search for: objsize

...tail call i8* @calloc(i64 1, i64 %elements) %memobj = bitcast i8* %mem to i64* %ptr = getelementptr inbounds i64* %memobj, i64 %index %4 = load i64* %ptr, align 8 Currently, the IR for bounds checking this load looks like this: %size = mul i64 8, %elements %offset = mul i64 %index, 8 %objsize = sub i64 %size, %offset %cmp2 = icmp ult i64 %size, %offset %cmp3 = icmp ult i64 %objsize, 8 %cmp1 = icmp slt i64 %offset, 0 %9 = or i1 %cmp2, %cmp3 %11 = or i1 %cmp1, %9 br i1 %11, label %trap, label %12 ┆ ┆ │ │ ╴╴╴╴╴╴╴╴╴╴...

...ments) > %memobj = bitcast i8* %mem to i64* > %ptr = getelementptr inbounds i64* %memobj, i64 %index > %4 = load i64* %ptr, align 8 > > Currently, the IR for bounds checking this load looks like this: > > %size = mul i64 8, %elements > %offset = mul i64 %index, 8 > %objsize = sub i64 %size, %offset > > %cmp2 = icmp ult i64 %size, %offset > %cmp3 = icmp ult i64 %objsize, 8 > %cmp1 = icmp slt i64 %offset, 0 > > %9 = or i1 %cmp2, %cmp3 > %11 = or i1 %cmp1, %9 > br i1 %11, label %trap, label %12 > > ┆ ┆ >...

...348 >> 349 ObjectSizeOffsetVisitor Visitor(TD, TLI, Ptr->getContext(), RoundToAlign); >> 350 SizeOffsetType Data = Visitor.compute(const_cast<Value*>(Ptr)); >> 351 if (!Visitor.bothKnown(Data)) >> 352 return false; >> 353 >> 354 APInt ObjSize = Data.first, Offset = Data.second; >> 355 // check for overflow >> 356 if (Offset.slt(0) || ObjSize.ult(Offset)) >> 357 Size = 0; >> 358 else >> 359 Size = (ObjSize - Offset).getZExtValue(); ??? What the hack is "object"?????? >> 36...

...346 if (!TD) 347 return false; 348 349 ObjectSizeOffsetVisitor Visitor(TD, TLI, Ptr->getContext(), RoundToAlign); 350 SizeOffsetType Data = Visitor.compute(const_cast<Value*>(Ptr)); 351 if (!Visitor.bothKnown(Data)) 352 return false; 353 354 APInt ObjSize = Data.first, Offset = Data.second; 355 // check for overflow 356 if (Offset.slt(0) || ObjSize.ult(Offset)) 357 Size = 0; 358 else 359 Size = (ObjSize - Offset).getZExtValue(); ??? What the hack is "object"?????? 360 return true; 361 } Figure 2 cat -...

...alse; > 348 > 349 ObjectSizeOffsetVisitor Visitor(TD, TLI, Ptr->getContext(), > RoundToAlign); > 350 SizeOffsetType Data = Visitor.compute(const_cast<Value*>(Ptr)); > 351 if (!Visitor.bothKnown(Data)) > 352 return false; > 353 > 354 APInt ObjSize = Data.first, Offset = Data.second; > 355 // check for overflow > 356 if (Offset.slt(0) || ObjSize.ult(Offset)) > 357 Size = 0; > 358 else > 359 Size = (ObjSize - Offset).getZExtValue(); ??? What the > hack is "object"?????? > 360 return...

...ow whether an access is beyond the bounds of an underlying object (undefined behavior land) so we pass the underlying object (which in your example would be the "p" returned from malloc) to the getObjectSize function. > > In the first case (passing "p+50" to getObjectSize) ObjSize should be 56 and the Offset will be 50 yielding 6 in the second case your ObjSize will be 56 and the offset is zero because basicaa passed the underlying object "p". you figured out an alternative to fix the problem. In the context of alias analysis, it is up to the caller to pass the b...

