Re: [PATCH] Fix call-clobbering (PRs 36373 and 36387)

["Daniel Berlin" <dberlin at dberlin dot org>]

On Fri, May 30, 2008 at 6:12 PM, Richard Guenther <rguenther@suse.de> wrote:
>
> Second, we miss to compute the reachability set of the
> escaped pointers and only clobber the directly pointed-to
> memory.

This is because points-to is not computing the reachability of the
anything variable properly.
Trying to work around this by doing 3 other transitive closures is not
going to buy you anything.
We should just fix points-to, which will fix all of these problems.

> A followup patch needs to deal with the wrong final points-to sets
> (see comment #2 of PR36387) by fixing them by using the
> call-clobber solution.  A followup also may need to deal with the
> memory tag clobbering code - but I have to think about how to
> correctly deal with that.
>

You are really going about this wrong.  Trying to post-fix up results
that are wrong through computing the properties it should have been
computing in the first place is not the way to go here.
You will end up writing a lot of code to try to fix up the broken results.

As you point out in comment #2, p should point to j, or at the very
least, ANYTHING.

There are two ways to do this, the really easy way (which i'm not
positive will work but should), the easy way (which may use a bit of
memory), or the hard way (which is harder to get right but lower
memory usage).

The really easy way is to add *q = q at the escape site for q.

IE the following constraints:
ANYTHING = &ANYTHING
READONLY = &ANYTHING
INTEGER = &ANYTHING
p = &i
q = &p
q = &ANYTHING
*q = q
p.0_2 = p

This will end up causing p to point to anything, as it should after the call.


The easy way is to
1. Let edges be added to anything (IE remove the special casing from the solver)
2. Add *ANYTHING = &ANYTHING to the constraint list (*ANYTHING = tmp,
tmp = &ANYTHING)
3. At each escape site, add the escaped variables to ANYTHING.
4. Add the ANYTHING set to each variable pointing to ANYTHING at the end.

This should generate the following constraints for your testcase:

ANYTHING = &ANYTHING
*ANYTHING = tmp
tmp = &ANYTHING
READONLY = &ANYTHING
INTEGER = &ANYTHING
p = &i
q = &p
ANYTHING = &q
q = &ANYTHING
p.0_2 = p

This will come up with

ANYTHING = {ANYTHING, q, p, i}
q = {q, p, i, ANYTHING}
p = { i, ANYTHING }


The harder way is to separate ANYTHING and ESCAPED so you don't have
to propagate the ANYTHING set around until the very end.

IE Like the easy way, except you have:
ANYTHING = &ANYTHING
*ANYTHING = tmp
tmp = &ANYTHING
READONLY = &ANYTHING
INTEGER = &ANYTHING
ESCAPED = *ESCAPED
p = &i
q = &p
ESCAPED = &q
q = &ANYTHING
p.0_2 = p

Then add ESCAPED to all things with ANYTHING at the very end
> Anyway, bootstrapped and tested on x86_64-unknown-linux-gnu, ok
> for trunk?

No.
We very much need to solve this problem by making points-to do a
correct transitive closure and correctly give the result of "p points
to anything" for your testcase.
Trying to work around points-to not transitive closing the set of
ANYTHING variables is a hack.