xref: /illumos-gate/usr/src/tools/smatch/src/evaluate.c (revision c85f09cc92abd00c84e58ec9f0f5d942906cb713)
1 /*
2  * sparse/evaluate.c
3  *
4  * Copyright (C) 2003 Transmeta Corp.
5  *               2003-2004 Linus Torvalds
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  *
25  * Evaluate constant expressions.
26  */
27 #include <stdlib.h>
28 #include <stdarg.h>
29 #include <stddef.h>
30 #include <stdio.h>
31 #include <string.h>
32 #include <ctype.h>
33 #include <unistd.h>
34 #include <fcntl.h>
35 #include <limits.h>
36 
37 #include "evaluate.h"
38 #include "lib.h"
39 #include "allocate.h"
40 #include "parse.h"
41 #include "token.h"
42 #include "symbol.h"
43 #include "target.h"
44 #include "expression.h"
45 
46 struct symbol *current_fn;
47 
48 struct ident bad_address_space = { .len = 6, .name = "bad AS", };
49 
50 static struct symbol *degenerate(struct expression *expr);
51 static struct symbol *evaluate_symbol(struct symbol *sym);
52 
valid_expr_type(struct expression * expr)53 static inline int valid_expr_type(struct expression *expr)
54 {
55 	return expr && valid_type(expr->ctype);
56 }
57 
valid_subexpr_type(struct expression * expr)58 static inline int valid_subexpr_type(struct expression *expr)
59 {
60 	return valid_expr_type(expr->left)
61 	    && valid_expr_type(expr->right);
62 }
63 
evaluate_symbol_expression(struct expression * expr)64 static struct symbol *evaluate_symbol_expression(struct expression *expr)
65 {
66 	struct expression *addr;
67 	struct symbol *sym = expr->symbol;
68 	struct symbol *base_type;
69 
70 	if (!sym) {
71 		expression_error(expr, "undefined identifier '%s'", show_ident(expr->symbol_name));
72 		return NULL;
73 	}
74 
75 	examine_symbol_type(sym);
76 
77 	base_type = get_base_type(sym);
78 	if (!base_type) {
79 		expression_error(expr, "identifier '%s' has no type", show_ident(expr->symbol_name));
80 		return NULL;
81 	}
82 
83 	addr = alloc_expression(expr->pos, EXPR_SYMBOL);
84 	addr->symbol = sym;
85 	addr->symbol_name = expr->symbol_name;
86 	addr->ctype = &lazy_ptr_ctype;	/* Lazy evaluation: we need to do a proper job if somebody does &sym */
87 	addr->flags = expr->flags;
88 	expr->type = EXPR_PREOP;
89 	expr->op = '*';
90 	expr->unop = addr;
91 	expr->flags = CEF_NONE;
92 
93 	/* The type of a symbol is the symbol itself! */
94 	expr->ctype = sym;
95 	return sym;
96 }
97 
evaluate_string(struct expression * expr)98 static struct symbol *evaluate_string(struct expression *expr)
99 {
100 	struct symbol *sym = alloc_symbol(expr->pos, SYM_NODE);
101 	struct symbol *array = alloc_symbol(expr->pos, SYM_ARRAY);
102 	struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
103 	struct expression *initstr = alloc_expression(expr->pos, EXPR_STRING);
104 	unsigned int length = expr->string->length;
105 
106 	sym->array_size = alloc_const_expression(expr->pos, length);
107 	sym->bit_size = bytes_to_bits(length);
108 	sym->ctype.alignment = 1;
109 	sym->string = 1;
110 	sym->ctype.modifiers = MOD_STATIC;
111 	sym->ctype.base_type = array;
112 	sym->initializer = initstr;
113 
114 	initstr->ctype = sym;
115 	initstr->string = expr->string;
116 
117 	array->array_size = sym->array_size;
118 	array->bit_size = bytes_to_bits(length);
119 	array->ctype.alignment = 1;
120 	array->ctype.modifiers = MOD_STATIC;
121 	array->ctype.base_type = &char_ctype;
122 
123 	addr->symbol = sym;
124 	addr->ctype = &lazy_ptr_ctype;
125 	addr->flags = CEF_ADDR;
126 
127 	expr->type = EXPR_PREOP;
128 	expr->op = '*';
129 	expr->unop = addr;
130 	expr->ctype = sym;
131 	return sym;
132 }
133 
134 /* type has come from classify_type and is an integer type */
integer_promotion(struct symbol * type)135 static inline struct symbol *integer_promotion(struct symbol *type)
136 {
137 	unsigned long mod =  type->ctype.modifiers;
138 	int width = type->bit_size;
139 
140 	/*
141 	 * Bitfields always promote to the base type,
142 	 * even if the bitfield might be bigger than
143 	 * an "int".
144 	 */
145 	if (type->type == SYM_BITFIELD) {
146 		type = type->ctype.base_type;
147 	}
148 	mod = type->ctype.modifiers;
149 	if (width < bits_in_int)
150 		return &int_ctype;
151 
152 	/* If char/short has as many bits as int, it still gets "promoted" */
153 	if (mod & (MOD_CHAR | MOD_SHORT)) {
154 		if (mod & MOD_UNSIGNED)
155 			return &uint_ctype;
156 		return &int_ctype;
157 	}
158 	return type;
159 }
160 
161 /*
162  * integer part of usual arithmetic conversions:
163  *	integer promotions are applied
164  *	if left and right are identical, we are done
165  *	if signedness is the same, convert one with lower rank
166  *	unless unsigned argument has rank lower than signed one, convert the
167  *	signed one.
168  *	if signed argument is bigger than unsigned one, convert the unsigned.
169  *	otherwise, convert signed.
170  *
171  * Leaving aside the integer promotions, that is equivalent to
172  *	if identical, don't convert
173  *	if left is bigger than right, convert right
174  *	if right is bigger than left, convert right
175  *	otherwise, if signedness is the same, convert one with lower rank
176  *	otherwise convert the signed one.
177  */
bigger_int_type(struct symbol * left,struct symbol * right)178 static struct symbol *bigger_int_type(struct symbol *left, struct symbol *right)
179 {
180 	unsigned long lmod, rmod;
181 
182 	left = integer_promotion(left);
183 	right = integer_promotion(right);
184 
185 	if (left == right)
186 		goto left;
187 
188 	if (left->bit_size > right->bit_size)
189 		goto left;
190 
191 	if (right->bit_size > left->bit_size)
192 		goto right;
193 
194 	lmod = left->ctype.modifiers;
195 	rmod = right->ctype.modifiers;
196 	if ((lmod ^ rmod) & MOD_UNSIGNED) {
197 		if (lmod & MOD_UNSIGNED)
198 			goto left;
199 	} else if ((lmod & ~rmod) & (MOD_LONG_ALL))
200 		goto left;
201 right:
202 	left = right;
203 left:
204 	return left;
205 }
206 
same_cast_type(struct symbol * orig,struct symbol * new)207 static int same_cast_type(struct symbol *orig, struct symbol *new)
208 {
209 	return orig->bit_size == new->bit_size &&
210 	       orig->bit_offset == new->bit_offset;
211 }
212 
base_type(struct symbol * node,unsigned long * modp,struct ident ** asp)213 static struct symbol *base_type(struct symbol *node, unsigned long *modp, struct ident **asp)
214 {
215 	unsigned long mod = 0;
216 	struct ident *as = NULL;
217 
218 	while (node) {
219 		mod |= node->ctype.modifiers;
220 		combine_address_space(node->pos, &as, node->ctype.as);
221 		if (node->type == SYM_NODE) {
222 			node = node->ctype.base_type;
223 			continue;
224 		}
225 		break;
226 	}
227 	*modp = mod & ~MOD_IGNORE;
228 	*asp = as;
229 	return node;
230 }
231 
is_same_type(struct expression * expr,struct symbol * new)232 static int is_same_type(struct expression *expr, struct symbol *new)
233 {
234 	struct symbol *old = expr->ctype;
235 	unsigned long oldmod, newmod;
236 	struct ident *oldas, *newas;
237 
238 	old = base_type(old, &oldmod, &oldas);
239 	new = base_type(new, &newmod, &newas);
240 
241 	/* Same base type, same address space? */
242 	if (old == new && oldas == newas) {
243 		unsigned long difmod;
244 
245 		/* Check the modifier bits. */
246 		difmod = (oldmod ^ newmod) & ~MOD_NOCAST;
247 
248 		/* Exact same type? */
249 		if (!difmod)
250 			return 1;
251 
252 		/*
253 		 * Not the same type, but differs only in "const".
254 		 * Don't warn about MOD_NOCAST.
255 		 */
256 		if (difmod == MOD_CONST)
257 			return 0;
258 	}
259 	if ((oldmod | newmod) & MOD_NOCAST) {
260 		const char *tofrom = "to/from";
261 		if (!(newmod & MOD_NOCAST))
262 			tofrom = "from";
263 		if (!(oldmod & MOD_NOCAST))
264 			tofrom = "to";
265 		warning(expr->pos, "implicit cast %s nocast type", tofrom);
266 	}
267 	return 0;
268 }
269 
270 static void
warn_for_different_enum_types(struct position pos,struct symbol * typea,struct symbol * typeb)271 warn_for_different_enum_types (struct position pos,
272 			       struct symbol *typea,
273 			       struct symbol *typeb)
274 {
275 	if (!Wenum_mismatch)
276 		return;
277 	if (typea->type == SYM_NODE)
278 		typea = typea->ctype.base_type;
279 	if (typeb->type == SYM_NODE)
280 		typeb = typeb->ctype.base_type;
281 
282 	if (typea == typeb)
283 		return;
284 
285 	if (typea->type == SYM_ENUM && typeb->type == SYM_ENUM) {
286 		warning(pos, "mixing different enum types");
287 		info(pos, "    %s versus", show_typename(typea));
288 		info(pos, "    %s", show_typename(typeb));
289 	}
290 }
291 
292 static int cast_flags(struct expression *expr, struct expression *target);
293 static struct symbol *cast_to_bool(struct expression *expr);
294 
295 /*
296  * This gets called for implicit casts in assignments and
297  * integer promotion. We often want to try to move the
298  * cast down, because the ops involved may have been
299  * implicitly cast up, and we can get rid of the casts
300  * early.
301  */
cast_to(struct expression * old,struct symbol * type)302 static struct expression * cast_to(struct expression *old, struct symbol *type)
303 {
304 	struct expression *expr;
305 
306 	warn_for_different_enum_types (old->pos, old->ctype, type);
307 
308 	if (old->ctype != &null_ctype && is_same_type(old, type))
309 		return old;
310 
311 	/*
312 	 * See if we can simplify the op. Move the cast down.
313 	 */
314 	switch (old->type) {
315 	case EXPR_PREOP:
316 		if (old->ctype->bit_size < type->bit_size)
317 			break;
318 		if (old->op == '~') {
319 			old->ctype = type;
320 			old->unop = cast_to(old->unop, type);
321 			return old;
322 		}
323 		break;
324 
325 	case EXPR_IMPLIED_CAST:
326 		warn_for_different_enum_types(old->pos, old->ctype, type);
327 
328 		if (old->ctype->bit_size >= type->bit_size) {
329 			struct expression *orig = old->cast_expression;
330 			if (same_cast_type(orig->ctype, type))
331 				return orig;
332 			if (old->ctype->bit_offset == type->bit_offset) {
333 				old->ctype = type;
334 				old->cast_type = type;
335 				return old;
336 			}
337 		}
338 		break;
339 
340 	default:
341 		/* nothing */;
342 	}
343 
344 	expr = alloc_expression(old->pos, EXPR_IMPLIED_CAST);
345 	expr->ctype = type;
346 	expr->cast_type = type;
347 	expr->cast_expression = old;
348 	expr->flags = cast_flags(expr, old);
349 
350 	if (is_bool_type(type))
351 		cast_to_bool(expr);
352 
353 	return expr;
354 }
355 
356 enum {
357 	TYPE_NUM = 1,
358 	TYPE_BITFIELD = 2,
359 	TYPE_RESTRICT = 4,
360 	TYPE_FLOAT = 8,
361 	TYPE_PTR = 16,
362 	TYPE_COMPOUND = 32,
363 	TYPE_FOULED = 64,
364 	TYPE_FN = 128,
365 };
366 
classify_type(struct symbol * type,struct symbol ** base)367 static inline int classify_type(struct symbol *type, struct symbol **base)
368 {
369 	static int type_class[SYM_BAD + 1] = {
370 		[SYM_PTR] = TYPE_PTR,
371 		[SYM_FN] = TYPE_PTR | TYPE_FN,
372 		[SYM_ARRAY] = TYPE_PTR | TYPE_COMPOUND,
373 		[SYM_STRUCT] = TYPE_COMPOUND,
374 		[SYM_UNION] = TYPE_COMPOUND,
375 		[SYM_BITFIELD] = TYPE_NUM | TYPE_BITFIELD,
376 		[SYM_RESTRICT] = TYPE_NUM | TYPE_RESTRICT,
377 		[SYM_FOULED] = TYPE_NUM | TYPE_RESTRICT | TYPE_FOULED,
378 	};
379 	if (type->type == SYM_NODE)
380 		type = type->ctype.base_type;
381 	if (type->type == SYM_TYPEOF) {
382 		type = evaluate_expression(type->initializer);
383 		if (!type)
384 			type = &bad_ctype;
385 		else if (type->type == SYM_NODE)
386 			type = type->ctype.base_type;
387 	}
388 	if (type->type == SYM_ENUM)
389 		type = type->ctype.base_type;
390 	*base = type;
391 	if (type->type == SYM_BASETYPE) {
392 		if (type->ctype.base_type == &int_type)
393 			return TYPE_NUM;
394 		if (type->ctype.base_type == &fp_type)
395 			return TYPE_NUM | TYPE_FLOAT;
396 	}
397 	return type_class[type->type];
398 }
399 
400 #define is_int(class) ((class & (TYPE_NUM | TYPE_FLOAT)) == TYPE_NUM)
401 
is_string_type(struct symbol * type)402 static inline int is_string_type(struct symbol *type)
403 {
404 	if (type->type == SYM_NODE)
405 		type = type->ctype.base_type;
406 	return type->type == SYM_ARRAY && is_byte_type(type->ctype.base_type);
407 }
408 
bad_expr_type(struct expression * expr)409 static struct symbol *bad_expr_type(struct expression *expr)
410 {
411 	switch (expr->type) {
412 	case EXPR_BINOP:
413 	case EXPR_COMPARE:
414 		if (!valid_subexpr_type(expr))
415 			break;
416 		sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
417 		info(expr->pos, "   left side has type %s", show_typename(expr->left->ctype));
418 		info(expr->pos, "   right side has type %s", show_typename(expr->right->ctype));
419 		break;
420 	case EXPR_PREOP:
421 	case EXPR_POSTOP:
422 		if (!valid_expr_type(expr->unop))
423 			break;
424 		sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
425 		info(expr->pos, "   argument has type %s", show_typename(expr->unop->ctype));
426 		break;
427 	default:
428 		break;
429 	}
430 
431 	expr->flags = CEF_NONE;
432 	return expr->ctype = &bad_ctype;
433 }
434 
restricted_value(struct expression * v,struct symbol * type)435 static int restricted_value(struct expression *v, struct symbol *type)
436 {
437 	if (v->type != EXPR_VALUE)
438 		return 1;
439 	if (v->value != 0)
440 		return 1;
441 	return 0;
442 }
443 
restricted_binop(int op,struct symbol * type)444 static int restricted_binop(int op, struct symbol *type)
445 {
446 	switch (op) {
447 		case '&':
448 		case '=':
449 		case SPECIAL_AND_ASSIGN:
450 		case SPECIAL_OR_ASSIGN:
451 		case SPECIAL_XOR_ASSIGN:
452 			return 1;	/* unfoul */
453 		case '|':
454 		case '^':
455 		case '?':
456 			return 2;	/* keep fouled */
457 		case SPECIAL_EQUAL:
458 		case SPECIAL_NOTEQUAL:
459 			return 3;	/* warn if fouled */
460 		default:
461 			return 0;	/* warn */
462 	}
463 }
464 
restricted_unop(int op,struct symbol ** type)465 static int restricted_unop(int op, struct symbol **type)
466 {
467 	if (op == '~') {
468 		if ((*type)->bit_size < bits_in_int)
469 			*type = befoul(*type);
470 		return 0;
471 	} if (op == '+')
472 		return 0;
473 	return 1;
474 }
475 
476 /* type should be SYM_FOULED */
unfoul(struct symbol * type)477 static inline struct symbol *unfoul(struct symbol *type)
478 {
479 	return type->ctype.base_type;
480 }
481 
restricted_binop_type(int op,struct expression * left,struct expression * right,int lclass,int rclass,struct symbol * ltype,struct symbol * rtype)482 static struct symbol *restricted_binop_type(int op,
483 					struct expression *left,
484 					struct expression *right,
485 					int lclass, int rclass,
486 					struct symbol *ltype,
487 					struct symbol *rtype)
488 {
489 	struct symbol *ctype = NULL;
490 	if (lclass & TYPE_RESTRICT) {
491 		if (rclass & TYPE_RESTRICT) {
492 			if (ltype == rtype) {
493 				ctype = ltype;
494 			} else if (lclass & TYPE_FOULED) {
495 				if (unfoul(ltype) == rtype)
496 					ctype = ltype;
497 			} else if (rclass & TYPE_FOULED) {
498 				if (unfoul(rtype) == ltype)
499 					ctype = rtype;
500 			}
501 		} else {
502 			if (!restricted_value(right, ltype))
503 				ctype = ltype;
504 		}
505 	} else if (!restricted_value(left, rtype))
506 		ctype = rtype;
507 
508 	if (ctype) {
509 		switch (restricted_binop(op, ctype)) {
510 		case 1:
511 			if ((lclass ^ rclass) & TYPE_FOULED)
512 				ctype = unfoul(ctype);
513 			break;
514 		case 3:
515 			if (!(lclass & rclass & TYPE_FOULED))
516 				break;
517 		case 0:
518 			ctype = NULL;
519 		default:
520 			break;
521 		}
522 	}
523 
524 	return ctype;
525 }
526 
unrestrict(struct expression * expr,int class,struct symbol ** ctype)527 static inline void unrestrict(struct expression *expr,
528 			      int class, struct symbol **ctype)
529 {
530 	if (class & TYPE_RESTRICT) {
531 		if (class & TYPE_FOULED)
532 			*ctype = unfoul(*ctype);
533 		warning(expr->pos, "%s degrades to integer",
534 			show_typename(*ctype));
535 		*ctype = (*ctype)->ctype.base_type; /* get to arithmetic type */
536 	}
537 }
538 
usual_conversions(int op,struct expression * left,struct expression * right,int lclass,int rclass,struct symbol * ltype,struct symbol * rtype)539 static struct symbol *usual_conversions(int op,
540 					struct expression *left,
541 					struct expression *right,
542 					int lclass, int rclass,
543 					struct symbol *ltype,
544 					struct symbol *rtype)
545 {
546 	struct symbol *ctype;
547 
548 	warn_for_different_enum_types(right->pos, left->ctype, right->ctype);
549 
550 	if ((lclass | rclass) & TYPE_RESTRICT)
551 		goto Restr;
552 
553 Normal:
554 	if (!(lclass & TYPE_FLOAT)) {
555 		if (!(rclass & TYPE_FLOAT))
556 			return bigger_int_type(ltype, rtype);
557 		else
558 			return rtype;
559 	} else if (rclass & TYPE_FLOAT) {
560 		unsigned long lmod = ltype->ctype.modifiers;
561 		unsigned long rmod = rtype->ctype.modifiers;
562 		if (rmod & ~lmod & (MOD_LONG_ALL))
563 			return rtype;
564 		else
565 			return ltype;
566 	} else
567 		return ltype;
568 
569 Restr:
570 	ctype = restricted_binop_type(op, left, right,
571 				      lclass, rclass, ltype, rtype);
572 	if (ctype)
573 		return ctype;
574 
575 	unrestrict(left, lclass, &ltype);
576 	unrestrict(right, rclass, &rtype);
577 
578 	goto Normal;
579 }
580 
lvalue_expression(struct expression * expr)581 static inline int lvalue_expression(struct expression *expr)
582 {
583 	return expr->type == EXPR_PREOP && expr->op == '*';
584 }
585 
evaluate_ptr_add(struct expression * expr,struct symbol * itype)586 static struct symbol *evaluate_ptr_add(struct expression *expr, struct symbol *itype)
587 {
588 	struct expression *index = expr->right;
589 	struct symbol *ctype, *base;
590 	int multiply;
591 
592 	classify_type(degenerate(expr->left), &ctype);
593 	base = examine_pointer_target(ctype);
594 
595 	/*
596 	 * An address constant +/- an integer constant expression
597 	 * yields an address constant again [6.6(7)].
