How to detect all free() calls

Hi,
I’m trying to write a pass to detect all free()/delete() call instructions in LLVM IR.The method is as follows.
First I find Call Instructions: CallInst CI=dyn_cast(&i);
then see if the Function name matches:
name=CI->getCalledFunction()->getName(); if(name==“_ZdlPv”||name==“_ZdaPv”||name==“free”)
It worked but when something like this occurs
%call2 = call i32 bitcast (i32 (…)
@free to i32 (i8
))(i8 %call1) nounwind, !dbg !16
It seems like a indirect function call and I don’t know how to detect free() in such situation.
By the way, is there any way that is more convenient to detect all free()/delete() call instructions in a module except by matching the function name?

Try isFreeCall() defined in "llvm/Analysis/MemoryBuiltins.h".

As others have mentioned, to handle situations in which the function pointer is casted before the call, fetch the called SSA value using Function::getCalledValue() and then use the stripPointerCasts() method to remove all the casts. However, that only solves the problem of calls to free() that cast the free() function pointer. It is also possible that an indirect function call calls free() as well. To find those, you’ll need to use the CallGraph interface or, better yet, the DSCallGraph interface from DSA (which is located in the poolalloc project). – John T.