xref: /netbsd-src/usr.bin/xlint/lint1/tree.c (revision 06dfa8449cb5e76c0044ec0f3badf7d5180af0f5)
1 /*	$NetBSD: tree.c,v 1.519 2023/04/22 20:54:28 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID)
40 __RCSID("$NetBSD: tree.c,v 1.519 2023/04/22 20:54:28 rillig Exp $");
41 #endif
42 
43 #include <float.h>
44 #include <limits.h>
45 #include <math.h>
46 #include <signal.h>
47 #include <stdlib.h>
48 #include <string.h>
49 
50 #include "lint1.h"
51 
52 
53 typedef struct integer_constraints {
54 	int64_t		smin;	/* signed minimum */
55 	int64_t		smax;	/* signed maximum */
56 	uint64_t	umin;	/* unsigned minimum */
57 	uint64_t	umax;	/* unsigned maximum */
58 	uint64_t	bset;	/* bits that are definitely set */
59 	uint64_t	bclr;	/* bits that are definitely clear */
60 } integer_constraints;
61 
62 
63 static uint64_t
64 u64_fill_right(uint64_t x)
65 {
66 	x |= x >> 1;
67 	x |= x >> 2;
68 	x |= x >> 4;
69 	x |= x >> 8;
70 	x |= x >> 16;
71 	x |= x >> 32;
72 	return x;
73 }
74 
75 static bool
76 str_endswith(const char *haystack, const char *needle)
77 {
78 	size_t hlen = strlen(haystack);
79 	size_t nlen = strlen(needle);
80 
81 	return nlen <= hlen &&
82 	       memcmp(haystack + hlen - nlen, needle, nlen) == 0;
83 }
84 static const char *
85 op_name(op_t op)
86 {
87 	return modtab[op].m_name;
88 }
89 
90 static unsigned
91 width_in_bits(const type_t *tp)
92 {
93 
94 	lint_assert(is_integer(tp->t_tspec));
95 	return tp->t_bitfield ? tp->t_flen : size_in_bits(tp->t_tspec);
96 }
97 
98 static bool
99 ic_maybe_signed(const type_t *tp, const integer_constraints *ic)
100 {
101 
102 	return !is_uinteger(tp->t_tspec) &&
103 	    (ic->bclr & ((uint64_t)1 << 63)) == 0;
104 }
105 
106 static integer_constraints
107 ic_any(const type_t *tp)
108 {
109 	integer_constraints c;
110 
111 	uint64_t vbits = value_bits(width_in_bits(tp));
112 	if (is_uinteger(tp->t_tspec)) {
113 		c.smin = INT64_MIN;
114 		c.smax = INT64_MAX;
115 		c.umin = 0;
116 		c.umax = vbits;
117 		c.bset = 0;
118 		c.bclr = ~c.umax;
119 	} else {
120 		c.smin = (int64_t)-1 - (int64_t)(vbits >> 1);
121 		c.smax = (int64_t)(vbits >> 1);
122 		c.umin = 0;
123 		c.umax = UINT64_MAX;
124 		c.bset = 0;
125 		c.bclr = 0;
126 	}
127 	return c;
128 }
129 
130 static integer_constraints
131 ic_con(const type_t *tp, const val_t *v)
132 {
133 	integer_constraints c;
134 
135 	lint_assert(is_integer(tp->t_tspec));
136 	int64_t s = v->v_quad;
137 	uint64_t u = (uint64_t)s;
138 	c.smin = s;
139 	c.smax = s;
140 	c.umin = u;
141 	c.umax = u;
142 	c.bset = u;
143 	c.bclr = ~u;
144 	return c;
145 }
146 
147 static integer_constraints
148 ic_cvt(const type_t *ntp, const type_t *otp, integer_constraints a)
149 {
150 
151 	if (width_in_bits(ntp) > width_in_bits(otp) &&
152 	    is_uinteger(otp->t_tspec))
153 		return a;
154 	return ic_any(ntp);
155 }
156 
157 static integer_constraints
158 ic_bitand(integer_constraints a, integer_constraints b)
159 {
160 	integer_constraints c;
161 
162 	c.smin = INT64_MIN;
163 	c.smax = INT64_MAX;
164 	c.umin = 0;
165 	c.umax = UINT64_MAX;
166 	c.bset = a.bset & b.bset;
167 	c.bclr = a.bclr | b.bclr;
168 	return c;
169 }
170 
171 static integer_constraints
172 ic_bitor(integer_constraints a, integer_constraints b)
173 {
174 	integer_constraints c;
175 
176 	c.smin = INT64_MIN;
177 	c.smax = INT64_MAX;
178 	c.umin = 0;
179 	c.umax = UINT64_MAX;
180 	c.bset = a.bset | b.bset;
181 	c.bclr = a.bclr & b.bclr;
182 	return c;
183 }
184 
185 static integer_constraints
186 ic_mod(const type_t *tp, integer_constraints a, integer_constraints b)
187 {
188 	integer_constraints c;
189 
190 	if (ic_maybe_signed(tp, &a) || ic_maybe_signed(tp, &b))
191 		return ic_any(tp);
192 
193 	c.smin = INT64_MIN;
194 	c.smax = INT64_MAX;
195 	c.umin = 0;
196 	c.umax = b.umax - 1;
197 	c.bset = 0;
198 	c.bclr = ~u64_fill_right(c.umax);
199 	return c;
200 }
201 
202 static integer_constraints
203 ic_shl(const type_t *tp, integer_constraints a, integer_constraints b)
204 {
205 	integer_constraints c;
206 	unsigned int amount;
207 
208 	if (ic_maybe_signed(tp, &a))
209 		return ic_any(tp);
210 
211 	if (b.smin == b.smax && b.smin >= 0 && b.smin < 64)
212 		amount = (unsigned int)b.smin;
213 	else if (b.umin == b.umax && b.umin < 64)
214 		amount = (unsigned int)b.umin;
215 	else
216 		return ic_any(tp);
217 
218 	c.smin = INT64_MIN;
219 	c.smax = INT64_MAX;
220 	c.umin = 0;
221 	c.umax = UINT64_MAX;
222 	c.bset = a.bset << amount;
223 	c.bclr = a.bclr << amount | (((uint64_t)1 << amount) - 1);
224 	return c;
225 }
226 
227 static integer_constraints
228 ic_shr(const type_t *tp, integer_constraints a, integer_constraints b)
229 {
230 	integer_constraints c;
231 	unsigned int amount;
232 
233 	if (ic_maybe_signed(tp, &a))
234 		return ic_any(tp);
235 
236 	if (b.smin == b.smax && b.smin >= 0 && b.smin < 64)
237 		amount = (unsigned int)b.smin;
238 	else if (b.umin == b.umax && b.umin < 64)
239 		amount = (unsigned int)b.umin;
240 	else
241 		return ic_any(tp);
242 
243 	c.smin = INT64_MIN;
244 	c.smax = INT64_MAX;
245 	c.umin = 0;
246 	c.umax = UINT64_MAX;
247 	c.bset = a.bset >> amount;
248 	c.bclr = a.bclr >> amount | ~(~(uint64_t)0 >> amount);
249 	return c;
250 }
251 
252 static integer_constraints
253 ic_expr(const tnode_t *tn)
254 {
255 	integer_constraints lc, rc;
256 
257 	lint_assert(is_integer(tn->tn_type->t_tspec));
258 
259 	switch (tn->tn_op) {
260 	case CON:
261 		return ic_con(tn->tn_type, tn->tn_val);
262 	case CVT:
263 		if (!is_integer(tn->tn_left->tn_type->t_tspec))
264 			return ic_any(tn->tn_type);
265 		lc = ic_expr(tn->tn_left);
266 		return ic_cvt(tn->tn_type, tn->tn_left->tn_type, lc);
267 	case MOD:
268 		lc = ic_expr(before_conversion(tn->tn_left));
269 		rc = ic_expr(before_conversion(tn->tn_right));
270 		return ic_mod(tn->tn_type, lc, rc);
271 	case SHL:
272 		lc = ic_expr(tn->tn_left);
273 		rc = ic_expr(tn->tn_right);
274 		return ic_shl(tn->tn_type, lc, rc);
275 	case SHR:
276 		lc = ic_expr(tn->tn_left);
277 		rc = ic_expr(tn->tn_right);
278 		return ic_shr(tn->tn_type, lc, rc);
279 	case BITAND:
280 		lc = ic_expr(tn->tn_left);
281 		rc = ic_expr(tn->tn_right);
282 		return ic_bitand(lc, rc);
283 	case BITOR:
284 		lc = ic_expr(tn->tn_left);
285 		rc = ic_expr(tn->tn_right);
286 		return ic_bitor(lc, rc);
287 	default:
288 		return ic_any(tn->tn_type);
289 	}
290 }
291 
292 /* Build 'pointer to tp', 'array of tp' or 'function returning tp'. */
293 type_t *
294 block_derive_type(type_t *tp, tspec_t t)
295 {
296 	type_t	*tp2;
297 
298 	tp2 = block_zero_alloc(sizeof(*tp2));
299 	tp2->t_tspec = t;
300 	tp2->t_subt = tp;
301 	return tp2;
302 }
303 
304 /*
305  * Derive 'pointer to tp' or 'function returning tp'.
306  * The memory is freed at the end of the current expression.
307  */
308 type_t *
309 expr_derive_type(type_t *tp, tspec_t t)
310 {
311 	type_t	*tp2;
312 
313 	tp2 = expr_zero_alloc(sizeof(*tp2));
314 	tp2->t_tspec = t;
315 	tp2->t_subt = tp;
316 	return tp2;
317 }
318 
319 /*
320  * Build and initialize a new node.
321  */
322 static tnode_t *
323 new_tnode(op_t op, bool sys, type_t *type, tnode_t *ln, tnode_t *rn)
324 {
325 
326 	tnode_t *ntn = expr_alloc_tnode();
327 	ntn->tn_op = op;
328 	ntn->tn_type = type;
329 	ntn->tn_sys = sys;
330 	ntn->tn_left = ln;
331 	ntn->tn_right = rn;
332 
333 	if (op == INDIR || op == FSEL) {
334 		lint_assert(ln->tn_type->t_tspec == PTR);
335 		tspec_t t = ln->tn_type->t_subt->t_tspec;
336 		if (t != FUNC && t != VOID)
337 			ntn->tn_lvalue = true;
338 	}
339 
340 	return ntn;
341 }
342 
343 /*
344  * Create a node for a constant.
345  */
346 tnode_t *
347 build_constant(type_t *tp, val_t *v)
348 {
349 	tnode_t	*n;
350 
351 	n = expr_alloc_tnode();
352 	n->tn_op = CON;
353 	n->tn_type = tp;
354 	n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
355 	n->tn_val->v_tspec = tp->t_tspec;
356 	n->tn_val->v_unsigned_since_c90 = v->v_unsigned_since_c90;
357 	n->tn_val->v_u = v->v_u;
358 	free(v);
359 	return n;
360 }
361 
362 static tnode_t *
363 build_integer_constant(tspec_t t, int64_t q)
364 {
365 	tnode_t	*n;
366 
367 	n = expr_alloc_tnode();
368 	n->tn_op = CON;
369 	n->tn_type = gettyp(t);
370 	n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
371 	n->tn_val->v_tspec = t;
372 	n->tn_val->v_quad = q;
373 	return n;
374 }
375 
376 static void
377 fallback_symbol(sym_t *sym)
378 {
379 
380 	if (Tflag && fallback_symbol_strict_bool(sym))
381 		return;
382 
383 	if (block_level > 0 && (strcmp(sym->s_name, "__FUNCTION__") == 0 ||
384 			   strcmp(sym->s_name, "__PRETTY_FUNCTION__") == 0)) {
385 		/* __FUNCTION__/__PRETTY_FUNCTION__ is a GCC extension */
386 		gnuism(316);
387 		sym->s_type = block_derive_type(gettyp(CHAR), PTR);
388 		sym->s_type->t_const = true;
389 		return;
390 	}
391 
392 	if (block_level > 0 && strcmp(sym->s_name, "__func__") == 0) {
393 		if (!allow_c99)
394 			/* __func__ is a C99 feature */
395 			warning(317);
396 		/* C11 6.4.2.2 */
397 		sym->s_type = block_derive_type(gettyp(CHAR), ARRAY);
398 		sym->s_type->t_const = true;
399 		sym->s_type->t_dim = (int)strlen(funcsym->s_name) + 1;
400 		return;
401 	}
402 
403 	/* '%s' undefined */
404 	error(99, sym->s_name);
405 }
406 
407 /*
408  * Functions that are predeclared by GCC or other compilers can be called
409  * with arbitrary arguments.  Since lint usually runs after a successful
410  * compilation, it's the compiler's job to catch any errors.
411  */
412 bool
413 is_compiler_builtin(const char *name)
414 {
415 	/* https://gcc.gnu.org/onlinedocs/gcc/C-Extensions.html */
416 	if (allow_gcc) {
417 		if (strncmp(name, "__atomic_", 9) == 0 ||
418 		    strncmp(name, "__builtin_", 10) == 0 ||
419 		    strcmp(name, "alloca") == 0 ||
420 		    /* obsolete but still in use, as of 2021 */
421 		    strncmp(name, "__sync_", 7) == 0)
422 			return true;
423 	}
424 
425 	/* https://software.intel.com/sites/landingpage/IntrinsicsGuide/ */
426 	if (strncmp(name, "_mm_", 4) == 0)
427 		return true;
428 
429 	return false;
430 }
431 
432 /* https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html */
433 static bool
434 is_gcc_bool_builtin(const char *name)
435 {
436 	return strncmp(name, "__builtin_", 10) == 0 &&
437 	       (str_endswith(name, "_overflow") ||
438 		str_endswith(name, "_overflow_p"));
439 }
440 
441 static void
442 build_name_call(sym_t *sym)
443 {
444 
445 	if (is_compiler_builtin(sym->s_name)) {
446 		/*
447 		 * Do not warn about these, just assume that
448 		 * they are regular functions compatible with
449 		 * non-prototype calling conventions.
450 		 */
451 		if (allow_gcc && is_gcc_bool_builtin(sym->s_name))
452 			sym->s_type = gettyp(BOOL);
453 
454 	} else if (allow_c99) {
455 		/* function '%s' implicitly declared to return int */
456 		error(215, sym->s_name);
457 	} else if (!allow_trad) {
458 		/* function '%s' implicitly declared to return int */
459 		warning(215, sym->s_name);
460 	}
461 
462 	/* XXX if !allow_c90, the symbol should be exported to level 0 */
463 	sym->s_type = block_derive_type(sym->s_type, FUNC);
464 }
465 
466 /* Create a node for a name (symbol table entry). */
467 tnode_t *
468 build_name(sym_t *sym, bool is_funcname)
469 {
470 	tnode_t	*n;
471 
472 	if (sym->s_scl == NOSCL && !in_gcc_attribute) {
473 		sym->s_scl = EXTERN;
474 		sym->s_def = DECL;
475 		if (is_funcname)
476 			build_name_call(sym);
477 		else
478 			fallback_symbol(sym);
479 	}
480 
481 	lint_assert(sym->s_kind == FVFT || sym->s_kind == FMEMBER);
482 
483 	n = expr_alloc_tnode();
484 	n->tn_type = sym->s_type;
485 	if (sym->s_scl == BOOL_CONST) {
486 		n->tn_op = CON;
487 		n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
488 		n->tn_val->v_tspec = BOOL;
489 		n->tn_val->v_quad = sym->u.s_bool_constant ? 1 : 0;
490 	} else if (sym->s_scl == ENUM_CONST) {
491 		n->tn_op = CON;
492 		n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
493 		n->tn_val->v_tspec = INT;	/* ENUM is in n->tn_type */
494 		n->tn_val->v_quad = sym->u.s_enum_constant;
495 	} else {
496 		n->tn_op = NAME;
497 		n->tn_sym = sym;
498 		if (sym->s_kind == FVFT && sym->s_type->t_tspec != FUNC)
499 			n->tn_lvalue = true;
500 	}
501 
502 	return n;
503 }
504 
505 tnode_t *
506 build_string(strg_t *strg)
507 {
508 	size_t	len;
509 	tnode_t	*n;
510 	type_t *tp;
511 
512 	len = strg->st_len;
513 
514 	n = expr_alloc_tnode();
515 
516 	tp = expr_zero_alloc(sizeof(*tp));
517 	tp->t_tspec = ARRAY;
518 	tp->t_subt = gettyp(strg->st_char ? CHAR : WCHAR);
519 	tp->t_dim = (int)(len + 1);
520 
521 	n->tn_op = STRING;
522 	n->tn_type = tp;
523 	n->tn_lvalue = true;
524 
525 	n->tn_string = expr_zero_alloc(sizeof(*n->tn_string));
526 	n->tn_string->st_char = strg->st_char;
527 	n->tn_string->st_len = len;
528 
529 	size_t chsize = strg->st_char ? sizeof(char) : sizeof(wchar_t);
530 	size_t size = (len + 1) * chsize;
531 	n->tn_string->st_mem = expr_zero_alloc(size);
532 	(void)memcpy(n->tn_string->st_mem, strg->st_mem, size);
533 	free(strg->st_mem);
534 	free(strg);
535 
536 	return n;
537 }
538 
539 tnode_t *
540 build_generic_selection(const tnode_t *expr,
541 			struct generic_association *sel)
542 {
543 	tnode_t *default_result = NULL;
544 
545 	for (; sel != NULL; sel = sel->ga_prev) {
546 		if (expr != NULL &&
547 		    types_compatible(sel->ga_arg, expr->tn_type,
548 			false, false, NULL))
549 			return sel->ga_result;
550 		else if (sel->ga_arg == NULL)
551 			default_result = sel->ga_result;
552 	}
553 	return default_result;
554 }
555 
556 static bool
557 is_out_of_char_range(const tnode_t *tn)
558 {
559 	return tn->tn_op == CON &&
560 	       !(0 <= tn->tn_val->v_quad &&
561 		 tn->tn_val->v_quad < 1 << (CHAR_SIZE - 1));
562 }
563 
564 /*
565  * Check for ordered comparisons of unsigned values with 0.
