[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

Richard Biener  changed:

   What|Removed |Added

 Status|ASSIGNED|RESOLVED
 Resolution|--- |FIXED

--- Comment #9 from Richard Biener  ---
Fixed.

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

Richard Biener  changed:

   What|Removed |Added

 Status|ASSIGNED|RESOLVED
  Known to work|8.0 |
 Resolution|--- |FIXED
 Status|RESOLVED|ASSIGNED
  Known to work|8.0 |
 Resolution|FIXED   |---

--- Comment #7 from Richard Biener  ---
Fixed for GCC8.

--- Comment #8 from Richard Biener  ---
Author: rguenth
Date: Fri Apr 21 12:47:02 2017
New Revision: 247062

URL: https://gcc.gnu.org/viewcvs?rev=247062=gcc=rev
Log:
2017-04-21  Richard Biener  

PR tree-optimization/79547
* tree-ssa-structalias.c (find_func_aliases_for_builtin_call):
Handle strlen, strcmp, strncmp, strcasecmp, strncasecmp, memcmp,
bcmp, strspn, strcspn, __builtin_object_size and __builtin_constant_p
without any constraints.

* gcc.dg/tree-ssa/strlen-2.c: New testcase.

Added:
trunk/gcc/testsuite/gcc.dg/tree-ssa/strlen-2.c
Modified:
trunk/gcc/ChangeLog
trunk/gcc/testsuite/ChangeLog
trunk/gcc/tree-ssa-structalias.c

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

Richard Biener  changed:

   What|Removed |Added

 Status|ASSIGNED|RESOLVED
  Known to work|8.0 |
 Resolution|--- |FIXED
 Status|RESOLVED|ASSIGNED
  Known to work|8.0 |
 Resolution|FIXED   |---

--- Comment #7 from Richard Biener  ---
Fixed for GCC8.

--- Comment #8 from Richard Biener  ---
Author: rguenth
Date: Fri Apr 21 12:47:02 2017
New Revision: 247062

URL: https://gcc.gnu.org/viewcvs?rev=247062=gcc=rev
Log:
2017-04-21  Richard Biener  

PR tree-optimization/79547
* tree-ssa-structalias.c (find_func_aliases_for_builtin_call):
Handle strlen, strcmp, strncmp, strcasecmp, strncasecmp, memcmp,
bcmp, strspn, strcspn, __builtin_object_size and __builtin_constant_p
without any constraints.

* gcc.dg/tree-ssa/strlen-2.c: New testcase.

Added:
trunk/gcc/testsuite/gcc.dg/tree-ssa/strlen-2.c
Modified:
trunk/gcc/ChangeLog
trunk/gcc/testsuite/ChangeLog
trunk/gcc/tree-ssa-structalias.c

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

--- Comment #6 from rguenther at suse dot de  ---
On Thu, 16 Feb 2017, jakub at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547
> 
> --- Comment #5 from Jakub Jelinek  ---
> Actually the last 4 not, they return addresses into it.
> But also strspn and strcspn?

Yeah, and __builtin_object_size (which is pure, not const - huh).
and __builtin_constant_p.  Then there's bcmp.

Just looking at the list of BT_FN_{INT,SIZE}_ in builtins.def.

Note that other functions like popcount can cause similar leakage,
say for

  foo (popcountl ((uintptr_t)s));

but as they do return some property of the pointer value I'm nervous
that a combination of such info can be used to restore the actual
pointer value (which is the only reason we track pointers through
integers - and floats!).

Richard.

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

--- Comment #5 from Jakub Jelinek  ---
Actually the last 4 not, they return addresses into it.
But also strspn and strcspn?

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

--- Comment #4 from Jakub Jelinek  ---
(In reply to Richard Biener from comment #3)
> +  /* Pure functions that return something not based on any object.  */
> +  case BUILT_IN_STRLEN:
> +   /* We don't need to do anything here.  No constraints are necessary
> +  for the return value and call handling for pure functions is
> +  special-cased in the alias oracle.  */
> +   return true;
>/* Trampolines are special - they set up passing the static
>  frame.  */
>case BUILT_IN_INIT_TRAMPOLINE:
> 
> 
> any other similar (pure/const) builtins?

strcmp, strncmp, strcasecmp, strncasecmp, memcmp, strchr, strrchr, index,
rindex?

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

Richard Biener  changed:

   What|Removed |Added

 Status|UNCONFIRMED |ASSIGNED
   Last reconfirmed||2017-02-16
   Assignee|unassigned at gcc dot gnu.org  |rguenth at gcc dot 
gnu.org
 Ever confirmed|0   |1

--- Comment #3 from Richard Biener  ---
Yes, the issue is that we are not told that __builtin_strlen does not return
something that can be used to re-construct the address of 's' and thus
passing that return value to f() makes it escaped.  That is, strlen is not

size_t strlen(const char *s) { return (size_t)s; }

handling strlen inside find_func_aliases_for_builtin_call would fix that part
but for example SCCVN doesn't do stmt walking when CSEing pure calls.  But the
strlen pass then handles things.

Index: gcc/tree-ssa-structalias.c
===
--- gcc/tree-ssa-structalias.c  (revision 245501)
+++ gcc/tree-ssa-structalias.c  (working copy)
@@ -4474,6 +4474,12 @@ find_func_aliases_for_builtin_call (stru
process_all_all_constraints (lhsc, rhsc);
  }
return true;
+  /* Pure functions that return something not based on any object.  */
+  case BUILT_IN_STRLEN:
+   /* We don't need to do anything here.  No constraints are necessary
+  for the return value and call handling for pure functions is
+  special-cased in the alias oracle.  */
+   return true;
   /* Trampolines are special - they set up passing the static
 frame.  */
   case BUILT_IN_INIT_TRAMPOLINE:


any other similar (pure/const) builtins?

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

Jakub Jelinek  changed:

   What|Removed |Added

 CC||jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek  ---
Yeah, if alias analysis would be able to determine that __builtin_strlen
doesn't really escape the address anywhere (similarly strcmp and others), then
it would magically just work, the strlen pass just asks alias oracle whether
each stmt can modify the bytes pointed by s.

[Bug tree-optimization/79547] duplicate strlen calls with same argument not folded

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79547

--- Comment #1 from Andrew Pinski  ---
Most likely the alias analysis thinks s escapes such that f touches it.

Look at the alias dump and also add -vops to the dump option.