598 	 */
599 	if ((expr->left->flags & CEF_ADDR) && (expr->right->flags & CEF_ICE))
600 		expr->flags = CEF_ADDR;
601 
602 	if (!base) {
603 		expression_error(expr, "missing type information");
604 		return NULL;
605 	}
606 	if (is_function(base)) {
607 		expression_error(expr, "arithmetics on pointers to functions");
608 		return NULL;
609 	}
610 
611 	/* Get the size of whatever the pointer points to */
612 	multiply = is_void_type(base) ? 1 : bits_to_bytes(base->bit_size);
613 
614 	if (ctype == &null_ctype)
615 		ctype = &ptr_ctype;
616 	expr->ctype = ctype;
617 
618 	if (multiply == 1 && itype->bit_size >= bits_in_pointer)
619 		return ctype;
620 
621 	if (index->type == EXPR_VALUE) {
622 		struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
623 		unsigned long long v = index->value, mask;
624 		mask = 1ULL << (itype->bit_size - 1);
625 		if (v & mask)
626 			v |= -mask;
627 		else
628 			v &= mask - 1;
629 		v *= multiply;
630 		mask = 1ULL << (bits_in_pointer - 1);
631 		v &= mask | (mask - 1);
632 		val->value = v;
633 		val->ctype = ssize_t_ctype;
634 		expr->right = val;
635 		return ctype;
636 	}
637 
638 	if (itype->bit_size < bits_in_pointer)
639 		index = cast_to(index, ssize_t_ctype);
640 
641 	if (multiply > 1) {
642 		struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
643 		struct expression *mul = alloc_expression(expr->pos, EXPR_BINOP);
644 
645 		val->ctype = ssize_t_ctype;
646 		val->value = multiply;
647 
648 		mul->op = '*';
649 		mul->ctype = ssize_t_ctype;
650 		mul->left = index;
651 		mul->right = val;
652 		index = mul;
653 	}
654 
655 	expr->right = index;
656 	return ctype;
657 }
658 
659 static void examine_fn_arguments(struct symbol *fn);
660 
661 #define MOD_IGN (MOD_QUALIFIER | MOD_PURE)
662 
type_difference(struct ctype * c1,struct ctype * c2,unsigned long mod1,unsigned long mod2)663 const char *type_difference(struct ctype *c1, struct ctype *c2,
664 	unsigned long mod1, unsigned long mod2)
665 {
666 	struct ident *as1 = c1->as, *as2 = c2->as;
667 	struct symbol *t1 = c1->base_type;
668 	struct symbol *t2 = c2->base_type;
669 	int move1 = 1, move2 = 1;
670 	mod1 |= c1->modifiers;
671 	mod2 |= c2->modifiers;
672 	for (;;) {
673 		unsigned long diff;
674 		int type;
675 		struct symbol *base1 = t1->ctype.base_type;
676 		struct symbol *base2 = t2->ctype.base_type;
677 
678 		/*
679 		 * FIXME! Collect alignment and context too here!
680 		 */
681 		if (move1) {
682 			if (t1 && t1->type != SYM_PTR) {
683 				mod1 |= t1->ctype.modifiers;
684 				combine_address_space(t1->pos, &as1, t1->ctype.as);
685 			}
686 			move1 = 0;
687 		}
688 
689 		if (move2) {
690 			if (t2 && t2->type != SYM_PTR) {
691 				mod2 |= t2->ctype.modifiers;
692 				combine_address_space(t2->pos, &as2, t2->ctype.as);
693 			}
694 			move2 = 0;
695 		}
696 
697 		if (t1 == t2)
698 			break;
699 		if (!t1 || !t2)
700 			return "different types";
701 
702 		if (t1->type == SYM_NODE || t1->type == SYM_ENUM) {
703 			t1 = base1;
704 			move1 = 1;
705 			if (!t1)
706 				return "bad types";
707 			continue;
708 		}
709 
710 		if (t2->type == SYM_NODE || t2->type == SYM_ENUM) {
711 			t2 = base2;
712 			move2 = 1;
713 			if (!t2)
714 				return "bad types";
715 			continue;
716 		}
717 
718 		move1 = move2 = 1;
719 		type = t1->type;
720 		if (type != t2->type)
721 			return "different base types";
722 
723 		switch (type) {
724 		default:
725 			sparse_error(t1->pos,
726 				     "internal error: bad type in derived(%d)",
727 				     type);
728 			return "bad types";
729 		case SYM_RESTRICT:
730 			return "different base types";
731 		case SYM_UNION:
732 		case SYM_STRUCT:
733 			/* allow definition of incomplete structs and unions */
734 			if (t1->ident == t2->ident)
735 			  return NULL;
736 			return "different base types";
737 		case SYM_ARRAY:
738 			/* XXX: we ought to compare sizes */
739 			break;
740 		case SYM_PTR:
741 			if (as1 != as2)
742 				return "different address spaces";
743 			/* MOD_SPECIFIER is due to idiocy in parse.c */
744 			if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SPECIFIER)
745 				return "different modifiers";
746 			/* we could be lazier here */
747 			base1 = examine_pointer_target(t1);
748 			base2 = examine_pointer_target(t2);
749 			mod1 = t1->ctype.modifiers;
750 			as1 = t1->ctype.as;
751 			mod2 = t2->ctype.modifiers;
752 			as2 = t2->ctype.as;
753 			break;
754 		case SYM_FN: {
755 			struct symbol *arg1, *arg2;
756 			int i;
757 
758 			if (as1 != as2)
759 				return "different address spaces";
760 			if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SIGNEDNESS)
761 				return "different modifiers";
762 			mod1 = t1->ctype.modifiers;
763 			as1 = t1->ctype.as;
764 			mod2 = t2->ctype.modifiers;
765 			as2 = t2->ctype.as;
766 
767 			if (t1->variadic != t2->variadic)
768 				return "incompatible variadic arguments";
769 			examine_fn_arguments(t1);
770 			examine_fn_arguments(t2);
771 			PREPARE_PTR_LIST(t1->arguments, arg1);
772 			PREPARE_PTR_LIST(t2->arguments, arg2);
773 			i = 1;
774 			for (;;) {
775 				const char *diffstr;
776 				if (!arg1 && !arg2)
777 					break;
778 				if (!arg1 || !arg2)
779 					return "different argument counts";
780 				diffstr = type_difference(&arg1->ctype,
781 							  &arg2->ctype,
782 							  MOD_IGN, MOD_IGN);
783 				if (diffstr) {
784 					static char argdiff[80];
785 					sprintf(argdiff, "incompatible argument %d (%s)", i, diffstr);
786 					return argdiff;
787 				}
788 				NEXT_PTR_LIST(arg1);
789 				NEXT_PTR_LIST(arg2);
790 				i++;
791 			}
792 			FINISH_PTR_LIST(arg2);
793 			FINISH_PTR_LIST(arg1);
794 			break;
795 		}
796 		case SYM_BASETYPE:
797 			if (as1 != as2)
798 				return "different address spaces";
799 			if (base1 != base2)
800 				return "different base types";
801 			diff = (mod1 ^ mod2) & ~MOD_IGNORE;
802 			if (!diff)
803 				return NULL;
804 			if (diff & MOD_SIZE)
805 				return "different type sizes";
806 			else if (diff & ~MOD_SIGNEDNESS)
807 				return "different modifiers";
808 			else
809 				return "different signedness";
810 		}
811 		t1 = base1;
812 		t2 = base2;
813 	}
814 	if (as1 != as2)
815 		return "different address spaces";
816 	if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SIGNEDNESS)
817 		return "different modifiers";
818 	return NULL;
819 }
820 
bad_null(struct expression * expr)821 static void bad_null(struct expression *expr)
822 {
823 	if (Wnon_pointer_null)
824 		warning(expr->pos, "Using plain integer as NULL pointer");
825 }
826 
target_qualifiers(struct symbol * type)827 static unsigned long target_qualifiers(struct symbol *type)
828 {
829 	unsigned long mod = type->ctype.modifiers & MOD_IGN;
830 	if (type->ctype.base_type && type->ctype.base_type->type == SYM_ARRAY)
831 		mod = 0;
832 	return mod;
833 }
834 
evaluate_ptr_sub(struct expression * expr)835 static struct symbol *evaluate_ptr_sub(struct expression *expr)
836 {
837 	const char *typediff;
838 	struct symbol *ltype, *rtype;
839 	struct expression *l = expr->left;
840 	struct expression *r = expr->right;
841 	struct symbol *lbase;
842 
843 	classify_type(degenerate(l), &ltype);
844 	classify_type(degenerate(r), &rtype);
845 
846 	lbase = examine_pointer_target(ltype);
847 	examine_pointer_target(rtype);
848 	typediff = type_difference(&ltype->ctype, &rtype->ctype,
849 				   target_qualifiers(rtype),
850 				   target_qualifiers(ltype));
851 	if (typediff)
852 		expression_error(expr, "subtraction of different types can't work (%s)", typediff);
853 
854 	if (is_function(lbase)) {
855 		expression_error(expr, "subtraction of functions? Share your drugs");
856 		return NULL;
857 	}
858 
859 	expr->ctype = ssize_t_ctype;
860 	if (lbase->bit_size > bits_in_char) {
861 		struct expression *sub = alloc_expression(expr->pos, EXPR_BINOP);
862 		struct expression *div = expr;
863 		struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
864 		unsigned long value = bits_to_bytes(lbase->bit_size);
865 
866 		val->ctype = size_t_ctype;
867 		val->value = value;
868 
869 		if (value & (value-1)) {
870 			if (Wptr_subtraction_blows) {
871 				warning(expr->pos, "potentially expensive pointer subtraction");
872 				info(expr->pos, "    '%s' has a non-power-of-2 size: %lu", show_typename(lbase), value);
873 			}
874 		}
875 
876 		sub->op = '-';
877 		sub->ctype = ssize_t_ctype;
878 		sub->left = l;
879 		sub->right = r;
880 
881 		div->op = '/';
882 		div->left = sub;
883 		div->right = val;
884 	}
885 
886 	return ssize_t_ctype;
887 }
888 
889 #define is_safe_type(type) ((type)->ctype.modifiers & MOD_SAFE)
890 
evaluate_conditional(struct expression * expr,int iterator)891 static struct symbol *evaluate_conditional(struct expression *expr, int iterator)
892 {
893 	struct symbol *ctype;
894 
895 	if (!expr)
896 		return NULL;
897 
898 	if (!iterator && expr->type == EXPR_ASSIGNMENT && expr->op == '=')
899 		warning(expr->pos, "assignment expression in conditional");
900 
901 	ctype = evaluate_expression(expr);
902 	if (!valid_type(ctype))
903 		return NULL;
904 	if (is_safe_type(ctype))
905 		warning(expr->pos, "testing a 'safe expression'");
906 	if (is_func_type(ctype)) {
907 		if (Waddress)
908 			warning(expr->pos, "the address of %s will always evaluate as true", "a function");
909 	} else if (is_array_type(ctype)) {
910 		if (Waddress)
911 			warning(expr->pos, "the address of %s will always evaluate as true", "an array");
912 	} else if (!is_scalar_type(ctype)) {
913 		sparse_error(expr->pos, "incorrect type in conditional (non-scalar type)");
914 		info(expr->pos, "   got %s", show_typename(ctype));
915 		return NULL;
916 	}
917 
918 	ctype = degenerate(expr);
919 	return ctype;
920 }
921 
evaluate_logical(struct expression * expr)922 static struct symbol *evaluate_logical(struct expression *expr)
923 {
924 	if (!evaluate_conditional(expr->left, 0))
925 		return NULL;
926 	if (!evaluate_conditional(expr->right, 0))
927 		return NULL;
928 
929 	/* the result is int [6.5.13(3), 6.5.14(3)] */
930 	expr->ctype = &int_ctype;
931 	expr->flags = expr->left->flags & expr->right->flags;
932 	expr->flags &= ~(CEF_CONST_MASK | CEF_ADDR);
933 	return &int_ctype;
934 }
935 
evaluate_binop(struct expression * expr)936 static struct symbol *evaluate_binop(struct expression *expr)
937 {
938 	struct symbol *ltype, *rtype, *ctype;
939 	int lclass = classify_type(expr->left->ctype, &ltype);
940 	int rclass = classify_type(expr->right->ctype, &rtype);
941 	int op = expr->op;
942 
943 	/* number op number */
944 	if (lclass & rclass & TYPE_NUM) {
945 		expr->flags = expr->left->flags & expr->right->flags;
946 		expr->flags &= ~CEF_CONST_MASK;
947 
948 		if ((lclass | rclass) & TYPE_FLOAT) {
949 			switch (op) {
950 			case '+': case '-': case '*': case '/':
951 				break;
952 			default:
953 				return bad_expr_type(expr);
954 			}
955 		}
956 
957 		if (op == SPECIAL_LEFTSHIFT || op == SPECIAL_RIGHTSHIFT) {
958 			// shifts do integer promotions, but that's it.
