compiler: add range param attr to slice/string len/cap

This attaches the maximum valid len/cap to string/slice fuction parameters.
The compiler can use this to:
1. Prove that index math will not overflow
2. Prove that signed and unsigned comparisons are equivalent

Author: niaow

builder/sizes_test.go

@@ -44,7 +44,7 @@ func TestBinarySize(t *testing.T) {
 		// microcontrollers
 		{"hifive1b", "examples/echo", 3668, 280, 0, 2244},
 		{"microbit", "examples/serial", 2694, 342, 8, 2248},
-		{"wioterminal", "examples/pininterrupt", 6837, 1491, 120, 6888},
+		{"wioterminal", "examples/pininterrupt", 6835, 1493, 120, 6888},
 
 		// TODO: also check wasm. Right now this is difficult, because
 		// wasm binaries are run through wasm-opt and therefore the

compiler/calls.go

@@ -21,6 +21,7 @@ type paramInfo struct {
 	llvmType llvm.Type
 	name     string     // name, possibly with suffixes for e.g. struct fields
 	elemSize uint64     // size of pointer element type, or 0 if this isn't a pointer
+	max      uint64     // maximum value (for len/cap)
 	flags    paramFlags // extra flags for this parameter
 }
 
@@ -171,6 +172,8 @@ func (c *compilerContext) flattenAggregateType(t llvm.Type, name string, goType
 			}
 			suffix := strconv.Itoa(i)
 			isString := false
+			hasLengths := false
+			var maxLen uint64
 			if goType != nil {
 				// Try to come up with a good suffix for this struct field,
 				// depending on which Go type it's based on.
@@ -179,6 +182,9 @@ func (c *compilerContext) flattenAggregateType(t llvm.Type, name string, goType
 					suffix = []string{"typecode", "value"}[i]
 				case *types.Slice:
 					suffix = []string{"data", "len", "cap"}[i]
+					maxLen = c.maxLen
+					maxLen /= max(c.targetData.TypeAllocSize(c.getLLVMType(goType.Elem())), 1)
+					hasLengths = true
 				case *types.Struct:
 					suffix = goType.Field(i).Name()
 				case *types.Basic:
@@ -188,6 +194,8 @@ func (c *compilerContext) flattenAggregateType(t llvm.Type, name string, goType
 					case types.String:
 						suffix = []string{"data", "len"}[i]
 						isString = true
+						hasLengths = true
+						maxLen = c.maxLen
 					}
 				case *types.Signature:
 					suffix = []string{"context", "funcptr"}[i]
@@ -197,6 +205,10 @@ func (c *compilerContext) flattenAggregateType(t llvm.Type, name string, goType
 			if isString {
 				subInfos[0].flags |= paramIsReadonly
 			}
+			if hasLengths && i > 0 {
+				// Add the max to a len/cap
+				subInfos[0].max = maxLen
+			}
 			paramInfos = append(paramInfos, subInfos...)
 		}
 		return paramInfos

compiler/compiler.go

@@ -84,6 +84,7 @@ type compilerContext struct {
 	funcPtrType      llvm.Type // pointer in function address space (1 for AVR, 0 elsewhere)
 	funcPtrAddrSpace int
 	uintptrType      llvm.Type
+	maxLen           uint64
 	program          *ssa.Program
 	diagnostics      []error
 	functionInfos    map[*ssa.Function]functionInfo
@@ -128,6 +129,7 @@ func newCompilerContext(moduleName string, machine llvm.TargetMachine, config *C
 		panic("unknown pointer size")
 	}
 	c.dataPtrType = llvm.PointerType(c.ctx.Int8Type(), 0)
+	c.maxLen = (uint64(1) << (c.uintptrType.IntTypeWidth() - 1)) - 1
 
 	dummyFuncType := llvm.FunctionType(c.ctx.VoidType(), nil, false)
 	dummyFunc := llvm.AddFunction(c.mod, "tinygo.dummy", dummyFuncType)

compiler/symbol.go

@@ -128,11 +128,18 @@ func (c *compilerContext) getFunction(fn *ssa.Function) (llvm.Type, llvm.Value)
 	c.addStandardDeclaredAttributes(llvmFn)
 
 	dereferenceableOrNullKind := llvm.AttributeKindID("dereferenceable_or_null")
+	rangeKind := llvm.AttributeKindID("range")
 	for i, paramInfo := range paramInfos {
 		if paramInfo.elemSize != 0 {
 			dereferenceableOrNull := c.ctx.CreateEnumAttribute(dereferenceableOrNullKind, paramInfo.elemSize)
 			llvmFn.AddAttributeAtIndex(i+1, dereferenceableOrNull)
 		}
+		if paramInfo.max != 0 {
+			rangeAttr := c.ctx.CreateSmallRangeAttribute(rangeKind, uint(paramInfo.llvmType.IntTypeWidth()), 0, paramInfo.max+1)
+			if !rangeAttr.IsNil() {
+				llvmFn.AddAttributeAtIndex(i+1, rangeAttr)
+			}
+		}
 		if info.noescape && paramInfo.flags&paramIsGoParam != 0 && paramInfo.llvmType.TypeKind() == llvm.PointerTypeKind {
 			// Parameters to functions with a //go:noescape parameter should get
 			// the nocapture attribute. However, the context parameter should

compiler/testdata/channel.ll

@@ -105,7 +105,7 @@ select.body:                                      ; preds = %select.next
   br label %select.done
 }
 
