xref: /netbsd-src/usr.bin/xlint/lint1/func.c (revision 627f7eb200a4419d89b531d55fccd2ee3ffdcde0)
1 /*	$NetBSD: func.c,v 1.102 2021/04/02 15:06:35 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: func.c,v 1.102 2021/04/02 15:06:35 rillig Exp $");
41 #endif
42 
43 #include <stdlib.h>
44 #include <string.h>
45 
46 #include "lint1.h"
47 #include "cgram.h"
48 
49 /*
50  * Contains a pointer to the symbol table entry of the current function
51  * definition.
52  */
53 sym_t	*funcsym;
54 
55 /* Is set as long as a statement can be reached. Must be set at level 0. */
56 bool	reached = true;
57 
58 /*
59  * Is true by default, can be cleared by NOTREACHED.
60  * Is reset to true whenever 'reached' changes.
61  */
62 bool	warn_about_unreachable;
63 
64 /*
65  * In conjunction with 'reached', controls printing of "fallthrough on ..."
66  * warnings.
67  * Reset by each statement and set by FALLTHROUGH, switch (switch1())
68  * and case (label()).
69  *
70  * Control statements if, for, while and switch do not reset seen_fallthrough
71  * because this must be done by the controlled statement. At least for if this
72  * is important because ** FALLTHROUGH ** after "if (expr) statement" is
73  * evaluated before the following token, which causes reduction of above.
74  * This means that ** FALLTHROUGH ** after "if ..." would always be ignored.
75  */
76 bool	seen_fallthrough;
77 
78 /* The innermost control statement */
79 cstk_t	*cstmt;
80 
81 /*
82  * Number of arguments which will be checked for usage in following
83  * function definition. -1 stands for all arguments.
84  *
85  * The position of the last ARGSUSED comment is stored in argsused_pos.
86  */
87 int	nargusg = -1;
88 pos_t	argsused_pos;
89 
90 /*
91  * Number of arguments of the following function definition whose types
92  * shall be checked by lint2. -1 stands for all arguments.
93  *
94  * The position of the last VARARGS comment is stored in vapos.
95  */
96 int	nvararg = -1;
97 pos_t	vapos;
98 
99 /*
100  * Both printflike_argnum and scanflike_argnum contain the 1-based number
101  * of the string argument which shall be used to check the types of remaining
102  * arguments (for PRINTFLIKE and SCANFLIKE).
103  *
104  * printflike_pos and scanflike_pos are the positions of the last PRINTFLIKE
105  * or SCANFLIKE comment.
106  */
107 int	printflike_argnum = -1;
108 int	scanflike_argnum = -1;
109 pos_t	printflike_pos;
110 pos_t	scanflike_pos;
111 
112 /*
113  * If both plibflg and llibflg are set, prototypes are written as function
114  * definitions to the output file.
115  */
116 bool	plibflg;
117 
118 /*
119  * True means that no warnings about constants in conditional
120  * context are printed.
121  */
122 bool	constcond_flag;
123 
124 /*
125  * llibflg is set if a lint library shall be created. The effect of
126  * llibflg is that all defined symbols are treated as used.
127  * (The LINTLIBRARY comment also resets vflag.)
128  */
129 bool	llibflg;
130 
131 /*
132  * Nonzero if warnings are suppressed by a LINTED directive
133  * LWARN_BAD:	error
134  * LWARN_ALL:	warnings on
135  * LWARN_NONE:	all warnings ignored
136  * 0..n: warning n ignored
137  */
138 int	lwarn = LWARN_ALL;
139 
140 /*
141  * Whether bitfield type errors are suppressed by a BITFIELDTYPE
142  * directive.
143  */
144 bool	bitfieldtype_ok;
145 
146 /*
147  * Whether complaints about use of "long long" are suppressed in
148  * the next statement or declaration.
149  */
150 bool	quadflg;
151 
152 /*
153  * Puts a new element at the top of the stack used for control statements.
154  */
155 void
156 begin_control_statement(control_statement_kind kind)
157 {
158 	cstk_t	*ci;
159 
160 	ci = xcalloc(1, sizeof(*ci));
161 	ci->c_kind = kind;
162 	ci->c_surrounding = cstmt;
163 	cstmt = ci;
164 }
165 
166 /*
167  * Removes the top element of the stack used for control statements.
168  */
169 void
170 end_control_statement(control_statement_kind kind)
171 {
172 	cstk_t	*ci;
173 	case_label_t *cl, *next;
174 
175 	lint_assert(cstmt != NULL);
176 	lint_assert(cstmt->c_kind == kind);
177 
178 	ci = cstmt;
179 	cstmt = ci->c_surrounding;
180 
181 	for (cl = ci->c_case_labels; cl != NULL; cl = next) {
182 		next = cl->cl_next;
183 		free(cl);
184 	}
185 
186 	free(ci->c_switch_type);
187 	free(ci);
188 }
189 
190 static void
191 set_reached(bool new_reached)
192 {
193 	reached = new_reached;
194 	warn_about_unreachable = true;
195 }
196 
197 /*
198  * Prints a warning if a statement cannot be reached.
