Lint.cpp revision 13ec30b6a1184c590ed93d81764a0314202abeaf
1//===-- Lint.cpp - Check for common errors in LLVM IR ---------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This pass statically checks for common and easily-identified constructs 11// which produce undefined or likely unintended behavior in LLVM IR. 12// 13// It is not a guarantee of correctness, in two ways. First, it isn't 14// comprehensive. There are checks which could be done statically which are 15// not yet implemented. Some of these are indicated by TODO comments, but 16// those aren't comprehensive either. Second, many conditions cannot be 17// checked statically. This pass does no dynamic instrumentation, so it 18// can't check for all possible problems. 19// 20// Another limitation is that it assumes all code will be executed. A store 21// through a null pointer in a basic block which is never reached is harmless, 22// but this pass will warn about it anyway. 23// 24// Optimization passes may make conditions that this pass checks for more or 25// less obvious. If an optimization pass appears to be introducing a warning, 26// it may be that the optimization pass is merely exposing an existing 27// condition in the code. 28// 29// This code may be run before instcombine. In many cases, instcombine checks 30// for the same kinds of things and turns instructions with undefined behavior 31// into unreachable (or equivalent). Because of this, this pass makes some 32// effort to look through bitcasts and so on. 33// 34//===----------------------------------------------------------------------===// 35 36#include "llvm/Analysis/Passes.h" 37#include "llvm/Analysis/AliasAnalysis.h" 38#include "llvm/Analysis/InstructionSimplify.h" 39#include "llvm/Analysis/ConstantFolding.h" 40#include "llvm/Analysis/Dominators.h" 41#include "llvm/Analysis/Lint.h" 42#include "llvm/Analysis/Loads.h" 43#include "llvm/Analysis/ValueTracking.h" 44#include "llvm/Assembly/Writer.h" 45#include "llvm/Target/TargetData.h" 46#include "llvm/Pass.h" 47#include "llvm/PassManager.h" 48#include "llvm/IntrinsicInst.h" 49#include "llvm/Function.h" 50#include "llvm/Support/CallSite.h" 51#include "llvm/Support/Debug.h" 52#include "llvm/Support/InstVisitor.h" 53#include "llvm/Support/raw_ostream.h" 54#include "llvm/ADT/STLExtras.h" 55using namespace llvm; 56 57namespace { 58 namespace MemRef { 59 static unsigned Read = 1; 60 static unsigned Write = 2; 61 static unsigned Callee = 4; 62 static unsigned Branchee = 8; 63 } 64 65 class Lint : public FunctionPass, public InstVisitor<Lint> { 66 friend class InstVisitor<Lint>; 67 68 void visitFunction(Function &F); 69 70 void visitCallSite(CallSite CS); 71 void visitMemoryReference(Instruction &I, Value *Ptr, unsigned Align, 72 const Type *Ty, unsigned Flags); 73 74 void visitCallInst(CallInst &I); 75 void visitInvokeInst(InvokeInst &I); 76 void visitReturnInst(ReturnInst &I); 77 void visitLoadInst(LoadInst &I); 78 void visitStoreInst(StoreInst &I); 79 void visitXor(BinaryOperator &I); 80 void visitSub(BinaryOperator &I); 81 void visitLShr(BinaryOperator &I); 82 void visitAShr(BinaryOperator &I); 83 void visitShl(BinaryOperator &I); 84 void visitSDiv(BinaryOperator &I); 85 void visitUDiv(BinaryOperator &I); 86 void visitSRem(BinaryOperator &I); 87 void visitURem(BinaryOperator &I); 88 void visitAllocaInst(AllocaInst &I); 89 void visitVAArgInst(VAArgInst &I); 90 void visitIndirectBrInst(IndirectBrInst &I); 91 void visitExtractElementInst(ExtractElementInst &I); 92 void visitInsertElementInst(InsertElementInst &I); 93 void visitUnreachableInst(UnreachableInst &I); 94 95 Value *findValue(Value *V, bool OffsetOk) const; 96 Value *findValueImpl(Value *V, bool OffsetOk, 97 SmallPtrSet<Value *, 4> &Visited) const; 98 99 public: 100 Module *Mod; 101 AliasAnalysis *AA; 102 DominatorTree *DT; 103 TargetData *TD; 104 105 std::string Messages; 106 raw_string_ostream MessagesStr; 107 108 static char ID; // Pass identification, replacement for typeid 109 Lint() : FunctionPass(&ID), MessagesStr(Messages) {} 110 111 virtual bool runOnFunction(Function &F); 112 113 virtual void getAnalysisUsage(AnalysisUsage &AU) const { 114 AU.setPreservesAll(); 115 AU.addRequired<AliasAnalysis>(); 116 AU.addRequired<DominatorTree>(); 117 } 118 virtual void print(raw_ostream &O, const Module *M) const {} 119 120 void WriteValue(const Value *V) { 121 if (!V) return; 122 if (isa<Instruction>(V)) { 123 MessagesStr << *V << '\n'; 124 } else { 125 WriteAsOperand(MessagesStr, V, true, Mod); 126 MessagesStr << '\n'; 127 } 128 } 129 130 void WriteType(const Type *T) { 131 if (!T) return; 132 MessagesStr << ' '; 133 WriteTypeSymbolic(MessagesStr, T, Mod); 134 } 135 136 // CheckFailed - A check failed, so print out the condition and the message 137 // that failed. This provides a nice place to put a breakpoint if you want 138 // to see why something is not correct. 139 void CheckFailed(const Twine &Message, 140 const Value *V1 = 0, const Value *V2 = 0, 141 const Value *V3 = 0, const Value *V4 = 0) { 142 MessagesStr << Message.str() << "\n"; 143 WriteValue(V1); 144 WriteValue(V2); 145 WriteValue(V3); 146 WriteValue(V4); 147 } 148 149 void CheckFailed(const Twine &Message, const Value *V1, 150 const Type *T2, const Value *V3 = 0) { 151 MessagesStr << Message.str() << "\n"; 152 WriteValue(V1); 153 WriteType(T2); 154 WriteValue(V3); 155 } 156 157 void CheckFailed(const Twine &Message, const Type *T1, 158 const Type *T2 = 0, const Type *T3 = 0) { 159 MessagesStr << Message.str() << "\n"; 160 WriteType(T1); 161 WriteType(T2); 162 WriteType(T3); 163 } 164 }; 165} 166 167char Lint::ID = 0; 168static RegisterPass<Lint> 169X("lint", "Statically lint-checks LLVM IR", false, true); 170 171// Assert - We know that cond should be true, if not print an error message. 172#define Assert(C, M) \ 173 do { if (!(C)) { CheckFailed(M); return; } } while (0) 174#define Assert1(C, M, V1) \ 175 do { if (!(C)) { CheckFailed(M, V1); return; } } while (0) 176#define Assert2(C, M, V1, V2) \ 177 do { if (!(C)) { CheckFailed(M, V1, V2); return; } } while (0) 178#define Assert3(C, M, V1, V2, V3) \ 179 do { if (!(C)) { CheckFailed(M, V1, V2, V3); return; } } while (0) 180#define Assert4(C, M, V1, V2, V3, V4) \ 181 do { if (!(C)) { CheckFailed(M, V1, V2, V3, V4); return; } } while (0) 182 183// Lint::run - This is the main Analysis entry point for a 184// function. 185// 186bool Lint::runOnFunction(Function &F) { 187 Mod = F.getParent(); 188 AA = &getAnalysis<AliasAnalysis>(); 189 DT = &getAnalysis<DominatorTree>(); 190 TD = getAnalysisIfAvailable<TargetData>(); 191 visit(F); 192 dbgs() << MessagesStr.str(); 193 Messages.clear(); 194 return false; 195} 196 197void Lint::visitFunction(Function &F) { 198 // This isn't undefined behavior, it's just a little unusual, and it's a 199 // fairly common mistake to neglect to name a function. 