Merge pull request #6807 from ethereum/storageKnowledge

Knowledge about storage and memory.

libdevcore/InvertibleMap.h

@@ -20,6 +20,48 @@
 #include <map>
 #include <set>
 
+/**
+ * Data structure that keeps track of values and keys of a mapping.
+ */
+template <class K, class V>
+struct InvertibleMap
+{
+	std::map<K, V> values;
+	// references[x] == {y | values[y] == x}
+	std::map<V, std::set<K>> references;
+
+	void set(K _key, V _value)
+	{
+		if (values.count(_key))
+			references[values[_key]].erase(_key);
+		values[_key] = _value;
+		references[_value].insert(_key);
+	}
+
+	void eraseKey(K _key)
+	{
+		if (values.count(_key))
+			references[values[_key]].erase(_key);
+		values.erase(_key);
+	}
+
+	void eraseValue(V _value)
+	{
+		if (references.count(_value))
+		{
+			for (V v: references[_value])
+				values.erase(v);
+			references.erase(_value);
+		}
+	}
+
+	void clear()
+	{
+		values.clear();
+		references.clear();
+	}
+};
+
 template <class T>
 struct InvertibleRelation
 {

libyul/CMakeLists.txt

@@ -94,6 +94,10 @@ add_library(yul
 	optimiser/FunctionHoister.h
 	optimiser/InlinableExpressionFunctionFinder.cpp
 	optimiser/InlinableExpressionFunctionFinder.h
+	optimiser/KnowledgeBase.cpp
+	optimiser/KnowledgeBase.h
+	optimiser/LoadResolver.cpp
+	optimiser/LoadResolver.h
 	optimiser/MainFunction.cpp
 	optimiser/MainFunction.h
 	optimiser/Metrics.cpp

libyul/Dialect.h

@@ -57,6 +57,12 @@ struct BuiltinFunction
 	bool sideEffectFreeIfNoMSize = false;
 	/// If true, this is the msize instruction.
 	bool isMSize = false;
+	/// If false, storage of the current contract before and after the function is the same
+	/// under every circumstance. If the function does not return, this can be false.
+	bool invalidatesStorage = true;
+	/// If false, memory before and after the function is the same under every circumstance.
+	/// If the function does not return, this can be false.
+	bool invalidatesMemory = true;
 	/// If true, can only accept literals as arguments and they cannot be moved to variables.
 	bool literalArguments = false;
 };

libyul/backends/evm/EVMDialect.cpp

@@ -54,6 +54,8 @@ pair<YulString, BuiltinFunctionForEVM> createEVMFunction(
 	f.sideEffectFree = eth::SemanticInformation::sideEffectFree(_instruction);
 	f.sideEffectFreeIfNoMSize = eth::SemanticInformation::sideEffectFreeIfNoMSize(_instruction);
 	f.isMSize = _instruction == dev::eth::Instruction::MSIZE;
+	f.invalidatesStorage = eth::SemanticInformation::invalidatesStorage(_instruction);
+	f.invalidatesMemory = eth::SemanticInformation::invalidatesMemory(_instruction);
 	f.literalArguments = false;
 	f.instruction = _instruction;
 	f.generateCode = [_instruction](
@@ -76,6 +78,8 @@ pair<YulString, BuiltinFunctionForEVM> createFunction(
 	bool _movable,
 	bool _sideEffectFree,
 	bool _sideEffectFreeIfNoMSize,
+	bool _invalidatesStorage,
+	bool _invalidatesMemory,
 	bool _literalArguments,
 	std::function<void(FunctionCall const&, AbstractAssembly&, BuiltinContext&, std::function<void()>)> _generateCode
 )
@@ -90,6 +94,8 @@ pair<YulString, BuiltinFunctionForEVM> createFunction(
 	f.sideEffectFree = _sideEffectFree;
 	f.sideEffectFreeIfNoMSize = _sideEffectFreeIfNoMSize;
 	f.isMSize = false;
+	f.invalidatesStorage = _invalidatesStorage;
+	f.invalidatesMemory = _invalidatesMemory;
 	f.instruction = {};
 	f.generateCode = std::move(_generateCode);
 	return {name, f};
@@ -110,7 +116,7 @@ map<YulString, BuiltinFunctionForEVM> createBuiltins(langutil::EVMVersion _evmVe
 
 	if (_objectAccess)
 	{
-		builtins.emplace(createFunction("datasize", 1, 1, true, true, true, true, [](
+		builtins.emplace(createFunction("datasize", 1, 1, true, true, true, false, false, true, [](
 			FunctionCall const& _call,
 			AbstractAssembly& _assembly,
 			BuiltinContext& _context,
@@ -131,7 +137,7 @@ map<YulString, BuiltinFunctionForEVM> createBuiltins(langutil::EVMVersion _evmVe
 				_assembly.appendDataSize(_context.subIDs.at(dataName));
 			}
 		}));
-		builtins.emplace(createFunction("dataoffset", 1, 1, true, true, true, true, [](
+		builtins.emplace(createFunction("dataoffset", 1, 1, true, true, true, false, false, true, [](
 			FunctionCall const& _call,
 			AbstractAssembly& _assembly,
 			BuiltinContext& _context,
@@ -152,7 +158,7 @@ map<YulString, BuiltinFunctionForEVM> createBuiltins(langutil::EVMVersion _evmVe
 				_assembly.appendDataOffset(_context.subIDs.at(dataName));
 			}
 		}));
-		builtins.emplace(createFunction("datacopy", 3, 0, false, false, false, false, [](
+		builtins.emplace(createFunction("datacopy", 3, 0, false, false, false, false, true, false, [](
 			FunctionCall const&,
 			AbstractAssembly& _assembly,
 			BuiltinContext&,

