1.3.11. TDDataStructures与EQTDDataStructures遍
自顶向下阶段非常类似于自底向上阶段。BU阶段已经识别了调用图，因此TD阶段可以使用Tarjan的算法直接遍历调用图的SCC。它不需要像BU阶段那样“重新访问”SCC。注意到在BU阶段可能仅部分访问某些SCC，因此TD阶段负责简并这些图。
总体来说，TD阶段仅在4方面与BU阶段不同：首先，TD阶段不会把一个SCC标记为未访问：它使用由BU阶段发现并记录的调用边。其次，TD阶段以逆后序，而不是后序，访问由BU遍历得到的调用图的SCC。第三，TD遍把每个函数图内联入其调用的函数（而不是相反），并且它是直接把一个调用者的图内联入其所有的潜在的被调用者（不需要“延迟”这个内联操作，因为每个调用点的潜在被调用者是已知的）。最后的差别是，如果一个函数的所有调用者已经被分析识别出来，就把形参节点标记为完整。比如，任何外部函数不能访问的函数。类似的，全局变量可能被标记为完整，除非它们可以被外部函数访问。一个函数或全局对象是外部可见的，如果它没有内部链接性（比如，没有标记为static的C对象），或者在main的图中，该全局对象存在一个没有标记为完整的节点。
1.3.11.1. 确定外部可访问的函数
TDDataStructures作为独立的遍运行时，77行的useEQBU被设置为false，这时它只依赖于BUDataStructures的结果。但当运行EQTDDataStructures遍时，useEQBU被设置为true，则TDDataStructures依赖于EquivBUDataStructures的结果。注意在对init的调用中，倒数第2个参数是true（copyGlobalAuxCalls），在拷贝DSGraph时，还将拷贝AuxFunctionCalls的内容（它现在保存了还未解析的函数调用）。
75 bool TDDataStructures::runOnModule(Module&M) {
76
77 init(useEQBU? &getAnalysis<EquivBUDataStructures>()
78 : &getAnalysis<BUDataStructures>(),
79 true, true, true, false);
80 // Figure outwhich functions must not mark their arguments complete because
81 // they areaccessible outside this compilation unit. Currently, these
82 // arguments arefunctions which are reachable by incomplete or external
83 // nodes in theglobals graph.
84 constDSScalarMap &GGSM = GlobalsGraph->getScalarMap();
85 DenseSet<DSNode*> Visited;
86 for(DSScalarMap::global_iterator I=GGSM.global_begin(), E=GGSM.global_end();
87 I != E; ++I) {
88 DSNode *N =GGSM.find(*I)->second.getNode();
89 if (N->isIncompleteNode() ||N->isExternalNode())
90 markReachableFunctionsExternallyAccessible(N,Visited);
91 }
92
93 // Loop overunresolved call nodes. Any functionspassed into (but not
94 // returned!) fromunresolvable call nodes may be invoked outside of the
95 // currentmodule.
