MAKO: Refining Indirect-Call Targets with Type Relation Unfolding

Type-based indirect call resolution scales well to large software systems, but type information it uses can lead to a proliferation of infeasible callees and thus compromise precision. Existing precision-enhancing schemes resort to reasoning about reachability between indirect calls and functions to directly remove spurious callees. However, they suffer from insufficient precision or severe performance overhead due to their limited reasoning capabilities.<br/><br/>In this work, we argue that existing approaches overlook the importance of type relations in refining indirect-call targets, and refocus on their validity to eliminate spurious callees within the steps of type-based resolution. To facilitate precise and scalable reduction of invalid type relations, we unfold global type relations to their producer statements and verify their validity for each indirect call via syntax-level reachability between their associated statements and the call itself. With these refined type relations, type-based resolution effectively blocks numerous resolution traces leading to spurious callees while imposing slight overhead. We implemented our approach as Mako, and evaluations demonstrate that it serves as a practical resolver by achieving the best precision across most benchmark programs without any performance breakdowns, thanks to a 59.5% reduction in type relations used for resolving indirect calls and an 80.9% reduction in indirect-call targets with an average process time of 373 seconds. Notably, when supporting value-flow-based bug detection, Mako reduces the reported warnings spanning indirect calls by 19.2%, with acceptable time costs in common industrial settings.