1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
//! DF-5 - call graph with indirect dispatch resolution.
//!
//! Direct calls are trivial - the graph is built during AP-2 lowering.
//! Indirect calls (fnptr tables, vtables, kernel ops-struct dispatch -
//! `file_operations`, `net_proto_ops`, `proto_ops`, etc.) require
//! points-to (DF-3) to resolve the callee set.
//!
//! The kernel ops-struct pattern is the largest source of false
//! negatives in competing tools. We track every struct literal whose
//! fields are function pointers, index by the struct's type, and when
//! `x->f(...)` appears with `x : struct T *` the callee set is
//! `{ s.f | s is a struct T literal in the program }`.
//!
//! # Implementation
//!
//! The final call-graph bitset per call-site is
//! `direct ∪ (indirect_sites × points_to_closure)`. Both operands are
//! bitsets in the CSR-frontier shape we already own, so the kernel
//! is a per-invocation bitwise OR of two loads plus a bounds check.
//!
//! Soundness: [`MayOver`](super::Soundness::MayOver) - may-analysis.
//!
//! Gate for C19.
#[cfg(any(test, feature = "cpu-parity"))]
mod cpu_oracle;
mod dispatch;
mod program;
mod scratch;
mod tag;
#[cfg(test)]
mod tests;
pub(crate) const OP_ID: &str = "weir::callgraph";
#[cfg(any(test, feature = "cpu-parity"))]
#[allow(deprecated)]
pub(crate) use cpu_oracle::callgraph_build_cpu;
pub use dispatch::{
callgraph_build_borrowed_into_result_with_scratch_via, callgraph_build_borrowed_into_via,
callgraph_build_borrowed_via, callgraph_build_borrowed_with_scratch_via, callgraph_build_via,
};
pub use program::{callgraph_build, callgraph_build_with_count};
pub use scratch::CallgraphBuildScratch;
pub use tag::Callgraph;