The RTL representation of the code for a function is a doubly-linked
chain of objects called insns. Insns are expressions with
special codes that are used for no other purpose. Some insns are
actual instructions; others represent dispatch tables for
statements; others represent labels to jump to or various sorts of
In addition to its own specific data, each insn must have a unique
id-number that distinguishes it from all other insns in the current
function (after delayed branch scheduling, copies of an insn with the
same id-number may be present in multiple places in a function, but
these copies will always be identical and will only appear inside a
sequence), and chain pointers to the preceding and following
insns. These three fields occupy the same position in every insn,
independent of the expression code of the insn. They could be accessed
XINT, but instead three special macros are
Accesses the unique id of insn i.
Accesses the chain pointer to the insn preceding i. If i is the first insn, this is a null pointer.
Accesses the chain pointer to the insn following i. If i is the last insn, this is a null pointer.
The first insn in the chain is obtained by calling
last insn is the result of calling
get_last_insn. Within the
chain delimited by these insns, the
PREV_INSN pointers must always correspond: if insn is not
the first insn,
NEXT_INSN (PREV_INSN (insn)) == insn
is always true and if insn is not the last insn,
PREV_INSN (NEXT_INSN (insn)) == insn
is always true.
After delay slot scheduling, some of the insns in the chain might be
sequence expressions, which contain a vector of insns. The value
NEXT_INSN in all but the last of these insns is the next insn
in the vector; the value of
NEXT_INSN of the last insn in the vector
is the same as the value of
NEXT_INSN for the
which it is contained. Similar rules apply for
This means that the above invariants are not necessarily true for insns
sequence expressions. Specifically, if insn is the
first insn in a
NEXT_INSN (PREV_INSN (insn))
is the insn containing the
sequence expression, as is the value
PREV_INSN (NEXT_INSN (insn)) if insn is the last
insn in the
sequence expression. You can use these expressions
to find the containing
Every insn has one of the following expression codes:
The expression code
insn is used for instructions that do not jump
and do not do function calls.
sequence expressions are always
contained in insns with code
insn even if one of those insns
should jump or do function calls.
Insns with code
insn have four additional fields beyond the three
mandatory ones listed above. These four are described in a table below.
The expression code
jump_insn is used for instructions that may
jump (or, more generally, may contain
label_ref expressions to
pc can be set in that instruction). If there is an
instruction to return from the current function, it is recorded as a
jump_insn insns have the same extra fields as
accessed in the same way and in addition contain a field
JUMP_LABEL which is defined once jump optimization has completed.
For simple conditional and unconditional jumps, this field contains
code_label to which this insn will (possibly conditionally)
branch. In a more complex jump,
JUMP_LABEL records one of the
labels that the insn refers to; other jump target labels are recorded
REG_LABEL_TARGET notes. The exception is
and the only way to find the labels is to scan the entire body of the
Return insns count as jumps, but their
The expression code
call_insn is used for instructions that may do
function calls. It is important to distinguish these instructions because
they imply that certain registers and memory locations may be altered
call_insn insns have the same extra fields as
accessed in the same way and in addition contain a field
CALL_INSN_FUNCTION_USAGE, which contains a list (chain of
expr_list expressions) containing
set expressions that denote hard registers and
mems used or clobbered by the called function.
mem generally points to a stack slot in which arguments passed
to the libcall by reference (see TARGET_PASS_BY_REFERENCE) are stored. If the argument is
caller-copied (see TARGET_CALLEE_COPIES),
the stack slot will be mentioned in
entries; if it’s callee-copied, only a
use will appear, and the
mem may point to addresses that are not stack slots.
Registers occurring inside a
clobber in this list augment
registers specified in
CALL_USED_REGISTERS (see Register Basics).
If the list contains a
set involving two registers, it indicates
that the function returns one of its arguments. Such a
look like a no-op if the same register holds the argument and the return
code_label insn represents a label that a jump insn can jump
to. It contains two special fields of data in addition to the three
CODE_LABEL_NUMBER is used to hold the label
number, a number that identifies this label uniquely among all the
labels in the compilation (not just in the current function).
Ultimately, the label is represented in the assembler output as an
assembler label, usually of the form ‘Ln’ where n is
the label number.
code_label appears in an RTL expression, it normally
appears within a
label_ref which represents the address of
the label, as a number.
Besides as a
code_label, a label can also be represented as a
note of type
LABEL_NUSES is only defined once the jump optimization
phase is completed. It contains the number of times this label is
referenced in the current function.
