title: How to get the arguments of a function pointer from a CallExpr in Clang?
body: <p>I am trying to analyse C source code with function calls within them. I am able to analyse normal function calls to get their arguments without problem using the source code below where ce is a <code>CallExpr</code> object:</p>
  
  <pre><code>1.  if(ce != NULL) {            
  2.      QualType q = ce-&gt;getType();
  3.      const Type *t = q.getTypePtrOrNull();
  4.
  5.      if (t != NULL) {
  6.          llvm::errs() &lt;&lt; "TYPE: " &lt;&lt; t-&gt;isFunctionPointerType() &lt;&lt; " " &lt;&lt; q.getAsString() &lt;&lt; " " &lt;&lt; t-&gt;isPointerType() &lt;&lt; "\n";
  7.      } else {
  8.          llvm::errs() &lt;&lt; "FUNCTION CE HAS NO TYPE?\n";
  9.      }
  10.
  11.
  12.     const Decl* D = ce -&gt;getCalleeDecl();
  13.     while(D-&gt;getPreviousDecl() != NULL) 
  14.         D = D-&gt;getPreviousDecl();
  15.         
  16.     llvm::errs() &lt;&lt; "Kind:  " &lt;&lt; D-&gt;getDeclKindName() &lt;&lt; "\n";
  17.     
  18.     FunctionDecl* fd = (FunctionDecl*) llvm::dyn_cast&lt;FunctionDecl&gt;(D);
  19.     for(int x = 0; x&lt; fd -&gt;getNumParams(); x++) {
  20.         if(fd -&gt;getParamDecl(x)-&gt;getType()-&gt;isAnyPointerType()) {
  21.             // Do Stuff Here
  22.         } 
  23.     }
  24. }
  </code></pre>
  
  <p>The problem with the above source code comes on line 18, when I try to typecast the Decl from the <code>CallExpr</code> to a <code>FunctionDecl</code>, this results in fd becoming <code>NULL</code> if the <code>CallExpr</code> is from a function pointer call.</p>
  
  <p>I tried to debug by trying to print the kind on line 16. For function pointers, it specifies the <code>Decl on 12</code> is a <code>VarDecl</code>, not a FunctionDecl like normal function calls.</p>
  
  <p>I also tried using the <code>isFunctionPointerType()</code>, but this is returning false.</p>
  
  <p>Here is a piece of source code that results in a segfault:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  
  int main(int argc, char *argv[]) {
      void* (*mp)(size_t size);
      void *mpp;
  
      mp = &amp;malloc;
      mpp = mp(30);
  
      free(mpp);
      return (0);
  }
  </code></pre>
  
  <p>Is there a way using clang to detect whether a <code>CallExpr</code> is a function pointer call? and if so, how to get a list of the arguments?</p>
  
  <p>I am using <code>clang 3.1</code></p>
  
  <p>Thanks</p>