200 Assert1(F.hasName() || F.hasLocalLinkage(), 201 "Unusual: Unnamed function with non-local linkage", &F); 202} 203 204void Lint::visitCallSite(CallSite CS) { 205 Instruction &I = *CS.getInstruction(); 206 Value *Callee = CS.getCalledValue(); 207 208 visitMemoryReference(I, Callee, 0, 0, MemRef::Callee); 209 210 if (Function *F = dyn_cast<Function>(findValue(Callee, /*OffsetOk=*/false))) { 211 Assert1(CS.getCallingConv() == F->getCallingConv(), 212 "Undefined behavior: Caller and callee calling convention differ", 213 &I); 214 215 const FunctionType *FT = F->getFunctionType(); 216 unsigned NumActualArgs = unsigned(CS.arg_end()-CS.arg_begin()); 217 218 Assert1(FT->isVarArg() ? 219 FT->getNumParams() <= NumActualArgs : 220 FT->getNumParams() == NumActualArgs, 221 "Undefined behavior: Call argument count mismatches callee " 222 "argument count", &I); 223 224 // TODO: Check argument types (in case the callee was casted) 225 226 // TODO: Check ABI-significant attributes. 227 228 // TODO: Check noalias attribute. 229 230 // TODO: Check sret attribute. 231 } 232 233 if (CS.isCall() && cast<CallInst>(CS.getInstruction())->isTailCall()) 234 for (CallSite::arg_iterator AI = CS.arg_begin(), AE = CS.arg_end(); 235 AI != AE; ++AI) { 236 Value *Obj = findValue(*AI, /*OffsetOk=*/true); 237 Assert1(!isa<AllocaInst>(Obj), 238 "Undefined behavior: Call with \"tail\" keyword references " 239 "alloca", &I); 240 } 241 242 243 if (IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I)) 244 switch (II->getIntrinsicID()) { 245 default: break; 246 247 // TODO: Check more intrinsics 248 249 case Intrinsic::memcpy: { 250 MemCpyInst *MCI = cast<MemCpyInst>(&I); 251 visitMemoryReference(I, MCI->getDest(), MCI->getAlignment(), 0, 252 MemRef::Write); 253 visitMemoryReference(I, MCI->getSource(), MCI->getAlignment(), 0, 254 MemRef::Read); 255 256 // Check that the memcpy arguments don't overlap. The AliasAnalysis API 257 // isn't expressive enough for what we really want to do. Known partial 258 // overlap is not distinguished from the case where nothing is known. 259 unsigned Size = 0; 260 if (const ConstantInt *Len = 261 dyn_cast<ConstantInt>(findValue(MCI->getLength(), 262 /*OffsetOk=*/false))) 263 if (Len->getValue().isIntN(32)) 264 Size = Len->getValue().getZExtValue(); 265 Assert1(AA->alias(MCI->getSource(), Size, MCI->getDest(), Size) != 266 AliasAnalysis::MustAlias, 267 "Undefined behavior: memcpy source and destination overlap", &I); 268 break; 269 } 270 case Intrinsic::memmove: { 271 MemMoveInst *MMI = cast<MemMoveInst>(&I); 272 visitMemoryReference(I, MMI->getDest(), MMI->getAlignment(), 0, 273 MemRef::Write); 274 visitMemoryReference(I, MMI->getSource(), MMI->getAlignment(), 0, 275 MemRef::Read); 276 break; 277 } 278 case Intrinsic::memset: { 279 MemSetInst *MSI = cast<MemSetInst>(&I); 280 visitMemoryReference(I, MSI->getDest(), MSI->getAlignment(), 0, 281 MemRef::Write); 282 break; 283 } 284 285 case Intrinsic::vastart: 286 Assert1(I.getParent()->getParent()->isVarArg(), 287 "Undefined behavior: va_start called in a non-varargs function", 288 &I); 289 290 visitMemoryReference(I, CS.getArgument(0), 0, 0, 291 MemRef::Read | MemRef::Write); 292 break; 293 case Intrinsic::vacopy: 294 visitMemoryReference(I, CS.getArgument(0), 0, 0, MemRef::Write); 295 visitMemoryReference(I, CS.getArgument(1), 0, 0, MemRef::Read); 296 break; 297 case Intrinsic::vaend: 298 visitMemoryReference(I, CS.getArgument(0), 0, 0, 299 MemRef::Read | MemRef::Write); 300 break; 301 302 case Intrinsic::stackrestore: 303 // Stackrestore doesn't read or write memory, but it sets the 304 // stack pointer, which the compiler may read from or write to 305 // at any time, so check it for both readability and writeability. 