
->nonzero_chars
;
3525 dsi
->nonzero_chars
= newlen
;
3526 dsi
->full_string_p
= full_string_p
;
3527 /* Break the chain, so adjust_related_strinfo on later pointers in
3528 the chain won't adjust this one anymore. */
3531 dsi
->endptr
= NULL_TREE
;
3535 dsi
= new_strinfo (dst
, didx
, newlen
, full_string_p
);
3536 set_strinfo (didx
, dsi
);
3537 find_equal_ptrs (dst
, didx
);
3539 dsi
->writable
= true;
3540 dsi
->dont_invalidate
= true;
3543 tree adj
= NULL_TREE
;
3544 location_t loc
= gimple_location (stmt
);
3545 if (oldlen
== NULL_TREE
)
3547 else if (integer_zerop (oldlen
))
3549 else if (TREE_CODE (oldlen
) == INTEGER_CST
3550 || TREE_CODE (newlen
) == INTEGER_CST
)
3551 adj
= fold_build2_loc (loc
, MINUS_EXPR
, TREE_TYPE (newlen
), newlen
,
3552 fold_convert_loc (loc
, TREE_TYPE (newlen
),
3554 if (adj
!= NULL_TREE
)
3555 adjust_related_strinfos (loc
, dsi
, adj
);
3559 /* memcpy src may not overlap dst, so src doesn't need to be
3560 invalidated either. */
3562 si
->dont_invalidate
= true;
3566 lhs
= gimple_call_lhs (stmt
);
3569 case BUILT_IN_MEMCPY
:
3570 case BUILT_IN_MEMCPY_CHK
:
3571 /* Allow adjust_last_stmt to decrease this memcpy's size. */
3572 laststmt
.stmt
= stmt
;
3573 laststmt
.len
= dsi
->nonzero_chars
;
3574 laststmt
.stridx
= dsi
->idx
;
3576 ssa_ver_to_stridx
[SSA_NAME_VERSION (lhs
)] = didx
;
3578 case BUILT_IN_MEMPCPY
:
3579 case BUILT_IN_MEMPCPY_CHK
:
3587 /* Handle a strcat-like ({strcat,__strcat_chk}) call.
3588 If strlen of the second argument is known, strlen of the first argument
3589 is increased by the length of the second argument. Furthermore, attempt
3590 to convert it to memcpy/strcpy if the length of the first argument
3594 handle_builtin_strcat (enum built_in_function bcode
, gimple_stmt_iterator
*gsi
)
3597 tree srclen
, args
, type
, fn
, objsz
, endptr
;
3599 gimple
*stmt
= gsi_stmt (*gsi
);
3601 location_t loc
= gimple_location (stmt
);
3603 tree src
= gimple_call_arg (stmt
, 1);
3604 tree dst
= gimple_call_arg (stmt
, 0);
3606 /* Bail if the source is the same as destination. It will be diagnosed
3608 if (operand_equal_p (src
, dst
, 0))
3611 tree lhs
= gimple_call_lhs (stmt
);
3613 didx
= get_stridx (dst
);
3619 dsi
= get_strinfo (didx
);
3623 idx
= get_stridx (src
);
3625 srclen
= build_int_cst (size_type_node
, ~idx
);
3628 si
= get_strinfo (idx
);
3630 srclen
= get_string_length (si
);
3633 /* Set the no-warning bit on the transformed statement? */
3634 bool set_no_warning
= false;
3636 if (dsi
== NULL
|| get_string_length (dsi
) == NULL_TREE
)
3639 /* The concatenation always involves copying at least one byte
3640 (the terminating nul), even if the source string is empty.
3641 If the source is unknown assume it's one character long and
3642 used that as both sizes. */
3646 tree type
= TREE_TYPE (slen
);
3647 slen
= fold_build2 (PLUS_EXPR
, type
, slen
, build_int_cst (type
, 1));
3650 tree sptr
= si
&& si
->ptr
? si
->ptr
: src
;
3652 if (check_bounds_or_overlap (stmt
, dst
, sptr
, NULL_TREE
, slen
))
3654 gimple_set_no_warning (stmt
, true);
3655 set_no_warning
= true;
3659 /* strcat (p, q) can be transformed into
3660 tmp = p + strlen (p); endptr = stpcpy (tmp, q);
3661 with length endptr - p if we need to compute the length
3662 later on. Don't do this transformation if we don't need
3664 if (builtin_decl_implicit_p (BUILT_IN_STPCPY
) && lhs
== NULL_TREE
)
3668 didx
= new_stridx (dst
);
3674 dsi
= new_strinfo (dst
, didx
, NULL_TREE
, false);
3675 set_strinfo (didx
, dsi
);
3676 find_equal_ptrs (dst
, didx
);
3680 dsi
= unshare_strinfo (dsi
);
3681 dsi
->nonzero_chars
= NULL_TREE
;
3682 dsi
->full_string_p
= false;
3684 dsi
->endptr
= NULL_TREE
;
3686 dsi
->writable
= true;
3688 dsi
->dont_invalidate
= true;
3693 tree dstlen
= dsi
->nonzero_chars
;
3694 endptr
= dsi
->endptr
;
3696 dsi
= unshare_strinfo (dsi
);
3697 dsi
->endptr
= NULL_TREE
;
3699 dsi
->writable
= true;
3701 if (srclen
!= NULL_TREE
)
3703 dsi
->nonzero_chars
= fold_build2_loc (loc
, PLUS_EXPR
,
3704 TREE_TYPE (dsi
->nonzero_chars
),
3705 dsi
->nonzero_chars
, srclen
);
3706 gcc_assert (dsi
->full_string_p
);
3707 adjust_related_strinfos (loc
, dsi
, srclen
);
3708 dsi
->dont_invalidate
= true;
3712 dsi
->nonzero_chars
= NULL
;
3713 dsi
->full_string_p
= false;
3714 if (lhs
== NULL_TREE
&& builtin_decl_implicit_p (BUILT_IN_STPCPY
))
3715 dsi
->dont_invalidate
= true;
3719 /* strcat src may not overlap dst, so src doesn't need to be
3720 invalidated either. */
3721 si
->dont_invalidate
= true;
3723 /* For now. Could remove the lhs from the call and add
3724 lhs = dst; afterwards. */
3732 case BUILT_IN_STRCAT
:
3733 if (srclen
!= NULL_TREE
)
3734 fn
= builtin_decl_implicit (BUILT_IN_MEMCPY
);
3736 fn
= builtin_decl_implicit (BUILT_IN_STRCPY
);
3738 case BUILT_IN_STRCAT_CHK
:
3739 if (srclen
!= NULL_TREE
)
3740 fn
= builtin_decl_explicit (BUILT_IN_MEMCPY_CHK
);
3742 fn
= builtin_decl_explicit (BUILT_IN_STRCPY_CHK
);
3743 objsz
= gimple_call_arg (stmt
, 2);
3749 if (fn
== NULL_TREE
)
3754 tree type
= TREE_TYPE (dstlen
);
3756 /* Compute the size of the source sequence, including the nul. */
3757 tree srcsize
= srclen
? srclen
: size_zero_node
;
3758 tree one
= build_int_cst (type
, 1);
3759 srcsize
= fold_build2 (PLUS_EXPR
, type
, srcsize
, one
);
3760 tree dstsize
= fold_build2 (PLUS_EXPR
, type
, dstlen
, one
);
3761 tree sptr
= si
&& si
->ptr
? si
->ptr
: src
;
3763 if (check_bounds_or_overlap (stmt
, dst
, sptr
, dstsize
, srcsize
))
3765 gimple_set_no_warning (stmt
, true);
3766 set_no_warning
= true;
3770 tree len
= NULL_TREE
;
3771 if (srclen
!= NULL_TREE
)
3773 args
= TYPE_ARG_TYPES (TREE_TYPE (fn
));
3774 type
= TREE_VALUE (TREE_CHAIN (TREE_CHAIN (args
)));
3776 len
= fold_convert_loc (loc
, type
, unshare_expr (srclen
));
3777 len
= fold_build2_loc (loc
, PLUS_EXPR
, type
, len
,
3778 build_int_cst (type
, 1));
3779 len
= force_gimple_operand_gsi (gsi
, len
, true, NULL_TREE
, true,
3783 dst
= fold_convert_loc (loc
, TREE_TYPE (dst
), unshare_expr (endptr
));
3785 dst
= fold_build2_loc (loc
, POINTER_PLUS_EXPR
, TREE_TYPE (dst
), dst
,
3786 fold_convert_loc (loc
, sizetype
,
3787 unshare_expr (dstlen
)));
3788 dst
= force_gimple_operand_gsi (gsi
, dst
, true, NULL_TREE
, true,
3792 objsz
= fold_build2_loc (loc
, MINUS_EXPR
, TREE_TYPE (objsz
), objsz
,
3793 fold_convert_loc (loc
, TREE_TYPE (objsz
),
3794 unshare_expr (dstlen
)));
3795 objsz
= force_gimple_operand_gsi (gsi
, objsz
, true, NULL_TREE
, true,
3798 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
3800 fprintf (dump_file
, "Optimizing: ");
3801 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
3803 if (srclen
!= NULL_TREE
)
3804 success
= update_gimple_call (gsi
, fn
, 3 + (objsz
!= NULL_TREE
),
3805 dst
, src
, len
, objsz
);
3807 success
= update_gimple_call (gsi
, fn
, 2 + (objsz
!= NULL_TREE
),
3811 stmt
= gsi_stmt (*gsi
);
3813 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
3815 fprintf (dump_file
, "into: ");
3816 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
3818 /* If srclen == NULL, note that current string length can be
3819 computed by transforming this strcpy into stpcpy. */
3820 if (srclen
== NULL_TREE
&& dsi
->dont_invalidate
)
3822 adjust_last_stmt (dsi
, stmt
, true);
3823 if (srclen
!= NULL_TREE
)
3825 laststmt
.stmt
= stmt
;
3826 laststmt
.len
= srclen
;
3827 laststmt
.stridx
= dsi
->idx
;
3830 else if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
3831 fprintf (dump_file
, "not possible.\n");
3834 gimple_set_no_warning (stmt
, true);
3837 /* Handle a call to an allocation function like alloca, malloc or calloc,
3838 or an ordinary allocation function declared with attribute alloc_size. */
3841 handle_alloc_call (enum built_in_function bcode
, gimple_stmt_iterator
*gsi
)
3843 gimple
*stmt
= gsi_stmt (*gsi
);
3844 tree lhs
= gimple_call_lhs (stmt
);
3845 if (lhs
== NULL_TREE
)
3848 gcc_assert (get_stridx (lhs
) == 0);
3849 int idx
= new_stridx (lhs
);
3850 tree length
= NULL_TREE
;
3851 if (bcode
== BUILT_IN_CALLOC
)
3852 length
= build_int_cst (size_type_node
, 0);
3853 strinfo
*si
= new_strinfo (lhs
, idx
, length
, length
!= NULL_TREE
);
3854 if (bcode
== BUILT_IN_CALLOC
)
3856 /* Only set STMT for calloc and malloc. */
3858 /* Only set ENDPTR for calloc. */
3861 else if (bcode
== BUILT_IN_MALLOC
)
3864 /* Set ALLOC is set for all allocation functions. */
3866 set_strinfo (idx
, si
);
3867 si
->writable
= true;
3868 si
->dont_invalidate
= true;
3871 /* Handle a call to memset.