libyul/backends/wasm/WasmDialect.cpp

@@ -83,5 +83,7 @@ void WasmDialect::addFunction(string _name, size_t _params, size_t _returns)
 	f.sideEffectFree = false;
 	f.sideEffectFreeIfNoMSize = false;
 	f.isMSize = false;
+	f.invalidatesStorage = true;
+	f.invalidatesMemory = true;
 	f.literalArguments = false;
 }

libyul/optimiser/DataFlowAnalyzer.cpp

@@ -26,21 +26,61 @@
 #include <libyul/optimiser/Semantics.h>
 #include <libyul/Exceptions.h>
 #include <libyul/AsmData.h>
+#include <libyul/backends/evm/EVMDialect.h>
 
 #include <libdevcore/CommonData.h>
 
 #include <boost/range/adaptor/reversed.hpp>
+#include <boost/range/algorithm_ext/erase.hpp>
 
 using namespace std;
 using namespace dev;
 using namespace yul;
 
+
+void DataFlowAnalyzer::operator()(ExpressionStatement& _statement)
+{
+	if (auto vars = isSimpleStore(dev::eth::Instruction::SSTORE, _statement))
+	{
+		ASTModifier::operator()(_statement);
+		m_storage.set(vars->first, vars->second);
+		set<YulString> keysToErase;
+		for (auto const& item: m_storage.values)
+			if (!(
+				m_knowledgeBase.knownToBeDifferent(vars->first, item.first) ||
+				m_knowledgeBase.knownToBeEqual(vars->second, item.second)
+			))
+				keysToErase.insert(item.first);
+		for (YulString const& key: keysToErase)
+			m_storage.eraseKey(key);
+	}
+	else if (auto vars = isSimpleStore(dev::eth::Instruction::MSTORE, _statement))
+	{
+		ASTModifier::operator()(_statement);
+		set<YulString> keysToErase;
+		for (auto const& item: m_memory.values)
+			if (!m_knowledgeBase.knownToBeDifferentByAtLeast32(vars->first, item.first))
+				keysToErase.insert(item.first);
+		// TODO is it fine to do that here?
+		// can we also move the storage above?
+		m_memory.set(vars->first, vars->second);
+		for (YulString const& key: keysToErase)
+			m_memory.eraseKey(key);
+	}
+	else
+	{
+		clearKnowledgeIfInvalidated(_statement.expression);
+		ASTModifier::operator()(_statement);
+	}
+}
+
 void DataFlowAnalyzer::operator()(Assignment& _assignment)
 {
 	set<YulString> names;
 	for (auto const& var: _assignment.variableNames)
 		names.emplace(var.name);
 	assertThrow(_assignment.value, OptimizerException, "");
+	clearKnowledgeIfInvalidated(*_assignment.value);
 	visit(*_assignment.value);
 	handleAssignment(names, _assignment.value.get());
 }
@@ -53,15 +93,24 @@ void DataFlowAnalyzer::operator()(VariableDeclaration& _varDecl)
 	m_variableScopes.back().variables += names;
 
 	if (_varDecl.value)
+	{
+		clearKnowledgeIfInvalidated(*_varDecl.value);
 		visit(*_varDecl.value);
+	}
 
 	handleAssignment(names, _varDecl.value.get());
 }
 
 void DataFlowAnalyzer::operator()(If& _if)
 {
+	clearKnowledgeIfInvalidated(*_if.condition);
+	InvertibleMap<YulString, YulString> storage = m_storage;
+	InvertibleMap<YulString, YulString> memory = m_memory;
+
 	ASTModifier::operator()(_if);
 
+	joinKnowledge(storage, memory);
+
 	Assignments assignments;
 	assignments(_if.body);
 	clearValues(assignments.names());
@@ -69,17 +118,25 @@ void DataFlowAnalyzer::operator()(If& _if)
 
 void DataFlowAnalyzer::operator()(Switch& _switch)
 {
+	clearKnowledgeIfInvalidated(*_switch.expression);
 	visit(*_switch.expression);
 	set<YulString> assignedVariables;
 	for (auto& _case: _switch.cases)
 	{
+		InvertibleMap<YulString, YulString> storage = m_storage;
+		InvertibleMap<YulString, YulString> memory = m_memory;
 		(*this)(_case.body);
+		joinKnowledge(storage, memory);
+
 		Assignments assignments;
 		assignments(_case.body);
 		assignedVariables += assignments.names();
 		// This is a little too destructive, we could retain the old values.
 		clearValues(assignments.names());
+		clearKnowledgeIfInvalidated(_case.body);
 	}
+	for (auto& _case: _switch.cases)
+		clearKnowledgeIfInvalidated(_case.body);
 	clearValues(assignedVariables);
 }
 
