xref: /netbsd-src/usr.bin/xlint/lint1/func.c (revision 53b02e147d4ed531c0d2a5ca9b3e8026ba3e99b5)
1 /*	$NetBSD: func.c,v 1.126 2021/11/16 21:01:05 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: func.c,v 1.126 2021/11/16 21:01:05 rillig Exp $");
41 #endif
42 
43 #include <stdlib.h>
44 #include <string.h>
45 
46 #include "lint1.h"
47 #include "cgram.h"
48 
49 /*
50  * Contains a pointer to the symbol table entry of the current function
51  * definition.
52  */
53 sym_t	*funcsym;
54 
55 /* Is set as long as a statement can be reached. Must be set at level 0. */
56 bool	reached = true;
57 
58 /*
59  * Is true by default, can be cleared by NOTREACHED.
60  * Is reset to true whenever 'reached' changes.
61  */
62 bool	warn_about_unreachable;
63 
64 /*
65  * In conjunction with 'reached', controls printing of "fallthrough on ..."
66  * warnings.
67  * Reset by each statement and set by FALLTHROUGH, switch (switch1())
68  * and case (label()).
69  *
70  * Control statements if, for, while and switch do not reset seen_fallthrough
71  * because this must be done by the controlled statement. At least for if this
72  * is important because ** FALLTHROUGH ** after "if (expr) statement" is
73  * evaluated before the following token, which causes reduction of above.
74  * This means that ** FALLTHROUGH ** after "if ..." would always be ignored.
75  */
76 bool	seen_fallthrough;
77 
78 /* The innermost control statement */
79 control_statement *cstmt;
80 
81 /*
82  * Number of arguments which will be checked for usage in following
83  * function definition. -1 stands for all arguments.
84  *
85  * The position of the last ARGSUSED comment is stored in argsused_pos.
86  */
87 int	nargusg = -1;
88 pos_t	argsused_pos;
89 
90 /*
91  * Number of arguments of the following function definition whose types
92  * shall be checked by lint2. -1 stands for all arguments.
93  *
94  * The position of the last VARARGS comment is stored in vapos.
95  */
96 int	nvararg = -1;
97 pos_t	vapos;
98 
99 /*
100  * Both printflike_argnum and scanflike_argnum contain the 1-based number
101  * of the string argument which shall be used to check the types of remaining
102  * arguments (for PRINTFLIKE and SCANFLIKE).
103  *
104  * printflike_pos and scanflike_pos are the positions of the last PRINTFLIKE
105  * or SCANFLIKE comment.
106  */
107 int	printflike_argnum = -1;
108 int	scanflike_argnum = -1;
109 pos_t	printflike_pos;
110 pos_t	scanflike_pos;
111 
112 /*
113  * If both plibflg and llibflg are set, prototypes are written as function
114  * definitions to the output file.
115  */
116 bool	plibflg;
117 
118 /*
119  * True means that no warnings about constants in conditional
120  * context are printed.
121  */
122 bool	constcond_flag;
123 
124 /*
125  * llibflg is set if a lint library shall be created. The effect of
126  * llibflg is that all defined symbols are treated as used.
127  * (The LINTLIBRARY comment also resets vflag.)
128  */
129 bool	llibflg;
130 
131 /*
132  * Nonzero if warnings are suppressed by a LINTED directive
133  * LWARN_BAD:	error
134  * LWARN_ALL:	warnings on
135  * LWARN_NONE:	all warnings ignored
136  * 0..n: warning n ignored
137  */
138 int	lwarn = LWARN_ALL;
139 
140 /*
141  * Whether bitfield type errors are suppressed by a BITFIELDTYPE
142  * directive.
143  */
144 bool	bitfieldtype_ok;
145 
146 /*
147  * Whether complaints about use of "long long" are suppressed in
148  * the next statement or declaration.
149  */
150 bool	quadflg;
151 
152 /*
153  * Puts a new element at the top of the stack used for control statements.
154  */
155 void
156 begin_control_statement(control_statement_kind kind)
157 {
158 	control_statement *cs;
159 
160 	cs = xcalloc(1, sizeof(*cs));
161 	cs->c_kind = kind;
162 	cs->c_surrounding = cstmt;
163 	cstmt = cs;
164 }
165 
166 /*
167  * Removes the top element of the stack used for control statements.
168  */
169 void
170 end_control_statement(control_statement_kind kind)
171 {
172 	control_statement *cs;
173 	case_label_t *cl, *next;
174 
175 	lint_assert(cstmt != NULL);
176 
177 	while (cstmt->c_kind != kind)
178 		cstmt = cstmt->c_surrounding;
179 
180 	cs = cstmt;
181 	cstmt = cs->c_surrounding;
182 
183 	for (cl = cs->c_case_labels; cl != NULL; cl = next) {
184 		next = cl->cl_next;
185 		free(cl);
186 	}
187 
188 	free(cs->c_switch_type);
189 	free(cs);
190 }
191 
192 static void
193 set_reached(bool new_reached)
194 {
195 	debug_step("%s -> %s",
196 	    reached ? "reachable" : "unreachable",
197 	    new_reached ? "reachable" : "unreachable");
198 	reached = new_reached;
199 	warn_about_unreachable = true;
200 }
201 
202 /*
203  * Prints a warning if a statement cannot be reached.
