`base_function["Name"]` crashes with `KeyError` when the model has
a function without an explicit `Name` (e.g. the binary entry stub).
Skip those entries silently; only named functions can be matched
by name anyway.
Move all per-function state and logic into a new SegregateFunctionStack
worker, so the pass class itself only holds module-wide state and the
runOnFunction body is just upgrade() + segregate(). The discovery loop
now uses the MFP ExtraState surface to capture the analysis value
before each interesting program point, replacing the splitBasicBlock
trick that introduced fake nodes only to read the lattice value at
them.
Other changes that ride along:
- StackOffsetCache memoizes getStackOffset per function.
- findAllWriters does a single sorted sweep instead of a quadratic
scan over Ranges.
- The pipeline gains a stack-accesses-segregated artifact entry.
- Test fixtures (filecheck.ll, override.yml, segregate-stack-accesses
configuration) are updated to match the new IR shape.
Three closely-coupled changes that have to land together to keep
every caller compiling:
- Introduce a per-instance ExtraState recording surface (with a
NoExtraState default) and thread it through applyTransferFunction.
- Replace getMaximalFixedPoint's positional arg list with a single
MFPConfiguration struct, so callers spell out only the fields they
need.
- Replace the EntryLabels pointer with an Entry/All/vector* variant
so callers can ask for the graph entry, every node, or a custom
list without juggling extra arguments.
Update every existing caller for the new signatures and switch
Liveness::GraphType to a plain Function* (with the inverse
GraphTraits selected at call sites).
Replace the hoist-struct-phis pass with a split-struct-phis pass that
breaks struct PHI nodes into per-field PHIs instead of moving them
out, and update both pipelines to use the new name.
Split createReturn into a reusable createCall that emits the
struct-initializer call without wrapping it in a return. An EmitBody
flag lets callers create the declaration but skip the body, useful
when the body would later be stripped.
The YAML traits for Layout (and friends) move into Layout.h so callers
can serialize a Layout directly without pulling in Layout.cpp's
internals. As a result StackSpan gains default-initialized fields and
its operator+ is hoisted to a free function (with the symmetric
uint64+StackSpan overload) so it works with the YAML mapping.
Drop the SPTAR-specific special case in layoutToLLVMFunctionType: all
ModelAggregate-returning functions now use the same array-of-i8 return
type. Clifter is updated accordingly to treat any aggregate return the
same way, removing the SPTAR-specific branches that were just dead
code after the type unification.
Return a pointer to a buffer of the requested size and let the macro
dereference it as the target type, instead of casting a uintmax_t. This
makes the macro usable for types wider than uintmax_t.
For comparison operators (==, !=, <, >, <=, >=) the elision is only
sound when both operands are of integral type; otherwise we'd be
changing the kind of comparison being performed.
These tests could pass even when the analysis crashed. The harness
joins the test command into a single shell line, and the diagnostic
block of the error-comparison branch was missing its statement
terminators: it collapsed into a single echo that swallowed `exit 1`,
so the comparison could never fail the test. Moreover, the exit code
of revng2 was only consumed as a boolean, mistaking crashes for
graceful failures, and tests without an expected-error.txt compared
the empty string against the empty RuntimeError payload extracted
from a crash trace, silently passing.
Now the diagnostics are properly terminated, the content of the error
file is printed on mismatch, and the expected-error path requires
exit code 1, an existing expected-error.txt and a non-empty
RuntimeError payload; any other failing outcome dumps stderr and
makes the test fail.
Replace the stable_sort that ordered (block, value) entries by raw
BasicBlock* address in getIncomingUsesOfValuesFromBlocks with a
MapVector that groups entries by block in first-encountered
insertion order, and add a per-block stable_sort by use count
(descending). Same-block contiguity is now structural rather than
enforced by a sort, and the order in which the split basic blocks
are created and appended to the function no longer depends on
pointer values that vary across runs. The within-block ordering,
the use-count tie-breaking, and the rest of the edge-splitting
algorithm are preserved.
After we drop legacy mode, the only user of LocalVariableBuilder will be
SegregateStackAccesses. This is possible thanks to the fact that
dropping the legacy mode will demistify local variables and turn them
into plain allocas accessed via loads/stores. This will end the need for
a centralized place to deal with local variable creation, that is caused
by the various ad-hoc manipulations we've been doing for a long time in
legacy mode.
This commit fixes a situation where CollapseSingleChild could introduce
infinite loops composed entirely of pointer edges, which would end up in
making the DLA backend go out-of-memory.
This happened when collapsing a Child at offset 0 into a Parent node,
when Child had a pointer edge going to Parent.
The pointer edge needed not to be at step one, but it could possibly be
a pointer-to-pointer to Parent, at any depth.
After merging Child into Parent this would lead to a node pointing to
itself, which is a forbidden pointer loop in the graph.
This commit catches the pattern and prevents it to merge Child into
Parent.
The --import-debug-info CLI flag and the ImporterOptions::
AdditionalDebugInfoPaths field it populated were a side-channel that
loaded extra DWARF files outside the normal ELF dependency-resolution
path. It bypassed the symbol-aware machinery and is no longer needed.
Add `PostInlineHelpersVerifyPass`, a `ModulePass` derived class that
aborts on any `getelementptr` instruction found in any Isolated
function. `inline-helpers` is the only pass in the post-isolate chain
that could import a GEP into an Isolated function by inlining a helper
body that contains one, so the verifier is invoked at the end of
`InlineHelpersPass::runOnModule`. In this way, we early catch this
invariant on the IR.
When PromoteCSVs synthesizes a CSV-promoted wrapper for a helper,
compute the `!revng.inline.policy` metadata so `InlineHelpers` sees the
static policy at the wrapper's call site.
Introduce a pass which statically demotes some helpers from candidates
for inlining:
1) Helpers which are part of SCC on the callgraph.
2) Helpers which contains an `insertvalue`.
3) Helpers which _fail_ the `CriticalArguments` criterion.
A critical argument is defined starting from the critical operand
definition.
A critical operand is either the condition of a `switch` instruction or
the indices of a `getelementptr` instruction.
If the dataflow computing the the operand trace back to a formal
parameter of the function, that parameter will be considered critical
when attempting the inlining of the helper.
In case each condition is satisfied, the `revng.inline.policy` metadata
is attached to the function, so that it can be used at _inline_ time to
take the decision based on the critical arguments constantness.
The metadata is encoded as an `iN` integer with N = `arg_size() + 1`:
the extra most-significant bit is always zero so LLVM's signed-decimal
`iN` printer renders the value positively (avoiding e.g. `!{i2 -2}`).
The (de)serialisation primitives live in `revng/Support/IRHelpers.h`
as `serializeInliningPolicy` / `deserializeInliningPolicy` so the
runtime `revngFunctionIsolation` doesn't need to link the build-time
`revngHelperInliningAnalyses` to read the metadata back.
Introduce a build-time pass that tags every QEMU helper transitively
reaching a function defined under one of the configured runtime-library
directories (currently `fpu/` only) as `revng_inline`. The intent is to
make the lift pipeline surface "leaf-level" runtime-library calls (e.g.
softfloat ops) directly in the lifted IR by inlining away every wrapper
helper that sits between QEMU's `helper_*` boundary and the leaf.
We also gate the tagging by a per-function body-size budget.
The pass is run in the pipeline building the `libtcg-helpers-full-*.bc`
artifacts.
Ivan Krysak