...ectSizeOffsetVisitor Visitor(TD, TLI, Ptr->getContext(), RoundToAlign); >>> 350 SizeOffsetType Data = Visitor.compute(const_cast<Value*>(Ptr)); >>> 351 if (!Visitor.bothKnown(Data)) >>> 352 return false; >>> 353 >>> 354 APInt ObjSize = Data.first, Offset = Data.second; >>> 355 // check for overflow >>> 356 if (Offset.slt(0) || ObjSize.ult(Offset)) >>> 357 Size = 0; >>> 358 else >>> 359 Size = (ObjSize - Offset).getZExtValue(); ??? What the hack is "object...

...sitor Visitor(TD, TLI, Ptr->getContext(), RoundToAlign); >>>> 350 SizeOffsetType Data = Visitor.compute(const_cast<Value*>(Ptr)); >>>> 351 if (!Visitor.bothKnown(Data)) >>>> 352 return false; >>>> 353 >>>> 354 APInt ObjSize = Data.first, Offset = Data.second; >>>> 355 // check for overflow >>>> 356 if (Offset.slt(0) || ObjSize.ult(Offset)) >>>> 357 Size = 0; >>>> 358 else >>>> 359 Size = (ObjSize - Offset).getZExtValue(); ??? What the hack...

...ocReg(), RC); EVT RegisterValueType = VA.getLocVT(); ArgValue = DAG.getCopyFromReg(Chain, dl, Register, RegisterValueType); InVals.push_back(ArgValue); } else { // Sanity check assert(VA.isMemLoc()); // Load the argument to a virtual register unsigned ObjSize = VA.getLocVT().getSizeInBits()/8; if (ObjSize != 4) { llvm_unreachable("Memory argument is wrong size - not 32 bit!"); } // Create the frame index object for this incoming parameter... int FI = MFI->CreateFixedObject(ObjSize, VA.getLocMemOffset(), tru...

...8* %mem to i64* >> %ptr = getelementptr inbounds i64* %memobj, i64 %index >> %4 = load i64* %ptr, align 8 >> >> Currently, the IR for bounds checking this load looks like this: >> >> %size = mul i64 8, %elements >> %offset = mul i64 %index, 8 >> %objsize = sub i64 %size, %offset >> >> %cmp2 = icmp ult i64 %size, %offset >> %cmp3 = icmp ult i64 %objsize, 8 >> %cmp1 = icmp slt i64 %offset, 0 >> >> %9 = or i1 %cmp2, %cmp3 >> %11 = or i1 %cmp1, %9 >> br i1 %11, label %trap, label %12 >> >&g...

...r->getContext(), RoundToAlign); >>>>> 350 SizeOffsetType Data = Visitor.compute(const_cast<Value*>(Ptr)); >>>>> 351 if (!Visitor.bothKnown(Data)) >>>>> 352 return false; >>>>> 353 >>>>> 354 APInt ObjSize = Data.first, Offset = Data.second; >>>>> 355 // check for overflow >>>>> 356 if (Offset.slt(0) || ObjSize.ult(Offset)) >>>>> 357 Size = 0; >>>>> 358 else >>>>> 359 Size = (ObjSize - Offset).getZExtVa...

..... int q = p[s - 2]; } then the access of p[s - 2] always stays in bound. I implemented a prototype using the Scalar Evolution pass. Here are the pseudo-code of the implementation: const SCEV * offset = SE->getMinusSCEV(SE->getSCEV(GEP), GEPBase); const SCEV * bounds = SE->getSCEV(objSize); if (SE->getSMaxExpr(offset, bounds) == bounds) { ++safeGEPs; } But it turns out that SCEVSMaxExpr does not handle the case of SMax(N, N-2). My question is, is there a plan to support something like this, or is it possible to do some refactoring to enhance the capability of Scalar E...

...stays in bound. > > > > I implemented a prototype using the Scalar Evolution pass. Here are the > > pseudo-code of the implementation: > > > > const SCEV * offset = SE->getMinusSCEV(SE->getSCEV(GEP), GEPBase); > > const SCEV * bounds = SE->getSCEV(objSize); > > > > if (SE->getSMaxExpr(offset, bounds) == bounds) { > > ++safeGEPs; > > } > > > > But it turns out that SCEVSMaxExpr does not handle the case of SMax(N, > > N-2). > > Consider 8-bit integers and N = -127. N-1 equals INT_MIN and N...