566  */
567 static void
568 check_integer_comparison(op_t op, tnode_t *ln, tnode_t *rn)
569 {
570 	tspec_t	lt, rt;
571 
572 	lt = ln->tn_type->t_tspec;
573 	rt = rn->tn_type->t_tspec;
574 
575 	if (ln->tn_op != CON && rn->tn_op != CON)
576 		return;
577 
578 	if (!is_integer(lt) || !is_integer(rt))
579 		return;
580 
581 	if (hflag || pflag) {
582 		if (lt == CHAR && is_out_of_char_range(rn)) {
583 			char buf[128];
584 			(void)snprintf(buf, sizeof(buf), "%s %d",
585 			    op_name(op), (int)rn->tn_val->v_quad);
586 			/* nonportable character comparison '%s' */
587 			warning(230, buf);
588 			return;
589 		}
590 		if (rt == CHAR && is_out_of_char_range(ln)) {
591 			char buf[128];
592 			(void)snprintf(buf, sizeof(buf), "%d %s ?",
593 			    (int)ln->tn_val->v_quad, op_name(op));
594 			/* nonportable character comparison '%s' */
595 			warning(230, buf);
596 			return;
597 		}
598 	}
599 
600 	if (is_uinteger(lt) && !is_uinteger(rt) &&
601 	    rn->tn_op == CON && rn->tn_val->v_quad <= 0) {
602 		if (rn->tn_val->v_quad < 0) {
603 			/* operator '%s' compares '%s' with '%s' */
604 			warning(162, op_name(op),
605 			    type_name(ln->tn_type), "negative constant");
606 		} else if (op == LT || op == GE) {
607 			/* operator '%s' compares '%s' with '%s' */
608 			warning(162, op_name(op), type_name(ln->tn_type), "0");
609 		}
610 		return;
611 	}
612 	if (is_uinteger(rt) && !is_uinteger(lt) &&
613 	    ln->tn_op == CON && ln->tn_val->v_quad <= 0) {
614 		if (ln->tn_val->v_quad < 0) {
615 			/* operator '%s' compares '%s' with '%s' */
616 			warning(162, op_name(op),
617 			    "negative constant", type_name(rn->tn_type));
618 		} else if (op == GT || op == LE) {
619 			/* operator '%s' compares '%s' with '%s' */
620 			warning(162, op_name(op), "0", type_name(rn->tn_type));
621 		}
622 		return;
623 	}
624 }
625 
626 static const tspec_t arith_rank[] = {
627 	LDOUBLE, DOUBLE, FLOAT,
628 #ifdef INT128_SIZE
629 	UINT128, INT128,
630 #endif
631 	UQUAD, QUAD,
632 	ULONG, LONG,
633 	UINT, INT,
634 };
635 
636 /* Keep unsigned in traditional C */
637 static tspec_t
638 usual_arithmetic_conversion_trad(tspec_t lt, tspec_t rt)
639 {
640 
641 	size_t i;
642 	for (i = 0; arith_rank[i] != INT; i++)
643 		if (lt == arith_rank[i] || rt == arith_rank[i])
644 			break;
645 
646 	tspec_t t = arith_rank[i];
647 	if (is_uinteger(lt) || is_uinteger(rt))
648 		if (is_integer(t) && !is_uinteger(t))
649 			return unsigned_type(t);
650 	return t;
651 }
652 
653 static tspec_t
654 usual_arithmetic_conversion_c90(tspec_t lt, tspec_t rt)
655 {
656 
657 	if (lt == rt)
658 		return lt;
659 
660 	if (lt == LCOMPLEX || rt == LCOMPLEX)
661 		return LCOMPLEX;
662 	if (lt == DCOMPLEX || rt == DCOMPLEX)
663 		return DCOMPLEX;
664 	if (lt == FCOMPLEX || rt == FCOMPLEX)
665 		return FCOMPLEX;
666 	if (lt == LDOUBLE || rt == LDOUBLE)
667 		return LDOUBLE;
668 	if (lt == DOUBLE || rt == DOUBLE)
669 		return DOUBLE;
670 	if (lt == FLOAT || rt == FLOAT)
671 		return FLOAT;
672 
673 	/*
674 	 * If type A has more bits than type B, it should be able to hold all
675 	 * possible values of type B.
676 	 */
677 	if (size_in_bits(lt) > size_in_bits(rt))
678 		return lt;
679 	if (size_in_bits(lt) < size_in_bits(rt))
680 		return rt;
681 
682 	size_t i;
683 	for (i = 3; arith_rank[i] != INT; i++)
684 		if (arith_rank[i] == lt || arith_rank[i] == rt)
685 			break;
686 	if ((is_uinteger(lt) || is_uinteger(rt)) &&
687 	    !is_uinteger(arith_rank[i]))
688 		i--;
689 	return arith_rank[i];
690 }
691 
692 static tnode_t *
693 apply_usual_arithmetic_conversions(op_t op, tnode_t *tn, tspec_t t)
694 {
695 	type_t *ntp = expr_dup_type(tn->tn_type);
696 	ntp->t_tspec = t;
697 	if (tn->tn_op != CON) {
698 		/* usual arithmetic conversion for '%s' from '%s' to '%s' */
699 		query_message(4, op_name(op),
700 		    type_name(tn->tn_type), type_name(ntp));
701 	}
702 	return convert(op, 0, ntp, tn);
703 }
704 
705 /*
706  * Apply the "usual arithmetic conversions" (C99 6.3.1.8), which gives both
707  * operands the same type.
708  */
709 static void
710 balance(op_t op, tnode_t **lnp, tnode_t **rnp)
711 {
712 
713 	tspec_t lt = (*lnp)->tn_type->t_tspec;
714 	tspec_t rt = (*rnp)->tn_type->t_tspec;
715 	if (!is_arithmetic(lt) || !is_arithmetic(rt))
716 		return;
717 
718 	tspec_t t = allow_c90
719 	    ? usual_arithmetic_conversion_c90(lt, rt)
720 	    : usual_arithmetic_conversion_trad(lt, rt);
721 
722 	if (t != lt)
723 		*lnp = apply_usual_arithmetic_conversions(op, *lnp, t);
724 	if (t != rt)
725 		*rnp = apply_usual_arithmetic_conversions(op, *rnp, t);
726 }
727 
728 /*
729  * Create a tree node for the unary & operator
730  */
731 static tnode_t *
732 build_address(bool sys, tnode_t *tn, bool noign)
733 {
734 	tspec_t	t;
735 
736 	if (!noign && ((t = tn->tn_type->t_tspec) == ARRAY || t == FUNC)) {
737 		if (!allow_c90)
738 			/* '&' before array or function: ignored */
739 			warning(127);
740 		return tn;
741 	}
742 
743 	/* eliminate &* */
744 	if (tn->tn_op == INDIR &&
745 	    tn->tn_left->tn_type->t_tspec == PTR &&
746 	    tn->tn_left->tn_type->t_subt == tn->tn_type) {
747 		return tn->tn_left;
748 	}
749 
750 	return new_tnode(ADDR, sys, expr_derive_type(tn->tn_type, PTR),
751 	    tn, NULL);
752 }
753 
754 /*
755  * XXX
756  * Note: There appear to be a number of bugs in detecting overflow in
757  * this function. An audit and a set of proper regression tests are needed.
758  *     --Perry Metzger, Nov. 16, 2001
759  */
760 /*
761  * Do only as much as necessary to compute constant expressions.
762  * Called only if the operator allows folding and all operands are constants.
763  */
764 static tnode_t *
765 fold(tnode_t *tn)
766 {
767 	val_t *v;
768 	tspec_t t;
769 	bool utyp, ovfl;
770 	int64_t sl, sr = 0, q = 0, mask;
771 	uint64_t ul, ur = 0;
772 	tnode_t *cn;
773 
774 	v = xcalloc(1, sizeof(*v));
775 	v->v_tspec = tn->tn_type->t_tspec;
776 
777 	t = tn->tn_left->tn_type->t_tspec;
778 	utyp = !is_integer(t) || is_uinteger(t);
779 	ul = sl = tn->tn_left->tn_val->v_quad;
780 	if (is_binary(tn))
781 		ur = sr = tn->tn_right->tn_val->v_quad;
782 
783 	mask = value_bits(size_in_bits(t));
784 	ovfl = false;
785 
786 	switch (tn->tn_op) {
787 	case UPLUS:
788 		q = sl;
789 		break;
790 	case UMINUS:
791 		q = sl == INT64_MIN ? sl : -sl;
792 		if (sl != 0 && msb(q, t) == msb(sl, t))
793 			ovfl = true;
794 		break;
795 	case COMPL:
796 		q = ~sl;
797 		break;
798 	case MULT:
799 		if (utyp) {
800 			q = ul * ur;
801 			if (q != (q & mask))
802 				ovfl = true;
803 			else if ((ul != 0) && ((q / ul) != ur))
804 				ovfl = true;
805 		} else {
806 			q = sl * sr;
807 			if (msb(q, t) != (msb(sl, t) ^ msb(sr, t)))
808 				ovfl = true;
809 		}
810 		break;
811 	case DIV:
812 		if (sr == 0) {
813 			/* division by 0 */
814 			error(139);
815 			q = utyp ? -1 : INT64_MAX;
816 		} else {
817 			q = utyp ? (int64_t)(ul / ur) : sl / sr;
818 		}
819 		break;
820 	case MOD:
821 		if (sr == 0) {
822 			/* modulus by 0 */
823 			error(140);
824 			q = 0;
825 		} else {
826 			q = utyp ? (int64_t)(ul % ur) : sl % sr;
827 		}
828 		break;
829 	case PLUS:
830 		q = utyp ? (int64_t)(ul + ur) : sl + sr;
831 		if (msb(sl, t) && msb(sr, t) && !msb(q, t))
832 			ovfl = true;
833 		if (!utyp && !msb(sl, t) && !msb(sr, t) && msb(q, t))
834 			ovfl = true;
835 		break;
836 	case MINUS:
837 		q = utyp ? (int64_t)(ul - ur) : sl - sr;
838 		if (!utyp && msb(sl, t) && !msb(sr, t) && !msb(q, t))
839 			ovfl = true;
840 		if (!msb(sl, t) && msb(sr, t) && msb(q, t))
841 			ovfl = true;
842 		break;
843 	case SHL:
844 		/* TODO: warn about out-of-bounds 'sr'. */
845 		/* TODO: warn about overflow in signed '<<'. */
846 		q = utyp ? (int64_t)(ul << (sr & 63)) : sl << (sr & 63);
847 		break;
848 	case SHR:
849 		/*
850 		 * The sign must be explicitly extended because
851 		 * shifts of signed values are implementation dependent.
852 		 */
853 		/* TODO: warn about out-of-bounds 'sr'. */
854 		q = ul >> (sr & 63);
855 		q = convert_integer(q, t, size_in_bits(t) - (int)sr);
856 		break;
857 	case LT:
858 		q = (utyp ? ul < ur : sl < sr) ? 1 : 0;
859 		break;
860 	case LE:
861 		q = (utyp ? ul <= ur : sl <= sr) ? 1 : 0;
862 		break;
863 	case GE:
864 		q = (utyp ? ul >= ur : sl >= sr) ? 1 : 0;
865 		break;
866 	case GT:
867 		q = (utyp ? ul > ur : sl > sr) ? 1 : 0;
868 		break;
869 	case EQ:
870 		q = (utyp ? ul == ur : sl == sr) ? 1 : 0;
871 		break;
872 	case NE:
873 		q = (utyp ? ul != ur : sl != sr) ? 1 : 0;
874 		break;
875 	case BITAND:
876 		q = utyp ? (int64_t)(ul & ur) : sl & sr;
877 		break;
878 	case BITXOR:
879 		q = utyp ? (int64_t)(ul ^ ur) : sl ^ sr;
880 		break;
881 	case BITOR:
882 		q = utyp ? (int64_t)(ul | ur) : sl | sr;
883 		break;
884 	default:
885 		lint_assert(/*CONSTCOND*/false);
886 	}
887 
888 	/* XXX does not work for quads. */
889 	if (ovfl ||
890 	    ((uint64_t)(q | mask) != ~(uint64_t)0 && (q & ~mask) != 0)) {
891 		if (hflag)
892 			/* integer overflow detected, op '%s' */
893 			warning(141, op_name(tn->tn_op));
894 	}
895 
896 	v->v_quad = convert_integer(q, t, 0);
897 
898 	cn = build_constant(tn->tn_type, v);
899 	if (tn->tn_left->tn_system_dependent)
900 		cn->tn_system_dependent = true;
901 	if (is_binary(tn) && tn->tn_right->tn_system_dependent)
902 		cn->tn_system_dependent = true;
903 
904 	return cn;
905 }
906 
907 /*
908  * Create a new node for one of the operators POINT and ARROW.
909  */
910 static tnode_t *
911 build_struct_access(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
912 {
913 	tnode_t	*ntn, *ctn;
914 	bool	nolval;
915 
916 	lint_assert(rn->tn_op == NAME);
917 	lint_assert(is_member(rn->tn_sym));
918 
919 	/*
920 	 * Remember if the left operand is an lvalue (structure members
921 	 * are lvalues if and only if the structure itself is an lvalue).
922 	 */
923 	nolval = op == POINT && !ln->tn_lvalue;
924 
925 	if (op == POINT) {
926 		ln = build_address(sys, ln, true);
927 	} else if (ln->tn_type->t_tspec != PTR) {
928 		lint_assert(!allow_c90);
929 		lint_assert(is_integer(ln->tn_type->t_tspec));
930 		ln = convert(NOOP, 0, expr_derive_type(gettyp(VOID), PTR), ln);
931 	}
932 
933 	ctn = build_integer_constant(PTRDIFF_TSPEC,
934 	    rn->tn_sym->u.s_member.sm_offset_in_bits / CHAR_SIZE);
935 
936 	ntn = new_tnode(PLUS, sys, expr_derive_type(rn->tn_type, PTR),
937 	    ln, ctn);
938 	if (ln->tn_op == CON)
939 		ntn = fold(ntn);
940 
941 	if (rn->tn_type->t_bitfield) {
942 		ntn = new_tnode(FSEL, sys, ntn->tn_type->t_subt, ntn, NULL);
943 	} else {
944 		ntn = new_tnode(INDIR, sys, ntn->tn_type->t_subt, ntn, NULL);
945 	}
946 
947 	if (nolval)
948 		ntn->tn_lvalue = false;
949 
950 	return ntn;
951 }
952 
953 /*
954  * Get the size in bytes of type tp->t_subt, as a constant expression of type
955  * ptrdiff_t as seen from the target platform.
956  */
957 static tnode_t *
958 subt_size_in_bytes(type_t *tp)
959 {
960 	int elem, elsz_in_bits;
961 
962 	lint_assert(tp->t_tspec == PTR);
963 	tp = tp->t_subt;
964 
965 	elem = 1;
966 	elsz_in_bits = 0;
967 
968 	while (tp->t_tspec == ARRAY) {
969 		elem *= tp->t_dim;
970 		tp = tp->t_subt;
971 	}
972 
973 	switch (tp->t_tspec) {
974 	case FUNC:
975 		/* pointer to function is not allowed here */
976 		error(110);
977 		break;
978 	case VOID:
979 		/* cannot do pointer arithmetic on operand of unknown size */
980 		gnuism(136);
981 		break;
982 	case STRUCT:
983 	case UNION:
984 		if ((elsz_in_bits = tp->t_sou->sou_size_in_bits) == 0)
985 			/* cannot do pointer arithmetic on operand of ... */
986 			error(136);
987 		break;
988 	case ENUM:
989 		if (is_incomplete(tp)) {
990 			/* cannot do pointer arithmetic on operand of ... */
991 			warning(136);
992 		}
993 		/* FALLTHROUGH */
994 	default:
995 		if ((elsz_in_bits = size_in_bits(tp->t_tspec)) == 0) {
996 			/* cannot do pointer arithmetic on operand of ... */
997 			error(136);
998 		} else {
999 			lint_assert(elsz_in_bits != -1);
1000 		}
1001 		break;
1002 	}
1003 
1004 	if (elem == 0 && elsz_in_bits != 0) {
1005 		/* cannot do pointer arithmetic on operand of unknown size */
1006 		error(136);
1007 	}
1008 
1009 	if (elsz_in_bits == 0)
1010 		elsz_in_bits = CHAR_SIZE;
1011 
1012 	return build_integer_constant(PTRDIFF_TSPEC,
1013 	    (int64_t)(elem * elsz_in_bits / CHAR_SIZE));
1014 }
1015 
1016 /*
1017  * Create a node for INCAFT, INCBEF, DECAFT and DECBEF.