959 			unrestrict(expr->left, lclass, &ltype);
960 			unrestrict(expr->right, rclass, &rtype);
961 			ctype = ltype = integer_promotion(ltype);
962 			rtype = integer_promotion(rtype);
963 		} else {
964 			// The rest do usual conversions
965 			const unsigned left_not  = expr->left->type == EXPR_PREOP
966 			                           && expr->left->op == '!';
967 			const unsigned right_not = expr->right->type == EXPR_PREOP
968 			                           && expr->right->op == '!';
969 			if ((op == '&' || op == '|') && (left_not || right_not))
970 				warning(expr->pos, "dubious: %sx %c %sy",
971 				        left_not ? "!" : "",
972 					op,
973 					right_not ? "!" : "");
974 
975 			ltype = usual_conversions(op, expr->left, expr->right,
976 						  lclass, rclass, ltype, rtype);
977 			ctype = rtype = ltype;
978 		}
979 
980 		expr->left = cast_to(expr->left, ltype);
981 		expr->right = cast_to(expr->right, rtype);
982 		expr->ctype = ctype;
983 		return ctype;
984 	}
985 
986 	/* pointer (+|-) integer */
987 	if (lclass & TYPE_PTR && is_int(rclass) && (op == '+' || op == '-')) {
988 		unrestrict(expr->right, rclass, &rtype);
989 		return evaluate_ptr_add(expr, rtype);
990 	}
991 
992 	/* integer + pointer */
993 	if (rclass & TYPE_PTR && is_int(lclass) && op == '+') {
994 		struct expression *index = expr->left;
995 		unrestrict(index, lclass, &ltype);
996 		expr->left = expr->right;
997 		expr->right = index;
998 		return evaluate_ptr_add(expr, ltype);
999 	}
1000 
1001 	/* pointer - pointer */
1002 	if (lclass & rclass & TYPE_PTR && expr->op == '-')
1003 		return evaluate_ptr_sub(expr);
1004 
1005 	return bad_expr_type(expr);
1006 }
1007 
evaluate_comma(struct expression * expr)1008 static struct symbol *evaluate_comma(struct expression *expr)
1009 {
1010 	expr->ctype = degenerate(expr->right);
1011 	if (expr->ctype == &null_ctype)
1012 		expr->ctype = &ptr_ctype;
1013 	expr->flags &= expr->left->flags & expr->right->flags;
1014 	return expr->ctype;
1015 }
1016 
modify_for_unsigned(int op)1017 static int modify_for_unsigned(int op)
1018 {
1019 	if (op == '<')
1020 		op = SPECIAL_UNSIGNED_LT;
1021 	else if (op == '>')
1022 		op = SPECIAL_UNSIGNED_GT;
1023 	else if (op == SPECIAL_LTE)
1024 		op = SPECIAL_UNSIGNED_LTE;
1025 	else if (op == SPECIAL_GTE)
1026 		op = SPECIAL_UNSIGNED_GTE;
1027 	return op;
1028 }
1029 
1030 enum null_constant_type {
1031 	NON_NULL,
1032 	NULL_PTR,
1033 	NULL_ZERO,
1034 };
1035 
is_null_pointer_constant(struct expression * e)1036 static inline int is_null_pointer_constant(struct expression *e)
1037 {
1038 	if (e->ctype == &null_ctype)
1039 		return NULL_PTR;
1040 	if (!(e->flags & CEF_ICE))
1041 		return NON_NULL;
1042 	return is_zero_constant(e) ? NULL_ZERO : NON_NULL;
1043 }
1044 
evaluate_compare(struct expression * expr)1045 static struct symbol *evaluate_compare(struct expression *expr)
1046 {
1047 	struct expression *left = expr->left, *right = expr->right;
1048 	struct symbol *ltype, *rtype, *lbase, *rbase;
1049 	int lclass = classify_type(degenerate(left), &ltype);
1050 	int rclass = classify_type(degenerate(right), &rtype);
1051 	struct symbol *ctype;
1052 	const char *typediff;
1053 
1054 	/* Type types? */
1055 	if (is_type_type(ltype) && is_type_type(rtype)) {
1056 		/*
1057 		 * __builtin_types_compatible_p() yields an integer
1058 		 * constant expression
1059 		 */
1060 		expr->flags = CEF_SET_ICE;
1061 		goto OK;
1062 	}
1063 
1064 	if (is_safe_type(left->ctype) || is_safe_type(right->ctype))
1065 		warning(expr->pos, "testing a 'safe expression'");
1066 
1067 	expr->flags = left->flags & right->flags & ~CEF_CONST_MASK & ~CEF_ADDR;
1068 
1069 	/* number on number */
1070 	if (lclass & rclass & TYPE_NUM) {
1071 		ctype = usual_conversions(expr->op, expr->left, expr->right,
1072 					  lclass, rclass, ltype, rtype);
1073 		expr->left = cast_to(expr->left, ctype);
1074 		expr->right = cast_to(expr->right, ctype);
1075 		if (ctype->ctype.modifiers & MOD_UNSIGNED)
1076 			expr->op = modify_for_unsigned(expr->op);
1077 		goto OK;
1078 	}
1079 
1080 	/* at least one must be a pointer */
1081 	if (!((lclass | rclass) & TYPE_PTR))
1082 		return bad_expr_type(expr);
1083 
1084 	/* equality comparisons can be with null pointer constants */
1085 	if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1086 		int is_null1 = is_null_pointer_constant(left);
1087 		int is_null2 = is_null_pointer_constant(right);
1088 		if (is_null1 == NULL_ZERO)
1089 			bad_null(left);
1090 		if (is_null2 == NULL_ZERO)
1091 			bad_null(right);
1092 		if (is_null1 && is_null2) {
1093 			int positive = expr->op == SPECIAL_EQUAL;
1094 			expr->type = EXPR_VALUE;
1095 			expr->value = positive;
1096 			goto OK;
1097 		}
1098 		if (is_null1 && (rclass & TYPE_PTR)) {
1099 			left = cast_to(left, rtype);
1100 			goto OK;
1101 		}
1102 		if (is_null2 && (lclass & TYPE_PTR)) {
1103 			right = cast_to(right, ltype);
1104 			goto OK;
1105 		}
1106 	}
1107 	/* both should be pointers */
1108 	if (!(lclass & rclass & TYPE_PTR))
1109 		return bad_expr_type(expr);
1110 	expr->op = modify_for_unsigned(expr->op);
1111 
1112 	lbase = examine_pointer_target(ltype);
1113 	rbase = examine_pointer_target(rtype);
1114 
1115 	/* they also have special treatment for pointers to void */
1116 	if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1117 		if (ltype->ctype.as == rtype->ctype.as) {
1118 			if (lbase == &void_ctype) {
1119 				right = cast_to(right, ltype);
1120 				goto OK;
1121 			}
1122 			if (rbase == &void_ctype) {
1123 				left = cast_to(left, rtype);
1124 				goto OK;
1125 			}
1126 		}
1127 	}
1128 
1129 	typediff = type_difference(&ltype->ctype, &rtype->ctype,
1130 				   target_qualifiers(rtype),
1131 				   target_qualifiers(ltype));
1132 	if (!typediff)
1133 		goto OK;
1134 
1135 	expression_error(expr, "incompatible types in comparison expression (%s):", typediff);
1136 	info(expr->pos, "   %s", show_typename(ltype));
1137 	info(expr->pos, "   %s", show_typename(rtype));
1138 	return NULL;
1139 
1140 OK:
1141 	/* the result is int [6.5.8(6), 6.5.9(3)]*/
1142 	expr->ctype = &int_ctype;
1143 	return &int_ctype;
1144 }
1145 
1146 /*
1147  * NOTE! The degenerate case of "x ? : y", where we don't
1148  * have a true case, this will possibly promote "x" to the
1149  * same type as "y", and thus _change_ the conditional
1150  * test in the expression. But since promotion is "safe"
1151  * for testing, that's OK.
1152  */
evaluate_conditional_expression(struct expression * expr)1153 static struct symbol *evaluate_conditional_expression(struct expression *expr)
1154 {
1155 	struct expression **cond;
1156 	struct symbol *ctype, *ltype, *rtype, *lbase, *rbase;
1157 	int lclass, rclass;
1158 	const char * typediff;
1159 	int qual;
1160 
1161 	if (!evaluate_conditional(expr->conditional, 0))
1162 		return NULL;
1163 	if (!evaluate_expression(expr->cond_false))
1164 		return NULL;
1165 
1166 	ctype = degenerate(expr->conditional);
1167 	rtype = degenerate(expr->cond_false);
1168 
1169 	cond = &expr->conditional;
1170 	ltype = ctype;
1171 	if (expr->cond_true) {
1172 		if (!evaluate_expression(expr->cond_true))
1173 			return NULL;
1174 		ltype = degenerate(expr->cond_true);
1175 		cond = &expr->cond_true;
1176 	}
1177 
1178 	expr->flags = (expr->conditional->flags & (*cond)->flags &
1179 			expr->cond_false->flags & ~CEF_CONST_MASK);
1180 	/*
1181 	 * A conditional operator yields a particular constant
1182 	 * expression type only if all of its three subexpressions are
1183 	 * of that type [6.6(6), 6.6(8)].
1184 	 * As an extension, relax this restriction by allowing any
1185 	 * constant expression type for the condition expression.
1186 	 *
1187 	 * A conditional operator never yields an address constant
1188 	 * [6.6(9)].
1189 	 * However, as an extension, if the condition is any constant
1190 	 * expression, and the true and false expressions are both
1191 	 * address constants, mark the result as an address constant.
1192 	 */
1193 	if (expr->conditional->flags & (CEF_ACE | CEF_ADDR))
1194 		expr->flags = (*cond)->flags & expr->cond_false->flags & ~CEF_CONST_MASK;
1195 
1196 	lclass = classify_type(ltype, &ltype);
1197 	rclass = classify_type(rtype, &rtype);
1198 	if (lclass & rclass & TYPE_NUM) {
1199 		ctype = usual_conversions('?', *cond, expr->cond_false,
1200 					  lclass, rclass, ltype, rtype);
1201 		*cond = cast_to(*cond, ctype);
1202 		expr->cond_false = cast_to(expr->cond_false, ctype);
1203 		goto out;
1204 	}
1205 
1206 	if ((lclass | rclass) & TYPE_PTR) {
1207 		int is_null1 = is_null_pointer_constant(*cond);
1208 		int is_null2 = is_null_pointer_constant(expr->cond_false);
1209 
1210 		if (is_null1 && is_null2) {
1211 			*cond = cast_to(*cond, &ptr_ctype);
1212 			expr->cond_false = cast_to(expr->cond_false, &ptr_ctype);
1213 			ctype = &ptr_ctype;
1214 			goto out;
1215 		}
1216 		if (is_null1 && (rclass & TYPE_PTR)) {
1217 			if (is_null1 == NULL_ZERO)
1218 				bad_null(*cond);
1219 			*cond = cast_to(*cond, rtype);
1220 			ctype = rtype;
1221 			goto out;
1222 		}
1223 		if (is_null2 && (lclass & TYPE_PTR)) {
1224 			if (is_null2 == NULL_ZERO)
1225 				bad_null(expr->cond_false);
1226 			expr->cond_false = cast_to(expr->cond_false, ltype);
1227 			ctype = ltype;
1228 			goto out;
1229 		}
1230 		if (!(lclass & rclass & TYPE_PTR)) {
1231 			typediff = "different types";
1232 			goto Err;
1233 		}
1234 		/* OK, it's pointer on pointer */
1235 		if (ltype->ctype.as != rtype->ctype.as) {
1236 			typediff = "different address spaces";
1237 			goto Err;
1238 		}
1239 
1240 		/* need to be lazier here */
1241 		lbase = examine_pointer_target(ltype);
1242 		rbase = examine_pointer_target(rtype);
1243 		qual = target_qualifiers(ltype) | target_qualifiers(rtype);
1244 
1245 		if (lbase == &void_ctype) {
1246 			/* XXX: pointers to function should warn here */
1247 			ctype = ltype;
1248 			goto Qual;
1249 
1250 		}
1251 		if (rbase == &void_ctype) {
1252 			/* XXX: pointers to function should warn here */
1253 			ctype = rtype;
1254 			goto Qual;
1255 		}
1256 		/* XXX: that should be pointer to composite */
1257 		ctype = ltype;
1258 		typediff = type_difference(&ltype->ctype, &rtype->ctype,
1259 					   qual, qual);
1260 		if (!typediff)
1261 			goto Qual;
1262 		goto Err;
1263 	}
1264 
1265 	/* void on void, struct on same struct, union on same union */
1266 	if (ltype == rtype) {
1267 		ctype = ltype;
1268 		goto out;
1269 	}
1270 	typediff = "different base types";
1271 
1272 Err:
1273 	expression_error(expr, "incompatible types in conditional expression (%s):", typediff);
1274 	info(expr->pos, "   %s", show_typename(ltype));
1275 	info(expr->pos, "   %s", show_typename(rtype));
1276 	/*
1277 	 * if the condition is constant, the type is in fact known
1278 	 * so use it, as gcc & clang do.
1279 	 */
1280 	switch (expr_truth_value(expr->conditional)) {
1281 	case 1:	expr->ctype = ltype;
1282 		break;
1283 	case 0: expr->ctype = rtype;
1284 		break;
1285 	default:
1286 		break;
1287 	}
1288 	return NULL;
1289 
1290 out:
1291 	expr->ctype = ctype;
1292 	return ctype;
1293 
1294 Qual:
1295 	if (qual & ~ctype->ctype.modifiers) {
1296 		struct symbol *sym = alloc_symbol(ctype->pos, SYM_PTR);
1297 		*sym = *ctype;
1298 		sym->ctype.modifiers |= qual;
1299 		ctype = sym;
1300 	}
1301 	*cond = cast_to(*cond, ctype);
1302 	expr->cond_false = cast_to(expr->cond_false, ctype);
1303 	goto out;
1304 }
1305 
1306 /* FP assignments can not do modulo or bit operations */
compatible_float_op(int op)1307 static int compatible_float_op(int op)
1308 {
1309 	return	op == SPECIAL_ADD_ASSIGN ||
1310 		op == SPECIAL_SUB_ASSIGN ||
1311 		op == SPECIAL_MUL_ASSIGN ||
1312 		op == SPECIAL_DIV_ASSIGN;
1313 }
1314 
evaluate_assign_op(struct expression * expr)1315 static int evaluate_assign_op(struct expression *expr)
1316 {
1317 	struct symbol *target = expr->left->ctype;
1318 	struct symbol *source = expr->right->ctype;
1319 	struct symbol *t, *s;
1320 	int tclass = classify_type(target, &t);
1321 	int sclass = classify_type(source, &s);
1322 	int op = expr->op;
1323 
1324 	if (tclass & sclass & TYPE_NUM) {
1325 		if (tclass & TYPE_FLOAT && !compatible_float_op(op)) {
1326 			expression_error(expr, "invalid assignment");
1327 			return 0;
1328 		}
1329 		if (tclass & TYPE_RESTRICT) {
1330 			if (!restricted_binop(op, t)) {
1331 				warning(expr->pos, "bad assignment (%s) to %s",
1332 					show_special(op), show_typename(t));
1333 				expr->right = cast_to(expr->right, target);
1334 				return 0;
1335 			}
1336 			/* allowed assignments unfoul */
1337 			if (sclass & TYPE_FOULED && unfoul(s) == t)
1338 				goto Cast;
1339 			if (!restricted_value(expr->right, t))
1340 				return 1;
1341 		} else if (op == SPECIAL_SHR_ASSIGN || op == SPECIAL_SHL_ASSIGN) {
1342 			// shifts do integer promotions, but that's it.
1343 			unrestrict(expr->right, sclass, &s);
1344 			target = integer_promotion(s);
1345 			goto Cast;
1346 		} else if (!(sclass & TYPE_RESTRICT))
1347 			goto usual;
1348 		/* source and target would better be identical restricted */
1349 		if (t == s)
1350 			return 1;
1351 		warning(expr->pos, "invalid assignment: %s", show_special(op));
1352 		info(expr->pos, "   left side has type %s", show_typename(t));
1353 		info(expr->pos, "   right side has type %s", show_typename(s));
1354 		expr->right = cast_to(expr->right, target);
1355 		return 0;
1356 	}
1357 	if (tclass == TYPE_PTR && is_int(sclass)) {
1358 		if (op == SPECIAL_ADD_ASSIGN || op == SPECIAL_SUB_ASSIGN) {
1359 			unrestrict(expr->right, sclass, &s);
1360 			evaluate_ptr_add(expr, s);
1361 			return 1;
1362 		}
1363 		expression_error(expr, "invalid pointer assignment");
1364 		return 0;
1365 	}
1366 
1367 	expression_error(expr, "invalid assignment");
1368 	return 0;
1369 
1370 usual:
1371 	target = usual_conversions(op, expr->left, expr->right,
1372 				tclass, sclass, target, source);
1373 Cast:
1374 	expr->right = cast_to(expr->right, target);
1375 	return 1;
1376 }
1377 
whitelist_pointers(struct symbol * t1,struct symbol * t2)1378 static int whitelist_pointers(struct symbol *t1, struct symbol *t2)
1379 {
1380 	if (t1 == t2)
1381 		return 0;	/* yes, 0 - we don't want a cast_to here */
1382 	if (t1 == &void_ctype)
1383 		return 1;
1384 	if (t2 == &void_ctype)
1385 		return 1;
1386 	if (classify_type(t1, &t1) != TYPE_NUM)
1387 		return 0;
1388 	if (classify_type(t2, &t2) != TYPE_NUM)
1389 		return 0;
1390 	if (t1 == t2)
1391 		return 1;
1392 	if (t1->ctype.modifiers & t2->ctype.modifiers & MOD_CHAR)
1393 		return 1;
1394 	if ((t1->ctype.modifiers ^ t2->ctype.modifiers) & MOD_SIZE)
1395 		return 0;
1396 	return !Wtypesign;
1397 }
1398 
check_assignment_types(struct symbol * target,struct expression ** rp,const char ** typediff)1399 static int check_assignment_types(struct symbol *target, struct expression **rp,
1400 	const char **typediff)
1401 {
1402 	struct symbol *source = degenerate(*rp);
1403 	struct symbol *t, *s;
1404 	int tclass = classify_type(target, &t);
1405 	int sclass = classify_type(source, &s);
1406 
1407 	if (tclass & sclass & TYPE_NUM) {
1408 		if (tclass & TYPE_RESTRICT) {
1409 			/* allowed assignments unfoul */
1410 			if (sclass & TYPE_FOULED && unfoul(s) == t)
1411 				goto Cast;
1412 			if (!restricted_value(*rp, target))
1413 				return 1;
1414 			if (s == t)
1415 				return 1;
1416 		} else if (!(sclass & TYPE_RESTRICT))
1417 			goto Cast;
1418                 if (t == &bool_ctype) {
1419                         if (is_fouled_type(s))
1420                                 warning((*rp)->pos, "%s degrades to integer",
1421                                         show_typename(s->ctype.base_type));
1422                         goto Cast;
1423                 }
1424 		*typediff = "different base types";
1425 		return 0;
1426 	}
1427 
1428 	if (tclass == TYPE_PTR) {
1429 		unsigned long mod1, mod2;
1430 		struct symbol *b1, *b2;
1431 		// NULL pointer is always OK
1432 		int is_null = is_null_pointer_constant(*rp);
1433 		if (is_null) {
1434 			if (is_null == NULL_ZERO)
1435 				bad_null(*rp);
1436 			goto Cast;
1437 		}
1438 		if (!(sclass & TYPE_PTR)) {
1439 			*typediff = "different base types";
1440 			return 0;
1441 		}
1442 		b1 = examine_pointer_target(t);
1443 		b2 = examine_pointer_target(s);
1444 		mod1 = target_qualifiers(t);
1445 		mod2 = target_qualifiers(s);
1446 		if (whitelist_pointers(b1, b2)) {
1447 			/*
1448 			 * assignments to/from void * are OK, provided that
1449 			 * we do not remove qualifiers from pointed to [C]
1450 			 * or mix address spaces [sparse].