@@ -89,8 +146,12 @@ void DataFlowAnalyzer::operator()(FunctionDefinition& _fun)
 	// but this could be difficult if it is subclassed.
 	map<YulString, Expression const*> value;
 	InvertibleRelation<YulString> references;
+	InvertibleMap<YulString, YulString> storage;
+	InvertibleMap<YulString, YulString> memory;
 	m_value.swap(value);
 	swap(m_references, references);
+	swap(m_storage, storage);
+	swap(m_memory, memory);
 	pushScope(true);
 
 	for (auto const& parameter: _fun.parameters)
@@ -105,6 +166,8 @@ void DataFlowAnalyzer::operator()(FunctionDefinition& _fun)
 	popScope();
 	m_value.swap(value);
 	swap(m_references, references);
+	swap(m_storage, storage);
+	swap(m_memory, memory);
 }
 
 void DataFlowAnalyzer::operator()(ForLoop& _for)
@@ -121,11 +184,20 @@ void DataFlowAnalyzer::operator()(ForLoop& _for)
 	assignments(_for.post);
 	clearValues(assignments.names());
 
+	// break/continue are tricky for storage and thus we almost always clear here.
+	clearKnowledgeIfInvalidated(*_for.condition);
+	clearKnowledgeIfInvalidated(_for.post);
+	clearKnowledgeIfInvalidated(_for.body);
+
 	visit(*_for.condition);
 	(*this)(_for.body);
 	clearValues(assignmentsSinceCont.names());
+	clearKnowledgeIfInvalidated(_for.body);
 	(*this)(_for.post);
 	clearValues(assignments.names());
+	clearKnowledgeIfInvalidated(*_for.condition);
+	clearKnowledgeIfInvalidated(_for.post);
+	clearKnowledgeIfInvalidated(_for.body);
 }
 
 void DataFlowAnalyzer::operator()(Block& _block)
@@ -159,7 +231,17 @@ void DataFlowAnalyzer::handleAssignment(set<YulString> const& _variables, Expres
 
 	auto const& referencedVariables = movableChecker.referencedVariables();
 	for (auto const& name: _variables)
+	{
 		m_references.set(name, referencedVariables);
+		// assignment to slot denoted by "name"
+		m_storage.eraseKey(name);
+		// assignment to slot contents denoted by "name"
+		m_storage.eraseValue(name);
+		// assignment to slot denoted by "name"
+		m_memory.eraseKey(name);
+		// assignment to slot contents denoted by "name"
+		m_memory.eraseValue(name);
+	}
 }
 
 void DataFlowAnalyzer::pushScope(bool _functionScope)
@@ -188,7 +270,22 @@ void DataFlowAnalyzer::clearValues(set<YulString> _variables)
 	// This cannot be easily tested since the substitutions will be done
 	// one by one on the fly, and the last line will just be add(1, 1)
 
-	// Clear variables that reference variables to be cleared.
+	// First clear storage knowledge, because we do not have to clear
+	// storage knowledge of variables whose expression has changed,
+	// since the value is still unchanged.
+	for (auto const& name: _variables)
+	{
+		// clear slot denoted by "name"
+		m_storage.eraseKey(name);
+		// clear slot contents denoted by "name"
+		m_storage.eraseValue(name);
+		// assignment to slot denoted by "name"
+		m_memory.eraseKey(name);
+		// assignment to slot contents denoted by "name"
+		m_memory.eraseValue(name);
+	}
+
+	// Also clear variables that reference variables to be cleared.
 	for (auto const& name: _variables)
 		for (auto const& ref: m_references.backward[name])
 			_variables.emplace(ref);
@@ -200,6 +297,53 @@ void DataFlowAnalyzer::clearValues(set<YulString> _variables)
 		m_references.eraseKey(name);
 }
 