199  */
200 void
201 check_statement_reachable(void)
202 {
203 	if (!reached && warn_about_unreachable) {
204 		/* statement not reached */
205 		warning(193);
206 		warn_about_unreachable = false;
207 	}
208 }
209 
210 /*
211  * Called after a function declaration which introduces a function definition
212  * and before an (optional) old style argument declaration list.
213  *
214  * Puts all symbols declared in the prototype or in an old style argument
215  * list back to the symbol table.
216  *
217  * Does the usual checking of storage class, type (return value),
218  * redeclaration, etc.
219  */
220 void
221 funcdef(sym_t *fsym)
222 {
223 	int	n;
224 	bool	dowarn;
225 	sym_t	*arg, *sym, *rdsym;
226 
227 	funcsym = fsym;
228 
229 	/*
230 	 * Put all symbols declared in the argument list back to the
231 	 * symbol table.
232 	 */
233 	for (sym = dcs->d_func_proto_syms; sym != NULL; sym = sym->s_dlnxt) {
234 		if (sym->s_block_level != -1) {
235 			lint_assert(sym->s_block_level == 1);
236 			inssym(1, sym);
237 		}
238 	}
239 
240 	/*
241 	 * In old_style_function() we did not know whether it is an old
242 	 * style function definition or only an old style declaration,
243 	 * if there are no arguments inside the argument list ("f()").
244 	 */
245 	if (!fsym->s_type->t_proto && fsym->s_args == NULL)
246 		fsym->s_osdef = true;
247 
248 	check_type(fsym);
249 
250 	/*
251 	 * check_type() checks for almost all possible errors, but not for
252 	 * incomplete return values (these are allowed in declarations)
253 	 */
254 	if (fsym->s_type->t_subt->t_tspec != VOID &&
255 	    is_incomplete(fsym->s_type->t_subt)) {
256 		/* cannot return incomplete type */
257 		error(67);
258 	}
259 
260 	fsym->s_def = DEF;
261 
262 	if (fsym->s_scl == TYPEDEF) {
263 		fsym->s_scl = EXTERN;
264 		/* illegal storage class */
265 		error(8);
266 	}
267 
268 	if (dcs->d_inline)
269 		fsym->s_inline = true;
270 
271 	/*
272 	 * Arguments in new style function declarations need a name.
273 	 * (void is already removed from the list of arguments)
274 	 */
275 	n = 1;
276 	for (arg = fsym->s_type->t_args; arg != NULL; arg = arg->s_next) {
277 		if (arg->s_scl == ABSTRACT) {
278 			lint_assert(arg->s_name == unnamed);
279 			/* formal parameter lacks name: param #%d */
280 			error(59, n);
281 		} else {
282 			lint_assert(arg->s_name != unnamed);
283 		}
284 		n++;
285 	}
286 
287 	/*
288 	 * We must also remember the position. s_def_pos is overwritten
289 	 * if this is an old style definition and we had already a
290 	 * prototype.
291 	 */
292 	dcs->d_func_def_pos = fsym->s_def_pos;
293 
294 	if ((rdsym = dcs->d_redeclared_symbol) != NULL) {
295 
296 		if (!check_redeclaration(fsym, (dowarn = false, &dowarn))) {
297 
298 			/*
299 			 * Print nothing if the newly defined function
300 			 * is defined in old style. A better warning will
301 			 * be printed in check_func_lint_directives().
302 			 */
303 			if (dowarn && !fsym->s_osdef) {
304 				if (sflag)
305 					/* redeclaration of %s */
306 					error(27, fsym->s_name);
307 				else
308 					/* redeclaration of %s */
309 					warning(27, fsym->s_name);
310 				print_previous_declaration(-1, rdsym);
311 			}
312 
313 			copy_usage_info(fsym, rdsym);
314 
315 			/*
316 			 * If the old symbol was a prototype and the new
317 			 * one is none, overtake the position of the
318 			 * declaration of the prototype.
319 			 */
320 			if (fsym->s_osdef && rdsym->s_type->t_proto)
321 				fsym->s_def_pos = rdsym->s_def_pos;
322 
323 			complete_type(fsym, rdsym);
324 
325 			if (rdsym->s_inline)
326 				fsym->s_inline = true;
327 
328 		}
329 
330 		/* remove the old symbol from the symbol table */
331 		rmsym(rdsym);
332 
333 	}
334 
335 	if (fsym->s_osdef && !fsym->s_type->t_proto) {
336 		if (sflag && hflag && strcmp(fsym->s_name, "main") != 0)
337 			/* function definition is not a prototype */
338 			warning(286);
339 	}
340 
341 	if (dcs->d_notyp)
342 		fsym->s_return_type_implicit_int = true;
343 
344 	set_reached(true);
345 }
346 
347 static void
348 check_missing_return_value(void)
349 {
350 	if (funcsym->s_type->t_subt->t_tspec == VOID)
351 		return;
352 	if (funcsym->s_return_type_implicit_int)
353 		return;
354 
355 	/* C99 5.1.2.2.3 "Program termination" p1 */
356 	if (Sflag && strcmp(funcsym->s_name, "main") == 0)
357 		return;
358 
359 	/* function %s falls off bottom without returning value */
360 	warning(217, funcsym->s_name);
361 }
362 
363 /*
364  * Called at the end of a function definition.