1451 			 */
1452 			if (t->ctype.as != s->ctype.as) {
1453 				*typediff = "different address spaces";
1454 				return 0;
1455 			}
1456 			/*
1457 			 * If this is a function pointer assignment, it is
1458 			 * actually fine to assign a pointer to const data to
1459 			 * it, as a function pointer points to const data
1460 			 * implicitly, i.e., dereferencing it does not produce
1461 			 * an lvalue.
1462 			 */
1463 			if (b1->type == SYM_FN)
1464 				mod1 |= MOD_CONST;
1465 			if (mod2 & ~mod1) {
1466 				*typediff = "different modifiers";
1467 				return 0;
1468 			}
1469 			goto Cast;
1470 		}
1471 		/* It's OK if the target is more volatile or const than the source */
1472 		*typediff = type_difference(&t->ctype, &s->ctype, 0, mod1);
1473 		if (*typediff)
1474 			return 0;
1475 		return 1;
1476 	}
1477 
1478 	if ((tclass & TYPE_COMPOUND) && s == t)
1479 		return 1;
1480 
1481 	if (tclass & TYPE_NUM) {
1482 		/* XXX: need to turn into comparison with NULL */
1483 		if (t == &bool_ctype && (sclass & TYPE_PTR))
1484 			goto Cast;
1485 		*typediff = "different base types";
1486 		return 0;
1487 	}
1488 	*typediff = "invalid types";
1489 	return 0;
1490 
1491 Cast:
1492 	*rp = cast_to(*rp, target);
1493 	return 1;
1494 }
1495 
compatible_assignment_types(struct expression * expr,struct symbol * target,struct expression ** rp,const char * where)1496 static int compatible_assignment_types(struct expression *expr, struct symbol *target,
1497 	struct expression **rp, const char *where)
1498 {
1499 	const char *typediff;
1500 	struct symbol *source = degenerate(*rp);
1501 
1502 	if (!check_assignment_types(target, rp, &typediff)) {
1503 		warning(expr->pos, "incorrect type in %s (%s)", where, typediff);
1504 		info(expr->pos, "   expected %s", show_typename(target));
1505 		info(expr->pos, "   got %s", show_typename(source));
1506 		*rp = cast_to(*rp, target);
1507 		return 0;
1508 	}
1509 
1510 	return 1;
1511 }
1512 
compatible_transparent_union(struct symbol * target,struct expression ** rp)1513 static int compatible_transparent_union(struct symbol *target,
1514 	struct expression **rp)
1515 {
1516 	struct symbol *t, *member;
1517 	classify_type(target, &t);
1518 	if (t->type != SYM_UNION || !t->transparent_union)
1519 		return 0;
1520 
1521 	FOR_EACH_PTR(t->symbol_list, member) {
1522 		const char *typediff;
1523 		if (check_assignment_types(member, rp, &typediff))
1524 			return 1;
1525 	} END_FOR_EACH_PTR(member);
1526 
1527 	return 0;
1528 }
1529 
compatible_argument_type(struct expression * expr,struct symbol * target,struct expression ** rp,const char * where)1530 static int compatible_argument_type(struct expression *expr, struct symbol *target,
1531 	struct expression **rp, const char *where)
1532 {
1533 	if (compatible_transparent_union(target, rp))
1534 		return 1;
1535 
1536 	return compatible_assignment_types(expr, target, rp, where);
1537 }
1538 
mark_assigned(struct expression * expr)1539 static void mark_assigned(struct expression *expr)
1540 {
1541 	struct symbol *sym;
1542 
1543 	if (!expr)
1544 		return;
1545 	switch (expr->type) {
1546 	case EXPR_SYMBOL:
1547 		sym = expr->symbol;
1548 		if (!sym)
1549 			return;
1550 		if (sym->type != SYM_NODE)
1551 			return;
1552 		sym->ctype.modifiers |= MOD_ASSIGNED;
1553 		return;
1554 
1555 	case EXPR_BINOP:
1556 		mark_assigned(expr->left);
1557 		mark_assigned(expr->right);
1558 		return;
1559 	case EXPR_CAST:
1560 	case EXPR_FORCE_CAST:
1561 		mark_assigned(expr->cast_expression);
1562 		return;
1563 	case EXPR_SLICE:
1564 		mark_assigned(expr->base);
1565 		return;
1566 	default:
1567 		/* Hmm? */
1568 		return;
1569 	}
1570 }
1571 
evaluate_assign_to(struct expression * left,struct symbol * type)1572 static void evaluate_assign_to(struct expression *left, struct symbol *type)
1573 {
1574 	if (type->ctype.modifiers & MOD_CONST)
1575 		expression_error(left, "assignment to const expression");
1576 
1577 	/* We know left is an lvalue, so it's a "preop-*" */
1578 	mark_assigned(left->unop);
1579 }
1580 
evaluate_assignment(struct expression * expr)1581 static struct symbol *evaluate_assignment(struct expression *expr)
1582 {
1583 	struct expression *left = expr->left;
1584 	struct symbol *ltype;
1585 
1586 	if (!lvalue_expression(left)) {
1587 		expression_error(expr, "not an lvalue");
1588 		return NULL;
1589 	}
1590 
1591 	ltype = left->ctype;
1592 
1593 	if (expr->op != '=') {
1594 		if (!evaluate_assign_op(expr))
1595 			return NULL;
1596 	} else {
1597 		if (!compatible_assignment_types(expr, ltype, &expr->right, "assignment"))
1598 			return NULL;
1599 	}
1600 
1601 	evaluate_assign_to(left, ltype);
1602 
1603 	expr->ctype = ltype;
1604 	return ltype;
1605 }
1606 
examine_fn_arguments(struct symbol * fn)1607 static void examine_fn_arguments(struct symbol *fn)
1608 {
1609 	struct symbol *s;
1610 
1611 	FOR_EACH_PTR(fn->arguments, s) {
1612 		struct symbol *arg = evaluate_symbol(s);
1613 		/* Array/function arguments silently degenerate into pointers */
1614 		if (arg) {
1615 			struct symbol *ptr;
1616 			switch(arg->type) {
1617 			case SYM_ARRAY:
1618 			case SYM_FN:
1619 				ptr = alloc_symbol(s->pos, SYM_PTR);
1620 				if (arg->type == SYM_ARRAY)
1621 					ptr->ctype = arg->ctype;
1622 				else
1623 					ptr->ctype.base_type = arg;
1624 				combine_address_space(s->pos, &ptr->ctype.as, s->ctype.as);
1625 				ptr->ctype.modifiers |= s->ctype.modifiers & MOD_PTRINHERIT;
1626 
1627 				s->ctype.base_type = ptr;
1628 				s->ctype.as = NULL;
1629 				s->ctype.modifiers &= ~MOD_PTRINHERIT;
1630 				s->bit_size = 0;
1631 				s->examined = 0;
1632 				examine_symbol_type(s);
1633 				break;
1634 			default:
1635 				/* nothing */
1636 				break;
1637 			}
1638 		}
1639 	} END_FOR_EACH_PTR(s);
1640 }
1641 
convert_to_as_mod(struct symbol * sym,struct ident * as,int mod)1642 static struct symbol *convert_to_as_mod(struct symbol *sym, struct ident *as, int mod)
1643 {
1644 	/* Take the modifiers of the pointer, and apply them to the member */
1645 	mod |= sym->ctype.modifiers;
1646 	if (sym->ctype.as != as || sym->ctype.modifiers != mod) {
1647 		struct symbol *newsym = alloc_symbol(sym->pos, SYM_NODE);
1648 		*newsym = *sym;
1649 		newsym->ctype.as = as;
1650 		newsym->ctype.modifiers = mod;
1651 		sym = newsym;
1652 	}
1653 	return sym;
1654 }
1655 
create_pointer(struct expression * expr,struct symbol * sym,int degenerate)1656 static struct symbol *create_pointer(struct expression *expr, struct symbol *sym, int degenerate)
1657 {
1658 	struct symbol *node = alloc_symbol(expr->pos, SYM_NODE);
1659 	struct symbol *ptr = alloc_symbol(expr->pos, SYM_PTR);
1660 
1661 	node->ctype.base_type = ptr;
1662 	ptr->bit_size = bits_in_pointer;
1663 	ptr->ctype.alignment = pointer_alignment;
1664 
1665 	node->bit_size = bits_in_pointer;
1666 	node->ctype.alignment = pointer_alignment;
1667 
1668 	access_symbol(sym);
1669 	if (sym->ctype.modifiers & MOD_REGISTER) {
1670 		warning(expr->pos, "taking address of 'register' variable '%s'", show_ident(sym->ident));
1671 		sym->ctype.modifiers &= ~MOD_REGISTER;
1672 	}
1673 	if (sym->type == SYM_NODE) {
1674 		combine_address_space(sym->pos, &ptr->ctype.as, sym->ctype.as);
1675 		ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1676 		sym = sym->ctype.base_type;
1677 	}
1678 	if (degenerate && sym->type == SYM_ARRAY) {
1679 		combine_address_space(sym->pos, &ptr->ctype.as, sym->ctype.as);
1680 		ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1681 		sym = sym->ctype.base_type;
1682 	}
1683 	ptr->ctype.base_type = sym;
1684 
1685 	return node;
1686 }
1687 
1688 /* Arrays degenerate into pointers on pointer arithmetic */
degenerate(struct expression * expr)1689 static struct symbol *degenerate(struct expression *expr)
1690 {
1691 	struct symbol *ctype, *base;
1692 
1693 	if (!expr)
1694 		return NULL;
1695 	ctype = expr->ctype;
1696 	if (!ctype)
1697 		return NULL;
1698 	base = examine_symbol_type(ctype);
1699 	if (ctype->type == SYM_NODE)
1700 		base = ctype->ctype.base_type;
1701 	/*
1702 	 * Arrays degenerate into pointers to the entries, while
1703 	 * functions degenerate into pointers to themselves.
1704 	 * If array was part of non-lvalue compound, we create a copy
1705 	 * of that compound first and then act as if we were dealing with
1706 	 * the corresponding field in there.
1707 	 */
1708 	switch (base->type) {
1709 	case SYM_ARRAY:
1710 		if (expr->type == EXPR_SLICE) {
1711 			struct symbol *a = alloc_symbol(expr->pos, SYM_NODE);
1712 			struct expression *e0, *e1, *e2, *e3, *e4;
1713 
1714 			a->ctype.base_type = expr->base->ctype;
1715 			a->bit_size = expr->base->ctype->bit_size;
1716 			a->array_size = expr->base->ctype->array_size;
1717 
1718 			e0 = alloc_expression(expr->pos, EXPR_SYMBOL);
1719 			e0->symbol = a;
1720 			e0->ctype = &lazy_ptr_ctype;
1721 
1722 			e1 = alloc_expression(expr->pos, EXPR_PREOP);
1723 			e1->unop = e0;
1724 			e1->op = '*';
1725 			e1->ctype = expr->base->ctype;	/* XXX */
1726 
1727 			e2 = alloc_expression(expr->pos, EXPR_ASSIGNMENT);
1728 			e2->left = e1;
1729 			e2->right = expr->base;
1730 			e2->op = '=';
1731 			e2->ctype = expr->base->ctype;
1732 
1733 			if (expr->r_bitpos) {
1734 				e3 = alloc_expression(expr->pos, EXPR_BINOP);
1735 				e3->op = '+';
1736 				e3->left = e0;
1737 				e3->right = alloc_const_expression(expr->pos,
1738 							bits_to_bytes(expr->r_bitpos));
1739 				e3->ctype = &lazy_ptr_ctype;
1740 			} else {
1741 				e3 = e0;
1742 			}
1743 
1744 			e4 = alloc_expression(expr->pos, EXPR_COMMA);
1745 			e4->left = e2;
1746 			e4->right = e3;
1747 			e4->ctype = &lazy_ptr_ctype;
1748 
1749 			expr->unop = e4;
1750 			expr->type = EXPR_PREOP;
1751 			expr->op = '*';
1752 		}
1753 	case SYM_FN:
1754 		if (expr->op != '*' || expr->type != EXPR_PREOP) {
1755 			expression_error(expr, "strange non-value function or array");
1756 			return &bad_ctype;
1757 		}
1758 		*expr = *expr->unop;
1759 		ctype = create_pointer(expr, ctype, 1);
1760 		expr->ctype = ctype;
1761 	default:
1762 		/* nothing */;
1763 	}
1764 	return ctype;
1765 }
1766 
evaluate_addressof(struct expression * expr)1767 static struct symbol *evaluate_addressof(struct expression *expr)
1768 {
1769 	struct expression *op = expr->unop;
1770 	struct symbol *ctype;
1771 
1772 	if (op->op != '*' || op->type != EXPR_PREOP) {
1773 		expression_error(expr, "not addressable");
1774 		return NULL;
1775 	}
1776 	ctype = op->ctype;
1777 	*expr = *op->unop;
1778 
1779 	if (expr->type == EXPR_SYMBOL) {
1780 		struct symbol *sym = expr->symbol;
1781 		sym->ctype.modifiers |= MOD_ADDRESSABLE;
1782 	}
1783 
1784 	/*
1785 	 * symbol expression evaluation is lazy about the type
1786 	 * of the sub-expression, so we may have to generate
1787 	 * the type here if so..
1788 	 */
1789 	if (expr->ctype == &lazy_ptr_ctype) {
1790 		ctype = create_pointer(expr, ctype, 0);
1791 		expr->ctype = ctype;
1792 	}
1793 	return expr->ctype;
1794 }
1795 
1796 
evaluate_dereference(struct expression * expr)1797 static struct symbol *evaluate_dereference(struct expression *expr)
1798 {
1799 	struct expression *op = expr->unop;
1800 	struct symbol *ctype = op->ctype, *node, *target;
1801 
1802 	/* Simplify: *&(expr) => (expr) */
1803 	if (op->type == EXPR_PREOP && op->op == '&') {
1804 		*expr = *op->unop;
1805 		expr->flags = CEF_NONE;
1806 		return expr->ctype;
1807 	}
1808 
1809 	examine_symbol_type(ctype);
1810 
1811 	/* Dereferencing a node drops all the node information. */
1812 	if (ctype->type == SYM_NODE)
1813 		ctype = ctype->ctype.base_type;
1814 
1815 	target = ctype->ctype.base_type;
1816 	examine_symbol_type(target);
1817 
1818 	switch (ctype->type) {
1819 	default:
1820 		expression_error(expr, "cannot dereference this type");
1821 		return NULL;
1822 	case SYM_FN:
1823 		*expr = *op;
1824 		return expr->ctype;
1825 	case SYM_PTR:
1826 		node = alloc_symbol(expr->pos, SYM_NODE);
1827 		node->ctype.modifiers = target->ctype.modifiers & MOD_SPECIFIER;
1828 		merge_type(node, ctype);
1829 		break;
1830 
1831 	case SYM_ARRAY:
1832 		if (!lvalue_expression(op)) {
1833 			expression_error(op, "non-lvalue array??");
1834 			return NULL;
1835 		}
1836 
1837 		/* Do the implied "addressof" on the array */
1838 		*op = *op->unop;
1839 
1840 		/*
1841 		 * When an array is dereferenced, we need to pick
1842 		 * up the attributes of the original node too..
