diff --git a/poolalloc/test/dsa/callgraph/addrtaken_caller.ll b/poolalloc/test/dsa/callgraph/addrtaken_caller.ll
new file mode 100644
index 0000000..0715184
--- /dev/null
+++ b/poolalloc/test/dsa/callgraph/addrtaken_caller.ll
@@ -0,0 +1,50 @@
+;RUN: dsaopt %s -dsa-td -analyze -check-callees=run_func,f1
+;RUN: dsaopt %s -dsa-td -analyze -check-not-callees=run_func,main2
+
+;XFAIL: *
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+@.str = private unnamed_addr constant [10 x i8] c"Main: %p\0A\00", align 1
+@.str1 = private unnamed_addr constant [10 x i8] c"Sum:  %d\0A\00", align 1
+
+; Function Attrs: nounwind uwtable
+define internal i32 @main(i32 %argc, i8** %argv) #0 {
+entry:
+	%call = call i32 @main2(i32 %argc, i8** %argv)
+	ret i32 %call
+}
+
+define internal i32 @main2(i32 %argc, i8** %argv) #0 {
+entry:
+  %call = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i32 0, i32 0), i32 (i32, i8**)* @main2)
+  %call1 = call i32 @foo()
+  %call2 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str1, i32 0, i32 0), i32 %call1)
+  ret i32 0
+}
+
+declare i32 @printf(i8*, ...)
+
+; Function Attrs: noinline nounwind uwtable
+define internal i32 @foo() #1 {
+entry:
+  %call = call i32 @run_func(i32 (i32, i32)* @f1, i32 1, i32 2)
+  ret i32 %call
+}
+
+; Function Attrs: noinline nounwind uwtable
+define internal i32 @run_func(i32 (i32, i32)* %fptr, i32 %arg1, i32 %arg2) #1 {
+entry:
+  %call = call i32 %fptr(i32 %arg1, i32 %arg2)
+  ret i32 %call
+}
+
+; Function Attrs: noinline nounwind uwtable
+define internal i32 @f1(i32 %arg1, i32 %arg2) #1 {
+entry:
+  %add = add nsw i32 %arg1, %arg2
+  ret i32 %add
+}
+
+attributes #0 = { nounwind uwtable }
+attributes #1 = { noinline nounwind uwtable }
diff --git a/poolalloc/test/dsa/callgraph/addrtaken_main.ll b/poolalloc/test/dsa/callgraph/addrtaken_main.ll
new file mode 100644
index 0000000..74c8786
--- /dev/null
+++ b/poolalloc/test/dsa/callgraph/addrtaken_main.ll
@@ -0,0 +1,44 @@
+;RUN: dsaopt %s -dsa-td -analyze -check-callees=run_func,f1
+;RUN: dsaopt %s -dsa-td -analyze -check-not-callees=run_func,main
+
+;XFAIL: *
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+@.str = private unnamed_addr constant [10 x i8] c"Main: %p\0A\00", align 1
+@.str1 = private unnamed_addr constant [10 x i8] c"Sum:  %d\0A\00", align 1
+
+; Function Attrs: nounwind uwtable
+define internal i32 @main(i32 %argc, i8** %argv) #0 {
+entry:
+  %call = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i32 0, i32 0), i32 (i32, i8**)* @main)
+  %call1 = call i32 @foo()
+  %call2 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str1, i32 0, i32 0), i32 %call1)
+  ret i32 0
+}
+
+declare i32 @printf(i8*, ...)
+
+; Function Attrs: noinline nounwind uwtable
+define internal i32 @foo() #1 {
+entry:
+  %call = call i32 @run_func(i32 (i32, i32)* @f1, i32 1, i32 2)
+  ret i32 %call
+}
+
+; Function Attrs: noinline nounwind uwtable
+define internal i32 @run_func(i32 (i32, i32)* %fptr, i32 %arg1, i32 %arg2) #1 {
+entry:
+  %call = call i32 %fptr(i32 %arg1, i32 %arg2)
+  ret i32 %call
+}
+
+; Function Attrs: noinline nounwind uwtable
+define internal i32 @f1(i32 %arg1, i32 %arg2) #1 {
+entry:
+  %add = add nsw i32 %arg1, %arg2
+  ret i32 %add
+}
+
+attributes #0 = { nounwind uwtable }
+attributes #1 = { noinline nounwind uwtable }
diff --git a/poolalloc/test/dsa/callgraph/decode.ll b/poolalloc/test/dsa/callgraph/decode.ll
new file mode 100644
index 0000000..e2a6438
--- /dev/null
+++ b/poolalloc/test/dsa/callgraph/decode.ll
@@ -0,0 +1,58 @@
+;RUN: dsaopt %s -dsa-td -analyze -check-callees=decode,C2
+;RUN: dsaopt %s -dsa-td -analyze -check-not-callees=decode,A1,B2,main,decode
+
+;XFAIL: *
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+%struct.msg = type { void (i32, i32)*, i32 }
+
+@q = common global void (i32)* null, align 8
+
+; Function Attrs: nounwind uwtable
+define i32 @main() #0 {
+entry:
+  %call = call noalias i8* @malloc(i64 16) #2
+  %0 = bitcast i8* %call to %struct.msg*
+  store void (i32)* @A1, void (i32)** @q, align 8
+  %p = getelementptr inbounds %struct.msg, %struct.msg* %0, i32 0, i32 0
+  store void (i32, i32)* @B2, void (i32, i32)** %p, align 8
+  call void @decode(void (i32, i32)* @C2)
+  ret i32 0
+}
+
+; Function Attrs: nounwind
+declare noalias i8* @malloc(i64) #1
+
+; Function Attrs: nounwind uwtable
+define internal void @A1(i32 %a) #0 {
+entry:
+  ret void
+}
+
+; Function Attrs: nounwind uwtable
+define internal void @B2(i32 %a, i32 %b) #0 {
+entry:
+  ret void
+}
+
+; Function Attrs: nounwind uwtable
+define internal void @decode(void (i32, i32)* %decoder_f) #0 {
+entry:
+  call void %decoder_f(i32 1, i32 2)
+  ret void
+}
+
+; Function Attrs: nounwind uwtable
+define internal void @C2(i32 %a, i32 %b) #0 {
+entry:
+  ret void
+}
+
+attributes #0 = { nounwind uwtable "less-precise-fpmad"="false" "no-frame-pointer-elim"="true" "no-frame-pointer-elim-non-leaf" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+sse,+sse2" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #1 = { nounwind "less-precise-fpmad"="false" "no-frame-pointer-elim"="true" "no-frame-pointer-elim-non-leaf" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+sse,+sse2" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #2 = { nounwind }
+
+!llvm.ident = !{!0}
+
+!0 = !{!"clang version 3.7.0 (git@github.com:llvm-mirror/clang.git c7f06de7cf01e7552da38e08a0a410c71fbc6837) (git@github.com:llvm-mirror/llvm.git 1fd101c86df4dd321a53bdd80fe5ca106f3f76e2)"}