365  */
366 void
367 funcend(void)
368 {
369 	sym_t	*arg;
370 	int	n;
371 
372 	if (reached) {
373 		cstmt->c_had_return_noval = true;
374 		check_missing_return_value();
375 	}
376 
377 	/*
378 	 * This warning is printed only if the return value was implicitly
379 	 * declared to be int. Otherwise the wrong return statement
380 	 * has already printed a warning.
381 	 */
382 	if (cstmt->c_had_return_noval && cstmt->c_had_return_value &&
383 	    funcsym->s_return_type_implicit_int)
384 		/* function %s has return (e); and return; */
385 		warning(216, funcsym->s_name);
386 
387 	/* Print warnings for unused arguments */
388 	arg = dcs->d_func_args;
389 	n = 0;
390 	while (arg != NULL && (nargusg == -1 || n < nargusg)) {
391 		check_usage_sym(dcs->d_asm, arg);
392 		arg = arg->s_next;
393 		n++;
394 	}
395 	nargusg = -1;
396 
397 	/*
398 	 * write the information about the function definition to the
399 	 * output file
400 	 * inline functions explicitly declared extern are written as
401 	 * declarations only.
402 	 */
403 	if (dcs->d_scl == EXTERN && funcsym->s_inline) {
404 		outsym(funcsym, funcsym->s_scl, DECL);
405 	} else {
406 		outfdef(funcsym, &dcs->d_func_def_pos,
407 		    cstmt->c_had_return_value, funcsym->s_osdef,
408 		    dcs->d_func_args);
409 	}
410 
411 	/*
412 	 * remove all symbols declared during argument declaration from
413 	 * the symbol table
414 	 */
415 	lint_assert(dcs->d_next == NULL);
416 	lint_assert(dcs->d_ctx == EXTERN);
417 	rmsyms(dcs->d_func_proto_syms);
418 
419 	/* must be set on level 0 */
420 	set_reached(true);
421 }
422 
423 void
424 named_label(sym_t *sym)
425 {
426 
427 	if (sym->s_set) {
428 		/* label %s redefined */
429 		error(194, sym->s_name);
430 	} else {
431 		mark_as_set(sym);
432 	}
433 
434 	set_reached(true);
435 }
436 
437 static void
438 check_case_label_enum(const tnode_t *tn, const cstk_t *ci)
439 {
440 	/* similar to typeok_enum in tree.c */
441 
442 	if (!(tn->tn_type->t_is_enum || ci->c_switch_type->t_is_enum))
443 		return;
444 	if (tn->tn_type->t_is_enum && ci->c_switch_type->t_is_enum &&
445 	    tn->tn_type->t_enum == ci->c_switch_type->t_enum)
446 		return;
447 
448 #if 0 /* not yet ready, see msg_130.c */
449 	/* enum type mismatch: '%s' '%s' '%s' */
450 	warning(130, type_name(ci->c_switch_type), op_name(EQ),
451 	    type_name(tn->tn_type));
452 #endif
453 }
454 
455 static void
456 check_case_label(tnode_t *tn, cstk_t *ci)
457 {
458 	case_label_t *cl;
459 	val_t	*v;
460 	val_t	nv;
461 	tspec_t	t;
462 
463 	if (ci == NULL) {
464 		/* case not in switch */
465 		error(195);
466 		return;
467 	}
468 
469 	if (tn != NULL && tn->tn_op != CON) {
470 		/* non-constant case expression */
471 		error(197);
472 		return;
473 	}
474 
475 	if (tn != NULL && !is_integer(tn->tn_type->t_tspec)) {
476 		/* non-integral case expression */
477 		error(198);
478 		return;
479 	}
480 
481 	check_case_label_enum(tn, ci);
482 
483 	lint_assert(ci->c_switch_type != NULL);
484 
485 	if (reached && !seen_fallthrough) {
486 		if (hflag)
487 			/* fallthrough on case statement */
488 			warning(220);
489 	}
490 
491 	t = tn->tn_type->t_tspec;
492 	if (t == LONG || t == ULONG ||
493 	    t == QUAD || t == UQUAD) {
494 		if (tflag)
495 			/* case label must be of type `int' in traditional C */
496 			warning(203);
497 	}
498 
499 	/*
500 	 * get the value of the expression and convert it
501 	 * to the type of the switch expression
502 	 */
503 	v = constant(tn, true);
504 	(void)memset(&nv, 0, sizeof(nv));
505 	convert_constant(CASE, 0, ci->c_switch_type, &nv, v);
506 	free(v);
507 
508 	/* look if we had this value already */
509 	for (cl = ci->c_case_labels; cl != NULL; cl = cl->cl_next) {
510 		if (cl->cl_val.v_quad == nv.v_quad)
511 			break;
512 	}
513 	if (cl != NULL && is_uinteger(nv.v_tspec)) {
514 		/* duplicate case in switch: %lu */
515 		error(200, (u_long)nv.v_quad);
516 	} else if (cl != NULL) {