3872 After a call to calloc, memset(,0,) is unnecessary.
3873 memset(malloc(n),0,n) is calloc(n,1).
3874 return true when the call is transformed, false otherwise.
3875 When nonnull uses RVALS to determine range information. */
3878 handle_builtin_memset (gimple_stmt_iterator
*gsi
, bool *zero_write
,
3879 const vr_values
*rvals
)
3881 gimple
*memset_stmt
= gsi_stmt (*gsi
);
3882 tree ptr
= gimple_call_arg (memset_stmt
, 0);
3883 /* Set to the non-constant offset added to PTR. */
3885 int idx1
= get_stridx (ptr
, offrng
, rvals
);
3888 strinfo
*si1
= get_strinfo (idx1
);
3891 gimple
*alloc_stmt
= si1
->alloc
;
3892 if (!alloc_stmt
|| !is_gimple_call (alloc_stmt
))
3894 tree callee1
= gimple_call_fndecl (alloc_stmt
);
3895 if (!valid_builtin_call (alloc_stmt
))
3897 tree alloc_size
= gimple_call_arg (alloc_stmt
, 0);
3898 tree memset_size
= gimple_call_arg (memset_stmt
, 2);
3900 /* Check for overflow. */
3901 maybe_warn_overflow (memset_stmt
, memset_size
, rvals
, NULL
, false, true);
3903 /* Bail when there is no statement associated with the destination
3904 (the statement may be null even when SI1->ALLOC is not). */
3908 /* Avoid optimizing if store is at a variable offset from the beginning
3909 of the allocated object. */
3910 if (offrng
[0] != 0 || offrng
[0] != offrng
[1])
3913 /* Bail when the call writes a non-zero value. */
3914 if (!integer_zerop (gimple_call_arg (memset_stmt
, 1)))
3917 /* Let the caller know the memset call cleared the destination. */
3920 enum built_in_function code1
= DECL_FUNCTION_CODE (callee1
);
3921 if (code1
== BUILT_IN_CALLOC
)
3922 /* Not touching alloc_stmt */ ;
3923 else if (code1
== BUILT_IN_MALLOC
3924 && operand_equal_p (memset_size
, alloc_size
, 0))
3926 /* Replace the malloc + memset calls with calloc. */
3927 gimple_stmt_iterator gsi1
= gsi_for_stmt (si1
->stmt
);
3928 update_gimple_call (&gsi1
, builtin_decl_implicit (BUILT_IN_CALLOC
), 2,
3929 alloc_size
, build_one_cst (size_type_node
));
3930 si1
->nonzero_chars
= build_int_cst (size_type_node
, 0);
3931 si1
->full_string_p
= true;
3932 si1
->stmt
= gsi_stmt (gsi1
);
3936 tree lhs
= gimple_call_lhs (memset_stmt
);
3937 unlink_stmt_vdef (memset_stmt
);
3940 gimple
*assign
= gimple_build_assign (lhs
, ptr
);
3941 gsi_replace (gsi
, assign
, false);
3945 gsi_remove (gsi
, true);
3946 release_defs (memset_stmt
);
3952 /* Return a pointer to the first such equality expression if RES is used
3953 only in expressions testing its equality to zero, and null otherwise. */
3956 used_only_for_zero_equality (tree res
)
3958 gimple
*first_use
= NULL
;
3960 use_operand_p use_p
;
3961 imm_use_iterator iter
;
3963 FOR_EACH_IMM_USE_FAST (use_p
, iter
, res
)
3965 gimple
*use_stmt
= USE_STMT (use_p
);
3967 if (is_gimple_debug (use_stmt
))
3969 if (gimple_code (use_stmt
) == GIMPLE_ASSIGN
)
3971 tree_code code
= gimple_assign_rhs_code (use_stmt
);
3972 if (code
== COND_EXPR
)
3974 tree cond_expr
= gimple_assign_rhs1 (use_stmt
);
3975 if ((TREE_CODE (cond_expr
) != EQ_EXPR
3976 && (TREE_CODE (cond_expr
) != NE_EXPR
))
3977 || !integer_zerop (TREE_OPERAND (cond_expr
, 1)))
3980 else if (code
== EQ_EXPR
|| code
== NE_EXPR
)
3982 if (!integer_zerop (gimple_assign_rhs2 (use_stmt
)))
3988 else if (gimple_code (use_stmt
) == GIMPLE_COND
)
3990 tree_code code
= gimple_cond_code (use_stmt
);
3991 if ((code
!= EQ_EXPR
&& code
!= NE_EXPR
)
3992 || !integer_zerop (gimple_cond_rhs (use_stmt
)))
3999 first_use
= use_stmt
;
4005 /* Handle a call to memcmp. We try to handle small comparisons by
4006 converting them to load and compare, and replacing the call to memcmp
4007 with a __builtin_memcmp_eq call where possible.
4008 return true when call is transformed, return false otherwise. */
4011 handle_builtin_memcmp (gimple_stmt_iterator
*gsi
)
4013 gcall
*stmt
= as_a
<gcall
*> (gsi_stmt (*gsi
));
4014 tree res
= gimple_call_lhs (stmt
);
4016 if (!res
|| !used_only_for_zero_equality (res
))
4019 tree arg1
= gimple_call_arg (stmt
, 0);
4020 tree arg2
= gimple_call_arg (stmt
, 1);
4021 tree len
= gimple_call_arg (stmt
, 2);
4022 unsigned HOST_WIDE_INT leni
;
4024 if (tree_fits_uhwi_p (len
)
4025 && (leni
= tree_to_uhwi (len
)) <= GET_MODE_SIZE (word_mode
)
4026 && pow2p_hwi (leni
))
4028 leni
*= CHAR_TYPE_SIZE
;
4029 unsigned align1
= get_pointer_alignment (arg1
);
4030 unsigned align2
= get_pointer_alignment (arg2
);
4031 unsigned align
= MIN (align1
, align2
);
4032 scalar_int_mode mode
;
4033 if (int_mode_for_size (leni
, 1).exists (&mode
)
4034 && (align
>= leni
|| !targetm
.slow_unaligned_access (mode
, align
)))
4036 location_t loc
= gimple_location (stmt
);
4038 type
= build_nonstandard_integer_type (leni
, 1);
4039 gcc_assert (known_eq (GET_MODE_BITSIZE (TYPE_MODE (type
)), leni
));
4040 tree ptrtype
= build_pointer_type_for_mode (char_type_node
,
4042 off
= build_int_cst (ptrtype
, 0);
4043 arg1
= build2_loc (loc
, MEM_REF
, type
, arg1
, off
);
4044 arg2
= build2_loc (loc
, MEM_REF
, type
, arg2
, off
);
4045 tree tem1
= fold_const_aggregate_ref (arg1
);
4048 tree tem2
= fold_const_aggregate_ref (arg2
);
4051 res
= fold_convert_loc (loc
, TREE_TYPE (res
),
4052 fold_build2_loc (loc
, NE_EXPR
,
4055 gimplify_and_update_call_from_tree (gsi
, res
);
4060 gimple_call_set_fndecl (stmt
, builtin_decl_explicit (BUILT_IN_MEMCMP_EQ
));
4064 /* Given an index to the strinfo vector, compute the string length
4065 for the corresponding string. Return -1 when unknown. */
4067 static HOST_WIDE_INT
4068 compute_string_length (int idx
)
4070 HOST_WIDE_INT string_leni
= -1;
4071 gcc_assert (idx
!= 0);
4076 strinfo
*si
= get_strinfo (idx
);
4079 tree const_string_len
= get_string_length (si
);
4080 if (const_string_len
&& tree_fits_shwi_p (const_string_len
))
4081 string_leni
= tree_to_shwi (const_string_len
);
4084 if (string_leni
< 0)
4090 /* Determine the minimum size of the object referenced by DEST expression
4091 which must have a pointer type.
4092 Return the minimum size of the object if successful or HWI_M1U when
4093 the size cannot be determined. */
4095 static unsigned HOST_WIDE_INT
4096 determine_min_objsize (tree dest
)
4098 unsigned HOST_WIDE_INT size
= 0;
4100 init_object_sizes ();
4102 if (compute_builtin_object_size (dest
, 2, &size
))
4105 /* Try to determine the size of the object through the RHS
4106 of the assign statement. */
4107 if (TREE_CODE (dest
) == SSA_NAME
)
4109 gimple
*stmt
= SSA_NAME_DEF_STMT (dest
);
4110 if (!is_gimple_assign (stmt
))
4111 return HOST_WIDE_INT_M1U
;
4113 if (!gimple_assign_single_p (stmt
)
4114 && !gimple_assign_unary_nop_p (stmt
))
4115 return HOST_WIDE_INT_M1U
;
4117 dest
= gimple_assign_rhs1 (stmt
);
4118 return determine_min_objsize (dest
);
4121 /* Try to determine the size of the object from its type. */
4122 if (TREE_CODE (dest
) != ADDR_EXPR
)
4123 return HOST_WIDE_INT_M1U
;
4125 tree type
= TREE_TYPE (dest
);
4126 if (TREE_CODE (type
) == POINTER_TYPE
)
4127 type
= TREE_TYPE (type
);
4129 type
= TYPE_MAIN_VARIANT (type
);
4131 /* The size of a flexible array cannot be determined. Otherwise,
4132 for arrays with more than one element, return the size of its
4133 type. GCC itself misuses arrays of both zero and one elements
4134 as flexible array members so they are excluded as well. */
4135 if (TREE_CODE (type
) != ARRAY_TYPE
4136 || !array_at_struct_end_p (dest
))
4138 tree type_size
= TYPE_SIZE_UNIT (type
);
4139 if (type_size
&& TREE_CODE (type_size
) == INTEGER_CST
4140 && !integer_onep (type_size
)
4141 && !integer_zerop (type_size
))
4142 return tree_to_uhwi (type_size
);
4145 return HOST_WIDE_INT_M1U
;
4148 /* Given strinfo IDX for ARG, set LENRNG[] to the range of lengths
4149 of the string(s) referenced by ARG if it can be determined.
