Accurate Call Graph Extraction of Programs with Function Pointers Using Type Signatures

The use of pointers presents serious problems for software productivity tools for software understanding, restructuring, and testing. Pointers enable indirect memory accesses through pointer dereferences, as well as indirect procedure calls (e.g., through function pointers in C). Such indirect accesses and calls can be disambiguated with pointer analysis. In this paper we evaluate the precision of one specific pointer analysis (the FA pointer analysis by Zhang et al.) for the purposes of call graph construction for C programs with function pointers. The analysis is incorporated in a production-strength code-browsing tool from Siemens Corporate Research in which the program call graph is used as a primary tool for code understanding. The FA pointer analysis uses an inexpensive, almost-linear, flow- and context-insensitive algorithm. To measure analysis precision, we compare the call graph constructed by this analysis with the most precise call graph obtainable by a large category of existing pointer analyses. Surprisingly, for all our data programs the FA analysis achieves the best possible precision. This result indicates that for the purposes of call graph construction, inexpensive pointer analyses may provide precision comparable to the precision of expensive pointer analyses.

Program slicing is a potentially useful analysis for aiding program understanding. However, in reality even slices of small programs are often too large to be useful. Imprecise pointer analyses have been suggested as one cause of this problem. In this paper, we use dynamic points-to data, which represents optimistic pointer information, to obtain a bound on the best case slice size improvement that can be achieved with improved pointer precision. Our experiments show that slice size can be reduced significantly for programs that make frequent use of calls through function pointers because for them the dynamic pointer data results in a considerably smaller call graph, which leads to fewer data dependences. Programs without or with only few calls through function pointers, however, show considerably less improvement. We discovered that C programs appear to have a significant fraction of direct and nonspurious pointer data dependences so that reducing spurious dependences via pointers is only of limited benefit. Consequently, to make slicing useful in general for such programs, improvements beyond better pointer analyses are necessary. On the other hand, since we show that collecting dynamic function pointer information can be performed with little overhead (average slowdown of 10 percent for our benchmarks), dynamic pointer information may be a practical approach to making slicing of programs with frequent function pointer use more successful in practice.

How to detect and classify the huge malware samples received every day is a major challenge of security area. In recent years, using function call graph to detect and classify malicious software has become a feasible method. As the basic technology of call graph construction, function pointer analysis becomes more noticeable. Previous works often use the result of pointer analysis to determine the possible targets of function pointer calls. However, the inherent complexity and efficiency problem of the pointer analysis often leads to unsatisfactory results when applied to practical programs. This paper presents a strong connected component (SCC) level flow-sensitive and context-sensitive function pointer analysis algorithm (referred as FP algorithm). This algorithm not only makes up for the speed deficiency of pointer analysis, but also obtains higher precision. Measurements for 8 practical C programs show that FP algorithm advances 42.6 times on average compared with DSA algorithm and the precision is also improved.

In the evolving landscape of software development, where maintaining and understanding complex systems is increasingly challenging, call graph techniques play a critical role in enhancing software comprehension by providing a visual and structural representation of function calls within a system. This paper explores the role of call graphs in simplifying software maintenance and debugging. It highlights how call graphs significantly improve developers’ understanding of system architectures and function interactions, reducing the time spent on manual code exploration. Furthermore, the paper explores recent advancements in call graph techniques, particularly the integration of machine learning and deep learning models with traditional call graph approaches. This hybrid methodology demonstrates enhanced accuracy and relevance in tasks such as program comprehension and code refactoring, making it a valuable tool for modern software engineering practices.

Informally, a call graph represents calls between entities in a given program. The call graphs that compilers compute to determine the applicability of an optimization must typically be conservative: a call may be omitted only if it can never occur in any execution of the program. Numerous software engineering tools also extract call graphs with the expectation that they will help software engineers increase their understanding of a program. The requirements placed on software engineering tools that compute call graphs are typically more relaxed than for compilers. For example, some false negatives—calls that can in fact take place in some execution of the program, but which are omitted from the call graph—may be acceptable, depending on the understanding task at hand. In this article, we empirically show a consequence of this spectrum of requirements by comparing the C call graphs extracted from three software systems (mapmaker, mosaic, and gcc) by nine tools (cflow, cawk, CIA, Field, GCT, Imagix, LSME, Mawk, and Rigiparse). A quantitative analysis of the call graphs extracted for each system shows considerable variation, a result that is counterintuitive to many experienced software engineers. A qualitative analysis of these results reveals a number of reasons for this variation: differing treatments of macros, function pointers, input formats, etc. The fundamental problem is not that variances among the graphs extracted by different tools exist, but that software engineers have little sense of the dimensions of approximation in any particular call graph. In this article, we describe and discuss the study, sketch a design space for static call graph extractors, and discuss the impact of our study on practitioners, tool developers, and researchers. Although this article considers only one kind of information, call graphs, many of the observations also apply to static extractors of other kinds of information, such as inheritance structures, file dependences, and references to global variables.

