xref: /netbsd-src/usr.bin/xlint/lint1/decl.c (revision aef5eb5f59cdfe8314f1b5f78ac04eb144e44010)
1 /* $NetBSD: decl.c,v 1.302 2022/10/01 10:04:06 rillig Exp $ */
2 
3 /*
4  * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
5  * Copyright (c) 1994, 1995 Jochen Pohl
6  * All Rights Reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *      This product includes software developed by Jochen Pohl for
19  *	The NetBSD Project.
20  * 4. The name of the author may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #if HAVE_NBTOOL_CONFIG_H
36 #include "nbtool_config.h"
37 #endif
38 
39 #include <sys/cdefs.h>
40 #if defined(__RCSID)
41 __RCSID("$NetBSD: decl.c,v 1.302 2022/10/01 10:04:06 rillig Exp $");
42 #endif
43 
44 #include <sys/param.h>
45 #include <limits.h>
46 #include <stdlib.h>
47 #include <string.h>
48 
49 #include "lint1.h"
50 
51 const char unnamed[] = "<unnamed>";
52 
53 /* shared type structures for arithmetic types and void */
54 static	type_t	typetab[NTSPEC];
55 
56 /* value of next enumerator during declaration of enum types */
57 int	enumval;
58 
59 /*
60  * pointer to innermost element of a stack which contains information local
61  * to nested declarations
62  */
63 dinfo_t	*dcs;
64 
65 static	type_t	*typedef_error(type_t *, tspec_t);
66 static	void	set_first_typedef(type_t *, sym_t *);
67 static	void	dcs_align(unsigned int, unsigned int);
68 static	sym_t	*new_tag(sym_t *, scl_t, bool, bool);
69 static	bool	prototypes_compatible(const type_t *, const type_t *, bool *);
70 static	bool	matches_no_arg_function(const type_t *, bool *);
71 static	bool	check_old_style_definition(sym_t *, sym_t *);
72 static	bool	check_prototype_declaration(sym_t *, sym_t *);
73 static	sym_t	*new_style_function(sym_t *);
74 static	void	old_style_function(sym_t *, sym_t *);
75 static	void	declare_external_in_block(sym_t *);
76 static	bool	check_init(sym_t *);
77 static	void	check_argument_usage(bool, sym_t *);
78 static	void	check_variable_usage(bool, sym_t *);
79 static	void	check_label_usage(sym_t *);
80 static	void	check_tag_usage(sym_t *);
81 static	void	check_global_variable(const sym_t *);
82 static	void	check_global_variable_size(const sym_t *);
83 
84 /*
85  * initializes all global vars used in declarations
86  */
87 void
88 #ifdef __sh3__
89 /* XXX port-sh3/56311 */
90 __attribute__((optimize("O0")))
91 #endif
92 initdecl(void)
93 {
94 
95 	/* declaration stack */
96 	dcs = xcalloc(1, sizeof(*dcs));
97 	dcs->d_kind = DK_EXTERN;
98 	dcs->d_ldlsym = &dcs->d_dlsyms;
99 
100 	/* type information and classification */
101 	inittyp();
102 
103 	/*
104 	 * The following two are not really types. They are only used by the
105 	 * parser to handle the keywords "signed" and "unsigned".
106 	 */
107 	typetab[SIGNED].t_tspec = SIGNED;
108 	typetab[UNSIGN].t_tspec = UNSIGN;
109 
110 	typetab[BOOL].t_tspec = BOOL;
111 	typetab[CHAR].t_tspec = CHAR;
112 	typetab[SCHAR].t_tspec = SCHAR;
113 	typetab[UCHAR].t_tspec = UCHAR;
114 	typetab[SHORT].t_tspec = SHORT;
115 	typetab[USHORT].t_tspec = USHORT;
116 	typetab[INT].t_tspec = INT;
117 	typetab[UINT].t_tspec = UINT;
118 	typetab[LONG].t_tspec = LONG;
119 	typetab[ULONG].t_tspec = ULONG;
120 	typetab[QUAD].t_tspec = QUAD;
121 	typetab[UQUAD].t_tspec = UQUAD;
122 #ifdef INT128_SIZE
123 	typetab[INT128].t_tspec = INT128;
124 	typetab[UINT128].t_tspec = UINT128;
125 #endif
126 	typetab[FLOAT].t_tspec = FLOAT;
127 	typetab[DOUBLE].t_tspec = DOUBLE;
128 	typetab[LDOUBLE].t_tspec = LDOUBLE;
129 	typetab[VOID].t_tspec = VOID;
130 	/* struct, union, enum, ptr, array and func are not shared. */
131 	typetab[COMPLEX].t_tspec = COMPLEX;
132 	typetab[FCOMPLEX].t_tspec = FCOMPLEX;
133 	typetab[DCOMPLEX].t_tspec = DCOMPLEX;
134 	typetab[LCOMPLEX].t_tspec = LCOMPLEX;
135 }
136 
137 /*
138  * Returns a shared type structure for arithmetic types and void.
139  *
140  * It's important to duplicate this structure using block_dup_type or
141  * expr_dup_type if it is to be modified (adding qualifiers or anything
142  * else).
143  */
144 type_t *
145 gettyp(tspec_t t)
146 {
147 
148 	/* TODO: make the return type 'const' */
149 	return &typetab[t];
150 }
151 
152 type_t *
153 block_dup_type(const type_t *tp)
154 {
155 	type_t	*ntp;
156 
157 	ntp = block_zero_alloc(sizeof(*ntp));
158 	*ntp = *tp;
159 	return ntp;
160 }
161 
162 /* Duplicate a type, free the allocated memory after the expression. */
163 type_t *
164 expr_dup_type(const type_t *tp)
165 {
166 	type_t	*ntp;
167 
168 	ntp = expr_zero_alloc(sizeof(*ntp));
169 	*ntp = *tp;
170 	return ntp;
171 }
172 
173 /*
174  * Return the unqualified version of the type.  The returned type is freed at
175  * the end of the current expression.
176  *
177  * See C99 6.2.5p25.
178  */
179 type_t *
180 expr_unqualified_type(const type_t *tp)
181 {
182 	type_t *ntp;
183 
184 	ntp = expr_zero_alloc(sizeof(*ntp));
185 	*ntp = *tp;
186 	ntp->t_const = false;
187 	ntp->t_volatile = false;
188 
189 	/*
190 	 * In case of a struct or union type, the members should lose their
191 	 * qualifiers as well, but that would require a deep copy of the
192 	 * struct or union type.  This in turn would defeat the type
193 	 * comparison in types_compatible, which simply tests whether
194 	 * tp1->t_str == tp2->t_str.
195 	 */
196 
197 	return ntp;
198 }
199 
200 /*
201  * Returns whether the argument is void or an incomplete array,
202  * struct, union or enum type.
203  */
204 bool
205 is_incomplete(const type_t *tp)
206 {
207 	tspec_t	t;
208 
209 	if ((t = tp->t_tspec) == VOID)
210 		return true;
211 	if (t == ARRAY)
212 		return tp->t_incomplete_array;
213 	if (is_struct_or_union(t))
214 		return tp->t_str->sou_incomplete;
215 	if (t == ENUM)
216 		return tp->t_enum->en_incomplete;
217 
218 	return false;
219 }
220 
221 /*
222  * Remember the storage class of the current declaration and detect multiple
223  * storage classes.
224  */
225 void
226 dcs_add_storage_class(scl_t sc)
227 {
228 
229 	if (sc == INLINE) {
230 		if (dcs->d_inline)
231 			/* duplicate '%s' */
232 			warning(10, "inline");
233 		dcs->d_inline = true;
234 		return;
235 	}
236 
237 	if (dcs->d_type != NULL || dcs->d_abstract_type != NOTSPEC ||
238 	    dcs->d_sign_mod != NOTSPEC || dcs->d_rank_mod != NOTSPEC) {
239 		/* storage class after type is obsolescent */
240 		warning(83);
241 	}
242 
243 	if (dcs->d_scl == NOSCL)
244 		dcs->d_scl = sc;
245 	else
246 		dcs->d_multiple_storage_classes = true;
247 }
248 
249 /*
250  * Remember the type, modifier or typedef name returned by the parser
251  * in *dcs (top element of decl stack). This information is used in
252  * dcs_end_type to build the type used for all declarators in this
253  * declaration.
254  *
255  * If tp->t_typedef is true, the type comes from a previously defined
256  * typename. Otherwise, it comes from a type specifier (int, long, ...) or a
257  * struct/union/enum tag.
258  */
259 void
260 dcs_add_type(type_t *tp)
261 {
262 	tspec_t	t;
263 
264 	debug_step("%s: %s", __func__, type_name(tp));
265 	if (tp->t_typedef) {
266 		/*
267 		 * something like "typedef int a; int a b;"
268 		 * This should not happen with current grammar.
269 		 */
270 		lint_assert(dcs->d_type == NULL);
271 		lint_assert(dcs->d_abstract_type == NOTSPEC);
272 		lint_assert(dcs->d_sign_mod == NOTSPEC);
273 		lint_assert(dcs->d_rank_mod == NOTSPEC);
274 
275 		dcs->d_type = tp;
276 		return;
277 	}
278 
279 	t = tp->t_tspec;
280 
281 	if (is_struct_or_union(t) || t == ENUM) {
282 		/*
283 		 * something like "int struct a ..."
284 		 * struct/union/enum with anything else is not allowed
285 		 */
286 		if (dcs->d_type != NULL || dcs->d_abstract_type != NOTSPEC ||
287 		    dcs->d_rank_mod != NOTSPEC || dcs->d_sign_mod != NOTSPEC) {
288 			dcs->d_invalid_type_combination = true;
289 			dcs->d_abstract_type = NOTSPEC;
290 			dcs->d_sign_mod = NOTSPEC;
291 			dcs->d_rank_mod = NOTSPEC;
292 		}
293 		dcs->d_type = tp;
294 		return;
295 	}
296 
297 	if (dcs->d_type != NULL && !dcs->d_type->t_typedef) {
298 		/*
299 		 * something like "struct a int"
300 		 * struct/union/enum with anything else is not allowed
301 		 */
302 		dcs->d_invalid_type_combination = true;
303 		return;
304 	}
305 
306 	if (t == COMPLEX) {
307 		if (dcs->d_complex_mod == FLOAT)
308 			t = FCOMPLEX;
309 		else if (dcs->d_complex_mod == DOUBLE)
310 			t = DCOMPLEX;
311 		else {
312 			/* invalid type for _Complex */
313 			error(308);
314 			t = DCOMPLEX; /* just as a fallback */
315 		}
316 		dcs->d_complex_mod = NOTSPEC;
317 	}
318 
319 	if (t == LONG && dcs->d_rank_mod == LONG) {
320 		/* "long long" or "long ... long" */
321 		t = QUAD;
322 		dcs->d_rank_mod = NOTSPEC;
323 		if (!quadflg)
324 			/* %s does not support 'long long' */
325 			c99ism(265, allow_c90 ? "C90" : "traditional C");
326 	}
327 
328 	if (dcs->d_type != NULL && dcs->d_type->t_typedef) {
329 		/* something like "typedef int a; a long ..." */
330 		dcs->d_type = typedef_error(dcs->d_type, t);
331 		return;
332 	}
333 
334 	/* now it can be only a combination of arithmetic types and void */
335 	if (t == SIGNED || t == UNSIGN) {
336 		/*
337 		 * remember specifiers "signed" & "unsigned" in
338 		 * dcs->d_sign_mod
339 		 */
340 		if (dcs->d_sign_mod != NOTSPEC)
341 			/* more than one "signed" and/or "unsigned" */
342 			dcs->d_invalid_type_combination = true;
343 		dcs->d_sign_mod = t;
344 	} else if (t == SHORT || t == LONG || t == QUAD) {
345 		/*
346 		 * remember specifiers "short", "long" and "long long" in
347 		 * dcs->d_rank_mod
348 		 */
349 		if (dcs->d_rank_mod != NOTSPEC)
350 			dcs->d_invalid_type_combination = true;
351 		dcs->d_rank_mod = t;
352 	} else if (t == FLOAT || t == DOUBLE) {
353 		if (dcs->d_rank_mod == NOTSPEC || dcs->d_rank_mod == LONG) {
354 			if (dcs->d_complex_mod != NOTSPEC
355 			    || (t == FLOAT && dcs->d_rank_mod == LONG))
356 				dcs->d_invalid_type_combination = true;
357 			dcs->d_complex_mod = t;
358 		} else {
359 			if (dcs->d_abstract_type != NOTSPEC)
360 				dcs->d_invalid_type_combination = true;
361 			dcs->d_abstract_type = t;
362 		}
363 	} else if (t == PTR) {
364 		dcs->d_type = tp;
365 	} else {
366 		/*
367 		 * remember specifiers "void", "char", "int",
368 		 * or "_Complex" in dcs->d_abstract_type
369 		 */
370 		if (dcs->d_abstract_type != NOTSPEC)
371 			dcs->d_invalid_type_combination = true;
372 		dcs->d_abstract_type = t;
373 	}
374 }
375 
376 /* Merge the signedness into the abstract type. */
377 static tspec_t
378 merge_signedness(tspec_t t, tspec_t s)
379 {
380 
381 	if (s == SIGNED)
382 		return t == CHAR ? SCHAR : t;
383 	if (s != UNSIGN)
384 		return t;
385 	return t == CHAR ? UCHAR
386 	    : t == SHORT ? USHORT
387 	    : t == INT ? UINT
388 	    : t == LONG ? ULONG
389 	    : t == QUAD ? UQUAD
390 	    : t;
391 }
392 
393 /*
394  * called if a list of declaration specifiers contains a typedef name
395  * and other specifiers (except struct, union, enum, typedef name)
396  */
397 static type_t *
398 typedef_error(type_t *td, tspec_t t)
399 {
400 	tspec_t	t2;
401 
402 	t2 = td->t_tspec;
403 
404 	if ((t == SIGNED || t == UNSIGN) &&
405 	    (t2 == CHAR || t2 == SHORT || t2 == INT ||
406 	     t2 == LONG || t2 == QUAD)) {
407 		if (allow_c90)
408 			/* modifying typedef with '%s'; only qualifiers... */
409 			warning(5, tspec_name(t));
410 		td = block_dup_type(gettyp(merge_signedness(t2, t)));
411 		td->t_typedef = true;
412 		return td;
413 	}
414 
415 	if (t == SHORT && (t2 == INT || t2 == UINT)) {
416 		/* modifying typedef with '%s'; only qualifiers allowed */
417 		warning(5, "short");
418 		td = block_dup_type(gettyp(t2 == INT ? SHORT : USHORT));
419 		td->t_typedef = true;
420 		return td;
421 	}
422 
423 	if (t != LONG)
424 		goto invalid;
425 
426 	if (t2 == INT)
427 		td = gettyp(LONG);
428 	else if (t2 == UINT)
429 		td = gettyp(ULONG);
430 	else if (t2 == LONG)
431 		td = gettyp(QUAD);
432 	else if (t2 == ULONG)
433 		td = gettyp(UQUAD);
434 	else if (t2 == FLOAT)
435 		td = gettyp(DOUBLE);
436 	else if (t2 == DOUBLE)
437 		td = gettyp(LDOUBLE);
438 	else if (t2 == DCOMPLEX)
439 		td = gettyp(LCOMPLEX);
440 	else
441 		goto invalid;
442 
443 	/* modifying typedef with '%s'; only qualifiers allowed */
444 	warning(5, "long");
445 	td = block_dup_type(td);
446 	td->t_typedef = true;
447 	return td;
448 
449 invalid:
450 	/* Anything else is not accepted. */
451 	dcs->d_invalid_type_combination = true;
452 	return td;
453 }
454 
455 /*
456  * Remember the symbol of a typedef name (2nd arg) in a struct, union
457  * or enum tag if the typedef name is the first defined for this tag.