4150 If the length cannot be determined, set *SIZE to the size of
4151 the array the string is stored in, if any. If no such array is
4152 known, set *SIZE to -1. When the strings are nul-terminated set
4153 *NULTERM to true, otherwise to false. Return true on success. */
4156 get_len_or_size (tree arg
, int idx
, unsigned HOST_WIDE_INT lenrng
[2],
4157 unsigned HOST_WIDE_INT
*size
, bool *nulterm
)
4159 /* Set so that both LEN and ~LEN are invalid lengths, i.e.,
4160 maximum possible length + 1. */
4161 lenrng
[0] = lenrng
[1] = HOST_WIDE_INT_MAX
;
4163 *size
= HOST_WIDE_INT_M1U
;
4167 /* IDX is the inverted constant string length. */
4169 lenrng
[1] = lenrng
[0];
4173 ; /* Handled below. */
4174 else if (strinfo
*si
= get_strinfo (idx
))
4176 if (!si
->nonzero_chars
)
4178 else if (tree_fits_uhwi_p (si
->nonzero_chars
))
4180 lenrng
[0] = tree_to_uhwi (si
->nonzero_chars
);
4181 *nulterm
= si
->full_string_p
;
4182 /* Set the upper bound only if the string is known to be
4183 nul-terminated, otherwise leave it at maximum + 1. */
4185 lenrng
[1] = lenrng
[0];
4187 else if (TREE_CODE (si
->nonzero_chars
) == SSA_NAME
)
4190 value_range_kind rng
= get_range_info (si
->nonzero_chars
, &min
, &max
);
4191 if (rng
== VR_RANGE
)
4193 lenrng
[0] = min
.to_uhwi ();
4194 lenrng
[1] = max
.to_uhwi ();
4195 *nulterm
= si
->full_string_p
;
4202 if (lenrng
[0] == HOST_WIDE_INT_MAX
)
4204 /* Compute the minimum and maximum real or possible lengths. */
4205 c_strlen_data lendata
= { };
4206 if (get_range_strlen (arg
, &lendata
, /* eltsize = */1))
4208 if (tree_fits_shwi_p (lendata
.maxlen
) && !lendata
.maxbound
)
4210 lenrng
[0] = tree_to_shwi (lendata
.minlen
);
4211 lenrng
[1] = tree_to_shwi (lendata
.maxlen
);
4214 else if (lendata
.maxbound
&& tree_fits_shwi_p (lendata
.maxbound
))
4216 /* Set *SIZE to the conservative LENDATA.MAXBOUND which
4217 is a conservative estimate of the longest string based
4218 on the sizes of the arrays referenced by ARG. */
4219 *size
= tree_to_uhwi (lendata
.maxbound
) + 1;
4225 /* Set *SIZE to the size of the smallest object referenced
4226 by ARG if ARG denotes a single object, or to HWI_M1U
4228 *size
= determine_min_objsize (arg
);
4233 return lenrng
[0] != HOST_WIDE_INT_MAX
|| *size
!= HOST_WIDE_INT_M1U
;
4236 /* If IDX1 and IDX2 refer to strings A and B of unequal lengths, return
4237 the result of 0 == strncmp (A, B, BOUND) (which is the same as strcmp
4238 for a sufficiently large BOUND). If the result is based on the length
4239 of one string being greater than the longest string that would fit in
4240 the array pointer to by the argument, set *PLEN and *PSIZE to
4241 the corresponding length (or its complement when the string is known
4242 to be at least as long and need not be nul-terminated) and size.
4243 Otherwise return null. */
4246 strxcmp_eqz_result (tree arg1
, int idx1
, tree arg2
, int idx2
,
4247 unsigned HOST_WIDE_INT bound
, unsigned HOST_WIDE_INT len
[2],
4248 unsigned HOST_WIDE_INT
*psize
)
4250 /* Determine the range the length of each string is in and whether it's
4251 known to be nul-terminated, or the size of the array it's stored in. */
4253 unsigned HOST_WIDE_INT siz1
, siz2
;
4254 unsigned HOST_WIDE_INT len1rng
[2], len2rng
[2];
4255 if (!get_len_or_size (arg1
, idx1
, len1rng
, &siz1
, &nul1
)
4256 || !get_len_or_size (arg2
, idx2
, len2rng
, &siz2
, &nul2
))
4259 /* BOUND is set to HWI_M1U for strcmp and less to strncmp, and LENiRNG
4260 to HWI_MAX when invalid. Adjust the length of each string to consider
4261 to be no more than BOUND. */
4262 if (len1rng
[0] < HOST_WIDE_INT_MAX
&& len1rng
[0] > bound
)
4264 if (len1rng
[1] < HOST_WIDE_INT_MAX
&& len1rng
[1] > bound
)
4266 if (len2rng
[0] < HOST_WIDE_INT_MAX
&& len2rng
[0] > bound
)
4268 if (len2rng
[1] < HOST_WIDE_INT_MAX
&& len2rng
[1] > bound
)
4271 /* Two empty strings are equal. */
4272 if (len1rng
[1] == 0 && len2rng
[1] == 0)
4273 return integer_one_node
;
4275 /* The strings are definitely unequal when the lower bound of the length
4276 of one of them is greater than the length of the longest string that
4277 would fit into the other array. */
4278 if (len1rng
[0] == HOST_WIDE_INT_MAX
4279 && len2rng
[0] != HOST_WIDE_INT_MAX
4280 && ((len2rng
[0] < bound
&& len2rng
[0] >= siz1
)
4281 || len2rng
[0] > siz1
))
4284 len
[0] = len1rng
[0];
4285 /* Set LEN[0] to the lower bound of ARG1's length when it's
4286 nul-terminated or to the complement of its minimum length
4288 len
[1] = nul2
? len2rng
[0] : ~len2rng
[0];
4289 return integer_zero_node
;
4292 if (len2rng
[0] == HOST_WIDE_INT_MAX
4293 && len1rng
[0] != HOST_WIDE_INT_MAX
4294 && ((len1rng
[0] < bound
&& len1rng
[0] >= siz2
)
4295 || len1rng
[0] > siz2
))
4298 len
[0] = nul1
? len1rng
[0] : ~len1rng
[0];
4299 len
[1] = len2rng
[0];
4300 return integer_zero_node
;
4303 /* The strings are also definitely unequal when their lengths are unequal
4304 and at least one is nul-terminated. */
4305 if (len1rng
[0] != HOST_WIDE_INT_MAX
4306 && len2rng
[0] != HOST_WIDE_INT_MAX
4307 && ((len1rng
[1] < len2rng
[0] && nul1
)
4308 || (len2rng
[1] < len1rng
[0] && nul2
)))
4310 if (bound
<= len1rng
[0] || bound
<= len2rng
[0])
4313 *psize
= HOST_WIDE_INT_M1U
;
4315 len
[0] = len1rng
[0];
4316 len
[1] = len2rng
[0];
4317 return integer_zero_node
;
4320 /* The string lengths may be equal or unequal. Even when equal and
4321 both strings nul-terminated, without the string contents there's
4322 no way to determine whether they are equal. */
4326 /* Diagnose pointless calls to strcmp or strncmp STMT with string
4327 arguments of lengths LEN or size SIZ and (for strncmp) BOUND,
4328 whose result is used in equality expressions that evaluate to
4329 a constant due to one argument being longer than the size of
4333 maybe_warn_pointless_strcmp (gimple
*stmt
, HOST_WIDE_INT bound
,
4334 unsigned HOST_WIDE_INT len
[2],
4335 unsigned HOST_WIDE_INT siz
)
4337 tree lhs
= gimple_call_lhs (stmt
);
4338 gimple
*use
= used_only_for_zero_equality (lhs
);
4342 bool at_least
= false;
4344 /* Excessive LEN[i] indicates a lower bound. */
4345 if (len
[0] > HOST_WIDE_INT_MAX
)
4351 if (len
[1] > HOST_WIDE_INT_MAX
)
4357 unsigned HOST_WIDE_INT minlen
= MIN (len
[0], len
[1]);
4359 /* FIXME: Include a note pointing to the declaration of the smaller
4361 location_t stmt_loc
= gimple_nonartificial_location (stmt
);
4362 if (stmt_loc
== UNKNOWN_LOCATION
&& EXPR_HAS_LOCATION (lhs
))
4363 stmt_loc
= tree_nonartificial_location (lhs
);
4364 stmt_loc
= expansion_point_location_if_in_system_header (stmt_loc
);
4366 tree callee
= gimple_call_fndecl (stmt
);
4367 bool warned
= false;
4368 if (siz
<= minlen
&& bound
== -1)
4369 warned
= warning_at (stmt_loc
, OPT_Wstring_compare
,
4371 ? G_("%G%qD of a string of length %wu or more and "
4372 "an array of size %wu evaluates to nonzero")
4373 : G_("%G%qD of a string of length %wu and an array "
4374 "of size %wu evaluates to nonzero")),
4375 stmt
, callee
, minlen
, siz
);
4376 else if (!at_least
&& siz
<= HOST_WIDE_INT_MAX
)
4378 if (len
[0] != HOST_WIDE_INT_MAX
&& len
[1] != HOST_WIDE_INT_MAX
)
4379 warned
= warning_at (stmt_loc
, OPT_Wstring_compare
,
4380 "%G%qD of strings of length %wu and %wu "
4381 "and bound of %wu evaluates to nonzero",
4382 stmt
, callee
, len
[0], len
[1], bound
);
4384 warned
= warning_at (stmt_loc
, OPT_Wstring_compare
,
4385 "%G%qD of a string of length %wu, an array "
4386 "of size %wu and bound of %wu evaluates to "
4388 stmt
, callee
, minlen
, siz
, bound
);
4393 location_t use_loc
= gimple_location (use
);
4394 if (LOCATION_LINE (stmt_loc
) != LOCATION_LINE (use_loc
))
4395 inform (use_loc
, "in this expression");
4400 /* Optimize a call to strcmp or strncmp either by folding it to a constant
4401 when possible or by transforming the latter to the former. Warn about
4402 calls where the length of one argument is greater than the size of
4403 the array to which the other argument points if the latter's length
4404 is not known. Return true when the call has been transformed into
4405 another and false otherwise. */
4408 handle_builtin_string_cmp (gimple_stmt_iterator
*gsi
)
4410 gcall
*stmt
= as_a
<gcall
*> (gsi_stmt (*gsi
));
4411 tree lhs
= gimple_call_lhs (stmt
);
4416 tree arg1
= gimple_call_arg (stmt
, 0);
4417 tree arg2
= gimple_call_arg (stmt
, 1);
4418 int idx1
= get_stridx (arg1
);
4419 int idx2
= get_stridx (arg2
);
4421 /* For strncmp set to the the value of the third argument if known. */
4422 HOST_WIDE_INT bound
= -1;
4423 tree len
= NULL_TREE
;
4424 /* Extract the strncmp bound. */
4425 if (gimple_call_num_args (stmt
) == 3)
4427 len
= gimple_call_arg (stmt
, 2);
4428 if (tree_fits_shwi_p (len
))
4429 bound
= tree_to_shwi (len
);
4431 /* If the bound argument is NOT known, do nothing. */
4436 /* Avoid folding if either argument is not a nul-terminated array.