96 for(DSGraph::afc_iterator I = GlobalsGraph->afc_begin(),
97 E = GlobalsGraph->afc_end(); I !=E; ++I)
98 for(unsigned arg = 0, e = I->getNumPtrArgs(); arg != e; ++arg)
99 markReachableFunctionsExternallyAccessible(I->getPtrArg(arg).getNode(),
100 Visited);
101 Visited.clear();
DSGraph中的ScalarMap保存了该函数所援引的对象，而其中的GlobalSet只保存全局对象，而ValMap则保存所有对象（实际上是Value与DSNodeHandle的对）。上面86行的循环就是遍历全局图的GlobalSet，88行的find则返回DSNodeHandle指向的ValMap中的DSNode——对象在函数图里的节点。如果这个节点是不完整或是外部的，则调用下面的函数。而96行的循环则是遍历AuxFunctionCalls，并对每个指针参数调用同样的函数。
51 void TDDataStructures::markReachableFunctionsExternallyAccessible(DSNode*N,
52 DenseSet<DSNode*> &Visited) {
53 if (!N || Visited.count(N)) return;
54 Visited.insert(N);
55
56 // Handle thisnode
57 {
58 N->addFullFunctionSet(ExternallyCallable);
59 }
60
61 for(DSNode::edge_iterator ii = N->edge_begin(),
62 ee = N->edge_end(); ii != ee;++ii)
63 if (!ii->second.isNull()) {
64 DSNodeHandle &NH = ii->second;
65 DSNode * NN = NH.getNode();
66 NN->addFullFunctionSet(ExternallyCallable);
67 markReachableFunctionsExternallyAccessible(NN,Visited);
68 }
69 }
这里ExternallyCallable记录的是外部可调用函数。在DSA的设计中，从不完整或外部节点可访问的函数都被视为外部可访问的。另外，作为参数传递给未解析的函数的函数也可能是外部可访问的。除此之外，定义在当前编译单元中的函数，如果不是定义为内部或私有，也是外部可访问的。
TDDataStructures::runOnModule（续）
103 // Clear Aux ofGlobals Graph to be refilled in later by post-TD unresolved
104 // functions
105 GlobalsGraph->getAuxFunctionCalls().clear();
106
107 // Functionswithout internal linkage are definitely externally callable!
108 for(Module::iterator I = M.begin(), E = M.end(); I != E; ++I)
109 if (!I->isDeclaration() &&!I->hasInternalLinkage() && !I->hasPrivateLinkage())
110 ExternallyCallable.insert(I);
111
112 // Debug code toprint the functions that are externally callable
113 #if 0
114 for (Module::iterator I = M.begin(), E =M.end(); I != E; ++I)
115 if (ExternallyCallable.count(I)) {
116 errs() << "ExternallyCallable:" << I->getNameStr() << "\n";
117 }
118 #endif
1.3.11.2. 确定调用函数的后序遍历序
接下来，ComputePostOrder计算指定函数中函数调用的后序遍历次序，以这个次序在PostOrder中保存函数的DSGraph。
TDDataStructures::runOnModule（续）
120 // We want totraverse the call graph in reverse post-order. To do this, we
121 // calculate apost-order traversal, then reverse it.
122 DenseSet<DSGraph*> VisitedGraph;
123 std::vector<DSGraph*> PostOrder;
124
125 {TIME_REGION(XXX, "td:Computepostorder");
126
127 // Calculatetop-down from main...
128 if (Function *F =M.getFunction("main"))
129 ComputePostOrder(*F,VisitedGraph, PostOrder);
130
131 // Next calculatethe graphs for each unreachable function...
132 for(Module::iterator I = M.begin(), E = M.end(); I != E; ++I)
133 if (!I->isDeclaration())
134 ComputePostOrder(*I,VisitedGraph, PostOrder);
135
136 VisitedGraph.clear(); // Releasememory!
137 }
ComputePostOrder对函数的处理次序依然是先main，后其他函数。同样对于直接调用函数，直接进行递归。
187 void TDDataStructures::ComputePostOrder(const Function &F,
188 DenseSet<DSGraph*> &Visited,
189 std::vector<DSGraph*> &PostOrder) {
190 if (F.isDeclaration()) return;
191 DSGraph* G = getOrCreateGraph(&F);
192 if (!Visited.insert(G).second) return;
193
194 // Recursivelytraverse all of the callee graphs.
195 svset<constFunction*> Callees;
196
197 // Go through allof the callsites in this graph and find all callees
198 // Here we'retrying to capture all possible callees so that we can ensure
199 // each functionhas all possible callers inlined into it.
200 for(DSGraph::fc_iterator CI = G->fc_begin(), E = G->fc_end();
201 CI != E; ++CI) {
202 // Direct callsare easy, no reason to look at DSCallGraph
203 // or anythingto do with SCC's
204 if (CI->isDirectCall()) {
205 ComputePostOrder(*CI->getCalleeFunc(),Visited, PostOrder);
206 }
207 else {
208 // Otherwise,ask the DSCallGraph for the full set of possible
209 // calleesfor this callsite.