1018  */
1019 static tnode_t *
1020 build_prepost_incdec(op_t op, bool sys, tnode_t *ln)
1021 {
1022 	tnode_t	*cn, *ntn;
1023 
1024 	lint_assert(ln != NULL);
1025 
1026 	if (ln->tn_type->t_tspec == PTR) {
1027 		cn = subt_size_in_bytes(ln->tn_type);
1028 	} else {
1029 		cn = build_integer_constant(INT, (int64_t)1);
1030 	}
1031 	ntn = new_tnode(op, sys, ln->tn_type, ln, cn);
1032 
1033 	return ntn;
1034 }
1035 
1036 static void
1037 check_enum_array_index(const tnode_t *ln, const tnode_t *rn)
1038 {
1039 	int max_array_index;
1040 	int64_t max_enum_value;
1041 	const struct sym *ec, *max_ec;
1042 	const type_t *lt, *rt;
1043 
1044 	if (ln->tn_op != ADDR || ln->tn_left->tn_op != NAME)
1045 		return;
1046 
1047 	lt = ln->tn_left->tn_type;
1048 	if (lt->t_tspec != ARRAY || lt->t_incomplete_array)
1049 		return;
1050 
1051 	if (rn->tn_op != CVT || !rn->tn_type->t_is_enum)
1052 		return;
1053 	if (rn->tn_left->tn_op != LOAD)
1054 		return;
1055 
1056 	rt = rn->tn_left->tn_type;
1057 	ec = rt->t_enum->en_first_enumerator;
1058 	max_ec = ec;
1059 	lint_assert(ec != NULL);
1060 	for (ec = ec->s_next; ec != NULL; ec = ec->s_next)
1061 		if (ec->u.s_enum_constant > max_ec->u.s_enum_constant)
1062 			max_ec = ec;
1063 
1064 	max_enum_value = max_ec->u.s_enum_constant;
1065 	lint_assert(INT_MIN <= max_enum_value && max_enum_value <= INT_MAX);
1066 
1067 	max_array_index = lt->t_dim - 1;
1068 	if (max_enum_value == max_array_index)
1069 		return;
1070 
1071 	/*
1072 	 * If the name of the largest enum constant contains 'MAX' or 'NUM',
1073 	 * that constant is typically not part of the allowed enum values but
1074 	 * a marker for the number of actual enum values.
1075 	 */
1076 	if (max_enum_value == max_array_index + 1 &&
1077 	    (strstr(max_ec->s_name, "MAX") != NULL ||
1078 	     strstr(max_ec->s_name, "max") != NULL ||
1079 	     strstr(max_ec->s_name, "NUM") != NULL ||
1080 	     strstr(max_ec->s_name, "num") != NULL))
1081 		return;
1082 
1083 	/* maximum value %d of '%s' does not match maximum array index %d */
1084 	warning(348, (int)max_enum_value, type_name(rt), max_array_index);
1085 	print_previous_declaration(max_ec);
1086 }
1087 
1088 /*
1089  * Create a node for operators PLUS and MINUS.
1090  */
1091 static tnode_t *
1092 build_plus_minus(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
1093 {
1094 
1095 	/* If pointer and integer, then pointer to the lhs. */
1096 	if (rn->tn_type->t_tspec == PTR && is_integer(ln->tn_type->t_tspec)) {
1097 		tnode_t *tmp = ln;
1098 		ln = rn;
1099 		rn = tmp;
1100 		/* pointer addition has integer on the left-hand side */
1101 		query_message(5);
1102 	}
1103 
1104 	/* pointer +- integer */
1105 	if (ln->tn_type->t_tspec == PTR && rn->tn_type->t_tspec != PTR) {
1106 		lint_assert(is_integer(rn->tn_type->t_tspec));
1107 
1108 		check_ctype_macro_invocation(ln, rn);
1109 		check_enum_array_index(ln, rn);
1110 
1111 		tnode_t *elsz = subt_size_in_bytes(ln->tn_type);
1112 		if (rn->tn_type->t_tspec != elsz->tn_type->t_tspec)
1113 			rn = convert(NOOP, 0, elsz->tn_type, rn);
1114 
1115 		tnode_t *prod = new_tnode(MULT, sys, rn->tn_type, rn, elsz);
1116 		if (rn->tn_op == CON)
1117 			prod = fold(prod);
1118 
1119 		return new_tnode(op, sys, ln->tn_type, ln, prod);
1120 	}
1121 
1122 	/* pointer - pointer */
1123 	if (rn->tn_type->t_tspec == PTR) {
1124 		lint_assert(ln->tn_type->t_tspec == PTR);
1125 		lint_assert(op == MINUS);
1126 
1127 		type_t *ptrdiff = gettyp(PTRDIFF_TSPEC);
1128 		tnode_t *raw_diff = new_tnode(op, sys, ptrdiff, ln, rn);
1129 		if (ln->tn_op == CON && rn->tn_op == CON)
1130 			raw_diff = fold(raw_diff);
1131 
1132 		tnode_t *elsz = subt_size_in_bytes(ln->tn_type);
1133 		balance(NOOP, &raw_diff, &elsz);
1134 
1135 		return new_tnode(DIV, sys, ptrdiff, raw_diff, elsz);
1136 	}
1137 
1138 	return new_tnode(op, sys, ln->tn_type, ln, rn);
1139 }
1140 
1141 /*
1142  * Create a node for operators SHL and SHR.
1143  */
1144 static tnode_t *
1145 build_bit_shift(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
1146 {
1147 
1148 	if (!allow_c90 && rn->tn_type->t_tspec != INT)
1149 		rn = convert(NOOP, 0, gettyp(INT), rn);
1150 	return new_tnode(op, sys, ln->tn_type, ln, rn);
1151 }
1152 
1153 static bool
1154 is_null_pointer(const tnode_t *tn)
1155 {
1156 	tspec_t t = tn->tn_type->t_tspec;
1157 
1158 	return ((t == PTR && tn->tn_type->t_subt->t_tspec == VOID) ||
1159 		is_integer(t))
1160 	       && (tn->tn_op == CON && tn->tn_val->v_quad == 0);
1161 }
1162 
1163 /* Return a type based on tp1, with added qualifiers from tp2. */
1164 static type_t *
1165 merge_qualifiers(type_t *tp1, const type_t *tp2)
1166 {
1167 	type_t *ntp, *nstp;
1168 	bool c1, c2, v1, v2;
1169 
1170 	lint_assert(tp1->t_tspec == PTR);
1171 	lint_assert(tp2->t_tspec == PTR);
1172 
1173 	c1 = tp1->t_subt->t_const;
1174 	c2 = tp2->t_subt->t_const;
1175 	v1 = tp1->t_subt->t_volatile;
1176 	v2 = tp2->t_subt->t_volatile;
1177 
1178 	if (c1 == (c1 | c2) && v1 == (v1 | v2))
1179 		return tp1;
1180 
1181 	nstp = expr_dup_type(tp1->t_subt);
1182 	nstp->t_const |= c2;
1183 	nstp->t_volatile |= v2;
1184 
1185 	ntp = expr_dup_type(tp1);
1186 	ntp->t_subt = nstp;
1187 	return ntp;
1188 }
1189 
1190 /* See C99 6.5.15 "Conditional operator". */
1191 static tnode_t *
1192 build_colon(bool sys, tnode_t *ln, tnode_t *rn)
1193 {
1194 	tspec_t	lt, rt;
1195 	type_t	*tp;
1196 
1197 	lt = ln->tn_type->t_tspec;
1198 	rt = rn->tn_type->t_tspec;
1199 
1200 	if (is_arithmetic(lt) && is_arithmetic(rt)) {
1201 		/* The operands were already balanced in build_binary. */
1202 		tp = ln->tn_type;
1203 	} else if (lt == BOOL && rt == BOOL) {
1204 		tp = ln->tn_type;
1205 	} else if (lt == VOID || rt == VOID) {
1206 		tp = gettyp(VOID);
1207 	} else if (is_struct_or_union(lt)) {
1208 		/* Both types must be identical. */
1209 		lint_assert(is_struct_or_union(rt));
1210 		lint_assert(ln->tn_type->t_sou == rn->tn_type->t_sou);
1211 		if (is_incomplete(ln->tn_type)) {
1212 			/* unknown operand size, op '%s' */
1213 			error(138, op_name(COLON));
1214 			return NULL;
1215 		}
1216 		tp = ln->tn_type;
1217 	} else if (lt == PTR && is_integer(rt)) {
1218 		if (rt != PTRDIFF_TSPEC)
1219 			rn = convert(NOOP, 0, gettyp(PTRDIFF_TSPEC), rn);
1220 		tp = ln->tn_type;
1221 	} else if (rt == PTR && is_integer(lt)) {
1222 		if (lt != PTRDIFF_TSPEC)
1223 			ln = convert(NOOP, 0, gettyp(PTRDIFF_TSPEC), ln);
1224 		tp = rn->tn_type;
1225 	} else if (lt == PTR && is_null_pointer(rn)) {
1226 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
1227 	} else if (rt == PTR && is_null_pointer(ln)) {
1228 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
1229 	} else if (lt == PTR && ln->tn_type->t_subt->t_tspec == VOID) {
1230 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
1231 	} else if (rt == PTR && rn->tn_type->t_subt->t_tspec == VOID) {
1232 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
1233 	} else {
1234 		/*
1235 		 * XXX For now we simply take the left type. This is
1236 		 * probably wrong, if one type contains a function prototype
1237 		 * and the other one, at the same place, only an old-style
1238 		 * declaration.
1239 		 */
1240 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
1241 	}
1242 
1243 	return new_tnode(COLON, sys, tp, ln, rn);
1244 }
1245 
1246 /* TODO: check for varargs */
1247 static bool
1248 is_cast_redundant(const tnode_t *tn)
1249 {
1250 	const type_t *ntp = tn->tn_type, *otp = tn->tn_left->tn_type;
1251 	tspec_t nt = ntp->t_tspec, ot = otp->t_tspec;
1252 
1253 	if (nt == BOOL || ot == BOOL)
1254 		return nt == BOOL && ot == BOOL;
1255 
1256 	if (is_integer(nt) && is_integer(ot)) {
1257 		unsigned int nw = width_in_bits(ntp), ow = width_in_bits(otp);
1258 		if (is_uinteger(nt) == is_uinteger(ot))
1259 		       return nw >= ow;
1260 		return is_uinteger(ot) && nw > ow;
1261 	}
1262 
1263 	if (is_complex(nt) || is_complex(ot))
1264 		return is_complex(nt) && is_complex(ot) &&
1265 		       size_in_bits(nt) >= size_in_bits(ot);
1266 
1267 	if (is_floating(nt) && is_floating(ot))
1268 		return size_in_bits(nt) >= size_in_bits(ot);
1269 
1270 	if (nt == PTR && ot == PTR) {
1271 		if (!ntp->t_subt->t_const && otp->t_subt->t_const)
1272 			return false;
1273 		if (!ntp->t_subt->t_volatile && otp->t_subt->t_volatile)
1274 			return false;
1275 
1276 		if (ntp->t_subt->t_tspec == VOID ||
1277 		    otp->t_subt->t_tspec == VOID ||
1278 		    types_compatible(ntp->t_subt, otp->t_subt,
1279 			false, false, NULL))
1280 			return true;
1281 	}
1282 
1283 	return false;
1284 }
1285 
1286 /*
1287  * Create a node for an assignment operator (both = and op= ).
1288  */
1289 static tnode_t *
1290 build_assignment(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
1291 {
1292 	tspec_t	lt, rt;
1293 	tnode_t	*ntn, *ctn;
1294 
1295 	lint_assert(ln != NULL);
1296 	lint_assert(rn != NULL);
1297 
1298 	lt = ln->tn_type->t_tspec;
1299 	rt = rn->tn_type->t_tspec;
1300 
1301 	if ((op == ADDASS || op == SUBASS) && lt == PTR) {
1302 		lint_assert(is_integer(rt));
1303 		ctn = subt_size_in_bytes(ln->tn_type);
1304 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
1305 			rn = convert(NOOP, 0, ctn->tn_type, rn);
1306 		rn = new_tnode(MULT, sys, rn->tn_type, rn, ctn);
1307 		if (rn->tn_left->tn_op == CON)
1308 			rn = fold(rn);
1309 	}
1310 
1311 	if ((op == ASSIGN || op == RETURN || op == INIT) &&
1312 	    (lt == STRUCT || rt == STRUCT)) {
1313 		lint_assert(lt == rt);
1314 		lint_assert(ln->tn_type->t_sou == rn->tn_type->t_sou);
1315 		if (is_incomplete(ln->tn_type)) {
1316 			if (op == RETURN) {
1317 				/* cannot return incomplete type */
1318 				error(212);
1319 			} else {
1320 				/* unknown operand size, op '%s' */
1321 				error(138, op_name(op));
1322 			}
1323 			return NULL;
1324 		}
1325 	}
1326 
1327 	if (op == SHLASS) {
1328 		if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
1329 			if (hflag)
1330 				/* semantics of '%s' change in ANSI C; ... */
1331 				warning(118, "<<=");
1332 		}
1333 	} else if (op != SHRASS) {
1334 		if (op == ASSIGN || lt != PTR) {
1335 			if (lt != rt ||
1336 			    (ln->tn_type->t_bitfield && rn->tn_op == CON)) {
1337 				rn = convert(op, 0, ln->tn_type, rn);
1338 				rt = lt;
1339 			}
1340 		}
1341 	}
1342 
1343 	if (any_query_enabled && rn->tn_op == CVT && rn->tn_cast &&
1344 	    types_compatible(ln->tn_type, rn->tn_type, false, false, NULL) &&
1345 	    is_cast_redundant(rn)) {
1346 		/* redundant cast from '%s' to '%s' before assignment */
1347 		query_message(7,
1348 		    type_name(rn->tn_left->tn_type), type_name(rn->tn_type));
1349 	}
1350 
1351 	ntn = new_tnode(op, sys, ln->tn_type, ln, rn);
1352 
1353 	return ntn;
1354 }
1355 
1356 /*
1357  * Create a node for REAL, IMAG
1358  */
1359 static tnode_t *
1360 build_real_imag(op_t op, bool sys, tnode_t *ln)
1361 {
1362 	tnode_t	*cn, *ntn;
1363 
1364 	lint_assert(ln != NULL);
1365 
1366 	if (ln->tn_op == NAME) {
1367 		/*
1368 		 * This may be too much, but it avoids wrong warnings.
1369 		 * See d_c99_complex_split.c.
1370 		 */
1371 		mark_as_used(ln->tn_sym, false, false);
1372 		mark_as_set(ln->tn_sym);
1373 	}
1374 
1375 	switch (ln->tn_type->t_tspec) {
1376 	case LCOMPLEX:
1377 		/* XXX: integer and LDOUBLE don't match. */
1378 		cn = build_integer_constant(LDOUBLE, (int64_t)1);
1379 		break;
1380 	case DCOMPLEX:
1381 		/* XXX: integer and DOUBLE don't match. */
1382 		cn = build_integer_constant(DOUBLE, (int64_t)1);
1383 		break;
1384 	case FCOMPLEX:
1385 		/* XXX: integer and FLOAT don't match. */
1386 		cn = build_integer_constant(FLOAT, (int64_t)1);
1387 		break;
1388 	default:
1389 		/* '__%s__' is illegal for type '%s' */
1390 		error(276, op == REAL ? "real" : "imag",
1391 		    type_name(ln->tn_type));
1392 		return NULL;
1393 	}
1394 	ntn = new_tnode(op, sys, cn->tn_type, ln, cn);
1395 	ntn->tn_lvalue = true;
1396 
1397 	return ntn;
1398 }
1399 
1400 static bool
1401 is_confusing_precedence(op_t op, op_t lop, bool lparen, op_t rop, bool rparen)
1402 {
1403 
1404 	if (op == SHL || op == SHR) {
1405 		if (!lparen && (lop == PLUS || lop == MINUS))
1406 			return true;
1407 		if (!rparen && (rop == PLUS || rop == MINUS))
1408 			return true;
1409 		return false;
1410 	}
1411 
1412 	if (op == LOGOR) {
1413 		if (!lparen && lop == LOGAND)
1414 			return true;
1415 		if (!rparen && rop == LOGAND)
1416 			return true;
1417 		return false;
1418 	}
1419 
1420 	lint_assert(op == BITAND || op == BITXOR || op == BITOR);
1421 	if (!lparen && lop != op) {
1422 		if (lop == PLUS || lop == MINUS)
1423 			return true;
1424 		if (lop == BITAND || lop == BITXOR)
1425 			return true;
1426 	}
1427 	if (!rparen && rop != op) {
1428 		if (rop == PLUS || rop == MINUS)
1429 			return true;
1430 		if (rop == BITAND || rop == BITXOR)
1431 			return true;
1432 	}
1433 	return false;
1434 }
1435 
1436 /*
1437  * Print a warning if the given node has operands which should be
1438  * parenthesized.
1439  *
1440  * XXX Does not work if an operand is a constant expression. Constant
1441  * expressions are already folded.
1442  */
1443 static void
1444 check_precedence_confusion(tnode_t *tn)
1445 {
1446 	tnode_t *ln, *rn;
1447 
1448 	if (!hflag)
1449 		return;
1450 
1451 	debug_node(tn);
1452 
1453 	lint_assert(is_binary(tn));
1454 	for (ln = tn->tn_left; ln->tn_op == CVT; ln = ln->tn_left)
1455 		continue;
1456 	for (rn = tn->tn_right; rn->tn_op == CVT; rn = rn->tn_left)
1457 		continue;
1458 
1459 	if (is_confusing_precedence(tn->tn_op,
1460 	    ln->tn_op, ln->tn_parenthesized,
1461 	    rn->tn_op, rn->tn_parenthesized)) {
1462 		/* precedence confusion possible: parenthesize! */
1463 		warning(169);
1464 	}
1465 }
1466 
1467 /*
1468  * Fold constant nodes, as much as is needed for comparing the value with 0.