306 visitMemoryReference(I, CS.getArgument(0), 0, 0, 307 MemRef::Read | MemRef::Write); 308 break; 309 } 310} 311 312void Lint::visitCallInst(CallInst &I) { 313 return visitCallSite(&I); 314} 315 316void Lint::visitInvokeInst(InvokeInst &I) { 317 return visitCallSite(&I); 318} 319 320void Lint::visitReturnInst(ReturnInst &I) { 321 Function *F = I.getParent()->getParent(); 322 Assert1(!F->doesNotReturn(), 323 "Unusual: Return statement in function with noreturn attribute", 324 &I); 325 326 if (Value *V = I.getReturnValue()) { 327 Value *Obj = findValue(V, /*OffsetOk=*/true); 328 Assert1(!isa<AllocaInst>(Obj), 329 "Unusual: Returning alloca value", &I); 330 } 331} 332 333// TODO: Add a length argument and check that the reference is in bounds 334void Lint::visitMemoryReference(Instruction &I, 335 Value *Ptr, unsigned Align, const Type *Ty, 336 unsigned Flags) { 337 Value *UnderlyingObject = findValue(Ptr, /*OffsetOk=*/true); 338 Assert1(!isa<ConstantPointerNull>(UnderlyingObject), 339 "Undefined behavior: Null pointer dereference", &I); 340 Assert1(!isa<UndefValue>(UnderlyingObject), 341 "Undefined behavior: Undef pointer dereference", &I); 342 343 if (Flags & MemRef::Write) { 344 if (const GlobalVariable *GV = dyn_cast<GlobalVariable>(UnderlyingObject)) 345 Assert1(!GV->isConstant(), 346 "Undefined behavior: Write to read-only memory", &I); 347 Assert1(!isa<Function>(UnderlyingObject) && 348 !isa<BlockAddress>(UnderlyingObject), 349 "Undefined behavior: Write to text section", &I); 350 } 351 if (Flags & MemRef::Read) { 352 Assert1(!isa<Function>(UnderlyingObject), 353 "Unusual: Load from function body", &I); 354 Assert1(!isa<BlockAddress>(UnderlyingObject), 355 "Undefined behavior: Load from block address", &I); 356 } 357 if (Flags & MemRef::Callee) { 358 Assert1(!isa<BlockAddress>(UnderlyingObject), 359 "Undefined behavior: Call to block address", &I); 360 } 361 if (Flags & MemRef::Branchee) { 362 Assert1(!isa<Constant>(UnderlyingObject) || 363 isa<BlockAddress>(UnderlyingObject), 364 "Undefined behavior: Branch to non-blockaddress", &I); 365 } 366 367 if (TD) { 368 if (Align == 0 && Ty) Align = TD->getABITypeAlignment(Ty); 369 370 if (Align != 0) { 371 unsigned BitWidth = TD->getTypeSizeInBits(Ptr->getType()); 372 APInt Mask = APInt::getAllOnesValue(BitWidth), 373 KnownZero(BitWidth, 0), KnownOne(BitWidth, 0); 374 ComputeMaskedBits(Ptr, Mask, KnownZero, KnownOne, TD); 375 Assert1(!(KnownOne & APInt::getLowBitsSet(BitWidth, Log2_32(Align))), 376 "Undefined behavior: Memory reference address is misaligned", &I); 377 } 378 } 379} 380 381void Lint::visitLoadInst(LoadInst &I) { 382 visitMemoryReference(I, I.getPointerOperand(), I.getAlignment(), I.getType(), 383 MemRef::Read); 384} 385 386void Lint::visitStoreInst(StoreInst &I) { 387 visitMemoryReference(I, I.getPointerOperand(), I.getAlignment(), 388 I.getOperand(0)->getType(), MemRef::Write); 389} 390 391void Lint::visitXor(BinaryOperator &I) { 392 Assert1(!isa<UndefValue>(I.getOperand(0)) || 393 !isa<UndefValue>(I.getOperand(1)), 394 "Undefined result: xor(undef, undef)", &I); 395} 396 397void Lint::visitSub(BinaryOperator &I) { 398 Assert1(!isa<UndefValue>(I.getOperand(0)) || 399 !isa<UndefValue>(I.getOperand(1)), 400 "Undefined result: sub(undef, undef)", &I); 401} 402 403void Lint::visitLShr(BinaryOperator &I) { 404 if (ConstantInt *CI = 405 dyn_cast<ConstantInt>(findValue(I.getOperand(1), /*OffsetOk=*/false))) 406 Assert1(CI->getValue().ult(cast<IntegerType>(I.getType())->getBitWidth()), 407 "Undefined result: Shift count out of range", &I); 408} 409 410void Lint::visitAShr(BinaryOperator &I) { 411 if (ConstantInt *CI = 412 dyn_cast<ConstantInt>(findValue(I.getOperand(1), /*OffsetOk=*/false))) 413 Assert1(CI->getValue().ult(cast<IntegerType>(I.getType())->getBitWidth()), 414 "Undefined result: Shift count out of range", &I); 415} 416 417void Lint::visitShl(BinaryOperator &I) { 418 if (ConstantInt *CI = 419 dyn_cast<ConstantInt>(findValue(I.getOperand(1), /*OffsetOk=*/false))) 420 Assert1(CI->getValue().ult(cast<IntegerType>(I.getType())->getBitWidth()), 421 "Undefined result: Shift count out of range", &I); 422} 423 424static bool isZero(Value *V, TargetData *TD) { 425 // Assume undef could be zero. 426 if (isa<UndefValue>(V)) return true; 427 428 unsigned BitWidth = cast<IntegerType>(V->getType())->getBitWidth(); 429 APInt Mask = APInt::getAllOnesValue(BitWidth), 430 KnownZero(BitWidth, 0), KnownOne(BitWidth, 0); 431 ComputeMaskedBits(V, Mask, KnownZero, KnownOne, TD); 432 return KnownZero.isAllOnesValue(); 433} 434 435void Lint::visitSDiv(BinaryOperator &I) { 436 Assert1(!isZero(I.getOperand(1), TD), 437 "Undefined behavior: Division by zero", &I); 438} 439 440void Lint::visitUDiv(BinaryOperator &I) { 441 Assert1(!isZero(I.getOperand(1), TD), 442 "Undefined behavior: Division by zero", &I); 443} 444 445void Lint::visitSRem(BinaryOperator &I) { 446 Assert1(!isZero(I.getOperand(1), TD), 447 "Undefined behavior: Division by zero", &I); 448} 449 450void Lint::visitURem(BinaryOperator &I) { 451 Assert1(!isZero(I.getOperand(1), TD), 452 "Undefined behavior: Division by zero", &I); 453} 454 455void Lint::visitAllocaInst(AllocaInst &I) { 456 if (isa<ConstantInt>(I.getArraySize())) 457 // This isn't undefined behavior, it's just an obvious pessimization. 458 Assert1(&I.getParent()->getParent()->getEntryBlock() == I.getParent(), 459 "Pessimization: Static alloca outside of entry block", &I); 460} 461 462void Lint::visitVAArgInst(VAArgInst &I) { 463 visitMemoryReference(I, I.getOperand(0), 0, 0, 464 MemRef::Read | MemRef::Write); 465} 466 467void Lint::visitIndirectBrInst(IndirectBrInst &I) { 468 visitMemoryReference(I, I.getAddress(), 0, 0, MemRef::Branchee); 469} 470 471void Lint::visitExtractElementInst(ExtractElementInst &I) { 472 if (ConstantInt *CI = 473 dyn_cast<ConstantInt>(findValue(I.getIndexOperand(), 474 /*OffsetOk=*/false))) 475 Assert1(CI->getValue().ult(I.getVectorOperandType()->getNumElements()), 476 "Undefined result: extractelement index out of range", &I); 477} 478 479void Lint::visitInsertElementInst(InsertElementInst &I) { 480 if (ConstantInt *CI = 481 dyn_cast<ConstantInt>(findValue(I.getOperand(2), 482 /*OffsetOk=*/false))) 483 Assert1(CI->getValue().ult(I.getType()->getNumElements()), 484 "Undefined result: insertelement index out of range", &I); 485} 486 487void Lint::visitUnreachableInst(UnreachableInst &I) { 488 // This isn't undefined behavior, it's merely suspicious. 