204  */
205 void
206 check_statement_reachable(void)
207 {
208 	if (!reached && warn_about_unreachable) {
209 		/* statement not reached */
210 		warning(193);
211 		warn_about_unreachable = false;
212 	}
213 }
214 
215 /*
216  * Called after a function declaration which introduces a function definition
217  * and before an (optional) old style argument declaration list.
218  *
219  * Puts all symbols declared in the prototype or in an old style argument
220  * list back to the symbol table.
221  *
222  * Does the usual checking of storage class, type (return value),
223  * redeclaration, etc.
224  */
225 void
226 funcdef(sym_t *fsym)
227 {
228 	int	n;
229 	bool	dowarn;
230 	sym_t	*arg, *sym, *rdsym;
231 
232 	funcsym = fsym;
233 
234 	/*
235 	 * Put all symbols declared in the argument list back to the
236 	 * symbol table.
237 	 */
238 	for (sym = dcs->d_func_proto_syms; sym != NULL; sym = sym->s_dlnxt) {
239 		if (sym->s_block_level != -1) {
240 			lint_assert(sym->s_block_level == 1);
241 			inssym(1, sym);
242 		}
243 	}
244 
245 	/*
246 	 * In old_style_function() we did not know whether it is an old
247 	 * style function definition or only an old style declaration,
248 	 * if there are no arguments inside the argument list ("f()").
249 	 */
250 	if (!fsym->s_type->t_proto && fsym->s_args == NULL)
251 		fsym->s_osdef = true;
252 
253 	check_type(fsym);
254 
255 	/*
256 	 * check_type() checks for almost all possible errors, but not for
257 	 * incomplete return values (these are allowed in declarations)
258 	 */
259 	if (fsym->s_type->t_subt->t_tspec != VOID &&
260 	    is_incomplete(fsym->s_type->t_subt)) {
261 		/* cannot return incomplete type */
262 		error(67);
263 	}
264 
265 	fsym->s_def = DEF;
266 
267 	if (fsym->s_scl == TYPEDEF) {
268 		fsym->s_scl = EXTERN;
269 		/* illegal storage class */
270 		error(8);
271 	}
272 
273 	if (dcs->d_inline)
274 		fsym->s_inline = true;
275 
276 	/*
277 	 * Arguments in new style function declarations need a name.
278 	 * (void is already removed from the list of arguments)
279 	 */
280 	n = 1;
281 	for (arg = fsym->s_type->t_args; arg != NULL; arg = arg->s_next) {
282 		if (arg->s_scl == ABSTRACT) {
283 			lint_assert(arg->s_name == unnamed);
284 			/* formal parameter lacks name: param #%d */
285 			error(59, n);
286 		} else {
287 			lint_assert(arg->s_name != unnamed);
288 		}
289 		n++;
290 	}
291 
292 	/*
293 	 * We must also remember the position. s_def_pos is overwritten
294 	 * if this is an old style definition and we had already a
295 	 * prototype.
296 	 */
297 	dcs->d_func_def_pos = fsym->s_def_pos;
298 
299 	if ((rdsym = dcs->d_redeclared_symbol) != NULL) {
300 
301 		if (!check_redeclaration(fsym, (dowarn = false, &dowarn))) {
302 
303 			/*
304 			 * Print nothing if the newly defined function
305 			 * is defined in old style. A better warning will
306 			 * be printed in check_func_lint_directives().
307 			 */
308 			if (dowarn && !fsym->s_osdef) {
309 				if (sflag)
310 					/* redeclaration of %s */
311 					error(27, fsym->s_name);
312 				else
313 					/* redeclaration of %s */
314 					warning(27, fsym->s_name);
315 				print_previous_declaration(-1, rdsym);
316 			}
317 
318 			copy_usage_info(fsym, rdsym);
319 
320 			/*
321 			 * If the old symbol was a prototype and the new
322 			 * one is none, overtake the position of the
323 			 * declaration of the prototype.
324 			 */
325 			if (fsym->s_osdef && rdsym->s_type->t_proto)
326 				fsym->s_def_pos = rdsym->s_def_pos;
327 
328 			complete_type(fsym, rdsym);
329 
330 			if (rdsym->s_inline)
331 				fsym->s_inline = true;
332 
333 		}
334 
335 		/* remove the old symbol from the symbol table */
336 		rmsym(rdsym);
337 
338 	}
339 
340 	if (fsym->s_osdef && !fsym->s_type->t_proto) {
341 		if (sflag && hflag && strcmp(fsym->s_name, "main") != 0)
342 			/* function definition is not a prototype */
343 			warning(286);
344 	}
345 
346 	if (dcs->d_notyp)
347 		fsym->s_return_type_implicit_int = true;
348 
349 	set_reached(true);
350 }
351 
352 static void
353 check_missing_return_value(void)
354 {
355 	if (funcsym->s_type->t_subt->t_tspec == VOID)
356 		return;
357 	if (funcsym->s_return_type_implicit_int)
358 		return;
359 
360 	/* C99 5.1.2.2.3 "Program termination" p1 */
361 	if (Sflag && strcmp(funcsym->s_name, "main") == 0)
362 		return;
363 
364 	/* function %s falls off bottom without returning value */
365 	warning(217, funcsym->s_name);
366 }
367 
368 /*
369  * Called at the end of a function definition.