LABEL_KIND differentiates four different types of
LABEL_WEAK_ENTRY. The only labels
that do not have type
LABEL_NORMAL are alternate entry
points to the current function. These may be static (visible only in
the containing translation unit), global (exposed to all translation
units), or weak (global, but can be overridden by another symbol with the
Much of the compiler treats all four kinds of label identically. Some
of it needs to know whether or not a label is an alternate entry point;
for this purpose, the macro
LABEL_ALT_ENTRY_P is provided. It is
equivalent to testing whether ‘LABEL_KIND (label) == LABEL_NORMAL’.
The only place that cares about the distinction between static, global,
and weak alternate entry points, besides the front-end code that creates
them, is the function
To set the kind of a label, use the
jump_table_data insn is a placeholder for the jump-table data
tablejump insn. They are placed after
tablejump_p insn. A
jump_table_data insn is not part o
a basic blockm but it is associated with the basic block that ends with
tablejump_p insn. The
PATTERN of a
is always either an
addr_vec or an
addr_diff_vec, and a
jump_table_data insn is always preceded by a
tablejump_p insn refers to that
code_label via its
Barriers are placed in the instruction stream when control cannot flow
past them. They are placed after unconditional jump instructions to
indicate that the jumps are unconditional and after calls to
volatile functions, which do not return (e.g.,
They contain no information beyond the three standard fields.
note insns are used to represent additional debugging and
declarative information. They contain two nonstandard fields, an
integer which is accessed with the macro
NOTE_LINE_NUMBER and a
string accessed with
NOTE_LINE_NUMBER is positive, the note represents the
position of a source line and
NOTE_SOURCE_FILE is the source file name
that the line came from. These notes control generation of line
number data in the assembler output.
NOTE_LINE_NUMBER is not really a line number but a
code with one of the following values (and
must contain a null pointer):
Such a note is completely ignorable. Some passes of the compiler delete insns by altering them into notes of this kind.
This marks what used to be a
code_label, but was not used for other
purposes than taking its address and was transformed to mark that no
code jumps to it.
These types of notes indicate the position of the beginning and end of a level of scoping of variable names. They control the output of debugging information.
These types of notes indicate the position of the beginning and end of a
level of scoping for exception handling.
identifies which region is associated with these notes.
Appears at the start of the function body, after the function prologue.
This note is used to generate variable location debugging information.
It indicates that the user variable in its
is at the location given in the RTL expression, or holds a value that
can be computed by evaluating the RTL expression from that static
point in the program up to the next such note for the same user
This note is used to generate
is_stmt markers in line number
debuggign information. It indicates the beginning of a user
This note is used to generate
entry_pc for inlined subroutines in
debugging information. It indicates an inspection point at which all
arguments for the inlined function have been bound, and before its first
These codes are printed symbolically when they appear in debugging dumps.
The expression code
debug_insn is used for pseudo-instructions
that hold debugging information for variable tracking at assignments
(see -fvar-tracking-assignments option). They are the RTL
GIMPLE_DEBUG), with a
VAR_LOCATION operand that
binds a user variable tree to an RTL representation of the
value in the corresponding statement. A
it stands for the value bound to the corresponding
expanded to RTL as a
DEBUG_INSN with a
PATTERN; the difference is the RTL mode: the former’s
VOIDmode, whereas the latter is
BLKmode; information about the inlined function can be taken from
the lexical block encoded in the
DEBUG_INSNs, that do not carry
DEBUG_MARKERs, can be detected by testing
DEBUG_MARKER_INSN_P, whereas those that do can be recognized as
Throughout optimization passes,
DEBUG_INSNs are not reordered
with respect to each other, particularly during scheduling. Binding
information is kept in pseudo-instruction form, so that, unlike notes,
it gets the same treatment and adjustments that regular instructions
would. It is the variable tracking pass that turns these
analyzing control flow, value equivalences and changes to registers and
memory referenced in value expressions, propagating the values of debug
temporaries and determining expressions that can be used to compute the
value of each user variable at as many points (ranges, actually) in the
program as possible.
NOTE_INSN_VAR_LOCATION, the value expression in an
INSN_VAR_LOCATION denotes a value at that specific point in the
program, rather than an expression that can be evaluated at any later
point before an overriding
VAR_LOCATION is encountered. E.g.,
if a user variable is bound to a
REG and then a subsequent insn
REG, the note location would keep mapping the user
variable to the register across the insn, whereas the insn location
would keep the variable bound to the value, so that the variable
tracking pass would emit another location note for the variable at the
point in which the register is modified.