458  *
459  * If the tag is unnamed, the typedef name is used for identification
460  * of this tag in lint2. Although it's possible that more than one typedef
461  * name is defined for one tag, the first name defined should be unique
462  * if the tag is unnamed.
463  */
464 static void
465 set_first_typedef(type_t *tp, sym_t *sym)
466 {
467 	tspec_t	t;
468 
469 	if (is_struct_or_union(t = tp->t_tspec)) {
470 		if (tp->t_str->sou_first_typedef == NULL)
471 			tp->t_str->sou_first_typedef = sym;
472 	} else if (t == ENUM) {
473 		if (tp->t_enum->en_first_typedef == NULL)
474 			tp->t_enum->en_first_typedef = sym;
475 	}
476 }
477 
478 static unsigned int
479 bit_field_size(sym_t **mem)
480 {
481 	unsigned int len = (*mem)->s_type->t_flen;
482 	while (*mem != NULL && (*mem)->s_type->t_bitfield) {
483 		len += (*mem)->s_type->t_flen;
484 		*mem = (*mem)->s_next;
485 	}
486 	return len - len % INT_SIZE;
487 }
488 
489 static void
490 set_packed_size(type_t *tp)
491 {
492 	struct_or_union *sp;
493 	sym_t *mem;
494 
495 	switch (tp->t_tspec) {
496 	case STRUCT:
497 	case UNION:
498 		sp = tp->t_str;
499 		sp->sou_size_in_bits = 0;
500 		for (mem = sp->sou_first_member;
501 		     mem != NULL; mem = mem->s_next) {
502 			unsigned int x;
503 
504 			if (mem->s_type->t_bitfield) {
505 				sp->sou_size_in_bits += bit_field_size(&mem);
506 				if (mem == NULL)
507 					break;
508 			}
509 			x = type_size_in_bits(mem->s_type);
510 			if (tp->t_tspec == STRUCT)
511 				sp->sou_size_in_bits += x;
512 			else if (x > sp->sou_size_in_bits)
513 				sp->sou_size_in_bits = x;
514 		}
515 		break;
516 	default:
517 		/* attribute '%s' ignored for '%s' */
518 		warning(326, "packed", type_name(tp));
519 		break;
520 	}
521 }
522 
523 void
524 dcs_add_packed(void)
525 {
526 	if (dcs->d_type == NULL)
527 		dcs->d_packed = true;
528 	else
529 		set_packed_size(dcs->d_type);
530 }
531 
532 void
533 dcs_set_used(void)
534 {
535 	dcs->d_used = true;
536 }
537 
538 /*
539  * Remember a qualifier which is part of the declaration specifiers
540  * (and not the declarator).
541  * Also detect multiple qualifiers of the same kind.
542 
543  * The remembered qualifier is used by dcs_end_type to construct the type
544  * for all declarators.
545  */
546 void
547 dcs_add_qualifier(tqual_t q)
548 {
549 
550 	if (q == CONST) {
551 		if (dcs->d_const) {
552 			/* duplicate '%s' */
553 			warning(10, "const");
554 		}
555 		dcs->d_const = true;
556 	} else if (q == VOLATILE) {
557 		if (dcs->d_volatile) {
558 			/* duplicate '%s' */
559 			warning(10, "volatile");
560 		}
561 		dcs->d_volatile = true;
562 	} else {
563 		lint_assert(q == RESTRICT || q == THREAD);
564 		/* Silently ignore these qualifiers. */
565 	}
566 }
567 
568 /*
569  * Go to the next declaration level (structs, nested structs, blocks,
570  * argument declaration lists ...)
571  */
572 void
573 begin_declaration_level(declaration_kind dk)
574 {
575 	dinfo_t	*di;
576 
577 	/* put a new element on the declaration stack */
578 	di = xcalloc(1, sizeof(*di));
579 	di->d_enclosing = dcs;
580 	dcs = di;
581 	di->d_kind = dk;
582 	di->d_ldlsym = &di->d_dlsyms;
583 	debug_step("%s(%s)", __func__, declaration_kind_name(dk));
584 }
585 
586 /*
587  * Go back to previous declaration level
588  */
589 void
590 end_declaration_level(void)
591 {
592 	dinfo_t	*di;
593 
594 	debug_step("%s(%s)", __func__, declaration_kind_name(dcs->d_kind));
595 
596 	lint_assert(dcs->d_enclosing != NULL);
597 	di = dcs;
598 	dcs = di->d_enclosing;
599 
600 	switch (di->d_kind) {
601 	case DK_MOS:
602 	case DK_MOU:
603 	case DK_ENUM_CONST:
604 		/*
605 		 * Symbols declared in (nested) structs or enums are
606 		 * part of the next level (they are removed from the
607 		 * symbol table if the symbols of the outer level are
608 		 * removed).
609 		 */
610 		if ((*dcs->d_ldlsym = di->d_dlsyms) != NULL)
611 			dcs->d_ldlsym = di->d_ldlsym;
612 		break;
613 	case DK_OLD_STYLE_ARG:
614 		/*
615 		 * All symbols in dcs->d_dlsyms are introduced in old-style
616 		 * argument declarations (it's not clean, but possible).
617 		 * They are appended to the list of symbols declared in
618 		 * an old-style argument identifier list or a new style
619 		 * parameter type list.
620 		 */
621 		if (di->d_dlsyms != NULL) {
622 			*di->d_ldlsym = dcs->d_func_proto_syms;
623 			dcs->d_func_proto_syms = di->d_dlsyms;
624 		}
625 		break;
626 	case DK_ABSTRACT:	/* casts and sizeof */
627 		/*
628 		 * Append all symbols declared in the abstract declaration
629 		 * to the list of symbols declared in the surrounding
630 		 * declaration or block.
631 		 * XXX I'm not sure whether they should be removed from the
632 		 * symbol table now or later.
633 		 */
634 		if ((*dcs->d_ldlsym = di->d_dlsyms) != NULL)
635 			dcs->d_ldlsym = di->d_ldlsym;
636 		break;
637 	case DK_AUTO:
638 		/* check usage of local vars */
639 		check_usage(di);
640 		/* FALLTHROUGH */
641 	case DK_PROTO_ARG:
642 		/* usage of arguments will be checked by funcend() */
643 		rmsyms(di->d_dlsyms);
644 		break;
645 	case DK_EXTERN:
646 		/* there is nothing around an external declarations */
647 		/* FALLTHROUGH */
648 	default:
649 		lint_assert(/*CONSTCOND*/false);
650 	}
651 	free(di);
652 }
653 
654 /*
655  * Set flag d_asm in all declaration stack elements up to the
656  * outermost one.
657  *
658  * This is used to mark compound statements which have, possibly in
659  * nested compound statements, asm statements. For these compound
660  * statements no warnings about unused or uninitialized variables are
661  * printed.
662  *
663  * There is no need to clear d_asm in dinfo structs with context AUTO,
664  * because these structs are freed at the end of the compound statement.
665  * But it must be cleared in the outermost dinfo struct, which has
666  * context EXTERN. This could be done in dcs_begin_type and would work for
667  * C90, but not for C99 or C++ (due to mixed statements and declarations).
668  * Thus we clear it in global_clean_up_decl(), which is used to do some
669  * cleanup after global declarations/definitions.
670  */
671 void
672 dcs_set_asm(void)
673 {
674 
675 	for (dinfo_t *di = dcs; di != NULL; di = di->d_enclosing)
676 		di->d_asm = true;
677 }
678 
679 /*
680  * Clean all elements of the top element of declaration stack which
681  * will be used by the next declaration
682  */
683 void
684 dcs_begin_type(void)
685 {
686 
687 	dcs->d_abstract_type = NOTSPEC;
688 	dcs->d_complex_mod = NOTSPEC;
689 	dcs->d_sign_mod = NOTSPEC;
690 	dcs->d_rank_mod = NOTSPEC;
691 	dcs->d_scl = NOSCL;
692 	dcs->d_type = NULL;
693 	dcs->d_const = false;
694 	dcs->d_volatile = false;
695 	dcs->d_inline = false;
696 	dcs->d_multiple_storage_classes = false;
697 	dcs->d_invalid_type_combination = false;
698 	dcs->d_nonempty_decl = false;
699 	dcs->d_notyp = false;
700 }
701 
702 static void
703 dcs_adjust_storage_class(void)
704 {
705 	if (dcs->d_kind == DK_EXTERN) {
706 		if (dcs->d_scl == REG || dcs->d_scl == AUTO) {
707 			/* illegal storage class */
708 			error(8);
709 			dcs->d_scl = NOSCL;
710 		}
711 	} else if (dcs->d_kind == DK_OLD_STYLE_ARG ||
712 		   dcs->d_kind == DK_PROTO_ARG) {
713 		if (dcs->d_scl != NOSCL && dcs->d_scl != REG) {
714 			/* only register valid as formal parameter storage... */
715 			error(9);
716 			dcs->d_scl = NOSCL;
717 		}
718 	}
719 }
720 
721 /*
722  * Merge the declaration specifiers from dcs into dcs->d_type.
723  *
724  * See C99 6.7.2 "Type specifiers".
725  */
726 static void
727 dcs_merge_declaration_specifiers(void)
728 {
729 	tspec_t	t, s, l, c;
730 	type_t	*tp;
731 
732 	t = dcs->d_abstract_type; /* VOID, BOOL, CHAR, INT or COMPLEX */
733 	c = dcs->d_complex_mod;	/* FLOAT or DOUBLE */
734 	s = dcs->d_sign_mod;	/* SIGNED or UNSIGN */
735 	l = dcs->d_rank_mod;	/* SHORT, LONG or QUAD */
736 	tp = dcs->d_type;
737 
738 	debug_step("%s: %s", __func__, type_name(tp));
739 	if (t == NOTSPEC && s == NOTSPEC && l == NOTSPEC && c == NOTSPEC &&
740 	    tp == NULL)
741 		dcs->d_notyp = true;
742 	if (t == NOTSPEC && s == NOTSPEC && (l == NOTSPEC || l == LONG) &&
743 	    tp == NULL)
744 		t = c;
745 
746 	if (tp != NULL) {
747 		lint_assert(t == NOTSPEC);
748 		lint_assert(s == NOTSPEC);
749 		lint_assert(l == NOTSPEC);
750 		return;
751 	}
752 
753 	if (t == NOTSPEC)
754 		t = INT;
755 	if (s == NOTSPEC && t == INT)
756 		s = SIGNED;
757 	if (l != NOTSPEC && t == CHAR) {
758 		dcs->d_invalid_type_combination = true;
759 		l = NOTSPEC;
760 	}
761 	if (l == LONG && t == FLOAT) {
762 		l = NOTSPEC;
763 		t = DOUBLE;
764 		if (allow_c90)
765 			/* use 'double' instead of 'long float' */
766 			warning(6);
767 	}
768 	if ((l == LONG && t == DOUBLE) || t == LDOUBLE) {
769 		l = NOTSPEC;
770 		t = LDOUBLE;
771 	}
772 	if (t == LDOUBLE && !allow_c90) {
773 		/* 'long double' is illegal in traditional C */
774 		warning(266);
775 	}
776 	if (l == LONG && t == DCOMPLEX) {
777 		l = NOTSPEC;
778 		t = LCOMPLEX;
779 	}
780 
781 	if (t != INT && t != CHAR && (s != NOTSPEC || l != NOTSPEC)) {
782 		dcs->d_invalid_type_combination = true;
783 		l = s = NOTSPEC;
784 	}
785 	if (l != NOTSPEC)
786 		t = l;
787 	dcs->d_type = gettyp(merge_signedness(t, s));
788 }
789 
790 /*
791  * Create a type structure from the information gathered in the declaration
792  * stack.
793  * Complain about storage classes which are not possible in current context.
794  */
795 void
796 dcs_end_type(void)
797 {
798 
799 	dcs_merge_declaration_specifiers();
800 
801 	if (dcs->d_multiple_storage_classes) {
802 		/* only one storage class allowed */
803 		error(7);
804 	}
805 	if (dcs->d_invalid_type_combination) {
806 		/* illegal type combination */
807 		error(4);
808 	}
809 
810 	dcs_adjust_storage_class();
811 
812 	if (dcs->d_const && dcs->d_type->t_const && !dcs->d_type->t_typeof) {
813 		lint_assert(dcs->d_type->t_typedef);
814 		/* typedef already qualified with '%s' */
815 		warning(68, "const");
816 	}
817 	if (dcs->d_volatile && dcs->d_type->t_volatile &&
818 	    !dcs->d_type->t_typeof) {
819 		lint_assert(dcs->d_type->t_typedef);
820 		/* typedef already qualified with '%s' */
821 		warning(68, "volatile");
822 	}
823 
824 	if (dcs->d_const || dcs->d_volatile) {
825 		dcs->d_type = block_dup_type(dcs->d_type);
826 		dcs->d_type->t_const |= dcs->d_const;
827 		dcs->d_type->t_volatile |= dcs->d_volatile;
828 	}
829 }
830 
831 /*
832  * Return the length of a type in bits.
833  *
834  * Printing a message if the outermost dimension of an array is 0 must
835  * be done by the caller. All other problems are reported by this function
836  * if name is not NULL.
837  */
838 int
839 length_in_bits(const type_t *tp, const char *name)
840 {
841 	unsigned int elem, elsz;
842 
843 	elem = 1;
844 	while (tp != NULL && tp->t_tspec == ARRAY) {
845 		elem *= tp->t_dim;
846 		tp = tp->t_subt;
847 	}
848 	if (tp == NULL)
849 		return -1;
850 
851 	switch (tp->t_tspec) {
852 	case FUNC:
853 		lint_assert(/*CONSTCOND*/ false);
854 		break;		/* GCC 10 thinks this were reachable */
855 		/* NOTREACHED */
856 	case STRUCT:
857 	case UNION:
858 		if (is_incomplete(tp) && name != NULL) {
859 			/* '%s' has incomplete type '%s' */
860 			error(31, name, type_name(tp));
861 		}
862 		elsz = tp->t_str->sou_size_in_bits;
863 		break;
864 	case ENUM:
865 		if (is_incomplete(tp) && name != NULL) {
866 			/* incomplete enum type '%s' */
867 			warning(13, name);
868 		}
869 		/* FALLTHROUGH */
870 	default:
871 		elsz = size_in_bits(tp->t_tspec);
872 		/*
873 		 * Workaround until the type parser (see add_function,
874 		 * add_array, add_pointer) does not construct the invalid
875 		 * intermediate declaration 'void b[4]' for the legitimate
876 		 * declaration 'void *b[4]'.
