A Cocktail Approach to Practical Call Graph Construction
summary
Build named Coral prototype combines a cheap pre-analysis, a two-stage flow-insensitive pipeline and selective expensive refinement to resolve function-pointer targets. Evaluation on 20 large C projects shows the workflow makes about 80% of indirect calls precise without costly context-sensitive analysis, spending negligible pre-analysis time and then scaling to 1.2M LOC in 1 hour with 20 GB. Precision matches Andersen-style baselines, finds 12 confirmed bugs (6 involving indirect calls).
AI-written summary · about
chapters (11)
- 0:00Call graph construction intro
- 0:44Why call graph matters
- 2:11Indirect calls in C
- 3:14Precision and efficiency dilemmas in pointer analysis
- 5:21Key insights
- 6:25Stationary function pointers
- 8:57Detecting indirect calls early
- 10:21Multi-stage workflow
- 12:29Evaluation setup
- 13:56Results and scalability
- 15:02Q&A
related talks
11mCG-Bench: Can Language Models Assist Call Graph Construction in the Real World?
50mGuide Refactorings With Behavioral Code Analysis
47mExploring a complex codebase with AI
24mReturn of CFA: Call-Site Sensitivity Can Be Superior to Object Sensitivity Even
36mSpecification-Guided Component-Based Synthesis from Effectful Libraries
01h 00mSOAP - Keynote: Formal Reasoning and the Hacker Way
14mShow Me Why It's Correct: Saving 1/3 of Debugging Time in Program Repair with(…)
01h 06mOn-The-Fly Verification via Incremental, Interactive Abstract Interpretation wi...