6
Function *fun = call->getCalledFunction();

getCalledFunction(); returns null if it's indirect call. How can I get the name of the function or the name of the pointer?

I found all questions in Stack Overflow related to this issue talked about function name of direct call, or type of pointer.

I just want to track cases like this one:

void foo(){}
void goo(){}
void main(){
  int x = 1;
  void (*p)();
  if(x)
    p = &foo;
  else
    p = &goo;
  p(); // print the called function name
}
6
  • When you say "Indirect function", are you referring to a function pointer or a member function? Where are you looking at this? I'm fairly sure you can't find the name of the function itself if it's through a function pointer. Whether you can determine the name of the pointer, I'm not sure. It would really help to have some IR or source [or even better both] to understand what exactly you are trying to solve. Commented Feb 22, 2015 at 0:52
  • Yes, function pointer. I'm trying to print all called functions including ones called through function pointer.
    – Dalia
    Commented Feb 22, 2015 at 9:59
  • 1
    That may not be possible without following ALL the code back to the origin of the pointer (which in turn becomes a "halting problem" - data or indeterminable function results may control whether function pointer is set to A or B or C....). You can perhaps say that "This function [which calls the function pointer P] is called by F1, F2 and F3, which may set the function pointer to A, B or C" - but it's hard work. You'll definitely need a call-flow-graph of the entire code [and of course won't work for functions set outside the TU] Commented Feb 22, 2015 at 10:18
  • How can I get the name of the pinter?
    – Dalia
    Commented Feb 22, 2015 at 10:42
  • 2
    Not sure, that's why I asked for an example in LLVM IR or C/C++, so that I can look at what you are trying to trace - I may be coming up with something completely different if I use my Pascal compiler as an example. But knowing the function pointer is a very small part of the battle. Consider that the function pointer may be an argument to a function... Commented Feb 22, 2015 at 10:46

3 Answers 3

2

My suggestion would be to use the clang AST visitor, rather than using the LLVM IR.

An example of an AST visitor can be found here:

http://clang.llvm.org/docs/RAVFrontendAction.html

If we dump the AST of the code (compiled as C++ - in C it will be subtly different, since the declaration of func() is the same as func(...)):

$ clang++ -Xclang -ast-dump -fno-color-diagnostics -c funcptr.cpp

TranslationUnitDecl 0x50973b0 <<invalid sloc>> <invalid sloc>
|-TypedefDecl 0x50978f0 <<invalid sloc>> <invalid sloc> implicit __int128_t '__int128'
|-TypedefDecl 0x5097950 <<invalid sloc>> <invalid sloc> implicit __uint128_t 'unsigned __int128'
|-TypedefDecl 0x5097d50 <<invalid sloc>> <invalid sloc> implicit __builtin_va_list '__va_list_tag [1]'
|-FunctionDecl 0x5097df0 <funcptr.cpp:1:1, col:12> col:6 used foo 'void (void)'
| `-CompoundStmt 0x5097e90 <col:11, col:12>
|-FunctionDecl 0x5097ed0 <line:2:1, col:12> col:6 used goo 'void (void)'
| `-CompoundStmt 0x5097f70 <col:11, col:12>
`-FunctionDecl 0x5097fe0 <line:3:1, line:14:1> line:3:5 main 'int (void)'
  `-CompoundStmt 0x50d98b0 <col:11, line:14:1>
    |-DeclStmt 0x50d9548 <line:5:1, col:9>
    | `-VarDecl 0x50d94d0 <col:1, col:8> col:5 used x 'int' cinit
    |   `-IntegerLiteral 0x50d9528 <col:8> 'int' 1
    |-DeclStmt 0x50d9678 <line:6:1, col:12>
    | `-VarDecl 0x50d9620 <col:1, col:11> col:8 used p 'void (*)(void)'
    |-IfStmt 0x50d9818 <line:7:1, line:10:7>
    | |-<<<NULL>>>
    | |-ImplicitCastExpr 0x50d96d0 <line:7:4> '_Bool' <IntegralToBoolean>
    | | `-ImplicitCastExpr 0x50d96b8 <col:4> 'int' <LValueToRValue>
    | |   `-DeclRefExpr 0x50d9690 <col:4> 'int' lvalue Var 0x50d94d0 'x' 'int'
    | |-BinaryOperator 0x50d9758 <line:8:2, col:7> 'void (*)(void)' lvalue '='
    | | |-DeclRefExpr 0x50d96e8 <col:2> 'void (*)(void)' lvalue Var 0x50d9620 'p' 'void (*)(void)'
    | | `-UnaryOperator 0x50d9738 <col:6, col:7> 'void (*)(void)' prefix '&'
    | |   `-DeclRefExpr 0x50d9710 <col:7> 'void (void)' lvalue Function 0x5097df0 'foo' 'void (void)'
    | `-BinaryOperator 0x50d97f0 <line:10:2, col:7> 'void (*)(void)' lvalue '='
    |   |-DeclRefExpr 0x50d9780 <col:2> 'void (*)(void)' lvalue Var 0x50d9620 'p' 'void (*)(void)'
    |   `-UnaryOperator 0x50d97d0 <col:6, col:7> 'void (*)(void)' prefix '&'
    |     `-DeclRefExpr 0x50d97a8 <col:7> 'void (void)' lvalue Function 0x5097ed0 'goo' 'void (void)'
    `-CallExpr 0x50d9888 <line:12:1, col:3> 'void'
      `-ImplicitCastExpr 0x50d9870 <col:1> 'void (*)(void)' <LValueToRValue>
        `-DeclRefExpr 0x50d9848 <col:1> 'void (*)(void)' lvalue Var 0x50d9620 'p' 'void (*)(void)'