877 		 */
878 		if (sytxerr > 0 && elsz == 0)
879 			elsz = CHAR_SIZE;
880 		lint_assert(elsz > 0);
881 		break;
882 	}
883 	return (int)(elem * elsz);
884 }
885 
886 unsigned int
887 alignment_in_bits(const type_t *tp)
888 {
889 	unsigned int a;
890 	tspec_t t;
891 
892 	/* Super conservative so that it works for most systems. */
893 	unsigned int worst_align_in_bits = 2 * LONG_SIZE;
894 
895 	while (tp->t_tspec == ARRAY)
896 		tp = tp->t_subt;
897 
898 	if (is_struct_or_union(t = tp->t_tspec))
899 		a = tp->t_str->sou_align_in_bits;
900 	else {
901 		lint_assert(t != FUNC);
902 		if ((a = size_in_bits(t)) == 0)
903 			a = CHAR_SIZE;
904 		else if (a > worst_align_in_bits)
905 			a = worst_align_in_bits;
906 
907 	}
908 	lint_assert(a >= CHAR_SIZE);
909 	lint_assert(a <= worst_align_in_bits);
910 	return a;
911 }
912 
913 /*
914  * Concatenate two lists of symbols by s_next. Used by declarations of
915  * struct/union/enum elements and parameters.
916  */
917 sym_t *
918 concat_lists(sym_t *l1, sym_t *l2)
919 {
920 	sym_t	*l;
921 
922 	if ((l = l1) == NULL)
923 		return l2;
924 	while (l1->s_next != NULL)
925 		l1 = l1->s_next;
926 	l1->s_next = l2;
927 	return l;
928 }
929 
930 /*
931  * Check if the type of the given symbol is valid and print an error
932  * message if it is not.
933  *
934  * Invalid types are:
935  * - arrays of incomplete types or functions
936  * - functions returning arrays or functions
937  * - void types other than type of function or pointer
938  */
939 void
940 check_type(sym_t *sym)
941 {
942 	tspec_t	to, t;
943 	type_t	**tpp, *tp;
944 
945 	tpp = &sym->s_type;
946 	to = NOTSPEC;
947 	while ((tp = *tpp) != NULL) {
948 		t = tp->t_tspec;
949 		/*
950 		 * If this is the type of an old-style function definition,
951 		 * a better warning is printed in funcdef().
952 		 */
953 		if (t == FUNC && !tp->t_proto &&
954 		    !(to == NOTSPEC && sym->s_osdef)) {
955 			/* TODO: Make this an error in C99 mode as well. */
956 			if ((!allow_trad && !allow_c99) && hflag)
957 				/* function declaration is not a prototype */
958 				warning(287);
959 		}
960 		if (to == FUNC) {
961 			if (t == FUNC || t == ARRAY) {
962 				/* function returns illegal type '%s' */
963 				error(15, type_name(tp));
964 				*tpp = block_derive_type(
965 				    t == FUNC ? *tpp : (*tpp)->t_subt, PTR);
966 				return;
967 			}
968 			if (tp->t_const || tp->t_volatile) {
969 				/* TODO: Make this a warning in C99 mode as well. */
970 				if (!allow_trad && !allow_c99) {	/* XXX or better allow_c90? */
971 					/* function cannot return const... */
972 					warning(228);
973 				}
974 			}
975 		} else if (to == ARRAY) {
976 			if (t == FUNC) {
977 				/* array of function is illegal */
978 				error(16);
979 				*tpp = gettyp(INT);
980 				return;
981 			}
982 			if (t == ARRAY && tp->t_dim == 0) {
983 				/* null dimension */
984 				error(17);
985 				return;
986 			}
987 			if (t == VOID) {
988 				/* illegal use of 'void' */
989 				error(18);
990 				*tpp = gettyp(INT);
991 			}
992 			/*
993 			 * No need to check for incomplete types here as
994 			 * length_in_bits already does this.
995 			 */
996 		} else if (to == NOTSPEC && t == VOID) {
997 			if (dcs->d_kind == DK_PROTO_ARG) {
998 				if (sym->s_scl != ABSTRACT) {
999 					lint_assert(sym->s_name != unnamed);
1000 					/* void parameter '%s' cannot ... */
1001 					error(61, sym->s_name);
1002 					*tpp = gettyp(INT);
1003 				}
1004 			} else if (dcs->d_kind == DK_ABSTRACT) {
1005 				/* ok */
1006 			} else if (sym->s_scl != TYPEDEF) {
1007 				/* void type for '%s' */
1008 				error(19, sym->s_name);
1009 				*tpp = gettyp(INT);
1010 			}
1011 		}
1012 		if (t == VOID && to != PTR) {
1013 			if (tp->t_const || tp->t_volatile) {
1014 				/* inappropriate qualifiers with 'void' */
1015 				warning(69);
1016 				tp->t_const = tp->t_volatile = false;
1017 			}
1018 		}
1019 		tpp = &tp->t_subt;
1020 		to = t;
1021 	}
1022 }
1023 
1024 /*
1025  * In traditional C, the only portable type for bit-fields is unsigned int.
1026  *
1027  * In C90, the only allowed types for bit-fields are int, signed int and
1028  * unsigned int (3.5.2.1).  There is no mention of implementation-defined
1029  * types.
1030  *
1031  * In C99, the only portable types for bit-fields are _Bool, signed int and
1032  * unsigned int (6.7.2.1p4).  In addition, C99 allows "or some other
1033  * implementation-defined type".
1034  */
1035 static void
1036 check_bit_field_type(sym_t *dsym, type_t **const inout_tp, tspec_t *inout_t)
1037 {
1038 	type_t *tp = *inout_tp;
1039 	tspec_t t = *inout_t;
1040 
1041 	if (t == CHAR || t == UCHAR || t == SCHAR ||
1042 	    t == SHORT || t == USHORT || t == ENUM) {
1043 		if (!bitfieldtype_ok) {
1044 			/* TODO: Make this an error in C99 mode as well. */
1045 			if (!allow_trad && !allow_c99) {
1046 				type_t *btp = block_dup_type(tp);
1047 				btp->t_bitfield = false;
1048 				/* bit-field type '%s' invalid in ANSI C */
1049 				warning(273, type_name(btp));
1050 			} else if (pflag) {
1051 				type_t *btp = block_dup_type(tp);
1052 				btp->t_bitfield = false;
1053 				/* nonportable bit-field type '%s' */
1054 				warning(34, type_name(btp));
1055 			}
1056 		}
1057 	} else if (t == INT && dcs->d_sign_mod == NOTSPEC) {
1058 		if (pflag && !bitfieldtype_ok) {
1059 			/* bit-field of type plain 'int' has ... */
1060 			warning(344);
1061 		}
1062 	} else if (!(t == INT || t == UINT || t == BOOL ||
1063 		     (is_integer(t) && (bitfieldtype_ok || allow_gcc)))) {
1064 
1065 		type_t *btp = block_dup_type(tp);
1066 		btp->t_bitfield = false;
1067 		/* illegal bit-field type '%s' */
1068 		warning(35, type_name(btp));
1069 
1070 		unsigned int sz = tp->t_flen;
1071 		dsym->s_type = tp = block_dup_type(gettyp(t = INT));
1072 		if ((tp->t_flen = sz) > size_in_bits(t))
1073 			tp->t_flen = size_in_bits(t);
1074 		*inout_t = t;
1075 		*inout_tp = tp;
1076 	}
1077 }
1078 
1079 static void
1080 declare_bit_field(sym_t *dsym, tspec_t *inout_t, type_t **const inout_tp)
1081 {
1082 	type_t *tp;
1083 	tspec_t t;
1084 
1085 	check_bit_field_type(dsym, inout_tp, inout_t);
1086 
1087 	tp = *inout_tp;
1088 	t = *inout_t;
1089 	if (tp->t_flen > size_in_bits(t)) {
1090 		/* illegal bit-field size: %d */
1091 		error(36, tp->t_flen);
1092 		tp->t_flen = size_in_bits(t);
1093 	} else if (tp->t_flen == 0 && dsym->s_name != unnamed) {
1094 		/* zero size bit-field */
1095 		error(37);
1096 		tp->t_flen = size_in_bits(t);
1097 	}
1098 	if (dsym->s_scl == MOU) {
1099 		/* bit-field in union is very unusual */
1100 		warning(41);
1101 		dsym->s_type->t_bitfield = false;
1102 		dsym->s_bitfield = false;
1103 	}
1104 }
1105 
1106 /*
1107  * Process the declarator of a struct/union element.
1108  */
1109 sym_t *
1110 declarator_1_struct_union(sym_t *dsym)
1111 {
1112 	type_t	*tp;
1113 	tspec_t	t;
1114 	int	sz;
1115 	unsigned int o = 0;	/* Appease GCC */
1116 
1117 	lint_assert(is_member(dsym));
1118 
1119 	if (dcs->d_redeclared_symbol != NULL) {
1120 		lint_assert(is_member(dcs->d_redeclared_symbol));
1121 
1122 		if (dsym->u.s_member.sm_sou_type ==
1123 		    dcs->d_redeclared_symbol->u.s_member.sm_sou_type) {
1124 			/* duplicate member name '%s' */
1125 			error(33, dsym->s_name);
1126 			rmsym(dcs->d_redeclared_symbol);
1127 		}
1128 	}
1129 
1130 	check_type(dsym);
1131 
1132 	t = (tp = dsym->s_type)->t_tspec;
1133 
1134 	if (dsym->s_bitfield)
1135 		declare_bit_field(dsym, &t, &tp);
1136 	else if (t == FUNC) {
1137 		/* function illegal in structure or union */
1138 		error(38);
1139 		dsym->s_type = tp = block_derive_type(tp, t = PTR);
1140 	}
1141 
1142 	/*
1143 	 * bit-fields of length 0 are not warned about because length_in_bits
1144 	 * does not return the length of the bit-field but the length
1145 	 * of the type the bit-field is packed in (it's ok)
1146 	 */
1147 	if ((sz = length_in_bits(dsym->s_type, dsym->s_name)) == 0) {
1148 		if (t == ARRAY && dsym->s_type->t_dim == 0) {
1149 			/* zero-sized array '%s' in struct is a C99 extension */
1150 			c99ism(39, dsym->s_name);
1151 		}
1152 	}
1153 
1154 	if (dcs->d_kind == DK_MOU) {
1155 		o = dcs->d_offset_in_bits;
1156 		dcs->d_offset_in_bits = 0;
1157 	}
1158 	if (dsym->s_bitfield) {
1159 		dcs_align(alignment_in_bits(tp), tp->t_flen);
1160 		dsym->u.s_member.sm_offset_in_bits = dcs->d_offset_in_bits -
1161 		    dcs->d_offset_in_bits % size_in_bits(t);
1162 		tp->t_foffs = dcs->d_offset_in_bits -
1163 		    dsym->u.s_member.sm_offset_in_bits;
1164 		dcs->d_offset_in_bits += tp->t_flen;
1165 	} else {
1166 		dcs_align(alignment_in_bits(tp), 0);
1167 		dsym->u.s_member.sm_offset_in_bits = dcs->d_offset_in_bits;
1168 		dcs->d_offset_in_bits += sz;
1169 	}
1170 	if (dcs->d_kind == DK_MOU && o > dcs->d_offset_in_bits)
1171 		dcs->d_offset_in_bits = o;
1172 
1173 	check_function_definition(dsym, false);
1174 
1175 	/*
1176 	 * Clear the BITFIELDTYPE indicator after processing each
1177 	 * structure element.
1178 	 */
1179 	bitfieldtype_ok = false;
1180 
1181 	return dsym;
1182 }
1183 
1184 /*
1185  * Aligns next structure element as required.
1186  *
1187  * al contains the required alignment, len the length of a bit-field.
1188  */
1189 static void
1190 dcs_align(unsigned int al, unsigned int len)
1191 {
1192 	unsigned int no;
1193 
1194 	/*
1195 	 * The alignment of the current element becomes the alignment of
1196 	 * the struct/union if it is larger than the current alignment
1197 	 * of the struct/union.
1198 	 */
1199 	if (al > dcs->d_sou_align_in_bits)
1200 		dcs->d_sou_align_in_bits = al;
1201 
1202 	no = (dcs->d_offset_in_bits + (al - 1)) & ~(al - 1);
1203 	if (len == 0 || dcs->d_offset_in_bits + len > no)
1204 		dcs->d_offset_in_bits = no;
1205 }
1206 
1207 /*
1208  * Remember the width of the field in its type structure.
1209  */
1210 sym_t *
1211 set_bit_field_width(sym_t *dsym, int len)
1212 {
1213 
1214 	if (dsym == NULL) {
1215 		dsym = block_zero_alloc(sizeof(*dsym));
1216 		dsym->s_name = unnamed;
1217 		dsym->s_kind = FMEMBER;
1218 		dsym->s_scl = MOS;
1219 		dsym->s_type = gettyp(UINT);
1220 		dsym->s_block_level = -1;
1221 	}
1222 	dsym->s_type = block_dup_type(dsym->s_type);
1223 	dsym->s_type->t_bitfield = true;
1224 	dsym->s_type->t_flen = len;
1225 	dsym->s_bitfield = true;
1226 	return dsym;
1227 }
1228 
1229 /*
1230  * A sequence of asterisks and qualifiers, from right to left.  For example,
1231  * 'const ***volatile **const volatile' results in [cvp, p, vp, p, p].  The
1232  * leftmost 'const' is not included in this list, it is stored in dcs->d_const
1233  * instead.
1234  */
1235 qual_ptr *
1236 merge_qualified_pointer(qual_ptr *p1, qual_ptr *p2)
1237 {
1238 	qual_ptr *tail;
1239 
1240 	if (p2 == NULL)
1241 		return p1;	/* for optional qualifiers */
1242 
1243 	if (p2->p_pointer) {
1244 		/* append p1 to p2, keeping p2 */
1245 		for (tail = p2; tail->p_next != NULL; tail = tail->p_next)
1246 			continue;
1247 		tail->p_next = p1;
1248 		return p2;
1249 	}
1250 
1251 	/* merge p2 into p1, keeping p1 */
1252 	if (p2->p_const) {
1253 		if (p1->p_const) {
1254 			/* duplicate '%s' */
1255 			warning(10, "const");
1256 		}
1257 		p1->p_const = true;
1258 	}
1259 	if (p2->p_volatile) {
1260 		if (p1->p_volatile) {
1261 			/* duplicate '%s' */
1262 			warning(10, "volatile");
1263 		}
1264 		p1->p_volatile = true;
1265 	}
1266 	free(p2);
1267 	return p1;
1268 }
1269 
1270 static type_t *
1271 block_derive_pointer(type_t *stp, bool is_const, bool is_volatile)
1272 {
1273 	type_t *tp;
1274 
1275 	tp = block_derive_type(stp, PTR);
1276 	tp->t_const = is_const;
1277 	tp->t_volatile = is_volatile;
1278 	return tp;
1279 }
1280 
1281 /*
1282  * The following 3 functions extend the type of a declarator with
1283  * pointer, function and array types.