-declare { i32, i1 } @runtime.chanSelect(ptr, ptr, i32, i32, ptr, i32, i32, ptr) #1
+declare { i32, i1 } @runtime.chanSelect(ptr, ptr, i32 range(i32 0, 268435456), i32 range(i32 0, 268435456), ptr, i32 range(i32 0, 134217728), i32 range(i32 0, 134217728), ptr) #1
 
 attributes #0 = { allockind("alloc,zeroed") allocsize(0) "alloc-family"="runtime.alloc" "target-features"="+bulk-memory,+bulk-memory-opt,+call-indirect-overlong,+mutable-globals,+nontrapping-fptoint,+sign-ext,-multivalue,-reference-types" }
 attributes #1 = { "target-features"="+bulk-memory,+bulk-memory-opt,+call-indirect-overlong,+mutable-globals,+nontrapping-fptoint,+sign-ext,-multivalue,-reference-types" }

compiler/testdata/go1.20.ll

@@ -17,7 +17,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-define hidden ptr @main.unsafeSliceData(ptr %s.data, i32 %s.len, i32 %s.cap, ptr %context) unnamed_addr #2 {
+define hidden ptr @main.unsafeSliceData(ptr %s.data, i32 range(i32 0, 536870912) %s.len, i32 range(i32 0, 536870912) %s.cap, ptr %context) unnamed_addr #2 {
 entry:
   %stackalloc = alloca i8, align 1
   call void @runtime.trackPointer(ptr %s.data, ptr nonnull %stackalloc, ptr undef) #3
@@ -50,7 +50,7 @@ unsafe.String.throw:                              ; preds = %entry
 declare void @runtime.unsafeSlicePanic(ptr) #1
 
 ; Function Attrs: nounwind
-define hidden ptr @main.unsafeStringData(ptr readonly %s.data, i32 %s.len, ptr %context) unnamed_addr #2 {
+define hidden ptr @main.unsafeStringData(ptr readonly %s.data, i32 range(i32 0, -2147483648) %s.len, ptr %context) unnamed_addr #2 {
 entry:
   %stackalloc = alloca i8, align 1
   call void @runtime.trackPointer(ptr %s.data, ptr nonnull %stackalloc, ptr undef) #3

compiler/testdata/go1.21.ll

@@ -90,7 +90,7 @@ entry:
 declare double @llvm.minimum.f64(double, double) #3
 
 ; Function Attrs: nounwind
-define hidden %runtime._string @main.minString(ptr readonly %a.data, i32 %a.len, ptr readonly %b.data, i32 %b.len, ptr %context) unnamed_addr #2 {
+define hidden %runtime._string @main.minString(ptr readonly %a.data, i32 range(i32 0, -2147483648) %a.len, ptr readonly %b.data, i32 range(i32 0, -2147483648) %b.len, ptr %context) unnamed_addr #2 {
 entry:
   %0 = insertvalue %runtime._string zeroinitializer, ptr %a.data, 0
   %1 = insertvalue %runtime._string %0, i32 %a.len, 1
@@ -104,7 +104,7 @@ entry:
   ret %runtime._string %5
 }
 
-declare i1 @runtime.stringLess(ptr readonly, i32, ptr readonly, i32, ptr) #1
+declare i1 @runtime.stringLess(ptr readonly, i32 range(i32 0, -2147483648), ptr readonly, i32 range(i32 0, -2147483648), ptr) #1
 
 ; Function Attrs: nounwind
 define hidden i32 @main.maxInt(i32 %a, i32 %b, ptr %context) unnamed_addr #2 {
@@ -137,7 +137,7 @@ entry:
 declare float @llvm.maximum.f32(float, float) #3
 
 ; Function Attrs: nounwind
-define hidden %runtime._string @main.maxString(ptr readonly %a.data, i32 %a.len, ptr readonly %b.data, i32 %b.len, ptr %context) unnamed_addr #2 {
+define hidden %runtime._string @main.maxString(ptr readonly %a.data, i32 range(i32 0, -2147483648) %a.len, ptr readonly %b.data, i32 range(i32 0, -2147483648) %b.len, ptr %context) unnamed_addr #2 {
 entry:
   %0 = insertvalue %runtime._string zeroinitializer, ptr %a.data, 0
   %1 = insertvalue %runtime._string %0, i32 %a.len, 1
@@ -152,9 +152,9 @@ entry:
 }
 