Here, we can quite easily see that we're calling p by the CallExpr -> ImplicitCastExpr -> DeclRefExpr. So there you get p. But of course, you'd then have to interpret the code that leads to the assignment of p - which is not too difficult in this case, but imagine that x is not assigned a constant, it would be pretty much impossible to say anything beyond "it may be foo or goo depending on the value of x". It probably still requires a bit of work to backtrack to the assignment of p, but should be doable. You could look for assignments to function pointers (by identifying a pointer, using getPointeeType and then isa<FunctionType> or something like that).

To parse the llvm, you'd have to visit each instruction and find the load that leads to the call - which when using optimisation is done the other way around, by replacing the if (x) p = &foo; else p = &goo; with p = &foo;, and then realizing that p is always set to a single value, so doesn't need to be called via a function pointer [in this simple case]. But LLVM IR doesn't in itself track where the data actually came from. In general, it's a similar principle, it's just that you are further from the source-code, and will have to perform more steps to figure out what the callee is.

The starting point would be a function or module pass, which would be described in this section of the LLVM docs.

http://llvm.org/docs/WritingAnLLVMPass.html

I've not looked at all the details, but I'd say the CallGraphSCCPass may be a good place to start for this, since it starts with the Callee and you can work your way up the callgraph, rather than down it. But maybe not suitable for this particular case, where everything happens within a function - not sure.

And like I said in the comments, for trivial cases this can be done, but good luck trying to follow anything that either depends on user-data or functions that are not compile-time determinable (it is of course compile-time determinable if the result of a function is compile-time determinable - it is compile-time determinable if the source known and all inputs that affect the output are known!)

0
2

I get the same problem. Here is my solution after reading the llvm source code:

Function* fp = CI->getCalledFunction();
if (fp==NULL) {
    Value* v=CI->getCalledValue();
    Value* sv = v->stripPointerCasts();
    StringRef fname = sv->getName();
    errs()<<fname<<"\n";
 }
2
  • This doesn't work for me. I still get NULL values for fname. Any proposals? Commented Aug 3, 2015 at 10:19
  • 2
    This works when you have a direct call but through a bit cast. Not for indirect call.
    – Joky
    Commented Oct 15, 2016 at 23:38
1

Forget about it: this is not possible. It would require perfect alias analysis. If it was possible, LLVM would remove the indirect calls as an optimization.

The case you mention is trivial: LLVM after optimization will turn it into a direct call, and you get the function directly.

If x was a global variable, you may be able to get a list of function name (here foo and goo), but can't know which one will actually be called. But even then, LLVM should be able to do selective indirect call promotion and expose direct calls.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.