4437 Defer warning until later. */
4438 if (!check_nul_terminated_array (NULL_TREE
, arg1
, len
)
4439 || !check_nul_terminated_array (NULL_TREE
, arg2
, len
))
4443 /* Set to the length of one argument (or its complement if it's
4444 the lower bound of a range) and the size of the array storing
4445 the other if the result is based on the former being equal to
4446 or greater than the latter. */
4447 unsigned HOST_WIDE_INT len
[2] = { HOST_WIDE_INT_MAX
, HOST_WIDE_INT_MAX
};
4448 unsigned HOST_WIDE_INT siz
= HOST_WIDE_INT_M1U
;
4450 /* Try to determine if the two strings are either definitely equal
4451 or definitely unequal and if so, either fold the result to zero
4452 (when equal) or set the range of the result to ~[0, 0] otherwise. */
4453 if (tree eqz
= strxcmp_eqz_result (arg1
, idx1
, arg2
, idx2
, bound
,
4456 if (integer_zerop (eqz
))
4458 maybe_warn_pointless_strcmp (stmt
, bound
, len
, siz
);
4460 /* When the lengths of the first two string arguments are
4461 known to be unequal set the range of the result to non-zero.
4462 This allows the call to be eliminated if its result is only
4463 used in tests for equality to zero. */
4464 wide_int zero
= wi::zero (TYPE_PRECISION (TREE_TYPE (lhs
)));
4465 set_range_info (lhs
, VR_ANTI_RANGE
, zero
, zero
);
4468 /* When the two strings are definitely equal (such as when they
4469 are both empty) fold the call to the constant result. */
4470 replace_call_with_value (gsi
, integer_zero_node
);
4475 /* Return if nothing is known about the strings pointed to by ARG1
4477 if (idx1
== 0 && idx2
== 0)
4480 /* Determine either the length or the size of each of the strings,
4481 whichever is available. */
4482 HOST_WIDE_INT cstlen1
= -1, cstlen2
= -1;
4483 HOST_WIDE_INT arysiz1
= -1, arysiz2
= -1;
4486 cstlen1
= compute_string_length (idx1
);
4488 arysiz1
= determine_min_objsize (arg1
);
4490 /* Bail if neither the string length nor the size of the array
4491 it is stored in can be determined. */
4492 if (cstlen1
< 0 && arysiz1
< 0)
4495 /* Repeat for the second argument. */
4497 cstlen2
= compute_string_length (idx2
);
4499 arysiz2
= determine_min_objsize (arg2
);
4501 if (cstlen2
< 0 && arysiz2
< 0)
4504 if (cstlen1
< 0 && cstlen2
< 0)
4512 /* The exact number of characters to compare. */
4513 HOST_WIDE_INT cmpsiz
= bound
< 0 ? cstlen1
< 0 ? cstlen2
: cstlen1
: bound
;
4514 /* The size of the array in which the unknown string is stored. */
4515 HOST_WIDE_INT varsiz
= arysiz1
< 0 ? arysiz2
: arysiz1
;
4517 if (cmpsiz
< varsiz
&& used_only_for_zero_equality (lhs
))
4519 /* If the known length is less than the size of the other array
4520 and the strcmp result is only used to test equality to zero,
4521 transform the call to the equivalent _eq call. */
4522 if (tree fn
= builtin_decl_implicit (bound
< 0 ? BUILT_IN_STRCMP_EQ
4523 : BUILT_IN_STRNCMP_EQ
))
4525 tree n
= build_int_cst (size_type_node
, cmpsiz
);
4526 update_gimple_call (gsi
, fn
, 3, arg1
, arg2
, n
);
4534 /* Handle a POINTER_PLUS_EXPR statement.
4535 For p = "abcd" + 2; compute associated length, or if
4536 p = q + off is pointing to a '\0' character of a string, call
4537 zero_length_string on it. */
4540 handle_pointer_plus (gimple_stmt_iterator
*gsi
)
4542 gimple
*stmt
= gsi_stmt (*gsi
);
4543 tree lhs
= gimple_assign_lhs (stmt
), off
;
4544 int idx
= get_stridx (gimple_assign_rhs1 (stmt
));
4552 tree off
= gimple_assign_rhs2 (stmt
);
4553 if (tree_fits_uhwi_p (off
)
4554 && tree_to_uhwi (off
) <= (unsigned HOST_WIDE_INT
) ~idx
)
4555 ssa_ver_to_stridx
[SSA_NAME_VERSION (lhs
)]
4556 = ~(~idx
- (int) tree_to_uhwi (off
));
4560 si
= get_strinfo (idx
);
4561 if (si
== NULL
|| si
->nonzero_chars
== NULL_TREE
)
4564 off
= gimple_assign_rhs2 (stmt
);
4566 if (si
->full_string_p
&& operand_equal_p (si
->nonzero_chars
, off
, 0))
4567 zsi
= zero_length_string (lhs
, si
);
4568 else if (TREE_CODE (off
) == SSA_NAME
)
4570 gimple
*def_stmt
= SSA_NAME_DEF_STMT (off
);
4571 if (gimple_assign_single_p (def_stmt
)
4572 && si
->full_string_p
4573 && operand_equal_p (si
->nonzero_chars
,
4574 gimple_assign_rhs1 (def_stmt
), 0))
4575 zsi
= zero_length_string (lhs
, si
);
4578 && si
->endptr
!= NULL_TREE
4579 && si
->endptr
!= lhs
4580 && TREE_CODE (si
->endptr
) == SSA_NAME
)
4582 enum tree_code rhs_code
4583 = useless_type_conversion_p (TREE_TYPE (lhs
), TREE_TYPE (si
->endptr
))
4584 ? SSA_NAME
: NOP_EXPR
;
4585 gimple_assign_set_rhs_with_ops (gsi
, rhs_code
, si
->endptr
);
4586 gcc_assert (gsi_stmt (*gsi
) == stmt
);
4591 /* Describes recursion limits used by count_nonzero_bytes. */
4593 class ssa_name_limit_t
4595 bitmap visited
; /* Bitmap of visited SSA_NAMEs. */
4596 unsigned ssa_def_max
; /* Longest chain of SSA_NAMEs to follow. */
4598 /* Not copyable or assignable. */
4599 ssa_name_limit_t (ssa_name_limit_t
&);
4600 void operator= (ssa_name_limit_t
&);
4606 ssa_def_max (param_ssa_name_def_chain_limit
) { }
4608 int next_ssa_name (tree
);
4610 ~ssa_name_limit_t ()
4613 BITMAP_FREE (visited
);
4617 /* If the SSA_NAME has already been "seen" return a positive value.
4618 Otherwise add it to VISITED. If the SSA_NAME limit has been
4619 reached, return a negative value. Otherwise return zero. */
4621 int ssa_name_limit_t::next_ssa_name (tree ssa_name
)
4624 visited
= BITMAP_ALLOC (NULL
);
4626 /* Return a positive value if SSA_NAME has already been visited. */
4627 if (!bitmap_set_bit (visited
, SSA_NAME_VERSION (ssa_name
)))
4630 /* Return a negative value to let caller avoid recursing beyond
4631 the specified limit. */
4632 if (ssa_def_max
== 0)
4640 /* Determines the minimum and maximum number of leading non-zero bytes
4641 in the representation of EXP and set LENRANGE[0] and LENRANGE[1]
4642 to each. Sets LENRANGE[2] to the total number of bytes in
4643 the representation. Sets *NULTREM if the representation contains
4644 a zero byte, and sets *ALLNUL if all the bytes are zero.
4645 OFFSET and NBYTES are the offset into the representation and
4646 the size of the access to it determined from a MEM_REF or zero
4647 for other expressions.
4648 Uses RVALS to determine range information.
4649 Avoids recursing deeper than the limits in SNLIM allow.
4650 Returns true on success and false otherwise. */
4653 count_nonzero_bytes (tree exp
, unsigned HOST_WIDE_INT offset
,
4654 unsigned HOST_WIDE_INT nbytes
,
4655 unsigned lenrange
[3], bool *nulterm
,
4656 bool *allnul
, bool *allnonnul
, const vr_values
*rvals
,
4657 ssa_name_limit_t
&snlim
)
4659 int idx
= get_stridx (exp
);
4662 strinfo
*si
= get_strinfo (idx
);
4666 /* Handle both constant lengths as well non-constant lengths
4668 unsigned HOST_WIDE_INT minlen
, maxlen
;
4669 if (tree_fits_shwi_p (si
->nonzero_chars
))
4670 minlen
= maxlen
= tree_to_shwi (si
->nonzero_chars
);
4672 && si
->nonzero_chars
4673 && TREE_CODE (si
->nonzero_chars
) == SSA_NAME
)
4675 const value_range_equiv
*vr
4676 = CONST_CAST (class vr_values
*, rvals
)
4677 ->get_value_range (si
->nonzero_chars
);
4678 if (vr
->kind () != VR_RANGE
4679 || !range_int_cst_p (vr
))
4682 minlen
= tree_to_uhwi (vr
->min ());
4683 maxlen
= tree_to_uhwi (vr
->max ());
4688 if (maxlen
< offset
)
4691 minlen
= minlen
< offset
? 0 : minlen
- offset
;
4693 if (maxlen
+ 1 < nbytes
)
4697 && TREE_CODE (si
->ptr
) == SSA_NAME
4698 && !POINTER_TYPE_P (TREE_TYPE (si
->ptr
)))
4700 /* SI->PTR is an SSA_NAME with a DEF_STMT like
4701 _1 = MEM <unsigned int> [(char * {ref-all})s_4(D)]; */
4702 gimple
*stmt
= SSA_NAME_DEF_STMT (exp
);
4703 if (gimple_assign_single_p (stmt
)
4704 && gimple_assign_rhs_code (stmt
) == MEM_REF
)
4706 tree rhs
= gimple_assign_rhs1 (stmt
);
4707 if (tree refsize
= TYPE_SIZE_UNIT (TREE_TYPE (rhs
)))
4708 if (tree_fits_uhwi_p (refsize
))
4710 nbytes
= tree_to_uhwi (refsize
);
4719 if (nbytes
<= minlen
)
4722 if (nbytes
< minlen
)
4725 if (nbytes
< maxlen
)
4729 if (minlen
< lenrange
[0])
4730 lenrange
[0] = minlen
;
4731 if (lenrange
[1] < maxlen
)
4732 lenrange
[1] = maxlen
;
4734 if (lenrange
[2] < nbytes
)
4735 lenrange
[2] = nbytes
;
4737 /* Since only the length of the string are known and not its contents,
4738 clear ALLNUL and ALLNONNUL purely on the basis of the length. */
4740 if (minlen
< nbytes
)
4746 if (TREE_CODE (exp
) == ADDR_EXPR
)
4747 exp
= TREE_OPERAND (exp
, 0);
4749 if (TREE_CODE (exp
) == SSA_NAME
)
4751 /* Handle non-zero single-character stores specially. */
4752 tree type
= TREE_TYPE (exp
);
4753 if (TREE_CODE (type
) == INTEGER_TYPE
4754 && TYPE_MODE (type
) == TYPE_MODE (char_type_node
)
4755 && TYPE_PRECISION (type
) == TYPE_PRECISION (char_type_node
)
4756 && tree_expr_nonzero_p (exp
))
4758 /* If the character EXP is known to be non-zero (even if its
4759 exact value is not known) recurse once to set the range
4760 for an arbitrary constant. */
4761 exp
= build_int_cst (type
, 1);
4762 return count_nonzero_bytes (exp
, offset
, 1, lenrange
,
4763 nulterm
, allnul
, allnonnul
, rvals
, snlim
);
4766 gimple
*stmt
= SSA_NAME_DEF_STMT (exp
);
