GenericSpecializer: drop unused indirect arguments.

If there is no read from an indirect argument, this argument has to be dropped.
At the call site the store to the argument's memory location could have been removed (based on the callee's memory effects).
Therefore, converting such an unused indirect argument to a direct argument, would load an uninitialized value at the call site.
This would lead to verifier errors and in worst case to a miscompile because IRGen can implicitly use dead arguments, e.g. for getting the type of a class reference.

Author: eeckstein

include/swift/SILOptimizer/Utils/Generics.h

@@ -65,7 +65,7 @@ class ReabstractionInfo {
   /// A 1-bit means that the argument is a metatype argument. The argument is
   /// dropped and replaced by a `metatype` instruction in the entry block.
   /// Only used if `dropMetatypeArgs` is true.
-  SmallBitVector droppedMetatypeArgs;
+  SmallBitVector droppedArguments;
 
   /// Set to true if the function has a re-abstracted (= converted from
   /// indirect to direct) resilient argument or return type. This can happen if
@@ -84,10 +84,10 @@ class ReabstractionInfo {
   /// specializer.
   bool ConvertIndirectToDirect = true;
 
-  /// If true, drop metatype arguments.
-  /// See `droppedMetatypeArgs`.
-  bool dropMetatypeArgs = false;
-  
+  /// If true, drop unused arguments.
+  /// See `droppedArguments`.
+  bool dropUnusedArguments = false;
+
   bool hasIndirectErrorResult = false;
 
   /// The first NumResults bits in Conversions refer to formal indirect
@@ -277,15 +277,13 @@ class ReabstractionInfo {
   /// Returns true if there are any conversions from indirect to direct values.
   bool hasConversions() const { return Conversions.any(); }
 
-  /// Returns true if the argument at `ArgIdx` is a dropped metatype argument.
-  /// See `droppedMetatypeArgs`.
-  bool isDroppedMetatypeArg(unsigned ArgIdx) const {
-    return droppedMetatypeArgs.test(ArgIdx);
+  /// Returns true if the argument at `ArgIdx` is a dropped argument.
+  /// See `droppedArguments`.
+  bool isDroppedArgument(unsigned ArgIdx) const {
+    return droppedArguments.test(ArgIdx);
   }
 
-  /// Returns true if there are any dropped metatype arguments.
-  /// See `droppedMetatypeArgs`.
-  const SmallBitVector &getDroppedArgs() const { return droppedMetatypeArgs; }
+  const SmallBitVector &getDroppedArgs() const { return droppedArguments; }
 
   /// Remove the arguments of a partial apply, leaving the arguments for the
   /// partial apply result function.

lib/SILOptimizer/Utils/GenericCloner.cpp

@@ -125,11 +125,19 @@ void GenericCloner::populateCloned() {
             return true;
           }
         }
-      } else if (ReInfo.isDroppedMetatypeArg(ArgIdx)) {
-        // Replace the metatype argument with an `metatype` instruction in the
-        // entry block.
-        auto *mtInst = getBuilder().createMetatype(Loc, mappedType);
-        entryArgs.push_back(mtInst);
+      } else if (ReInfo.isDroppedArgument(ArgIdx)) {
+        if (OrigArg->getType().isAddress()) {
+          // Create an uninitialized alloc_stack for unused indirect arguments.
+          // This will be removed by other optimizations.
+          createAllocStack();
+          entryArgs.push_back(ASI);
+        } else {
+          // Dropped direct (= non-address) arguments are metatype arguments.
+          // Replace the metatype argument with an `metatype` instruction in the
+          // entry block.
+          auto *mtInst = getBuilder().createMetatype(Loc, mappedType);
+          entryArgs.push_back(mtInst);
+        }
         return true;
       } else {
         // Handle arguments for formal parameters.