+void DataFlowAnalyzer::clearKnowledgeIfInvalidated(Block const& _block)
+{
+	SideEffectsCollector sideEffects(m_dialect, _block);
+	if (sideEffects.invalidatesStorage())
+		m_storage.clear();
+	if (sideEffects.invalidatesMemory())
+		m_memory.clear();
+}
+
+void DataFlowAnalyzer::clearKnowledgeIfInvalidated(Expression const& _expr)
+{
+	SideEffectsCollector sideEffects(m_dialect, _expr);
+	if (sideEffects.invalidatesStorage())
+		m_storage.clear();
+	if (sideEffects.invalidatesMemory())
+		m_memory.clear();
+}
+
+void DataFlowAnalyzer::joinKnowledge(
+	InvertibleMap<YulString, YulString> const& _olderStorage,
+	InvertibleMap<YulString, YulString> const& _olderMemory
+)
+{
+	joinKnowledgeHelper(m_storage, _olderStorage);
+	joinKnowledgeHelper(m_memory, _olderMemory);
+}
+
+void DataFlowAnalyzer::joinKnowledgeHelper(
+	InvertibleMap<YulString, YulString>& _this,
+	InvertibleMap<YulString, YulString> const& _older
+)
+{
+	// We clear if the key does not exist in the older map or if the value is different.
+	// This also works for memory because _older is an "older version"
+	// of m_memory and thus any overlapping write would have cleared the keys
+	// that are not known to be different inside m_memory already.
+	set<YulString> keysToErase;
+	for (auto const& item: _this.values)
+	{
+		auto it = _older.values.find(item.first);
+		if (it == _older.values.end() || it->second != item.second)
+			keysToErase.insert(item.first);
+	}
+	for (auto const& key: keysToErase)
+		_this.eraseKey(key);
+}
+
 bool DataFlowAnalyzer::inScope(YulString _variableName) const
 {
 	for (auto const& scope: m_variableScopes | boost::adaptors::reversed)
@@ -211,3 +355,33 @@ bool DataFlowAnalyzer::inScope(YulString _variableName) const
 	}
 	return false;
 }
+
+boost::optional<pair<YulString, YulString>> DataFlowAnalyzer::isSimpleStore(
+	dev::eth::Instruction _store,
+	ExpressionStatement const& _statement
+) const
+{
+	yulAssert(
+		_store == dev::eth::Instruction::MSTORE ||
+		_store == dev::eth::Instruction::SSTORE,
+		""
+	);
+	if (_statement.expression.type() == typeid(FunctionCall))
+	{
+		FunctionCall const& funCall = boost::get<FunctionCall>(_statement.expression);
+		if (EVMDialect const* dialect = dynamic_cast<EVMDialect const*>(&m_dialect))
+			if (auto const* builtin = dialect->builtin(funCall.functionName.name))
+				if (builtin->instruction == _store)
+					if (
+						funCall.arguments.at(0).type() == typeid(Identifier) &&
+						funCall.arguments.at(1).type() == typeid(Identifier)
+					)
+					{
+						YulString key = boost::get<Identifier>(funCall.arguments.at(0)).name;
+						YulString value = boost::get<Identifier>(funCall.arguments.at(1)).name;
+						return make_pair(key, value);
+					}
+	}
+	return {};
+}
+

libyul/optimiser/DataFlowAnalyzer.h

@@ -23,9 +23,13 @@
 #pragma once
 
 #include <libyul/optimiser/ASTWalker.h>
+#include <libyul/optimiser/KnowledgeBase.h>
 #include <libyul/YulString.h>
 #include <libyul/AsmData.h>
 
+// TODO avoid
+#include <libevmasm/Instruction.h>
+
 #include <libdevcore/InvertibleMap.h>
 
 #include <map>
@@ -42,14 +46,34 @@ struct Dialect;
  *
  * A special zero constant expression is used for the default value of variables.
  *
+ * The class also tracks contents in storage and memory. Both keys and values
+ * are names of variables. Whenever such a variable is re-assigned, the knowledge
+ * is cleared.
+ *
+ * For elementary statements, we check if it is an SSTORE(x, y) / MSTORE(x, y)
+ * If yes, visit the statement. Then record that fact and clear all storage slots t
+ *   where we cannot prove x != t or y == m_storage[t] using the current values of the variables x and t.
+ * Otherwise, determine if the statement invalidates storage/memory. If yes, clear all knowledge
+ * about storage/memory before visiting the statement. Then visit the statement.
+ *
+ * For forward-joining control flow, storage/memory information from the branches is combined.
+ * If the keys or values are different or non-existent in one branch, the key is deleted.
+ * This works also for memory (where addresses overlap) because one branch is always an
+ * older version of the other and thus overlapping contents would have been deleted already
+ * at the point of assignment.
+ *
  * Prerequisite: Disambiguator, ForLoopInitRewriter.
  */
 class DataFlowAnalyzer: public ASTModifier
 {
 public:
-	explicit DataFlowAnalyzer(Dialect const& _dialect): m_dialect(_dialect) {}
+	explicit DataFlowAnalyzer(Dialect const& _dialect):
+		m_dialect(_dialect),
+		m_knowledgeBase(_dialect, m_value)
+	{}
 
 	using ASTModifier::operator();
+	void operator()(ExpressionStatement& _statement) override;
 	void operator()(Assignment& _assignment) override;
 	void operator()(VariableDeclaration& _varDecl) override;
 	void operator()(If& _if) override;
@@ -72,15 +96,46 @@ protected:
 	/// for example at points where control flow is merged.
 	void clearValues(std::set<YulString> _names);
 
+	/// Clears knowledge about storage or memory if they may be modified inside the block.
+	void clearKnowledgeIfInvalidated(Block const& _block);
+
+	/// Clears knowledge about storage or memory if they may be modified inside the expression.
+	void clearKnowledgeIfInvalidated(Expression const& _expression);
+
+	/// Joins knowledge about storage and memory with an older point in the control-flow.
+	/// This only works if the current state is a direct successor of the older point,
+	/// i.e. `_otherStorage` and `_otherMemory` cannot have additional changes.
+	void joinKnowledge(
+		InvertibleMap<YulString, YulString> const& _olderStorage,
+		InvertibleMap<YulString, YulString> const& _olderMemory
+	);
+
+	static void joinKnowledgeHelper(
+		InvertibleMap<YulString, YulString>& _thisData,
+		InvertibleMap<YulString, YulString> const& _olderData
+	);
+
 	/// Returns true iff the variable is in scope.
 	bool inScope(YulString _variableName) const;
 