4767 if (gimple_assign_single_p (stmt
))
4769 exp
= gimple_assign_rhs1 (stmt
);
4770 if (TREE_CODE (exp
) != MEM_REF
)
4772 /* Handle MEM_REF below. */
4774 else if (gimple_code (stmt
) == GIMPLE_PHI
)
4776 /* Avoid processing an SSA_NAME that has already been visited
4777 or if an SSA_NAME limit has been reached. Indicate success
4778 if the former and failure if the latter. */
4779 if (int res
= snlim
.next_ssa_name (exp
))
4782 /* Determine the minimum and maximum from the PHI arguments. */
4783 unsigned int n
= gimple_phi_num_args (stmt
);
4784 for (unsigned i
= 0; i
!= n
; i
++)
4786 tree def
= gimple_phi_arg_def (stmt
, i
);
4787 if (!count_nonzero_bytes (def
, offset
, nbytes
, lenrange
, nulterm
,
4788 allnul
, allnonnul
, rvals
, snlim
))
4796 if (TREE_CODE (exp
) == MEM_REF
)
4801 tree arg
= TREE_OPERAND (exp
, 0);
4802 tree off
= TREE_OPERAND (exp
, 1);
4804 if (TREE_CODE (off
) != INTEGER_CST
4805 || !tree_fits_uhwi_p (off
))
4808 unsigned HOST_WIDE_INT wioff
= tree_to_uhwi (off
);
4809 if (INT_MAX
< wioff
)
4813 if (INT_MAX
< offset
)
4816 /* The size of the MEM_REF access determines the number of bytes. */
4817 tree type
= TREE_TYPE (exp
);
4818 tree typesize
= TYPE_SIZE_UNIT (type
);
4819 if (!typesize
|| !tree_fits_uhwi_p (typesize
))
4821 nbytes
= tree_to_uhwi (typesize
);
4823 /* Handle MEM_REF = SSA_NAME types of assignments. */
4824 return count_nonzero_bytes (arg
, offset
, nbytes
, lenrange
, nulterm
,
4825 allnul
, allnonnul
, rvals
, snlim
);
4828 if (TREE_CODE (exp
) == VAR_DECL
&& TREE_READONLY (exp
))
4830 exp
= DECL_INITIAL (exp
);
4835 const char *prep
= NULL
;
4836 if (TREE_CODE (exp
) == STRING_CST
)
4838 unsigned nchars
= TREE_STRING_LENGTH (exp
);
4839 if (nchars
< offset
)
4843 /* If NBYTES hasn't been determined earlier from MEM_REF,
4844 set it here. It includes all internal nuls, including
4845 the terminating one if the string has one. */
4846 nbytes
= nchars
- offset
;
4848 prep
= TREE_STRING_POINTER (exp
) + offset
;
4851 unsigned char buf
[256];
4854 /* If the pointer to representation hasn't been set above
4855 for STRING_CST point it at the buffer. */
4856 prep
= reinterpret_cast <char *>(buf
);
4857 /* Try to extract the representation of the constant object
4858 or expression starting from the offset. */
4859 unsigned repsize
= native_encode_expr (exp
, buf
, sizeof buf
, offset
);
4860 if (repsize
< nbytes
)
4862 /* This should only happen when REPSIZE is zero because EXP
4863 doesn't denote an object with a known initializer, except
4864 perhaps when the reference reads past its end. */
4870 else if (nbytes
< repsize
)
4877 /* Compute the number of leading nonzero bytes in the representation
4878 and update the minimum and maximum. */
4879 unsigned n
= prep
? strnlen (prep
, nbytes
) : nbytes
;
4881 if (n
< lenrange
[0])
4883 if (lenrange
[1] < n
)
4886 /* Set the size of the representation. */
4887 if (lenrange
[2] < nbytes
)
4888 lenrange
[2] = nbytes
;
4890 /* Clear NULTERM if none of the bytes is zero. */
4896 /* When the initial number of non-zero bytes N is non-zero, reset
4897 *ALLNUL; if N is less than that the size of the representation
4898 also clear *ALLNONNUL. */
4903 else if (*allnul
|| *allnonnul
)
4909 /* When either ALLNUL is set and N is zero, also determine
4910 whether all subsequent bytes after the first one (which
4911 is nul) are zero or nonzero and clear ALLNUL if not. */
4912 for (const char *p
= prep
; p
!= prep
+ nbytes
; ++p
)
4924 /* Same as above except with an implicit SSA_NAME limit. RVALS is used
4925 to determine ranges of dynamically computed string lengths (the results
4929 count_nonzero_bytes (tree exp
, unsigned lenrange
[3], bool *nulterm
,
4930 bool *allnul
, bool *allnonnul
, const vr_values
*rvals
)
4932 /* Set to optimistic values so the caller doesn't have to worry about
4933 initializing these and to what. On success, the function will clear
4934 these if it determines their values are different but being recursive
4935 it never sets either to true. On failure, their values are
4941 ssa_name_limit_t snlim
;
4942 return count_nonzero_bytes (exp
, 0, 0, lenrange
, nulterm
, allnul
, allnonnul
,
4946 /* Handle a single or multibyte store other than by a built-in function,
4947 either via a single character assignment or by multi-byte assignment
4948 either via MEM_REF or via a type other than char (such as in
4949 '*(int*)a = 12345'). Return true to let the caller advance *GSI to
4950 the next statement in the basic block and false otherwise. */
4953 handle_store (gimple_stmt_iterator
*gsi
, bool *zero_write
,
4954 const vr_values
*rvals
)
4958 gimple
*stmt
= gsi_stmt (*gsi
);
4959 tree ssaname
= NULL_TREE
, lhs
= gimple_assign_lhs (stmt
);
4960 tree rhs
= gimple_assign_rhs1 (stmt
);
4962 /* The offset of the first byte in LHS modified by the the store. */
4963 unsigned HOST_WIDE_INT offset
= 0;
4965 if (TREE_CODE (lhs
) == MEM_REF
4966 && TREE_CODE (TREE_OPERAND (lhs
, 0)) == SSA_NAME
)
4968 tree mem_offset
= TREE_OPERAND (lhs
, 1);
4969 if (tree_fits_uhwi_p (mem_offset
))
4971 /* Get the strinfo for the base, and use it if it starts with at
4972 least OFFSET nonzero characters. This is trivially true if
4974 offset
= tree_to_uhwi (mem_offset
);
4975 idx
= get_stridx (TREE_OPERAND (lhs
, 0));
4977 si
= get_strinfo (idx
);
4979 ssaname
= TREE_OPERAND (lhs
, 0);
4980 else if (si
== NULL
|| compare_nonzero_chars (si
, offset
, rvals
) < 0)
4982 *zero_write
= initializer_zerop (rhs
);
4985 unsigned lenrange
[] = { UINT_MAX
, 0, 0 };
4986 if (count_nonzero_bytes (rhs
, lenrange
, &dummy
, &dummy
, &dummy
,
4988 maybe_warn_overflow (stmt
, lenrange
[2], rvals
);
4996 idx
= get_addr_stridx (lhs
, NULL_TREE
, &offset
, rvals
);
4998 si
= get_strinfo (idx
);
5001 /* Minimum and maximum leading non-zero bytes and the size of the store. */
5002 unsigned lenrange
[] = { UINT_MAX
, 0, 0 };
5004 /* Set to the minimum length of the string being assigned if known. */
5005 unsigned HOST_WIDE_INT rhs_minlen
;
5007 /* STORING_NONZERO_P is true iff not all stored characters are zero.
5008 STORING_ALL_NONZERO_P is true if all stored characters are zero.
5009 STORING_ALL_ZEROS_P is true iff all stored characters are zero.
5010 Both are false when it's impossible to determine which is true. */
5011 bool storing_nonzero_p
;
5012 bool storing_all_nonzero_p
;
5013 bool storing_all_zeros_p
;
5014 /* FULL_STRING_P is set when the stored sequence of characters form
5015 a nul-terminated string. */
5018 const bool ranges_valid
5019 = count_nonzero_bytes (rhs
, lenrange
, &full_string_p
,
5020 &storing_all_zeros_p
, &storing_all_nonzero_p
,
5024 rhs_minlen
= lenrange
[0];
5025 storing_nonzero_p
= lenrange
[1] > 0;
5026 *zero_write
= storing_all_zeros_p
;
5028 maybe_warn_overflow (stmt
, lenrange
[2], rvals
);
5032 rhs_minlen
= HOST_WIDE_INT_M1U
;
5033 full_string_p
= false;
5034 storing_nonzero_p
= false;
5035 storing_all_zeros_p
= false;
5036 storing_all_nonzero_p
= false;
5041 /* The corresponding element is set to 1 if the first and last
5042 element, respectively, of the sequence of characters being
5043 written over the string described by SI ends before
5044 the terminating nul (if it has one), to zero if the nul is
5045 being overwritten but not beyond, or negative otherwise. */
5046 int store_before_nul
[2];
5049 /* The offset of the last stored byte. */
5050 unsigned HOST_WIDE_INT endoff
= offset
+ lenrange
[2] - 1;
5051 store_before_nul
[0] = compare_nonzero_chars (si
, offset
, rvals
);
5052 if (endoff
== offset
)
5053 store_before_nul
[1] = store_before_nul
[0];
5055 store_before_nul
[1] = compare_nonzero_chars (si
, endoff
, rvals
);
5059 store_before_nul
[0] = compare_nonzero_chars (si
, offset
, rvals
);
5060 store_before_nul
[1] = store_before_nul
[0];
5061 gcc_assert (offset
== 0 || store_before_nul
[0] >= 0);
5064 if (storing_all_zeros_p
5065 && store_before_nul
[0] == 0
5066 && store_before_nul
[1] == 0
5067 && si
->full_string_p
)
5069 /* When overwriting a '\0' with a '\0', the store can be removed
5070 if we know it has been stored in the current function. */
5071 if (!stmt_could_throw_p (cfun
, stmt
) && si
->writable
)
5073 unlink_stmt_vdef (stmt
);
5074 release_defs (stmt
);
5075 gsi_remove (gsi
, true);
5080 si
->writable
= true;
5086 if (store_before_nul
[1] > 0
5087 && storing_nonzero_p
5088 && lenrange
[0] == lenrange
[1]
5089 && lenrange
[0] == lenrange
[2]
5090 && TREE_CODE (TREE_TYPE (rhs
)) == INTEGER_TYPE
)
5092 /* Handle a store of one or more non-nul characters that ends
5093 before the terminating nul of the destination and so does
5094 not affect its length
5095 If si->nonzero_chars > OFFSET, we aren't overwriting '\0',
5096 and if we aren't storing '\0', we know that the length of
5097 the string and any other zero terminated string in memory
5098 remains the same. In that case we move to the next gimple
5099 statement and return to signal the caller that it shouldn't
5100 invalidate anything.