517 		/* duplicate case in switch: %ld */
518 		error(199, (long)nv.v_quad);
519 	} else {
520 		check_getopt_case_label(nv.v_quad);
521 
522 		/*
523 		 * append the value to the list of
524 		 * case values
525 		 */
526 		cl = xcalloc(1, sizeof(*cl));
527 		cl->cl_val = nv;
528 		cl->cl_next = ci->c_case_labels;
529 		ci->c_case_labels = cl;
530 	}
531 }
532 
533 void
534 case_label(tnode_t *tn)
535 {
536 	cstk_t	*ci;
537 
538 	/* find the innermost switch statement */
539 	for (ci = cstmt; ci != NULL && !ci->c_switch; ci = ci->c_surrounding)
540 		continue;
541 
542 	check_case_label(tn, ci);
543 
544 	expr_free_all();
545 
546 	set_reached(true);
547 }
548 
549 void
550 default_label(void)
551 {
552 	cstk_t	*ci;
553 
554 	/* find the innermost switch statement */
555 	for (ci = cstmt; ci != NULL && !ci->c_switch; ci = ci->c_surrounding)
556 		continue;
557 
558 	if (ci == NULL) {
559 		/* default outside switch */
560 		error(201);
561 	} else if (ci->c_default) {
562 		/* duplicate default in switch */
563 		error(202);
564 	} else {
565 		if (reached && !seen_fallthrough) {
566 			if (hflag)
567 				/* fallthrough on default statement */
568 				warning(284);
569 		}
570 		ci->c_default = true;
571 	}
572 
573 	set_reached(true);
574 }
575 
576 static tnode_t *
577 check_controlling_expression(tnode_t *tn)
578 {
579 
580 	if (tn != NULL)
581 		tn = cconv(tn);
582 	if (tn != NULL)
583 		tn = promote(NOOP, false, tn);
584 
585 	if (tn != NULL && !is_scalar(tn->tn_type->t_tspec)) {
586 		/* C99 6.5.15p4 for the ?: operator; see typeok:QUEST */
587 		/* C99 6.8.4.1p1 for if statements */
588 		/* C99 6.8.5p2 for while, do and for loops */
589 		/* controlling expressions must have scalar type */
590 		error(204);
591 		return NULL;
592 	}
593 
594 	if (tn != NULL && Tflag && !is_typeok_bool_operand(tn)) {
595 		/* controlling expression must be bool, not '%s' */
596 		error(333, tspec_name(tn->tn_type->t_tspec));
597 		return NULL;
598 	}
599 
600 	return tn;
601 }
602 
603 /*
604  * T_IF T_LPAREN expr T_RPAREN
605  */
606 void
607 if1(tnode_t *tn)
608 {
609 
610 	if (tn != NULL)
611 		tn = check_controlling_expression(tn);
612 	if (tn != NULL)
613 		expr(tn, false, true, false, false);
614 	begin_control_statement(CS_IF);
615 
616 	if (tn != NULL && tn->tn_op == CON && !tn->tn_system_dependent) {
617 		/* XXX: what if inside 'if (0)'? */
618 		set_reached(constant_is_nonzero(tn));
619 		/* XXX: what about always_else? */
620 		cstmt->c_always_then = reached;
621 	}
622 }
623 
624 /*
625  * if_without_else
626  * if_without_else T_ELSE
627  */
628 void
629 if2(void)
630 {
631 
632 	cstmt->c_reached_end_of_then = reached;
633 	/* XXX: what if inside 'if (0)'? */
634 	set_reached(!cstmt->c_always_then);
635 }
636 
637 /*
638  * if_without_else
639  * if_without_else T_ELSE statement
640  */
641 void
642 if3(bool els)
643 {
644 	if (cstmt->c_reached_end_of_then)
645 		set_reached(true);
646 	else if (cstmt->c_always_then)
647 		set_reached(false);
648 	else if (!els)
649 		set_reached(true);
650 
651 	end_control_statement(CS_IF);
652 }
653 
654 /*
655  * T_SWITCH T_LPAREN expr T_RPAREN
656  */
657 void
658 switch1(tnode_t *tn)
659 {
660 	tspec_t	t;
661 	type_t	*tp;
662 
663 	if (tn != NULL)
664 		tn = cconv(tn);
665 	if (tn != NULL)
666 		tn = promote(NOOP, false, tn);
667 	if (tn != NULL && !is_integer(tn->tn_type->t_tspec)) {
668 		/* switch expression must have integral type */
669 		error(205);
670 		tn = NULL;
671 	}
672 	if (tn != NULL && tflag) {
673 		t = tn->tn_type->t_tspec;
674 		if (t == LONG || t == ULONG || t == QUAD || t == UQUAD) {
675 			/* switch expr. must be of type `int' in trad. C */
676 			warning(271);
677 		}
678 	}
679 
680 	/*
681 	 * Remember the type of the expression. Because it's possible
682 	 * that (*tp) is allocated on tree memory, the type must be
683 	 * duplicated. This is not too complicated because it is
684 	 * only an integer type.
