Checking out-of-bounds access on compile time in SIL

suyashsrijan · July 23, 2019, 12:36pm

Thanks! We don't run constant propagation pass at -Onone, so where should this pattern matching code go? or are you suggesting that pattern matching is smart enough to work at -O as well (since we'll be dealing with builtin instructions, etc)?

Michael_Gottesman · July 23, 2019, 2:34pm

We do run constant propagation at -Onone:

github.com

apple/swift/blob/main/lib/SILOptimizer/PassManager/PassPipeline.cpp#L127


      
          P.startPipeline("Mandatory Diagnostic Passes + Enabling Optimization Passes");
          P.addSILGenCleanup();
          P.addDiagnoseInvalidEscapingCaptures();
          P.addDiagnoseStaticExclusivity();
          P.addNestedSemanticFunctionCheck();
          P.addCapturePromotion();
          
          
// Select access kind after capture promotion and before stack promotion.
          // This guarantees that stack-promotable boxes have [static] enforcement.
          P.addAccessEnforcementSelection();
          
          
P.addAllocBoxToStack();
          P.addNoReturnFolding();
          addDefiniteInitialization(P);
          
          
//===---
          // Begin Ownership Optimizations
          //
          
          
P.addMoveOnlyAddressChecker(); // Check noImplicitCopy and move only types for
                                         // addresses.

suyashsrijan · July 23, 2019, 7:15pm

Oh, I was trying to dump the instructions in wrong place actually and I assumed it wasn't working because the pass wasn't running.

Anyway, I was trying your semantics matcher, however in the example you posted above, m_SemanticsExact only takes a single argument (the string), where as you seem to be passing two arguments i.e. m_SemanticsExact("array.allocateUninitializedArray", m_IntegerLiteral(capacity))?

(note: I have substituted m_SemanticsCall with m_SemanticsExact above).

I translated your example to:

IntegerLiteralInst *capacity;
if (!match(I,
  m_ApplyInst(
    m_SemanticsExact("array.init.literal"), 
     m_TupleExtractInst(
        m_SemanticsExact("array.allocateUninitializedArray", 
                         m_IntegerLiteralInst(capacity)), 1)))) {
   
   return ... // fail
}

suyashsrijan · July 23, 2019, 7:43pm

Also, I was looking at the @_semantic arguments for arrays and it seems like we're using array.uninitialized or array.uninitialized_intrinsic (SIL code mentions the latter). I couldn't find the semantics annotation for init(arrayLiteral:) though.

(this is assuming what the matcher uses to find the matches?)

suyashsrijan · July 23, 2019, 9:09pm

Okay, I have got something working. I'll create a PR now and tag you!