lib/SILOptimizer/Utils/Generics.cpp

@@ -602,10 +602,10 @@ bool ReabstractionInfo::canBeSpecialized(ApplySite Apply, SILFunction *Callee,
 ReabstractionInfo::ReabstractionInfo(
     ModuleDecl *targetModule, bool isWholeModule, ApplySite Apply,
     SILFunction *Callee, SubstitutionMap ParamSubs, SerializedKind_t Serialized,
-    bool ConvertIndirectToDirect, bool dropMetatypeArgs,
+    bool ConvertIndirectToDirect, bool dropUnusedArguments,
     OptRemark::Emitter *ORE)
     : ConvertIndirectToDirect(ConvertIndirectToDirect),
-      dropMetatypeArgs(dropMetatypeArgs), M(&Callee->getModule()),
+      dropUnusedArguments(dropUnusedArguments), M(&Callee->getModule()),
       TargetModule(targetModule), isWholeModule(isWholeModule),
       Serialized(Serialized) {
   if (!prepareAndCheck(Apply, Callee, ParamSubs, ORE))
@@ -737,7 +737,7 @@ void ReabstractionInfo::createSubstitutedAndSpecializedTypes() {
                      SubstitutedType->getParameters().size();
   Conversions.resize(NumArgs);
   TrivialArgs.resize(NumArgs);
-  droppedMetatypeArgs.resize(NumArgs);
+  droppedArguments.resize(NumArgs);
 
   if (SubstitutedType->getNumDirectFormalResults() == 0) {
     // The original function has no direct result yet. Try to convert the first
@@ -763,9 +763,11 @@ void ReabstractionInfo::createSubstitutedAndSpecializedTypes() {
   }
 
   // Try to convert indirect incoming parameters to direct parameters.
+  unsigned i = 0;
   for (SILParameterInfo PI : SubstitutedType->getParameters()) {
     auto IdxToInsert = IdxForParam;
     ++IdxForParam;
+    unsigned argIdx = i++;
 
     SILFunctionConventions substConv(SubstitutedType, getModule());
     TypeCategory tc = getParamTypeCategory(PI, substConv, getResilienceExpansion());
@@ -776,6 +778,23 @@ void ReabstractionInfo::createSubstitutedAndSpecializedTypes() {
     case ParameterConvention::Indirect_In_CXX:
     case ParameterConvention::Indirect_In:
     case ParameterConvention::Indirect_In_Guaranteed: {
+      if (Callee && Apply && dropUnusedArguments) {
+        // If there is no read from an indirect argument, this argument has to
+        // be dropped. At the call site the store to the argument's memory location
+        // could have been removed (based on the callee's memory effects).
+        // Therefore, converting such an unused indirect argument to a direct
+        // argument, would load an uninitialized value at the call site.
+        // This would lead to verifier errors and in worst case to a miscompile
+        // because IRGen can implicitly use dead arguments, e.g. for getting the
+        // type of a class reference.
+        if (FullApplySite fas = Apply.asFullApplySite()) {
+          Operand &op = fas.getOperandsWithoutIndirectResults()[argIdx];
+          if (!Callee->argumentMayRead(&op, op.get())) {
+            droppedArguments.set(IdxToInsert);
+            break;
+          }
+        }
+      }
       Conversions.set(IdxToInsert);
       if (tc == LoadableAndTrivial)
         TrivialArgs.set(IdxToInsert);
@@ -799,8 +818,8 @@ void ReabstractionInfo::createSubstitutedAndSpecializedTypes() {
     case ParameterConvention::Direct_Unowned:
     case ParameterConvention::Direct_Guaranteed: {
       CanType ty = PI.getInterfaceType();
-      if (dropMetatypeArgs && isa<MetatypeType>(ty) && !ty->hasArchetype())
-        droppedMetatypeArgs.set(IdxToInsert);
+      if (dropUnusedArguments && isa<MetatypeType>(ty) && !ty->hasArchetype())
+        droppedArguments.set(IdxToInsert);
       break;
     }
     }
@@ -887,15 +906,15 @@ ReabstractionInfo::createSubstitutedType(SILFunction *OrigF,
 }
 