1843 		 */
1844 		node = alloc_symbol(expr->pos, SYM_NODE);
1845 		merge_type(node, op->ctype);
1846 		merge_type(node, ctype);
1847 		break;
1848 	}
1849 
1850 	node->bit_size = target->bit_size;
1851 	node->array_size = target->array_size;
1852 
1853 	expr->ctype = node;
1854 	return node;
1855 }
1856 
1857 /*
1858  * Unary post-ops: x++ and x--
1859  */
evaluate_postop(struct expression * expr)1860 static struct symbol *evaluate_postop(struct expression *expr)
1861 {
1862 	struct expression *op = expr->unop;
1863 	struct symbol *ctype = op->ctype;
1864 	int class = classify_type(ctype, &ctype);
1865 	int multiply = 0;
1866 
1867 	if (!class || class & TYPE_COMPOUND) {
1868 		expression_error(expr, "need scalar for ++/--");
1869 		return NULL;
1870 	}
1871 	if (!lvalue_expression(expr->unop)) {
1872 		expression_error(expr, "need lvalue expression for ++/--");
1873 		return NULL;
1874 	}
1875 
1876 	if ((class & TYPE_RESTRICT) && restricted_unop(expr->op, &ctype))
1877 		unrestrict(expr, class, &ctype);
1878 
1879 	if (class & TYPE_NUM) {
1880 		multiply = 1;
1881 	} else if (class == TYPE_PTR) {
1882 		struct symbol *target = examine_pointer_target(ctype);
1883 		if (!is_function(target))
1884 			multiply = bits_to_bytes(target->bit_size);
1885 	}
1886 
1887 	if (multiply) {
1888 		evaluate_assign_to(op, op->ctype);
1889 		expr->op_value = multiply;
1890 		expr->ctype = ctype;
1891 		return ctype;
1892 	}
1893 
1894 	expression_error(expr, "bad argument type for ++/--");
1895 	return NULL;
1896 }
1897 
evaluate_sign(struct expression * expr)1898 static struct symbol *evaluate_sign(struct expression *expr)
1899 {
1900 	struct symbol *ctype = expr->unop->ctype;
1901 	int class = classify_type(ctype, &ctype);
1902 	unsigned char flags = expr->unop->flags & ~CEF_CONST_MASK;
1903 
1904 	/* should be an arithmetic type */
1905 	if (!(class & TYPE_NUM))
1906 		return bad_expr_type(expr);
1907 	if (class & TYPE_RESTRICT)
1908 		goto Restr;
1909 Normal:
1910 	if (!(class & TYPE_FLOAT)) {
1911 		ctype = integer_promotion(ctype);
1912 		expr->unop = cast_to(expr->unop, ctype);
1913 	} else if (expr->op != '~') {
1914 		/* no conversions needed */
1915 	} else {
1916 		return bad_expr_type(expr);
1917 	}
1918 	if (expr->op == '+')
1919 		*expr = *expr->unop;
1920 	expr->flags = flags;
1921 	expr->ctype = ctype;
1922 	return ctype;
1923 Restr:
1924 	if (restricted_unop(expr->op, &ctype))
1925 		unrestrict(expr, class, &ctype);
1926 	goto Normal;
1927 }
1928 
evaluate_preop(struct expression * expr)1929 static struct symbol *evaluate_preop(struct expression *expr)
1930 {
1931 	struct symbol *ctype = expr->unop->ctype;
1932 
1933 	switch (expr->op) {
1934 	case '(':
1935 		*expr = *expr->unop;
1936 		return ctype;
1937 
1938 	case '+':
1939 	case '-':
1940 	case '~':
1941 		return evaluate_sign(expr);
1942 
1943 	case '*':
1944 		return evaluate_dereference(expr);
1945 
1946 	case '&':
1947 		return evaluate_addressof(expr);
1948 
1949 	case SPECIAL_INCREMENT:
1950 	case SPECIAL_DECREMENT:
1951 		/*
1952 		 * From a type evaluation standpoint the preops are
1953 		 * the same as the postops
1954 		 */
1955 		return evaluate_postop(expr);
1956 
1957 	case '!':
1958 		ctype = degenerate(expr->unop);
1959 		expr->flags = expr->unop->flags & ~CEF_CONST_MASK;
1960 		/*
1961 		 * A logical negation never yields an address constant
1962 		 * [6.6(9)].
1963 		 */
1964 		expr->flags &= ~CEF_ADDR;
1965 
1966 		if (is_safe_type(ctype))
1967 			warning(expr->pos, "testing a 'safe expression'");
1968 		if (is_float_type(ctype)) {
1969 			struct expression *arg = expr->unop;
1970 			expr->type = EXPR_COMPARE;
1971 			expr->op = SPECIAL_EQUAL;
1972 			expr->left = arg;
1973 			expr->right = alloc_expression(expr->pos, EXPR_FVALUE);
1974 			expr->right->ctype = ctype;
1975 			expr->right->fvalue = 0;
1976 		} else if (is_fouled_type(ctype)) {
1977 			warning(expr->pos, "%s degrades to integer",
1978 				show_typename(ctype->ctype.base_type));
1979 		}
1980 		/* the result is int [6.5.3.3(5)]*/
1981 		ctype = &int_ctype;
1982 		break;
1983 
1984 	default:
1985 		break;
1986 	}
1987 	expr->ctype = ctype;
1988 	return ctype;
1989 }
1990 
find_identifier(struct ident * ident,struct symbol_list * _list,int * offset)1991 struct symbol *find_identifier(struct ident *ident, struct symbol_list *_list, int *offset)
1992 {
1993 	struct ptr_list *head = (struct ptr_list *)_list;
1994 	struct ptr_list *list = head;
1995 
1996 	if (!head)
1997 		return NULL;
1998 	do {
1999 		int i;
2000 		for (i = 0; i < list->nr; i++) {
2001 			struct symbol *sym = (struct symbol *) list->list[i];
2002 			if (sym->ident) {
2003 				if (sym->ident != ident)
2004 					continue;
2005 				*offset = sym->offset;
2006 				return sym;
2007 			} else {
2008 				struct symbol *ctype = sym->ctype.base_type;
2009 				struct symbol *sub;
2010 				if (!ctype)
2011 					continue;
2012 				if (ctype->type != SYM_UNION && ctype->type != SYM_STRUCT)
2013 					continue;
2014 				sub = find_identifier(ident, ctype->symbol_list, offset);
2015 				if (!sub)
2016 					continue;
2017 				*offset += sym->offset;
2018 				return sub;
2019 			}
2020 		}
2021 	} while ((list = list->next) != head);
2022 	return NULL;
2023 }
2024 
evaluate_offset(struct expression * expr,unsigned long offset)2025 static struct expression *evaluate_offset(struct expression *expr, unsigned long offset)
2026 {
2027 	struct expression *add;
2028 
2029 	/*
2030 	 * Create a new add-expression
2031 	 *
2032 	 * NOTE! Even if we just add zero, we need a new node
2033 	 * for the member pointer, since it has a different
2034 	 * type than the original pointer. We could make that
2035 	 * be just a cast, but the fact is, a node is a node,
2036 	 * so we might as well just do the "add zero" here.
2037 	 */
2038 	add = alloc_expression(expr->pos, EXPR_BINOP);
2039 	add->op = '+';
2040 	add->left = expr;
2041 	add->right = alloc_expression(expr->pos, EXPR_VALUE);
2042 	add->right->ctype = &int_ctype;
2043 	add->right->value = offset;
2044 
2045 	/*
2046 	 * The ctype of the pointer will be lazily evaluated if
2047 	 * we ever take the address of this member dereference..
2048 	 */
2049 	add->ctype = &lazy_ptr_ctype;
2050 	/*
2051 	 * The resulting address of a member access through an address
2052 	 * constant is an address constant again [6.6(9)].
2053 	 */
2054 	add->flags = expr->flags;
2055 
2056 	return add;
2057 }
2058 
2059 /* structure/union dereference */
evaluate_member_dereference(struct expression * expr)2060 static struct symbol *evaluate_member_dereference(struct expression *expr)
2061 {
2062 	int offset;
2063 	struct symbol *ctype, *member;
2064 	struct expression *deref = expr->deref, *add;
2065 	struct ident *ident = expr->member;
2066 	struct ident *address_space;
2067 	unsigned int mod;
2068 
2069 	if (!evaluate_expression(deref))
2070 		return NULL;
2071 	if (!ident) {
2072 		expression_error(expr, "bad member name");
2073 		return NULL;
2074 	}
2075 
2076 	ctype = deref->ctype;
2077 	examine_symbol_type(ctype);
2078 	address_space = ctype->ctype.as;
2079 	mod = ctype->ctype.modifiers;
2080 	if (ctype->type == SYM_NODE) {
2081 		ctype = ctype->ctype.base_type;
2082 		combine_address_space(deref->pos, &address_space, ctype->ctype.as);
2083 		mod |= ctype->ctype.modifiers;
2084 	}
2085 	if (!ctype || (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION)) {
2086 		expression_error(expr, "expected structure or union");
2087 		return NULL;
2088 	}
2089 	offset = 0;
2090 	member = find_identifier(ident, ctype->symbol_list, &offset);
2091 	if (!member) {
2092 		const char *type = ctype->type == SYM_STRUCT ? "struct" : "union";
2093 		const char *name = "<unnamed>";
2094 		int namelen = 9;
2095 		if (ctype->ident) {
2096 			name = ctype->ident->name;
2097 			namelen = ctype->ident->len;
2098 		}
2099 		if (ctype->symbol_list)
2100 			expression_error(expr, "no member '%s' in %s %.*s",
2101 				show_ident(ident), type, namelen, name);
2102 		else
2103 			expression_error(expr, "using member '%s' in "
2104 				"incomplete %s %.*s", show_ident(ident),
2105 				type, namelen, name);
2106 		return NULL;
2107 	}
2108 
2109 	/*
2110 	 * The member needs to take on the address space and modifiers of
2111 	 * the "parent" type.
2112 	 */
2113 	member = convert_to_as_mod(member, address_space, mod);
2114 	ctype = get_base_type(member);
2115 
2116 	if (!lvalue_expression(deref)) {
2117 		if (deref->type != EXPR_SLICE) {
2118 			expr->base = deref;
2119 			expr->r_bitpos = 0;
2120 		} else {
2121 			expr->base = deref->base;
2122 			expr->r_bitpos = deref->r_bitpos;
2123 		}
2124 		expr->r_bitpos += bytes_to_bits(offset);
2125 		expr->type = EXPR_SLICE;
2126 		expr->r_nrbits = member->bit_size;
2127 		expr->r_bitpos += member->bit_offset;
2128 		expr->ctype = member;
2129 		return member;
2130 	}
2131 
2132 	deref = deref->unop;
2133 	expr->deref = deref;
2134 
2135 	add = evaluate_offset(deref, offset);
2136 	expr->type = EXPR_PREOP;
2137 	expr->op = '*';
2138 	expr->unop = add;
2139 
2140 	expr->ctype = member;
2141 	return member;
2142 }
2143 
is_promoted(struct expression * expr)2144 static int is_promoted(struct expression *expr)
2145 {
2146 	while (1) {
2147 		switch (expr->type) {
2148 		case EXPR_BINOP:
2149 		case EXPR_SELECT:
2150 		case EXPR_CONDITIONAL:
2151 			return 1;
2152 		case EXPR_COMMA:
2153 			expr = expr->right;
2154 			continue;
2155 		case EXPR_PREOP:
2156 			switch (expr->op) {
2157 			case '(':
2158 				expr = expr->unop;
2159 				continue;
2160 			case '+':
2161 			case '-':
2162 			case '~':
2163 				return 1;
2164 			default:
2165 				return 0;
2166 			}
2167 		default:
2168 			return 0;
2169 		}
2170 	}
2171 }
2172 
2173 
2174 static struct symbol *evaluate_cast(struct expression *);
2175 
evaluate_type_information(struct expression * expr)2176 static struct symbol *evaluate_type_information(struct expression *expr)
2177 {
2178 	struct symbol *sym = expr->cast_type;
2179 	if (!sym) {
2180 		sym = evaluate_expression(expr->cast_expression);
2181 		if (!sym)
2182 			return NULL;
2183 		/*
2184 		 * Expressions of restricted types will possibly get
2185 		 * promoted - check that here
2186 		 */
2187 		if (is_restricted_type(sym)) {
2188 			if (sym->bit_size < bits_in_int && is_promoted(expr))
2189 				sym = &int_ctype;
2190 		} else if (is_fouled_type(sym)) {
2191 			sym = &int_ctype;
2192 		}
2193 	}
2194 	examine_symbol_type(sym);
2195 	if (is_bitfield_type(sym)) {
2196 		expression_error(expr, "trying to examine bitfield type");
2197 		return NULL;
2198 	}
2199 	return sym;
2200 }
2201 
evaluate_sizeof(struct expression * expr)2202 static struct symbol *evaluate_sizeof(struct expression *expr)
2203 {
2204 	struct symbol *type;
2205 	int size;
2206 
2207 	type = evaluate_type_information(expr);
2208 	if (!type)
2209 		return NULL;
2210 
2211 	size = type->bit_size;
2212 
2213 	if (size < 0 && is_void_type(type)) {
2214 		if (Wpointer_arith)
2215 			warning(expr->pos, "expression using sizeof(void)");
2216 		size = bits_in_char;
2217 	}
2218 
2219 	if (is_bool_type(type)) {
2220 		if (Wsizeof_bool)
2221 			warning(expr->pos, "expression using sizeof _Bool");
2222 		size = bits_to_bytes(bits_in_bool) * bits_in_char;
2223 	}
2224 
2225 	if (is_function(type->ctype.base_type)) {
2226 		if (Wpointer_arith)
2227 			warning(expr->pos, "expression using sizeof on a function");
2228 		size = bits_in_char;
2229 	}
2230 
2231 	if (is_array_type(type) && size < 0) {	// VLA, 1-dimension only
2232 		struct expression *base, *size;
2233 		struct symbol *base_type;
2234 
2235 		if (type->type == SYM_NODE)
2236 			type = type->ctype.base_type;	// strip the SYM_NODE
2237 		base_type = get_base_type(type);
2238 		if (!base_type)
2239 			goto error;
2240 		if (base_type->bit_size <= 0) {
2241 			base = alloc_expression(expr->pos, EXPR_SIZEOF);
2242 			base->cast_type = base_type;
2243 			if (!evaluate_sizeof(base))
2244 				goto error;
2245 		} else {
2246 			base = alloc_expression(expr->pos, EXPR_VALUE);
2247 			base->value = bits_to_bytes(base_type->bit_size);
2248 			base->ctype = size_t_ctype;
2249 		}
2250 		size = alloc_expression(expr->pos, EXPR_CAST);
2251 		size->cast_type = size_t_ctype;
2252 		size->cast_expression = type->array_size;
2253 		if (!evaluate_expression(size))
2254 			goto error;
2255 		expr->left = size;
2256 		expr->right = base;
2257 		expr->type = EXPR_BINOP;
2258 		expr->op = '*';
2259 		return expr->ctype = size_t_ctype;
2260 	}
2261 
2262 error:
2263 	if ((size < 0) || (size & (bits_in_char - 1)))
2264 		expression_error(expr, "cannot size expression");
2265 
2266 	expr->type = EXPR_VALUE;
2267 	expr->value = bits_to_bytes(size);
2268 	expr->taint = 0;
2269 	expr->ctype = size_t_ctype;
2270 	return size_t_ctype;
2271 }
2272 
evaluate_ptrsizeof(struct expression * expr)2273 static struct symbol *evaluate_ptrsizeof(struct expression *expr)
2274 {
2275 	struct symbol *type;
2276 	int size;
2277 
2278 	type = evaluate_type_information(expr);
2279 	if (!type)
2280 		return NULL;
2281 
2282 	if (type->type == SYM_NODE)
2283 		type = type->ctype.base_type;
2284 	if (!type)
2285 		return NULL;
2286 	switch (type->type) {
2287 	case SYM_ARRAY:
2288 		break;
2289 	case SYM_PTR:
2290 		type = get_base_type(type);
2291 		if (type)
2292 			break;
2293 	default:
2294 		expression_error(expr, "expected pointer expression");
2295 		return NULL;
2296 	}
2297 	size = type->bit_size;
2298 	if (size & (bits_in_char-1))
2299 		size = 0;
2300 	expr->type = EXPR_VALUE;
2301 	expr->value = bits_to_bytes(size);
2302 	expr->taint = 0;
2303 	expr->ctype = size_t_ctype;
2304 	return size_t_ctype;
2305 }
2306 
evaluate_alignof(struct expression * expr)2307 static struct symbol *evaluate_alignof(struct expression *expr)
2308 {
2309 	struct symbol *type;
2310 
2311 	type = evaluate_type_information(expr);
2312 	if (!type)
2313 		return NULL;
2314 
2315 	expr->type = EXPR_VALUE;
2316 	expr->value = type->ctype.alignment;
2317 	expr->taint = 0;
2318 	expr->ctype = size_t_ctype;
2319 	return size_t_ctype;
2320 }
2321 
evaluate_arguments(struct symbol * fn,struct expression_list * head)2322 static int evaluate_arguments(struct symbol *fn, struct expression_list *head)
2323 {
2324 	struct expression *expr;
2325 	struct symbol_list *argument_types = fn->arguments;
2326 	struct symbol *argtype;
2327 	int i = 1;
2328 
2329 	PREPARE_PTR_LIST(argument_types, argtype);
2330 	FOR_EACH_PTR (head, expr) {
2331 		struct expression **p = THIS_ADDRESS(expr);
2332 		struct symbol *ctype, *target;
2333 		ctype = evaluate_expression(expr);
2334 
2335 		if (!ctype)
2336 			return 0;
2337 
2338 		target = argtype;
2339 		if (!target) {
2340 			struct symbol *type;
2341 			int class = classify_type(ctype, &type);
2342 			if (is_int(class)) {
2343 				*p = cast_to(expr, integer_promotion(type));
2344 			} else if (class & TYPE_FLOAT) {
2345 				unsigned long mod = type->ctype.modifiers;
2346 				if (!(mod & (MOD_LONG_ALL)))
2347 					*p = cast_to(expr, &double_ctype);
2348 			} else if (class & TYPE_PTR) {
2349 				if (expr->ctype == &null_ctype)
2350 					*p = cast_to(expr, &ptr_ctype);
2351 				else
2352 					degenerate(expr);
2353 			}
2354 		} else if (!target->forced_arg){
2355 			static char where[30];
2356 			examine_symbol_type(target);
2357 			sprintf(where, "argument %d", i);
2358 			compatible_argument_type(expr, target, p, where);
2359 		}
2360 
2361 		i++;
2362 		NEXT_PTR_LIST(argtype);
2363 	} END_FOR_EACH_PTR(expr);
2364 	FINISH_PTR_LIST(argtype);
2365 	return 1;
2366 }
2367 
convert_index(struct expression * e)2368 static void convert_index(struct expression *e)
2369 {
2370 	struct expression *child = e->idx_expression;
2371 	unsigned from = e->idx_from;
2372 	unsigned to = e->idx_to + 1;
2373 	e->type = EXPR_POS;
2374 	e->init_offset = from * bits_to_bytes(e->ctype->bit_size);
2375 	e->init_nr = to - from;
2376 	e->init_expr = child;
2377 }
2378 
convert_ident(struct expression * e)2379 static void convert_ident(struct expression *e)
2380 {
2381 	struct expression *child = e->ident_expression;
2382 	int offset = e->offset;
2383 
2384 	e->type = EXPR_POS;
2385 	e->init_offset = offset;
2386 	e->init_nr = 1;
2387 	e->init_expr = child;
2388 }
2389 
convert_designators(struct expression * e)2390 static void convert_designators(struct expression *e)
2391 {
2392 	while (e) {
2393 		if (e->type == EXPR_INDEX)
2394 			convert_index(e);
2395 		else if (e->type == EXPR_IDENTIFIER)
2396 			convert_ident(e);
2397 		else
2398 			break;
2399 		e = e->init_expr;
2400 	}
2401 }
2402 
excess(struct expression * e,const char * s)2403 static void excess(struct expression *e, const char *s)
2404 {
2405 	warning(e->pos, "excessive elements in %s initializer", s);
2406 }
2407 
2408 /*
2409  * implicit designator for the first element
2410  */
first_subobject(struct symbol * ctype,int class,struct expression ** v)2411 static struct expression *first_subobject(struct symbol *ctype, int class,
2412 					  struct expression **v)
2413 {
2414 	struct expression *e = *v, *new;
2415 
2416 	if (ctype->type == SYM_NODE)
2417 		ctype = ctype->ctype.base_type;
2418 
2419 	if (class & TYPE_PTR) { /* array */
2420 		if (!ctype->bit_size)
2421 			return NULL;
2422 		new = alloc_expression(e->pos, EXPR_INDEX);
2423 		new->idx_expression = e;
2424 		new->ctype = ctype->ctype.base_type;
2425 	} else  {
2426 		struct symbol *field, *p;
2427 		PREPARE_PTR_LIST(ctype->symbol_list, p);
2428 		while (p && !p->ident && is_bitfield_type(p))
2429 			NEXT_PTR_LIST(p);
2430 		field = p;
2431 		FINISH_PTR_LIST(p);
2432 		if (!field)
2433 			return NULL;
2434 		new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2435 		new->ident_expression = e;
2436 		new->field = new->ctype = field;
2437 		new->offset = field->offset;
2438 	}
2439 	*v = new;
2440 	return new;
2441 }
2442 
2443 /*
2444  * sanity-check explicit designators; return the innermost one or NULL
2445  * in case of error.  Assign types.
