Possible call targets of indirect calls

Beginners
,
1

I am implementing an interprocedural analysis in LLVM for C++ programs. For that, I need to get a list of possible call targets for each indirect call in the program. I am okay with the result being imprecise but it should be sound.

#include <iostream>
class X {
    public:
        virtual void vfun() {
            return;
        }
};
class Y : public X {
    public:
        virtual void vfun() {
            return;
        }
};
int main() {
    X *x = new Y();
    x->vfun();
}

For example, in the above code, I should get X::vfun() and Y::vfun() as possible call targets for the virtual call.

Does LLVM provide any API for this purpose? Or is there any open-source tool that will give me this information?

2

How would you handle a class Z : public X in a separate translation unit, or even library?

The existing devirtualisation support in LLVM is probably of interest.

3
  1. You ask Clang for the generated IR:
clang -S -emit-llvm foo.c
  1. In your case you will see VTables, but as Jessica noted there can be classes unknown to you:
    Virtual Methods — Mapping High Level Constructs to LLVM IR documentation
4

Thank you for your reply. I read about the WholeProgramDevirt pass and currently trying to see if it can be used to get possible call targets for virtual calls.

5

Thank you for your reply.

6

Hi, I am also interested in this question. Do you now know how to get all possible functions called indirectly by LLVM?