1284  *
1285  * The current type is the type built by dcs_end_type (dcs->d_type) and
1286  * pointer, function and array types already added for this
1287  * declarator. The new type extension is inserted between both.
1288  */
1289 sym_t *
1290 add_pointer(sym_t *decl, qual_ptr *p)
1291 {
1292 
1293 	debug_dinfo(dcs);
1294 
1295 	type_t **tpp = &decl->s_type;
1296 	while (*tpp != NULL && *tpp != dcs->d_type)
1297 		tpp = &(*tpp)->t_subt;
1298 	if (*tpp == NULL) {
1299 		debug_step("add_pointer: unchanged '%s'",
1300 		    type_name(decl->s_type));
1301 		return decl;
1302 	}
1303 
1304 	while (p != NULL) {
1305 		*tpp = block_derive_pointer(dcs->d_type,
1306 		    p->p_const, p->p_volatile);
1307 
1308 		tpp = &(*tpp)->t_subt;
1309 
1310 		qual_ptr *next = p->p_next;
1311 		free(p);
1312 		p = next;
1313 	}
1314 	debug_step("add_pointer: '%s'", type_name(decl->s_type));
1315 	return decl;
1316 }
1317 
1318 static type_t *
1319 block_derive_array(type_t *stp, bool dim, int len)
1320 {
1321 
1322 	type_t *tp = block_derive_type(stp, ARRAY);
1323 	tp->t_dim = len;
1324 
1325 #if 0
1326 	/*
1327 	 * As of 2022-04-03, the implementation of the type parser (see
1328 	 * add_function, add_array, add_pointer) is strange.  When it sees
1329 	 * the type 'void *b[4]', it first creates 'void b[4]' and only later
1330 	 * inserts the '*' in the middle of the type.  Late modifications like
1331 	 * these should not be done at all, instead the parser should be fixed
1332 	 * to process the type names in the proper syntactical order.
1333 	 *
1334 	 * Since the intermediate type would be an array of void, but the
1335 	 * final type is valid, this check cannot be enabled yet.
1336 	 */
1337 	if (stp->t_tspec == VOID) {
1338 		/* array of incomplete type */
1339 		error(301);
1340 		tp->t_subt = gettyp(CHAR);
1341 	}
1342 #endif
1343 	if (len < 0) {
1344 		/* negative array dimension (%d) */
1345 		error(20, len);
1346 	} else if (len == 0 && dim) {
1347 		/* zero sized array is a C99 extension */
1348 		c99ism(322);
1349 	} else if (len == 0 && !dim)
1350 		tp->t_incomplete_array = true;
1351 
1352 	return tp;
1353 }
1354 
1355 /*
1356  * If a dimension was specified, dim is true, otherwise false
1357  * n is the specified dimension
1358  */
1359 sym_t *
1360 add_array(sym_t *decl, bool dim, int n)
1361 {
1362 
1363 	debug_dinfo(dcs);
1364 
1365 	type_t **tpp = &decl->s_type;
1366 	while (*tpp != NULL && *tpp != dcs->d_type)
1367 		tpp = &(*tpp)->t_subt;
1368 	if (*tpp == NULL) {
1369 		debug_step("add_array: unchanged '%s'",
1370 		    type_name(decl->s_type));
1371 		return decl;
1372 	}
1373 
1374 	*tpp = block_derive_array(dcs->d_type, dim, n);
1375 
1376 	debug_step("add_array: '%s'", type_name(decl->s_type));
1377 	return decl;
1378 }
1379 
1380 static type_t *
1381 block_derive_function(type_t *ret, bool proto, sym_t *args, bool vararg)
1382 {
1383 
1384 	type_t *tp = block_derive_type(ret, FUNC);
1385 	tp->t_proto = proto;
1386 	if (proto)
1387 		tp->t_args = args;
1388 	tp->t_vararg = vararg;
1389 	return tp;
1390 }
1391 
1392 sym_t *
1393 add_function(sym_t *decl, sym_t *args)
1394 {
1395 
1396 	debug_enter();
1397 	debug_dinfo(dcs);
1398 	debug_sym("decl: ", decl, "\n");
1399 #ifdef DEBUG
1400 	for (const sym_t *arg = args; arg != NULL; arg = arg->s_next)
1401 		debug_sym("arg: ", arg, "\n");
1402 #endif
1403 
1404 	if (dcs->d_proto) {
1405 		if (!allow_c90)
1406 			/* function prototypes are illegal in traditional C */
1407 			warning(270);
1408 		args = new_style_function(args);
1409 	} else {
1410 		old_style_function(decl, args);
1411 	}
1412 
1413 	/*
1414 	 * The symbols are removed from the symbol table by
1415 	 * end_declaration_level after add_function. To be able to restore
1416 	 * them if this is a function definition, a pointer to the list of
1417 	 * all symbols is stored in dcs->d_enclosing->d_func_proto_syms. Also
1418 	 * a list of the arguments (concatenated by s_next) is stored in
1419 	 * dcs->d_enclosing->d_func_args. (dcs->d_enclosing must be used
1420 	 * because *dcs is the declaration stack element created for the list
1421 	 * of params and is removed after add_function.)
1422 	 */
1423 	if (dcs->d_enclosing->d_kind == DK_EXTERN &&
1424 	    decl->s_type == dcs->d_enclosing->d_type) {
1425 		dcs->d_enclosing->d_func_proto_syms = dcs->d_dlsyms;
1426 		dcs->d_enclosing->d_func_args = args;
1427 	}
1428 
1429 	/*
1430 	 * XXX: What is this code doing on a semantic level, and why?
1431 	 * Returning decl leads to the wrong function types in msg_347.
1432 	 */
1433 	type_t **tpp = &decl->s_type;
1434 	if (*tpp == NULL)
1435 		decl->s_type = dcs->d_enclosing->d_type;
1436 	while (*tpp != NULL && *tpp != dcs->d_enclosing->d_type)
1437 		/*
1438 		 * XXX: accessing INT->t_subt feels strange, even though it
1439 		 * may even be guaranteed to be NULL.
1440 		 */
1441 		tpp = &(*tpp)->t_subt;
1442 	if (*tpp == NULL) {
1443 		debug_step("add_function: unchanged '%s'",
1444 		    type_name(decl->s_type));
1445 		debug_leave();
1446 		return decl;	/* see msg_347 */
1447 	}
1448 
1449 	*tpp = block_derive_function(dcs->d_enclosing->d_type,
1450 	    dcs->d_proto, args, dcs->d_vararg);
1451 
1452 	debug_step("add_function: '%s'", type_name(decl->s_type));
1453 	debug_leave();
1454 	return decl;
1455 }
1456 
1457 static sym_t *
1458 new_style_function(sym_t *args)
1459 {
1460 	sym_t	*arg, *sym;
1461 	scl_t	sc;
1462 
1463 	/*
1464 	 * Declarations of structs/unions/enums in param lists are legal,
1465 	 * but senseless.
1466 	 */
1467 	for (sym = dcs->d_dlsyms; sym != NULL; sym = sym->s_level_next) {
1468 		sc = sym->s_scl;
1469 		if (sc == STRUCT_TAG || sc == UNION_TAG || sc == ENUM_TAG) {
1470 			/* dubious tag declaration '%s %s' */
1471 			warning(85, storage_class_name(sc), sym->s_name);
1472 		}
1473 	}
1474 
1475 	for (arg = args; arg != NULL; arg = arg->s_next) {
1476 		if (arg->s_type->t_tspec == VOID &&
1477 		    !(arg == args && arg->s_next == NULL)) {
1478 			/* void must be sole parameter */
1479 			error(60);
1480 			arg->s_type = gettyp(INT);
1481 		}
1482 	}
1483 
1484 	if (args == NULL || args->s_type->t_tspec == VOID)
1485 		return NULL;
1486 	return args;
1487 }
1488 
1489 /*
1490  * Called for old-style function declarations.
1491  */
1492 static void
1493 old_style_function(sym_t *decl, sym_t *args)
1494 {
1495 
1496 	/*
1497 	 * Remember list of parameters only if this really seems to be a
1498 	 * function definition.
1499 	 */
1500 	if (dcs->d_enclosing->d_kind == DK_EXTERN &&
1501 	    decl->s_type == dcs->d_enclosing->d_type) {
1502 		/*
1503 		 * We assume that this becomes a function definition. If
1504 		 * we are wrong, it's corrected in check_function_definition.
1505 		 */
1506 		if (args != NULL) {
1507 			decl->s_osdef = true;
1508 			decl->u.s_old_style_args = args;
1509 		}
1510 	} else {
1511 		if (args != NULL)
1512 			/* function prototype parameters must have types */
1513 			warning(62);
1514 	}
1515 }
1516 
1517 /*
1518  * Lists of identifiers in functions declarations are allowed only if
1519  * it's also a function definition. If this is not the case, print an
1520  * error message.
1521  */
1522 void
1523 check_function_definition(sym_t *sym, bool msg)
1524 {
1525 
1526 	if (sym->s_osdef) {
1527 		if (msg) {
1528 			/* incomplete or misplaced function definition */
1529 			error(22);
1530 		}
1531 		sym->s_osdef = false;
1532 		sym->u.s_old_style_args = NULL;
1533 	}
1534 }
1535 
1536 /*
1537  * Process the name in a declarator.
1538  * The symbol gets one of the storage classes EXTERN, STATIC, AUTO or
1539  * TYPEDEF.
1540  * s_def and s_register are valid after declarator_name().
1541  */
1542 sym_t *
1543 declarator_name(sym_t *sym)
1544 {
1545 	scl_t	sc = NOSCL;
1546 
1547 	if (sym->s_scl == NOSCL)
1548 		dcs->d_redeclared_symbol = NULL;
1549 	else if (sym->s_defarg) {
1550 		sym->s_defarg = false;
1551 		dcs->d_redeclared_symbol = NULL;
1552 	} else {
1553 		dcs->d_redeclared_symbol = sym;
1554 		sym = pushdown(sym);
1555 	}
1556 
1557 	switch (dcs->d_kind) {
1558 	case DK_MOS:
1559 	case DK_MOU:
1560 		/* Set parent */
1561 		sym->u.s_member.sm_sou_type = dcs->d_tagtyp->t_str;
1562 		sym->s_def = DEF;
1563 		/* XXX: Where is sym->u.s_member.sm_offset_in_bits set? */
1564 		sc = dcs->d_kind == DK_MOS ? MOS : MOU;
1565 		break;
1566 	case DK_EXTERN:
1567 		/*
1568 		 * static and external symbols without "extern" are
1569 		 * considered to be tentatively defined, external
1570 		 * symbols with "extern" are declared, and typedef names
1571 		 * are defined. Tentative defined and declared symbols
1572 		 * may become defined if an initializer is present or
1573 		 * this is a function definition.
1574 		 */
1575 		if ((sc = dcs->d_scl) == NOSCL) {
1576 			sc = EXTERN;
1577 			sym->s_def = TDEF;
1578 		} else if (sc == STATIC)
1579 			sym->s_def = TDEF;
1580 		else if (sc == TYPEDEF)
1581 			sym->s_def = DEF;
1582 		else {
1583 			lint_assert(sc == EXTERN);
1584 			sym->s_def = DECL;
1585 		}
1586 		break;
1587 	case DK_PROTO_ARG:
1588 		sym->s_arg = true;
1589 		/* FALLTHROUGH */
1590 	case DK_OLD_STYLE_ARG:
1591 		if ((sc = dcs->d_scl) == NOSCL)
1592 			sc = AUTO;
1593 		else {
1594 			lint_assert(sc == REG);
1595 			sym->s_register = true;
1596 			sc = AUTO;
1597 		}
1598 		sym->s_def = DEF;
1599 		break;
1600 	case DK_AUTO:
1601 		if ((sc = dcs->d_scl) == NOSCL) {
1602 			/*
1603 			 * XXX somewhat ugly because we dont know whether
1604 			 * this is AUTO or EXTERN (functions). If we are
1605 			 * wrong it must be corrected in declare_local(),
1606 			 * where we have the necessary type information.
1607 			 */
1608 			sc = AUTO;
1609 			sym->s_def = DEF;
1610 		} else if (sc == AUTO || sc == STATIC || sc == TYPEDEF)
1611 			sym->s_def = DEF;
1612 		else if (sc == REG) {
1613 			sym->s_register = true;
1614 			sc = AUTO;
1615 			sym->s_def = DEF;
1616 		} else {
1617 			lint_assert(sc == EXTERN);
1618 			sym->s_def = DECL;
1619 		}
1620 		break;
1621 	case DK_ABSTRACT:	/* try to continue after syntax errors */
1622 		sc = NOSCL;
1623 		break;
1624 	default:
1625 		lint_assert(/*CONSTCOND*/false);
1626 	}
1627 	sym->s_scl = sc;
1628 
1629 	sym->s_type = dcs->d_type;
1630 
1631 	dcs->d_func_proto_syms = NULL;
1632 
1633 	return sym;
1634 }
1635 
1636 /*
1637  * Process a name in the list of formal parameters in an old-style function
1638  * definition.
1639  */
1640 sym_t *
1641 old_style_function_name(sym_t *sym)
1642 {
1643 
1644 	if (sym->s_scl != NOSCL) {
1645 		if (block_level == sym->s_block_level) {
1646 			/* redeclaration of formal parameter '%s' */
1647 			error(21, sym->s_name);
1648 			lint_assert(sym->s_defarg);
1649 		}
1650 		sym = pushdown(sym);
1651 	}
1652 	sym->s_type = gettyp(INT);
1653 	sym->s_scl = AUTO;
1654 	sym->s_def = DEF;
1655 	sym->s_defarg = sym->s_arg = true;
1656 	return sym;
1657 }
1658 
1659 /*
1660  * Create the type of a tag.