210 // Thisincludes all members of the SCC's of those callees,
211 // and wellas others in F's SCC, since we must assume
212 // anyindirect call might be intra-SCC.
213 callgraph.addFullFunctionSet(CI->getCallSite(),Callees);
214 }
215 }
216
217 for(svset<const Function*>::iterator I =Callees.begin(),
218 E = Callees.end(); I != E; ++I)
219 ComputePostOrder(**I, Visited, PostOrder);
220
221 PostOrder.push_back(G);
222 }
对于间接调用的函数，通过addFullFunctionSet收集候选函数。下面265行遍历callgraph的ActualCallees容器中与指定CallSite关联的函数（Function）。对于某一特定的函数，如果它属于某个调用链SCC，把这个SCC的所有成员加入Set（如果它不属于某个SCC，267行的scc_begin会返回与scc_end相同的迭代器）。对于该CallSite所在的函数（270行的F1），同样向Set加入其所在SCC的成员，如果存在这样的SCC。因为我们假定间接调用都可能是SCC的任何部分。
261 void DSCallGraph::addFullFunctionSet(llvm::CallSiteCS,
262 svset<const llvm::Function*> &Set) const {
263 DSCallGraph::callee_iterator csi =callee_begin(CS),
264 cse = callee_end(CS);
265 while(csi !=cse) {
266 constFunction *F = *csi;
267 Set.insert(scc_begin(F), scc_end(F));
268 ++csi;
269 }
270 constFunction *F1 = CS.getInstruction()->getParent()->getParent();
271 F1 = sccLeader(&*F1);
272 Set.insert(scc_begin(F1), scc_end(F1));
273 }
接着在TDDataStructures::ComputePostOrder的217行对这些收集到的间接被调用函数进行递归。221行就是后序遍历的标志。
1.3.11.3. 向被调用者内联调用者
现在在PostOrder中，调用链最底层的被调用函数出现在容器头部，最顶层的则出现在容器的底部，因此143行对InlineCallersIntoGraph的调用从最顶层的（被）调用函数开始。这样对调用图的访问就是逆后序的。
TDDataStructures::runOnModule（续）
139 {TIME_REGION(XXX,"td:Inline stuff");
140
141 // Visit each ofthe graphs in reverse post-order now!
142 while(!PostOrder.empty()) {
143 InlineCallersIntoGraph(PostOrder.back());
144 PostOrder.pop_back();
145 }
146 }
这个函数用到一个新的数据类型：CallerCallEdge。336~338行的注释已经解释了这个结构的作用。
335 struct CallerCallEdge {
336 DSGraph *CallerGraph; // Thegraph of the caller function.
337 constDSCallSite *CS; // The actual call site.
338 constFunction *CalledFunction; // The actual function being called.
339
340 CallerCallEdge(DSGraph *G, const DSCallSite *cs, constFunction *CF)
341 : CallerGraph(G), CS(cs),CalledFunction(CF) {}
342
343 bool operator<(const CallerCallEdge &RHS) const {
344 returnCallerGraph < RHS.CallerGraph ||
345 (CallerGraph == RHS.CallerGraph&& CS < RHS.CS);
346 }
347 };
下面231行的CallerEdges的定义是std::map<DSGraph*, std::vector<CallerCallEdge> >，它是TDDataStructures的成员。DSG如果在CallerEdges中有记录，这个记录是它的调用者添加的（参考函数的后半段），230~235行取出这个记录。使用CallerCallEdge定义的比较操作符，238行的sort以调用者图的地址排序相关的CallerCallEdge项（这样同一个调用函数用产生的CallerCallEdge项会集合在一起，便于循环处理）。
226 void TDDataStructures::InlineCallersIntoGraph(DSGraph*DSG) {
227 // Inline callergraphs into this graph. First step, getthe list of call
228 // sites thatcall into this graph.
229 std::vector<CallerCallEdge>EdgesFromCaller;
230 std::map<DSGraph*,std::vector<CallerCallEdge> >::iterator
231 CEI = CallerEdges.find(DSG);
232 if (CEI != CallerEdges.end()) {
233 std::swap(CEI->second, EdgesFromCaller);
234 CallerEdges.erase(CEI);
235 }
236
237 // Sort thecaller sites to provide a by-caller-graph ordering.