+	boost::optional<std::pair<YulString, YulString>> isSimpleStore(
+		dev::eth::Instruction _store,
+		ExpressionStatement const& _statement
+	) const;
+
+	Dialect const& m_dialect;
+
 	/// Current values of variables, always movable.
 	std::map<YulString, Expression const*> m_value;
 	/// m_references.forward[a].contains(b) <=> the current expression assigned to a references b
 	/// m_references.backward[b].contains(a) <=> the current expression assigned to a references b
 	InvertibleRelation<YulString> m_references;
 
+	InvertibleMap<YulString, YulString> m_storage;
+	InvertibleMap<YulString, YulString> m_memory;
+
+	KnowledgeBase m_knowledgeBase;
+
 	struct Scope
 	{
 		explicit Scope(bool _isFunction): isFunction(_isFunction) {}
@@ -92,7 +147,6 @@ protected:
 	Expression const m_zero{Literal{{}, LiteralKind::Number, YulString{"0"}, {}}};
 	/// List of scopes.
 	std::vector<Scope> m_variableScopes;
-	Dialect const& m_dialect;
 };
 
 }

libyul/optimiser/KnowledgeBase.cpp

@@ -0,0 +1,88 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/**
+ * Class that can answer questions about values of variables and their relations.
+ */
+
+#include <libyul/optimiser/KnowledgeBase.h>
+
+#include <libyul/AsmData.h>
+#include <libyul/Utilities.h>
+#include <libyul/optimiser/SimplificationRules.h>
+#include <libyul/optimiser/Semantics.h>
+
+#include <libdevcore/CommonData.h>
+
+using namespace yul;
+using namespace dev;
+
+bool KnowledgeBase::knownToBeDifferent(YulString _a, YulString _b)
+{
+	// Try to use the simplification rules together with the
+	// current values to turn `sub(_a, _b)` into a nonzero constant.
+	// If that fails, try `eq(_a, _b)`.
+
+	Expression expr1 = simplify(FunctionCall{{}, {{}, "sub"_yulstring}, make_vector<Expression>(Identifier{{}, _a}, Identifier{{}, _b})});
+	if (expr1.type() == typeid(Literal))
+		return valueOfLiteral(boost::get<Literal>(expr1)) != 0;
+
+	Expression expr2 = simplify(FunctionCall{{}, {{}, "eq"_yulstring}, make_vector<Expression>(Identifier{{}, _a}, Identifier{{}, _b})});
+	if (expr2.type() == typeid(Literal))
+		return valueOfLiteral(boost::get<Literal>(expr2)) == 0;
+
+	return false;
+}
+
+bool KnowledgeBase::knownToBeDifferentByAtLeast32(YulString _a, YulString _b)
+{
+	// Try to use the simplification rules together with the
+	// current values to turn `sub(_a, _b)` into a constant whose absolute value is at least 32.
+
+	Expression expr1 = simplify(FunctionCall{{}, {{}, "sub"_yulstring}, make_vector<Expression>(Identifier{{}, _a}, Identifier{{}, _b})});
+	if (expr1.type() == typeid(Literal))
+	{
+		u256 val = valueOfLiteral(boost::get<Literal>(expr1));
+		return val >= 32 && val <= u256(0) - 32;
+	}
+
+	return false;
+}
+
+Expression KnowledgeBase::simplify(Expression _expression)
+{
+	bool startedRecursion = (m_recursionCounter == 0);
+	dev::ScopeGuard{[&] { if (startedRecursion) m_recursionCounter = 0; }};
+
+	if (startedRecursion)
+		m_recursionCounter = 100;
+	else if (m_recursionCounter == 1)
+		return _expression;
+	else
+		--m_recursionCounter;
+
+	if (_expression.type() == typeid(FunctionCall))
+		for (Expression& arg: boost::get<FunctionCall>(_expression).arguments)
+			arg = simplify(arg);
+	else if (_expression.type() == typeid(FunctionalInstruction))
+		for (Expression& arg: boost::get<FunctionalInstruction>(_expression).arguments)
+			arg = simplify(arg);
+
+	if (auto match = SimplificationRules::findFirstMatch(_expression, m_dialect, m_variableValues))
+		return simplify(match->action().toExpression(locationOf(_expression)));
+
+	return _expression;
+}

libyul/optimiser/KnowledgeBase.h

@@ -0,0 +1,57 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/**
+ * Class that can answer questions about values of variables and their relations.
+ */
+
+#pragma once
+
+#include <libyul/AsmDataForward.h>
+#include <libyul/YulString.h>
+#include <map>
+
+namespace yul
+{
+
+struct Dialect;
+
+/**
+ * Class that can answer questions about values of variables and their relations.
+ *
+ * The reference to the map of values provided at construction is assumed to be updating.
+ */
+class KnowledgeBase
+{
+public:
+	KnowledgeBase(Dialect const& _dialect, std::map<YulString, Expression const*> const& _variableValues):
+		m_dialect(_dialect),
+		m_variableValues(_variableValues)
+	{}
+
+	bool knownToBeDifferent(YulString _a, YulString _b);
+	bool knownToBeDifferentByAtLeast32(YulString _a, YulString _b);
+	bool knownToBeEqual(YulString _a, YulString _b) const { return _a == _b; }
+
+private:
+	Expression simplify(Expression _expression);
+
+	Dialect const& m_dialect;
+	std::map<YulString, Expression const*> const& m_variableValues;
+	size_t m_recursionCounter = 0;
+};
+
+}