685 	 */
686 	tp = xcalloc(1, sizeof(*tp));
687 	if (tn != NULL) {
688 		tp->t_tspec = tn->tn_type->t_tspec;
689 		if ((tp->t_is_enum = tn->tn_type->t_is_enum) != false)
690 			tp->t_enum = tn->tn_type->t_enum;
691 	} else {
692 		tp->t_tspec = INT;
693 	}
694 
695 	check_getopt_begin_switch();
696 	expr(tn, true, false, true, false);
697 
698 	begin_control_statement(CS_SWITCH);
699 	cstmt->c_switch = true;
700 	cstmt->c_switch_type = tp;
701 
702 	set_reached(false);
703 	seen_fallthrough = true;
704 }
705 
706 /*
707  * switch_expr statement
708  */
709 void
710 switch2(void)
711 {
712 	int	nenum = 0, nclab = 0;
713 	sym_t	*esym;
714 	case_label_t *cl;
715 
716 	lint_assert(cstmt->c_switch_type != NULL);
717 
718 	/*
719 	 * If the switch expression was of type enumeration, count the case
720 	 * labels and the number of enumerators. If both counts are not
721 	 * equal print a warning.
722 	 */
723 	if (cstmt->c_switch_type->t_is_enum) {
724 		nenum = nclab = 0;
725 		lint_assert(cstmt->c_switch_type->t_enum != NULL);
726 		for (esym = cstmt->c_switch_type->t_enum->en_first_enumerator;
727 		     esym != NULL; esym = esym->s_next) {
728 			nenum++;
729 		}
730 		for (cl = cstmt->c_case_labels; cl != NULL; cl = cl->cl_next)
731 			nclab++;
732 		if (hflag && eflag && nenum != nclab && !cstmt->c_default) {
733 			/* enumeration value(s) not handled in switch */
734 			warning(206);
735 		}
736 	}
737 
738 	check_getopt_end_switch();
739 
740 	if (cstmt->c_break) {
741 		/*
742 		 * end of switch always reached (c_break is only set if the
743 		 * break statement can be reached).
744 		 */
745 		set_reached(true);
746 	} else if (!cstmt->c_default &&
747 		   (!hflag || !cstmt->c_switch_type->t_is_enum ||
748 		    nenum != nclab)) {
749 		/*
750 		 * there are possible values which are not handled in
751 		 * switch
752 		 */
753 		set_reached(true);
754 	}	/*
755 		 * otherwise the end of the switch expression is reached
756 		 * if the end of the last statement inside it is reached.
757 		 */
758 
759 	end_control_statement(CS_SWITCH);
760 }
761 
762 /*
763  * T_WHILE T_LPAREN expr T_RPAREN
764  */
765 void
766 while1(tnode_t *tn)
767 {
768 	bool body_reached;
769 
770 	if (!reached) {
771 		/* loop not entered at top */
772 		warning(207);
773 		/* FIXME: that's plain wrong. */
774 		set_reached(true);
775 	}
776 
777 	if (tn != NULL)
778 		tn = check_controlling_expression(tn);
779 
780 	begin_control_statement(CS_WHILE);
781 	cstmt->c_loop = true;
782 	cstmt->c_maybe_endless = is_nonzero(tn);
783 	body_reached = !is_zero(tn);
784 
785 	check_getopt_begin_while(tn);
786 	expr(tn, false, true, true, false);
787 
788 	set_reached(body_reached);
789 }
790 
791 /*
792  * while_expr statement
793  * while_expr error
794  */
795 void
796 while2(void)
797 {
798 
799 	/*
800 	 * The end of the loop can be reached if it is no endless loop
801 	 * or there was a break statement which was reached.
802 	 */
803 	set_reached(!cstmt->c_maybe_endless || cstmt->c_break);
804 
805 	check_getopt_end_while();
806 	end_control_statement(CS_WHILE);
807 }
808 
809 /*
810  * T_DO
811  */
812 void
813 do1(void)
814 {
815 
816 	if (!reached) {
817 		/* loop not entered at top */
818 		warning(207);
819 		set_reached(true);
820 	}
821 
822 	begin_control_statement(CS_DO_WHILE);
823 	cstmt->c_loop = true;
824 }
825 
826 /*
827  * do statement do_while_expr
828  * do error
829  */
830 void
831 do2(tnode_t *tn)
832 {
833 
834 	/*
835 	 * If there was a continue statement, the expression controlling the
836 	 * loop is reached.