1469  */
1470 static tnode_t *
1471 fold_bool(tnode_t *tn)
1472 {
1473 	bool	l, r;
1474 	val_t	*v;
1475 
1476 	v = xcalloc(1, sizeof(*v));
1477 	v->v_tspec = tn->tn_type->t_tspec;
1478 	lint_assert(v->v_tspec == INT || (Tflag && v->v_tspec == BOOL));
1479 
1480 	l = constant_is_nonzero(tn->tn_left);
1481 	r = is_binary(tn) && constant_is_nonzero(tn->tn_right);
1482 
1483 	switch (tn->tn_op) {
1484 	case NOT:
1485 		if (hflag && !constcond_flag)
1486 			/* constant argument to '!' */
1487 			warning(239);
1488 		v->v_quad = !l ? 1 : 0;
1489 		break;
1490 	case LOGAND:
1491 		v->v_quad = l && r ? 1 : 0;
1492 		break;
1493 	case LOGOR:
1494 		v->v_quad = l || r ? 1 : 0;
1495 		break;
1496 	default:
1497 		lint_assert(/*CONSTCOND*/false);
1498 	}
1499 
1500 	return build_constant(tn->tn_type, v);
1501 }
1502 
1503 static ldbl_t
1504 floating_error_value(tspec_t t, ldbl_t lv)
1505 {
1506 	if (t == FLOAT)
1507 		return lv < 0 ? -FLT_MAX : FLT_MAX;
1508 	if (t == DOUBLE)
1509 		return lv < 0 ? -DBL_MAX : DBL_MAX;
1510 	/*
1511 	 * When NetBSD is cross-built in MKLINT=yes mode on x86_64 for
1512 	 * sparc64, tools/lint checks this code while building usr.bin/xlint.
1513 	 * In that situation, lint uses the preprocessor for sparc64, in which
1514 	 * the type 'long double' is IEEE-754-binary128, affecting the macro
1515 	 * LDBL_MAX below. The type 'long double', as well as the strtold
1516 	 * implementation, comes from the host platform x86_64 though, where
1517 	 * 'long double' consumes 128 bits as well but only uses 80 of them.
1518 	 * The exponent range of the two 'long double' types is the same, but
1519 	 * the maximum finite value differs due to the extended precision on
1520 	 * sparc64.
1521 	 *
1522 	 * To properly handle the data types of the target platform, lint
1523 	 * would have to implement the floating-point types in a
1524 	 * platform-independent way, which is not worth the effort, given how
1525 	 * few programs practically use 'long double'.
1526 	 */
1527 	/* LINTED 248: floating-point constant out of range */
1528 	ldbl_t max = LDBL_MAX;
1529 	return lv < 0 ? -max : max;
1530 }
1531 
1532 /*
1533  * Fold constant nodes having operands with floating point type.
1534  */
1535 static tnode_t *
1536 fold_float(tnode_t *tn)
1537 {
1538 	val_t	*v;
1539 	tspec_t	t;
1540 	ldbl_t	lv, rv = 0;
1541 
1542 	fpe = 0;
1543 	v = xcalloc(1, sizeof(*v));
1544 	v->v_tspec = t = tn->tn_type->t_tspec;
1545 
1546 	lint_assert(is_floating(t));
1547 	lint_assert(t == tn->tn_left->tn_type->t_tspec);
1548 	lint_assert(!is_binary(tn) || t == tn->tn_right->tn_type->t_tspec);
1549 
1550 	lv = tn->tn_left->tn_val->v_ldbl;
1551 	if (is_binary(tn))
1552 		rv = tn->tn_right->tn_val->v_ldbl;
1553 
1554 	switch (tn->tn_op) {
1555 	case UPLUS:
1556 		v->v_ldbl = lv;
1557 		break;
1558 	case UMINUS:
1559 		v->v_ldbl = -lv;
1560 		break;
1561 	case MULT:
1562 		v->v_ldbl = lv * rv;
1563 		break;
1564 	case DIV:
1565 		if (rv == 0.0) {
1566 			/* division by 0 */
1567 			error(139);
1568 			v->v_ldbl = floating_error_value(t, lv);
1569 		} else {
1570 			v->v_ldbl = lv / rv;
1571 		}
1572 		break;
1573 	case PLUS:
1574 		v->v_ldbl = lv + rv;
1575 		break;
1576 	case MINUS:
1577 		v->v_ldbl = lv - rv;
1578 		break;
1579 	case LT:
1580 		v->v_quad = lv < rv ? 1 : 0;
1581 		break;
1582 	case LE:
1583 		v->v_quad = lv <= rv ? 1 : 0;
1584 		break;
1585 	case GE:
1586 		v->v_quad = lv >= rv ? 1 : 0;
1587 		break;
1588 	case GT:
1589 		v->v_quad = lv > rv ? 1 : 0;
1590 		break;
1591 	case EQ:
1592 		v->v_quad = lv == rv ? 1 : 0;
1593 		break;
1594 	case NE:
1595 		v->v_quad = lv != rv ? 1 : 0;
1596 		break;
1597 	default:
1598 		lint_assert(/*CONSTCOND*/false);
1599 	}
1600 
1601 	lint_assert(fpe != 0 || isnan(v->v_ldbl) == 0);
1602 	if (is_complex(v->v_tspec)) {
1603 		/*
1604 		 * Don't warn, as lint doesn't model the imaginary part of
1605 		 * complex numbers.
1606 		 */
1607 		fpe = 0;
1608 	} else if (fpe != 0 || isfinite(v->v_ldbl) == 0 ||
1609 	    (t == FLOAT &&
1610 	     (v->v_ldbl > FLT_MAX || v->v_ldbl < -FLT_MAX)) ||
1611 	    (t == DOUBLE &&
1612 	     (v->v_ldbl > DBL_MAX || v->v_ldbl < -DBL_MAX))) {
1613 		/* floating point overflow on operator '%s' */
1614 		warning(142, op_name(tn->tn_op));
1615 		v->v_ldbl = floating_error_value(t, v->v_ldbl);
1616 		fpe = 0;
1617 	}
1618 
1619 	return build_constant(tn->tn_type, v);
1620 }
1621 
1622 /*
1623  * Create a tree node for a binary operator and its two operands. Also called
1624  * for unary operators; in that case rn is NULL.
1625  *
1626  * Function calls, sizeof and casts are handled elsewhere.
1627  */
1628 tnode_t *
1629 build_binary(tnode_t *ln, op_t op, bool sys, tnode_t *rn)
1630 {
1631 	const mod_t *mp;
1632 	tnode_t	*ntn;
1633 	type_t	*rettp;
1634 
1635 	mp = &modtab[op];
1636 
1637 	/* If there was an error in one of the operands, return. */
1638 	if (ln == NULL || (mp->m_binary && rn == NULL))
1639 		return NULL;
1640 
1641 	/*
1642 	 * Apply class conversions to the left operand, but only if its
1643 	 * value is needed or it is compared with zero.
1644 	 */
1645 	if (mp->m_value_context || mp->m_compares_with_zero)
1646 		ln = cconv(ln);
1647 	/*
1648 	 * The right operand is almost always in a test or value context,
1649 	 * except if it is a struct or union member.
1650 	 */
1651 	if (mp->m_binary && op != ARROW && op != POINT)
1652 		rn = cconv(rn);
1653 
1654 	/*
1655 	 * Print some warnings for comparisons of unsigned values with
1656 	 * constants lower than or equal to null. This must be done
1657 	 * before promote() because otherwise unsigned char and unsigned
1658 	 * short would be promoted to int. Types are also tested to be
1659 	 * CHAR, which would also become int.
1660 	 */
1661 	if (mp->m_comparison)
1662 		check_integer_comparison(op, ln, rn);
1663 
1664 	if (mp->m_value_context || mp->m_compares_with_zero)
1665 		ln = promote(op, false, ln);
1666 	if (mp->m_binary && op != ARROW && op != POINT &&
1667 	    op != ASSIGN && op != RETURN && op != INIT) {
1668 		rn = promote(op, false, rn);
1669 	}
1670 
1671 	/*
1672 	 * If the result of the operation is different for signed or
1673 	 * unsigned operands and one of the operands is signed only in
1674 	 * ANSI C, print a warning.
1675 	 */
1676 	if (mp->m_warn_if_left_unsigned_in_c90 &&
1677 	    ln->tn_op == CON && ln->tn_val->v_unsigned_since_c90) {
1678 		/* ANSI C treats constant as unsigned, op '%s' */
1679 		warning(218, mp->m_name);
1680 		ln->tn_val->v_unsigned_since_c90 = false;
1681 	}
1682 	if (mp->m_warn_if_right_unsigned_in_c90 &&
1683 	    rn->tn_op == CON && rn->tn_val->v_unsigned_since_c90) {
1684 		/* ANSI C treats constant as unsigned, op '%s' */
1685 		warning(218, mp->m_name);
1686 		rn->tn_val->v_unsigned_since_c90 = false;
1687 	}
1688 
1689 	/* Make sure both operands are of the same type */
1690 	if (mp->m_balance_operands || (!allow_c90 && (op == SHL || op == SHR)))
1691 		balance(op, &ln, &rn);
1692 
1693 	/*
1694 	 * Check types for compatibility with the operation and mutual
1695 	 * compatibility. Return if there are serious problems.
1696 	 */
1697 	if (!typeok(op, 0, ln, rn))
1698 		return NULL;
1699 
1700 	/* And now create the node. */
1701 	switch (op) {
1702 	case POINT:
1703 	case ARROW:
1704 		ntn = build_struct_access(op, sys, ln, rn);
1705 		break;
1706 	case INCAFT:
1707 	case DECAFT:
1708 	case INCBEF:
1709 	case DECBEF:
1710 		ntn = build_prepost_incdec(op, sys, ln);
1711 		break;
1712 	case ADDR:
1713 		ntn = build_address(sys, ln, false);
1714 		break;
1715 	case INDIR:
1716 		ntn = new_tnode(INDIR, sys, ln->tn_type->t_subt, ln, NULL);
1717 		break;
1718 	case PLUS:
1719 	case MINUS:
1720 		ntn = build_plus_minus(op, sys, ln, rn);
1721 		break;
1722 	case SHL:
1723 	case SHR:
1724 		ntn = build_bit_shift(op, sys, ln, rn);
1725 		break;
1726 	case COLON:
1727 		ntn = build_colon(sys, ln, rn);
1728 		break;
1729 	case ASSIGN:
1730 	case MULASS:
1731 	case DIVASS:
1732 	case MODASS:
1733 	case ADDASS:
1734 	case SUBASS:
1735 	case SHLASS:
1736 	case SHRASS:
1737 	case ANDASS:
1738 	case XORASS:
1739 	case ORASS:
1740 	case RETURN:
1741 	case INIT:
1742 		ntn = build_assignment(op, sys, ln, rn);
1743 		break;
1744 	case COMMA:
1745 	case QUEST:
1746 		ntn = new_tnode(op, sys, rn->tn_type, ln, rn);
1747 		break;
1748 	case REAL:
1749 	case IMAG:
1750 		ntn = build_real_imag(op, sys, ln);
1751 		break;
1752 	default:
1753 		rettp = mp->m_returns_bool
1754 		    ? gettyp(Tflag ? BOOL : INT) : ln->tn_type;
1755 		lint_assert(mp->m_binary == (rn != NULL));
1756 		ntn = new_tnode(op, sys, rettp, ln, rn);
1757 		break;
1758 	}
1759 
1760 	/* Return if an error occurred. */
1761 	if (ntn == NULL)
1762 		return NULL;
1763 
1764 	/* Print a warning if precedence confusion is possible */
1765 	if (mp->m_possible_precedence_confusion)
1766 		check_precedence_confusion(ntn);
1767 
1768 	/*
1769 	 * Print a warning if one of the operands is in a context where
1770 	 * it is compared with zero and if this operand is a constant.
1771 	 */
1772 	if (hflag && !constcond_flag &&
1773 	    mp->m_compares_with_zero &&
1774 	    (ln->tn_op == CON ||
1775 	     ((mp->m_binary && op != QUEST) && rn->tn_op == CON)) &&
1776 	    /* XXX: rn->tn_system_dependent should be checked as well */
1777 	    !ln->tn_system_dependent) {
1778 		/* constant in conditional context */
1779 		warning(161);
1780 	}
1781 
1782 	/* Fold if the operator requires it */
1783 	if (mp->m_fold_constant_operands) {
1784 		if (ln->tn_op == CON && (!mp->m_binary || rn->tn_op == CON)) {
1785 			if (mp->m_compares_with_zero) {
1786 				ntn = fold_bool(ntn);
1787 			} else if (is_floating(ntn->tn_type->t_tspec)) {
1788 				ntn = fold_float(ntn);
1789 			} else {
1790 				ntn = fold(ntn);
1791 			}
1792 		} else if (op == QUEST && ln->tn_op == CON) {
1793 			ntn = ln->tn_val->v_quad != 0
1794 			    ? rn->tn_left : rn->tn_right;
1795 		}
1796 	}
1797 
1798 	return ntn;
1799 }
1800 
1801 tnode_t *
1802 build_unary(op_t op, bool sys, tnode_t *tn)
1803 {
1804 	return build_binary(tn, op, sys, NULL);
1805 }
1806 
1807 /*
1808  * Return whether all struct/union members with the same name have the same
1809  * type and offset.
1810  */
1811 static bool
1812 all_members_compatible(const sym_t *msym)
1813 {
1814 	for (const sym_t *csym = msym;
1815 	     csym != NULL; csym = csym->s_symtab_next) {
1816 		if (!is_member(csym))
1817 			continue;
1818 		if (strcmp(msym->s_name, csym->s_name) != 0)
1819 			continue;
1820 
1821 		for (const sym_t *sym = csym->s_symtab_next;
1822 		     sym != NULL; sym = sym->s_symtab_next) {
1823 
1824 			if (!is_member(sym))
1825 				continue;
1826 			if (strcmp(csym->s_name, sym->s_name) != 0)
1827 				continue;
1828 			if (csym->u.s_member.sm_offset_in_bits !=
1829 			    sym->u.s_member.sm_offset_in_bits)
1830 				return false;
1831 
1832 			bool w = false;
1833 			if (!types_compatible(csym->s_type, sym->s_type,
1834 			    false, false, &w) && !w)
1835 				return false;
1836 			if (csym->s_bitfield != sym->s_bitfield)
1837 				return false;
1838 			if (csym->s_bitfield) {
1839 				type_t *tp1 = csym->s_type;
1840 				type_t *tp2 = sym->s_type;
1841 				if (tp1->t_flen != tp2->t_flen)
1842 					return false;
1843 				if (tp1->t_foffs != tp2->t_foffs)
1844 					return false;
1845 			}
1846 		}
1847 	}
1848 	return true;
1849 }
1850 
1851 /*
1852  * Returns a symbol which has the same name as the msym argument and is a
1853  * member of the struct or union specified by the tn argument.
1854  */
1855 static sym_t *
1856 struct_or_union_member(tnode_t *tn, op_t op, sym_t *msym)
1857 {
1858 	struct_or_union	*str;
1859 	type_t	*tp;
1860 	tspec_t	t;
1861 
1862 	/*
1863 	 * Remove the member if it was unknown until now, which means
1864 	 * that no defined struct or union has a member with the same name.
1865 	 */
1866 	if (msym->s_scl == NOSCL) {
1867 		/* type '%s' does not have member '%s' */
1868 		error(101, type_name(tn->tn_type), msym->s_name);
1869 		rmsym(msym);
1870 		msym->s_kind = FMEMBER;
1871 		msym->s_scl = STRUCT_MEMBER;
1872 
1873 		struct_or_union *sou = expr_zero_alloc(sizeof(*sou));
1874 		sou->sou_tag = expr_zero_alloc(sizeof(*sou->sou_tag));
1875 		sou->sou_tag->s_name = unnamed;
1876 
1877 		msym->u.s_member.sm_sou_type = sou;
1878 		/*
1879 		 * The member sm_offset_in_bits is not needed here since this
1880 		 * symbol can only be used for error reporting.
1881 		 */
1882 		return msym;
1883 	}
1884 
1885 	/* Set str to the tag of which msym is expected to be a member. */
1886 	str = NULL;
1887 	t = (tp = tn->tn_type)->t_tspec;
1888 	if (op == POINT) {
1889 		if (is_struct_or_union(t))
1890 			str = tp->t_sou;
1891 	} else if (op == ARROW && t == PTR) {
1892 		t = (tp = tp->t_subt)->t_tspec;
1893 		if (is_struct_or_union(t))
1894 			str = tp->t_sou;
1895 	}
1896 
1897 	/*
1898 	 * If this struct/union has a member with the name of msym, return it.
1899 	 */
1900 	if (str != NULL) {
1901 		for (sym_t *sym = msym;
1902 		     sym != NULL; sym = sym->s_symtab_next) {
1903 			if (is_member(sym) &&
1904 			    sym->u.s_member.sm_sou_type == str &&
1905 			    strcmp(sym->s_name, msym->s_name) == 0)
1906 				return sym;
1907 		}
1908 	}
1909 
1910 	bool eq = all_members_compatible(msym);
1911 
1912 	/*
1913 	 * Now handle the case in which the left operand refers really
1914 	 * to a struct/union, but the right operand is not member of it.
1915 	 */
1916 	if (str != NULL) {
1917 		if (eq && !allow_c90) {
1918 			/* illegal use of member '%s' */
1919 			warning(102, msym->s_name);
1920 		} else {
1921 			/* illegal use of member '%s' */
1922 			error(102, msym->s_name);
1923 		}
1924 		return msym;
1925 	}
1926 
1927 	/*
1928 	 * Now the left operand of ARROW does not point to a struct/union
1929 	 * or the left operand of POINT is no struct/union.
1930 	 */
1931 	if (eq) {
1932 		if (op == POINT) {
1933 			if (!allow_c90) {
1934 				/* left operand of '.' must be struct ... */
1935 				warning(103, type_name(tn->tn_type));
1936 			} else {
1937 				/* left operand of '.' must be struct ... */
1938 				error(103, type_name(tn->tn_type));
1939 			}
1940 		} else {
1941 			if (!allow_c90 && tn->tn_type->t_tspec == PTR) {
1942 				/* left operand of '->' must be pointer ... */
1943 				warning(104, type_name(tn->tn_type));
1944 			} else {
1945 				/* left operand of '->' must be pointer ... */
1946 				error(104, type_name(tn->tn_type));
1947 			}
1948 		}
1949 	} else {
1950 		if (!allow_c90) {
1951 			/* non-unique member requires struct/union %s */
1952 			error(105, op == POINT ? "object" : "pointer");
1953 		} else {
1954 			/* unacceptable operand of '%s' */
1955 			error(111, op_name(op));
1956 		}
1957 	}
1958 
1959 	return msym;
1960 }
1961 
1962 tnode_t *
1963 build_member_access(tnode_t *ln, op_t op, bool sys, sbuf_t *member)
1964 {
1965 	sym_t	*msym;
1966 
1967 	if (ln == NULL)
1968 		return NULL;
1969 
1970 	if (op == ARROW) {
1971 		/* must do this before struct_or_union_member is called */
1972 		ln = cconv(ln);
1973 	}
1974 	msym = struct_or_union_member(ln, op, getsym(member));
1975 	return build_binary(ln, op, sys, build_name(msym, false));
1976 }
1977 
1978 /*
1979  * Perform class conversions.