 CanSILFunctionType ReabstractionInfo::createThunkType(PartialApplyInst *forPAI) const {
-  if (!droppedMetatypeArgs.any())
+  if (!droppedArguments.any())
     return SubstitutedType;
 
   llvm::SmallVector<SILParameterInfo, 8> newParams;
   auto params = SubstitutedType->getParameters();
   unsigned firstAppliedParamIdx = params.size() - forPAI->getArguments().size();
 
   for (unsigned paramIdx = 0; paramIdx < params.size(); ++paramIdx) {
-    if (paramIdx >= firstAppliedParamIdx && isDroppedMetatypeArg(param2ArgIndex(paramIdx)))
+    if (paramIdx >= firstAppliedParamIdx && isDroppedArgument(param2ArgIndex(paramIdx)))
       continue;
     newParams.push_back(params[paramIdx]);
   }
@@ -968,7 +987,7 @@ createSpecializedType(CanSILFunctionType SubstFTy, SILModule &M) const {
     unsigned paramIdx = idx++;
     PI = PI.getUnsubstituted(M, SubstFTy, context);
 
-    if (isDroppedMetatypeArg(param2ArgIndex(paramIdx))) {
+    if (isDroppedArgument(param2ArgIndex(paramIdx))) {
       if (SubstFTy->hasSelfParam() && paramIdx == SubstFTy->getParameters().size() - 1)
         removedSelfParam = true;
       continue;
@@ -2216,7 +2235,7 @@ prepareCallArguments(ApplySite AI, SILBuilder &Builder,
       return true;
     }
 
-    if (ReInfo.isDroppedMetatypeArg(ArgIdx))
+    if (ReInfo.isDroppedArgument(ArgIdx))
       return true;
 
     // Handle arguments for formal parameters.
@@ -2738,7 +2757,7 @@ ReabstractionThunkGenerator::convertReabstractionThunkArguments(
   unsigned numParams = OrigF->getLoweredFunctionType()->getNumParameters();
   for (unsigned origParamIdx = 0, specArgIdx = 0; origParamIdx < numParams; ++origParamIdx) {
     unsigned origArgIdx = ReInfo.param2ArgIndex(origParamIdx);
-    if (ReInfo.isDroppedMetatypeArg(origArgIdx)) {
+    if (ReInfo.isDroppedArgument(origArgIdx)) {
       assert(origArgIdx >= ApplySite(OrigPAI).getCalleeArgIndexOfFirstAppliedArg() &&
              "cannot drop metatype argument of not applied argument");
       continue;
@@ -2862,14 +2881,22 @@ lookupOrCreatePrespecialization(SILOptFunctionBuilder &funcBuilder,
   return declaration;
 }
 
-bool usePrespecialized(
+static bool usePrespecialized(
     SILOptFunctionBuilder &funcBuilder, ApplySite apply, SILFunction *refF,
-    const ReabstractionInfo &specializedReInfo,
     ReabstractionInfo &prespecializedReInfo, SpecializedFunction &result) {
 
+  if (refF->getSpecializeAttrs().empty())
+    return false;
+
   SmallVector<std::tuple<unsigned, ReabstractionInfo, AvailabilityContext>, 4>
       layoutMatches;
 
+  ReabstractionInfo specializedReInfo(funcBuilder.getModule().getSwiftModule(),
+                                      funcBuilder.getModule().isWholeModule(), apply, refF,
+                                      apply.getSubstitutionMap(), IsNotSerialized,
+                                      /*ConvertIndirectToDirect=*/ true,
+                                      /*dropMetatypeArgs=*/ false);
+
   for (auto *SA : refF->getSpecializeAttrs()) {
     if (!SA->isExported())
       continue;
@@ -3185,7 +3212,7 @@ void swift::trySpecializeApplyOfGeneric(
   ReabstractionInfo prespecializedReInfo(FuncBuilder.getModule());
   bool replacePartialApplyWithoutReabstraction = false;
 