1661  *
1662  * tag points to the symbol table entry of the tag
1663  * kind is the kind of the tag (STRUCT/UNION/ENUM)
1664  * decl is true if the type of the tag will be completed in this declaration
1665  * (the following token is T_LBRACE)
1666  * semi is true if the following token is T_SEMI
1667  */
1668 type_t *
1669 make_tag_type(sym_t *tag, tspec_t kind, bool decl, bool semi)
1670 {
1671 	scl_t	scl;
1672 	type_t	*tp;
1673 
1674 	if (kind == STRUCT)
1675 		scl = STRUCT_TAG;
1676 	else if (kind == UNION)
1677 		scl = UNION_TAG;
1678 	else {
1679 		lint_assert(kind == ENUM);
1680 		scl = ENUM_TAG;
1681 	}
1682 
1683 	if (tag != NULL) {
1684 		if (tag->s_scl != NOSCL)
1685 			tag = new_tag(tag, scl, decl, semi);
1686 		else {
1687 			/* a new tag, no empty declaration */
1688 			dcs->d_enclosing->d_nonempty_decl = true;
1689 			if (scl == ENUM_TAG && !decl) {
1690 				/* TODO: Make this an error in C99 mode as well. */
1691 				if (allow_c90 &&
1692 				    ((!allow_trad && !allow_c99) || pflag))
1693 					/* forward reference to enum type */
1694 					warning(42);
1695 			}
1696 		}
1697 		if (tag->s_scl == NOSCL) {
1698 			tag->s_scl = scl;
1699 			tag->s_type = tp = block_zero_alloc(sizeof(*tp));
1700 			tp->t_packed = dcs->d_packed;
1701 		} else
1702 			tp = tag->s_type;
1703 
1704 	} else {
1705 		tag = block_zero_alloc(sizeof(*tag));
1706 		tag->s_name = unnamed;
1707 		UNIQUE_CURR_POS(tag->s_def_pos);
1708 		tag->s_kind = FTAG;
1709 		tag->s_scl = scl;
1710 		tag->s_block_level = -1;
1711 		tag->s_type = tp = block_zero_alloc(sizeof(*tp));
1712 		tp->t_packed = dcs->d_packed;
1713 		dcs->d_enclosing->d_nonempty_decl = true;
1714 	}
1715 
1716 	if (tp->t_tspec == NOTSPEC) {
1717 		tp->t_tspec = kind;
1718 		if (kind != ENUM) {
1719 			tp->t_str = block_zero_alloc(sizeof(*tp->t_str));
1720 			tp->t_str->sou_align_in_bits = CHAR_SIZE;
1721 			tp->t_str->sou_tag = tag;
1722 			tp->t_str->sou_incomplete = true;
1723 		} else {
1724 			tp->t_is_enum = true;
1725 			tp->t_enum = block_zero_alloc(sizeof(*tp->t_enum));
1726 			tp->t_enum->en_tag = tag;
1727 			tp->t_enum->en_incomplete = true;
1728 		}
1729 	}
1730 	return tp;
1731 }
1732 
1733 /*
1734  * Checks all possible cases of tag redeclarations.
1735  * decl is true if T_LBRACE follows
1736  * semi is true if T_SEMI follows
1737  */
1738 static sym_t *
1739 new_tag(sym_t *tag, scl_t scl, bool decl, bool semi)
1740 {
1741 
1742 	if (tag->s_block_level < block_level) {
1743 		if (semi) {
1744 			/* "struct a;" */
1745 			if (allow_c90) {
1746 				/* XXX: Why is this warning suppressed in C90 mode? */
1747 				if (allow_trad || allow_c99)
1748 					/* declaration of '%s %s' intro... */
1749 					warning(44, storage_class_name(scl),
1750 					    tag->s_name);
1751 				tag = pushdown(tag);
1752 			} else if (tag->s_scl != scl) {
1753 				/* base type is really '%s %s' */
1754 				warning(45, storage_class_name(tag->s_scl),
1755 				    tag->s_name);
1756 			}
1757 			dcs->d_enclosing->d_nonempty_decl = true;
1758 		} else if (decl) {
1759 			/* "struct a { ... } " */
1760 			if (hflag)
1761 				/* redefinition of '%s' hides earlier one */
1762 				warning(43, tag->s_name);
1763 			tag = pushdown(tag);
1764 			dcs->d_enclosing->d_nonempty_decl = true;
1765 		} else if (tag->s_scl != scl) {
1766 			/* base type is really '%s %s' */
1767 			warning(45, storage_class_name(tag->s_scl),
1768 			    tag->s_name);
1769 			/* XXX: Why is this warning suppressed in C90 mode? */
1770 			if (allow_trad || allow_c99) {
1771 				/* declaration of '%s %s' introduces ... */
1772 				warning(44, storage_class_name(scl),
1773 				    tag->s_name);
1774 			}
1775 			tag = pushdown(tag);
1776 			dcs->d_enclosing->d_nonempty_decl = true;
1777 		}
1778 	} else {
1779 		if (tag->s_scl != scl ||
1780 		    (decl && !is_incomplete(tag->s_type))) {
1781 			/* %s tag '%s' redeclared as %s */
1782 			error(46, storage_class_name(tag->s_scl),
1783 			    tag->s_name, storage_class_name(scl));
1784 			print_previous_declaration(tag);
1785 			tag = pushdown(tag);
1786 			dcs->d_enclosing->d_nonempty_decl = true;
1787 		} else if (semi || decl)
1788 			dcs->d_enclosing->d_nonempty_decl = true;
1789 	}
1790 	return tag;
1791 }
1792 
1793 const char *
1794 storage_class_name(scl_t sc)
1795 {
1796 	switch (sc) {
1797 	case EXTERN:	return "extern";
1798 	case STATIC:	return "static";
1799 	case AUTO:	return "auto";
1800 	case REG:	return "register";
1801 	case TYPEDEF:	return "typedef";
1802 	case STRUCT_TAG:return "struct";
1803 	case UNION_TAG:	return "union";
1804 	case ENUM_TAG:	return "enum";
1805 	default:	lint_assert(/*CONSTCOND*/false);
1806 	}
1807 	/* NOTREACHED */
1808 }
1809 
1810 /*
1811  * tp points to the type of the tag, fmem to the list of members.
1812  */
1813 type_t *
1814 complete_tag_struct_or_union(type_t *tp, sym_t *fmem)
1815 {
1816 
1817 	if (tp == NULL)		/* in case of syntax errors */
1818 		return gettyp(INT);
1819 
1820 	if (tp->t_tspec == ENUM)
1821 		tp->t_enum->en_incomplete = false;
1822 	else
1823 		tp->t_str->sou_incomplete = false;
1824 
1825 	tspec_t t = tp->t_tspec;
1826 	dcs_align((u_int)dcs->d_sou_align_in_bits, 0);
1827 
1828 	struct_or_union *sp = tp->t_str;
1829 	sp->sou_align_in_bits = dcs->d_sou_align_in_bits;
1830 	sp->sou_first_member = fmem;
1831 	if (tp->t_packed)
1832 		set_packed_size(tp);
1833 	else
1834 		sp->sou_size_in_bits = dcs->d_offset_in_bits;
1835 
1836 	if (sp->sou_size_in_bits == 0) {
1837 		/* zero sized %s is a C99 feature */
1838 		c99ism(47, ttab[t].tt_name);
1839 	}
1840 
1841 	int n = 0;
1842 	for (sym_t *mem = fmem; mem != NULL; mem = mem->s_next) {
1843 		/* bind anonymous members to the structure */
1844 		if (mem->u.s_member.sm_sou_type == NULL) {
1845 			mem->u.s_member.sm_sou_type = sp;
1846 			if (mem->s_type->t_bitfield) {
1847 				sp->sou_size_in_bits += bit_field_size(&mem);
1848 				if (mem == NULL)
1849 					break;
1850 			}
1851 			sp->sou_size_in_bits +=
1852 			    type_size_in_bits(mem->s_type);
1853 		}
1854 		if (mem->s_name != unnamed)
1855 			n++;
1856 	}
1857 
1858 	if (n == 0 && sp->sou_size_in_bits != 0) {
1859 		/* '%s' has no named members */
1860 		warning(65, type_name(tp));
1861 	}
1862 	return tp;
1863 }
1864 
1865 type_t *
1866 complete_tag_enum(type_t *tp, sym_t *first_enumerator)
1867 {
1868 
1869 	tp->t_enum->en_incomplete = false;
1870 	tp->t_enum->en_first_enumerator = first_enumerator;
1871 	return tp;
1872 }
1873 
1874 /*
1875  * Processes the name of an enumerator in an enum declaration.
1876  *
1877  * sym points to the enumerator
1878  * val is the value of the enumerator
1879  * impl is true if the value of the enumerator was not explicitly specified.
1880  */
1881 sym_t *
1882 enumeration_constant(sym_t *sym, int val, bool impl)
1883 {
1884 
1885 	if (sym->s_scl != NOSCL) {
1886 		if (sym->s_block_level == block_level) {
1887 			/* no hflag, because this is illegal */
1888 			if (sym->s_arg) {
1889 				/* enumeration constant '%s' hides parameter */
1890 				warning(57, sym->s_name);
1891 			} else {
1892 				/* redeclaration of '%s' */
1893 				error(27, sym->s_name);
1894 				/*
1895 				 * inside blocks it should not be too
1896 				 * complicated to find the position of the
1897 				 * previous declaration
1898 				 */
1899 				if (block_level == 0)
1900 					print_previous_declaration(sym);
1901 			}
1902 		} else {
1903 			if (hflag)
1904 				/* redefinition of '%s' hides earlier one */
1905 				warning(43, sym->s_name);
1906 		}
1907 		sym = pushdown(sym);
1908 	}
1909 
1910 	sym->s_scl = ENUM_CONST;
1911 	sym->s_type = dcs->d_tagtyp;
1912 	sym->u.s_enum_constant = val;
1913 
1914 	if (impl && val == TARG_INT_MIN) {
1915 		/* enumeration value '%s' overflows */
1916 		warning(48, sym->s_name);
1917 	}
1918 
1919 	enumval = val == TARG_INT_MAX ? TARG_INT_MIN : val + 1;
1920 	return sym;
1921 }
1922 
1923 /*
1924  * Process a single external declarator.
1925  */
1926 static void
1927 declare_extern(sym_t *dsym, bool initflg, sbuf_t *renaming)
1928 {
1929 
1930 	if (renaming != NULL) {
1931 		lint_assert(dsym->s_rename == NULL);
1932 
1933 		char *s = level_zero_alloc(1, renaming->sb_len + 1);
1934 		(void)memcpy(s, renaming->sb_name, renaming->sb_len + 1);
1935 		dsym->s_rename = s;
1936 	}
1937 
1938 	check_function_definition(dsym, true);
1939 
1940 	check_type(dsym);
1941 
1942 	if (initflg && !check_init(dsym))
1943 		dsym->s_def = DEF;
1944 
1945 	/*
1946 	 * Declarations of functions are marked as "tentative" in
1947 	 * declarator_name(). This is wrong because there are no
1948 	 * tentative function definitions.
1949 	 */
1950 	if (dsym->s_type->t_tspec == FUNC && dsym->s_def == TDEF)
1951 		dsym->s_def = DECL;
1952 
1953 	if (dcs->d_inline) {
1954 		if (dsym->s_type->t_tspec == FUNC) {
1955 			dsym->s_inline = true;
1956 		} else {
1957 			/* variable '%s' declared inline */
1958 			warning(268, dsym->s_name);
1959 		}
1960 	}
1961 
1962 	/* Write the declaration into the output file */
1963 	if (plibflg && llibflg &&
1964 	    dsym->s_type->t_tspec == FUNC && dsym->s_type->t_proto) {
1965 		/*
1966 		 * With both LINTLIBRARY and PROTOLIB the prototype is
1967 		 * written as a function definition to the output file.
1968 		 */
1969 		bool rval = dsym->s_type->t_subt->t_tspec != VOID;
1970 		outfdef(dsym, &dsym->s_def_pos, rval, false, NULL);
1971 	} else if (!is_compiler_builtin(dsym->s_name)) {
1972 		outsym(dsym, dsym->s_scl, dsym->s_def);
1973 	}
1974 
1975 	sym_t *rdsym;
1976 	if ((rdsym = dcs->d_redeclared_symbol) != NULL) {
1977 
1978 		/*
1979 		 * If the old symbol stems from an old-style function
1980 		 * definition, we have remembered the params in
1981 		 * rdsym->s_old_style_args and compare them with the params
1982 		 * of the prototype.
1983 		 */
1984 		bool redec = rdsym->s_osdef && dsym->s_type->t_proto &&
1985 		    check_old_style_definition(rdsym, dsym);
1986 
1987 		bool dowarn = false;
1988 		if (!redec && !check_redeclaration(dsym, &dowarn)) {
1989 			if (dowarn) {
1990 				/* TODO: Make this an error in C99 mode as well. */
1991 				if (!allow_trad && !allow_c99)
1992 					/* redeclaration of '%s' */
1993 					error(27, dsym->s_name);
1994 				else
1995 					/* redeclaration of '%s' */
1996 					warning(27, dsym->s_name);
1997 				print_previous_declaration(rdsym);
1998 			}
1999 
2000 			/*
2001 			 * Take over the remembered params if the new symbol
2002 			 * is not a prototype.
2003 			 */
2004 			if (rdsym->s_osdef && !dsym->s_type->t_proto) {
2005 				dsym->s_osdef = rdsym->s_osdef;
2006 				dsym->u.s_old_style_args =
2007 				    rdsym->u.s_old_style_args;
2008 				dsym->s_def_pos = rdsym->s_def_pos;
2009 			}
2010 
2011 			if (rdsym->s_type->t_proto && !dsym->s_type->t_proto)
2012 				dsym->s_def_pos = rdsym->s_def_pos;
2013 			else if (rdsym->s_def == DEF && dsym->s_def != DEF)
2014 				dsym->s_def_pos = rdsym->s_def_pos;
2015 
2016 			copy_usage_info(dsym, rdsym);
2017 
2018 			/* Once a name is defined, it remains defined. */
2019 			if (rdsym->s_def == DEF)
2020 				dsym->s_def = DEF;
2021 
2022 			/* once a function is inline, it remains inline */
2023 			if (rdsym->s_inline)
2024 				dsym->s_inline = true;
2025 
2026 			complete_type(dsym, rdsym);
2027 		}
2028 
2029 		rmsym(rdsym);
2030 	}
2031 
2032 	if (dsym->s_scl == TYPEDEF) {
2033 		dsym->s_type = block_dup_type(dsym->s_type);
2034 		dsym->s_type->t_typedef = true;
2035 		set_first_typedef(dsym->s_type, dsym);
2036 	}
2037 }
2038 
2039 void
2040 declare(sym_t *decl, bool initflg, sbuf_t *renaming)
2041 {
2042 
2043 	if (dcs->d_kind == DK_EXTERN)
2044 		declare_extern(decl, initflg, renaming);
2045 	else if (dcs->d_kind == DK_OLD_STYLE_ARG ||
2046 		 dcs->d_kind == DK_PROTO_ARG) {
2047 		if (renaming != NULL) {
2048 			/* symbol renaming can't be used on function arguments */
2049 			error(310);
2050 		} else
2051 			(void)declare_argument(decl, initflg);
2052 	} else {
2053 		lint_assert(dcs->d_kind == DK_AUTO);
2054 		if (renaming != NULL) {
2055 			/* symbol renaming can't be used on automatic variables */
2056 			error(311);
2057 		} else
2058 			declare_local(decl, initflg);
2059 	}
2060 }
2061 
2062 /*
2063  * Copies information about usage into a new symbol table entry of
2064  * the same symbol.
2065  */
2066 void
2067 copy_usage_info(sym_t *sym, sym_t *rdsym)
2068 {
2069 
2070 	sym->s_set_pos = rdsym->s_set_pos;
2071 	sym->s_use_pos = rdsym->s_use_pos;
2072 	sym->s_set = rdsym->s_set;
2073 	sym->s_used = rdsym->s_used;
2074 }
2075 
2076 /*
2077  * Prints an error and returns true if a symbol is redeclared/redefined.