5102 This is beneficial for cases like:
5107 strcpy (p, "foobar");
5108 size_t len = strlen (p); // can be folded to 6
5109 size_t len2 = strlen (q); // has to be computed
5111 size_t len3 = strlen (p); // can be folded to 6
5112 size_t len4 = strlen (q); // can be folded to len2
5113 bar (len, len2, len3, len4);
5119 if (storing_all_zeros_p
5120 || storing_nonzero_p
5121 || (offset
!= 0 && store_before_nul
[1] > 0))
5123 /* When STORING_NONZERO_P, we know that the string will start
5124 with at least OFFSET + 1 nonzero characters. If storing
5125 a single character, set si->NONZERO_CHARS to the result.
5126 If storing multiple characters, try to determine the number
5127 of leading non-zero characters and set si->NONZERO_CHARS to
5130 When STORING_ALL_ZEROS_P, we know that the string is now
5131 OFFSET characters long.
5133 Otherwise, we're storing an unknown value at offset OFFSET,
5134 so need to clip the nonzero_chars to OFFSET.
5135 Use the minimum length of the string (or individual character)
5136 being stored if it's known. Otherwise, STORING_NONZERO_P
5137 guarantees it's at least 1. */
5139 = storing_nonzero_p
&& ranges_valid
? lenrange
[0] : 1;
5140 location_t loc
= gimple_location (stmt
);
5141 tree oldlen
= si
->nonzero_chars
;
5142 if (store_before_nul
[1] == 0 && si
->full_string_p
)
5143 /* We're overwriting the nul terminator with a nonzero or
5144 unknown character. If the previous stmt was a memcpy,
5145 its length may be decreased. */
5146 adjust_last_stmt (si
, stmt
, false);
5147 si
= unshare_strinfo (si
);
5148 if (storing_nonzero_p
)
5150 gcc_assert (len
>= 0);
5151 si
->nonzero_chars
= build_int_cst (size_type_node
, offset
+ len
);
5154 si
->nonzero_chars
= build_int_cst (size_type_node
, offset
);
5156 /* Set FULL_STRING_P only if the length of the strings being
5157 written is the same, and clear it if the strings have
5158 different lengths. In the latter case the length stored
5159 in si->NONZERO_CHARS becomes the lower bound.
5160 FIXME: Handle the upper bound of the length if possible. */
5161 si
->full_string_p
= full_string_p
&& lenrange
[0] == lenrange
[1];
5163 if (storing_all_zeros_p
5165 && !SSA_NAME_OCCURS_IN_ABNORMAL_PHI (ssaname
))
5166 si
->endptr
= ssaname
;
5171 si
->writable
= true;
5172 si
->dont_invalidate
= true;
5175 tree adj
= fold_build2_loc (loc
, MINUS_EXPR
, size_type_node
,
5176 si
->nonzero_chars
, oldlen
);
5177 adjust_related_strinfos (loc
, si
, adj
);
5183 else if (idx
== 0 && (storing_all_zeros_p
|| storing_nonzero_p
))
5186 idx
= new_stridx (ssaname
);
5188 idx
= new_addr_stridx (lhs
);
5191 tree ptr
= (ssaname
? ssaname
: build_fold_addr_expr (lhs
));
5194 if (storing_all_zeros_p
)
5196 else if (storing_nonzero_p
&& ranges_valid
)
5198 /* FIXME: Handle the upper bound of the length when
5199 LENRANGE[0] != LENRANGE[1]. */
5201 if (lenrange
[0] != lenrange
[1])
5202 /* Set the minimum length but ignore the maximum
5204 full_string_p
= false;
5209 tree len
= (slen
<= 0
5211 : build_int_cst (size_type_node
, slen
));
5212 si
= new_strinfo (ptr
, idx
, len
, slen
>= 0 && full_string_p
);
5213 set_strinfo (idx
, si
);
5214 if (storing_all_zeros_p
5216 && !SSA_NAME_OCCURS_IN_ABNORMAL_PHI (ssaname
))
5217 si
->endptr
= ssaname
;
5218 si
->dont_invalidate
= true;
5219 si
->writable
= true;
5223 && rhs_minlen
< HOST_WIDE_INT_M1U
5224 && ssaname
== NULL_TREE
5225 && TREE_CODE (TREE_TYPE (lhs
)) == ARRAY_TYPE
)
5227 HOST_WIDE_INT a
= int_size_in_bytes (TREE_TYPE (lhs
));
5228 if (a
> 0 && (unsigned HOST_WIDE_INT
) a
> rhs_minlen
)
5230 int idx
= new_addr_stridx (lhs
);
5233 si
= new_strinfo (build_fold_addr_expr (lhs
), idx
,
5234 build_int_cst (size_type_node
, rhs_minlen
),
5236 set_strinfo (idx
, si
);
5237 si
->dont_invalidate
= true;
5242 if (si
!= NULL
&& offset
== 0 && storing_all_zeros_p
&& lenrange
[2] == 1)
5244 /* For single-byte stores only, allow adjust_last_stmt to remove
5245 the statement if the stored '\0' is immediately overwritten. */
5246 laststmt
.stmt
= stmt
;
5247 laststmt
.len
= build_int_cst (size_type_node
, 1);
5248 laststmt
.stridx
= si
->idx
;
5253 /* Try to fold strstr (s, t) eq/ne s to strncmp (s, t, strlen (t)) eq/ne 0. */
5256 fold_strstr_to_strncmp (tree rhs1
, tree rhs2
, gimple
*stmt
)
5258 if (TREE_CODE (rhs1
) != SSA_NAME
5259 || TREE_CODE (rhs2
) != SSA_NAME
)
5262 gimple
*call_stmt
= NULL
;
5263 for (int pass
= 0; pass
< 2; pass
++)
5265 gimple
*g
= SSA_NAME_DEF_STMT (rhs1
);
5266 if (gimple_call_builtin_p (g
, BUILT_IN_STRSTR
)
5267 && has_single_use (rhs1
)
5268 && gimple_call_arg (g
, 0) == rhs2
)
5273 std::swap (rhs1
, rhs2
);
5278 tree arg0
= gimple_call_arg (call_stmt
, 0);
5282 tree arg1
= gimple_call_arg (call_stmt
, 1);
5283 tree arg1_len
= NULL_TREE
;
5284 int idx
= get_stridx (arg1
);
5289 arg1_len
= build_int_cst (size_type_node
, ~idx
);
5292 strinfo
*si
= get_strinfo (idx
);
5294 arg1_len
= get_string_length (si
);
5298 if (arg1_len
!= NULL_TREE
)
5300 gimple_stmt_iterator gsi
= gsi_for_stmt (call_stmt
);
5301 tree strncmp_decl
= builtin_decl_explicit (BUILT_IN_STRNCMP
);
5303 if (!is_gimple_val (arg1_len
))
5305 tree arg1_len_tmp
= make_ssa_name (TREE_TYPE (arg1_len
));
5306 gassign
*arg1_stmt
= gimple_build_assign (arg1_len_tmp
,
5308 gsi_insert_before (&gsi
, arg1_stmt
, GSI_SAME_STMT
);
5309 arg1_len
= arg1_len_tmp
;
5312 gcall
*strncmp_call
= gimple_build_call (strncmp_decl
, 3,
5313 arg0
, arg1
, arg1_len
);
5314 tree strncmp_lhs
= make_ssa_name (integer_type_node
);
5315 gimple_set_vuse (strncmp_call
, gimple_vuse (call_stmt
));
5316 gimple_call_set_lhs (strncmp_call
, strncmp_lhs
);
5317 gsi_remove (&gsi
, true);
5318 gsi_insert_before (&gsi
, strncmp_call
, GSI_SAME_STMT
);
5319 tree zero
= build_zero_cst (TREE_TYPE (strncmp_lhs
));
5321 if (is_gimple_assign (stmt
))
5323 if (gimple_assign_rhs_code (stmt
) == COND_EXPR
)
5325 tree cond
= gimple_assign_rhs1 (stmt
);
5326 TREE_OPERAND (cond
, 0) = strncmp_lhs
;
5327 TREE_OPERAND (cond
, 1) = zero
;
5331 gimple_assign_set_rhs1 (stmt
, strncmp_lhs
);
5332 gimple_assign_set_rhs2 (stmt
, zero
);
5337 gcond
*cond
= as_a
<gcond
*> (stmt
);
5338 gimple_cond_set_lhs (cond
, strncmp_lhs
);
5339 gimple_cond_set_rhs (cond
, zero
);
5347 /* Return true if TYPE corresponds to a narrow character type. */
5350 is_char_type (tree type
)
5352 return (TREE_CODE (type
) == INTEGER_TYPE
5353 && TYPE_MODE (type
) == TYPE_MODE (char_type_node
)
5354 && TYPE_PRECISION (type
) == TYPE_PRECISION (char_type_node
));
5357 /* Check the built-in call at GSI for validity and optimize it.