Multi-core based systems are ubiquitous in data centers. Efficient exploitation of hardware parallelism supported by such systems is imperative on multiple fronts: minimizing latency and power consumption and maximizing throughput. This in turn calls for advanced program analysis and optimization. Call graphs have been long used to this end. Although several static call graph extraction techniques have been proposed in the past, these techniques cannot be applied to analyze programs already running in production. Likewise, the existing dynamic call graph extraction tools have limited use in production owing to, say (but not limited to), lack of support for capturing wall clock time spent in functions of a given program and lack of means to analyze the call graph information captured at run time. In this paper, we present a Pin-based dynamic call graph extraction framework called Trin-Trin. The framework enables extraction of complete, precise and dynamic call graphs. Additionally, the framework can be used seamlessly with already running applications. Furthermore, an analytics engine is provided to facilitate advanced program analysis, e.g., different multithreading context(s) of any function can be extracted in a demand-driven fashion. We evaluate the overhead of Trin-Trin using several Unix utilities, applications from the industry-standard SPEC CINT2006, CFP2006 benchmark suite and Yahoo! properties. Additionally, we present a case study to illustrate how Trin-Trin can be used to analyze performance bottlenecks and performance regressions.

Call graph construction serves as a foundational component in Python static analysis and software engineering. However, it faces significant challenges due to the language's unique characteristics. That is, the dynamic typing system, extensive use of third-party libraries, and runtime-dependent behaviors in Python create substantial obstacles for traditional static analysis methods. Although these methods typically achieve high precision, they suffer from low recall, making it difficult to strike a balance between soundness and precision. In this paper, we present InferCG , a hybrid framework that addresses these limitations by combining coarse-grained static analysis with large language model (LLM)–based semantic reasoning. InferCG first constructs a high-recall candidate call set using permissive name- and arity-based matching, and then employs powerful LLMs such as DeepSeek and Qwen to semantically filter implausible edges. This two-stage design balances recall and precision without requiring dynamic execution or extensive type annotations. Experiments on curated open-source Python projects and the DyPyBench benchmark demonstrate that InferCG outperforms state-of-the-art static tools, which achieves up to 13.9% improvement in average recall and a 5.0% gain in average F1 score over PyCG. Moreover, in a real-world vulnerable-function detection scenario, InferCG enables more accurate reachability analysis than dependency-based tools.

Points-to analysis is a static program analysis aiming at analyzing the reference structure of dynamically allocated objects at compile-time. It constitutes the basis for many analyses and optimizations in software engineering and compiler construction. Sparse program representations, such as Whole Program Points-to Graph (WPP2G) and Points-to SSA (P2SSA), represent only dataflow that is directly relevant for points-to analysis. They have proved to be practical in terms of analysis precision and efficiency. However, intra-procedural control flow information is removed from these representations, which sacrifices analysis precision to improve analysis performance. We show an approach for keeping control flow related information even in sparse program representations by representing control flow effects as operations on the data transferred, i.e., as dataflow information. These operations affect distinct paths of the program differently, thus yielding a certain degree of path-sensitivity. Our approach works with both WPP2G and P2SSA representations. We apply the approach to P2SSA-based and flow-sensitive points-to analysis and evaluate a context-insensitive and a context-sensitive variant. We assess our approach using abstract precision metrics. Moreover, we investigate the precision improvements and performance penalties when used as an input to three source-code-level analyses: dead code, cast safety, and null pointer analysis.

Onboard SPOT 5, the HRS instrument systematically collects stereopairs around the Globe since 2002. Each stereopair can encompass an area up to 600 km x 120 km within a single pass (i.e. 72 000 km2 stereoscopic strips). From this time, SPOT 5 stereoscopic imagery becomes one of main satellite data sources for accurate DEM extraction. Spot Image and French National Cartographic Institute (IGN) decided in 2002 to design and build a worldwide accurate database called Reference3DTM using HRS data. This database consists of three information layers: Digital Elevation Model at 1-arc-second resolution (DTED level 2), Orthoimage at 5m resolution and Quality Masks. Huge efforts have been made to standardize the process in order to offer affordable prices. From 2002 to 2008, the targeted accuracies were 16mCE90 for circular horizontal accuracy, and 10mLE90 for elevation accuracy. These accuracy requirements were achieved without any control points nor map support, as demonstrated by numerous scientific assessments of the Reference3D products performed by independent users. The introduction of the paper briefly reminds the most significant assessments performed by major players within the geospatial community, and more specifically the one by ImageONE Co., Ltd.(Tokyo) on two Reference3D geocells over the Northern coast of Japan, Hokkaido province. This work was published in 2008 during the last Beijing ISPRS congress. In 2009, it was decided to introduce reliable GCPs within the Reference3D production process, to increase the horizontal accuracy down to 10mCE90. In addition, two new layers were added to the product, which provide the user with i) the horizontal accuracy for every single pixel of the Reference3D orthoimage and ii) the vertical accuracy for every single elevation value within the Reference3D DEM. The paper shows how the extensive use of ICESat data, correctly selected and filtered, brings extremely valuable information regarding the effective vertical accuracy, and how ICESat data allows to fully quantify the elevation accuracy of a dataset. This will be illustrated by the presentation of the V&V works that took place over the above quoted 2 geocells in Hokkaido province. In conclusion, we present the road map for the update of the whole Reference3D database, which currently spreads over more than 45 millions of sq. km. (being more than 4,200 1° by 1° geocells), already funded and started up to 2014, towards 80 M km2 of Reference3D products.