1980  *
1981  * Arrays of type T are converted into pointers to type T.
1982  * Functions are converted to pointers to functions.
1983  * Lvalues are converted to rvalues.
1984  *
1985  * C99 6.3 "Conversions"
1986  * C99 6.3.2 "Other operands"
1987  * C99 6.3.2.1 "Lvalues, arrays, and function designators"
1988  */
1989 tnode_t *
1990 cconv(tnode_t *tn)
1991 {
1992 	/*
1993 	 * Array-lvalue (array of type T) is converted into rvalue
1994 	 * (pointer to type T)
1995 	 */
1996 	if (tn->tn_type->t_tspec == ARRAY) {
1997 		if (!tn->tn_lvalue) {
1998 			/* XXX print correct operator */
1999 			/* %soperand of '%s' must be lvalue */
2000 			gnuism(114, "", op_name(ADDR));
2001 		}
2002 		tn = new_tnode(ADDR, tn->tn_sys,
2003 		    expr_derive_type(tn->tn_type->t_subt, PTR), tn, NULL);
2004 	}
2005 
2006 	/*
2007 	 * Expression of type function (function with return value of type T)
2008 	 * in rvalue-expression (pointer to function with return value
2009 	 * of type T)
2010 	 */
2011 	if (tn->tn_type->t_tspec == FUNC)
2012 		tn = build_address(tn->tn_sys, tn, true);
2013 
2014 	/* lvalue to rvalue */
2015 	if (tn->tn_lvalue) {
2016 		type_t *tp = expr_dup_type(tn->tn_type);
2017 		/* C99 6.3.2.1p2 sentence 2 says to remove the qualifiers. */
2018 		tp->t_const = tp->t_volatile = false;
2019 		tn = new_tnode(LOAD, tn->tn_sys, tp, tn, NULL);
2020 	}
2021 
2022 	return tn;
2023 }
2024 
2025 const tnode_t *
2026 before_conversion(const tnode_t *tn)
2027 {
2028 	while (tn->tn_op == CVT && !tn->tn_cast)
2029 		tn = tn->tn_left;
2030 	return tn;
2031 }
2032 
2033 /*
2034  * Most errors required by ANSI C are reported in struct_or_union_member().
2035  * Here we only check for totally wrong things.
2036  */
2037 static bool
2038 typeok_point(const tnode_t *ln, const type_t *ltp, tspec_t lt)
2039 {
2040 	if (is_struct_or_union(lt))
2041 		return true;
2042 
2043 	if (lt == FUNC || lt == VOID || ltp->t_bitfield)
2044 		goto wrong;
2045 
2046 	/*
2047 	 * Some C dialects from before C90 tolerated any lvalue on the
2048 	 * left-hand side of the '.' operator, allowing things like
2049 	 * char st[100]; st.st_mtime, assuming that the member 'st_mtime'
2050 	 * only occurred in a single struct; see typeok_arrow.
2051 	 */
2052 	if (ln->tn_lvalue)
2053 		return true;
2054 
2055 wrong:
2056 	/* With allow_c90 we already got an error */
2057 	if (!allow_c90)
2058 		/* unacceptable operand of '%s' */
2059 		error(111, op_name(POINT));
2060 
2061 	return false;
2062 }
2063 
2064 static bool
2065 typeok_arrow(tspec_t lt)
2066 {
2067 	/*
2068 	 * C1978 Appendix A 14.1 says: <quote>In fact, any lvalue is allowed
2069 	 * before '.', and that lvalue is then assumed to have the form of
2070 	 * the structure of which the name of the right is a member. [...]
2071 	 * Such constructions are non-portable.</quote>
2072 	 */
2073 	if (lt == PTR || (!allow_c90 && is_integer(lt)))
2074 		return true;
2075 
2076 	/* With allow_c90 we already got an error */
2077 	if (!allow_c90)
2078 		/* unacceptable operand of '%s' */
2079 		error(111, op_name(ARROW));
2080 	return false;
2081 }
2082 
2083 static bool
2084 typeok_incdec(op_t op, const tnode_t *tn, const type_t *tp)
2085 {
2086 	/* operand has scalar type (checked in typeok) */
2087 	if (!tn->tn_lvalue) {
2088 		if (tn->tn_op == CVT && tn->tn_cast &&
2089 		    tn->tn_left->tn_op == LOAD) {
2090 			/* a cast does not yield an lvalue */
2091 			error(163);
2092 		}
2093 		/* %soperand of '%s' must be lvalue */
2094 		error(114, "", op_name(op));
2095 		return false;
2096 	}
2097 	if (tp->t_const && allow_c90) {
2098 		/* %soperand of '%s' must be modifiable lvalue */
2099 		warning(115, "", op_name(op));
2100 	}
2101 	return true;
2102 }
2103 
2104 static bool
2105 typeok_address(const mod_t *mp,
2106 	       const tnode_t *tn, const type_t *tp, tspec_t t)
2107 {
2108 	if (t == ARRAY || t == FUNC) {
2109 		/* ok, a warning comes later (in build_address()) */
2110 	} else if (!tn->tn_lvalue) {
2111 		if (tn->tn_op == CVT && tn->tn_cast &&
2112 		    tn->tn_left->tn_op == LOAD) {
2113 			/* a cast does not yield an lvalue */
2114 			error(163);
2115 		}
2116 		/* %soperand of '%s' must be lvalue */
2117 		error(114, "", mp->m_name);
2118 		return false;
2119 	} else if (is_scalar(t)) {
2120 		if (tp->t_bitfield) {
2121 			/* cannot take address of bit-field */
2122 			error(112);
2123 			return false;
2124 		}
2125 	} else if (t != STRUCT && t != UNION) {
2126 		/* unacceptable operand of '%s' */
2127 		error(111, mp->m_name);
2128 		return false;
2129 	}
2130 	if (tn->tn_op == NAME && tn->tn_sym->s_register) {
2131 		/* cannot take address of register '%s' */
2132 		error(113, tn->tn_sym->s_name);
2133 		return false;
2134 	}
2135 	return true;
2136 }
2137 
2138 static bool
2139 typeok_indir(const type_t *tp, tspec_t t)
2140 {
2141 
2142 	if (t != PTR) {
2143 		/* cannot dereference non-pointer type '%s' */
2144 		error(96, type_name(tp));
2145 		return false;
2146 	}
2147 	return true;
2148 }
2149 
2150 static void
2151 warn_incompatible_types(op_t op,
2152 			const type_t *ltp, tspec_t lt,
2153 			const type_t *rtp, tspec_t rt)
2154 {
2155 	const mod_t *mp = &modtab[op];
2156 
2157 	if (lt == VOID || (mp->m_binary && rt == VOID)) {
2158 		/* void type illegal in expression */
2159 		error(109);
2160 	} else if (op == ASSIGN) {
2161 		/* cannot assign to '%s' from '%s' */
2162 		error(171, type_name(ltp), type_name(rtp));
2163 	} else if (mp->m_binary) {
2164 		/* operands of '%s' have incompatible types '%s' and '%s' */
2165 		error(107, mp->m_name, tspec_name(lt), tspec_name(rt));
2166 	} else {
2167 		lint_assert(rt == NOTSPEC);
2168 		/* operand of '%s' has invalid type '%s' */
2169 		error(108, mp->m_name, type_name(ltp));
2170 	}
2171 }
2172 
2173 static bool
2174 typeok_plus(op_t op,
2175 	    const type_t *ltp, tspec_t lt,
2176 	    const type_t *rtp, tspec_t rt)
2177 {
2178 	/* operands have scalar types (checked in typeok) */
2179 	if ((lt == PTR && !is_integer(rt)) || (rt == PTR && !is_integer(lt))) {
2180 		warn_incompatible_types(op, ltp, lt, rtp, rt);
2181 		return false;
2182 	}
2183 	return true;
2184 }
2185 
2186 static bool
2187 typeok_minus(op_t op,
2188 	     const type_t *ltp, tspec_t lt,
2189 	     const type_t *rtp, tspec_t rt)
2190 {
2191 	/* operands have scalar types (checked in typeok) */
2192 	if ((lt == PTR && rt != PTR && !is_integer(rt)) ||
2193 	    (lt != PTR && rt == PTR)) {
2194 		warn_incompatible_types(op, ltp, lt, rtp, rt);
2195 		return false;
2196 	}
2197 	if (lt == PTR && rt == PTR &&
2198 	    !types_compatible(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
2199 		/* illegal pointer subtraction */
2200 		error(116);
2201 	}
2202 	return true;
2203 }
2204 
2205 static void
2206 typeok_shr(const mod_t *mp,
2207 	   const tnode_t *ln, tspec_t lt,
2208 	   const tnode_t *rn, tspec_t rt)
2209 {
2210 	tspec_t olt, ort;
2211 
2212 	olt = before_conversion(ln)->tn_type->t_tspec;
2213 	ort = before_conversion(rn)->tn_type->t_tspec;
2214 
2215 	/* operands have integer types (checked in typeok) */
2216 	if (pflag && !is_uinteger(olt)) {
2217 		integer_constraints lc = ic_expr(ln);
2218 		if (!ic_maybe_signed(ln->tn_type, &lc))
2219 			return;
2220 
2221 		/*
2222 		 * The left operand is signed. This means that
2223 		 * the operation is (possibly) nonportable.
2224 		 */
2225 		if (ln->tn_op != CON) {
2226 			/* bitwise '%s' on signed value possibly nonportable */
2227 			warning(117, mp->m_name);
2228 		} else if (ln->tn_val->v_quad < 0) {
2229 			/* bitwise '%s' on signed value nonportable */
2230 			warning(120, mp->m_name);
2231 		}
2232 	} else if (allow_trad && allow_c90 &&
2233 		   !is_uinteger(olt) && is_uinteger(ort)) {
2234 		/* The left operand would become unsigned in traditional C. */
2235 		if (hflag && (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
2236 			/* semantics of '%s' change in ANSI C; use ... */
2237 			warning(118, mp->m_name);
2238 		}
2239 	} else if (allow_trad && allow_c90 &&
2240 		   !is_uinteger(olt) && !is_uinteger(ort) &&
2241 		   portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
2242 		/*
2243 		 * In traditional C the left operand would be extended
2244 		 * (possibly sign-extended) and then shifted.
2245 		 */
2246 		if (hflag && (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
2247 			/* semantics of '%s' change in ANSI C; use ... */
2248 			warning(118, mp->m_name);
2249 		}
2250 	}
2251 }
2252 
2253 static void
2254 typeok_shl(const mod_t *mp, tspec_t lt, tspec_t rt)
2255 {
2256 	/*
2257 	 * C90 does not perform balancing for shift operations,
2258 	 * but traditional C does. If the width of the right operand
2259 	 * is greater than the width of the left operand, then in
2260 	 * traditional C the left operand would be extended to the
2261 	 * width of the right operand. For SHL this may result in
2262 	 * different results.
2263 	 */
2264 	if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
2265 		/*
2266 		 * XXX If both operands are constant, make sure
2267 		 * that there is really a difference between
2268 		 * ANSI C and traditional C.
2269 		 */
2270 		if (hflag && !allow_c99)
2271 			/* semantics of '%s' change in ANSI C; use ... */
2272 			warning(118, mp->m_name);
2273 	}
2274 }
2275 
2276 static void
2277 typeok_shift(const type_t *ltp, tspec_t lt, const tnode_t *rn, tspec_t rt)
2278 {
2279 	if (rn->tn_op != CON)
2280 		return;
2281 
2282 	if (!is_uinteger(rt) && rn->tn_val->v_quad < 0) {
2283 		/* negative shift */
2284 		warning(121);
2285 	} else if ((uint64_t)rn->tn_val->v_quad ==
2286 		   (uint64_t)size_in_bits(lt)) {
2287 		/* shift amount %u equals bit-size of '%s' */
2288 		warning(267, (unsigned)rn->tn_val->v_quad, type_name(ltp));
2289 	} else if ((uint64_t)rn->tn_val->v_quad > (uint64_t)size_in_bits(lt)) {
2290 		/* shift amount %llu is greater than bit-size %llu of '%s' */
2291 		warning(122, (unsigned long long)rn->tn_val->v_quad,
2292 		    (unsigned long long)size_in_bits(lt),
2293 		    tspec_name(lt));
2294 	}
2295 }
2296 
2297 static bool
2298 is_typeok_eq(const tnode_t *ln, tspec_t lt, const tnode_t *rn, tspec_t rt)
2299 {
2300 	if (lt == PTR && is_null_pointer(rn))
2301 		return true;
2302 	if (rt == PTR && is_null_pointer(ln))
2303 		return true;
2304 	return false;
2305 }
2306 
2307 /*
2308  * Called if incompatible pointer types are detected.
2309  * Print an appropriate warning.
2310  */
2311 static void
2312 warn_incompatible_pointers(const mod_t *mp,
2313 			   const type_t *ltp, const type_t *rtp)
2314 {
2315 	lint_assert(ltp->t_tspec == PTR);
2316 	lint_assert(rtp->t_tspec == PTR);
2317 
2318 	tspec_t lt = ltp->t_subt->t_tspec;
2319 	tspec_t rt = rtp->t_subt->t_tspec;
2320 
2321 	if (is_struct_or_union(lt) && is_struct_or_union(rt)) {
2322 		if (mp == NULL) {
2323 			/* illegal structure pointer combination */
2324 			warning(244);
2325 		} else {
2326 			/* incompatible structure pointers: '%s' '%s' '%s' */
2327 			warning(245, type_name(ltp), mp->m_name, type_name(rtp));
2328 		}
2329 	} else {
2330 		if (mp == NULL) {
2331 			/* illegal combination of '%s' and '%s' */
2332 			warning(184, type_name(ltp), type_name(rtp));
2333 		} else {
2334 			/* illegal combination of '%s' and '%s', op '%s' */
2335 			warning(124,
2336 			    type_name(ltp), type_name(rtp), mp->m_name);
2337 		}
2338 	}
2339 }
2340 
2341 static void
2342 check_pointer_comparison(op_t op, const tnode_t *ln, const tnode_t *rn)
2343 {
2344 	type_t *ltp = ln->tn_type, *rtp = rn->tn_type;
2345 	tspec_t lst = ltp->t_subt->t_tspec, rst = rtp->t_subt->t_tspec;
2346 
2347 	if (lst == VOID || rst == VOID) {
2348 		/* TODO: C99 behaves like C90 here. */
2349 		if ((!allow_trad && !allow_c99) &&
2350 		    (lst == FUNC || rst == FUNC)) {
2351 			/* (void *)0 is already handled in typeok() */
2352 			const char *lsts, *rsts;
2353 			*(lst == FUNC ? &lsts : &rsts) = "function pointer";
2354 			*(lst == VOID ? &lsts : &rsts) = "'void *'";
2355 			/* ANSI C forbids comparison of %s with %s */
2356 			warning(274, lsts, rsts);
2357 		}
2358 		return;
2359 	}
2360 
2361 	if (!types_compatible(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
2362 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
2363 		return;
2364 	}
2365 
2366 	if (lst == FUNC && rst == FUNC) {
2367 		/* TODO: C99 behaves like C90 here, see C99 6.5.8p2. */
2368 		if ((!allow_trad && !allow_c99) && op != EQ && op != NE)
2369 			/* ANSI C forbids ordered comparisons of ... */
2370 			warning(125);
2371 	}
2372 }
2373 
2374 static bool
2375 typeok_compare(op_t op,
2376 	       const tnode_t *ln, const type_t *ltp, tspec_t lt,
2377 	       const tnode_t *rn, const type_t *rtp, tspec_t rt)
2378 {
2379 	if (lt == PTR && rt == PTR) {
2380 		check_pointer_comparison(op, ln, rn);
2381 		return true;
2382 	}
2383 
2384 	if (lt != PTR && rt != PTR)
2385 		return true;
2386 
2387 	if (!is_integer(lt) && !is_integer(rt)) {
2388 		warn_incompatible_types(op, ltp, lt, rtp, rt);
2389 		return false;
2390 	}
2391 
2392 	const char *lx = lt == PTR ? "pointer" : "integer";
2393 	const char *rx = rt == PTR ? "pointer" : "integer";
2394 	/* illegal combination of %s '%s' and %s '%s', op '%s' */
2395 	warning(123, lx, type_name(ltp), rx, type_name(rtp), op_name(op));
2396 	return true;
2397 }
2398 
2399 static bool
2400 typeok_quest(tspec_t lt, const tnode_t *rn)
2401 {
2402 	if (!is_scalar(lt)) {
2403 		/* first operand must have scalar type, op ? : */
2404 		error(170);
2405 		return false;
2406 	}
2407 	lint_assert(before_conversion(rn)->tn_op == COLON);
2408 	return true;
2409 }
2410 
2411 static void
2412 typeok_colon_pointer(const mod_t *mp, const type_t *ltp, const type_t *rtp)
2413 {
2414 	type_t *lstp = ltp->t_subt;
2415 	type_t *rstp = rtp->t_subt;
2416 	tspec_t lst = lstp->t_tspec;
2417 	tspec_t rst = rstp->t_tspec;
2418 
2419 	if ((lst == VOID && rst == FUNC) || (lst == FUNC && rst == VOID)) {
2420 		/* (void *)0 is handled in typeok_colon */
2421 		/* TODO: C99 behaves like C90 here. */
2422 		if (!allow_trad && !allow_c99)
2423 			/* ANSI C forbids conversion of %s to %s, op %s */
2424 			warning(305, "function pointer", "'void *'",
2425 			    mp->m_name);
2426 		return;
2427 	}
2428 
2429 	if (pointer_types_are_compatible(lstp, rstp, true))
2430 		return;
2431 	if (!types_compatible(lstp, rstp, true, false, NULL))
2432 		warn_incompatible_pointers(mp, ltp, rtp);
2433 }
2434 
2435 static bool
2436 typeok_colon(const mod_t *mp,
2437 	     const tnode_t *ln, const type_t *ltp, tspec_t lt,
2438 	     const tnode_t *rn, const type_t *rtp, tspec_t rt)
2439 {
2440 
2441 	if (is_arithmetic(lt) && is_arithmetic(rt))
2442 		return true;
2443 	if (lt == BOOL && rt == BOOL)
2444 		return true;
2445 
2446 	if (lt == STRUCT && rt == STRUCT && ltp->t_sou == rtp->t_sou)
2447 		return true;
2448 	if (lt == UNION && rt == UNION && ltp->t_sou == rtp->t_sou)
2449 		return true;
2450 
2451 	if (lt == PTR && is_null_pointer(rn))
2452 		return true;
2453 	if (rt == PTR && is_null_pointer(ln))
2454 		return true;
2455 
2456 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
2457 		const char *lx = lt == PTR ? "pointer" : "integer";
2458 		const char *rx = rt == PTR ? "pointer" : "integer";
2459 		/* illegal combination of %s '%s' and %s '%s', op '%s' */
2460 		warning(123, lx, type_name(ltp),
2461 		    rx, type_name(rtp), mp->m_name);
2462 		return true;
2463 	}
2464 
2465 	if (lt == VOID || rt == VOID) {
2466 		if (lt != VOID || rt != VOID)
2467 			/* incompatible types '%s' and '%s' in conditional */
2468 			warning(126, type_name(ltp), type_name(rtp));
2469 		return true;
2470 	}
2471 
2472 	if (lt == PTR && rt == PTR) {
2473 		typeok_colon_pointer(mp, ltp, rtp);
2474 		return true;
2475 	}
2476 
2477 	/* incompatible types '%s' and '%s' in conditional */
2478 	error(126, type_name(ltp), type_name(rtp));
2479 	return false;
2480 }
2481 
2482 /*
2483  * Returns true if the given structure or union has a constant member
2484  * (maybe recursively).