370  */
371 void
372 funcend(void)
373 {
374 	sym_t	*arg;
375 	int	n;
376 
377 	if (reached) {
378 		cstmt->c_had_return_noval = true;
379 		check_missing_return_value();
380 	}
381 
382 	/*
383 	 * This warning is printed only if the return value was implicitly
384 	 * declared to be int. Otherwise the wrong return statement
385 	 * has already printed a warning.
386 	 */
387 	if (cstmt->c_had_return_noval && cstmt->c_had_return_value &&
388 	    funcsym->s_return_type_implicit_int)
389 		/* function %s has return (e); and return; */
390 		warning(216, funcsym->s_name);
391 
392 	/* Print warnings for unused arguments */
393 	arg = dcs->d_func_args;
394 	n = 0;
395 	while (arg != NULL && (nargusg == -1 || n < nargusg)) {
396 		check_usage_sym(dcs->d_asm, arg);
397 		arg = arg->s_next;
398 		n++;
399 	}
400 	nargusg = -1;
401 
402 	/*
403 	 * write the information about the function definition to the
404 	 * output file
405 	 * inline functions explicitly declared extern are written as
406 	 * declarations only.
407 	 */
408 	if (dcs->d_scl == EXTERN && funcsym->s_inline) {
409 		outsym(funcsym, funcsym->s_scl, DECL);
410 	} else {
411 		outfdef(funcsym, &dcs->d_func_def_pos,
412 		    cstmt->c_had_return_value, funcsym->s_osdef,
413 		    dcs->d_func_args);
414 	}
415 
416 	/* clean up after syntax errors, see test stmt_for.c. */
417 	while (dcs->d_next != NULL)
418 		dcs = dcs->d_next;
419 
420 	/*
421 	 * remove all symbols declared during argument declaration from
422 	 * the symbol table
423 	 */
424 	lint_assert(dcs->d_next == NULL);
425 	lint_assert(dcs->d_ctx == EXTERN);
426 	rmsyms(dcs->d_func_proto_syms);
427 
428 	/* must be set on level 0 */
429 	set_reached(true);
430 }
431 
432 void
433 named_label(sym_t *sym)
434 {
435 
436 	if (sym->s_set) {
437 		/* label %s redefined */
438 		error(194, sym->s_name);
439 	} else {
440 		mark_as_set(sym);
441 	}
442 
443 	set_reached(true);
444 }
445 
446 static void
447 check_case_label_bitand(const tnode_t *case_expr, const tnode_t *switch_expr)
448 {
449 	uint64_t case_value, mask;
450 
451 	if (switch_expr->tn_op != BITAND ||
452 	    switch_expr->tn_right->tn_op != CON)
453 		return;
454 
455 	lint_assert(case_expr->tn_op == CON);
456 	case_value = case_expr->tn_val->v_quad;
457 	mask = switch_expr->tn_right->tn_val->v_quad;
458 
459 	if ((case_value & ~mask) != 0) {
460 		/* statement not reached */
461 		warning(193);
462 	}
463 }
464 
465 static void
466 check_case_label_enum(const tnode_t *tn, const control_statement *cs)
467 {
468 	/* similar to typeok_enum in tree.c */
469 
470 	if (!(tn->tn_type->t_is_enum || cs->c_switch_type->t_is_enum))
471 		return;
472 	if (tn->tn_type->t_is_enum && cs->c_switch_type->t_is_enum &&
473 	    tn->tn_type->t_enum == cs->c_switch_type->t_enum)
474 		return;
475 
476 #if 0 /* not yet ready, see msg_130.c */
477 	/* enum type mismatch: '%s' '%s' '%s' */
478 	warning(130, type_name(cs->c_switch_type), op_name(EQ),
479 	    type_name(tn->tn_type));
480 #endif
481 }
482 
483 static void
484 check_case_label(tnode_t *tn, control_statement *cs)
485 {
486 	case_label_t *cl;
487 	val_t	*v;
488 	val_t	nv;
489 	tspec_t	t;
490 
491 	if (cs == NULL) {
492 		/* case not in switch */
493 		error(195);
494 		return;
495 	}
496 
497 	if (tn != NULL && tn->tn_op != CON) {
498 		/* non-constant case expression */
499 		error(197);
500 		return;
501 	}
502 
503 	if (tn != NULL && !is_integer(tn->tn_type->t_tspec)) {
504 		/* non-integral case expression */
505 		error(198);
506 		return;
507 	}
508 
509 	check_case_label_bitand(tn, cs->c_switch_expr);
510 	check_case_label_enum(tn, cs);
511 
512 	lint_assert(cs->c_switch_type != NULL);
513 
514 	if (reached && !seen_fallthrough) {
515 		if (hflag)
516 			/* fallthrough on case statement */
517 			warning(220);
518 	}
519 
520 	t = tn->tn_type->t_tspec;
521 	if (t == LONG || t == ULONG ||
522 	    t == QUAD || t == UQUAD) {
523 		if (tflag)
524 			/* case label must be of type 'int' in traditional C */
525 			warning(203);
526 	}
527 
528 	/*
529 	 * get the value of the expression and convert it
530 	 * to the type of the switch expression
531 	 */
532 	v = constant(tn, true);
533 	(void)memset(&nv, 0, sizeof(nv));
534 	convert_constant(CASE, 0, cs->c_switch_type, &nv, v);