...the access of p[s - 2] always stays in bound. > > I implemented a prototype using the Scalar Evolution pass. Here are the > pseudo-code of the implementation: > > const SCEV * offset = SE->getMinusSCEV(SE->getSCEV(GEP), GEPBase); > const SCEV * bounds = SE->getSCEV(objSize); > > if (SE->getSMaxExpr(offset, bounds) == bounds) { > ++safeGEPs; > } > > But it turns out that SCEVSMaxExpr does not handle the case of SMax(N, > N-2). Consider 8-bit integers and N = -127. N-1 equals INT_MIN and N-2 then is equal to INT_MAX, or 127. In that...

Now that icmp and fcmp have supported returning vectors of i1 for a while, I think it's time to remove the vicmp and vfcmp instructions from LLVM. The good news is that we've never shipped a release that included them so we won't be providing auto-upgrade support. There is some existing backend support for vicmp and vfcmp that looks different from what icmp and fcmp do. If this

...; > > > I implemented a prototype using the Scalar Evolution pass. Here are the > > > pseudo-code of the implementation: > > > > > > const SCEV * offset = SE->getMinusSCEV(SE->getSCEV(GEP), GEPBase); > > > const SCEV * bounds = SE->getSCEV(objSize); > > > > > > if (SE->getSMaxExpr(offset, bounds) == bounds) { > > > ++safeGEPs; > > > } > > > > > > But it turns out that SCEVSMaxExpr does not handle the case of SMax(N, > > > N-2). > > > > Consider 8-bit in...

...t;>> I implemented a prototype using the Scalar Evolution pass. Here are the >>>> pseudo-code of the implementation: >>>> >>>> const SCEV * offset = SE->getMinusSCEV(SE->getSCEV(GEP), GEPBase); >>>> const SCEV * bounds = SE->getSCEV(objSize); >>>> >>>> if (SE->getSMaxExpr(offset, bounds) == bounds) { >>>> ++safeGEPs; >>>> } >>>> >>>> But it turns out that SCEVSMaxExpr does not handle the case of SMax(N, >>>> N-2). >>> Consider 8-b...

...ge with pg''s use of its shared segment. So it doesn''t *look* like the ram is hiding in some cgroup. The kernel does not log anything relevant to this. Slabinfo gives some odd output. It seems to think there are negative quantities of some slabs: Name Objects Objsize Space Slabs/Part/Cpu O/S O %Fr %Ef Flg :at-0000016 5632 16 90.1K 18446744073709551363/0/275 256 0 0 100 *a :t-0000048 3386 48 249.8K 18446744073709551558/22/119 85 0 36 65 * :t-0000120 1022 120 167.9K 18446744073709551604/1...

...command that shows what is using the kernel memory? Here is what /proc/slabinfo shows (cut down for formatting). I don't understand how to read this so maybe someone can indicate if something looks wrong? ======= # cat /proc/slabinfo # name <active_objs> <num_objs> <objsize> <objperslab> <pagesperslab> nfsd4_delegations 0 0 596 13 2 nfsd4_stateids 0 0 72 53 1 nfsd4_files 0 0 36 101 1 nfsd4_stateowners 0 0 344 11 1 rpc_buffers 8 8 2048 2 1 rpc_...

...:59:31.000000000 +0100 +++ linux-2.6.10-mm1-full/fs/smbfs/request.c 2005-01-04 01:00:18.000000000 +0100 @@ -27,6 +27,8 @@ /* cache for request structures */ static kmem_cache_t *req_cachep; +static int smb_request_send_req(struct smb_request *req); + /* /proc/slabinfo: name, active, num, objsize, active_slabs, num_slaps, #pages @@ -132,7 +134,7 @@ * What prevents a rget to race with a rput? The count must never drop to zero * while it is in use. Only rput if it is ok that it is free'd. */ -void smb_rget(struct smb_request *req) +static void smb_rget(struct smb_request *req) {...