837 	 */
838 	if (cstmt->c_continue)
839 		set_reached(true);
840 
841 	if (tn != NULL)
842 		tn = check_controlling_expression(tn);
843 
844 	if (tn != NULL && tn->tn_op == CON) {
845 		cstmt->c_maybe_endless = constant_is_nonzero(tn);
846 		if (!cstmt->c_maybe_endless && cstmt->c_continue)
847 			/* continue in 'do ... while (0)' loop */
848 			error(323);
849 	}
850 
851 	expr(tn, false, true, true, true);
852 
853 	if (cstmt->c_maybe_endless)
854 		set_reached(false);
855 	if (cstmt->c_break)
856 		set_reached(true);
857 
858 	end_control_statement(CS_DO_WHILE);
859 }
860 
861 /*
862  * T_FOR T_LPAREN opt_expr T_SEMI opt_expr T_SEMI opt_expr T_RPAREN
863  */
864 void
865 for1(tnode_t *tn1, tnode_t *tn2, tnode_t *tn3)
866 {
867 
868 	/*
869 	 * If there is no initialization expression it is possible that
870 	 * it is intended not to enter the loop at top.
871 	 */
872 	if (tn1 != NULL && !reached) {
873 		/* loop not entered at top */
874 		warning(207);
875 		set_reached(true);
876 	}
877 
878 	begin_control_statement(CS_FOR);
879 	cstmt->c_loop = true;
880 
881 	/*
882 	 * Store the tree memory for the reinitialization expression.
883 	 * Also remember this expression itself. We must check it at
884 	 * the end of the loop to get "used but not set" warnings correct.
885 	 */
886 	cstmt->c_for_expr3_mem = expr_save_memory();
887 	cstmt->c_for_expr3 = tn3;
888 	cstmt->c_for_expr3_pos = curr_pos;
889 	cstmt->c_for_expr3_csrc_pos = csrc_pos;
890 
891 	if (tn1 != NULL)
892 		expr(tn1, false, false, true, false);
893 
894 	if (tn2 != NULL)
895 		tn2 = check_controlling_expression(tn2);
896 	if (tn2 != NULL)
897 		expr(tn2, false, true, true, false);
898 
899 	cstmt->c_maybe_endless = tn2 == NULL || is_nonzero(tn2);
900 
901 	/* Checking the reinitialization expression is done in for2() */
902 
903 	set_reached(!is_zero(tn2));
904 }
905 
906 /*
907  * for_exprs statement
908  * for_exprs error
909  */
910 void
911 for2(void)
912 {
913 	pos_t	cpos, cspos;
914 	tnode_t	*tn3;
915 
916 	if (cstmt->c_continue)
917 		set_reached(true);
918 
919 	cpos = curr_pos;
920 	cspos = csrc_pos;
921 
922 	/* Restore the tree memory for the reinitialization expression */
923 	expr_restore_memory(cstmt->c_for_expr3_mem);
924 	tn3 = cstmt->c_for_expr3;
925 	curr_pos = cstmt->c_for_expr3_pos;
926 	csrc_pos = cstmt->c_for_expr3_csrc_pos;
927 
928 	/* simply "statement not reached" would be confusing */
929 	if (!reached && warn_about_unreachable) {
930 		/* end-of-loop code not reached */
931 		warning(223);
932 		set_reached(true);
933 	}
934 
935 	if (tn3 != NULL) {
936 		expr(tn3, false, false, true, false);
937 	} else {
938 		expr_free_all();
939 	}
940 
941 	curr_pos = cpos;
942 	csrc_pos = cspos;
943 
944 	/* An endless loop without break will never terminate */
945 	/* TODO: What if the loop contains a 'return'? */
946 	set_reached(cstmt->c_break || !cstmt->c_maybe_endless);
947 
948 	end_control_statement(CS_FOR);
949 }
950 
951 /*
952  * T_GOTO identifier T_SEMI
953  */
954 void
955 do_goto(sym_t *lab)
956 {
957 
958 	mark_as_used(lab, false, false);
959 
960 	check_statement_reachable();
961 
962 	set_reached(false);
963 }
964 
965 /*
966  * T_BREAK T_SEMI
967  */
968 void
969 do_break(void)
970 {
971 	cstk_t	*ci;
972 
973 	ci = cstmt;
974 	while (ci != NULL && !ci->c_loop && !ci->c_switch)
975 		ci = ci->c_surrounding;
976 
977 	if (ci == NULL) {
978 		/* break outside loop or switch */
979 		error(208);
980 	} else {
981 		if (reached)
982 			ci->c_break = true;
983 	}
984 
985 	if (bflag)
986 		check_statement_reachable();
987 
988 	set_reached(false);
989 }
990 
991 /*
992  * T_CONTINUE T_SEMI
993  */
994 void
995 do_continue(void)
996 {
997 	cstk_t	*ci;
998 
999 	for (ci = cstmt; ci != NULL && !ci->c_loop; ci = ci->c_surrounding)
1000 		continue;
1001 
1002 	if (ci == NULL) {
1003 		/* continue outside loop */
1004 		error(209);
1005 	} else {
1006 		/* TODO: only if reachable, for symmetry with c_break */
1007 		ci->c_continue = true;
1008 	}
1009 
1010 	check_statement_reachable();
1011 
1012 	set_reached(false);
1013 }
1014 
1015 /*
1016  * T_RETURN T_SEMI
1017  * T_RETURN expr T_SEMI
1018  */
1019 void
1020 do_return(tnode_t *tn)
1021 {
1022 	tnode_t	*ln, *rn;
1023 	cstk_t	*ci;
1024 	op_t	op;
1025 
1026 	for (ci = cstmt; ci->c_surrounding != NULL; ci = ci->c_surrounding)
1027 		continue;
1028 
1029 	if (tn != NULL)
1030 		ci->c_had_return_value = true;
1031 	else
1032 		ci->c_had_return_noval = true;
1033 
1034 	if (tn != NULL && funcsym->s_type->t_subt->t_tspec == VOID) {
1035 		/* void function %s cannot return value */
1036 		error(213, funcsym->s_name);
1037 		expr_free_all();
1038 		tn = NULL;
1039 	} else if (tn == NULL && funcsym->s_type->t_subt->t_tspec != VOID) {
1040 		/*
1041 		 * Assume that the function has a return value only if it
1042 		 * is explicitly declared.