535 	free(v);
536 
537 	/* look if we had this value already */
538 	for (cl = cs->c_case_labels; cl != NULL; cl = cl->cl_next) {
539 		if (cl->cl_val.v_quad == nv.v_quad)
540 			break;
541 	}
542 	if (cl != NULL && is_uinteger(nv.v_tspec)) {
543 		/* duplicate case in switch: %lu */
544 		error(200, (unsigned long)nv.v_quad);
545 	} else if (cl != NULL) {
546 		/* duplicate case in switch: %ld */
547 		error(199, (long)nv.v_quad);
548 	} else {
549 		check_getopt_case_label(nv.v_quad);
550 
551 		/* append the value to the list of case values */
552 		cl = xcalloc(1, sizeof(*cl));
553 		cl->cl_val = nv;
554 		cl->cl_next = cs->c_case_labels;
555 		cs->c_case_labels = cl;
556 	}
557 }
558 
559 void
560 case_label(tnode_t *tn)
561 {
562 	control_statement *cs;
563 
564 	/* find the innermost switch statement */
565 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
566 		continue;
567 
568 	check_case_label(tn, cs);
569 
570 	expr_free_all();
571 
572 	set_reached(true);
573 }
574 
575 void
576 default_label(void)
577 {
578 	control_statement *cs;
579 
580 	/* find the innermost switch statement */
581 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
582 		continue;
583 
584 	if (cs == NULL) {
585 		/* default outside switch */
586 		error(201);
587 	} else if (cs->c_default) {
588 		/* duplicate default in switch */
589 		error(202);
590 	} else {
591 		if (reached && !seen_fallthrough) {
592 			if (hflag)
593 				/* fallthrough on default statement */
594 				warning(284);
595 		}
596 		cs->c_default = true;
597 	}
598 
599 	set_reached(true);
600 }
601 
602 static tnode_t *
603 check_controlling_expression(tnode_t *tn)
604 {
605 
606 	tn = cconv(tn);
607 	if (tn != NULL)
608 		tn = promote(NOOP, false, tn);
609 
610 	if (tn != NULL && !is_scalar(tn->tn_type->t_tspec)) {
611 		/* C99 6.5.15p4 for the ?: operator; see typeok:QUEST */
612 		/* C99 6.8.4.1p1 for if statements */
613 		/* C99 6.8.5p2 for while, do and for loops */
614 		/* controlling expressions must have scalar type */
615 		error(204);
616 		return NULL;
617 	}
618 
619 	if (tn != NULL && Tflag && !is_typeok_bool_operand(tn)) {
620 		/* controlling expression must be bool, not '%s' */
621 		error(333, tspec_name(tn->tn_type->t_tspec));
622 	}
623 
624 	return tn;
625 }
626 
627 /*
628  * T_IF T_LPAREN expr T_RPAREN
629  */
630 void
631 if1(tnode_t *tn)
632 {
633 
634 	if (tn != NULL)
635 		tn = check_controlling_expression(tn);
636 	if (tn != NULL)
637 		expr(tn, false, true, false, false);
638 	begin_control_statement(CS_IF);
639 
640 	if (tn != NULL && tn->tn_op == CON && !tn->tn_system_dependent) {
641 		/* XXX: what if inside 'if (0)'? */
642 		set_reached(constant_is_nonzero(tn));
643 		/* XXX: what about always_else? */
644 		cstmt->c_always_then = reached;
645 	}
646 }
647 
648 /*
649  * if_without_else
650  * if_without_else T_ELSE
651  */
652 void
653 if2(void)
654 {
655 
656 	cstmt->c_reached_end_of_then = reached;
657 	/* XXX: what if inside 'if (0)'? */
658 	set_reached(!cstmt->c_always_then);
659 }
660 
661 /*
662  * if_without_else
663  * if_without_else T_ELSE statement
664  */
665 void
666 if3(bool els)
667 {
668 	if (cstmt->c_reached_end_of_then)
669 		set_reached(true);
670 	else if (cstmt->c_always_then)
671 		set_reached(false);
672 	else if (!els)
673 		set_reached(true);
674 
675 	end_control_statement(CS_IF);
676 }
677 
678 /*
679  * T_SWITCH T_LPAREN expr T_RPAREN
680  */
681 void
682 switch1(tnode_t *tn)
683 {
684 	tspec_t	t;
685 	type_t	*tp;
686 
687 	if (tn != NULL)
688 		tn = cconv(tn);
689 	if (tn != NULL)
690 		tn = promote(NOOP, false, tn);
691 	if (tn != NULL && !is_integer(tn->tn_type->t_tspec)) {
692 		/* switch expression must have integral type */
693 		error(205);
694 		tn = NULL;
695 	}
696 	if (tn != NULL && tflag) {
697 		t = tn->tn_type->t_tspec;
698 		if (t == LONG || t == ULONG || t == QUAD || t == UQUAD) {
699 			/* switch expression must be of type 'int' in ... */
700 			warning(271);
701 		}
702 	}
703 
704 	/*
705 	 * Remember the type of the expression. Because it's possible
706 	 * that (*tp) is allocated on tree memory, the type must be
707 	 * duplicated. This is not too complicated because it is
708 	 * only an integer type.