The machine mode of an insn is normally
VOIDmode, but some
phases use the mode for various purposes.
The common subexpression elimination pass sets the mode of an insn to
QImode when it is the first insn in a block that has already
The second Haifa scheduling pass, for targets that can multiple issue,
sets the mode of an insn to
TImode when it is believed that the
instruction begins an issue group. That is, when the instruction
cannot issue simultaneously with the previous. This may be relied on
by later passes, in particular machine-dependent reorg.
Here is a table of the extra fields of
An expression for the side effect performed by this insn. This must
be one of the following codes:
sequence. If it is a
parallel, each element of the
parallel must be one these
codes, except that
parallel expressions cannot be nested and
addr_diff_vec are not permitted inside a
An integer that says which pattern in the machine description matches this insn, or -1 if the matching has not yet been attempted.
Such matching is never attempted and this field remains -1 on an insn
whose pattern consists of a single
Matching is also never attempted on insns that result from an
statement. These contain at least one
asm_noperands returns a non-negative value for
In the debugging output, this field is printed as a number followed by a symbolic representation that locates the pattern in the md file as some small positive or negative offset from a named pattern.
A list (chain of
insn_list expressions) giving information about
dependencies between instructions within a basic block. Neither a jump
nor a label may come between the related insns. These are only used by
the schedulers and by combine. This is a deprecated data structure.
Def-use and use-def chains are now preferred.
A list (chain of
expressions) giving miscellaneous information about the insn. It is often
information pertaining to the registers used in this insn.
LOG_LINKS field of an insn is a chain of
expressions. Each of these has two operands: the first is an insn,
and the second is another
insn_list expression (the next one in
the chain). The last
insn_list in the chain has a null pointer
as second operand. The significant thing about the chain is which
insns appear in it (as first operands of
expressions). Their order is not significant.
This list is originally set up by the flow analysis pass; it is a null pointer until then. Flow only adds links for those data dependencies which can be used for instruction combination. For each insn, the flow analysis pass adds a link to insns which store into registers values that are used for the first time in this insn.
REG_NOTES field of an insn is a chain similar to the
LOG_LINKS field but it includes
expressions in addition to
insn_list expressions. There are several
kinds of register notes, which are distinguished by the machine mode, which
in a register note is really understood as being an
The first operand op of the note is data whose meaning depends on
the kind of note.
REG_NOTE_KIND (x) returns the kind of
register note. Its counterpart, the macro
(x, newkind) sets the register note type of x to be
Register notes are of three classes: They may say something about an
input to an insn, they may say something about an output of an insn, or
they may create a linkage between two insns. There are also a set
of values that are only used in
These register notes annotate inputs to an insn:
The value in op dies in this insn; that is to say, altering the value immediately after this insn would not affect the future behavior of the program.
It does not follow that the register op has no useful value after this insn since op is not necessarily modified by this insn. Rather, no subsequent instruction uses the contents of op.
The register op being set by this insn will not be used in a
subsequent insn. This differs from a
REG_DEAD note, which
indicates that the value in an input will not be used subsequently.
These two notes are independent; both may be present for the same
The register op is incremented (or decremented; at this level
there is no distinction) by an embedded side effect inside this insn.
This means it appears in a
The register op is known to have a nonnegative value when this insn is reached. This is used so that decrement and branch until zero instructions, such as the m68k dbra, can be matched.
REG_NONNEG note is added to insns only if the machine
description has a ‘decrement_and_branch_until_zero’ pattern.
This insn uses op, a
code_label or a
note of type
NOTE_INSN_DELETED_LABEL, but is not a
jump_insn, or it
jump_insn that refers to the operand as an ordinary
operand. The label may still eventually be a jump target, but if so
in an indirect jump in a subsequent insn. The presence of this note
allows jump optimization to be aware that op is, in fact, being
used, and flow optimization to build an accurate flow graph.
This insn is a
jump_insn but not an
addr_diff_vec. It uses op, a
code_label as a
direct or indirect jump target. Its purpose is similar to that of
REG_LABEL_OPERAND. This note is only present if the insn has
multiple targets; the last label in the insn (in the highest numbered
insn-field) goes into the
JUMP_LABEL field and does not have a
REG_LABEL_TARGET note. See JUMP_LABEL.
Appears attached to each
setjmp or a
The following notes describe attributes of outputs of an insn:
This note is only valid on an insn that sets only one register and
indicates that that register will be equal to op at run time; the
scope of this equivalence differs between the two types of notes. The
value which the insn explicitly copies into the register may look
different from op, but they will be equal at run time. If the
output of the single
set is a
zero_extract expression, the note refers to the register that
is contained in its first operand.