238 std::sort(EdgesFromCaller.begin(),EdgesFromCaller.end());
239
240
241 // Mergeinformation from the globals graph into this graph. FIXME: This is
242 // stupid. Instead of us cloning information from the GGinto this graph,
243 // then havingRemoveDeadNodes clone it back, we should do all of this as a
244 // post-pass overall of the graphs. We need to takecloning out of
245 //removeDeadNodes and gut removeDeadNodes at the same time first though. :(
246 cloneGlobalsInto(DSG,DSGraph::DontCloneCallNodes |
247 DSGraph::DontCloneAuxCallNodes);
248
249 DEBUG(errs() << "[TD] Inliningcallers into '"
250 << DSG->getFunctionNames()<< "'\n");
251
252 DSG->maskIncompleteMarkers();
253 // Iterativelyinline caller graphs into this graph.
254 while(!EdgesFromCaller.empty()) {
255 DSGraph* CallerGraph =EdgesFromCaller.back().CallerGraph;
256
257 // Iteratethrough all of the call sites of this graph, cloning and merging
258 // any nodesrequired by the call.
259 ReachabilityCloner RC(DSG, CallerGraph,
260 DSGraph::DontCloneCallNodes |
261 DSGraph::DontCloneAuxCallNodes);
262
263 // Inline all callsites from this caller graph.
264 do {
265 constDSCallSite &CS = *EdgesFromCaller.back().CS;
266 constFunction &CF = *EdgesFromCaller.back().CalledFunction;
267 DEBUG(errs() << " [TD] Inlining graph into Fn '"
268 << CF.getName().str() << "'from ");
269 if(CallerGraph->getReturnNodes().empty()) {
270 DEBUG(errs() << "SYNTHESIZEDINDIRECT GRAPH");
271 } else {
272 DEBUG(errs() << "Fn '"<< CS.getCallSite().getInstruction()->
273 getParent()->getParent()->getName().str()<< "'");
274 }
275 DEBUG(errs() << ": "<< CF.getFunctionType()->getNumParams()
276 << " args\n");
277
278 // Get theformal argument and return nodes for the called function and
279 // merge themwith the cloned subgraph.
280 DSCallSite T1 =DSG->getCallSiteForArguments(CF);
281 RC.mergeCallSite(T1, CS);
282 ++NumTDInlines;
283
284 EdgesFromCaller.pop_back();
285 } while(!EdgesFromCaller.empty() &&
286 EdgesFromCaller.back().CallerGraph== CallerGraph);
287 }
252行清除所有节点的不完整标记。顶层调用函数不会进入230~235及254~287行。其他函数则根据CallerEdges的记录，把其调用者中调用点信息简并入自己的图。接着，297行的DSG是InlineCallersIntoGraph要处理的DSGraph，retnodes_begin返回ReturnNodes的首迭代器（ReturnNodes的类型是std::map<constFunction*, DSNodeHandle>，它记录函数的返回值。在BU遍中，在向调用者内联被调用者时，被调用者的返回值将被加入调用者的这个容器）。如果这个DSGraph所代表的函数（经过了内联，所代表的函数可以是多个）之一是外部可调用的，在300行isExternallyCallable被置为true。
TDDataStructures::InlineCallersIntoGraph（续）
291 // Next, now thatthis graph is finalized, we need to recompute the
292 // incompletenessmarkers for this graph and remove unreachable nodes.
293
294 // If any of thefunctions is externally callable, treat everything in its
295 // SCC asexternally callable.