709 	 */
710 	tp = xcalloc(1, sizeof(*tp));
711 	if (tn != NULL) {
712 		tp->t_tspec = tn->tn_type->t_tspec;
713 		if ((tp->t_is_enum = tn->tn_type->t_is_enum) != false)
714 			tp->t_enum = tn->tn_type->t_enum;
715 	} else {
716 		tp->t_tspec = INT;
717 	}
718 
719 	/* leak the memory, for check_case_label_bitand */
720 	(void)expr_save_memory();
721 
722 	check_getopt_begin_switch();
723 	expr(tn, true, false, false, false);
724 
725 	begin_control_statement(CS_SWITCH);
726 	cstmt->c_switch = true;
727 	cstmt->c_switch_type = tp;
728 	cstmt->c_switch_expr = tn;
729 
730 	set_reached(false);
731 	seen_fallthrough = true;
732 }
733 
734 /*
735  * switch_expr statement
736  */
737 void
738 switch2(void)
739 {
740 	int	nenum = 0, nclab = 0;
741 	sym_t	*esym;
742 	case_label_t *cl;
743 
744 	lint_assert(cstmt->c_switch_type != NULL);
745 
746 	if (cstmt->c_switch_type->t_is_enum) {
747 		/*
748 		 * Warn if the number of case labels is different from the
749 		 * number of enumerators.
750 		 */
751 		nenum = nclab = 0;
752 		lint_assert(cstmt->c_switch_type->t_enum != NULL);
753 		for (esym = cstmt->c_switch_type->t_enum->en_first_enumerator;
754 		     esym != NULL; esym = esym->s_next) {
755 			nenum++;
756 		}
757 		for (cl = cstmt->c_case_labels; cl != NULL; cl = cl->cl_next)
758 			nclab++;
759 		if (hflag && eflag && nenum != nclab && !cstmt->c_default) {
760 			/* enumeration value(s) not handled in switch */
761 			warning(206);
762 		}
763 	}
764 
765 	check_getopt_end_switch();
766 
767 	if (cstmt->c_break) {
768 		/*
769 		 * The end of the switch statement is always reached since
770 		 * c_break is only set if a break statement can actually
771 		 * be reached.
772 		 */
773 		set_reached(true);
774 	} else if (cstmt->c_default ||
775 		   (hflag && cstmt->c_switch_type->t_is_enum &&
776 		    nenum == nclab)) {
777 		/*
778 		 * The end of the switch statement is reached if the end
779 		 * of the last statement inside it is reached.
780 		 */
781 	} else {
782 		/*
783 		 * There are possible values that are not handled in the
784 		 * switch statement.
785 		 */
786 		set_reached(true);
787 	}
788 
789 	end_control_statement(CS_SWITCH);
790 }
791 
792 /*
793  * T_WHILE T_LPAREN expr T_RPAREN
794  */
795 void
796 while1(tnode_t *tn)
797 {
798 	bool body_reached;
799 
800 	if (!reached) {
801 		/* loop not entered at top */
802 		warning(207);
803 		/* FIXME: that's plain wrong. */
804 		set_reached(true);
805 	}
806 
807 	if (tn != NULL)
808 		tn = check_controlling_expression(tn);
809 
810 	begin_control_statement(CS_WHILE);
811 	cstmt->c_loop = true;
812 	cstmt->c_maybe_endless = is_nonzero(tn);
813 	body_reached = !is_zero(tn);
814 
815 	check_getopt_begin_while(tn);
816 	expr(tn, false, true, true, false);
817 
818 	set_reached(body_reached);
819 }
820 
821 /*
822  * while_expr statement
823  * while_expr error
824  */
825 void
826 while2(void)
827 {
828 
829 	/*
830 	 * The end of the loop can be reached if it is no endless loop
831 	 * or there was a break statement which was reached.
832 	 */
833 	set_reached(!cstmt->c_maybe_endless || cstmt->c_break);
834 
835 	check_getopt_end_while();
836 	end_control_statement(CS_WHILE);
837 }
838 
839 /*
840  * T_DO
841  */
842 void
843 do1(void)
844 {
845 
846 	if (!reached) {
847 		/* loop not entered at top */
848 		warning(207);
849 		set_reached(true);
850 	}
851 
852 	begin_control_statement(CS_DO_WHILE);
853 	cstmt->c_loop = true;
854 }
855 
856 /*
857  * do statement do_while_expr
858  * do error
859  */
860 void
861 do2(tnode_t *tn)
862 {
863 
864 	/*
865 	 * If there was a continue statement, the expression controlling the
866 	 * loop is reached.