5358 Uses RVALS to determine range information.
5359 Return true to let the caller advance *GSI to the next statement
5360 in the basic block and false otherwise. */
5363 strlen_check_and_optimize_call (gimple_stmt_iterator
*gsi
, bool *zero_write
,
5364 const vr_values
*rvals
)
5366 gimple
*stmt
= gsi_stmt (*gsi
);
5368 if (!gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
5370 tree fntype
= gimple_call_fntype (stmt
);
5371 if (fntype
&& lookup_attribute ("alloc_size", TYPE_ATTRIBUTES (fntype
)))
5372 handle_alloc_call (BUILT_IN_NONE
, gsi
);
5375 /* When not optimizing we must be checking printf calls which
5376 we do even for user-defined functions when they are declared
5377 with attribute format. */
5378 if (!flag_optimize_strlen
5380 || !valid_builtin_call (stmt
))
5381 return !handle_printf_call (gsi
, rvals
);
5383 tree callee
= gimple_call_fndecl (stmt
);
5384 switch (DECL_FUNCTION_CODE (callee
))
5386 case BUILT_IN_STRLEN
:
5387 case BUILT_IN_STRNLEN
:
5388 handle_builtin_strlen (gsi
);
5390 case BUILT_IN_STRCHR
:
5391 handle_builtin_strchr (gsi
);
5393 case BUILT_IN_STRCPY
:
5394 case BUILT_IN_STRCPY_CHK
:
5395 case BUILT_IN_STPCPY
:
5396 case BUILT_IN_STPCPY_CHK
:
5397 handle_builtin_strcpy (DECL_FUNCTION_CODE (callee
), gsi
, rvals
);
5400 case BUILT_IN_STRNCAT
:
5401 case BUILT_IN_STRNCAT_CHK
:
5402 handle_builtin_strncat (DECL_FUNCTION_CODE (callee
), gsi
);
5405 case BUILT_IN_STPNCPY
:
5406 case BUILT_IN_STPNCPY_CHK
:
5407 case BUILT_IN_STRNCPY
:
5408 case BUILT_IN_STRNCPY_CHK
:
5409 handle_builtin_stxncpy (DECL_FUNCTION_CODE (callee
), gsi
);
5412 case BUILT_IN_MEMCPY
:
5413 case BUILT_IN_MEMCPY_CHK
:
5414 case BUILT_IN_MEMPCPY
:
5415 case BUILT_IN_MEMPCPY_CHK
:
5416 handle_builtin_memcpy (DECL_FUNCTION_CODE (callee
), gsi
, rvals
);
5418 case BUILT_IN_STRCAT
:
5419 case BUILT_IN_STRCAT_CHK
:
5420 handle_builtin_strcat (DECL_FUNCTION_CODE (callee
), gsi
);
5422 case BUILT_IN_ALLOCA
:
5423 case BUILT_IN_ALLOCA_WITH_ALIGN
:
5424 case BUILT_IN_MALLOC
:
5425 case BUILT_IN_CALLOC
:
5426 handle_alloc_call (DECL_FUNCTION_CODE (callee
), gsi
);
5428 case BUILT_IN_MEMSET
:
5429 if (handle_builtin_memset (gsi
, zero_write
, rvals
))
5432 case BUILT_IN_MEMCMP
:
5433 if (handle_builtin_memcmp (gsi
))
5436 case BUILT_IN_STRCMP
:
5437 case BUILT_IN_STRNCMP
:
5438 if (handle_builtin_string_cmp (gsi
))
5442 if (handle_printf_call (gsi
, rvals
))
5450 /* Handle an assignment statement at *GSI to a LHS of integral type.
5451 If GSI's basic block needs clean-up of EH, set *CLEANUP_EH to true. */
5454 handle_integral_assign (gimple_stmt_iterator
*gsi
, bool *cleanup_eh
,
5455 const vr_values
*rvals
)
5457 gimple
*stmt
= gsi_stmt (*gsi
);
5458 tree lhs
= gimple_assign_lhs (stmt
);
5459 tree lhs_type
= TREE_TYPE (lhs
);
5461 enum tree_code code
= gimple_assign_rhs_code (stmt
);
5462 if (code
== COND_EXPR
)
5464 tree cond
= gimple_assign_rhs1 (stmt
);
5465 enum tree_code cond_code
= TREE_CODE (cond
);
5467 if (cond_code
== EQ_EXPR
|| cond_code
== NE_EXPR
)
5468 fold_strstr_to_strncmp (TREE_OPERAND (cond
, 0),
5469 TREE_OPERAND (cond
, 1), stmt
);
5471 else if (code
== EQ_EXPR
|| code
== NE_EXPR
)
5472 fold_strstr_to_strncmp (gimple_assign_rhs1 (stmt
),
5473 gimple_assign_rhs2 (stmt
), stmt
);
5474 else if (gimple_assign_load_p (stmt
)
5475 && TREE_CODE (lhs_type
) == INTEGER_TYPE
5476 && TYPE_MODE (lhs_type
) == TYPE_MODE (char_type_node
)
5477 && (TYPE_PRECISION (lhs_type
)
5478 == TYPE_PRECISION (char_type_node
))
5479 && !gimple_has_volatile_ops (stmt
))
5481 tree off
= integer_zero_node
;
5482 unsigned HOST_WIDE_INT coff
= 0;
5484 tree rhs1
= gimple_assign_rhs1 (stmt
);
5485 if (code
== MEM_REF
)
5487 idx
= get_stridx (TREE_OPERAND (rhs1
, 0));
5490 strinfo
*si
= get_strinfo (idx
);
5492 && si
->nonzero_chars
5493 && TREE_CODE (si
->nonzero_chars
) == INTEGER_CST
5494 && (wi::to_widest (si
->nonzero_chars
)
5495 >= wi::to_widest (off
)))
5496 off
= TREE_OPERAND (rhs1
, 1);
5498 /* This case is not useful. See if get_addr_stridx
5499 returns something usable. */
5504 idx
= get_addr_stridx (rhs1
, NULL_TREE
, &coff
);
5507 strinfo
*si
= get_strinfo (idx
);
5509 && si
->nonzero_chars
5510 && TREE_CODE (si
->nonzero_chars
) == INTEGER_CST
)
5512 widest_int w1
= wi::to_widest (si
->nonzero_chars
);
5513 widest_int w2
= wi::to_widest (off
) + coff
;
5515 && si
->full_string_p
)
5517 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
5519 fprintf (dump_file
, "Optimizing: ");
5520 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
5523 /* Reading the final '\0' character. */
5524 tree zero
= build_int_cst (lhs_type
, 0);
5525 gimple_set_vuse (stmt
, NULL_TREE
);
5526 gimple_assign_set_rhs_from_tree (gsi
, zero
);
5528 |= maybe_clean_or_replace_eh_stmt (stmt
,
5530 stmt
= gsi_stmt (*gsi
);
5533 if (dump_file
&& (dump_flags
& TDF_DETAILS
) != 0)
5535 fprintf (dump_file
, "into: ");
5536 print_gimple_stmt (dump_file
, stmt
, 0, TDF_SLIM
);
5541 /* Reading a character before the final '\0'
5542 character. Just set the value range to ~[0, 0]
5543 if we don't have anything better. */
5545 signop sign
= TYPE_SIGN (lhs_type
);
5546 int prec
= TYPE_PRECISION (lhs_type
);
5547 value_range_kind vr
= get_range_info (lhs
, &min
, &max
);
5548 if (vr
== VR_VARYING
5550 && min
== wi::min_value (prec
, sign
)
5551 && max
== wi::max_value (prec
, sign
)))
5552 set_range_info (lhs
, VR_ANTI_RANGE
,
5553 wi::zero (prec
), wi::zero (prec
));
5558 else if (code
== MEM_REF
&& TREE_CODE (lhs
) == SSA_NAME
)
5560 if (int idx
= new_stridx (lhs
))
5562 /* Record multi-byte assignments from MEM_REFs. */
5563 bool storing_all_nonzero_p
;
5564 bool storing_all_zeros_p
;
5566 unsigned lenrange
[] = { UINT_MAX
, 0, 0 };
5567 tree rhs
= gimple_assign_rhs1 (stmt
);
5568 const bool ranges_valid
5569 = count_nonzero_bytes (rhs
, lenrange
, &full_string_p
,
5570 &storing_all_zeros_p
, &storing_all_nonzero_p
,
5574 tree length
= build_int_cst (sizetype
, lenrange
[0]);
5575 strinfo
*si
= new_strinfo (lhs
, idx
, length
, full_string_p
);
5576 set_strinfo (idx
, si
);
5577 si
->writable
= true;
5578 si
->dont_invalidate
= true;
5579 maybe_warn_overflow (stmt
, lenrange
[2], rvals
);
5584 if (strlen_to_stridx
)
5586 tree rhs1
= gimple_assign_rhs1 (stmt
);
5587 if (stridx_strlenloc
*ps
= strlen_to_stridx
->get (rhs1
))
5588 strlen_to_stridx
->put (lhs
, stridx_strlenloc (*ps
));
5592 /* Attempt to check for validity of the performed access a single statement
5593 at *GSI using string length knowledge, and to optimize it.
5594 If the given basic block needs clean-up of EH, CLEANUP_EH is set to
5595 true. Return true to let the caller advance *GSI to the next statement
5596 in the basic block and false otherwise. */
5599 check_and_optimize_stmt (gimple_stmt_iterator
*gsi
, bool *cleanup_eh
,
5600 const vr_values
*rvals
)
5602 gimple
*stmt
= gsi_stmt (*gsi
);
5604 /* For statements that modify a string, set to true if the write
5606 bool zero_write
= false;
5608 if (is_gimple_call (stmt
))
5610 if (!strlen_check_and_optimize_call (gsi
, &zero_write
, rvals
))
5613 else if (!flag_optimize_strlen
|| !strlen_optimize
)
5615 else if (is_gimple_assign (stmt
) && !gimple_clobber_p (stmt
))
5617 /* Handle non-clobbering assignment. */
5618 tree lhs
= gimple_assign_lhs (stmt
);
5619 tree lhs_type
= TREE_TYPE (lhs
);
5621 if (TREE_CODE (lhs
) == SSA_NAME
&& POINTER_TYPE_P (lhs_type
))
5623 if (gimple_assign_single_p (stmt
)
5624 || (gimple_assign_cast_p (stmt
)
5625 && POINTER_TYPE_P (TREE_TYPE (gimple_assign_rhs1 (stmt
)))))
5627 int idx
= get_stridx (gimple_assign_rhs1 (stmt
));
5628 ssa_ver_to_stridx
[SSA_NAME_VERSION (lhs
)] = idx
;
5630 else if (gimple_assign_rhs_code (stmt
) == POINTER_PLUS_EXPR
)
5631 handle_pointer_plus (gsi
);
5633 else if (TREE_CODE (lhs
) == SSA_NAME
&& INTEGRAL_TYPE_P (lhs_type
))
5634 /* Handle assignment to a character. */
5635 handle_integral_assign (gsi
, cleanup_eh
, rvals
);
5636 else if (TREE_CODE (lhs
) != SSA_NAME
&& !TREE_SIDE_EFFECTS (lhs
))
5638 tree type
= TREE_TYPE (lhs
);
5639 if (TREE_CODE (type
) == ARRAY_TYPE
)
5640 type
= TREE_TYPE (type
);
5642 bool is_char_store
= is_char_type (type
);
5643 if (!is_char_store
&& TREE_CODE (lhs
) == MEM_REF
)
5645 /* To consider stores into char objects via integer types
5646 other than char but not those to non-character objects,
5647 determine the type of the destination rather than just
5648 the type of the access. */
5649 for (int i
= 0; i
!= 2; ++i
)
5651 tree ref
= TREE_OPERAND (lhs
, i
);
5652 type
= TREE_TYPE (ref
);
5653 if (TREE_CODE (type
) == POINTER_TYPE
)
5654 type
= TREE_TYPE (type
);
5655 if (TREE_CODE (type
) == ARRAY_TYPE
)
5656 type
= TREE_TYPE (type
);
5657 if (is_char_type (type
))
5659 is_char_store
= true;