296 bool isExternallyCallable = false;
297 for(DSGraph::retnodes_iterator I = DSG->retnodes_begin(),
298 E = DSG->retnodes_end(); I != E;++I)
299 if (ExternallyCallable.count(I->first)){
300 isExternallyCallable = true;
301 break;
302 }
303
304 // Recompute theIncomplete markers. Depends on whetherargs are complete
305 unsigned IncFlags =DSGraph::IgnoreFormalArgs;
306 IncFlags |= DSGraph::IgnoreGlobals |DSGraph::MarkVAStart;
307 DSG->markIncompleteNodes(IncFlags);
308
309 // If this graphcontains functions that are externally callable, now is the time to mark
310 // theirarguments and return values as external. At this point TD is inlining all caller information,
311 // and that meansExternal callers too.
312 unsigned ExtFlags = isExternallyCallable ?
313 DSGraph::MarkFormalsExternal: DSGraph::DontMarkFormalsExternal;
314 DSG->computeExternalFlags(ExtFlags);
315 DSG->computeIntPtrFlags();
316
317 cloneIntoGlobals(DSG,DSGraph::DontCloneCallNodes |
318 DSGraph::DontCloneAuxCallNodes);
319 //
320 // Delete deadnodes. Treat globals that areunreachable as dead also.
321 //
322 // FIXME:
323 // Do not delete unreachable globals as thecomment describes. For its
324 // alignment checks on the results of loadinstructions, SAFECode must be
325 // able to find the DSNode of both the result ofthe load as well as the
326 // pointer dereferenced by the load. If we remove unreachable globals, then
327 // if the dereferenced pointer is a global, itsDSNode will not reachable
328 // from the local graph's scalar map, and chaosensues.
329 //
330 // So, for now, just remove dead nodes but leavethe globals alone.
331 //
332 DSG->removeDeadNodes(0);
因为在前面252行已经把所有节点的未完成标记去掉了，在307行重现计算这些节点的未完成标记。根据IncFlags内容，markIncompleteNodes只把AuxFunctionCalls容器内的节点、可变参数节点标记为不完整。而314行的computeExternalFlags，则根据函数是否外部可访问，把函数的指针参数、返回值、可变参数标记为外部。317行将函数图中的全局对象节点克隆、简并入全局图（此时全局图中的全局对象节点是标记为完成的）。332行的removeDeadNodes在前一版是有参数DSGraph::RemoveUnreachableGlobals的，当前版本把这个参数去掉，原因322行的注释解释了。
TDDataStructures::InlineCallersIntoGraph（续）
334 // We are donewith computing the current TD Graph! Finally, before we can
335 // finishprocessing this function, we figure out which functions it calls and
336 // records thesecall graph edges, so that we have them when we process the
337 // callee graphs.
338 if (DSG->fc_begin() == DSG->fc_end()) return;
339
340 // Loop over allthe call sites and all the callees at each call site, and add
341 // edges to theCallerEdges structure for each callee.
342 for(DSGraph::fc_iterator CI = DSG->fc_begin(), E = DSG->fc_end();
343 CI != E; ++CI) {
344
345 // Handle directcalls efficiently.
346 if (CI->isDirectCall()) {
347 if(!CI->getCalleeFunc()->isDeclaration() &&
348 !DSG->getReturnNodes().count(CI->getCalleeFunc()))
349 CallerEdges[getOrCreateGraph(CI->getCalleeFunc())]
350 .push_back(CallerCallEdge(DSG,&*CI, CI->getCalleeFunc()));
351 continue;
352 }
353
354 svset<constFunction*> AllCallees;
355 std::vector<constFunction*> Callees;
356
357 // Get the listof callees
358 callgraph.addFullFunctionSet(CI->getCallSite(),AllCallees);
359
360 // Filter allnon-declarations, and calls within this DSGraph
361 for(svset<const Function*>::iterator I =AllCallees.begin(),
362 E = AllCallees.end(); I != E; ++I) {
363 constFunction *F = *I;
364 if (!F->isDeclaration() &&getDSGraph(**I) != DSG)
365 Callees.push_back(F);
366 }
367 AllCallees.clear();
368
369 // If there isexactly one callee from this call site, remember the edge in
370 // CallerEdges.