867 	 */
868 	if (cstmt->c_continue)
869 		set_reached(true);
870 
871 	if (tn != NULL)
872 		tn = check_controlling_expression(tn);
873 
874 	if (tn != NULL && tn->tn_op == CON) {
875 		cstmt->c_maybe_endless = constant_is_nonzero(tn);
876 		if (!cstmt->c_maybe_endless && cstmt->c_continue)
877 			/* continue in 'do ... while (0)' loop */
878 			error(323);
879 	}
880 
881 	expr(tn, false, true, true, true);
882 
883 	if (cstmt->c_maybe_endless)
884 		set_reached(false);
885 	if (cstmt->c_break)
886 		set_reached(true);
887 
888 	end_control_statement(CS_DO_WHILE);
889 }
890 
891 /*
892  * T_FOR T_LPAREN opt_expr T_SEMI opt_expr T_SEMI opt_expr T_RPAREN
893  */
894 void
895 for1(tnode_t *tn1, tnode_t *tn2, tnode_t *tn3)
896 {
897 
898 	/*
899 	 * If there is no initialization expression it is possible that
900 	 * it is intended not to enter the loop at top.
901 	 */
902 	if (tn1 != NULL && !reached) {
903 		/* loop not entered at top */
904 		warning(207);
905 		set_reached(true);
906 	}
907 
908 	begin_control_statement(CS_FOR);
909 	cstmt->c_loop = true;
910 
911 	/*
912 	 * Store the tree memory for the reinitialization expression.
913 	 * Also remember this expression itself. We must check it at
914 	 * the end of the loop to get "used but not set" warnings correct.
915 	 */
916 	cstmt->c_for_expr3_mem = expr_save_memory();
917 	cstmt->c_for_expr3 = tn3;
918 	cstmt->c_for_expr3_pos = curr_pos;
919 	cstmt->c_for_expr3_csrc_pos = csrc_pos;
920 
921 	if (tn1 != NULL)
922 		expr(tn1, false, false, true, false);
923 
924 	if (tn2 != NULL)
925 		tn2 = check_controlling_expression(tn2);
926 	if (tn2 != NULL)
927 		expr(tn2, false, true, true, false);
928 
929 	cstmt->c_maybe_endless = tn2 == NULL || is_nonzero(tn2);
930 
931 	/* Checking the reinitialization expression is done in for2() */
932 
933 	set_reached(!is_zero(tn2));
934 }
935 
936 /*
937  * for_exprs statement
938  * for_exprs error
939  */
940 void
941 for2(void)
942 {
943 	pos_t	cpos, cspos;
944 	tnode_t	*tn3;
945 
946 	if (cstmt->c_continue)
947 		set_reached(true);
948 
949 	cpos = curr_pos;
950 	cspos = csrc_pos;
951 
952 	/* Restore the tree memory for the reinitialization expression */
953 	expr_restore_memory(cstmt->c_for_expr3_mem);
954 	tn3 = cstmt->c_for_expr3;
955 	curr_pos = cstmt->c_for_expr3_pos;
956 	csrc_pos = cstmt->c_for_expr3_csrc_pos;
957 
958 	/* simply "statement not reached" would be confusing */
959 	if (!reached && warn_about_unreachable) {
960 		/* end-of-loop code not reached */
961 		warning(223);
962 		set_reached(true);
963 	}
964 
965 	if (tn3 != NULL) {
966 		expr(tn3, false, false, true, false);
967 	} else {
968 		expr_free_all();
969 	}
970 
971 	curr_pos = cpos;
972 	csrc_pos = cspos;
973 
974 	/* An endless loop without break will never terminate */
975 	/* TODO: What if the loop contains a 'return'? */
976 	set_reached(cstmt->c_break || !cstmt->c_maybe_endless);
977 
978 	end_control_statement(CS_FOR);
979 }
980 
981 /*
982  * T_GOTO identifier T_SEMI
983  */
984 void
985 do_goto(sym_t *lab)
986 {
987 
988 	mark_as_used(lab, false, false);
989 
990 	check_statement_reachable();
991 
992 	set_reached(false);
993 }
994 
995 /*
996  * T_BREAK T_SEMI
997  */
998 void
999 do_break(void)
1000 {
1001 	control_statement *cs;
1002 
1003 	cs = cstmt;
1004 	while (cs != NULL && !cs->c_loop && !cs->c_switch)
1005 		cs = cs->c_surrounding;
1006 
1007 	if (cs == NULL) {
1008 		/* break outside loop or switch */
1009 		error(208);
1010 	} else {
1011 		if (reached)
1012 			cs->c_break = true;
1013 	}
1014 
1015 	if (bflag)
1016 		check_statement_reachable();
1017 
1018 	set_reached(false);
1019 }
1020 
1021 /*
1022  * T_CONTINUE T_SEMI
1023  */
1024 void
1025 do_continue(void)
1026 {
1027 	control_statement *cs;
1028 
1029 	for (cs = cstmt; cs != NULL && !cs->c_loop; cs = cs->c_surrounding)
1030 		continue;
1031 
1032 	if (cs == NULL) {
1033 		/* continue outside loop */
1034 		error(209);
1035 	} else {
1036 		/* TODO: only if reachable, for symmetry with c_break */
1037 		cs->c_continue = true;
1038 	}
1039 
1040 	check_statement_reachable();
1041 
1042 	set_reached(false);
1043 }
1044 
1045 /*
1046  * T_RETURN T_SEMI
1047  * T_RETURN expr T_SEMI
1048  */
1049 void
1050 do_return(bool sys, tnode_t *tn)
1051 {
1052 	tnode_t	*ln, *rn;
1053 	control_statement *cs;
1054 	op_t	op;
1055 
1056 	cs = cstmt;
1057 	if (cs == NULL) {
1058 		/* syntax error '%s' */
1059 		error(249, "return outside function");
1060 		return;
1061 	}
1062 
1063 	for (; cs->c_surrounding != NULL; cs = cs->c_surrounding)
1064 		continue;
1065 
1066 	if (tn != NULL)
1067 		cs->c_had_return_value = true;
1068 	else
1069 		cs->c_had_return_noval = true;
1070 
1071 	if (tn != NULL && funcsym->s_type->t_subt->t_tspec == VOID) {
1072 		/* void function %s cannot return value */
1073 		error(213, funcsym->s_name);
1074 		expr_free_all();
1075 		tn = NULL;
1076 	} else if (tn == NULL && funcsym->s_type->t_subt->t_tspec != VOID) {
1077 		/*
1078 		 * Assume that the function has a return value only if it
1079 		 * is explicitly declared.
