FaultMaps and implicit checks

    For example, Java requires null checks on objects before they are readfrom or written to. If the object is then aNullPointerException has to be thrown, interrupting normalexecution. In practice, however, dereferencing a null pointer isextremely rare in well-behaved Java programs, and typically the nullcheck can be folded into a nearby memory operation that operates onthe same memory location.

    Information about implicit checks generated by LLVM are put in aspecial “fault map” section. On Darwin this section is named__llvm_faultmaps.

    The format of this section is

    The ImplicitNullChecks pass transforms explicit control flow forchecking if a pointer is null, like:

    to control flow implicit in the instruction loading or storing throughthe pointer being null checked:

    This transform happens at the MachineInstr level, not the LLVM IRlevel (so the above example is only representative, not literal). The pass runs during codegen, if-enable-implicit-null-checks is passed to llc.

    Making null checks implicit is an aggressive optimization, and it canbe a net performance pessimization if too many memory operations endup faulting because of it. A language runtime typically needs toensure that only a negligible number of implicit null checks actuallyfault once the application has reached a steady state. A standard wayof doing this is by healing failed implicit null checks into explicitnull checks via code patching or recompilation. It follows that thereare two requirements an explicit null check needs to satisfy for it tobe profitable to convert it to an implicit null check:

    1. The case where the pointer is actually null (i.e. the “failing”case) is extremely rare.

    The frontend is expected to mark branches that satisfy (1) and (2)using a metadata node (the actual content of themetadata node is ignored). Only branches that are marked with!make.implicit metadata are considered as candidates forconversion into implicit null checks.

    (Note that while we could deal with (1) using profiling data, dealingwith (2) requires some information not present in branch profiles.)