2485  */
2486 static bool
2487 has_constant_member(const type_t *tp)
2488 {
2489 	lint_assert(is_struct_or_union(tp->t_tspec));
2490 
2491 	for (sym_t *m = tp->t_sou->sou_first_member;
2492 	     m != NULL; m = m->s_next) {
2493 		const type_t *mtp = m->s_type;
2494 		if (mtp->t_const)
2495 			return true;
2496 		if (is_struct_or_union(mtp->t_tspec) &&
2497 		    has_constant_member(mtp))
2498 			return true;
2499 	}
2500 	return false;
2501 }
2502 
2503 static bool
2504 typeok_assign(op_t op, const tnode_t *ln, const type_t *ltp, tspec_t lt)
2505 {
2506 	if (op == RETURN || op == INIT || op == FARG)
2507 		return true;
2508 
2509 	if (!ln->tn_lvalue) {
2510 		if (ln->tn_op == CVT && ln->tn_cast &&
2511 		    ln->tn_left->tn_op == LOAD) {
2512 			/* a cast does not yield an lvalue */
2513 			error(163);
2514 		}
2515 		/* %soperand of '%s' must be lvalue */
2516 		error(114, "left ", op_name(op));
2517 		return false;
2518 	} else if (ltp->t_const || (is_struct_or_union(lt) &&
2519 				    has_constant_member(ltp))) {
2520 		if (allow_c90)
2521 			/* %soperand of '%s' must be modifiable lvalue */
2522 			warning(115, "left ", op_name(op));
2523 	}
2524 	return true;
2525 }
2526 
2527 /* Check the types using the information from modtab[]. */
2528 static bool
2529 typeok_scalar(op_t op, const mod_t *mp,
2530 	      const type_t *ltp, tspec_t lt,
2531 	      const type_t *rtp, tspec_t rt)
2532 {
2533 	if (mp->m_takes_bool && lt == BOOL && rt == BOOL)
2534 		return true;
2535 	if (mp->m_requires_integer) {
2536 		if (!is_integer(lt) || (mp->m_binary && !is_integer(rt))) {
2537 			warn_incompatible_types(op, ltp, lt, rtp, rt);
2538 			return false;
2539 		}
2540 	} else if (mp->m_requires_integer_or_complex) {
2541 		if ((!is_integer(lt) && !is_complex(lt)) ||
2542 		    (mp->m_binary && (!is_integer(rt) && !is_complex(rt)))) {
2543 			warn_incompatible_types(op, ltp, lt, rtp, rt);
2544 			return false;
2545 		}
2546 	} else if (mp->m_requires_scalar) {
2547 		if (!is_scalar(lt) || (mp->m_binary && !is_scalar(rt))) {
2548 			warn_incompatible_types(op, ltp, lt, rtp, rt);
2549 			return false;
2550 		}
2551 	} else if (mp->m_requires_arith) {
2552 		if (!is_arithmetic(lt) ||
2553 		    (mp->m_binary && !is_arithmetic(rt))) {
2554 			warn_incompatible_types(op, ltp, lt, rtp, rt);
2555 			return false;
2556 		}
2557 	}
2558 	return true;
2559 }
2560 
2561 static void
2562 check_assign_void_pointer(op_t op, int arg,
2563 			  tspec_t lt, tspec_t lst,
2564 			  tspec_t rt, tspec_t rst)
2565 {
2566 
2567 	if (!(lt == PTR && rt == PTR && (lst == VOID || rst == VOID)))
2568 		return;
2569 	/* two pointers, at least one pointer to void */
2570 
2571 	/* TODO: C99 behaves like C90 here. */
2572 	if (!((!allow_trad && !allow_c99) && (lst == FUNC || rst == FUNC)))
2573 		return;
2574 	/* comb. of ptr to func and ptr to void */
2575 
2576 	const char *lts, *rts;
2577 	*(lst == FUNC ? &lts : &rts) = "function pointer";
2578 	*(lst == VOID ? &lts : &rts) = "'void *'";
2579 
2580 	switch (op) {
2581 	case INIT:
2582 	case RETURN:
2583 		/* ANSI C forbids conversion of %s to %s */
2584 		warning(303, rts, lts);
2585 		break;
2586 	case FARG:
2587 		/* ANSI C forbids conversion of %s to %s, arg #%d */
2588 		warning(304, rts, lts, arg);
2589 		break;
2590 	default:
2591 		/* ANSI C forbids conversion of %s to %s, op %s */
2592 		warning(305, rts, lts, op_name(op));
2593 		break;
2594 	}
2595 }
2596 
2597 static bool
2598 is_direct_function_call(const tnode_t *tn, const char **out_name)
2599 {
2600 
2601 	if (!(tn->tn_op == CALL &&
2602 	      tn->tn_left->tn_op == ADDR &&
2603 	      tn->tn_left->tn_left->tn_op == NAME))
2604 		return false;
2605 
2606 	*out_name = tn->tn_left->tn_left->tn_sym->s_name;
2607 	return true;
2608 }
2609 
2610 static bool
2611 is_unconst_function(const char *name)
2612 {
2613 
2614 	return strcmp(name, "memchr") == 0 ||
2615 	       strcmp(name, "strchr") == 0 ||
2616 	       strcmp(name, "strpbrk") == 0 ||
2617 	       strcmp(name, "strrchr") == 0 ||
2618 	       strcmp(name, "strstr") == 0;
2619 }
2620 
2621 static bool
2622 is_const_char_pointer(const tnode_t *tn)
2623 {
2624 	/*
2625 	 * For traditional reasons, C99 6.4.5p5 defines that string literals
2626 	 * have type 'char[]'.  They are often implicitly converted to
2627 	 * 'char *', for example when they are passed as function arguments.
2628 	 *
2629 	 * C99 6.4.5p6 further defines that modifying a string that is
2630 	 * constructed from a string literal invokes undefined behavior.
2631 	 *
2632 	 * Out of these reasons, string literals are treated as 'effectively
2633 	 * const' here.
2634 	 */
2635 	if (tn->tn_op == CVT &&
2636 	    tn->tn_left->tn_op == ADDR &&
2637 	    tn->tn_left->tn_left->tn_op == STRING)
2638 		return true;
2639 
2640 	const type_t *tp = before_conversion(tn)->tn_type;
2641 	return tp->t_tspec == PTR &&
2642 	       tp->t_subt->t_tspec == CHAR &&
2643 	       tp->t_subt->t_const;
2644 }
2645 
2646 static bool
2647 is_first_arg_const_char_pointer(const tnode_t *tn)
2648 {
2649 	const tnode_t *an = tn->tn_right;
2650 	if (an == NULL)
2651 		return false;
2652 
2653 	while (an->tn_right != NULL)
2654 		an = an->tn_right;
2655 	return is_const_char_pointer(an->tn_left);
2656 }
2657 
2658 static bool
2659 is_const_pointer(const tnode_t *tn)
2660 {
2661 	const type_t *tp = before_conversion(tn)->tn_type;
2662 	return tp->t_tspec == PTR && tp->t_subt->t_const;
2663 }
2664 
2665 static bool
2666 is_second_arg_const_pointer(const tnode_t *tn)
2667 {
2668 	const tnode_t *an = tn->tn_right;
2669 	if (an == NULL || an->tn_right == NULL)
2670 		return false;
2671 
2672 	while (an->tn_right->tn_right != NULL)
2673 		an = an->tn_right;
2674 	return is_const_pointer(an->tn_left);
2675 }
2676 
2677 static void
2678 check_unconst_function(const type_t *lstp, const tnode_t *rn)
2679 {
2680 	const char *function_name;
2681 
2682 	if (lstp->t_tspec == CHAR && !lstp->t_const &&
2683 	    is_direct_function_call(rn, &function_name) &&
2684 	    is_unconst_function(function_name) &&
2685 	    is_first_arg_const_char_pointer(rn)) {
2686 		/* call to '%s' effectively discards 'const' from argument */
2687 		warning(346, function_name);
2688 	}
2689 
2690 	if (!lstp->t_const &&
2691 	    is_direct_function_call(rn, &function_name) &&
2692 	    strcmp(function_name, "bsearch") == 0 &&
2693 	    is_second_arg_const_pointer(rn)) {
2694 		/* call to '%s' effectively discards 'const' from argument */
2695 		warning(346, function_name);
2696 	}
2697 }
2698 
2699 static bool
2700 check_assign_void_pointer_compat(op_t op, int arg,
2701 				 const type_t *const ltp, tspec_t const lt,
2702 				 const type_t *const lstp, tspec_t const lst,
2703 				 const tnode_t *const rn,
2704 				 const type_t *const rtp, tspec_t const rt,
2705 				 const type_t *const rstp, tspec_t const rst)
2706 {
2707 	if (!(lt == PTR && rt == PTR && (lst == VOID || rst == VOID ||
2708 					 types_compatible(lstp, rstp,
2709 					     true, false, NULL))))
2710 		return false;
2711 
2712 	/* compatible pointer types (qualifiers ignored) */
2713 	if (allow_c90 &&
2714 	    ((!lstp->t_const && rstp->t_const) ||
2715 	     (!lstp->t_volatile && rstp->t_volatile))) {
2716 		/* left side has not all qualifiers of right */
2717 		switch (op) {
2718 		case INIT:
2719 		case RETURN:
2720 			/* incompatible pointer types to '%s' and '%s' */
2721 			warning(182, type_name(lstp), type_name(rstp));
2722 			break;
2723 		case FARG:
2724 			/* converting '%s' to incompatible '%s' ... */
2725 			warning(153,
2726 			    type_name(rtp), type_name(ltp), arg);
2727 			break;
2728 		default:
2729 			/* operands of '%s' have incompatible pointer ... */
2730 			warning(128, op_name(op),
2731 			    type_name(lstp), type_name(rstp));
2732 			break;
2733 		}
2734 	}
2735 
2736 	if (allow_c90)
2737 		check_unconst_function(lstp, rn);
2738 
2739 	return true;
2740 }
2741 
2742 static bool
2743 check_assign_pointer_integer(op_t op, int arg,
2744 			     const type_t *const ltp, tspec_t const lt,
2745 			     const type_t *const rtp, tspec_t const rt)
2746 {
2747 	const char *lx, *rx;
2748 
2749 	if (!((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)))
2750 		return false;
2751 
2752 	lx = lt == PTR ? "pointer" : "integer";
2753 	rx = rt == PTR ? "pointer" : "integer";
2754 
2755 	switch (op) {
2756 	case INIT:
2757 	case RETURN:
2758 		/* illegal combination of %s '%s' and %s '%s' */
2759 		warning(183, lx, type_name(ltp), rx, type_name(rtp));
2760 		break;
2761 	case FARG:
2762 		/* illegal combination of %s '%s' and %s '%s', arg #%d */
2763 		warning(154,
2764 		    lx, type_name(ltp), rx, type_name(rtp), arg);
2765 		break;
2766 	default:
2767 		/* illegal combination of %s '%s' and %s '%s', op '%s' */
2768 		warning(123,
2769 		    lx, type_name(ltp), rx, type_name(rtp), op_name(op));
2770 		break;
2771 	}
2772 	return true;
2773 }
2774 
2775 static bool
2776 check_assign_pointer(op_t op, int arg,
2777 		     const type_t *ltp, tspec_t lt,
2778 		     const type_t *rtp, tspec_t rt)
2779 {
2780 	if (!(lt == PTR && rt == PTR))
2781 		return false;
2782 
2783 	switch (op) {
2784 	case RETURN:
2785 		warn_incompatible_pointers(NULL, ltp, rtp);
2786 		break;
2787 	case FARG:
2788 		/* converting '%s' to incompatible '%s' for ... */
2789 		warning(153, type_name(rtp), type_name(ltp), arg);
2790 		break;
2791 	default:
2792 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
2793 		break;
2794 	}
2795 	return true;
2796 }
2797 
2798 static void
2799 warn_assign(op_t op, int arg,
2800 	    const type_t *ltp, tspec_t lt,
2801 	    const type_t *rtp, tspec_t rt)
2802 {
2803 	switch (op) {
2804 	case INIT:
2805 		/* cannot initialize '%s' from '%s' */
2806 		error(185, type_name(ltp), type_name(rtp));
2807 		break;
2808 	case RETURN:
2809 		/* function has return type '%s' but returns '%s' */
2810 		error(211, type_name(ltp), type_name(rtp));
2811 		break;
2812 	case FARG:
2813 		/* passing '%s' to incompatible '%s', arg #%d */
2814 		warning(155, type_name(rtp), type_name(ltp), arg);
2815 		break;
2816 	default:
2817 		warn_incompatible_types(op, ltp, lt, rtp, rt);
2818 		break;
2819 	}
2820 }
2821 
2822 /*
2823  * Checks type compatibility for ASSIGN, INIT, FARG and RETURN
2824  * and prints warnings/errors if necessary.
2825  * Returns whether the types are (almost) compatible.
2826  */
2827 static bool
2828 check_assign_types_compatible(op_t op, int arg,
2829 			      const tnode_t *ln, const tnode_t *rn)
2830 {
2831 	tspec_t	lt, rt, lst = NOTSPEC, rst = NOTSPEC;
2832 	type_t	*ltp, *rtp, *lstp = NULL, *rstp = NULL;
2833 
2834 	if ((lt = (ltp = ln->tn_type)->t_tspec) == PTR)
2835 		lst = (lstp = ltp->t_subt)->t_tspec;
2836 	if ((rt = (rtp = rn->tn_type)->t_tspec) == PTR)
2837 		rst = (rstp = rtp->t_subt)->t_tspec;
2838 
2839 	if (lt == BOOL && is_scalar(rt))	/* C99 6.3.1.2 */
2840 		return true;
2841 
2842 	if (is_arithmetic(lt) && (is_arithmetic(rt) || rt == BOOL))
2843 		return true;
2844 
2845 	if (is_struct_or_union(lt) && is_struct_or_union(rt))
2846 		/* both are struct or union */
2847 		return ltp->t_sou == rtp->t_sou;
2848 
2849 	/* a null pointer may be assigned to any pointer */
2850 	if (lt == PTR && is_null_pointer(rn))
2851 		return true;
2852 
2853 	check_assign_void_pointer(op, arg, lt, lst, rt, rst);
2854 
2855 	if (check_assign_void_pointer_compat(op, arg,
2856 	    ltp, lt, lstp, lst, rn, rtp, rt, rstp, rst))
2857 		return true;
2858 
2859 	if (check_assign_pointer_integer(op, arg, ltp, lt, rtp, rt))
2860 		return true;
2861 
2862 	if (check_assign_pointer(op, arg, ltp, lt, rtp, rt))
2863 		return true;
2864 
2865 	warn_assign(op, arg, ltp, lt, rtp, rt);
2866 	return false;
2867 }
2868 
2869 static bool
2870 has_side_effect(const tnode_t *tn) /* NOLINT(misc-no-recursion) */
2871 {
2872 	op_t op = tn->tn_op;
2873 
2874 	if (modtab[op].m_has_side_effect)
2875 		return true;
2876 
2877 	if (op == CVT && tn->tn_type->t_tspec == VOID)
2878 		return has_side_effect(tn->tn_left);
2879 
2880 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
2881 	if (op == LOGAND || op == LOGOR)
2882 		return has_side_effect(tn->tn_right);
2883 
2884 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
2885 	if (op == QUEST)
2886 		return has_side_effect(tn->tn_right);
2887 
2888 	if (op == COLON || op == COMMA) {
2889 		return has_side_effect(tn->tn_left) ||
2890 		       has_side_effect(tn->tn_right);
2891 	}
2892 
2893 	return false;
2894 }
2895 
2896 static bool
2897 is_void_cast(const tnode_t *tn)
2898 {
2899 
2900 	return tn->tn_op == CVT && tn->tn_cast &&
2901 	       tn->tn_type->t_tspec == VOID;
2902 }
2903 
2904 static bool
2905 is_local_symbol(const tnode_t *tn)
2906 {
2907 
2908 	return tn->tn_op == LOAD &&
2909 	       tn->tn_left->tn_op == NAME &&
2910 	       tn->tn_left->tn_sym->s_scl == AUTO;
2911 }
2912 
2913 static bool
2914 is_int_constant_zero(const tnode_t *tn)
2915 {
2916 
2917 	return tn->tn_op == CON &&
2918 	       tn->tn_type->t_tspec == INT &&
2919 	       tn->tn_val->v_quad == 0;
2920 }
2921 
2922 static void
2923 check_null_effect(const tnode_t *tn)
2924 {
2925 
2926 	if (hflag &&
2927 	    !has_side_effect(tn) &&
2928 	    !(is_void_cast(tn) && is_local_symbol(tn->tn_left)) &&
2929 	    !(is_void_cast(tn) && is_int_constant_zero(tn->tn_left))) {
2930 		/* expression has null effect */
2931 		warning(129);
2932 	}
2933 }
2934 
2935 /*
2936  * Check the types for specific operators and type combinations.