371 if (Callees.size() == 1) {
372 constFunction * Callee = Callees[0];
373 CallerEdges[getOrCreateGraph(Callee)]
374 .push_back(CallerCallEdge(DSG,&*CI, Callee));
375 }
376 if (Callees.size() <= 1) continue;
377
378 // Otherwise,there are multiple callees from this call site, so it must be
379 // an indirectcall. Chances are that there will beother call sites with
380 // this set oftargets. If so, we don't want to do M*Ninlining operations,
381 // so we buildup a new, private, graph that represents the calls of all
382 // calls tothis set of functions.
383
384 std::map<std::vector<const Function*>, DSGraph*>::iteratorIndCallRecI =
385 IndCallMap.lower_bound(Callees);
386
387 // If wealready have this graph, recycle it.
388 if (IndCallRecI != IndCallMap.end()&& IndCallRecI->first == Callees) {
389 DEBUG(errs() << " [TD] *** Reuse of indcall graph for "<< Callees.size()
390 << " callees!\n");
391 DSGraph * IndCallGraph =IndCallRecI->second;
392 assert(IndCallGraph->getFunctionCalls().size()== 1);
393
394 // Merge thecall into the CS already in the IndCallGraph
395 ReachabilityCloner RC(IndCallGraph, DSG,0);
396 RC.mergeCallSite(IndCallGraph->getFunctionCalls().front(),*CI);
DSGraph的fc_begin及fc_end返回容器FunctionCalls的首尾迭代器，FunctionCalls记录了在该函数中进行的函数调用。上面这段代码的目的是找出当前函数调用的函数，并使CallerEdges记录之。对于直接调用（346行条件），如果被调用的函数有定义，且不在当前函数图中，把它记录在CallerEdges里。对于间接调用，在358行首先获取所有可能的被调用函数，在364行过滤掉没有定义或者在当前函数图中调用的函数。如果被调用函数的个数只是1（371行），那么直接把它记录在CallerEdges里。而如果被调用函数的个数多于1个，而且如果这些被调用函数已经处理过了（比如，另一个调用这些函数的调用点，这样它们会被记录在IndCallMap中），那么已经存在一个内联后的图，在396行把这些函数调用简并入这个图（这样避免在InlineCallersIntoGraph开头的更耗时的内联操作）。注意392行断言检查IndCallMap的完整性是否被破坏。
1036 void ReachabilityCloner::mergeCallSite(DSCallSite&DestCS,
1037 const DSCallSite &SrcCS) {
1038 merge(DestCS.getRetVal(),SrcCS.getRetVal());
1039 merge(DestCS.getVAVal(),SrcCS.getVAVal());
1040 unsigned MinArgs = DestCS.getNumPtrArgs();
1041 if (SrcCS.getNumPtrArgs() < MinArgs)MinArgs = SrcCS.getNumPtrArgs();
1042
1043 for (unsigneda = 0; a != MinArgs; ++a)
1044 merge(DestCS.getPtrArg(a),SrcCS.getPtrArg(a));
1045
1046 for (unsigneda = MinArgs, e = SrcCS.getNumPtrArgs(); a != e; ++a) {
1047 // If a callsite passes more params, ignore the extra params.
1048 // If thecalled function is varargs, merge the extra params, with
1049 // the varargsnode.
1050 if(DestCS.getVAVal() != NULL) {
1051 merge(DestCS.getVAVal(),SrcCS.getPtrArg(a));
1052 }
1053 }
1054
1055 for (unsigneda = MinArgs, e = DestCS.getNumPtrArgs(); a!=e; ++a) {
1056 // If a callsite passes less explicit params, than the function needs
1057 // But passesparams through a varargs node, merge those in.