2446  */
check_designators(struct expression * e,struct symbol * ctype)2447 static struct expression *check_designators(struct expression *e,
2448 					    struct symbol *ctype)
2449 {
2450 	struct expression *last = NULL;
2451 	const char *err;
2452 	while (1) {
2453 		if (ctype->type == SYM_NODE)
2454 			ctype = ctype->ctype.base_type;
2455 		if (e->type == EXPR_INDEX) {
2456 			struct symbol *type;
2457 			if (ctype->type != SYM_ARRAY) {
2458 				err = "array index in non-array";
2459 				break;
2460 			}
2461 			type = ctype->ctype.base_type;
2462 			if (ctype->bit_size >= 0 && type->bit_size >= 0) {
2463 				unsigned offset = array_element_offset(type->bit_size, e->idx_to);
2464 				if (offset >= ctype->bit_size) {
2465 					err = "index out of bounds in";
2466 					break;
2467 				}
2468 			}
2469 			e->ctype = ctype = type;
2470 			ctype = type;
2471 			last = e;
2472 			if (!e->idx_expression) {
2473 				err = "invalid";
2474 				break;
2475 			}
2476 			e = e->idx_expression;
2477 		} else if (e->type == EXPR_IDENTIFIER) {
2478 			int offset = 0;
2479 			if (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION) {
2480 				err = "field name not in struct or union";
2481 				break;
2482 			}
2483 			ctype = find_identifier(e->expr_ident, ctype->symbol_list, &offset);
2484 			if (!ctype) {
2485 				err = "unknown field name in";
2486 				break;
2487 			}
2488 			e->offset = offset;
2489 			e->field = e->ctype = ctype;
2490 			last = e;
2491 			if (!e->ident_expression) {
2492 				err = "invalid";
2493 				break;
2494 			}
2495 			e = e->ident_expression;
2496 		} else if (e->type == EXPR_POS) {
2497 			err = "internal front-end error: EXPR_POS in";
2498 			break;
2499 		} else
2500 			return last;
2501 	}
2502 	expression_error(e, "%s initializer", err);
2503 	return NULL;
2504 }
2505 
2506 /*
2507  * choose the next subobject to initialize.
2508  *
2509  * Get designators for next element, switch old ones to EXPR_POS.
2510  * Return the resulting expression or NULL if we'd run out of subobjects.
2511  * The innermost designator is returned in *v.  Designators in old
2512  * are assumed to be already sanity-checked.
2513  */
next_designators(struct expression * old,struct symbol * ctype,struct expression * e,struct expression ** v)2514 static struct expression *next_designators(struct expression *old,
2515 			     struct symbol *ctype,
2516 			     struct expression *e, struct expression **v)
2517 {
2518 	struct expression *new = NULL;
2519 
2520 	if (!old)
2521 		return NULL;
2522 	if (old->type == EXPR_INDEX) {
2523 		struct expression *copy;
2524 		unsigned n;
2525 
2526 		copy = next_designators(old->idx_expression,
2527 					old->ctype, e, v);
2528 		if (!copy) {
2529 			n = old->idx_to + 1;
2530 			if (array_element_offset(old->ctype->bit_size, n) == ctype->bit_size) {
2531 				convert_index(old);
2532 				return NULL;
2533 			}
2534 			copy = e;
2535 			*v = new = alloc_expression(e->pos, EXPR_INDEX);
2536 		} else {
2537 			n = old->idx_to;
2538 			new = alloc_expression(e->pos, EXPR_INDEX);
2539 		}
2540 
2541 		new->idx_from = new->idx_to = n;
2542 		new->idx_expression = copy;
2543 		new->ctype = old->ctype;
2544 		convert_index(old);
2545 	} else if (old->type == EXPR_IDENTIFIER) {
2546 		struct expression *copy;
2547 		struct symbol *field;
2548 		int offset = 0;
2549 
2550 		copy = next_designators(old->ident_expression,
2551 					old->ctype, e, v);
2552 		if (!copy) {
2553 			field = old->field->next_subobject;
2554 			if (!field) {
2555 				convert_ident(old);
2556 				return NULL;
2557 			}
2558 			copy = e;
2559 			*v = new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2560 			/*
2561 			 * We can't necessarily trust "field->offset",
2562 			 * because the field might be in an anonymous
2563 			 * union, and the field offset is then the offset
2564 			 * within that union.
2565 			 *
2566 			 * The "old->offset - old->field->offset"
2567 			 * would be the offset of such an anonymous
2568 			 * union.
2569 			 */
2570 			offset = old->offset - old->field->offset;
2571 		} else {
2572 			field = old->field;
2573 			new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2574 		}
2575 
2576 		new->field = field;
2577 		new->expr_ident = field->ident;
2578 		new->ident_expression = copy;
2579 		new->ctype = field;
2580 		new->offset = field->offset + offset;
2581 		convert_ident(old);
2582 	}
2583 	return new;
2584 }
2585 
2586 static int handle_initializer(struct expression **ep, int nested,
2587 		int class, struct symbol *ctype, unsigned long mods);
2588 
2589 /*
2590  * deal with traversing subobjects [6.7.8(17,18,20)]
2591  */
handle_list_initializer(struct expression * expr,int class,struct symbol * ctype,unsigned long mods)2592 static void handle_list_initializer(struct expression *expr,
2593 		int class, struct symbol *ctype, unsigned long mods)
2594 {
2595 	struct expression *e, *last = NULL, *top = NULL, *next;
2596 	int jumped = 0;
2597 
2598 	FOR_EACH_PTR(expr->expr_list, e) {
2599 		struct expression **v;
2600 		struct symbol *type;
2601 		int lclass;
2602 
2603 		if (e->type != EXPR_INDEX && e->type != EXPR_IDENTIFIER) {
2604 			struct symbol *struct_sym;
2605 			if (!top) {
2606 				top = e;
2607 				last = first_subobject(ctype, class, &top);
2608 			} else {
2609 				last = next_designators(last, ctype, e, &top);
2610 			}
2611 			if (!last) {
2612 				excess(e, class & TYPE_PTR ? "array" :
2613 							"struct or union");
2614 				DELETE_CURRENT_PTR(e);
2615 				continue;
2616 			}
2617 			struct_sym = ctype->type == SYM_NODE ? ctype->ctype.base_type : ctype;
2618 			if (Wdesignated_init && struct_sym->designated_init)
2619 				warning(e->pos, "%s%.*s%spositional init of field in %s %s, declared with attribute designated_init",
2620 					ctype->ident ? "in initializer for " : "",
2621 					ctype->ident ? ctype->ident->len : 0,
2622 					ctype->ident ? ctype->ident->name : "",
2623 					ctype->ident ? ": " : "",
2624 					get_type_name(struct_sym->type),
2625 					show_ident(struct_sym->ident));
2626 			if (jumped) {
2627 				warning(e->pos, "advancing past deep designator");
2628 				jumped = 0;
2629 			}
2630 			REPLACE_CURRENT_PTR(e, last);
2631 		} else {
2632 			next = check_designators(e, ctype);
2633 			if (!next) {
2634 				DELETE_CURRENT_PTR(e);
2635 				continue;
2636 			}
2637 			top = next;
2638 			/* deeper than one designator? */
2639 			jumped = top != e;
2640 			convert_designators(last);
2641 			last = e;
2642 		}
2643 
2644 found:
2645 		lclass = classify_type(top->ctype, &type);
2646 		if (top->type == EXPR_INDEX)
2647 			v = &top->idx_expression;
2648 		else
2649 			v = &top->ident_expression;
2650 
2651 		mods |= ctype->ctype.modifiers & MOD_STORAGE;
2652 		if (handle_initializer(v, 1, lclass, top->ctype, mods))
2653 			continue;
2654 
2655 		if (!(lclass & TYPE_COMPOUND)) {
2656 			warning(e->pos, "bogus scalar initializer");
2657 			DELETE_CURRENT_PTR(e);
2658 			continue;
2659 		}
2660 
2661 		next = first_subobject(type, lclass, v);
2662 		if (next) {
2663 			warning(e->pos, "missing braces around initializer");
2664 			top = next;
2665 			goto found;
2666 		}
2667 
2668 		DELETE_CURRENT_PTR(e);
2669 		excess(e, lclass & TYPE_PTR ? "array" : "struct or union");
2670 
2671 	} END_FOR_EACH_PTR(e);
2672 
2673 	convert_designators(last);
2674 	expr->ctype = ctype;
2675 }
2676 
is_string_literal(struct expression ** v)2677 static int is_string_literal(struct expression **v)
2678 {
2679 	struct expression *e = *v;
2680 	while (e && e->type == EXPR_PREOP && e->op == '(')
2681 		e = e->unop;
2682 	if (!e || e->type != EXPR_STRING)
2683 		return 0;
2684 	if (e != *v && Wparen_string)
2685 		warning(e->pos,
2686 			"array initialized from parenthesized string constant");
2687 	*v = e;
2688 	return 1;
2689 }
2690 
2691 /*
2692  * We want a normal expression, possibly in one layer of braces.  Warn
2693  * if the latter happens inside a list (it's legal, but likely to be
2694  * an effect of screwup).  In case of anything not legal, we are definitely
2695  * having an effect of screwup, so just fail and let the caller warn.
2696  */
handle_scalar(struct expression * e,int nested)2697 static struct expression *handle_scalar(struct expression *e, int nested)
2698 {
2699 	struct expression *v = NULL, *p;
2700 	int count = 0;
2701 
2702 	/* normal case */
2703 	if (e->type != EXPR_INITIALIZER)
2704 		return e;
2705 
2706 	FOR_EACH_PTR(e->expr_list, p) {
2707 		if (!v)
2708 			v = p;
2709 		count++;
2710 	} END_FOR_EACH_PTR(p);
2711 	if (count != 1)
2712 		return NULL;
2713 	switch(v->type) {
2714 	case EXPR_INITIALIZER:
2715 	case EXPR_INDEX:
2716 	case EXPR_IDENTIFIER:
2717 		return NULL;
2718 	default:
2719 		break;
2720 	}
2721 	if (nested)
2722 		warning(e->pos, "braces around scalar initializer");
2723 	return v;
2724 }
2725 
2726 /*
2727  * deal with the cases that don't care about subobjects:
2728  * scalar <- assignment expression, possibly in braces [6.7.8(11)]
2729  * character array <- string literal, possibly in braces [6.7.8(14)]
2730  * struct or union <- assignment expression of compatible type [6.7.8(13)]
2731  * compound type <- initializer list in braces [6.7.8(16)]
2732  * The last one punts to handle_list_initializer() which, in turn will call
2733  * us for individual elements of the list.
2734  *
2735  * We do not handle 6.7.8(15) (wide char array <- wide string literal) for
2736  * the lack of support of wide char stuff in general.
2737  *
2738  * One note: we need to take care not to evaluate a string literal until
2739  * we know that we *will* handle it right here.  Otherwise we would screw
2740  * the cases like struct { struct {char s[10]; ...} ...} initialized with
2741  * { "string", ...} - we need to preserve that string literal recognizable
2742  * until we dig into the inner struct.
2743  */
handle_initializer(struct expression ** ep,int nested,int class,struct symbol * ctype,unsigned long mods)2744 static int handle_initializer(struct expression **ep, int nested,
2745 		int class, struct symbol *ctype, unsigned long mods)
2746 {
2747 	int is_string = is_string_type(ctype);
2748 	struct expression *e = *ep, *p;
2749 	struct symbol *type;
2750 
2751 	if (!e)
2752 		return 0;
2753 
2754 	/* scalar */
2755 	if (!(class & TYPE_COMPOUND)) {
2756 		e = handle_scalar(e, nested);
2757 		if (!e)
2758 			return 0;
2759 		*ep = e;
2760 		if (!evaluate_expression(e))
2761 			return 1;
2762 		compatible_assignment_types(e, ctype, ep, "initializer");
2763 		/*
2764 		 * Initializers for static storage duration objects
2765 		 * shall be constant expressions or a string literal [6.7.8(4)].
2766 		 */
2767 		mods |= ctype->ctype.modifiers;
2768 		mods &= (MOD_TOPLEVEL | MOD_STATIC);
2769 		if (mods && !(e->flags & (CEF_ACE | CEF_ADDR)))
2770 			if (Wconstexpr_not_const)
2771 				warning(e->pos, "non-constant initializer for static object");
2772 
2773 		return 1;
2774 	}
2775 
2776 	/*
2777 	 * sublist; either a string, or we dig in; the latter will deal with
2778 	 * pathologies, so we don't need anything fancy here.
2779 	 */
2780 	if (e->type == EXPR_INITIALIZER) {
2781 		if (is_string) {
2782 			struct expression *v = NULL;
2783 			int count = 0;
2784 
2785 			FOR_EACH_PTR(e->expr_list, p) {
2786 				if (!v)
2787 					v = p;
2788 				count++;
2789 			} END_FOR_EACH_PTR(p);
2790 			if (count == 1 && is_string_literal(&v)) {
2791 				*ep = e = v;
2792 				goto String;
2793 			}
2794 		}
2795 		handle_list_initializer(e, class, ctype, mods);
2796 		return 1;
2797 	}
2798 
2799 	/* string */
2800 	if (is_string_literal(&e)) {
2801 		/* either we are doing array of char, or we'll have to dig in */
2802 		if (is_string) {
2803 			*ep = e;
2804 			goto String;
2805 		}
2806 		return 0;
2807 	}
2808 	/* struct or union can be initialized by compatible */
2809 	if (class != TYPE_COMPOUND)
2810 		return 0;
2811 	type = evaluate_expression(e);
2812 	if (!type)
2813 		return 0;
2814 	if (ctype->type == SYM_NODE)
2815 		ctype = ctype->ctype.base_type;
2816 	if (type->type == SYM_NODE)
2817 		type = type->ctype.base_type;
2818 	if (ctype == type)
2819 		return 1;
2820 	return 0;
2821 
2822 String:
2823 	p = alloc_expression(e->pos, EXPR_STRING);
2824 	*p = *e;
2825 	type = evaluate_expression(p);
2826 	if (ctype->bit_size != -1) {
2827 		if (ctype->bit_size + bits_in_char < type->bit_size)
2828 			warning(e->pos,
2829 				"too long initializer-string for array of char");
2830 		else if (Winit_cstring && ctype->bit_size + bits_in_char == type->bit_size) {
2831 			warning(e->pos,
2832 				"too long initializer-string for array of char(no space for nul char)");
2833 		}
2834 	}
2835 	*ep = p;
2836 	return 1;
2837 }
2838 
evaluate_initializer(struct symbol * ctype,struct expression ** ep)2839 static void evaluate_initializer(struct symbol *ctype, struct expression **ep)
2840 {
2841 	struct symbol *type;
2842 	int class = classify_type(ctype, &type);
2843 	if (!handle_initializer(ep, 0, class, ctype, 0))
2844 		expression_error(*ep, "invalid initializer");
2845 }
2846 
cast_to_bool(struct expression * expr)2847 static struct symbol *cast_to_bool(struct expression *expr)
2848 {
2849 	struct expression *old = expr->cast_expression;
2850 	struct expression *zero;
2851 	struct symbol *otype;
2852 	int oclass = classify_type(degenerate(old), &otype);
2853 	struct symbol *ctype;
2854 
2855 	if (oclass & TYPE_COMPOUND)
2856 		return NULL;
2857 
2858 	zero = alloc_const_expression(expr->pos, 0);
2859 	expr->op = SPECIAL_NOTEQUAL;
2860 	ctype = usual_conversions(expr->op, old, zero,
2861 			oclass, TYPE_NUM, otype, zero->ctype);
2862 	expr->type = EXPR_COMPARE;
2863 	expr->left = cast_to(old, ctype);
2864 	expr->right = cast_to(zero, ctype);
2865 
2866 	return expr->ctype;
2867 }
2868 
cast_flags(struct expression * expr,struct expression * old)2869 static int cast_flags(struct expression *expr, struct expression *old)
2870 {
2871 	struct symbol *t;
2872 	int class;
2873 	int flags = CEF_NONE;
2874 
2875 	class = classify_type(expr->ctype, &t);
2876 	if (class & TYPE_NUM) {
2877 		flags = old->flags & ~CEF_CONST_MASK;
2878 		/*
2879 		 * Casts to numeric types never result in address
2880 		 * constants [6.6(9)].