1080 		 */
1081 		if (!funcsym->s_return_type_implicit_int)
1082 			/* function '%s' expects to return value */
1083 			warning(214, funcsym->s_name);
1084 	}
1085 
1086 	if (tn != NULL) {
1087 
1088 		/* Create a temporary node for the left side */
1089 		ln = expr_zalloc(sizeof(*ln));
1090 		ln->tn_op = NAME;
1091 		ln->tn_type = expr_unqualified_type(funcsym->s_type->t_subt);
1092 		ln->tn_lvalue = true;
1093 		ln->tn_sym = funcsym;		/* better than nothing */
1094 
1095 		tn = build_binary(ln, RETURN, sys, tn);
1096 
1097 		if (tn != NULL) {
1098 			rn = tn->tn_right;
1099 			while ((op = rn->tn_op) == CVT || op == PLUS)
1100 				rn = rn->tn_left;
1101 			if (rn->tn_op == ADDR && rn->tn_left->tn_op == NAME &&
1102 			    rn->tn_left->tn_sym->s_scl == AUTO) {
1103 				/* %s returns pointer to automatic object */
1104 				warning(302, funcsym->s_name);
1105 			}
1106 		}
1107 
1108 		expr(tn, true, false, true, false);
1109 
1110 	} else {
1111 
1112 		check_statement_reachable();
1113 
1114 	}
1115 
1116 	set_reached(false);
1117 }
1118 
1119 /*
1120  * Do some cleanup after a global declaration or definition.
1121  * Especially remove information about unused lint comments.
1122  */
1123 void
1124 global_clean_up_decl(bool silent)
1125 {
1126 
1127 	if (nargusg != -1) {
1128 		if (!silent) {
1129 			/* must precede function definition: ** %s ** */
1130 			warning_at(282, &argsused_pos, "ARGSUSED");
1131 		}
1132 		nargusg = -1;
1133 	}
1134 	if (nvararg != -1) {
1135 		if (!silent) {
1136 			/* must precede function definition: ** %s ** */
1137 			warning_at(282, &vapos, "VARARGS");
1138 		}
1139 		nvararg = -1;
1140 	}
1141 	if (printflike_argnum != -1) {
1142 		if (!silent) {
1143 			/* must precede function definition: ** %s ** */
1144 			warning_at(282, &printflike_pos, "PRINTFLIKE");
1145 		}
1146 		printflike_argnum = -1;
1147 	}
1148 	if (scanflike_argnum != -1) {
1149 		if (!silent) {
1150 			/* must precede function definition: ** %s ** */
1151 			warning_at(282, &scanflike_pos, "SCANFLIKE");
1152 		}
1153 		scanflike_argnum = -1;
1154 	}
1155 
1156 	dcs->d_asm = false;
1157 
1158 	/*
1159 	 * Needed for BSD yacc in case of parse errors; GNU Bison 3.0.4 is
1160 	 * fine.  See test gcc_attribute.c, function_with_unknown_attribute.
1161 	 */
1162 	in_gcc_attribute = false;
1163 }
1164 
1165 /*
1166  * ARGSUSED comment
1167  *
1168  * Only the first n arguments of the following function are checked
1169  * for usage. A missing argument is taken to be 0.
1170  */
1171 void
1172 argsused(int n)
1173 {
1174 
1175 	if (n == -1)
1176 		n = 0;
1177 
1178 	if (dcs->d_ctx != EXTERN) {
1179 		/* must be outside function: ** %s ** */
1180 		warning(280, "ARGSUSED");
1181 		return;
1182 	}
1183 	if (nargusg != -1) {
1184 		/* duplicate use of ** %s ** */
1185 		warning(281, "ARGSUSED");
1186 	}
1187 	nargusg = n;
1188 	argsused_pos = curr_pos;
1189 }
1190 
1191 /*
1192  * VARARGS comment
1193  *
1194  * Causes lint2 to check only the first n arguments for compatibility
1195  * with the function definition. A missing argument is taken to be 0.