1058 if(SrcCS.getVAVal() != NULL) {
1059 merge(DestCS.getPtrArg(a),SrcCS.getVAVal());
1060 }
1061 }
1062 }
对于调用点来说，可以看到就是返回值、各种参数，因此简并意味着处理返回值、指针参数以及可变参数。
接下来处理个数多于1个且尚未处理的被调用函数。这种情况下，399行首先创建一个新的DSGraph实例，注意在这个实例中FunctionCalls是空的，而且不包含任何DSNode节点（因为它的目的就是携带CallSite对象）。407行向这个DSGraph加入唯一的一个DSCallSite对象，并在410行加入IndCallMap（这是前面392行断言的依据）。最后，针对每个被调用函数，在CallerEdges中记录下IndCallGraph（携带CallSite信息的图，即代表调用函数），对应的DSCallSite（似乎不需要），被调用函数（以被调用函数图为键值）。
TDDataStructures::InlineCallersIntoGraph（续）
397 } else {
398 // Otherwise,create a new DSGraph to represent this.
399 DSGraph* IndCallGraph = new DSGraph(DSG->getGlobalECs(),
400 DSG->getDataLayout(), *TypeSS);
401
402 // Clone overthe call into the new DSGraph
403 ReachabilityCloner RC(IndCallGraph, DSG,0);
404 DSCallSite ClonedCS = RC.cloneCallSite(*CI);
405
406 // Add thecloned CS to the graph, as if it were an original call.
407 IndCallGraph->getFunctionCalls().push_back(ClonedCS);
408
409 // Save thisgraph for use later, should we need it.
410 IndCallRecI =IndCallMap.insert(IndCallRecI,
411 std::make_pair(Callees, IndCallGraph));
412
413 //Additionally, make sure that each of the callees inlines this graph
414 // exactlyonce.
415 DSCallSite *NCS =&IndCallGraph->getFunctionCalls().front();
416 for(unsigned i = 0, e = Callees.size(); i != e; ++i) {
417 DSGraph* CalleeGraph = getDSGraph(*Callees[i]);
418 if (CalleeGraph != DSG)
419 CallerEdges[CalleeGraph].push_back(CallerCallEdge(IndCallGraph, NCS,
420 Callees[i]));
421 }
422 }
423 }
424 }
在处理了所有的函数调用后，IndCallMap，ExternallyCallable的内容不再需要，回收其中的资源。接下来重现计算全局图的各种标记，注意这里不再重现计算完整性标记，因为全局图节点的完整性计算在BUDataStructure及CompleteDataStructure遍中就完成了。同样，函数图的完整性计算在InlineCallersIntoGraph中已经完成。最后，恢复调用图。
TDDataStructures::runOnModule（续）
148 // Free theIndCallMap.
149 while(!IndCallMap.empty()) {
150 deleteIndCallMap.begin()->second;
151 IndCallMap.erase(IndCallMap.begin());
152 }
153
154 formGlobalECs();
155
156 ExternallyCallable.clear();
157 GlobalsGraph->removeTriviallyDeadNodes();
158 GlobalsGraph->computeExternalFlags(DSGraph::DontMarkFormalsExternal);
159 GlobalsGraph->computeIntPtrFlags();
160
161 // Make sure eachgraph has updated external information about globals
162 // in the globalsgraph.
163 VisitedGraph.clear();
164 for(Module::iterator F = M.begin(); F != M.end(); ++F) {
165 if (!(F->isDeclaration())){
166 DSGraph *Graph = getOrCreateGraph(F);
167 if (!VisitedGraph.insert(Graph).second) continue;
168
169 cloneGlobalsInto(Graph,DSGraph::DontCloneCallNodes |
170 DSGraph::DontCloneAuxCallNodes);
171
172 Graph->computeExternalFlags(DSGraph::DontMarkFormalsExternal);
173 Graph->computeIntPtrFlags();
174 // Clean upuninteresting nodes
175 Graph->removeDeadNodes(0);
176
177 }
178 }
179
180 // CBU containsthe correct call graph.
181 // Restore it, sothat subsequent passes and clients can get it.
182 restoreCorrectCallGraph();
183 return false;
184 }
至此，TDDataStructures及EQTDDataStructures遍的处理全部完成。从DSA分析的结果出发，Chris在论文中提到了其在别名分析及自动池分配（automatic pool allocation）的应用。Poolalloc对此也做了延伸及扩展。Poolalloc目前被应用到SafeCode项目中，它是这个项目的基础。
扫一扫
1690
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
