Add SimplifyTypeTests pass. #141327

pcc · 2025-05-24T03:15:13Z

This pass figures out whether inlining has exposed a constant address to
a lowered type test, and remove the test if so and the address is known
to pass the test. Unfortunately this pass ends up needing to reverse
engineer what LowerTypeTests did; this is currently inherent to the design
of ThinLTO importing where LowerTypeTests needs to run at the start.

Created using spr 1.3.6-beta.1 [skip ci]

Created using spr 1.3.6-beta.1

llvmbot · 2025-05-24T03:15:50Z

@llvm/pr-subscribers-llvm-transforms

Author: Peter Collingbourne (pcc)

Changes

This pass figures out whether inlining has exposed a constant address to
a lowered type test, and remove the test if so and the address is known
to pass the test. Unfortunately this pass ends up needing to reverse
engineer what LowerTypeTests did; this is currently inherent to the design
of ThinLTO importing where LowerTypeTests needs to run at the start.

TODO: Add tests.

Full diff: https://github.com/llvm/llvm-project/pull/141327.diff

4 Files Affected:

(modified) llvm/include/llvm/Transforms/IPO/LowerTypeTests.h (+5)
(modified) llvm/lib/Passes/PassBuilderPipelines.cpp (+2)
(modified) llvm/lib/Passes/PassRegistry.def (+1)
(modified) llvm/lib/Transforms/IPO/LowerTypeTests.cpp (+61)

diff --git a/llvm/include/llvm/Transforms/IPO/LowerTypeTests.h b/llvm/include/llvm/Transforms/IPO/LowerTypeTests.h
index 02adcd8bfd45d..40f2d2c4fadf7 100644
--- a/llvm/include/llvm/Transforms/IPO/LowerTypeTests.h
+++ b/llvm/include/llvm/Transforms/IPO/LowerTypeTests.h
@@ -223,6 +223,11 @@ class LowerTypeTestsPass : public PassInfoMixin<LowerTypeTestsPass> {
   PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM);
 };
 
+class SimplifyTypeTestsPass : public PassInfoMixin<SimplifyTypeTestsPass> {
+public:
+  PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM);
+};
+
 } // end namespace llvm
 
 #endif // LLVM_TRANSFORMS_IPO_LOWERTYPETESTS_H
diff --git a/llvm/lib/Passes/PassBuilderPipelines.cpp b/llvm/lib/Passes/PassBuilderPipelines.cpp
index f3654600c5abb..e3adceed7d70a 100644
--- a/llvm/lib/Passes/PassBuilderPipelines.cpp
+++ b/llvm/lib/Passes/PassBuilderPipelines.cpp
@@ -1464,6 +1464,8 @@ PassBuilder::buildModuleOptimizationPipeline(OptimizationLevel Level,
   if (!LTOPreLink)
     MPM.addPass(EliminateAvailableExternallyPass());
 