1043 		 */
1044 		if (!funcsym->s_return_type_implicit_int)
1045 			/* function %s expects to return value */
1046 			warning(214, funcsym->s_name);
1047 	}
1048 
1049 	if (tn != NULL) {
1050 
1051 		/* Create a temporary node for the left side */
1052 		ln = expr_zalloc(sizeof(*ln));
1053 		ln->tn_op = NAME;
1054 		ln->tn_type = expr_dup_type(funcsym->s_type->t_subt);
1055 		ln->tn_type->t_const = false;
1056 		ln->tn_lvalue = true;
1057 		ln->tn_sym = funcsym;		/* better than nothing */
1058 
1059 		tn = build(RETURN, ln, tn);
1060 
1061 		if (tn != NULL) {
1062 			rn = tn->tn_right;
1063 			while ((op = rn->tn_op) == CVT || op == PLUS)
1064 				rn = rn->tn_left;
1065 			if (rn->tn_op == ADDR && rn->tn_left->tn_op == NAME &&
1066 			    rn->tn_left->tn_sym->s_scl == AUTO) {
1067 				/* %s returns pointer to automatic object */
1068 				warning(302, funcsym->s_name);
1069 			}
1070 		}
1071 
1072 		expr(tn, true, false, true, false);
1073 
1074 	} else {
1075 
1076 		check_statement_reachable();
1077 
1078 	}
1079 
1080 	set_reached(false);
1081 }
1082 
1083 /*
1084  * Do some cleanup after a global declaration or definition.
1085  * Especially remove information about unused lint comments.
1086  */
1087 void
1088 global_clean_up_decl(bool silent)
1089 {
1090 	pos_t	cpos;
1091 
1092 	cpos = curr_pos;
1093 
1094 	if (nargusg != -1) {
1095 		if (!silent) {
1096 			curr_pos = argsused_pos;
1097 			/* must precede function definition: ** %s ** */
1098 			warning(282, "ARGSUSED");
1099 		}
1100 		nargusg = -1;
1101 	}
1102 	if (nvararg != -1) {
1103 		if (!silent) {
1104 			curr_pos = vapos;
1105 			/* must precede function definition: ** %s ** */
1106 			warning(282, "VARARGS");
1107 		}
1108 		nvararg = -1;
1109 	}
1110 	if (printflike_argnum != -1) {
1111 		if (!silent) {
1112 			curr_pos = printflike_pos;
1113 			/* must precede function definition: ** %s ** */
1114 			warning(282, "PRINTFLIKE");
1115 		}
1116 		printflike_argnum = -1;
1117 	}
1118 	if (scanflike_argnum != -1) {
1119 		if (!silent) {
1120 			curr_pos = scanflike_pos;
1121 			/* must precede function definition: ** %s ** */
1122 			warning(282, "SCANFLIKE");
1123 		}
1124 		scanflike_argnum = -1;
1125 	}
1126 
1127 	curr_pos = cpos;
1128 
1129 	dcs->d_asm = false;
1130 }
1131 
1132 /*
1133  * ARGSUSED comment
1134  *
1135  * Only the first n arguments of the following function are checked
1136  * for usage. A missing argument is taken to be 0.
1137  */
1138 void
1139 argsused(int n)
1140 {
1141 
1142 	if (n == -1)
1143 		n = 0;
1144 
1145 	if (dcs->d_ctx != EXTERN) {
1146 		/* must be outside function: ** %s ** */
1147 		warning(280, "ARGSUSED");
1148 		return;
1149 	}
1150 	if (nargusg != -1) {
1151 		/* duplicate use of ** %s ** */
1152 		warning(281, "ARGSUSED");
1153 	}
1154 	nargusg = n;
1155 	argsused_pos = curr_pos;
1156 }
1157 
1158 /*
1159  * VARARGS comment
1160  *
1161  * Causes lint2 to check only the first n arguments for compatibility
1162  * with the function definition. A missing argument is taken to be 0.