2881 		 */
2882 		flags &= ~CEF_ADDR;
2883 
2884 		/*
2885 		 * As an extension, treat address constants cast to
2886 		 * integer type as an arithmetic constant.
2887 		 */
2888 		if (old->flags & CEF_ADDR)
2889 			flags = CEF_ACE;
2890 
2891 		/*
2892 		 * Cast to float type -> not an integer constant
2893 		 * expression [6.6(6)].
2894 		 */
2895 		if (class & TYPE_FLOAT)
2896 			flags &= ~CEF_CLR_ICE;
2897 		/*
2898 		 * Casts of float literals to integer type results in
2899 		 * a constant integer expression [6.6(6)].
2900 		 */
2901 		else if (old->flags & CEF_FLOAT)
2902 			flags = CEF_SET_ICE;
2903 	} else if (class & TYPE_PTR) {
2904 		/*
2905 		 * Casts of integer literals to pointer type yield
2906 		 * address constants [6.6(9)].
2907 		 *
2908 		 * As an extension, treat address constants cast to a
2909 		 * different pointer type as address constants again.
2910 		 *
2911 		 * As another extension, treat integer constant
2912 		 * expressions (in contrast to literals) cast to
2913 		 * pointer type as address constants.
2914 		 */
2915 		if (old->flags & (CEF_ICE | CEF_ADDR))
2916 			flags = CEF_ADDR;
2917 	}
2918 
2919 	return flags;
2920 }
2921 
evaluate_cast(struct expression * expr)2922 static struct symbol *evaluate_cast(struct expression *expr)
2923 {
2924 	struct expression *source = expr->cast_expression;
2925 	struct symbol *ctype;
2926 	struct symbol *ttype, *stype;
2927 	int tclass, sclass;
2928 	struct ident *tas = NULL, *sas = NULL;
2929 
2930 	if (!source)
2931 		return NULL;
2932 
2933 	/*
2934 	 * Special case: a cast can be followed by an
2935 	 * initializer, in which case we need to pass
2936 	 * the type value down to that initializer rather
2937 	 * than trying to evaluate it as an expression
2938 	 *
2939 	 * A more complex case is when the initializer is
2940 	 * dereferenced as part of a post-fix expression.
2941 	 * We need to produce an expression that can be dereferenced.
2942 	 */
2943 	if (source->type == EXPR_INITIALIZER) {
2944 		struct symbol *sym = expr->cast_type;
2945 		struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
2946 
2947 		sym->initializer = source;
2948 		evaluate_symbol(sym);
2949 
2950 		addr->ctype = &lazy_ptr_ctype;	/* Lazy eval */
2951 		addr->symbol = sym;
2952 		if (sym->ctype.modifiers & MOD_TOPLEVEL)
2953 			addr->flags |= CEF_ADDR;
2954 
2955 		expr->type = EXPR_PREOP;
2956 		expr->op = '*';
2957 		expr->unop = addr;
2958 		expr->ctype = sym;
2959 
2960 		return sym;
2961 	}
2962 
2963 	ctype = examine_symbol_type(expr->cast_type);
2964 	expr->ctype = ctype;
2965 	expr->cast_type = ctype;
2966 
2967 	evaluate_expression(source);
2968 	degenerate(source);
2969 
2970 	tclass = classify_type(ctype, &ttype);
2971 
2972 	expr->flags = cast_flags(expr, source);
2973 
2974 	/*
2975 	 * You can always throw a value away by casting to
2976 	 * "void" - that's an implicit "force". Note that
2977 	 * the same is _not_ true of "void *".
2978 	 */
2979 	if (ttype == &void_ctype)
2980 		goto out;
2981 
2982 	stype = source->ctype;
2983 	if (!stype) {
2984 		expression_error(expr, "cast from unknown type");
2985 		goto out;
2986 	}
2987 	sclass = classify_type(stype, &stype);
2988 
2989 	if (expr->type == EXPR_FORCE_CAST)
2990 		goto out;
2991 
2992 	if (tclass & (TYPE_COMPOUND | TYPE_FN))
2993 		warning(expr->pos, "cast to non-scalar");
2994 
2995 	if (sclass & TYPE_COMPOUND)
2996 		warning(expr->pos, "cast from non-scalar");
2997 
2998 	/* allowed cast unfouls */
2999 	if (sclass & TYPE_FOULED)
3000 		stype = unfoul(stype);
3001 
3002 	if (ttype != stype) {
3003 		if ((tclass & TYPE_RESTRICT) && restricted_value(source, ttype))
3004 			warning(expr->pos, "cast to %s",
3005 				show_typename(ttype));
3006 		if (sclass & TYPE_RESTRICT) {
3007 			if (ttype == &bool_ctype) {
3008 				if (sclass & TYPE_FOULED)
3009 					warning(expr->pos, "%s degrades to integer",
3010 						show_typename(stype));
3011 			} else {
3012 				warning(expr->pos, "cast from %s",
3013 					show_typename(stype));
3014 			}
3015 		}
3016 	}
3017 
3018 	if ((ttype == &ulong_ctype || ttype == uintptr_ctype) && !Wcast_from_as)
3019 		tas = &bad_address_space;
3020 	else if (tclass == TYPE_PTR) {
3021 		examine_pointer_target(ttype);
3022 		tas = ttype->ctype.as;
3023 	}
3024 
3025 	if ((stype == &ulong_ctype || stype == uintptr_ctype))
3026 		sas = &bad_address_space;
3027 	else if (sclass == TYPE_PTR) {
3028 		examine_pointer_target(stype);
3029 		sas = stype->ctype.as;
3030 	}
3031 
3032 	if (!tas && valid_as(sas))
3033 		warning(expr->pos, "cast removes address space '%s' of expression", show_as(sas));
3034 	if (valid_as(tas) && valid_as(sas) && tas != sas)
3035 		warning(expr->pos, "cast between address spaces (%s -> %s)", show_as(sas), show_as(tas));
3036 	if (valid_as(tas) && !sas &&
3037 	    !is_null_pointer_constant(source) && Wcast_to_as)
3038 		warning(expr->pos,
3039 			"cast adds address space '%s' to expression", show_as(tas));
3040 
3041 	if (!(ttype->ctype.modifiers & MOD_PTRINHERIT) && tclass == TYPE_PTR &&
3042 	    !tas && (source->flags & CEF_ICE)) {
3043 		if (ttype->ctype.base_type == &void_ctype) {
3044 			if (is_zero_constant(source)) {
3045 				/* NULL */
3046 				expr->type = EXPR_VALUE;
3047 				expr->ctype = &null_ctype;
3048 				expr->value = 0;
3049 				return expr->ctype;
3050 			}
3051 		}
3052 	}
3053 
3054 	if (ttype == &bool_ctype)
3055 		cast_to_bool(expr);
3056 
3057 	// checks pointers to restricted
3058 	while (Wbitwise_pointer && tclass == TYPE_PTR && sclass == TYPE_PTR) {
3059 		tclass = classify_type(ttype->ctype.base_type, &ttype);
3060 		sclass = classify_type(stype->ctype.base_type, &stype);
3061 		if (ttype == stype)
3062 			break;
3063 		if (!ttype || !stype)
3064 			break;
3065 		if (ttype == &void_ctype || stype == &void_ctype)
3066 			break;
3067 		if (tclass & TYPE_RESTRICT) {
3068 			warning(expr->pos, "cast to %s", show_typename(ctype));
3069 			break;
3070 		}
3071 		if (sclass & TYPE_RESTRICT) {
3072 			warning(expr->pos, "cast from %s", show_typename(source->ctype));
3073 			break;
3074 		}
3075 	}
3076 out:
3077 	return ctype;
3078 }
3079 
3080 /*
3081  * Evaluate a call expression with a symbol. This
3082  * should expand inline functions, and evaluate
3083  * builtins.
3084  */
evaluate_symbol_call(struct expression * expr)3085 static int evaluate_symbol_call(struct expression *expr)
3086 {
3087 	struct expression *fn = expr->fn;
3088 	struct symbol *ctype = fn->ctype;
3089 
3090 	if (fn->type != EXPR_PREOP)
3091 		return 0;
3092 
3093 	if (ctype->op && ctype->op->evaluate)
3094 		return ctype->op->evaluate(expr);
3095 
3096 	if (ctype->ctype.modifiers & MOD_INLINE) {
3097 		int ret;
3098 		struct symbol *curr = current_fn;
3099 
3100 		if (ctype->definition)
3101 			ctype = ctype->definition;
3102 
3103 		current_fn = ctype->ctype.base_type;
3104 
3105 		ret = inline_function(expr, ctype);
3106 
3107 		/* restore the old function */
3108 		current_fn = curr;
3109 		return ret;
3110 	}
3111 
3112 	return 0;
3113 }
3114 
evaluate_call(struct expression * expr)3115 static struct symbol *evaluate_call(struct expression *expr)
3116 {
3117 	int args, fnargs;
3118 	struct symbol *ctype, *sym;
3119 	struct expression *fn = expr->fn;
3120 	struct expression_list *arglist = expr->args;
3121 
3122 	if (!evaluate_expression(fn))
3123 		return NULL;
3124 	sym = ctype = fn->ctype;
3125 	if (ctype->type == SYM_NODE)
3126 		ctype = ctype->ctype.base_type;
3127 	if (ctype->type == SYM_PTR)
3128 		ctype = get_base_type(ctype);
3129 
3130 	if (ctype->type != SYM_FN) {
3131 		struct expression *arg;
3132 		expression_error(expr, "not a function %s",
3133 			     show_ident(sym->ident));
3134 		/* do typechecking in arguments */
3135 		FOR_EACH_PTR (arglist, arg) {
3136 			evaluate_expression(arg);
3137 		} END_FOR_EACH_PTR(arg);
3138 		return NULL;
3139 	}
3140 
3141 	examine_fn_arguments(ctype);
3142         if (sym->type == SYM_NODE && fn->type == EXPR_PREOP &&
3143 	    sym->op && sym->op->args) {
3144 		if (!sym->op->args(expr))
3145 			return NULL;
3146 	} else {
3147 		if (!evaluate_arguments(ctype, arglist))
3148 			return NULL;
3149 		args = expression_list_size(expr->args);
3150 		fnargs = symbol_list_size(ctype->arguments);
3151 		if (args < fnargs) {
3152 			expression_error(expr,
3153 				     "not enough arguments for function %s",
3154 				     show_ident(sym->ident));
3155 			return NULL;
3156 		}
3157 		if (args > fnargs && !ctype->variadic)
3158 			expression_error(expr,
3159 				     "too many arguments for function %s",
3160 				     show_ident(sym->ident));
3161 	}
3162 	expr->ctype = ctype->ctype.base_type;
3163 	if (sym->type == SYM_NODE) {
3164 		if (evaluate_symbol_call(expr))
3165 			return expr->ctype;
3166 	}
3167 	return expr->ctype;
3168 }
3169 
evaluate_offsetof(struct expression * expr)3170 static struct symbol *evaluate_offsetof(struct expression *expr)
3171 {
3172 	struct expression *e = expr->down;
3173 	struct symbol *ctype = expr->in;
3174 	int class;
3175 
3176 	if (expr->op == '.') {
3177 		struct symbol *field;
3178 		int offset = 0;
3179 		if (!ctype) {
3180 			expression_error(expr, "expected structure or union");
3181 			return NULL;
3182 		}
3183 		examine_symbol_type(ctype);
3184 		class = classify_type(ctype, &ctype);
3185 		if (class != TYPE_COMPOUND) {
3186 			expression_error(expr, "expected structure or union");
3187 			return NULL;
3188 		}
3189 
3190 		field = find_identifier(expr->ident, ctype->symbol_list, &offset);
3191 		if (!field) {
3192 			expression_error(expr, "unknown member");
3193 			return NULL;
3194 		}
3195 		ctype = field;
3196 		expr->type = EXPR_VALUE;
3197 		expr->flags = CEF_SET_ICE;
3198 		expr->value = offset;
3199 		expr->taint = 0;
3200 		expr->ctype = size_t_ctype;
3201 	} else {
3202 		if (!ctype) {
3203 			expression_error(expr, "expected structure or union");
3204 			return NULL;
3205 		}
3206 		examine_symbol_type(ctype);
3207 		class = classify_type(ctype, &ctype);
3208 		if (class != (TYPE_COMPOUND | TYPE_PTR)) {
3209 			expression_error(expr, "expected array");
3210 			return NULL;
3211 		}
3212 		ctype = ctype->ctype.base_type;
3213 		if (!expr->index) {
3214 			expr->type = EXPR_VALUE;
3215 			expr->flags = CEF_SET_ICE;
3216 			expr->value = 0;
3217 			expr->taint = 0;
3218 			expr->ctype = size_t_ctype;
3219 		} else {
3220 			struct expression *idx = expr->index, *m;
3221 			struct symbol *i_type = evaluate_expression(idx);
3222 			unsigned old_idx_flags;
3223 			int i_class = classify_type(i_type, &i_type);
3224 
3225 			if (!is_int(i_class)) {
3226 				expression_error(expr, "non-integer index");
3227 				return NULL;
3228 			}
3229 			unrestrict(idx, i_class, &i_type);
3230 			old_idx_flags = idx->flags;
3231 			idx = cast_to(idx, size_t_ctype);
3232 			idx->flags = old_idx_flags;
3233 			m = alloc_const_expression(expr->pos,
3234 						   bits_to_bytes(ctype->bit_size));
3235 			m->ctype = size_t_ctype;
3236 			m->flags = CEF_SET_INT;
3237 			expr->type = EXPR_BINOP;
3238 			expr->left = idx;
3239 			expr->right = m;
3240 			expr->op = '*';
3241 			expr->ctype = size_t_ctype;
3242 			expr->flags = m->flags & idx->flags & ~CEF_CONST_MASK;
3243 		}
3244 	}
3245 	if (e) {
3246 		struct expression *copy = __alloc_expression(0);
3247 		*copy = *expr;
3248 		if (e->type == EXPR_OFFSETOF)
3249 			e->in = ctype;
3250 		if (!evaluate_expression(e))
3251 			return NULL;
3252 		expr->type = EXPR_BINOP;
3253 		expr->flags = e->flags & copy->flags & ~CEF_CONST_MASK;
3254 		expr->op = '+';
3255 		expr->ctype = size_t_ctype;
3256 		expr->left = copy;
3257 		expr->right = e;
3258 	}
3259 	return size_t_ctype;
3260 }
3261 
evaluate_expression(struct expression * expr)3262 struct symbol *evaluate_expression(struct expression *expr)
3263 {
3264 	if (!expr)
3265 		return NULL;
3266 	if (expr->ctype)
3267 		return expr->ctype;
3268 
3269 	switch (expr->type) {
3270 	case EXPR_VALUE:
3271 	case EXPR_FVALUE:
3272 		expression_error(expr, "value expression without a type");
3273 		return NULL;
3274 	case EXPR_STRING:
3275 		return evaluate_string(expr);
3276 	case EXPR_SYMBOL:
3277 		return evaluate_symbol_expression(expr);
3278 	case EXPR_BINOP:
3279 		evaluate_expression(expr->left);
3280 		evaluate_expression(expr->right);
3281 		if (!valid_subexpr_type(expr))
3282 			return NULL;
3283 		return evaluate_binop(expr);
3284 	case EXPR_LOGICAL:
3285 		return evaluate_logical(expr);
3286 	case EXPR_COMMA:
3287 		evaluate_expression(expr->left);
3288 		if (!evaluate_expression(expr->right))
3289 			return NULL;
3290 		return evaluate_comma(expr);
3291 	case EXPR_COMPARE:
3292 		evaluate_expression(expr->left);
3293 		evaluate_expression(expr->right);
3294 		if (!valid_subexpr_type(expr))
3295 			return NULL;
3296 		return evaluate_compare(expr);
3297 	case EXPR_ASSIGNMENT:
3298 		evaluate_expression(expr->left);
3299 		evaluate_expression(expr->right);
3300 		if (!valid_subexpr_type(expr))
3301 			return NULL;
3302 		return evaluate_assignment(expr);
3303 	case EXPR_PREOP:
3304 		if (!evaluate_expression(expr->unop))
3305 			return NULL;
3306 		return evaluate_preop(expr);
3307 	case EXPR_POSTOP:
3308 		if (!evaluate_expression(expr->unop))
3309 			return NULL;
3310 		return evaluate_postop(expr);
3311 	case EXPR_CAST:
3312 	case EXPR_FORCE_CAST:
3313 	case EXPR_IMPLIED_CAST:
3314 		return evaluate_cast(expr);
3315 	case EXPR_SIZEOF:
3316 		return evaluate_sizeof(expr);
3317 	case EXPR_PTRSIZEOF:
3318 		return evaluate_ptrsizeof(expr);
3319 	case EXPR_ALIGNOF:
3320 		return evaluate_alignof(expr);
3321 	case EXPR_DEREF:
3322 		return evaluate_member_dereference(expr);
3323 	case EXPR_CALL:
3324 		return evaluate_call(expr);
3325 	case EXPR_SELECT:
3326 	case EXPR_CONDITIONAL:
3327 		return evaluate_conditional_expression(expr);
3328 	case EXPR_STATEMENT:
3329 		expr->ctype = evaluate_statement(expr->statement);
3330 		return expr->ctype;
3331 
3332 	case EXPR_LABEL:
3333 		expr->ctype = &ptr_ctype;
3334 		return &ptr_ctype;
3335 
3336 	case EXPR_TYPE:
3337 		/* Evaluate the type of the symbol .. */
3338 		evaluate_symbol(expr->symbol);
3339 		/* .. but the type of the _expression_ is a "type" */
3340 		expr->ctype = &type_ctype;
3341 		return &type_ctype;
3342 
3343 	case EXPR_OFFSETOF:
3344 		return evaluate_offsetof(expr);
3345 
3346 	/* These can not exist as stand-alone expressions */
3347 	case EXPR_INITIALIZER:
3348 	case EXPR_IDENTIFIER:
3349 	case EXPR_INDEX:
3350 	case EXPR_POS:
3351 		expression_error(expr, "internal front-end error: initializer in expression");
3352 		return NULL;
3353 	case EXPR_SLICE:
3354 		expression_error(expr, "internal front-end error: SLICE re-evaluated");
3355 		return NULL;
3356 	case EXPR_ASM_OPERAND:
3357 		expression_error(expr, "internal front-end error: ASM_OPERAND evaluated");
3358 		return NULL;
3359 	}
3360 	return NULL;
3361 }
3362 
check_duplicates(struct symbol * sym)3363 void check_duplicates(struct symbol *sym)
3364 {
3365 	int declared = 0;
3366 	struct symbol *next = sym;
3367 	int initialized = sym->initializer != NULL;
3368 
3369 	while ((next = next->same_symbol) != NULL) {
3370 		const char *typediff;
3371 		evaluate_symbol(next);
3372 		if (initialized && next->initializer) {
3373 			sparse_error(sym->pos, "symbol '%s' has multiple initializers (originally initialized at %s:%d)",
3374 				show_ident(sym->ident),
3375 				stream_name(next->pos.stream), next->pos.line);
3376 			/* Only warn once */
3377 			initialized = 0;
3378 		}
3379 		declared++;
3380 		typediff = type_difference(&sym->ctype, &next->ctype, 0, 0);
3381 		if (typediff) {
3382 			sparse_error(sym->pos, "symbol '%s' redeclared with different type (originally declared at %s:%d) - %s",
3383 				show_ident(sym->ident),
3384 				stream_name(next->pos.stream), next->pos.line, typediff);
3385 			return;
3386 		}
3387 	}
3388 	if (!declared) {
3389 		unsigned long mod = sym->ctype.modifiers;
3390 		if (mod & (MOD_STATIC | MOD_REGISTER | MOD_EXT_VISIBLE))
3391 			return;
3392 		if (!(mod & MOD_TOPLEVEL))
3393 			return;
3394 		if (!Wdecl)
3395 			return;
3396 		if (sym->ident == &main_ident)
3397 			return;
3398 		warning(sym->pos, "symbol '%s' was not declared. Should it be static?", show_ident(sym->ident));
3399 	}
3400 }
3401 
evaluate_symbol(struct symbol * sym)3402 static struct symbol *evaluate_symbol(struct symbol *sym)
3403 {
3404 	struct symbol *base_type;
3405 
3406 	if (!sym)
3407 		return sym;
3408 	if (sym->evaluated)
3409 		return sym;
3410 	sym->evaluated = 1;
3411 
3412 	sym = examine_symbol_type(sym);
3413 	base_type = get_base_type(sym);
3414 	if (!base_type)
3415 		return NULL;
3416 
3417 	/* Evaluate the initializers */
3418 	if (sym->initializer)
3419 		evaluate_initializer(sym, &sym->initializer);
3420 
3421 	/* And finally, evaluate the body of the symbol too */
3422 	if (base_type->type == SYM_FN) {
3423 		struct symbol *curr = current_fn;
3424 
3425 		if (sym->definition && sym->definition != sym)
3426 			return evaluate_symbol(sym->definition);
3427 
3428 		current_fn = base_type;
3429 
3430 		examine_fn_arguments(base_type);
3431 		if (!base_type->stmt && base_type->inline_stmt)
3432 			uninline(sym);
3433 		if (base_type->stmt)
3434 			evaluate_statement(base_type->stmt);
3435 
3436 		current_fn = curr;
3437 	}
3438 
3439 	return base_type;
3440 }
3441 
evaluate_symbol_list(struct symbol_list * list)3442 void evaluate_symbol_list(struct symbol_list *list)
3443 {
3444 	struct symbol *sym;
3445 
3446 	FOR_EACH_PTR(list, sym) {
3447 		has_error &= ~ERROR_CURR_PHASE;
3448 		evaluate_symbol(sym);
3449 		check_duplicates(sym);
3450 	} END_FOR_EACH_PTR(sym);
3451 }
3452 
evaluate_return_expression(struct statement * stmt)3453 static struct symbol *evaluate_return_expression(struct statement *stmt)
3454 {
3455 	struct expression *expr = stmt->expression;
3456 	struct symbol *fntype;
3457 
3458 	evaluate_expression(expr);
3459 	fntype = current_fn->ctype.base_type;
3460 	if (!fntype || fntype == &void_ctype) {
3461 		if (expr && expr->ctype != &void_ctype)
3462 			expression_error(expr, "return expression in %s function", fntype?"void":"typeless");
3463 		if (expr && Wreturn_void)
3464 			warning(stmt->pos, "returning void-valued expression");
3465 		return NULL;
3466 	}
3467 
3468 	if (!expr) {
3469 		sparse_error(stmt->pos, "return with no return value");
3470 		return NULL;
3471 	}
3472 	if (!expr->ctype)
3473 		return NULL;
3474 	compatible_assignment_types(expr, fntype, &stmt->expression, "return expression");
3475 	return NULL;
3476 }
3477 
evaluate_if_statement(struct statement * stmt)3478 static void evaluate_if_statement(struct statement *stmt)
3479 {
3480 	if (!stmt->if_conditional)
3481 		return;
3482 
3483 	evaluate_conditional(stmt->if_conditional, 0);
3484 	evaluate_statement(stmt->if_true);
3485 	evaluate_statement(stmt->if_false);
3486 }
3487 
evaluate_iterator(struct statement * stmt)3488 static void evaluate_iterator(struct statement *stmt)
3489 {
3490 	evaluate_symbol_list(stmt->iterator_syms);
3491 	evaluate_conditional(stmt->iterator_pre_condition, 1);
3492 	evaluate_conditional(stmt->iterator_post_condition,1);
3493 	evaluate_statement(stmt->iterator_pre_statement);
3494 	evaluate_statement(stmt->iterator_statement);
3495 	evaluate_statement(stmt->iterator_post_statement);
3496 }
3497 
verify_output_constraint(struct expression * expr,const char * constraint)3498 static void verify_output_constraint(struct expression *expr, const char *constraint)
3499 {
3500 	switch (*constraint) {
3501 	case '=':	/* Assignment */
3502 	case '+':	/* Update */
3503 		break;
3504 	default:
3505 		expression_error(expr, "output constraint is not an assignment constraint (\"%s\")", constraint);
3506 	}
3507 }
3508 
verify_input_constraint(struct expression * expr,const char * constraint)3509 static void verify_input_constraint(struct expression *expr, const char *constraint)
3510 {
3511 	switch (*constraint) {
3512 	case '=':	/* Assignment */
3513 	case '+':	/* Update */
3514 		expression_error(expr, "input constraint with assignment (\"%s\")", constraint);
3515 	}
3516 }
3517 
evaluate_asm_statement(struct statement * stmt)3518 static void evaluate_asm_statement(struct statement *stmt)
3519 {
3520 	struct expression *expr;
3521 	struct expression *op;
3522 	struct symbol *sym;
3523 
3524 	expr = stmt->asm_string;
3525 	if (!expr || expr->type != EXPR_STRING) {
3526 		sparse_error(stmt->pos, "need constant string for inline asm");
3527 		return;
3528 	}
3529 
3530 	FOR_EACH_PTR(stmt->asm_outputs, op) {
3531 		/* Identifier */
3532 
3533 		/* Constraint */
3534 		expr = op->constraint;
3535 		if (!expr || expr->type != EXPR_STRING) {
3536 			sparse_error(expr ? expr->pos : stmt->pos, "asm output constraint is not a string");
3537 			op->constraint = NULL;
3538 		} else
3539 			verify_output_constraint(expr, expr->string->data);
3540 
3541 		/* Expression */
3542 		expr = op->expr;
3543 		if (!evaluate_expression(expr))
3544 			return;
3545 		if (!lvalue_expression(expr))
3546 			warning(expr->pos, "asm output is not an lvalue");
3547 		evaluate_assign_to(expr, expr->ctype);
3548 	} END_FOR_EACH_PTR(op);
3549 
3550 	FOR_EACH_PTR(stmt->asm_inputs, op) {
3551 		/* Identifier */
3552 
3553 		/* Constraint */
3554 		expr = op->constraint;
3555 		if (!expr || expr->type != EXPR_STRING) {
3556 			sparse_error(expr ? expr->pos : stmt->pos, "asm input constraint is not a string");
3557 			op->constraint = NULL;
3558 		} else
3559 			verify_input_constraint(expr, expr->string->data);
3560 
3561 		/* Expression */
3562 		if (!evaluate_expression(op->expr))
3563 			return;
3564 	} END_FOR_EACH_PTR(op);
3565 
3566 	FOR_EACH_PTR(stmt->asm_clobbers, expr) {
3567 		if (!expr) {
3568 			sparse_error(stmt->pos, "bad asm clobbers");
3569 			return;
3570 		}
3571 		if (expr->type == EXPR_STRING)
3572 			continue;
3573 		expression_error(expr, "asm clobber is not a string");
3574 	} END_FOR_EACH_PTR(expr);
3575 
3576 	FOR_EACH_PTR(stmt->asm_labels, sym) {
3577 		if (!sym || sym->type != SYM_LABEL) {
3578 			sparse_error(stmt->pos, "bad asm label");
3579 			return;
3580 		}
3581 	} END_FOR_EACH_PTR(sym);
3582 }
3583 
evaluate_case_statement(struct statement * stmt)3584 static void evaluate_case_statement(struct statement *stmt)
3585 {
3586 	evaluate_expression(stmt->case_expression);
3587 	evaluate_expression(stmt->case_to);
3588 	evaluate_statement(stmt->case_statement);
3589 }
3590 
check_case_type(struct expression * switch_expr,struct expression * case_expr,struct expression ** enumcase)3591 static void check_case_type(struct expression *switch_expr,
3592 			    struct expression *case_expr,
3593 			    struct expression **enumcase)
3594 {
3595 	struct symbol *switch_type, *case_type;
3596 	int sclass, cclass;
3597 
3598 	if (!case_expr)
3599 		return;
3600 
3601 	switch_type = switch_expr->ctype;
3602 	case_type = evaluate_expression(case_expr);
3603 
3604 	if (!switch_type || !case_type)
3605 		goto Bad;
3606 	if (enumcase) {
3607 		if (*enumcase)
3608 			warn_for_different_enum_types(case_expr->pos, case_type, (*enumcase)->ctype);
3609 		else if (is_enum_type(case_type))
3610 			*enumcase = case_expr;
3611 	}
3612 
3613 	sclass = classify_type(switch_type, &switch_type);
3614 	cclass = classify_type(case_type, &case_type);
3615 
3616 	/* both should be arithmetic */
3617 	if (!(sclass & cclass & TYPE_NUM))
3618 		goto Bad;
3619 
3620 	/* neither should be floating */
3621 	if ((sclass | cclass) & TYPE_FLOAT)
3622 		goto Bad;
3623 
3624 	/* if neither is restricted, we are OK */
3625 	if (!((sclass | cclass) & TYPE_RESTRICT))
3626 		return;
3627 
3628 	if (!restricted_binop_type(SPECIAL_EQUAL, case_expr, switch_expr,
3629 				   cclass, sclass, case_type, switch_type)) {
3630 		unrestrict(case_expr, cclass, &case_type);
3631 		unrestrict(switch_expr, sclass, &switch_type);
3632 	}
3633 	return;
3634 
3635 Bad:
3636 	expression_error(case_expr, "incompatible types for 'case' statement");
3637 }
3638 
evaluate_switch_statement(struct statement * stmt)3639 static void evaluate_switch_statement(struct statement *stmt)
3640 {
3641 	struct symbol *sym;
3642 	struct expression *enumcase = NULL;
3643 	struct expression **enumcase_holder = &enumcase;
3644 	struct expression *sel = stmt->switch_expression;
3645 
3646 	evaluate_expression(sel);
3647 	evaluate_statement(stmt->switch_statement);
3648 	if (!sel)
3649 		return;
3650 	if (sel->ctype && is_enum_type(sel->ctype))
3651 		enumcase_holder = NULL; /* Only check cases against switch */
3652 
3653 	FOR_EACH_PTR(stmt->switch_case->symbol_list, sym) {
3654 		struct statement *case_stmt = sym->stmt;
3655 		check_case_type(sel, case_stmt->case_expression, enumcase_holder);
3656 		check_case_type(sel, case_stmt->case_to, enumcase_holder);
3657 	} END_FOR_EACH_PTR(sym);
3658 }
3659 
evaluate_goto_statement(struct statement * stmt)3660 static void evaluate_goto_statement(struct statement *stmt)
3661 {
3662 	struct symbol *label = stmt->goto_label;
3663 
3664 	if (label && !label->stmt && label->ident && !lookup_keyword(label->ident, NS_KEYWORD))
3665 		sparse_error(stmt->pos, "label '%s' was not declared", show_ident(label->ident));
3666 
3667 	evaluate_expression(stmt->goto_expression);
3668 }
3669 
evaluate_statement(struct statement * stmt)3670 struct symbol *evaluate_statement(struct statement *stmt)
3671 {
3672 	if (!stmt)
3673 		return NULL;
3674 
3675 	switch (stmt->type) {
3676 	case STMT_DECLARATION: {
3677 		struct symbol *s;
3678 		FOR_EACH_PTR(stmt->declaration, s) {
3679 			evaluate_symbol(s);
3680 		} END_FOR_EACH_PTR(s);
3681 		return NULL;
3682 	}
3683 
3684 	case STMT_RETURN:
3685 		return evaluate_return_expression(stmt);
3686 
3687 	case STMT_EXPRESSION:
3688 		if (!evaluate_expression(stmt->expression))
3689 			return NULL;
3690 		if (stmt->expression->ctype == &null_ctype)
3691 			stmt->expression = cast_to(stmt->expression, &ptr_ctype);
3692 		return degenerate(stmt->expression);
3693 
3694 	case STMT_COMPOUND: {
3695 		struct statement *s;
3696 		struct symbol *type = NULL;
3697 
3698 		/* Evaluate the return symbol in the compound statement */
3699 		evaluate_symbol(stmt->ret);
3700 
3701 		/*
3702 		 * Then, evaluate each statement, making the type of the
3703 		 * compound statement be the type of the last statement
3704 		 */
3705 		type = evaluate_statement(stmt->args);
3706 		FOR_EACH_PTR(stmt->stmts, s) {
3707 			type = evaluate_statement(s);
3708 		} END_FOR_EACH_PTR(s);
3709 		if (!type)
3710 			type = &void_ctype;
3711 		return type;
3712 	}
3713 	case STMT_IF:
3714 		evaluate_if_statement(stmt);
3715 		return NULL;
3716 	case STMT_ITERATOR:
3717 		evaluate_iterator(stmt);
3718 		return NULL;
3719 	case STMT_SWITCH:
3720 		evaluate_switch_statement(stmt);
3721 		return NULL;
3722 	case STMT_CASE:
3723 		evaluate_case_statement(stmt);
3724 		return NULL;
3725 	case STMT_LABEL:
3726 		return evaluate_statement(stmt->label_statement);
3727 	case STMT_GOTO:
3728 		evaluate_goto_statement(stmt);
3729 		return NULL;
3730 	case STMT_NONE:
3731 		break;
3732 	case STMT_ASM:
3733 		evaluate_asm_statement(stmt);
3734 		return NULL;
3735 	case STMT_CONTEXT:
3736 		evaluate_expression(stmt->expression);
3737 		return NULL;
3738 	case STMT_RANGE:
3739 		evaluate_expression(stmt->range_expression);
3740 		evaluate_expression(stmt->range_low);
3741 		evaluate_expression(stmt->range_high);
3742 		return NULL;
3743 	}
3744 	return NULL;
3745 }
3746