My suggestion would be to use the clang AST visitor, rather than using the LLVM IR.
An example of an AST visitor can be found here:
http://clang.llvm.org/docs/RAVFrontendAction.html
If we dump the AST of the code (compiled as C++ - in C it will be subtly different, since the declaration of func()
is the same as func(...)
):
$ clang++ -Xclang -ast-dump -fno-color-diagnostics -c funcptr.cpp
TranslationUnitDecl 0x50973b0 <<invalid sloc>> <invalid sloc>
|-TypedefDecl 0x50978f0 <<invalid sloc>> <invalid sloc> implicit __int128_t '__int128'
|-TypedefDecl 0x5097950 <<invalid sloc>> <invalid sloc> implicit __uint128_t 'unsigned __int128'
|-TypedefDecl 0x5097d50 <<invalid sloc>> <invalid sloc> implicit __builtin_va_list '__va_list_tag [1]'
|-FunctionDecl 0x5097df0 <funcptr.cpp:1:1, col:12> col:6 used foo 'void (void)'
| `-CompoundStmt 0x5097e90 <col:11, col:12>
|-FunctionDecl 0x5097ed0 <line:2:1, col:12> col:6 used goo 'void (void)'
| `-CompoundStmt 0x5097f70 <col:11, col:12>
`-FunctionDecl 0x5097fe0 <line:3:1, line:14:1> line:3:5 main 'int (void)'
`-CompoundStmt 0x50d98b0 <col:11, line:14:1>
|-DeclStmt 0x50d9548 <line:5:1, col:9>
| `-VarDecl 0x50d94d0 <col:1, col:8> col:5 used x 'int' cinit
| `-IntegerLiteral 0x50d9528 <col:8> 'int' 1
|-DeclStmt 0x50d9678 <line:6:1, col:12>
| `-VarDecl 0x50d9620 <col:1, col:11> col:8 used p 'void (*)(void)'
|-IfStmt 0x50d9818 <line:7:1, line:10:7>
| |-<<<NULL>>>
| |-ImplicitCastExpr 0x50d96d0 <line:7:4> '_Bool' <IntegralToBoolean>
| | `-ImplicitCastExpr 0x50d96b8 <col:4> 'int' <LValueToRValue>
| | `-DeclRefExpr 0x50d9690 <col:4> 'int' lvalue Var 0x50d94d0 'x' 'int'
| |-BinaryOperator 0x50d9758 <line:8:2, col:7> 'void (*)(void)' lvalue '='
| | |-DeclRefExpr 0x50d96e8 <col:2> 'void (*)(void)' lvalue Var 0x50d9620 'p' 'void (*)(void)'
| | `-UnaryOperator 0x50d9738 <col:6, col:7> 'void (*)(void)' prefix '&'
| | `-DeclRefExpr 0x50d9710 <col:7> 'void (void)' lvalue Function 0x5097df0 'foo' 'void (void)'
| `-BinaryOperator 0x50d97f0 <line:10:2, col:7> 'void (*)(void)' lvalue '='
| |-DeclRefExpr 0x50d9780 <col:2> 'void (*)(void)' lvalue Var 0x50d9620 'p' 'void (*)(void)'
| `-UnaryOperator 0x50d97d0 <col:6, col:7> 'void (*)(void)' prefix '&'
| `-DeclRefExpr 0x50d97a8 <col:7> 'void (void)' lvalue Function 0x5097ed0 'goo' 'void (void)'
`-CallExpr 0x50d9888 <line:12:1, col:3> 'void'
`-ImplicitCastExpr 0x50d9870 <col:1> 'void (*)(void)' <LValueToRValue>
`-DeclRefExpr 0x50d9848 <col:1> 'void (*)(void)' lvalue Var 0x50d9620 'p' 'void (*)(void)'
Here, we can quite easily see that we're calling p
by the CallExpr
-> ImplicitCastExpr
-> DeclRefExpr
. So there you get p
. But of course, you'd then have to interpret the code that leads to the assignment of p
- which is not too difficult in this case, but imagine that x
is not assigned a constant, it would be pretty much impossible to say anything beyond "it may be foo
or goo
depending on the value of x
". It probably still requires a bit of work to backtrack to the assignment of p
, but should be doable. You could look for assignments to function pointers (by identifying a pointer, using getPointeeType
and then isa<FunctionType>
or something like that).
To parse the llvm, you'd have to visit each instruction and find the load that leads to the call - which when using optimisation is done the other way around, by replacing the if (x) p = &foo; else p = &goo;
with p = &foo;
, and then realizing that p
is always set to a single value, so doesn't need to be called via a function pointer [in this simple case]. But LLVM IR doesn't in itself track where the data actually came from. In general, it's a similar principle, it's just that you are further from the source-code, and will have to perform more steps to figure out what the callee is.
The starting point would be a function or module pass, which would be described in this section of the LLVM docs.
http://llvm.org/docs/WritingAnLLVMPass.html
I've not looked at all the details, but I'd say the CallGraphSCCPass
may be a good place to start for this, since it starts with the Callee and you can work your way up the callgraph, rather than down it. But maybe not suitable for this particular case, where everything happens within a function - not sure.
And like I said in the comments, for trivial cases this can be done, but good luck trying to follow anything that either depends on user-data or functions that are not compile-time determinable (it is of course compile-time determinable if the result of a function is compile-time determinable - it is compile-time determinable if the source known and all inputs that affect the output are known!)