libyul/optimiser/LoadResolver.cpp

@@ -0,0 +1,66 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/**
+ * Optimisation stage that replaces expressions of type ``sload(x)`` by the value
+ * currently stored in storage, if known.
+ */
+
+#include <libyul/optimiser/LoadResolver.h>
+
+#include <libyul/backends/evm/EVMDialect.h>
+#include <libyul/optimiser/Semantics.h>
+#include <libyul/AsmData.h>
+
+using namespace std;
+using namespace dev;
+using namespace yul;
+
+void LoadResolver::run(Dialect const& _dialect, Block& _ast)
+{
+	bool containsMSize = SideEffectsCollector(_dialect, _ast).containsMSize();
+	LoadResolver{_dialect, !containsMSize}(_ast);
+}
+
+void LoadResolver::visit(Expression& _e)
+{
+	if (_e.type() == typeid(FunctionCall))
+	{
+		FunctionCall const& funCall = boost::get<FunctionCall>(_e);
+		if (auto const* builtin = dynamic_cast<EVMDialect const&>(m_dialect).builtin(funCall.functionName.name))
+			if (!builtin->parameters.empty() && funCall.arguments.at(0).type() == typeid(Identifier))
+			{
+				YulString key = boost::get<Identifier>(funCall.arguments.at(0)).name;
+				if (
+					builtin->instruction == dev::eth::Instruction::SLOAD &&
+					m_storage.values.count(key)
+				)
+				{
+					_e = Identifier{locationOf(_e), m_storage.values[key]};
+					return;
+				}
+				else if (
+					m_optimizeMLoad &&
+					builtin->instruction == dev::eth::Instruction::MLOAD &&
+					m_memory.values.count(key)
+				)
+				{
+					_e = Identifier{locationOf(_e), m_memory.values[key]};
+					return;
+				}
+			}
+	}
+}

libyul/optimiser/LoadResolver.h

@@ -0,0 +1,57 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/**
+ * Optimisation stage that replaces expressions of type ``sload(x)`` by the value
+ * currently stored in storage, if known.
+ */
+
+#pragma once
+
+#include <libyul/optimiser/DataFlowAnalyzer.h>
+
+namespace yul
+{
+
+struct EVMDialect;
+
+/**
+ * Optimisation stage that replaces expressions of type ``sload(x)`` and ``mload(x)`` by the value
+ * currently stored in storage resp. memory, if known.
+ *
+ * Works best if the code is in SSA form.
+ *
+ * Prerequisite: Disambiguator, ForLoopInitRewriter.
+ */
+class LoadResolver: public DataFlowAnalyzer
+{
+public:
+	static void run(Dialect const& _dialect, Block& _ast);
+
+private:
+	LoadResolver(Dialect const& _dialect, bool _optimizeMLoad):
+		DataFlowAnalyzer(_dialect),
+		m_optimizeMLoad(_optimizeMLoad)
+	{}
+
+protected:
+	using ASTModifier::visit;
+	void visit(Expression& _e) override;
+
+	bool m_optimizeMLoad = false;
+};
+
+}

libyul/optimiser/Semantics.cpp

@@ -63,6 +63,10 @@ void SideEffectsCollector::operator()(FunctionalInstruction const& _instr)
 		m_sideEffectFreeIfNoMSize = false;
 	if (_instr.instruction == eth::Instruction::MSIZE)
 		m_containsMSize = true;
+	if (eth::SemanticInformation::invalidatesStorage(_instr.instruction))
+		m_invalidatesStorage = true;
+	if (eth::SemanticInformation::invalidatesMemory(_instr.instruction))
+		m_invalidatesMemory = true;
 }
 
 void SideEffectsCollector::operator()(FunctionCall const& _functionCall)
@@ -79,12 +83,18 @@ void SideEffectsCollector::operator()(FunctionCall const& _functionCall)
 			m_sideEffectFreeIfNoMSize = false;
 		if (f->isMSize)
 			m_containsMSize = true;
+		if (f->invalidatesStorage)
+			m_invalidatesStorage = true;
+		if (f->invalidatesMemory)
+			m_invalidatesMemory = true;
 	}
 	else
 	{
 		m_movable = false;
 		m_sideEffectFree = false;
 		m_sideEffectFreeIfNoMSize = false;
+		m_invalidatesStorage = true;
+		m_invalidatesMemory = true;
 	}
 }
 

libyul/optimiser/Semantics.h

@@ -54,6 +54,8 @@ public:
 	}
 	bool sideEffectFreeIfNoMSize() const { return m_sideEffectFreeIfNoMSize; }
 	bool containsMSize() const { return m_containsMSize; }
+	bool invalidatesStorage() const { return m_invalidatesStorage; }
+	bool invalidatesMemory() const { return m_invalidatesMemory; }
 
 private:
 	Dialect const& m_dialect;
@@ -69,6 +71,10 @@ private:
 	/// Note that this is a purely syntactic property meaning that even if this is false,
 	/// the code can still contain calls to functions that contain the msize instruction.
 	bool m_containsMSize = false;
+	/// If false, storage is guaranteed to be unchanged by the coded under all
+	/// circumstances.
+	bool m_invalidatesStorage = false;
+	bool m_invalidatesMemory = false;
 };
 