-  if (usePrespecialized(FuncBuilder, Apply, RefF, ReInfo, prespecializedReInfo,
+  if (usePrespecialized(FuncBuilder, Apply, RefF, prespecializedReInfo,
                         prespecializedF)) {
     ReInfo = prespecializedReInfo;
   }
@@ -3343,7 +3370,7 @@ void swift::trySpecializeApplyOfGeneric(
     SmallVector<SILValue, 4> Arguments;
     for (auto &Op : PAI->getArgumentOperands()) {
       unsigned calleeArgIdx = ApplySite(PAI).getCalleeArgIndex(Op);
-      if (ReInfo.isDroppedMetatypeArg(calleeArgIdx))
+      if (ReInfo.isDroppedArgument(calleeArgIdx))
         continue;
       Arguments.push_back(Op.get());
     }

test/SIL/Serialization/shared_function_serialization.sil

@@ -5,7 +5,7 @@
 // CHECK: sil private @top_level_code
 // CHECK: sil public_external [serialized] [ossa] @$ss1XVABycfC{{.*}}
 // CHECK: sil public_external [serialized] [ossa] @$ss17the_thing_it_does1xys1XV_tF{{.*}}
-// CHECK: sil shared [serialized] [noinline] [ossa] @$ss9the_thing1tyx_tlFs1XV_Tgq5{{.*}}
+// CHECK: sil shared [serialized] [noinline] [ossa] @$ss9the_thing1tyx_tlFs1XV_Ttgq5{{.*}}
 
 sil_stage canonical
 

test/SILOptimizer/cross-module-optimization.swift

@@ -80,14 +80,14 @@ class DerivedFromOpen<T> : OpenClass<T> { }
 
 func testProtocolsAndClasses() {
   // CHECK-OUTPUT: false
-  // CHECK-SIL-DAG: sil shared [noinline] @$s4Test20checkIfClassConformsyyxlFSi_Tg5
+  // CHECK-SIL-DAG: sil shared [noinline] @$s4Test20checkIfClassConformsyyxlFSi_Ttg5
   checkIfClassConforms(27)
   // CHECK-OUTPUT: false
   // CHECK-SIL-DAG: sil public_external {{.*}} @$s4Test24checkIfClassConforms_genyyxlF
   checkIfClassConforms_gen(27)
   // CHECK-OUTPUT: 123
   // CHECK-OUTPUT: 1234
-  // CHECK-SIL-DAG: sil shared [noinline] @$s4Test7callFooyyxlFSi_Tg5
+  // CHECK-SIL-DAG: sil shared [noinline] @$s4Test7callFooyyxlFSi_Ttg5
   // CHECK-SIL-DAG: sil [{{.*}}] @$s4Test19printFooExistential33_{{.*}} : $@convention(thin)
   callFoo(27)
   // CHECK-OUTPUT: 123

test/SILOptimizer/devirt_witness_cross_module.swift

@@ -48,7 +48,7 @@ public struct Local: P {
 
 // CHECK-LABEL: sil @$s4Main24testGenericInOtherModuleyyF
 // CHECK-NOCMO:   [[F:%[0-9]+]] = witness_method $S, #P.foo
-// CHECK-CMO:     [[F:%[0-9]+]] = function_ref @$s6Module1SV3foo1xyx_tSkRzSi7ElementRtzlFSaySiG_Tgq5{{.*}}
+// CHECK-CMO:     [[F:%[0-9]+]] = function_ref @$s6Module1SV3foo1xyx_tSkRzSi7ElementRtzlFSaySiG_Ttgq5{{.*}}
 // CHECK:         apply [[F]]
 // CHECK:       } // end sil function '$s4Main24testGenericInOtherModuleyyF'
 public func testGenericInOtherModule() {
@@ -75,7 +75,7 @@ public func testGenericRequirementInOtherModule() {
 }
 
 // CHECK-LABEL: sil @$s4Main23testGenericInSameModuleyyF
-// CHECK:         [[F:%[0-9]+]] = function_ref @$s4Main5LocalV3foo1xyx_tSkRzSi7ElementRtzlFSaySiG_Tg5
+// CHECK:         [[F:%[0-9]+]] = function_ref @$s4Main5LocalV3foo1xyx_tSkRzSi7ElementRtzlFSaySiG_Ttg5
 // CHECK:         apply [[F]]
 // CHECK:       } // end sil function '$s4Main23testGenericInSameModuleyyF'
 public func testGenericInSameModule() {