REG_EQUIV, the register is equivalent to op throughout
the entire function, and could validly be replaced in all its
occurrences by op. (“Validly” here refers to the data flow of
the program; simple replacement may make some insns invalid.) For
example, when a constant is loaded into a register that is never
assigned any other value, this kind of note is used.
When a parameter is copied into a pseudo-register at entry to a function, a note of this kind records that the register is equivalent to the stack slot where the parameter was passed. Although in this case the register may be set by other insns, it is still valid to replace the register by the stack slot throughout the function.
REG_EQUIV note is also used on an instruction which copies a
register parameter into a pseudo-register at entry to a function, if
there is a stack slot where that parameter could be stored. Although
other insns may set the pseudo-register, it is valid for the compiler to
replace the pseudo-register by stack slot throughout the function,
provided the compiler ensures that the stack slot is properly
initialized by making the replacement in the initial copy instruction as
well. This is used on machines for which the calling convention
allocates stack space for register parameters. See
REG_PARM_STACK_SPACE in Stack Arguments.
In the case of
REG_EQUAL, the register that is set by this insn
will be equal to op at run time at the end of this insn but not
necessarily elsewhere in the function. In this case, op
is typically an arithmetic expression. For example, when a sequence of
insns such as a library call is used to perform an arithmetic operation,
this kind of note is attached to the insn that produces or copies the
These two notes are used in different ways by the compiler passes.
REG_EQUAL is used by passes prior to register allocation (such as
common subexpression elimination and loop optimization) to tell them how
to think of that value.
REG_EQUIV notes are used by register
allocation to indicate that there is an available substitute expression
(either a constant or a
mem expression for the location of a
parameter on the stack) that may be used in place of a register if
insufficient registers are available.
Except for stack homes for parameters, which are indicated by a
REG_EQUIV note and are not useful to the early optimization
passes and pseudo registers that are equivalent to a memory location
throughout their entire life, which is not detected until later in
the compilation, all equivalences are initially indicated by an attached
REG_EQUAL note. In the early stages of register allocation, a
REG_EQUAL note is changed into a
REG_EQUIV note if
op is a constant and the insn represents the only set of its
Thus, compiler passes prior to register allocation need only check for
REG_EQUAL notes and passes subsequent to register allocation
need only check for
These notes describe linkages between insns. They occur in pairs: one insn has one of a pair of notes that points to a second insn, which has the inverse note pointing back to the first insn.
On machines that use
cc0, the insns which set and use
set and use
cc0 are adjacent. However, when branch delay slot
filling is done, this may no longer be true. In this case a
REG_CC_USER note will be placed on the insn setting
point to the insn using
cc0 and a
REG_CC_SETTER note will
be placed on the insn using
cc0 to point to the insn setting
These values are only used in the
LOG_LINKS field, and indicate
the type of dependency that each link represents. Links which indicate
a data dependence (a read after write dependence) do not use any code,
they simply have mode
VOIDmode, and are printed without any
This indicates a true dependence (a read after write dependence).
This indicates an output dependence (a write after write dependence).
This indicates an anti dependence (a write after read dependence).
These notes describe information gathered from gcov profile data. They
are stored in the
REG_NOTES field of an insn.
This is used to specify the ratio of branches to non-branches of a
branch insn according to the profile data. The note is represented
int_list expression whose integer value is an encoding
to extract and store the probability into the RTL encoding.
These notes are found in JUMP insns after delayed branch scheduling has taken place. They indicate both the direction and the likelihood of the JUMP. The format is a bitmask of ATTR_FLAG_* values.
This is used on an RTX_FRAME_RELATED_P insn wherein the attached expression is used in place of the actual insn pattern. This is done in cases where the pattern is either complex or misleading.
REG_CALL_NOCF_CHECK is used in conjunction with the
-fcf-protection=branch option. The note is set if a
nocf_check attribute is specified for a function type or a
pointer to function type. The note is stored in the
field of an insn.
Users have control through the
nocf_check attribute to identify
which calls to a function should be skipped from control-flow instrumentation
when the option -fcf-protection=branch is specified. The compiler
REG_CALL_NOCF_CHECK note on each
that has a function type marked with a
For convenience, the machine mode in an
expr_list is printed using these symbolic codes in debugging dumps.
The only difference between the expression codes
expr_list is that the first operand of an
assumed to be an insn and is printed in debugging dumps as the insn’s
unique id; the first operand of an
expr_list is printed in the
ordinary way as an expression.