+  MPM.addPass(SimplifyTypeTestsPass());
+
   // Do RPO function attribute inference across the module to forward-propagate
   // attributes where applicable.
   // FIXME: Is this really an optimization rather than a canonicalization?
diff --git a/llvm/lib/Passes/PassRegistry.def b/llvm/lib/Passes/PassRegistry.def
index 94dabe290213d..35ad73738d71d 100644
--- a/llvm/lib/Passes/PassRegistry.def
+++ b/llvm/lib/Passes/PassRegistry.def
@@ -100,6 +100,7 @@ MODULE_PASS("jmc-instrumenter", JMCInstrumenterPass())
 MODULE_PASS("lower-emutls", LowerEmuTLSPass())
 MODULE_PASS("lower-global-dtors", LowerGlobalDtorsPass())
 MODULE_PASS("lower-ifunc", LowerIFuncPass())
+MODULE_PASS("simplify-type-tests", SimplifyTypeTestsPass())
 MODULE_PASS("lowertypetests", LowerTypeTestsPass())
 MODULE_PASS("fatlto-cleanup", FatLtoCleanup())
 MODULE_PASS("pgo-force-function-attrs", PGOForceFunctionAttrsPass(PGOOpt ? PGOOpt->ColdOptType : PGOOptions::ColdFuncOpt::Default))
diff --git a/llvm/lib/Transforms/IPO/LowerTypeTests.cpp b/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
index 428c4641a7f56..344ac9f5a8f95 100644
--- a/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
+++ b/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
@@ -2456,3 +2456,64 @@ PreservedAnalyses LowerTypeTestsPass::run(Module &M,
     return PreservedAnalyses::all();
   return PreservedAnalyses::none();
 }
+
+PreservedAnalyses SimplifyTypeTestsPass::run(Module &M,
+                                             ModuleAnalysisManager &AM) {
+  bool Changed = false;
+  // Figure out whether inlining has exposed a constant address to a lowered
+  // type test, and remove the test if so and the address is known to pass the
+  // test. Unfortunately this pass ends up needing to reverse engineer what
+  // LowerTypeTests did; this is currently inherent to the design of ThinLTO
+  // importing where LowerTypeTests needs to run at the start.
+  for (auto &GV : M.globals()) {
+    if (!GV.getName().starts_with("__typeid_") ||
+        !GV.getName().ends_with("_global_addr"))
+      continue;
+    auto *MD = MDString::get(M.getContext(),
+                             GV.getName().substr(9, GV.getName().size() - 21));
+    auto MaySimplify = [&](Value *Op) {
+      auto *PtrAsInt = dyn_cast<ConstantExpr>(Op);
+      if (!PtrAsInt || PtrAsInt->getOpcode() != Instruction::PtrToInt)
+        return false;
+      auto *Ptr = PtrAsInt->getOperand(0);
+      if (auto *GV = dyn_cast<GlobalValue>(Ptr))
+        if (auto *CFIGV = M.getNamedValue((GV->getName() + ".cfi").str()))
+          Ptr = CFIGV;
+      return isKnownTypeIdMember(MD, M.getDataLayout(), Ptr, 0);
+    };
+    for (User *U : GV.users()) {
+      auto *CE = dyn_cast<ConstantExpr>(U);
+      if (!CE || CE->getOpcode() != Instruction::PtrToInt)
+        continue;
+      for (Use &U : make_early_inc_range(CE->uses())) {
+        auto *CE = dyn_cast<ConstantExpr>(U.getUser());
+        if (U.getOperandNo() == 1 && CE &&
+            CE->getOpcode() == Instruction::Sub &&
+            MaySimplify(CE->getOperand(0))) {
+          // This is a computation of PtrOffset as generated by
+          // LowerTypeTestsModule::lowerTypeTestCall above. If
+          // isKnownTypeIdMember passes we just pretend it evaluated to 0. This
+          // should cause later passes to remove the range and alignment checks.
+          // The bitset checks won't be removed but those are uncommon.
+          CE->replaceAllUsesWith(ConstantInt::get(CE->getType(), 0));
+          Changed = true;
+        }
+        auto *CI = dyn_cast<ICmpInst>(U.getUser());
+        if (U.getOperandNo() == 1 && CI &&
+            CI->getPredicate() == CmpInst::ICMP_EQ &&
+            MaySimplify(CI->getOperand(0))) {
+          // This is an equality comparison (TypeTestResolution::Single case in
+          // lowerTypeTestCall). In this case we just replace the comparison
+          // with true.
+          CI->replaceAllUsesWith(ConstantInt::getTrue(M.getContext()));
+          CI->eraseFromParent();
+          Changed = true;
+        }
+      }
+    }
+  }
+
+  if (!Changed)
+    return PreservedAnalyses::all();
+  return PreservedAnalyses::none();
+}

Created using spr 1.3.6-beta.1 [skip ci]

Created using spr 1.3.6-beta.1

github-actions · 2025-05-28T06:02:42Z

⚠️ C/C++ code formatter, clang-format found issues in your code. ⚠️

You can test this locally with the following command:

git-clang-format --diff HEAD~1 HEAD --extensions h,cpp -- llvm/include/llvm/Transforms/IPO/LowerTypeTests.h llvm/lib/Passes/PassBuilderPipelines.cpp llvm/lib/Transforms/IPO/LowerTypeTests.cpp

View the diff from clang-format here.

diff --git a/llvm/lib/Transforms/IPO/LowerTypeTests.cpp b/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
index 988e5d86e..d1695a88a 100644
--- a/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
+++ b/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
@@ -2487,7 +2487,8 @@ PreservedAnalyses SimplifyTypeTestsPass::run(Module &M,
   //
   // We look for things like:
   //
-  // sub (i64 ptrtoint (ptr @_Z2fpv to i64), i64 ptrtoint (ptr @__typeid__ZTSFvvE_global_addr to i64))
+  // sub (i64 ptrtoint (ptr @_Z2fpv to i64), i64 ptrtoint (ptr
+  // @__typeid__ZTSFvvE_global_addr to i64))
   //
   // which gets replaced with 0 if _Z2fpv (more specifically _Z2fpv.cfi, the
   // function referred to by the jump table) is a member of the type _ZTSFvv, as

Created using spr 1.3.6-beta.1

teresajohnson · 2025-05-28T14:27:37Z

llvm/lib/Transforms/IPO/LowerTypeTests.cpp

+    if (!GV.getName().starts_with("__typeid_") ||
+        !GV.getName().ends_with("_global_addr"))
+      continue;
+    auto *MD = MDString::get(M.getContext(),


Can you add a comment on this conversion? Figured it out by adding up the chars myself but it would be good to make it explicit.

I would just use strlen("__typeid_") and strlen("_global_addr")

I added an example, I think that should make it clear enough.

teresajohnson · 2025-05-28T14:28:27Z

llvm/lib/Transforms/IPO/LowerTypeTests.cpp

+      if (auto *GV = dyn_cast<GlobalValue>(Ptr))
+        if (auto *CFIGV = M.getNamedValue((GV->getName() + ".cfi").str()))
+          Ptr = CFIGV;
+      return isKnownTypeIdMember(MD, M.getDataLayout(), Ptr, 0);


Are there cases where the GV will not have a ".cfi" extension? I notice the test has that extension.

