Question about points-to analysis, global variables, IPA, and field sensitivity

Question about points-to analysis, global variables, IPA, and field sensitivity

[Erick Ochoa]

Hi,

I am looking at the points-to analysis in GCC and I found the
following comment in tree-ssa-structalias.c:

  /* Collect field information.  */
  if (use_field_sensitive
      && var_can_have_subvars (decl)
      /* ???  Force us to not use subfields for globals in IPA mode.
         Else we'd have to parse arbitrary initializers.  */
      && !(in_ipa_mode
           && is_global_var (decl)))


From what I understand here the points-to analysis is explicitly not
using field sensitivity for global variables when in IPA. I am
wondering,
0) Is "initializers" here talking about brace initializers? Or are
"initializers" a little bit more abstract and refer to anything that
can initialize a field? Like struct->field = function()?
1) How much work would it be to parse initializers?
2) How would global structs which are not initialized using
initializers be handled? Would all fields get assigned NULL at the
global variable level, but then as other fields get assigned we just
create new constraints with the correct offsets?

Thanks!

Re: Question about points-to analysis, global variables, IPA, and field sensitivity

[Richard Biener]

On Tue, Mar 30, 2021 at 10:52 AM Erick Ochoa via Gcc <gcc@gcc.gnu.org> wrote:
>
> Hi,
>
> I am looking at the points-to analysis in GCC and I found the
> following comment in tree-ssa-structalias.c:
>
>   /* Collect field information.  */
>   if (use_field_sensitive
>       && var_can_have_subvars (decl)
>       /* ???  Force us to not use subfields for globals in IPA mode.
>          Else we'd have to parse arbitrary initializers.  */
>       && !(in_ipa_mode
>            && is_global_var (decl)))
>
>
> From what I understand here the points-to analysis is explicitly not
> using field sensitivity for global variables when in IPA. I am
> wondering,
> 0) Is "initializers" here talking about brace initializers? Or are
> "initializers" a little bit more abstract and refer to anything that
> can initialize a field? Like struct->field = function()?

initializers refers to static initializers (DECL_INITIAL) on global variables
which satisfy the property of being assemblyable by varasm but can
have some arbitrary GENERIC structure in their field initializers
(like address calculations).

> 1) How much work would it be to parse initializers?

It should be pretty straight-forward to come up with sth conservative.
To make it optimal is a little harder but maybe not so much.  Straight-forward
would be to generate constraints from DECL_INITIAL in a non-field-sensitive
manner and then assign each subfield of the constraint variable this
non-field sensitive solution.  Basically do

  get_constraint_for_rhs (DECL_INITIAL (decl), &rhsc);
  process_all_all_constraints (&lhsc, &rhsc);

and then go improve get_constraint_for_1 to handle CONSTRUCTOR
(otherwise you'll get ANYTHING as fallback for everything it does not handle).

Then there's the missing initializer bits which get zero which means NULL
init (but when not considering field sensitive processing that's likely
superfluous unless you want precise modeling of NULL)

> 2) How would global structs which are not initialized using
> initializers be handled? Would all fields get assigned NULL at the
> global variable level, but then as other fields get assigned we just
> create new constraints with the correct offsets?

If the global is module local we should initialize it with NULL, yes.  If it is
not module local it should be initialized with NONLOCAL (that's both what
should currently happen correctly - it's needed for non-field-sensitive init
as well).

>
> Thanks!

Re: Question about points-to analysis, global variables, IPA, and field sensitivity

[Erick Ochoa]

> If the global is module local we should initialize it with NULL, yes.  If it is
> not module local it should be initialized with NONLOCAL (that's both what
> should currently happen correctly - it's needed for non-field-sensitive init
> as well).
>

Awesome, thanks Richard! One more question: in the context of LTO,
"module local" means the current partition?

I understand that IPA-PTA is a late SIMPLE_IPA_PASS but my
understanding of the consequences of this is a little fuzzy. I think
that IPA-PTA also runs in multiple partitions (unless a flag like
-flto-partition=none is used), but there might be some issue with
reduced precision. Perhaps this reduced precision comes from NONLOCAL
constraints with symbols that cross partitions? (This is just
speculation on my part, as I mention, my understanding is a little bit
fuzzy.)

Re: Question about points-to analysis, global variables, IPA, and field sensitivity

[Richard Biener]

On Tue, Mar 30, 2021 at 1:39 PM Erick Ochoa <eochoa@gcc.gnu.org> wrote:
>
> > If the global is module local we should initialize it with NULL, yes.  If it is
> > not module local it should be initialized with NONLOCAL (that's both what
> > should currently happen correctly - it's needed for non-field-sensitive init
> > as well).
> >
>
> Awesome, thanks Richard! One more question: in the context of LTO,
> "module local" means the current partition?

Yes.

> I understand that IPA-PTA is a late SIMPLE_IPA_PASS but my
> understanding of the consequences of this is a little fuzzy. I think
> that IPA-PTA also runs in multiple partitions (unless a flag like
> -flto-partition=none is used), but there might be some issue with
> reduced precision. Perhaps this reduced precision comes from NONLOCAL
> constraints with symbols that cross partitions? (This is just
> speculation on my part, as I mention, my understanding is a little bit
> fuzzy.)

Yes.  Also (obviously) from function definitions not visible and thus
functions treated as external calls when they need not (because of LTO)

Richard.