test/SILOptimizer/pre_specialize_layouts.swift

@@ -188,8 +188,8 @@ public func usePrespecializedEntryPoints(wrapperStruct: ReferenceWrapperStruct,
 // OPT:   [[R3:%.*]] = apply [[F1]]([[A1]]) : $@convention(thin) (@guaranteed AnyObject) -> @owned AnyObject
 // OPT:   store [[R3]] to [[R2]] : $*AnyObject
 // OPT:   [[A2:%.*]] = load [[R1]] : $*SomeClass
-// OPT:   [[F2:%.*]] = function_ref @$s22pre_specialize_layouts7consumeyyxlF0a20_specialized_module_C09SomeClassC_Tg5 : $@convention(thin) (@guaranteed SomeClass) -> ()
-// OPT:   apply [[F2]]([[A2]]) : $@convention(thin) (@guaranteed SomeClass) -> ()
+// OPT:   [[F2:%.*]] = function_ref @$s22pre_specialize_layouts7consumeyyxlF0a20_specialized_module_C09SomeClassC_Ttg5 : $@convention(thin) () -> ()
+// OPT:   apply [[F2]]() : $@convention(thin) () -> ()
 // OPT:   strong_release [[A2]] : $SomeClass
 // OPT:   dealloc_stack [[R1]] : $*SomeClass
 // OPT: } // end sil function '$s22pre_specialize_layouts46usePrespecializedEntryPointsWithMarkerProtocol1ty0a20_specialized_module_C09SomeClassC_tF'

test/SILOptimizer/spec_archetype_method.swift

@@ -32,7 +32,7 @@ func useFoo<T>(x x: T) {
 //CHECK-LABEL: sil @$s21spec_archetype_method21interesting_code_hereyyF
 //CHECK: function_ref @$s21spec_archetype_method12generic_call{{[_0-9a-zA-Z]*}}FAA3ABCC_Tg5
 //CHECK-NEXT: apply
-//CHECK:  function_ref @$s21spec_archetype_method6useFoo{{[_0-9a-zA-Z]*}}FAA3ABCC_Tg5 : $@convention(thin) (@guaranteed ABC) -> ()
+//CHECK:  function_ref @$s21spec_archetype_method6useFoo{{[_0-9a-zA-Z]*}}FAA3ABCC_Ttg5 : $@convention(thin) () -> ()
 //CHECK-NEXT: apply
 //CHECK: return
 public

test/SILOptimizer/spec_conf1.swift

@@ -19,8 +19,8 @@ func inner_function<T : P>(In In : T) { }
 @inline(never)
 func outer_function<T : P>(In In : T) { inner_function(In: In) }
 
-//CHECK: sil shared [noinline] {{.*}}@$s10spec_conf114outer_function2Inyx_tAA1PRzlFAA3FooC_Tg5
-//CHECK: $s10spec_conf114inner_function2Inyx_tAA1PRzlFAA3FooC_Tg5
+//CHECK: sil shared [noinline] {{.*}}@$s10spec_conf114outer_function2Inyx_tAA1PRzlFAA3FooC_Ttg5
+//CHECK: $s10spec_conf114inner_function2Inyx_tAA1PRzlFAA3FooC_Ttg5
 //CHECK-NEXT: apply
 //CHECK: return
 

test/SILOptimizer/spec_conf2.swift

@@ -18,8 +18,8 @@ func inner_function<T : P & Q>(In In : T) { }
 @inline(never)
 func outer_function<T : P & Q>(In In : T) { inner_function(In: In) }
 
-//CHECK: sil shared [noinline] {{.*}}@$s10spec_conf214outer_function2Inyx_tAA1PRzAA1QRzlFAA3FooC_Tg5
-//CHECK: function_ref @$s10spec_conf214inner_function2Inyx_tAA1PRzAA1QRzlFAA3FooC_Tg5
+//CHECK: sil shared [noinline] {{.*}}@$s10spec_conf214outer_function2Inyx_tAA1PRzAA1QRzlFAA3FooC_Ttg5
+//CHECK: function_ref @$s10spec_conf214inner_function2Inyx_tAA1PRzAA1QRzlFAA3FooC_Ttg5
 //CHECK-NEXT: apply
 //CHECK: return