1163  */
1164 void
1165 varargs(int n)
1166 {
1167 
1168 	if (n == -1)
1169 		n = 0;
1170 
1171 	if (dcs->d_ctx != EXTERN) {
1172 		/* must be outside function: ** %s ** */
1173 		warning(280, "VARARGS");
1174 		return;
1175 	}
1176 	if (nvararg != -1) {
1177 		/* duplicate use of ** %s ** */
1178 		warning(281, "VARARGS");
1179 	}
1180 	nvararg = n;
1181 	vapos = curr_pos;
1182 }
1183 
1184 /*
1185  * PRINTFLIKE comment
1186  *
1187  * Check all arguments until the (n-1)-th as usual. The n-th argument is
1188  * used the check the types of remaining arguments.
1189  */
1190 void
1191 printflike(int n)
1192 {
1193 
1194 	if (n == -1)
1195 		n = 0;
1196 
1197 	if (dcs->d_ctx != EXTERN) {
1198 		/* must be outside function: ** %s ** */
1199 		warning(280, "PRINTFLIKE");
1200 		return;
1201 	}
1202 	if (printflike_argnum != -1) {
1203 		/* duplicate use of ** %s ** */
1204 		warning(281, "PRINTFLIKE");
1205 	}
1206 	printflike_argnum = n;
1207 	printflike_pos = curr_pos;
1208 }
1209 
1210 /*
1211  * SCANFLIKE comment
1212  *
1213  * Check all arguments until the (n-1)-th as usual. The n-th argument is
1214  * used the check the types of remaining arguments.
1215  */
1216 void
1217 scanflike(int n)
1218 {
1219 
1220 	if (n == -1)
1221 		n = 0;
1222 
1223 	if (dcs->d_ctx != EXTERN) {
1224 		/* must be outside function: ** %s ** */
1225 		warning(280, "SCANFLIKE");
1226 		return;
1227 	}
1228 	if (scanflike_argnum != -1) {
1229 		/* duplicate use of ** %s ** */
1230 		warning(281, "SCANFLIKE");
1231 	}
1232 	scanflike_argnum = n;
1233 	scanflike_pos = curr_pos;
1234 }
1235 
1236 /*
1237  * Set the line number for a CONSTCOND comment. At this and the following
1238  * line no warnings about constants in conditional contexts are printed.
1239  */
1240 /* ARGSUSED */
1241 void
1242 constcond(int n)
1243 {
1244 
1245 	constcond_flag = true;
1246 }
1247 
1248 /*
1249  * Suppress printing of "fallthrough on ..." warnings until next
1250  * statement.
1251  */
1252 /* ARGSUSED */
1253 void
1254 fallthru(int n)
1255 {
1256 
1257 	seen_fallthrough = true;
1258 }
1259 
1260 /*
1261  * Stop warnings about statements which cannot be reached. Also tells lint
1262  * that the following statements cannot be reached (e.g. after exit()).
1263  */
1264 /* ARGSUSED */
1265 void
1266 not_reached(int n)
1267 {
1268 
1269 	set_reached(false);
1270 	warn_about_unreachable = false;
1271 }
1272 
1273 /* ARGSUSED */
1274 void
1275 lintlib(int n)
1276 {
1277 
1278 	if (dcs->d_ctx != EXTERN) {
1279 		/* must be outside function: ** %s ** */
1280 		warning(280, "LINTLIBRARY");
1281 		return;
1282 	}
1283 	llibflg = true;
1284 	vflag = false;
1285 }
1286 
1287 /*
1288  * Suppress most warnings at the current and the following line.
1289  */
1290 /* ARGSUSED */
1291 void
1292 linted(int n)
1293 {
1294 
1295 #ifdef DEBUG
1296 	printf("%s, %d: lwarn = %d\n", curr_pos.p_file, curr_pos.p_line, n);
1297 #endif
1298 	lwarn = n;
1299 }
1300 
1301 /*
1302  * Suppress bitfield type errors on the current line.
1303  */
1304 /* ARGSUSED */
1305 void
1306 bitfieldtype(int n)
1307 {
1308 
1309 #ifdef DEBUG
1310 	printf("%s, %d: bitfieldtype_ok = true\n", curr_pos.p_file,
1311 	    curr_pos.p_line);
1312 #endif
1313 	bitfieldtype_ok = true;
1314 }
1315 
1316 /*
1317  * PROTOLIB in conjunction with LINTLIBRARY can be used to handle
1318  * prototypes like function definitions. This is done if the argument
1319  * to PROTOLIB is nonzero. Otherwise prototypes are handled normally.
1320  */
1321 void
1322 protolib(int n)
1323 {
1324 
1325 	if (dcs->d_ctx != EXTERN) {
1326 		/* must be outside function: ** %s ** */
1327 		warning(280, "PROTOLIB");
1328 		return;
1329 	}
1330 	plibflg = n != 0;
1331 }
1332 
1333 /* The next statement/declaration may use "long long" without a diagnostic. */
1334 /* ARGSUSED */
1335 void
1336 longlong(int n)
1337 {
1338 
1339 	quadflg = true;
1340 }
1341