2078  * Otherwise, returns false and, in some cases of minor problems, prints
2079  * a warning.
2080  */
2081 bool
2082 check_redeclaration(sym_t *dsym, bool *dowarn)
2083 {
2084 
2085 	sym_t *rsym = dcs->d_redeclared_symbol;
2086 	if (rsym->s_scl == ENUM_CONST) {
2087 		/* redeclaration of '%s' */
2088 		error(27, dsym->s_name);
2089 		print_previous_declaration(rsym);
2090 		return true;
2091 	}
2092 	if (rsym->s_scl == TYPEDEF) {
2093 		/* typedef '%s' redeclared */
2094 		error(89, dsym->s_name);
2095 		print_previous_declaration(rsym);
2096 		return true;
2097 	}
2098 	if (dsym->s_scl == TYPEDEF) {
2099 		/* redeclaration of '%s' */
2100 		error(27, dsym->s_name);
2101 		print_previous_declaration(rsym);
2102 		return true;
2103 	}
2104 	if (rsym->s_def == DEF && dsym->s_def == DEF) {
2105 		/* redefinition of '%s' */
2106 		error(28, dsym->s_name);
2107 		print_previous_declaration(rsym);
2108 		return true;
2109 	}
2110 	if (!types_compatible(rsym->s_type, dsym->s_type, false, false, dowarn)) {
2111 		/* redeclaration of '%s' with type '%s', expected '%s' */
2112 		error(347, dsym->s_name,
2113 		    type_name(dsym->s_type), type_name(rsym->s_type));
2114 		print_previous_declaration(rsym);
2115 		return true;
2116 	}
2117 	if (rsym->s_scl == EXTERN && dsym->s_scl == EXTERN)
2118 		return false;
2119 	if (rsym->s_scl == STATIC && dsym->s_scl == STATIC)
2120 		return false;
2121 	if (rsym->s_scl == STATIC && dsym->s_def == DECL)
2122 		return false;
2123 	if (rsym->s_scl == EXTERN && rsym->s_def == DEF) {
2124 		/*
2125 		 * All cases except "int a = 1; static int a;" are caught
2126 		 * above with or without a warning
2127 		 */
2128 		/* redeclaration of '%s' */
2129 		error(27, dsym->s_name);
2130 		print_previous_declaration(rsym);
2131 		return true;
2132 	}
2133 	if (rsym->s_scl == EXTERN) {
2134 		/* '%s' was previously declared extern, becomes static */
2135 		warning(29, dsym->s_name);
2136 		print_previous_declaration(rsym);
2137 		return false;
2138 	}
2139 	/*
2140 	 * Now it's one of:
2141 	 * "static a; int a;", "static a; int a = 1;", "static a = 1; int a;"
2142 	 */
2143 	/* TODO: Make this an error in C99 mode as well. */
2144 	if (!allow_trad && !allow_c99) {
2145 		/* redeclaration of '%s'; ANSI C requires static */
2146 		warning(30, dsym->s_name);
2147 		print_previous_declaration(rsym);
2148 	}
2149 	dsym->s_scl = STATIC;
2150 	return false;
2151 }
2152 
2153 static bool
2154 qualifiers_correspond(const type_t *tp1, const type_t *tp2, bool ignqual)
2155 {
2156 
2157 	if (tp1->t_const != tp2->t_const && !ignqual && allow_c90)
2158 		return false;
2159 	if (tp1->t_volatile != tp2->t_volatile && !ignqual && allow_c90)
2160 		return false;
2161 	return true;
2162 }
2163 
2164 bool
2165 pointer_types_are_compatible(const type_t *tp1, const type_t *tp2, bool ignqual)
2166 {
2167 
2168 	return tp1->t_tspec == VOID || tp2->t_tspec == VOID ||
2169 	       qualifiers_correspond(tp1, tp2, ignqual);
2170 }
2171 
2172 /*
2173  * ignqual	ignore qualifiers of type; used for function parameters
2174  * promot	promote the left type; used for comparison of parameters of
2175  *		old-style function definitions with parameters of prototypes.
2176  * *dowarn	is set to true if an old-style function declaration is not
2177  *		compatible with a prototype
2178  */
2179 bool
2180 types_compatible(const type_t *tp1, const type_t *tp2,
2181 		     bool ignqual, bool promot, bool *dowarn)
2182 {
2183 
2184 	while (tp1 != NULL && tp2 != NULL) {
2185 		tspec_t t = tp1->t_tspec;
2186 		if (promot) {
2187 			if (t == FLOAT)
2188 				t = DOUBLE;
2189 			else if (t == CHAR || t == SCHAR)
2190 				t = INT;
2191 			else if (t == UCHAR)
2192 				t = allow_c90 ? INT : UINT;
2193 			else if (t == SHORT)
2194 				t = INT;
2195 			else if (t == USHORT) {
2196 				/* CONSTCOND */
2197 				t = TARG_INT_MAX < TARG_USHRT_MAX || !allow_c90
2198 				    ? UINT : INT;
2199 			}
2200 		}
2201 
2202 		if (t != tp2->t_tspec)
2203 			return false;
2204 
2205 		if (!qualifiers_correspond(tp1, tp2, ignqual))
2206 			return false;
2207 
2208 		if (is_struct_or_union(t))
2209 			return tp1->t_str == tp2->t_str;
2210 
2211 		if (t == ENUM && eflag)
2212 			return tp1->t_enum == tp2->t_enum;
2213 
2214 		if (t == ARRAY && tp1->t_dim != tp2->t_dim) {
2215 			if (tp1->t_dim != 0 && tp2->t_dim != 0)
2216 				return false;
2217 		}
2218 
2219 		/* don't check prototypes for traditional */
2220 		if (t == FUNC && allow_c90) {
2221 			if (tp1->t_proto && tp2->t_proto) {
2222 				if (!prototypes_compatible(tp1, tp2, dowarn))
2223 					return false;
2224 			} else if (tp1->t_proto) {
2225 				if (!matches_no_arg_function(tp1, dowarn))
2226 					return false;
2227 			} else if (tp2->t_proto) {
2228 				if (!matches_no_arg_function(tp2, dowarn))
2229 					return false;
2230 			}
2231 		}
2232 
2233 		tp1 = tp1->t_subt;
2234 		tp2 = tp2->t_subt;
2235 		ignqual = promot = false;
2236 	}
2237 
2238 	return tp1 == tp2;
2239 }
2240 
2241 static bool
2242 prototypes_compatible(const type_t *tp1, const type_t *tp2, bool *dowarn)
2243 {
2244 
2245 	if (tp1->t_vararg != tp2->t_vararg)
2246 		return false;
2247 
2248 	sym_t *a1 = tp1->t_args;
2249 	sym_t *a2 = tp2->t_args;
2250 
2251 	for (; a1 != NULL && a2 != NULL; a1 = a1->s_next, a2 = a2->s_next) {
2252 		if (!types_compatible(a1->s_type, a2->s_type,
2253 		    true, false, dowarn))
2254 			return false;
2255 	}
2256 	return a1 == a2;
2257 }
2258 
2259 /*
2260  * Returns whether all parameters of a prototype are compatible with an
2261  * old-style function declaration.
2262  *
2263  * This is the case if the following conditions are met:
2264  *	1. the prototype has a fixed number of parameters
2265  *	2. no parameter is of type float
2266  *	3. no parameter is converted to another type if integer promotion
2267  *	   is applied on it
2268  */
2269 static bool
2270 matches_no_arg_function(const type_t *tp, bool *dowarn)
2271 {
2272 	sym_t	*arg;
2273 	tspec_t	t;
2274 
2275 	if (tp->t_vararg && dowarn != NULL)
2276 		*dowarn = true;
2277 	for (arg = tp->t_args; arg != NULL; arg = arg->s_next) {
2278 		if ((t = arg->s_type->t_tspec) == FLOAT ||
2279 		    t == CHAR || t == SCHAR || t == UCHAR ||
2280 		    t == SHORT || t == USHORT) {
2281 			if (dowarn != NULL)
2282 				*dowarn = true;
2283 		}
2284 	}
2285 	/* FIXME: Always returning true cannot be correct. */
2286 	return true;
2287 }
2288 
2289 /*
2290  * Compares a prototype declaration with the remembered arguments of
2291  * a previous old-style function definition.
2292  */
2293 static bool
2294 check_old_style_definition(sym_t *rdsym, sym_t *dsym)
2295 {
2296 	sym_t	*args, *pargs, *arg, *parg;
2297 	int	narg, nparg, n;
2298 	bool	dowarn, msg;
2299 
2300 	args = rdsym->u.s_old_style_args;
2301 	pargs = dsym->s_type->t_args;
2302 
2303 	msg = false;
2304 
2305 	narg = nparg = 0;
2306 	for (arg = args; arg != NULL; arg = arg->s_next)
2307 		narg++;
2308 	for (parg = pargs; parg != NULL; parg = parg->s_next)
2309 		nparg++;
2310 	if (narg != nparg) {
2311 		/* prototype does not match old-style definition */
2312 		error(63);
2313 		msg = true;
2314 		goto end;
2315 	}
2316 
2317 	arg = args;
2318 	parg = pargs;
2319 	n = 1;
2320 	while (narg-- > 0) {
2321 		dowarn = false;
2322 		/*
2323 		 * If it does not match due to promotion and lint runs in
2324 		 * "traditional to C90" migration mode, print only a warning.
2325 		 *
2326 		 * XXX: Where is this "only a warning"?
2327 		 */
2328 		if (!types_compatible(arg->s_type, parg->s_type,
2329 		    true, true, &dowarn) ||
2330 		    dowarn) {
2331 			/* prototype does not match old-style ... */
2332 			error(299, n);
2333 			msg = true;
2334 		}
2335 		arg = arg->s_next;
2336 		parg = parg->s_next;
2337 		n++;
2338 	}
2339 
2340 end:
2341 	if (msg && rflag) {
2342 		/* old-style definition */
2343 		message_at(300, &rdsym->s_def_pos);
2344 	}
2345 
2346 	return msg;
2347 }
2348 
2349 /*
2350  * Completes a type by copying the dimension and prototype information
2351  * from a second compatible type.
2352  *
2353  * Following lines are legal:
2354  *  "typedef a[]; a b; a b[10]; a c; a c[20];"
2355  *  "typedef ft(); ft f; f(int); ft g; g(long);"
2356  * This means that, if a type is completed, the type structure must
2357  * be duplicated.
2358  */
2359 void
2360 complete_type(sym_t *dsym, sym_t *ssym)
2361 {
2362 	type_t **dstp, *src;
2363 	type_t *dst;
2364 
2365 	dstp = &dsym->s_type;
2366 	src = ssym->s_type;
2367 
2368 	while ((dst = *dstp) != NULL) {
2369 		lint_assert(src != NULL);
2370 		lint_assert(dst->t_tspec == src->t_tspec);
2371 		if (dst->t_tspec == ARRAY) {
2372 			if (dst->t_dim == 0 && src->t_dim != 0) {
2373 				*dstp = dst = block_dup_type(dst);
2374 				dst->t_dim = src->t_dim;
2375 				dst->t_incomplete_array = false;
2376 			}
2377 		} else if (dst->t_tspec == FUNC) {
2378 			if (!dst->t_proto && src->t_proto) {
2379 				*dstp = dst = block_dup_type(dst);
2380 				dst->t_proto = true;
2381 				dst->t_args = src->t_args;
2382 			}
2383 		}
2384 		dstp = &dst->t_subt;
2385 		src = src->t_subt;
2386 	}
2387 }
2388 
2389 /*
2390  * Completes the declaration of a single argument.
2391  */
2392 sym_t *
2393 declare_argument(sym_t *sym, bool initflg)
2394 {
2395 	tspec_t t;
2396 
2397 	check_function_definition(sym, true);
2398 
2399 	check_type(sym);
2400 
2401 	if (dcs->d_redeclared_symbol != NULL &&
2402 	    dcs->d_redeclared_symbol->s_block_level == block_level) {
2403 		/* redeclaration of formal parameter '%s' */
2404 		error(237, sym->s_name);
2405 		rmsym(dcs->d_redeclared_symbol);
2406 		sym->s_arg = true;
2407 	}
2408 
2409 	if (!sym->s_arg) {
2410 		/* declared argument '%s' is missing */
2411 		error(53, sym->s_name);
2412 		sym->s_arg = true;
2413 	}
2414 
2415 	if (initflg) {
2416 		/* cannot initialize parameter '%s' */
2417 		error(52, sym->s_name);
2418 	}
2419 
2420 	if (sym->s_type == NULL)	/* for c(void()) */
2421 		sym->s_type = gettyp(VOID);
2422 
2423 	if ((t = sym->s_type->t_tspec) == ARRAY)
2424 		sym->s_type = block_derive_type(sym->s_type->t_subt, PTR);
2425 	else if (t == FUNC) {
2426 		if (!allow_c90)
2427 			/* argument '%s' has function type, should be ... */
2428 			warning(50, sym->s_name);
2429 		sym->s_type = block_derive_type(sym->s_type, PTR);
2430 	} else if (t == FLOAT) {
2431 		if (!allow_c90)
2432 			sym->s_type = gettyp(DOUBLE);
2433 	}
2434 
2435 	if (dcs->d_inline)
2436 		/* argument '%s' declared inline */
2437 		warning(269, sym->s_name);
2438 
2439 	/*
2440 	 * Arguments must have complete types. length_in_bits prints the
2441 	 * needed error messages (null dimension is impossible because arrays
2442 	 * are converted to pointers).
2443 	 */
2444 	if (sym->s_type->t_tspec != VOID)
2445 		(void)length_in_bits(sym->s_type, sym->s_name);
2446 
2447 	sym->s_used = dcs->d_used;
2448 	mark_as_set(sym);
2449 
2450 	return sym;
2451 }
2452 
2453 static bool
2454 is_character_pointer(const type_t *tp)
2455 {
2456 	tspec_t st;
2457 
2458 	return tp->t_tspec == PTR &&
2459 	       (st = tp->t_subt->t_tspec,
2460 		   st == CHAR || st == SCHAR || st == UCHAR);
2461 }
2462 
2463 void
2464 check_func_lint_directives(void)
2465 {
2466 
2467 	/* check for illegal combinations of lint directives */
2468 	if (printflike_argnum != -1 && scanflike_argnum != -1) {
2469 		/* can't be used together: ** PRINTFLIKE ** ** SCANFLIKE ** */
2470 		warning(289);
2471 		printflike_argnum = scanflike_argnum = -1;
2472 	}
2473 	if (nvararg != -1 &&
2474 	    (printflike_argnum != -1 || scanflike_argnum != -1)) {
2475 		/* dubious use of ** VARARGS ** with ** %s ** */
2476 		warning(288,
2477 		    printflike_argnum != -1 ? "PRINTFLIKE" : "SCANFLIKE");
2478 		nvararg = -1;
2479 	}
2480 
2481 	/*
2482 	 * check if the argument of a lint directive is compatible with the
2483 	 * number of arguments.