1196  */
1197 void
1198 varargs(int n)
1199 {
1200 
1201 	if (n == -1)
1202 		n = 0;
1203 
1204 	if (dcs->d_ctx != EXTERN) {
1205 		/* must be outside function: ** %s ** */
1206 		warning(280, "VARARGS");
1207 		return;
1208 	}
1209 	if (nvararg != -1) {
1210 		/* duplicate use of ** %s ** */
1211 		warning(281, "VARARGS");
1212 	}
1213 	nvararg = n;
1214 	vapos = curr_pos;
1215 }
1216 
1217 /*
1218  * PRINTFLIKE comment
1219  *
1220  * Check all arguments until the (n-1)-th as usual. The n-th argument is
1221  * used the check the types of remaining arguments.
1222  */
1223 void
1224 printflike(int n)
1225 {
1226 
1227 	if (n == -1)
1228 		n = 0;
1229 
1230 	if (dcs->d_ctx != EXTERN) {
1231 		/* must be outside function: ** %s ** */
1232 		warning(280, "PRINTFLIKE");
1233 		return;
1234 	}
1235 	if (printflike_argnum != -1) {
1236 		/* duplicate use of ** %s ** */
1237 		warning(281, "PRINTFLIKE");
1238 	}
1239 	printflike_argnum = n;
1240 	printflike_pos = curr_pos;
1241 }
1242 
1243 /*
1244  * SCANFLIKE comment
1245  *
1246  * Check all arguments until the (n-1)-th as usual. The n-th argument is
1247  * used the check the types of remaining arguments.
1248  */
1249 void
1250 scanflike(int n)
1251 {
1252 
1253 	if (n == -1)
1254 		n = 0;
1255 
1256 	if (dcs->d_ctx != EXTERN) {
1257 		/* must be outside function: ** %s ** */
1258 		warning(280, "SCANFLIKE");
1259 		return;
1260 	}
1261 	if (scanflike_argnum != -1) {
1262 		/* duplicate use of ** %s ** */
1263 		warning(281, "SCANFLIKE");
1264 	}
1265 	scanflike_argnum = n;
1266 	scanflike_pos = curr_pos;
1267 }
1268 
1269 /*
1270  * Set the line number for a CONSTCOND comment. At this and the following
1271  * line no warnings about constants in conditional contexts are printed.
1272  */
1273 /* ARGSUSED */
1274 void
1275 constcond(int n)
1276 {
1277 
1278 	constcond_flag = true;
1279 }
1280 
1281 /*
1282  * Suppress printing of "fallthrough on ..." warnings until next
1283  * statement.
1284  */
1285 /* ARGSUSED */
1286 void
1287 fallthru(int n)
1288 {
1289 
1290 	seen_fallthrough = true;
1291 }
1292 
1293 /*
1294  * Stop warnings about statements which cannot be reached. Also tells lint
1295  * that the following statements cannot be reached (e.g. after exit()).
1296  */
1297 /* ARGSUSED */
1298 void
1299 not_reached(int n)
1300 {
1301 
1302 	set_reached(false);
1303 	warn_about_unreachable = false;
1304 }
1305 
1306 /* ARGSUSED */
1307 void
1308 lintlib(int n)
1309 {
1310 
1311 	if (dcs->d_ctx != EXTERN) {
1312 		/* must be outside function: ** %s ** */
1313 		warning(280, "LINTLIBRARY");
1314 		return;
1315 	}
1316 	llibflg = true;
1317 	vflag = false;
1318 }
1319 
1320 /*
1321  * Suppress most warnings at the current and the following line.
1322  */
1323 /* ARGSUSED */
1324 void
1325 linted(int n)
1326 {
1327 
1328 	debug_step("set lwarn %d", n);
1329 	lwarn = n;
1330 }
1331 
1332 /*
1333  * Suppress bitfield type errors on the current line.
1334  */
1335 /* ARGSUSED */
1336 void
1337 bitfieldtype(int n)
1338 {
1339 
1340 	debug_step("%s, %d: bitfieldtype_ok = true",
1341 	    curr_pos.p_file, curr_pos.p_line);
1342 	bitfieldtype_ok = true;
1343 }
1344 
1345 /*
1346  * PROTOLIB in conjunction with LINTLIBRARY can be used to handle
1347  * prototypes like function definitions. This is done if the argument
1348  * to PROTOLIB is nonzero. Otherwise prototypes are handled normally.
1349  */
1350 void
1351 protolib(int n)
1352 {
1353 
1354 	if (dcs->d_ctx != EXTERN) {
1355 		/* must be outside function: ** %s ** */
1356 		warning(280, "PROTOLIB");
1357 		return;
1358 	}
1359 	plibflg = n != 0;
1360 }
1361 
1362 /* The next statement/declaration may use "long long" without a diagnostic. */
1363 /* ARGSUSED */
1364 void
1365 longlong(int n)
1366 {
1367 
1368 	quadflg = true;
1369 }
1370