489 Assert1(&I == I.getParent()->begin() || 490 prior(BasicBlock::iterator(&I))->mayHaveSideEffects(), 491 "Unusual: unreachable immediately preceded by instruction without " 492 "side effects", &I); 493} 494 495/// findValue - Look through bitcasts and simple memory reference patterns 496/// to identify an equivalent, but more informative, value. If OffsetOk 497/// is true, look through getelementptrs with non-zero offsets too. 498/// 499/// Most analysis passes don't require this logic, because instcombine 500/// will simplify most of these kinds of things away. But it's a goal of 501/// this Lint pass to be useful even on non-optimized IR. 502Value *Lint::findValue(Value *V, bool OffsetOk) const { 503 SmallPtrSet<Value *, 4> Visited; 504 return findValueImpl(V, OffsetOk, Visited); 505} 506 507/// findValueImpl - Implementation helper for findValue. 508Value *Lint::findValueImpl(Value *V, bool OffsetOk, 509 SmallPtrSet<Value *, 4> &Visited) const { 510 // Detect self-referential values. 511 if (!Visited.insert(V)) 512 return UndefValue::get(V->getType()); 513 514 // TODO: Look through sext or zext cast, when the result is known to 515 // be interpreted as signed or unsigned, respectively. 516 // TODO: Look through calls with unique return values. 517 // TODO: Look through vector insert/extract/shuffle. 518 V = OffsetOk ? V->getUnderlyingObject() : V->stripPointerCasts(); 519 if (LoadInst *L = dyn_cast<LoadInst>(V)) { 520 BasicBlock::iterator BBI = L; 521 BasicBlock *BB = L->getParent(); 522 SmallPtrSet<BasicBlock *, 4> VisitedBlocks; 523 for (;;) { 524 if (!VisitedBlocks.insert(BB)) break; 525 if (Value *U = FindAvailableLoadedValue(L->getPointerOperand(), 526 BB, BBI, 6, AA)) 527 return findValueImpl(U, OffsetOk, Visited); 528 if (BBI != BB->begin()) break; 529 BB = BB->getUniquePredecessor(); 530 if (!BB) break; 531 BBI = BB->end(); 532 } 533 } else if (CastInst *CI = dyn_cast<CastInst>(V)) { 534 if (CI->isNoopCast(TD ? TD->getIntPtrType(V->getContext()) : 535 Type::getInt64Ty(V->getContext()))) 536 return findValueImpl(CI->getOperand(0), OffsetOk, Visited); 537 } else if (PHINode *PN = dyn_cast<PHINode>(V)) { 538 if (Value *W = PN->hasConstantValue(DT)) 539 return findValueImpl(W, OffsetOk, Visited); 540 } else if (ExtractValueInst *Ex = dyn_cast<ExtractValueInst>(V)) { 541 if (Value *W = FindInsertedValue(Ex->getAggregateOperand(), 542 Ex->idx_begin(), 543 Ex->idx_end())) 544 if (W != V) 545 return findValueImpl(W, OffsetOk, Visited); 546 } 547 548 // As a last resort, try SimplifyInstruction or constant folding. 549 if (Instruction *Inst = dyn_cast<Instruction>(V)) { 550 if (Value *W = SimplifyInstruction(Inst, TD)) 551 if (W != Inst) 552 return findValueImpl(W, OffsetOk, Visited); 553 } else if (ConstantExpr *CE = dyn_cast<ConstantExpr>(V)) { 554 if (Value *W = ConstantFoldConstantExpression(CE, TD)) 555 if (W != V) 556 return findValueImpl(W, OffsetOk, Visited); 557 } 558 559 return V; 560} 561 562//===----------------------------------------------------------------------===// 563// Implement the public interfaces to this file... 564//===----------------------------------------------------------------------===// 565 566FunctionPass *llvm::createLintPass() { 567 return new Lint(); 568} 569 570/// lintFunction - Check a function for errors, printing messages on stderr. 571/// 572void llvm::lintFunction(const Function &f) { 573 Function &F = const_cast<Function&>(f); 574 assert(!F.isDeclaration() && "Cannot lint external functions"); 575 576 FunctionPassManager FPM(F.getParent()); 577 Lint *V = new Lint(); 578 FPM.add(V); 579 FPM.run(F); 580} 581 582/// lintModule - Check a module for errors, printing messages on stderr. 583/// 584void llvm::lintModule(const Module &M) { 585 PassManager PM; 586 Lint *V = new Lint(); 587 PM.add(V); 588 PM.run(const_cast<Module&>(M)); 589} 590