2484 	 */
2485 	int narg = 0;
2486 	for (sym_t *arg = dcs->d_func_args; arg != NULL; arg = arg->s_next)
2487 		narg++;
2488 	if (nargusg > narg) {
2489 		/* argument number mismatch with directive ** %s ** */
2490 		warning(283, "ARGSUSED");
2491 		nargusg = 0;
2492 	}
2493 	if (nvararg > narg) {
2494 		/* argument number mismatch with directive ** %s ** */
2495 		warning(283, "VARARGS");
2496 		nvararg = 0;
2497 	}
2498 	if (printflike_argnum > narg) {
2499 		/* argument number mismatch with directive ** %s ** */
2500 		warning(283, "PRINTFLIKE");
2501 		printflike_argnum = -1;
2502 	} else if (printflike_argnum == 0) {
2503 		printflike_argnum = -1;
2504 	}
2505 	if (scanflike_argnum > narg) {
2506 		/* argument number mismatch with directive ** %s ** */
2507 		warning(283, "SCANFLIKE");
2508 		scanflike_argnum = -1;
2509 	} else if (scanflike_argnum == 0) {
2510 		scanflike_argnum = -1;
2511 	}
2512 	if (printflike_argnum != -1 || scanflike_argnum != -1) {
2513 		narg = printflike_argnum != -1
2514 		    ? printflike_argnum : scanflike_argnum;
2515 		sym_t *arg = dcs->d_func_args;
2516 		for (int n = 1; n < narg; n++)
2517 			arg = arg->s_next;
2518 		if (!is_character_pointer(arg->s_type)) {
2519 			/* argument %d must be 'char *' for PRINTFLIKE/... */
2520 			warning(293, narg);
2521 			printflike_argnum = scanflike_argnum = -1;
2522 		}
2523 	}
2524 }
2525 
2526 /*
2527  * Warn about arguments in old-style function definitions that default to int.
2528  * Check that an old-style function definition is compatible to a previous
2529  * prototype.
2530  */
2531 void
2532 check_func_old_style_arguments(void)
2533 {
2534 	sym_t *args, *arg, *pargs, *parg;
2535 	int narg, nparg;
2536 	bool msg;
2537 
2538 	args = funcsym->u.s_old_style_args;
2539 	pargs = funcsym->s_type->t_args;
2540 
2541 	/*
2542 	 * print a warning for each argument of an old-style function
2543 	 * definition which defaults to int
2544 	 */
2545 	for (arg = args; arg != NULL; arg = arg->s_next) {
2546 		if (arg->s_defarg) {
2547 			/* type of argument '%s' defaults to 'int' */
2548 			warning(32, arg->s_name);
2549 			arg->s_defarg = false;
2550 			mark_as_set(arg);
2551 		}
2552 	}
2553 
2554 	/*
2555 	 * If this is an old-style function definition and a prototype
2556 	 * exists, compare the types of arguments.
2557 	 */
2558 	if (funcsym->s_osdef && funcsym->s_type->t_proto) {
2559 		/*
2560 		 * If the number of arguments does not match, we need not
2561 		 * continue.
2562 		 */
2563 		narg = nparg = 0;
2564 		msg = false;
2565 		for (parg = pargs; parg != NULL; parg = parg->s_next)
2566 			nparg++;
2567 		for (arg = args; arg != NULL; arg = arg->s_next)
2568 			narg++;
2569 		if (narg != nparg) {
2570 			/* parameter mismatch: %d declared, %d defined */
2571 			error(51, nparg, narg);
2572 			msg = true;
2573 		} else {
2574 			parg = pargs;
2575 			arg = args;
2576 			while (narg-- > 0) {
2577 				msg |= check_prototype_declaration(arg, parg);
2578 				parg = parg->s_next;
2579 				arg = arg->s_next;
2580 			}
2581 		}
2582 		if (msg && rflag) {
2583 			/* prototype declaration */
2584 			message_at(285, &dcs->d_redeclared_symbol->s_def_pos);
2585 		}
2586 
2587 		/* from now on the prototype is valid */
2588 		funcsym->s_osdef = false;
2589 		funcsym->u.s_old_style_args = NULL;
2590 	}
2591 }
2592 
2593 /*
2594  * Checks compatibility of an old-style function definition with a previous
2595  * prototype declaration.
2596  * Returns true if the position of the previous declaration should be reported.
2597  */
2598 static bool
2599 check_prototype_declaration(sym_t *arg, sym_t *parg)
2600 {
2601 	type_t	*tp, *ptp;
2602 	bool	dowarn;
2603 
2604 	tp = arg->s_type;
2605 	ptp = parg->s_type;
2606 
2607 	dowarn = false;
2608 
2609 	if (!types_compatible(tp, ptp, true, true, &dowarn)) {
2610 		if (types_compatible(tp, ptp, true, false, &dowarn)) {
2611 			/* type of '%s' does not match prototype */
2612 			return gnuism(58, arg->s_name);
2613 		} else {
2614 			/* type of '%s' does not match prototype */
2615 			error(58, arg->s_name);
2616 			return true;
2617 		}
2618 	}
2619 	if (dowarn) {
2620 		/* TODO: Make this an error in C99 mode as well. */
2621 		if (!allow_trad && !allow_c99)
2622 			/* type of '%s' does not match prototype */
2623 			error(58, arg->s_name);
2624 		else
2625 			/* type of '%s' does not match prototype */
2626 			warning(58, arg->s_name);
2627 		return true;
2628 	}
2629 
2630 	return false;
2631 }
2632 
2633 static void
2634 check_local_hiding(const sym_t *dsym)
2635 {
2636 	switch (dsym->s_scl) {
2637 	case AUTO:
2638 		/* automatic '%s' hides external declaration */
2639 		warning(86, dsym->s_name);
2640 		break;
2641 	case STATIC:
2642 		/* static '%s' hides external declaration */
2643 		warning(87, dsym->s_name);
2644 		break;
2645 	case TYPEDEF:
2646 		/* typedef '%s' hides external declaration */
2647 		warning(88, dsym->s_name);
2648 		break;
2649 	case EXTERN:
2650 		/* Already checked in declare_external_in_block. */
2651 		break;
2652 	default:
2653 		lint_assert(/*CONSTCOND*/false);
2654 	}
2655 }
2656 
2657 static void
2658 check_local_redeclaration(const sym_t *dsym, sym_t *rsym)
2659 {
2660 	if (rsym->s_block_level == 0) {
2661 		if (hflag)
2662 			check_local_hiding(dsym);
2663 
2664 	} else if (rsym->s_block_level == block_level) {
2665 
2666 		/* no hflag, because it's illegal! */
2667 		if (rsym->s_arg) {
2668 			/*
2669 			 * if allow_c90, a "redeclaration of '%s'" error
2670 			 * is produced below
2671 			 */
2672 			if (!allow_c90) {
2673 				if (hflag) {
2674 					/* declaration of '%s' hides ... */
2675 					warning(91, dsym->s_name);
2676 				}
2677 				rmsym(rsym);
2678 			}
2679 		}
2680 
2681 	} else if (rsym->s_block_level < block_level) {
2682 		if (hflag) {
2683 			/* declaration of '%s' hides earlier one */
2684 			warning(95, dsym->s_name);
2685 		}
2686 	}
2687 
2688 	if (rsym->s_block_level == block_level) {
2689 		/* redeclaration of '%s' */
2690 		error(27, dsym->s_name);
2691 		rmsym(rsym);
2692 	}
2693 }
2694 
2695 /*
2696  * Completes a single local declaration/definition.
2697  */
2698 void
2699 declare_local(sym_t *dsym, bool initflg)
2700 {
2701 
2702 	/* Correct a mistake done in declarator_name(). */
2703 	if (dsym->s_type->t_tspec == FUNC) {
2704 		dsym->s_def = DECL;
2705 		if (dcs->d_scl == NOSCL)
2706 			dsym->s_scl = EXTERN;
2707 	}
2708 
2709 	if (dsym->s_type->t_tspec == FUNC) {
2710 		if (dsym->s_scl == STATIC) {
2711 			/* dubious static function '%s' at block level */
2712 			warning(93, dsym->s_name);
2713 			dsym->s_scl = EXTERN;
2714 		} else if (dsym->s_scl != EXTERN && dsym->s_scl != TYPEDEF) {
2715 			/* function '%s' has illegal storage class */
2716 			error(94, dsym->s_name);
2717 			dsym->s_scl = EXTERN;
2718 		}
2719 	}
2720 
2721 	/*
2722 	 * functions may be declared inline at local scope, although
2723 	 * this has no effect for a later definition of the same
2724 	 * function.
2725 	 * XXX it should have an effect if !allow_c90 is set. this would
2726 	 * also be the way gcc behaves.
2727 	 */
2728 	if (dcs->d_inline) {
2729 		if (dsym->s_type->t_tspec == FUNC)
2730 			dsym->s_inline = true;
2731 		else {
2732 			/* variable '%s' declared inline */
2733 			warning(268, dsym->s_name);
2734 		}
2735 	}
2736 
2737 	check_function_definition(dsym, true);
2738 
2739 	check_type(dsym);
2740 
2741 	if (dcs->d_redeclared_symbol != NULL && dsym->s_scl == EXTERN)
2742 		declare_external_in_block(dsym);
2743 
2744 	if (dsym->s_scl == EXTERN) {
2745 		/*
2746 		 * XXX if the static variable at level 0 is only defined
2747 		 * later, checking will be possible.
2748 		 */
2749 		if (dsym->s_ext_sym == NULL)
2750 			outsym(dsym, EXTERN, dsym->s_def);
2751 		else
2752 			outsym(dsym, dsym->s_ext_sym->s_scl, dsym->s_def);
2753 
2754 	}
2755 
2756 	if (dcs->d_redeclared_symbol != NULL)
2757 		check_local_redeclaration(dsym, dcs->d_redeclared_symbol);
2758 
2759 	if (initflg && !check_init(dsym)) {
2760 		dsym->s_def = DEF;
2761 		mark_as_set(dsym);
2762 	}
2763 
2764 	if (dsym->s_scl == TYPEDEF) {
2765 		dsym->s_type = block_dup_type(dsym->s_type);
2766 		dsym->s_type->t_typedef = true;
2767 		set_first_typedef(dsym->s_type, dsym);
2768 	}
2769 
2770 	/*
2771 	 * Before we can check the size we must wait for an initialization
2772 	 * that may follow.
2773 	 */
2774 }
2775 
2776 /* Processes (re)declarations of external symbols inside blocks. */
2777 static void
2778 declare_external_in_block(sym_t *dsym)
2779 {
2780 
2781 	/* look for a symbol with the same name */
2782 	sym_t *esym = dcs->d_redeclared_symbol;
2783 	while (esym != NULL && esym->s_block_level != 0) {
2784 		while ((esym = esym->s_symtab_next) != NULL) {
2785 			if (esym->s_kind != FVFT)
2786 				continue;
2787 			if (strcmp(dsym->s_name, esym->s_name) == 0)
2788 				break;
2789 		}
2790 	}
2791 	if (esym == NULL)
2792 		return;
2793 	if (esym->s_scl != EXTERN && esym->s_scl != STATIC) {
2794 		/* gcc accepts this without a warning, pcc prints an error. */
2795 		/* redeclaration of '%s' */
2796 		warning(27, dsym->s_name);
2797 		print_previous_declaration(esym);
2798 		return;
2799 	}
2800 
2801 	bool dowarn = false;
2802 	bool compatible = types_compatible(esym->s_type, dsym->s_type,
2803 	    false, false, &dowarn);
2804 
2805 	if (!compatible || dowarn) {
2806 		if (esym->s_scl == EXTERN) {
2807 			/* inconsistent redeclaration of extern '%s' */
2808 			warning(90, dsym->s_name);
2809 			print_previous_declaration(esym);
2810 		} else {
2811 			/* inconsistent redeclaration of static '%s' */
2812 			warning(92, dsym->s_name);
2813 			print_previous_declaration(esym);
2814 		}
2815 	}
2816 
2817 	if (compatible) {
2818 		/*
2819 		 * Remember the external symbol so we can update usage
2820 		 * information at the end of the block.
2821 		 */
2822 		dsym->s_ext_sym = esym;
2823 	}
2824 }
2825 
2826 /*
2827  * Print an error or a warning if the symbol cannot be initialized due
2828  * to type/storage class. Return whether an error has been detected.
2829  */
2830 static bool
2831 check_init(sym_t *sym)
2832 {
2833 	bool	erred;
2834 
2835 	erred = false;
2836 
2837 	if (sym->s_type->t_tspec == FUNC) {
2838 		/* cannot initialize function '%s' */
2839 		error(24, sym->s_name);
2840 		erred = true;
2841 	} else if (sym->s_scl == TYPEDEF) {
2842 		/* cannot initialize typedef '%s' */
2843 		error(25, sym->s_name);
2844 		erred = true;
2845 	} else if (sym->s_scl == EXTERN && sym->s_def == DECL) {
2846 		if (dcs->d_kind == DK_EXTERN) {
2847 			/* cannot initialize extern declaration '%s' */
2848 			warning(26, sym->s_name);
2849 		} else {
2850 			/* cannot initialize extern declaration '%s' */
2851 			error(26, sym->s_name);
2852 			erred = true;
2853 		}
2854 	}
2855 
2856 	return erred;
2857 }
2858 
2859 /*
2860  * Create a symbol for an abstract declaration.
2861  */
2862 sym_t *
2863 abstract_name(void)
2864 {
2865 	sym_t	*sym;
2866 
2867 	lint_assert(dcs->d_kind == DK_ABSTRACT ||
2868 	    dcs->d_kind == DK_PROTO_ARG);
2869 
2870 	sym = block_zero_alloc(sizeof(*sym));
2871 
2872 	sym->s_name = unnamed;
2873 	sym->s_def = DEF;
2874 	sym->s_scl = ABSTRACT;
2875 	sym->s_block_level = -1;
2876 
2877 	if (dcs->d_kind == DK_PROTO_ARG)
2878 		sym->s_arg = true;
2879 
2880 	/*
2881 	 * At this point, dcs->d_type contains only the basic type.  That
2882 	 * type will be updated later, adding pointers, arrays and functions
2883 	 * as necessary.
2884 	 */
2885 	/*
2886 	 * XXX: This is not the correct type.  For example in msg_347, it is
2887 	 * the type of the last prototype parameter, but it should rather be
2888 	 * the return type of the function.
2889 	 */
2890 	sym->s_type = dcs->d_type;
2891 	dcs->d_redeclared_symbol = NULL;
2892 	dcs->d_vararg = false;
2893 
2894 	return sym;
2895 }
2896 
2897 /*
2898  * Removes anything which has nothing to do on global level.
2899  */
2900 void
2901 global_clean_up(void)
2902 {
2903 
2904 	while (dcs->d_enclosing != NULL)
2905 		end_declaration_level();
2906 
2907 	clean_up_after_error();
2908 	block_level = 0;
2909 	mem_block_level = 0;
2910 
2911 	/*
2912 	 * remove all information about pending lint directives without
2913 	 * warnings.
