Type-Alias Analysis: Enabling LLVM IR with Accurate Types
Jinmeng Zhou, Ziyue Pan, Wenbo Shen, Xingkai Wang, Kangjie Lu, Zhiyun Qian · Proceedings of the ACM on software engineering. · 2025
LLVM Intermediate Representation (IR) underpins the LLVM compiler infrastructure, offering a strong type system and a static single-assignment (SSA) form that are well-suited for program analysis. However, its single-type design assigns exactly one type to each IR variable, even when the variable may legitimately correspond to multiple types. The recent introduction of opaque pointers exacerbates this limitation: all pointers in the IR are uniformly represented with a generic pointer type ( ptr ) that erases concrete pointee type information, making many type-based analyses ineffective. To address the limitations of single-type design, we introduce type-alias analysis, a multiple-type design that maintains type-alias sets for IR variables and infers types across IR instructions. We have developed Type Copilot , a prototype that recovers concrete pointee types for opaque-pointer-enabled LLVM IR generated from C programs. Type Copilot achieves 98.57% accuracy with 94.98% coverage, allowing existing analysis tools to retain their effectiveness despite the adoption of opaque pointers. To foster further research and security applications, we have open-sourced Type Copilot , providing the community with a practical foundation for precise, type-aware security analyses on modern LLVM IR.