5665 /* Handle a single or multibyte assignment. */
5666 if (is_char_store
&& !handle_store (gsi
, &zero_write
, rvals
))
5670 else if (gcond
*cond
= dyn_cast
<gcond
*> (stmt
))
5672 enum tree_code code
= gimple_cond_code (cond
);
5673 if (code
== EQ_EXPR
|| code
== NE_EXPR
)
5674 fold_strstr_to_strncmp (gimple_cond_lhs (stmt
),
5675 gimple_cond_rhs (stmt
), stmt
);
5678 if (gimple_vdef (stmt
))
5679 maybe_invalidate (stmt
, zero_write
);
5683 /* Recursively call maybe_invalidate on stmts that might be executed
5684 in between dombb and current bb and that contain a vdef. Stop when
5685 *count stmts are inspected, or if the whole strinfo vector has
5686 been invalidated. */
5689 do_invalidate (basic_block dombb
, gimple
*phi
, bitmap visited
, int *count
)
5691 unsigned int i
, n
= gimple_phi_num_args (phi
);
5693 for (i
= 0; i
< n
; i
++)
5695 tree vuse
= gimple_phi_arg_def (phi
, i
);
5696 gimple
*stmt
= SSA_NAME_DEF_STMT (vuse
);
5697 basic_block bb
= gimple_bb (stmt
);
5700 || !bitmap_set_bit (visited
, bb
->index
)
5701 || !dominated_by_p (CDI_DOMINATORS
, bb
, dombb
))
5705 if (gimple_code (stmt
) == GIMPLE_PHI
)
5707 do_invalidate (dombb
, stmt
, visited
, count
);
5714 if (!maybe_invalidate (stmt
))
5719 vuse
= gimple_vuse (stmt
);
5720 stmt
= SSA_NAME_DEF_STMT (vuse
);
5721 if (gimple_bb (stmt
) != bb
)
5723 bb
= gimple_bb (stmt
);
5726 || !bitmap_set_bit (visited
, bb
->index
)
5727 || !dominated_by_p (CDI_DOMINATORS
, bb
, dombb
))
5734 class strlen_dom_walker
: public dom_walker
5737 strlen_dom_walker (cdi_direction direction
)
5738 : dom_walker (direction
),
5740 m_cleanup_cfg (false)
5743 virtual edge
before_dom_children (basic_block
);
5744 virtual void after_dom_children (basic_block
);
5746 /* EVRP analyzer used for printf argument range processing, and
5747 to track strlen results across integer variable assignments. */
5748 evrp_range_analyzer evrp
;
5750 /* Flag that will trigger TODO_cleanup_cfg to be returned in strlen
5751 execute function. */
5755 /* Callback for walk_dominator_tree. Attempt to optimize various
5756 string ops by remembering string lengths pointed by pointer SSA_NAMEs. */
5759 strlen_dom_walker::before_dom_children (basic_block bb
)
5763 basic_block dombb
= get_immediate_dominator (CDI_DOMINATORS
, bb
);
5766 stridx_to_strinfo
= NULL
;
5769 stridx_to_strinfo
= ((vec
<strinfo
*, va_heap
, vl_embed
> *) dombb
->aux
);
5770 if (stridx_to_strinfo
)
5772 for (gphi_iterator gsi
= gsi_start_phis (bb
); !gsi_end_p (gsi
);
5775 gphi
*phi
= gsi
.phi ();
5776 if (virtual_operand_p (gimple_phi_result (phi
)))
5778 bitmap visited
= BITMAP_ALLOC (NULL
);
5779 int count_vdef
= 100;
5780 do_invalidate (dombb
, phi
, visited
, &count_vdef
);
5781 BITMAP_FREE (visited
);
5782 if (count_vdef
== 0)
5784 /* If there were too many vdefs in between immediate
5785 dominator and current bb, invalidate everything.
5786 If stridx_to_strinfo has been unshared, we need
5787 to free it, otherwise just set it to NULL. */
5788 if (!strinfo_shared ())
5794 vec_safe_iterate (stridx_to_strinfo
, i
, &si
);
5798 (*stridx_to_strinfo
)[i
] = NULL
;
5802 stridx_to_strinfo
= NULL
;
5810 /* If all PHI arguments have the same string index, the PHI result
5812 for (gphi_iterator gsi
= gsi_start_phis (bb
); !gsi_end_p (gsi
);
5815 gphi
*phi
= gsi
.phi ();
5816 tree result
= gimple_phi_result (phi
);
5817 if (!virtual_operand_p (result
) && POINTER_TYPE_P (TREE_TYPE (result
)))
5819 int idx
= get_stridx (gimple_phi_arg_def (phi
, 0));
5822 unsigned int i
, n
= gimple_phi_num_args (phi
);
5823 for (i
= 1; i
< n
; i
++)
5824 if (idx
!= get_stridx (gimple_phi_arg_def (phi
, i
)))
5827 ssa_ver_to_stridx
[SSA_NAME_VERSION (result
)] = idx
;
5832 bool cleanup_eh
= false;
5834 /* Attempt to optimize individual statements. */
5835 for (gimple_stmt_iterator gsi
= gsi_start_bb (bb
); !gsi_end_p (gsi
); )
5837 gimple
*stmt
= gsi_stmt (gsi
);
5839 /* First record ranges generated by this statement so they
5840 can be used by printf argument processing. */
5841 evrp
.record_ranges_from_stmt (stmt
, false);
5843 if (check_and_optimize_stmt (&gsi
, &cleanup_eh
, evrp
.get_vr_values ()))
5847 if (cleanup_eh
&& gimple_purge_dead_eh_edges (bb
))
5848 m_cleanup_cfg
= true;
5850 bb
->aux
= stridx_to_strinfo
;
5851 if (vec_safe_length (stridx_to_strinfo
) && !strinfo_shared ())
5852 (*stridx_to_strinfo
)[0] = (strinfo
*) bb
;
5856 /* Callback for walk_dominator_tree. Free strinfo vector if it is
5857 owned by the current bb, clear bb->aux. */
5860 strlen_dom_walker::after_dom_children (basic_block bb
)
5866 stridx_to_strinfo
= ((vec
<strinfo
*, va_heap
, vl_embed
> *) bb
->aux
);
5867 if (vec_safe_length (stridx_to_strinfo
)
5868 && (*stridx_to_strinfo
)[0] == (strinfo
*) bb
)
5873 for (i
= 1; vec_safe_iterate (stridx_to_strinfo
, i
, &si
); ++i
)
5875 vec_free (stridx_to_strinfo
);
5884 printf_strlen_execute (function
*fun
, bool warn_only
)
5886 strlen_optimize
= !warn_only
;
5888 calculate_dominance_info (CDI_DOMINATORS
);
5890 bool use_scev
= optimize
> 0 && flag_printf_return_value
;
5893 loop_optimizer_init (LOOPS_NORMAL
);
5897 gcc_assert (!strlen_to_stridx
);
5898 if (warn_stringop_overflow
|| warn_stringop_truncation
)
5899 strlen_to_stridx
= new hash_map
<tree
, stridx_strlenloc
> ();
5901 /* This has to happen after initializing the loop optimizer
5902 and initializing SCEV as they create new SSA_NAMEs. */
5903 ssa_ver_to_stridx
.safe_grow_cleared (num_ssa_names
);
5906 /* String length optimization is implemented as a walk of the dominator
5907 tree and a forward walk of statements within each block. */
5908 strlen_dom_walker
walker (CDI_DOMINATORS
);
5909 walker
.walk (ENTRY_BLOCK_PTR_FOR_FN (fun
));
5911 ssa_ver_to_stridx
.release ();
5912 strinfo_pool
.release ();
5913 if (decl_to_stridxlist_htab
)
5915 obstack_free (&stridx_obstack
, NULL
);
5916 delete decl_to_stridxlist_htab
;
5917 decl_to_stridxlist_htab
= NULL
;
5919 laststmt
.stmt
= NULL
;
5920 laststmt
.len
= NULL_TREE
;
5921 laststmt
.stridx
= 0;
5923 if (strlen_to_stridx
)
5925 strlen_to_stridx
->empty ();
5926 delete strlen_to_stridx
;
5927 strlen_to_stridx
= NULL
;
5933 loop_optimizer_finalize ();
5936 /* Clean up object size info. */
5937 fini_object_sizes ();
5939 return walker
.m_cleanup_cfg
? TODO_cleanup_cfg
: 0;
5942 /* This file defines two passes: one for warnings that runs only when
5943 optimization is disabled, and another that implements optimizations
5944 and also issues warnings. */
5946 const pass_data pass_data_warn_printf
=
5948 GIMPLE_PASS
, /* type */
5949 "warn-printf", /* name */
5950 OPTGROUP_NONE
, /* optinfo_flags */
5951 TV_NONE
, /* tv_id */
5952 /* Normally an optimization pass would require PROP_ssa but because
5953 this pass runs early, with no optimization, to do sprintf format
5954 checking, it only requires PROP_cfg. */
5955 PROP_cfg
, /* properties_required */
5956 0, /* properties_provided */
5957 0, /* properties_destroyed */
5958 0, /* todo_flags_start */
5959 0, /* todo_flags_finish */
5962 class pass_warn_printf
: public gimple_opt_pass
5965 pass_warn_printf (gcc::context
*ctxt
)
5966 : gimple_opt_pass (pass_data_warn_printf
, ctxt
)
5969 virtual bool gate (function
*);
5970 virtual unsigned int execute (function
*fun
)
5972 return printf_strlen_execute (fun
, true);
5977 /* Return true to run the warning pass only when not optimizing and
5978 iff either -Wformat-overflow or -Wformat-truncation is specified. */
5981 pass_warn_printf::gate (function
*)
5983 return !optimize
&& (warn_format_overflow
> 0 || warn_format_trunc
> 0);
5986 const pass_data pass_data_strlen
=
5988 GIMPLE_PASS
, /* type */
5989 "strlen", /* name */
5990 OPTGROUP_NONE
, /* optinfo_flags */
5991 TV_TREE_STRLEN
, /* tv_id */
5992 PROP_cfg
| PROP_ssa
, /* properties_required */
5993 0, /* properties_provided */
5994 0, /* properties_destroyed */
5995 0, /* todo_flags_start */
5996 0, /* todo_flags_finish */
5999 class pass_strlen
: public gimple_opt_pass
6002 pass_strlen (gcc::context
*ctxt
)
6003 : gimple_opt_pass (pass_data_strlen
, ctxt
)
6006 opt_pass
* clone () { return new pass_strlen (m_ctxt
); }
6008 virtual bool gate (function
*);
6009 virtual unsigned int execute (function
*fun
)
6011 return printf_strlen_execute (fun
, false);
6015 /* Return true to run the pass only when the sprintf and/or strlen
6016 optimizations are enabled and -Wformat-overflow or -Wformat-truncation
6020 pass_strlen::gate (function
*)
6022 return ((warn_format_overflow
> 0
6023 || warn_format_trunc
> 0
6024 || warn_restrict
> 0
6025 || flag_optimize_strlen
> 0
6026 || flag_printf_return_value
)
6033 make_pass_warn_printf (gcc::context
*ctxt
)
6035 return new pass_warn_printf (ctxt
);
6039 make_pass_strlen (gcc::context
*ctxt
)
6041 return new pass_strlen (ctxt
);