2937  *
2938  * At this point, the operands already conform to the type requirements of
2939  * the operator, such as being integer, floating or scalar.
2940  */
2941 static bool
2942 typeok_op(op_t op, const mod_t *mp, int arg,
2943 	  const tnode_t *ln, const type_t *ltp, tspec_t lt,
2944 	  const tnode_t *rn, const type_t *rtp, tspec_t rt)
2945 {
2946 	switch (op) {
2947 	case ARROW:
2948 		return typeok_arrow(lt);
2949 	case POINT:
2950 		return typeok_point(ln, ltp, lt);
2951 	case INCBEF:
2952 	case DECBEF:
2953 	case INCAFT:
2954 	case DECAFT:
2955 		return typeok_incdec(op, ln, ltp);
2956 	case INDIR:
2957 		return typeok_indir(ltp, lt);
2958 	case ADDR:
2959 		return typeok_address(mp, ln, ltp, lt);
2960 	case PLUS:
2961 		return typeok_plus(op, ltp, lt, rtp, rt);
2962 	case MINUS:
2963 		return typeok_minus(op, ltp, lt, rtp, rt);
2964 	case SHL:
2965 		typeok_shl(mp, lt, rt);
2966 		goto shift;
2967 	case SHR:
2968 		typeok_shr(mp, ln, lt, rn, rt);
2969 	shift:
2970 		typeok_shift(ltp, lt, rn, rt);
2971 		break;
2972 	case LT:
2973 	case LE:
2974 	case GT:
2975 	case GE:
2976 	compare:
2977 		return typeok_compare(op, ln, ltp, lt, rn, rtp, rt);
2978 	case EQ:
2979 	case NE:
2980 		if (is_typeok_eq(ln, lt, rn, rt))
2981 			break;
2982 		goto compare;
2983 	case QUEST:
2984 		return typeok_quest(lt, rn);
2985 	case COLON:
2986 		return typeok_colon(mp, ln, ltp, lt, rn, rtp, rt);
2987 	case ASSIGN:
2988 	case INIT:
2989 	case FARG:
2990 	case RETURN:
2991 		if (!check_assign_types_compatible(op, arg, ln, rn))
2992 			return false;
2993 		goto assign;
2994 	case MULASS:
2995 	case DIVASS:
2996 	case MODASS:
2997 		goto assign;
2998 	case ADDASS:
2999 	case SUBASS:
3000 		if ((lt == PTR && !is_integer(rt)) || rt == PTR) {
3001 			warn_incompatible_types(op, ltp, lt, rtp, rt);
3002 			return false;
3003 		}
3004 		goto assign;
3005 	case SHLASS:
3006 		goto assign;
3007 	case SHRASS:
3008 		if (pflag && !is_uinteger(lt) &&
3009 		    !(!allow_c90 && is_uinteger(rt))) {
3010 			/* bitwise '%s' on signed value possibly nonportable */
3011 			warning(117, mp->m_name);
3012 		}
3013 		goto assign;
3014 	case ANDASS:
3015 	case XORASS:
3016 	case ORASS:
3017 	assign:
3018 		return typeok_assign(op, ln, ltp, lt);
3019 	case COMMA:
3020 		if (!modtab[ln->tn_op].m_has_side_effect)
3021 			check_null_effect(ln);
3022 		break;
3023 	default:
3024 		break;
3025 	}
3026 	return true;
3027 }
3028 
3029 /* Prints a warning if a strange operator is used on an enum type. */
3030 static void
3031 check_bad_enum_operation(op_t op, const tnode_t *ln, const tnode_t *rn)
3032 {
3033 
3034 	if (!eflag)
3035 		return;
3036 
3037 	/*
3038 	 * Enum as offset to a pointer is an exception (otherwise enums
3039 	 * could not be used as array indices).
3040 	 */
3041 	if (op == PLUS &&
3042 	    ((ln->tn_type->t_is_enum && rn->tn_type->t_tspec == PTR) ||
3043 	     (rn->tn_type->t_is_enum && ln->tn_type->t_tspec == PTR))) {
3044 		return;
3045 	}
3046 
3047 	/* dubious operation on enum, op '%s' */
3048 	warning(241, op_name(op));
3049 }
3050 
3051 /*
3052  * Prints a warning if an operator is applied to two different enum types.
3053  */
3054 static void
3055 check_enum_type_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
3056 {
3057 	const mod_t *mp = &modtab[op];
3058 
3059 	if (ln->tn_type->t_enum != rn->tn_type->t_enum) {
3060 		switch (op) {
3061 		case INIT:
3062 			/* enum type mismatch between '%s' and '%s' in ... */
3063 			warning(210,
3064 			    type_name(ln->tn_type), type_name(rn->tn_type));
3065 			break;
3066 		case FARG:
3067 			/* function expects '%s', passing '%s' for arg #%d */
3068 			warning(156,
3069 			    type_name(ln->tn_type), type_name(rn->tn_type),
3070 			    arg);
3071 			break;
3072 		case RETURN:
3073 			/* function has return type '%s' but returns '%s' */
3074 			warning(211,
3075 			    type_name(ln->tn_type), type_name(rn->tn_type));
3076 			break;
3077 		default:
3078 			/* enum type mismatch: '%s' '%s' '%s' */
3079 			warning(130, type_name(ln->tn_type), mp->m_name,
3080 			    type_name(rn->tn_type));
3081 			break;
3082 		}
3083 	} else if (Pflag && mp->m_comparison && op != EQ && op != NE) {
3084 		if (eflag)
3085 			/* dubious comparison of enums, op '%s' */
3086 			warning(243, mp->m_name);
3087 	}
3088 }
3089 
3090 /* Prints a warning if the operands mix between enum and integer. */
3091 static void
3092 check_enum_int_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
3093 {
3094 
3095 	if (!eflag)
3096 		return;
3097 
3098 	switch (op) {
3099 	case INIT:
3100 		/*
3101 		 * Initialization with 0 is allowed. Otherwise, all implicit
3102 		 * initializations would need to be warned upon as well.
3103 		 */
3104 		if (!rn->tn_type->t_is_enum && rn->tn_op == CON &&
3105 		    is_integer(rn->tn_type->t_tspec) &&
3106 		    rn->tn_val->v_quad == 0) {
3107 			return;
3108 		}
3109 		/* initialization of '%s' with '%s' */
3110 		warning(277, type_name(ln->tn_type), type_name(rn->tn_type));
3111 		break;
3112 	case FARG:
3113 		/* combination of '%s' and '%s', arg #%d */
3114 		warning(278,
3115 		    type_name(ln->tn_type), type_name(rn->tn_type), arg);
3116 		break;
3117 	case RETURN:
3118 		/* combination of '%s' and '%s' in return */
3119 		warning(279, type_name(ln->tn_type), type_name(rn->tn_type));
3120 		break;
3121 	default:
3122 		/* combination of '%s' and '%s', op '%s' */
3123 		warning(242, type_name(ln->tn_type), type_name(rn->tn_type),
3124 		    op_name(op));
3125 		break;
3126 	}
3127 }
3128 
3129 static void
3130 typeok_enum(op_t op, const mod_t *mp, int arg,
3131 	    const tnode_t *ln, const type_t *ltp,
3132 	    const tnode_t *rn, const type_t *rtp)
3133 {
3134 	if (mp->m_bad_on_enum &&
3135 	    (ltp->t_is_enum || (mp->m_binary && rtp->t_is_enum))) {
3136 		check_bad_enum_operation(op, ln, rn);
3137 	} else if (mp->m_valid_on_enum &&
3138 		   (ltp->t_is_enum && rtp != NULL && rtp->t_is_enum)) {
3139 		check_enum_type_mismatch(op, arg, ln, rn);
3140 	} else if (mp->m_valid_on_enum &&
3141 		   (ltp->t_is_enum || (rtp != NULL && rtp->t_is_enum))) {
3142 		check_enum_int_mismatch(op, arg, ln, rn);
3143 	}
3144 }
3145 
3146 /* Perform most type checks. Return whether the types are ok. */
3147 bool
3148 typeok(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
3149 {
3150 	tspec_t	lt, rt;
3151 	type_t	*ltp, *rtp;
3152 
3153 	const mod_t *mp = &modtab[op];
3154 
3155 	lint_assert((ltp = ln->tn_type) != NULL);
3156 	lt = ltp->t_tspec;
3157 
3158 	if (mp->m_binary) {
3159 		lint_assert((rtp = rn->tn_type) != NULL);
3160 		rt = rtp->t_tspec;
3161 	} else {
3162 		rtp = NULL;
3163 		rt = NOTSPEC;
3164 	}
3165 
3166 	if (Tflag && !typeok_scalar_strict_bool(op, mp, arg, ln, rn))
3167 		return false;
3168 	if (!typeok_scalar(op, mp, ltp, lt, rtp, rt))
3169 		return false;
3170 
3171 	if (!typeok_op(op, mp, arg, ln, ltp, lt, rn, rtp, rt))
3172 		return false;
3173 
3174 	typeok_enum(op, mp, arg, ln, ltp, rn, rtp);
3175 	return true;
3176 }
3177 
3178 /* In traditional C, keep unsigned and promote FLOAT to DOUBLE. */
3179 static tspec_t
3180 promote_trad(tspec_t t)
3181 {
3182 
3183 	if (t == UCHAR || t == USHORT)
3184 		return UINT;
3185 	if (t == CHAR || t == SCHAR || t == SHORT)
3186 		return INT;
3187 	if (t == FLOAT)
3188 		return DOUBLE;
3189 	if (t == ENUM)
3190 		return INT;
3191 	return t;
3192 }
3193 
3194 /*
3195  * C99 6.3.1.1p2 requires for types with lower rank than int that "If an int
3196  * can represent all the values of the original type, the value is converted
3197  * to an int; otherwise it is converted to an unsigned int", and that "All
3198  * other types are unchanged by the integer promotions".
3199  */
3200 static tspec_t
3201 promote_c90(const tnode_t *tn, tspec_t t, bool farg)
3202 {
3203 	if (tn->tn_type->t_bitfield) {
3204 		unsigned int len = tn->tn_type->t_flen;
3205 		if (len < size_in_bits(INT))
3206 			return INT;
3207 		if (len == size_in_bits(INT))
3208 			return is_uinteger(t) ? UINT : INT;
3209 		return t;
3210 	}
3211 
3212 	if (t == CHAR || t == SCHAR)
3213 		return INT;
3214 	if (t == UCHAR)
3215 		return size_in_bits(CHAR) < size_in_bits(INT) ? INT : UINT;
3216 	if (t == SHORT)
3217 		return INT;
3218 	if (t == USHORT)
3219 		return size_in_bits(SHORT) < size_in_bits(INT) ? INT : UINT;
3220 	if (t == ENUM)
3221 		return INT;
3222 	if (farg && t == FLOAT)
3223 		return DOUBLE;
3224 	return t;
3225 }
3226 
3227 /*
3228  * Performs the "integer promotions" (C99 6.3.1.1p2), which convert small
3229  * integer types to either int or unsigned int.
3230  *
3231  * If allow_c90 is unset or the operand is a function argument with no type
3232  * information (no prototype or variable # of args), converts float to double.
3233  */
3234 tnode_t *
3235 promote(op_t op, bool farg, tnode_t *tn)
3236 {
3237 
3238 	tspec_t ot = tn->tn_type->t_tspec;
3239 	if (!is_arithmetic(ot))
3240 		return tn;
3241 
3242 	tspec_t nt = allow_c90 ? promote_c90(tn, ot, farg) : promote_trad(ot);
3243 	if (nt == ot)
3244 		return tn;
3245 
3246 	type_t *ntp = expr_dup_type(tn->tn_type);
3247 	ntp->t_tspec = nt;
3248 	/*
3249 	 * Keep t_is_enum even though t_tspec gets converted from
3250 	 * ENUM to INT, so we are later able to check compatibility
3251 	 * of enum types.
3252 	 */
3253 	return convert(op, 0, ntp, tn);
3254 }
3255 
3256 static void
3257 convert_integer_from_floating(op_t op, const type_t *tp, const tnode_t *tn)
3258 {
3259 
3260 	if (op == CVT)
3261 		/* cast from floating point '%s' to integer '%s' */
3262 		query_message(2, type_name(tn->tn_type), type_name(tp));
3263 	else
3264 		/* implicit conversion from floating point '%s' to ... */
3265 		query_message(1, type_name(tn->tn_type), type_name(tp));
3266 }
3267 
3268 static bool
3269 should_warn_about_prototype_conversion(tspec_t nt,
3270 				       tspec_t ot, const tnode_t *ptn)
3271 {
3272 
3273 	if (nt == ot)
3274 		return false;
3275 
3276 	if (nt == ENUM && ot == INT)
3277 		return false;
3278 
3279 	if (is_floating(nt) != is_floating(ot) ||
3280 	    portable_size_in_bits(nt) != portable_size_in_bits(ot)) {
3281 		/* representation and/or width change */
3282 		if (!is_integer(ot))
3283 			return true;
3284 		/*
3285 		 * XXX: Investigate whether this rule makes sense; see
3286 		 * tests/usr.bin/xlint/lint1/platform_long.c.
3287 		 */
3288 		return portable_size_in_bits(ot) > portable_size_in_bits(INT);
3289 	}
3290 
3291 	if (!hflag)
3292 		return false;
3293 
3294 	/*
3295 	 * If the types differ only in sign and the argument has the same
3296 	 * representation in both types, print no warning.
3297 	 */
3298 	if (ptn->tn_op == CON && is_integer(nt) &&
3299 	    signed_type(nt) == signed_type(ot) &&
3300 	    !msb(ptn->tn_val->v_quad, ot))
3301 		return false;
3302 
3303 	return true;
3304 }
3305 
3306 /*
3307  * Warn if a prototype causes a type conversion that is different from what
3308  * would happen to the same argument in the absence of a prototype.  This
3309  * check is intended for code that needs to stay compatible with pre-C90 C.
3310  *
3311  * Errors/warnings about illegal type combinations are already printed
3312  * in check_assign_types_compatible().
3313  */
3314 static void
3315 check_prototype_conversion(int arg, tspec_t nt, tspec_t ot, type_t *tp,
3316 			   tnode_t *tn)
3317 {
3318 
3319 	if (!is_arithmetic(nt) || !is_arithmetic(ot))
3320 		return;
3321 
3322 	/*
3323 	 * If the type of the formal parameter is char/short, a warning
3324 	 * would be useless, because functions declared the old style
3325 	 * can't expect char/short arguments.
3326 	 */
3327 	if (nt == CHAR || nt == SCHAR || nt == UCHAR ||
3328 	    nt == SHORT || nt == USHORT)
3329 		return;
3330 
3331 	/* apply the default promotion */
3332 	tnode_t *ptn = promote(NOOP, true, tn);
3333 	ot = ptn->tn_type->t_tspec;
3334 
3335 	if (should_warn_about_prototype_conversion(nt, ot, ptn)) {
3336 		/* argument #%d is converted from '%s' to '%s' ... */
3337 		warning(259, arg, type_name(tn->tn_type), type_name(tp));
3338 	}
3339 }
3340 
3341 /*
3342  * When converting a large integer type to a small integer type, in some
3343  * cases the value of the actual expression is further restricted than the
3344  * type bounds, such as in (expr & 0xFF) or (expr % 100) or (expr >> 24).