Large language models (LLMs) have transformed software development by enabling automated code generation, yet they frequently suffer from systematic errors that limit practical deployment. We identify two critical failure modes: \textit{logical hallucination} (incorrect control/data-flow reasoning) and \textit{schematic hallucination} (type mismatches, signature violations, and architectural inconsistencies). These errors stem from the absence of explicit, queryable representations of repository-wide semantics. This paper presents \textbf{\framework}, a novel framework for code generation that addresses these limitations through knowledge graph-guided constraint satisfaction. Our approach proceeds in four integrated stages: (1) constructing heterogeneous repository knowledge graphs that capture both static analysis and dynamic execution traces; (2) learning neural query planners that extract task-relevant context from these graphs; (3) employing satisfiability modulo theories (SMT)-guided beam search to ensure generated code satisfies semantic constraints; and (4) maintaining graph fidelity through continual incremental updates. Our comprehensive evaluation on \dataset, a curated benchmark of 4,250 repository-level tasks across 50 Python projects, demonstrates significant improvements over state-of-the-art baselines: 49.8\% Pass@1 (18.1\% absolute improvement), 52\% reduction in schematic hallucination, and 31\% reduction in logical hallucination. Cross-repository generalization analysis shows strong transfer capabilities with only 4.3\% average performance degradation across architectural patterns. These results establish new benchmarks for repository-level code generation while providing theoretical foundations and practical tools for semantically-aware automated software development. The explicit semantic representation and constraint satisfaction framework introduced in \framework\ enables more reliable automated development tools and provides a foundation for future advances in AI-assisted software engineering.

Points-to information is essential in software engineering, including compiler optimization, instruction-level parallelism, program verification, and so on. The propagating of points-to information along paths of a program can be viewed as the “frame problem” in a dynamic world. As a primary knowledge representing and reasoning tool in Artificial Intelligence, Answer Set Programming (ASP) provides a natural and concise way to express the frame problem. We present a collection of ASP rules to model the propagating of points-to information along paths of an object-oriented program. With these rules and basic facts of a program, points-to information at each program point can be computed easily. This makes it possible to acquire useful information for program analysis through existing ASP solvers.KeywordsAnswer Set Programmingknowledge representing and reasoningpoints-to analysisobject-oriented language

To function on programs written in languages such as C that make extensive use of pointers, automated software engineering tools require safe alias information. Existing alias-analysis techniques that are sufficiently efficient for analysis on large software systems may provide alias information that is too imprecise for tools that use it: the imprecision of the alias information may (1) reduce the precision of the information provided by the tools and (2) increase the cost of the tools. This paper presents a flow-insensitive, context-sensitive points-to analysis algorithm that computes alias information that is almost as precise as that computed by Andersen’s algorithm — the most precise flow- and context-insensitive algorithm — and almost as efficient as Steensgaard’s algorithm — the most efficient flow- and context-insensitive algorithm. Our empirical studies show that our algorithm scales to large programs better than Andersen’s algorithm and show that flow-insensitive alias analysis algorithms, such as our algorithm and Andersen’s algorithm, can compute alias information that is close in precision to that computed by the more expensive flow- and context-sensitive alias analysis algorithms.

We will demonstrate several advanced refactorings for Java that have been implemented in the context of the Eclipse development environment for Java (see www.eclipse.org). These refactorings are semantics-preserving program transformations that are typical of the sorts of transformations object-oriented programmers perform manually in order to improve the structure of existing code, and to promote reuse, clarity, and extensibility.Our demonstration will consist of three parts: (i) a quick review of the implementation in Eclipse of several widely-used refactorings such as Extract Method, Introduce Factory and Change Method Signature as described in Fowler's seminal book on refactoring, (ii) a demonstration of generalization-related refactorings such as Extract Interface, for extracting an interface from a class in order to reduce client dependencies on implementation particulars, and Generalize Type, for remediating over-specific declarations, and (iii) a demonstration of Genericize Container Uses, a refactoring that we are currently developing for migrating occurrences of standard container classes such as ArrayList or HashMap in a user's program to instantiations of the generic versions of these container classes in Java 1.5 (e.g., ArrayList). This involves determining the element types that flow into each container object, modifying their declarations and allocations sites where possible, and removing casts that have been rendered redundant.The latter two categories of refactorings involve non-trivial static analysis, as well as challenging usability issues from a software engineering perspective, which reflect the complications that programmers face when performing the transformations manually. Therefore, during each demonstration, we will give a brief overview of the technical challenges that the refactorings present, along with highlights of the approach we took in addressing them. In particular, we will briefly describe a new piece of Eclipse infrastructure designed to help implement various kinds of context-sensitive and context-insensitive type and pointer analyses for Java.