 /**

test/libyul/YulOptimizerTest.cpp

@@ -35,6 +35,7 @@
 #include <libyul/optimiser/FullInliner.h>
 #include <libyul/optimiser/ForLoopConditionIntoBody.h>
 #include <libyul/optimiser/ForLoopInitRewriter.h>
+#include <libyul/optimiser/LoadResolver.h>
 #include <libyul/optimiser/MainFunction.h>
 #include <libyul/optimiser/NameDisplacer.h>
 #include <libyul/optimiser/Rematerialiser.h>
@@ -252,6 +253,21 @@ TestCase::TestResult YulOptimizerTest::run(ostream& _stream, string const& _line
 		SSATransform::run(*m_ast, nameDispenser);
 		RedundantAssignEliminator::run(*m_dialect, *m_ast);
 	}
+	else if (m_optimizerStep == "loadResolver")
+	{
+		disambiguate();
+		ForLoopInitRewriter{}(*m_ast);
+		NameDispenser nameDispenser{*m_dialect, *m_ast};
+		ExpressionSplitter{*m_dialect, nameDispenser}(*m_ast);
+		CommonSubexpressionEliminator{*m_dialect}(*m_ast);
+		ExpressionSimplifier::run(*m_dialect, *m_ast);
+
+		LoadResolver::run(*m_dialect, *m_ast);
+
+		UnusedPruner::runUntilStabilised(*m_dialect, *m_ast);
+		ExpressionJoiner::run(*m_ast);
+		ExpressionJoiner::run(*m_ast);
+	}
 	else if (m_optimizerStep == "controlFlowSimplifier")
 	{
 		disambiguate();

test/libyul/yulOptimizerTests/fullSuite/storage.yul

@@ -0,0 +1,15 @@
+{
+    sstore(4, 5)
+    sstore(4, 3)
+    sstore(8, sload(4))
+}
+// ====
+// step: fullSuite
+// ----
+// {
+//     {
+//         sstore(4, 5)
+//         sstore(4, 3)
+//         sstore(8, sload(4))
+//     }
+// }

test/libyul/yulOptimizerTests/loadResolver/memory_with_different_kinds_of_invalidation.yul

@@ -0,0 +1,38 @@
+{
+    mstore(2, 9)
+    sstore(0, mload(2))
+    pop(call(0, 0, 0, 0, 0, 0, 0))
+    sstore(0, mload(2))
+
+    mstore(2, 10)
+    mstore8(calldataload(0), 4)
+    sstore(0, mload(2))
+
+    mstore(2, 10)
+    g()
+    sstore(0, mload(2))
+
+    function g() {}
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _1 := 9
+//     let _2 := 2
+//     mstore(_2, _1)
+//     let _4 := _1
+//     let _5 := 0
+//     sstore(_5, _4)
+//     pop(call(_5, _5, _5, _5, _5, _5, _5))
+//     sstore(_5, mload(_2))
+//     let _17 := 10
+//     mstore(_2, _17)
+//     mstore8(calldataload(_5), 4)
+//     sstore(_5, mload(_2))
+//     mstore(_2, _17)
+//     g()
+//     sstore(_5, mload(_2))
+//     function g()
+//     { }
+// }

test/libyul/yulOptimizerTests/loadResolver/memory_with_msize.yul

@@ -0,0 +1,17 @@
+{
+    // No mload removal because of msize
+    mstore(calldataload(0), msize())
+    let t := mload(calldataload(10))
+    let q := mload(calldataload(0))
+    sstore(t, q)
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _1 := msize()
+//     let _3 := calldataload(0)
+//     mstore(_3, _1)
+//     let t := mload(calldataload(10))
+//     sstore(t, mload(_3))
+// }

test/libyul/yulOptimizerTests/loadResolver/merge_known_write.yul

@@ -0,0 +1,22 @@
+{
+    mstore(calldataload(0), calldataload(10))
+    if calldataload(1) {
+        mstore(calldataload(0), 1)
+    }
+    let t := mload(0)
+    let q := mload(calldataload(0))
+    sstore(t, q)
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _2 := calldataload(10)
+//     let _3 := 0
+//     let _4 := calldataload(_3)
+//     mstore(_4, _2)
+//     let _5 := 1
+//     if calldataload(_5) { mstore(_4, _5) }
+//     let t := mload(_3)
+//     sstore(t, mload(_4))
+// }

test/libyul/yulOptimizerTests/loadResolver/merge_known_write_with_distance.yul

@@ -0,0 +1,20 @@
+{
+    mstore(calldataload(0), calldataload(10))
+    if calldataload(1) {
+        mstore(add(calldataload(0), 0x20), 1)
+    }
+    let t := mload(add(calldataload(0), 0x20))
+    let q := mload(calldataload(0))
+    sstore(t, q)
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _2 := calldataload(10)
+//     let _4 := calldataload(0)
+//     mstore(_4, _2)
+//     let _5 := 1
+//     if calldataload(_5) { mstore(add(_4, 0x20), _5) }
+//     sstore(mload(add(_4, 0x20)), _2)
+// }

