Before this commit, DLA's frontend was representing information about
string literals in a way that had a bad outcome: very often, all (or
most) places in the binary that were using string literals ended up
collapsed on the DLA graph on the same node, causing all their types to
be a weird struct.
This was wrong, and it was the result of an aggressive creation of
equality edges.
This commit avoids to emit equality edges, and replaces them with
instance edges, that represent the fact that a call to StringLiteral
actually returns a type that represents a pointer to char.
The inter-procedural part of the DLA frontend connects actual arguments
of function calls with formal arguments of the callee functions, with
instance links at offset 0.
This represents the information that the type pointed-to by the actual
argument has an instance of the type pointed-to by the formal argument
at offset 0.
Before this commit, this was done even when the actual argument was an
integer constant leading to various problems:
1. Most of the times, small integer constants passed as actual
cannot represent valid pointers, leading to graphs bigger than
necessary.
2. Even when an integer constant might actually represent a pointer into
valid memory, if it does it should fall into some segment.
If it does, by the time DLA runs, those integer constants should have
already converted into calls to the special SegmentRef opcode, which
is already handled properly.
3. Finally, those constants end up being very connected in the DLA
graph, creating connections between other nodes that are otherwise
unrelated or very far from each other. This pollutes the graph and
rapidly degrades the quality of the results.
This commit properly guards the code so that the instance-at-offset-0
link between actual and formal arguments is never injected if the actual
argument is an integer constant.
Before this commit the DLA frontend was not ready to handle all the
possible combinations of integer- and pointer-typed arithmetic that was
used to compute SCEVs.
This could cause crashes when dealing with pointer-typed SCEVs.
This commit fixes the issues by converting all pointer-typed expressions
to integers, and resizing integers to the same size before adding them.
Now extractvalue instruction are replaced by dedicated
OpaqueExtractValue custom opcode, that prevents LLVM from doing strange
things with extractvalues during optimizations (such as e.g. sinking).
This is important since extractvalue instructions and struct-typed
values in general in our LLVM IR are not real first-class citizens, but
only a byproduct of the binary lifting process, and they actually
represent bundles of registers that are returned from isolated
functions.
For segmentRef type of the segment and type returned by segmentRef
function are the same.
For cstringLiteral every call returns pointer to 1-byte type. Pointer is
offsetted by value of strlen+1. strlen is fetched from metadata.
Additionally, all uses of cstringLiteral function has same type as the
type of cstringLiteral (pointer to 1-byte).
Before this commit we were not adding nodes to DLATypeSystem for calls
with 0 uses.
This commit fixes the problem, and only avoids adding nodes for calls
that return void.
Before this commit, the creation of intra-procedural types and edges
was too liberal, possibly leading to creation of pointer edges starting
from nodes that were not pointer-sized.
This commit fixes the issue, never creating outgoing pointer edges from
non-pointer-sized nodes.
Alessandro Di Federico