 ; Function Attrs: nounwind
-define hidden void @main.clearSlice(ptr %s.data, i32 %s.len, i32 %s.cap, ptr %context) unnamed_addr #2 {
+define hidden void @main.clearSlice(ptr %s.data, i32 range(i32 0, 536870912) %s.len, i32 range(i32 0, 536870912) %s.cap, ptr %context) unnamed_addr #2 {
 entry:
-  %0 = shl i32 %s.len, 2
+  %0 = shl nuw nsw i32 %s.len, 2
   call void @llvm.memset.p0.i32(ptr align 4 %s.data, i8 0, i32 %0, i1 false)
   ret void
 }
@@ -163,7 +163,7 @@ entry:
 declare void @llvm.memset.p0.i32(ptr nocapture writeonly, i8, i32, i1 immarg) #4
 
 ; Function Attrs: nounwind
-define hidden void @main.clearZeroSizedSlice(ptr %s.data, i32 %s.len, i32 %s.cap, ptr %context) unnamed_addr #2 {
+define hidden void @main.clearZeroSizedSlice(ptr %s.data, i32 range(i32 0, -2147483648) %s.len, i32 range(i32 0, -2147483648) %s.cap, ptr %context) unnamed_addr #2 {
 entry:
   ret void
 }

compiler/testdata/goroutine-cortex-m-qemu-tasks.ll

@@ -132,7 +132,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-define hidden void @main.copyBuiltinGoroutine(ptr %dst.data, i32 %dst.len, i32 %dst.cap, ptr %src.data, i32 %src.len, i32 %src.cap, ptr %context) unnamed_addr #1 {
+define hidden void @main.copyBuiltinGoroutine(ptr %dst.data, i32 range(i32 0, -2147483648) %dst.len, i32 range(i32 0, -2147483648) %dst.cap, ptr %src.data, i32 range(i32 0, -2147483648) %src.len, i32 range(i32 0, -2147483648) %src.cap, ptr %context) unnamed_addr #1 {
 entry:
   %copy.n = call i32 @llvm.umin.i32(i32 %dst.len, i32 %src.len)
   call void @llvm.memmove.p0.p0.i32(ptr align 1 %dst.data, ptr align 1 %src.data, i32 %copy.n, i1 false)

compiler/testdata/goroutine-wasm-asyncify.ll

@@ -141,7 +141,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-define hidden void @main.copyBuiltinGoroutine(ptr %dst.data, i32 %dst.len, i32 %dst.cap, ptr %src.data, i32 %src.len, i32 %src.cap, ptr %context) unnamed_addr #2 {
+define hidden void @main.copyBuiltinGoroutine(ptr %dst.data, i32 range(i32 0, -2147483648) %dst.len, i32 range(i32 0, -2147483648) %dst.cap, ptr %src.data, i32 range(i32 0, -2147483648) %src.len, i32 range(i32 0, -2147483648) %src.cap, ptr %context) unnamed_addr #2 {
 entry:
   %copy.n = call i32 @llvm.umin.i32(i32 %dst.len, i32 %src.len)
   call void @llvm.memmove.p0.p0.i32(ptr align 1 %dst.data, ptr align 1 %src.data, i32 %copy.n, i1 false)

compiler/testdata/pragma.ll

@@ -85,10 +85,10 @@ entry:
 
 declare void @main.undefinedFunctionNotInSection(ptr) #1
 
-declare void @main.doesNotEscapeParam(ptr nocapture dereferenceable_or_null(4), ptr nocapture, i32, i32, ptr nocapture dereferenceable_or_null(36), ptr nocapture, ptr) #1
+declare void @main.doesNotEscapeParam(ptr nocapture dereferenceable_or_null(4), ptr nocapture, i32 range(i32 0, 536870912), i32 range(i32 0, 536870912), ptr nocapture dereferenceable_or_null(36), ptr nocapture, ptr) #1
 
 ; Function Attrs: nounwind
-define hidden void @main.stillEscapes(ptr dereferenceable_or_null(4) %a, ptr %b.data, i32 %b.len, i32 %b.cap, ptr dereferenceable_or_null(36) %c, ptr %d, ptr %context) unnamed_addr #2 {
+define hidden void @main.stillEscapes(ptr dereferenceable_or_null(4) %a, ptr %b.data, i32 range(i32 0, 536870912) %b.len, i32 range(i32 0, 536870912) %b.cap, ptr dereferenceable_or_null(36) %c, ptr %d, ptr %context) unnamed_addr #2 {
 entry:
   ret void
 }