Description
It would be nice if we only inferred types for undefined functions that are actually used. If a function is never used, 3C has no information to base inference on, so converting the function doesn't make much sense. Doing this would reduce the size of the difference before and after conversion, making it easier to validate that the types of the converted functions are accurate, and less rewriting means there will be less opportunity for 3C rewriting bugs to manifest in real use cases.
By "never used" I mean that constraining the parameters of the function to WILD shouldn't result in any other pointers solving to WILD. This could be implemented by doing the root cause analysis using all parameters and returns of undefined functions as the "direct wild" nodes. Any node found to be the root cause of wildness for at least one other node is not constrained to WILD, all other are. The downside to this approach is that it would make our (slow) root cause analysis part of the main inference algorithm, but since here we only need to know if the affected pointers set is non-empty, I think we could get rid of the expensive set unions and achieve much better performance.