Yes, if it's a function defined outside the LTO unit the jump table entry will be named foo.cfi_jt and the external function will be named foo. Since functions inside the LTO unit are the more common case I only handled them here.

teresajohnson · 2025-05-28T14:32:47Z

llvm/test/Transforms/SimplifyTypeTests/basic.ll

@@ -0,0 +1,40 @@
+; RUN: opt -S %s -passes=simplify-type-tests | FileCheck %s


Add a comment about what this is testing

teresajohnson · 2025-05-28T14:33:22Z

llvm/lib/Transforms/IPO/LowerTypeTests.cpp

+  // Figure out whether inlining has exposed a constant address to a lowered
+  // type test, and remove the test if so and the address is known to pass the
+  // test. Unfortunately this pass ends up needing to reverse engineer what
+  // LowerTypeTests did; this is currently inherent to the design of ThinLTO


Can you add a more extensive comment with what this is looking for and why? I don't look at lower type test output often so I don't recall offhand what e.g. it would have looked like without inlining vs with.

fmayer · 2025-05-28T17:10:02Z

llvm/lib/Transforms/IPO/LowerTypeTests.cpp

+    if (!GV.getName().starts_with("__typeid_") ||
+        !GV.getName().ends_with("_global_addr"))
+      continue;
+    auto *MD = MDString::get(M.getContext(),


I would just use strlen("__typeid_") and strlen("_global_addr")

fmayer · 2025-05-28T17:16:02Z

llvm/lib/Transforms/IPO/LowerTypeTests.cpp

+
+  if (!Changed)
+    return PreservedAnalyses::all();
+  return PreservedAnalyses::none();


Is that true? E.g. the CFG doesn't change, right? Could we do what we do in HWASan: https://github.com/llvm/llvm-project/blob/main/llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp#L485?

Okay, I updated this to preserve the CFG related analyses.

Created using spr 1.3.6-beta.1 [skip ci]

Created using spr 1.3.6-beta.1

teresajohnson

lgtm but I think there is a code formatting error reported that should be fixed before merging.

Created using spr 1.3.6-beta.1 [skip ci]

Created using spr 1.3.6-beta.1

This pass figures out whether inlining has exposed a constant address to a lowered type test, and remove the test if so and the address is known to pass the test. Unfortunately this pass ends up needing to reverse engineer what LowerTypeTests did; this is currently inherent to the design of ThinLTO importing where LowerTypeTests needs to run at the start. Reviewers: teresajohnson Reviewed By: teresajohnson Pull Request: llvm/llvm-project#141327

pcc added 2 commits May 23, 2025 20:15

[𝘀𝗽𝗿] changes to main this commit is based on

ab837f0

Created using spr 1.3.6-beta.1 [skip ci]

[𝘀𝗽𝗿] initial version

d7bb3c4

Created using spr 1.3.6-beta.1

llvmbot added the llvm:transforms label May 24, 2025

pcc added 2 commits May 27, 2025 23:00

[𝘀𝗽𝗿] changes introduced through rebase

1344339

Created using spr 1.3.6-beta.1 [skip ci]

Add test, add missing case

16d5799

Created using spr 1.3.6-beta.1

pcc requested review from fmayer and teresajohnson May 28, 2025 06:00

Format

b36c74c

Created using spr 1.3.6-beta.1

teresajohnson reviewed May 28, 2025

View reviewed changes

fmayer reviewed May 28, 2025

View reviewed changes

jrtc27 and others added 2 commits June 4, 2025 15:02

[𝘀𝗽𝗿] changes introduced through rebase

b76d0d4

Created using spr 1.3.6-beta.1 [skip ci]

Address comments

abfa556

Created using spr 1.3.6-beta.1

teresajohnson approved these changes Jun 5, 2025

View reviewed changes

pcc added 2 commits June 5, 2025 11:08

[𝘀𝗽𝗿] changes introduced through rebase

d140ba4

Created using spr 1.3.6-beta.1 [skip ci]

Format

7c0b3ea

Created using spr 1.3.6-beta.1

pcc changed the base branch from users/pcc/spr/main.add-simplifytypetests-pass to main June 5, 2025 18:09

pcc merged commit 3fa231f into main Jun 5, 2025
7 of 13 checks passed

pcc deleted the users/pcc/spr/add-simplifytypetests-pass branch June 5, 2025 18:09

		@@ -0,0 +1,40 @@
		; RUN: opt -S %s -passes=simplify-type-tests \| FileCheck %s

Add SimplifyTypeTests pass. #141327

Add SimplifyTypeTests pass. #141327

Uh oh!

Conversation

pcc commented May 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

llvmbot commented May 24, 2025

Uh oh!

github-actions bot commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

teresajohnson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pcc commented May 24, 2025 •

edited

Loading

github-actions bot commented May 28, 2025 •

edited

Loading