2914 	 */
2915 	global_clean_up_decl(true);
2916 }
2917 
2918 /*
2919  * Process an abstract type declaration
2920  */
2921 sym_t *
2922 declare_1_abstract(sym_t *sym)
2923 {
2924 
2925 	check_function_definition(sym, true);
2926 	check_type(sym);
2927 	return sym;
2928 }
2929 
2930 /*
2931  * Checks size after declarations of variables and their initialization.
2932  */
2933 void
2934 check_size(sym_t *dsym)
2935 {
2936 
2937 	if (dsym->s_def == DEF &&
2938 	    dsym->s_scl != TYPEDEF &&
2939 	    dsym->s_type->t_tspec != FUNC &&
2940 	    length_in_bits(dsym->s_type, dsym->s_name) == 0 &&
2941 	    dsym->s_type->t_tspec == ARRAY &&
2942 	    dsym->s_type->t_dim == 0) {
2943 		if (!allow_c90) {
2944 			/* empty array declaration for '%s' */
2945 			warning(190, dsym->s_name);
2946 		} else {
2947 			/* empty array declaration for '%s' */
2948 			error(190, dsym->s_name);
2949 		}
2950 	}
2951 }
2952 
2953 /*
2954  * Mark an object as set if it is not already
2955  */
2956 void
2957 mark_as_set(sym_t *sym)
2958 {
2959 
2960 	if (!sym->s_set) {
2961 		sym->s_set = true;
2962 		UNIQUE_CURR_POS(sym->s_set_pos);
2963 	}
2964 }
2965 
2966 /*
2967  * Mark an object as used if it is not already
2968  */
2969 void
2970 mark_as_used(sym_t *sym, bool fcall, bool szof)
2971 {
2972 
2973 	if (!sym->s_used) {
2974 		sym->s_used = true;
2975 		UNIQUE_CURR_POS(sym->s_use_pos);
2976 	}
2977 	/*
2978 	 * For function calls, another record is written.
2979 	 *
2980 	 * XXX: Should symbols used in sizeof() be treated as used or not?
2981 	 * Probably not, because there is no point in declaring an external
2982 	 * variable only to get its size.
2983 	 */
2984 	if (!fcall && !szof && sym->s_kind == FVFT && sym->s_scl == EXTERN)
2985 		outusg(sym);
2986 }
2987 
2988 /*
2989  * Prints warnings for a list of variables and labels (concatenated
2990  * with s_level_next) if these are not used or only set.
2991  */
2992 void
2993 check_usage(dinfo_t *di)
2994 {
2995 	/* for this warning LINTED has no effect */
2996 	int saved_lwarn = lwarn;
2997 	lwarn = LWARN_ALL;
2998 
2999 	debug_step("begin lwarn %d", lwarn);
3000 	for (sym_t *sym = di->d_dlsyms; sym != NULL; sym = sym->s_level_next)
3001 		check_usage_sym(di->d_asm, sym);
3002 	lwarn = saved_lwarn;
3003 	debug_step("end lwarn %d", lwarn);
3004 }
3005 
3006 /*
3007  * Prints a warning for a single variable or label if it is not used or
3008  * only set.
3009  */
3010 void
3011 check_usage_sym(bool novar, sym_t *sym)
3012 {
3013 
3014 	if (sym->s_block_level == -1)
3015 		return;
3016 
3017 	if (sym->s_kind == FVFT && sym->s_arg)
3018 		check_argument_usage(novar, sym);
3019 	else if (sym->s_kind == FVFT)
3020 		check_variable_usage(novar, sym);
3021 	else if (sym->s_kind == FLABEL)
3022 		check_label_usage(sym);
3023 	else if (sym->s_kind == FTAG)
3024 		check_tag_usage(sym);
3025 }
3026 
3027 static void
3028 check_argument_usage(bool novar, sym_t *arg)
3029 {
3030 
3031 	lint_assert(arg->s_set);
3032 
3033 	if (novar)
3034 		return;
3035 
3036 	if (!arg->s_used && vflag) {
3037 		/* argument '%s' unused in function '%s' */
3038 		warning_at(231, &arg->s_def_pos, arg->s_name, funcsym->s_name);
3039 	}
3040 }
3041 
3042 static void
3043 check_variable_usage(bool novar, sym_t *sym)
3044 {
3045 	scl_t	sc;
3046 	sym_t	*xsym;
3047 
3048 	lint_assert(block_level != 0);
3049 
3050 	/* example at file scope: int c = ({ return 3; }); */
3051 	if (sym->s_block_level == 0 && ch_isdigit(sym->s_name[0]))
3052 		return;
3053 
3054 	/* errors in expressions easily cause lots of these warnings */
3055 	if (nerr != 0)
3056 		return;
3057 
3058 	/*
3059 	 * XXX Only variables are checked, although types should
3060 	 * probably also be checked
3061 	 */
3062 	sc = sym->s_scl;
3063 	if (sc != EXTERN && sc != STATIC && sc != AUTO && sc != REG)
3064 		return;
3065 
3066 	if (novar)
3067 		return;
3068 
3069 	if (sc == EXTERN) {
3070 		if (!sym->s_used && !sym->s_set) {
3071 			/* '%s' unused in function '%s' */
3072 			warning_at(192, &sym->s_def_pos,
3073 			    sym->s_name, funcsym->s_name);
3074 		}
3075 	} else {
3076 		if (sym->s_set && !sym->s_used) {
3077 			/* '%s' set but not used in function '%s' */
3078 			warning_at(191, &sym->s_set_pos,
3079 			    sym->s_name, funcsym->s_name);
3080 		} else if (!sym->s_used) {
3081 			/* '%s' unused in function '%s' */
3082 			warning_at(192, &sym->s_def_pos,
3083 			    sym->s_name, funcsym->s_name);
3084 		}
3085 	}
3086 
3087 	if (sc == EXTERN) {
3088 		/*
3089 		 * information about usage is taken over into the symbol
3090 		 * table entry at level 0 if the symbol was locally declared
3091 		 * as an external symbol.
3092 		 *
3093 		 * XXX This is wrong for symbols declared static at level 0
3094 		 * if the usage information stems from sizeof(). This is
3095 		 * because symbols at level 0 only used in sizeof() are
3096 		 * considered to not be used.
3097 		 */
3098 		if ((xsym = sym->s_ext_sym) != NULL) {
3099 			if (sym->s_used && !xsym->s_used) {
3100 				xsym->s_used = true;
3101 				xsym->s_use_pos = sym->s_use_pos;
3102 			}
3103 			if (sym->s_set && !xsym->s_set) {
3104 				xsym->s_set = true;
3105 				xsym->s_set_pos = sym->s_set_pos;
3106 			}
3107 		}
3108 	}
3109 }
3110 
3111 static void
3112 check_label_usage(sym_t *lab)
3113 {
3114 
3115 	lint_assert(block_level == 1);
3116 	lint_assert(lab->s_block_level == 1);
3117 
3118 	if (funcsym == NULL) {
3119 		/* syntax error '%s' */
3120 		error(249, "labels are only valid inside a function");
3121 	} else if (lab->s_set && !lab->s_used) {
3122 		/* label '%s' unused in function '%s' */
3123 		warning_at(232, &lab->s_set_pos, lab->s_name, funcsym->s_name);
3124 	} else if (!lab->s_set) {
3125 		/* undefined label '%s' */
3126 		warning_at(23, &lab->s_use_pos, lab->s_name);
3127 	}
3128 }
3129 
3130 static void
3131 check_tag_usage(sym_t *sym)
3132 {
3133 
3134 	if (!is_incomplete(sym->s_type))
3135 		return;
3136 
3137 	/* always complain about incomplete tags declared inside blocks */
3138 	if (!zflag || dcs->d_kind != DK_EXTERN)
3139 		return;
3140 
3141 	switch (sym->s_type->t_tspec) {
3142 	case STRUCT:
3143 		/* struct '%s' never defined */
3144 		warning_at(233, &sym->s_def_pos, sym->s_name);
3145 		break;
3146 	case UNION:
3147 		/* union '%s' never defined */
3148 		warning_at(234, &sym->s_def_pos, sym->s_name);
3149 		break;
3150 	case ENUM:
3151 		/* enum '%s' never defined */
3152 		warning_at(235, &sym->s_def_pos, sym->s_name);
3153 		break;
3154 	default:
3155 		lint_assert(/*CONSTCOND*/false);
3156 	}
3157 }
3158 
3159 /*
3160  * Called after the entire translation unit has been parsed.
3161  * Changes tentative definitions into definitions.
3162  * Performs some tests on global symbols. Detected problems are:
3163  * - defined variables of incomplete type
3164  * - constant variables which are not initialized
3165  * - static symbols which are never used
3166  */
3167 void
3168 check_global_symbols(void)
3169 {
3170 	sym_t	*sym;
3171 
3172 	if (block_level != 0 || dcs->d_enclosing != NULL)
3173 		norecover();
3174 
3175 	for (sym = dcs->d_dlsyms; sym != NULL; sym = sym->s_level_next) {
3176 		if (sym->s_block_level == -1)
3177 			continue;
3178 		if (sym->s_kind == FVFT)
3179 			check_global_variable(sym);
3180 		else if (sym->s_kind == FTAG)
3181 			check_tag_usage(sym);
3182 		else
3183 			lint_assert(sym->s_kind == FMEMBER);
3184 	}
3185 }
3186 
3187 static void
3188 check_unused_static_global_variable(const sym_t *sym)
3189 {
3190 	if (sym->s_type->t_tspec == FUNC) {
3191 		if (sym->s_def == DEF) {
3192 			if (!sym->s_inline)
3193 				/* static function '%s' unused */
3194 				warning_at(236, &sym->s_def_pos, sym->s_name);
3195 		} else {
3196 			/* static function '%s' declared but not defined */
3197 			warning_at(290, &sym->s_def_pos, sym->s_name);
3198 		}
3199 	} else if (!sym->s_set) {
3200 		/* static variable '%s' unused */
3201 		warning_at(226, &sym->s_def_pos, sym->s_name);
3202 	} else {
3203 		/* static variable '%s' set but not used */
3204 		warning_at(307, &sym->s_def_pos, sym->s_name);
3205 	}
3206 }
3207 
3208 static void
3209 check_static_global_variable(const sym_t *sym)
3210 {
3211 	if (sym->s_type->t_tspec == FUNC && sym->s_used && sym->s_def != DEF) {
3212 		/* static function '%s' called but not defined */
3213 		error_at(225, &sym->s_use_pos, sym->s_name);
3214 	}
3215 
3216 	if (!sym->s_used)
3217 		check_unused_static_global_variable(sym);
3218 
3219 	if (allow_c90 && sym->s_def == TDEF && sym->s_type->t_const) {
3220 		/* const object '%s' should have initializer */
3221 		warning_at(227, &sym->s_def_pos, sym->s_name);
3222 	}
3223 }
3224 
3225 static void
3226 check_global_variable(const sym_t *sym)
3227 {
3228 	scl_t scl = sym->s_scl;
3229 
3230 	if (scl == TYPEDEF || scl == BOOL_CONST || scl == ENUM_CONST)
3231 		return;
3232 
3233 	if (scl == NOSCL)
3234 		return;		/* May be caused by a syntax error. */
3235 
3236 	lint_assert(scl == EXTERN || scl == STATIC);
3237 
3238 	check_global_variable_size(sym);
3239 
3240 	if (scl == STATIC)
3241 		check_static_global_variable(sym);
3242 }
3243 
3244 static void
3245 check_global_variable_size(const sym_t *sym)
3246 {
3247 	pos_t cpos;
3248 	int len_in_bits;
3249 
3250 	if (sym->s_def != TDEF)
3251 		return;
3252 	if (sym->s_type->t_tspec == FUNC) {
3253 		/* Maybe a syntax error after a function declaration. */
3254 		return;
3255 	}
3256 	if (sym->s_def == TDEF && sym->s_type->t_tspec == VOID) {
3257 		/* Prevent an internal error in length_in_bits below. */
3258 		return;
3259 	}
3260 
3261 	cpos = curr_pos;
3262 	curr_pos = sym->s_def_pos;
3263 	len_in_bits = length_in_bits(sym->s_type, sym->s_name);
3264 	curr_pos = cpos;
3265 
3266 	if (len_in_bits == 0 &&
3267 	    sym->s_type->t_tspec == ARRAY && sym->s_type->t_dim == 0) {
3268 		/* TODO: C99 6.7.5.2p1 defines this as an error as well. */
3269 		if (!allow_c90 ||
3270 		    (sym->s_scl == EXTERN && (allow_trad || allow_c99))) {
3271 			/* empty array declaration for '%s' */
3272 			warning_at(190, &sym->s_def_pos, sym->s_name);
3273 		} else {
3274 			/* empty array declaration for '%s' */
3275 			error_at(190, &sym->s_def_pos, sym->s_name);
3276 		}
3277 	}
3278 }
3279 
3280 /*
3281  * Prints information about location of previous definition/declaration.
3282  */
3283 void
3284 print_previous_declaration(const sym_t *psym)
3285 {
3286 
3287 	if (!rflag)
3288 		return;
3289 
3290 	if (psym->s_def == DEF || psym->s_def == TDEF) {
3291 		/* previous definition of '%s' */
3292 		message_at(261, &psym->s_def_pos, psym->s_name);
3293 	} else {
3294 		/* previous declaration of '%s' */
3295 		message_at(260, &psym->s_def_pos, psym->s_name);
3296 	}
3297 }
3298 
3299 /*
3300  * Gets a node for a constant and returns the value of this constant
3301  * as integer.
3302  *
3303  * If the node is not constant or too large for int or of type float,
3304  * a warning will be printed.
3305  *
3306  * to_int_constant() should be used only inside declarations. If it is used in
3307  * expressions, it frees the memory used for the expression.
3308  */
3309 int
3310 to_int_constant(tnode_t *tn, bool required)
3311 {
3312 	int	i;
3313 	tspec_t	t;
3314 
3315 	if (tn == NULL)
3316 		return 1;
3317 
3318 	val_t *v = constant(tn, required);
3319 
3320 	/*
3321 	 * Abstract declarations are used inside expression. To free
3322 	 * the memory would be a fatal error.
3323 	 * We don't free blocks that are inside casts because these
3324 	 * will be used later to match types.
3325 	 */
3326 	if (tn->tn_op != CON && dcs->d_kind != DK_ABSTRACT)
3327 		expr_free_all();
3328 
3329 	if ((t = v->v_tspec) == FLOAT || t == DOUBLE || t == LDOUBLE) {
3330 		i = (int)v->v_ldbl;
3331 		/* integral constant expression expected */
3332 		error(55);
3333 	} else {
3334 		i = (int)v->v_quad;
3335 		if (is_uinteger(t)) {
3336 			if ((uint64_t)v->v_quad > (uint64_t)TARG_INT_MAX) {
3337 				/* integral constant too large */
3338 				warning(56);
3339 			}
3340 		} else {
3341 			if (v->v_quad > (int64_t)TARG_INT_MAX ||
3342 			    v->v_quad < (int64_t)TARG_INT_MIN) {
3343 				/* integral constant too large */
3344 				warning(56);
3345 			}
3346 		}
3347 	}
3348 
3349 	free(v);
3350 	return i;
3351 }
3352