test/libyul/yulOptimizerTests/loadResolver/merge_unknown_write.yul

@@ -0,0 +1,22 @@
+{
+    mstore(calldataload(0), calldataload(10))
+    if calldataload(1) {
+        mstore(0, 1)
+    }
+    let t := mload(0)
+    let q := mload(calldataload(0))
+    sstore(t, q)
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _2 := calldataload(10)
+//     let _3 := 0
+//     let _4 := calldataload(_3)
+//     mstore(_4, _2)
+//     let _5 := 1
+//     if calldataload(_5) { mstore(_3, _5) }
+//     let t := mload(_3)
+//     sstore(t, mload(_4))
+// }

test/libyul/yulOptimizerTests/loadResolver/reassign.yul

@@ -0,0 +1,16 @@
+{
+    let a := calldataload(0)
+    sstore(a, 6)
+    a := calldataload(2)
+    mstore(0, sload(a))
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _1 := 0
+//     let a := calldataload(_1)
+//     sstore(a, 6)
+//     a := calldataload(2)
+//     mstore(_1, sload(a))
+// }

test/libyul/yulOptimizerTests/loadResolver/reassign_value_expression.yul

@@ -0,0 +1,32 @@
+{
+    let x := calldataload(1)
+    let a := add(x, 10)
+    sstore(a, 7)
+    // This clears the expression assigned to ``a`` but
+    // should not clear storage knowledge
+    x := 9
+    mstore(sload(a), 11)
+    // This, on the other hand, actually clears knowledge
+    a := 33
+    mstore(sload(a), 11)
+    // Try again with different expression to avoid
+    // clearing because we cannot know if it is different
+    a := 39
+    mstore(sload(a), 11)
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let x := calldataload(1)
+//     let a := add(x, 10)
+//     let _3 := 7
+//     sstore(a, _3)
+//     x := 9
+//     let _4 := 11
+//     mstore(_3, _4)
+//     a := 33
+//     mstore(sload(a), _4)
+//     a := 39
+//     mstore(sload(a), _4)
+// }

test/libyul/yulOptimizerTests/loadResolver/second_mstore_with_delta.yul

@@ -0,0 +1,24 @@
+{
+    let x := calldataload(1)
+    let a := add(x, 10)
+    let b := add(x, 42)
+    mstore(a, 7)
+    // does not invalidate the first store, because the
+    // difference is larger than 32, even if the absolute
+    // values are unknown
+    mstore(b, 8)
+    sstore(mload(a), mload(b))
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let x := calldataload(1)
+//     let a := add(x, 10)
+//     let b := add(x, 42)
+//     let _4 := 7
+//     mstore(a, _4)
+//     let _5 := 8
+//     mstore(b, _5)
+//     sstore(_4, _5)
+// }

test/libyul/yulOptimizerTests/loadResolver/second_store.yul

@@ -0,0 +1,19 @@
+{
+    let x := calldataload(1)
+    sstore(x, 7)
+    sstore(calldataload(0), 6)
+    // We cannot replace this because we do not know
+    // if the two slots are different.
+    mstore(0, sload(x))
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let x := calldataload(1)
+//     sstore(x, 7)
+//     let _3 := 6
+//     let _4 := 0
+//     sstore(calldataload(_4), _3)
+//     mstore(_4, sload(x))
+// }

test/libyul/yulOptimizerTests/loadResolver/second_store_same_value.yul

@@ -0,0 +1,19 @@
+{
+    let x := calldataload(1)
+    sstore(x, 7)
+    sstore(calldataload(0), 7)
+    // We can replace this because both values that were
+    // written are 7.
+    mstore(0, sload(x))
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let x := calldataload(1)
+//     let _2 := 7
+//     sstore(x, _2)
+//     let _4 := 0
+//     sstore(calldataload(_4), _2)
+//     mstore(_4, _2)
+// }

test/libyul/yulOptimizerTests/loadResolver/second_store_with_delta.yul

@@ -0,0 +1,24 @@
+{
+    let x := calldataload(1)
+    let a := add(x, 10)
+    let b := add(x, 20)
+    sstore(a, 7)
+    // does not invalidate the first store, because the
+    // difference is a constant, even if the absolute
+    // values are unknown
+    sstore(b, 8)
+    mstore(sload(a), sload(b))
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let x := calldataload(1)
+//     let a := add(x, 10)
+//     let b := add(x, 20)
+//     let _4 := 7
+//     sstore(a, _4)
+//     let _5 := 8
+//     sstore(b, _5)
+//     mstore(_4, _5)
+// }

test/libyul/yulOptimizerTests/loadResolver/simple.yul

@@ -0,0 +1,14 @@
+{
+    sstore(calldataload(0), calldataload(10))
+    let t := sload(calldataload(10))
+    let q := sload(calldataload(0))
+    mstore(t, q)
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _2 := calldataload(10)
+//     sstore(calldataload(0), _2)
+//     mstore(sload(_2), _2)
+// }

test/libyul/yulOptimizerTests/loadResolver/simple_memory.yul

@@ -0,0 +1,14 @@
+{
+    mstore(calldataload(0), calldataload(10))
+    let t := mload(calldataload(10))
+    let q := mload(calldataload(0))
+    sstore(t, q)
+}
+// ====
+// step: loadResolver
+// ----
+// {
+//     let _2 := calldataload(10)
+//     mstore(calldataload(0), _2)
+//     sstore(mload(_2), _2)
+// }