3345  */
3346 static bool
3347 can_represent(const type_t *tp, const tnode_t *tn)
3348 {
3349 
3350 	debug_step("%s: type '%s'", __func__, type_name(tp));
3351 	debug_node(tn);
3352 
3353 	uint64_t nmask = value_bits(width_in_bits(tp));
3354 	if (!is_uinteger(tp->t_tspec))
3355 		nmask >>= 1;
3356 
3357 	integer_constraints c = ic_expr(tn);
3358 	if ((~c.bclr & ~nmask) == 0)
3359 		return true;
3360 
3361 	return false;
3362 }
3363 
3364 static void
3365 convert_integer_from_integer(op_t op, int arg, tspec_t nt, tspec_t ot,
3366 			     type_t *tp, tnode_t *tn)
3367 {
3368 
3369 	if (tn->tn_op == CON)
3370 		return;
3371 
3372 	if (op == CVT)
3373 		return;
3374 
3375 	if (Pflag && pflag && aflag > 0 &&
3376 	    portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
3377 	    is_uinteger(nt) != is_uinteger(ot)) {
3378 		if (op == FARG) {
3379 			/* conversion to '%s' may sign-extend ... */
3380 			warning(297, type_name(tp), arg);
3381 		} else {
3382 			/* conversion to '%s' may sign-extend ... */
3383 			warning(131, type_name(tp));
3384 		}
3385 	}
3386 
3387 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
3388 	    (tn->tn_op == PLUS || tn->tn_op == MINUS || tn->tn_op == MULT ||
3389 	     tn->tn_op == SHL)) {
3390 		/* suggest cast from '%s' to '%s' on op '%s' to ... */
3391 		warning(324, type_name(gettyp(ot)), type_name(tp),
3392 		    op_name(tn->tn_op));
3393 	}
3394 
3395 	if (aflag > 0 &&
3396 	    portable_size_in_bits(nt) < portable_size_in_bits(ot) &&
3397 	    (ot == LONG || ot == ULONG || ot == QUAD || ot == UQUAD ||
3398 	     aflag > 1) &&
3399 	    !can_represent(tp, tn)) {
3400 		if (op == FARG) {
3401 			/* conversion from '%s' to '%s' may lose ... */
3402 			warning(298,
3403 			    type_name(tn->tn_type), type_name(tp), arg);
3404 		} else {
3405 			/* conversion from '%s' to '%s' may lose accuracy */
3406 			warning(132,
3407 			    type_name(tn->tn_type), type_name(tp));
3408 		}
3409 	}
3410 
3411 	if (is_uinteger(nt) != is_uinteger(ot))
3412 		/* implicit conversion changes sign from '%s' to '%s' */
3413 		query_message(3, type_name(tn->tn_type), type_name(tp));
3414 }
3415 
3416 static void
3417 convert_integer_from_pointer(op_t op, tspec_t nt, type_t *tp, tnode_t *tn)
3418 {
3419 
3420 	if (tn->tn_op == CON)
3421 		return;
3422 	if (op != CVT)
3423 		return;		/* We already got an error. */
3424 	if (portable_size_in_bits(nt) >= portable_size_in_bits(PTR))
3425 		return;
3426 
3427 	if (pflag && size_in_bits(nt) >= size_in_bits(PTR)) {
3428 		/* conversion of pointer to '%s' may lose bits */
3429 		warning(134, type_name(tp));
3430 	} else {
3431 		/* conversion of pointer to '%s' loses bits */
3432 		warning(133, type_name(tp));
3433 	}
3434 }
3435 
3436 static bool
3437 struct_starts_with(const type_t *struct_tp, const type_t *member_tp)
3438 {
3439 
3440 	return struct_tp->t_sou->sou_first_member != NULL &&
3441 	       types_compatible(struct_tp->t_sou->sou_first_member->s_type,
3442 		   member_tp, true, false, NULL);
3443 }
3444 
3445 static bool
3446 is_byte_array(const type_t *tp)
3447 {
3448 
3449 	return tp->t_tspec == ARRAY &&
3450 	       (tp->t_subt->t_tspec == CHAR || tp->t_subt->t_tspec == UCHAR);
3451 }
3452 
3453 static bool
3454 union_contains(const type_t *utp, const type_t *mtp)
3455 {
3456 	for (const sym_t *mem = utp->t_sou->sou_first_member;
3457 	     mem != NULL; mem = mem->s_next) {
3458 		if (types_compatible(mem->s_type, mtp, true, false, NULL))
3459 			return true;
3460 	}
3461 	return false;
3462 }
3463 
3464 static bool
3465 should_warn_about_pointer_cast(const type_t *nstp, tspec_t nst,
3466 			       const type_t *ostp, tspec_t ost)
3467 {
3468 
3469 	while (nst == ARRAY)
3470 		nstp = nstp->t_subt, nst = nstp->t_tspec;
3471 	while (ost == ARRAY)
3472 		ostp = ostp->t_subt, ost = ostp->t_tspec;
3473 
3474 	if (nst == STRUCT && ost == STRUCT &&
3475 	    (struct_starts_with(nstp, ostp) ||
3476 	     struct_starts_with(ostp, nstp)))
3477 		return false;
3478 
3479 	if (is_incomplete(nstp) || is_incomplete(ostp))
3480 		return false;
3481 
3482 	if (nst == CHAR || nst == UCHAR)
3483 		return false;	/* for the sake of traditional C code */
3484 	if (ost == CHAR || ost == UCHAR)
3485 		return false;	/* for the sake of traditional C code */
3486 
3487 	/* Allow cast between pointers to sockaddr variants. */
3488 	if (nst == STRUCT && ost == STRUCT) {
3489 		debug_type(nstp);
3490 		debug_type(ostp);
3491 		const sym_t *nmem = nstp->t_sou->sou_first_member;
3492 		const sym_t *omem = ostp->t_sou->sou_first_member;
3493 		while (nmem != NULL && omem != NULL &&
3494 		       types_compatible(nmem->s_type, omem->s_type,
3495 			   true, false, NULL))
3496 			nmem = nmem->s_next, omem = omem->s_next;
3497 		if (nmem != NULL && is_byte_array(nmem->s_type))
3498 			return false;
3499 		if (omem != NULL && is_byte_array(omem->s_type))
3500 			return false;
3501 		if (nmem == NULL && omem == NULL)
3502 			return false;
3503 	}
3504 
3505 	if (nst == UNION || ost == UNION) {
3506 		const type_t *union_tp = nst == UNION ? nstp : ostp;
3507 		const type_t *other_tp = nst == UNION ? ostp : nstp;
3508 		if (union_contains(union_tp, other_tp))
3509 			return false;
3510 	}
3511 
3512 	if (is_struct_or_union(nst) && nstp->t_sou != ostp->t_sou)
3513 		return true;
3514 
3515 	return portable_size_in_bits(nst) != portable_size_in_bits(ost);
3516 }
3517 
3518 static void
3519 convert_pointer_from_pointer(type_t *ntp, tnode_t *tn)
3520 {
3521 	const type_t *nstp = ntp->t_subt;
3522 	const type_t *otp = tn->tn_type;
3523 	const type_t *ostp = otp->t_subt;
3524 	tspec_t nst = nstp->t_tspec;
3525 	tspec_t ost = ostp->t_tspec;
3526 
3527 	if (nst == VOID || ost == VOID) {
3528 		/* TODO: C99 behaves like C90 here. */
3529 		if ((!allow_trad && !allow_c99) && (nst == FUNC || ost == FUNC)) {
3530 			const char *nts, *ots;
3531 			/* null pointers are already handled in convert() */
3532 			*(nst == FUNC ? &nts : &ots) = "function pointer";
3533 			*(nst == VOID ? &nts : &ots) = "'void *'";
3534 			/* ANSI C forbids conversion of %s to %s */
3535 			warning(303, ots, nts);
3536 		}
3537 		return;
3538 	}
3539 	if (nst == FUNC && ost == FUNC)
3540 		return;
3541 	if (nst == FUNC || ost == FUNC) {
3542 		/* converting '%s' to '%s' is questionable */
3543 		warning(229, type_name(otp), type_name(ntp));
3544 		return;
3545 	}
3546 
3547 	if (hflag && alignment_in_bits(nstp) > alignment_in_bits(ostp) &&
3548 	    ost != CHAR && ost != UCHAR &&
3549 	    !is_incomplete(ostp) &&
3550 	    !(nst == UNION && union_contains(nstp, ostp))) {
3551 		/* converting '%s' to '%s' increases alignment ... */
3552 		warning(135, type_name(otp), type_name(ntp),
3553 		    alignment_in_bits(ostp) / CHAR_SIZE,
3554 		    alignment_in_bits(nstp) / CHAR_SIZE);
3555 	}
3556 
3557 	if (cflag && should_warn_about_pointer_cast(nstp, nst, ostp, ost)) {
3558 		/* pointer cast from '%s' to '%s' may be troublesome */
3559 		warning(247, type_name(otp), type_name(ntp));
3560 	}
3561 }
3562 
3563 /*
3564  * Insert a conversion operator, which converts the type of the node
3565  * to another given type.
3566  *
3567  * Possible values for 'op':
3568  *	CVT	a cast-expression
3569  *	binary	integer promotion for one of the operands, or a usual
3570  *		arithmetic conversion
3571  *	binary	plain or compound assignments to bit-fields
3572  *	FARG	'arg' is the number of the argument (used for warnings)
3573  *	NOOP	several other implicit conversions
3574  *	...
3575  */
3576 tnode_t *
3577 convert(op_t op, int arg, type_t *tp, tnode_t *tn)
3578 {
3579 	tspec_t nt = tp->t_tspec;
3580 	tspec_t ot = tn->tn_type->t_tspec;
3581 
3582 	if (allow_trad && allow_c90 && op == FARG)
3583 		check_prototype_conversion(arg, nt, ot, tp, tn);
3584 
3585 	if (nt == BOOL) {
3586 		/* No further checks. */
3587 
3588 	} else if (is_integer(nt)) {
3589 		if (ot == BOOL) {
3590 			/* No further checks. */
3591 		} else if (is_integer(ot)) {
3592 			convert_integer_from_integer(op, arg, nt, ot, tp, tn);
3593 		} else if (is_floating(ot)) {
3594 			convert_integer_from_floating(op, tp, tn);
3595 		} else if (ot == PTR) {
3596 			convert_integer_from_pointer(op, nt, tp, tn);
3597 		}
3598 
3599 	} else if (is_floating(nt)) {
3600 		/* No further checks. */
3601 
3602 	} else if (nt == PTR) {
3603 		if (is_null_pointer(tn)) {
3604 			/* a null pointer may be assigned to any pointer. */
3605 		} else if (ot == PTR && op == CVT) {
3606 			convert_pointer_from_pointer(tp, tn);
3607 		}
3608 	}
3609 
3610 	tnode_t *ntn = expr_alloc_tnode();
3611 	ntn->tn_op = CVT;
3612 	ntn->tn_type = tp;
3613 	ntn->tn_cast = op == CVT;
3614 	ntn->tn_sys |= tn->tn_sys;
3615 	ntn->tn_right = NULL;
3616 	if (tn->tn_op != CON || nt == VOID) {
3617 		ntn->tn_left = tn;
3618 	} else {
3619 		ntn->tn_op = CON;
3620 		ntn->tn_val = expr_zero_alloc(sizeof(*ntn->tn_val));
3621 		convert_constant(op, arg, ntn->tn_type, ntn->tn_val,
3622 		    tn->tn_val);
3623 	}
3624 
3625 	return ntn;
3626 }
3627 
3628 static void
3629 convert_constant_floating(op_t op, int arg, tspec_t ot, const type_t *tp,
3630 			  tspec_t nt, val_t *v, val_t *nv)
3631 {
3632 	ldbl_t max = 0.0, min = 0.0;
3633 
3634 	switch (nt) {
3635 	case CHAR:
3636 		max = TARG_CHAR_MAX;	min = TARG_CHAR_MIN;	break;
3637 	case UCHAR:
3638 		max = TARG_UCHAR_MAX;	min = 0;		break;
3639 	case SCHAR:
3640 		max = TARG_SCHAR_MAX;	min = TARG_SCHAR_MIN;	break;
3641 	case SHORT:
3642 		max = TARG_SHRT_MAX;	min = TARG_SHRT_MIN;	break;
3643 	case USHORT:
3644 		max = TARG_USHRT_MAX;	min = 0;		break;
3645 	case ENUM:
3646 	case INT:
3647 		max = TARG_INT_MAX;	min = TARG_INT_MIN;	break;
3648 	case UINT:
3649 		max = TARG_UINT_MAX;	min = 0;		break;
3650 	case LONG:
3651 		max = TARG_LONG_MAX;	min = TARG_LONG_MIN;	break;
3652 	case ULONG:
3653 		max = TARG_ULONG_MAX;	min = 0;		break;
3654 	case QUAD:
3655 		max = QUAD_MAX;		min = QUAD_MIN;		break;
3656 	case UQUAD:
3657 		max = UQUAD_MAX;	min = 0;		break;
3658 	case FLOAT:
3659 	case FCOMPLEX:
3660 		max = FLT_MAX;		min = -FLT_MAX;		break;
3661 	case DOUBLE:
3662 	case DCOMPLEX:
3663 		max = DBL_MAX;		min = -DBL_MAX;		break;
3664 	case PTR:
3665 		/* Already got an error because of float --> ptr */
3666 	case LDOUBLE:
3667 	case LCOMPLEX:
3668 		/* LINTED 248 */
3669 		max = LDBL_MAX;		min = -max;		break;
3670 	default:
3671 		lint_assert(/*CONSTCOND*/false);
3672 	}
3673 	if (v->v_ldbl > max || v->v_ldbl < min) {
3674 		lint_assert(nt != LDOUBLE);
3675 		if (op == FARG) {
3676 			/* conversion of '%s' to '%s' is out of range, ... */
3677 			warning(295,
3678 			    type_name(gettyp(ot)), type_name(tp), arg);
3679 		} else {
3680 			/* conversion of '%s' to '%s' is out of range */
3681 			warning(119,
3682 			    type_name(gettyp(ot)), type_name(tp));
3683 		}
3684 		v->v_ldbl = v->v_ldbl > 0 ? max : min;
3685 	}
3686 
3687 	if (nt == FLOAT || nt == FCOMPLEX) {
3688 		nv->v_ldbl = (float)v->v_ldbl;
3689 	} else if (nt == DOUBLE || nt == DCOMPLEX) {
3690 		nv->v_ldbl = (double)v->v_ldbl;
3691 	} else if (nt == LDOUBLE || nt == LCOMPLEX) {
3692 		nv->v_ldbl = v->v_ldbl;
3693 	} else {
3694 		nv->v_quad = (int64_t)v->v_ldbl;
3695 	}
3696 }
3697 
3698 static bool
3699 convert_constant_to_floating(tspec_t nt, val_t *nv,
3700 			     tspec_t ot, const val_t *v)
3701 {
3702 	if (nt == FLOAT) {
3703 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
3704 		    (float)(uint64_t)v->v_quad : (float)v->v_quad;
3705 	} else if (nt == DOUBLE) {
3706 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
3707 		    (double)(uint64_t)v->v_quad : (double)v->v_quad;
3708 	} else if (nt == LDOUBLE) {
3709 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
3710 		    (ldbl_t)(uint64_t)v->v_quad : (ldbl_t)v->v_quad;
3711 	} else
3712 		return false;
3713 	return true;
3714 }
3715 
3716 /*
3717  * Print a warning if bits which were set are lost due to the conversion.
3718  * This can happen with operator ORASS only.
3719  */
3720 static void
3721 convert_constant_check_range_bitor(size_t nsz, size_t osz, const val_t *v,
3722 				   uint64_t xmask, op_t op)
3723 {
3724 	if (nsz < osz && (v->v_quad & xmask) != 0) {
3725 		/* constant truncated by conversion, op '%s' */
3726 		warning(306, op_name(op));
3727 	}
3728 }
3729 
3730 /*
3731  * Print a warning if additional bits are not all 1
3732  * and the most significant bit of the old value is 1,
3733  * or if at least one (but not all) removed bit was 0.
3734  */
3735 static void
3736 convert_constant_check_range_bitand(size_t nsz, size_t osz,
3737 				    uint64_t xmask, const val_t *nv,
3738 				    tspec_t ot, const val_t *v,
3739 				    const type_t *tp, op_t op)
3740 {
3741 	if (nsz > osz &&
3742 	    (nv->v_quad & bit((unsigned int)(osz - 1))) != 0 &&
3743 	    (nv->v_quad & xmask) != xmask) {
3744 		/* extra bits set to 0 in conversion of '%s' to '%s', ... */
3745 		warning(309, type_name(gettyp(ot)),
3746 		    type_name(tp), op_name(op));
3747 	} else if (nsz < osz &&
3748 		   (v->v_quad & xmask) != xmask &&
3749 		   (v->v_quad & xmask) != 0) {
3750 		/* constant truncated by conversion, op '%s' */
3751 		warning(306, op_name(op));
3752 	}
3753 }
3754 
3755 static void
3756 convert_constant_check_range_signed(op_t op, int arg)
3757 {
3758 	if (op == ASSIGN) {
3759 		/* assignment of negative constant to unsigned type */
3760 		warning(164);
3761 	} else if (op == INIT) {
3762 		/* initialization of unsigned with negative constant */
3763 		warning(221);
3764 	} else if (op == FARG) {
3765 		/* conversion of negative constant to unsigned type, ... */
3766 		warning(296, arg);
3767 	} else if (modtab[op].m_comparison) {
3768 		/* handled by check_integer_comparison() */
3769 	} else {
3770 		/* conversion of negative constant to unsigned type */
3771 		warning(222);
3772 	}
3773 }
3774 
3775 /*
3776  * Loss of significant bit(s). All truncated bits of unsigned types or all
3777  * truncated bits plus the msb of the target for signed types are considered
3778  * to be significant bits. Loss of significant bits means that at least one
3779  * of the bits was set in an unsigned type or that at least one but not all
3780  * of the bits was set in a signed type. Loss of significant bits means that
3781  * it is not possible, also not with necessary casts, to convert back to the
3782  * original type. A example for a necessary cast is:
3783  *	char c;	int	i; c = 128;
3784  *	i = c;			** yields -128 **
3785  *	i = (unsigned char)c;	** yields 128 **
3786  */
3787 static void
3788 convert_constant_check_range_truncated(op_t op, int arg, const type_t *tp,
3789 				       tspec_t ot)
3790 {
3791 	if (op == ASSIGN && tp->t_bitfield) {
3792 		/* precision lost in bit-field assignment */
3793 		warning(166);
3794 	} else if (op == ASSIGN) {
3795 		/* constant truncated by assignment */
3796 		warning(165);
3797 	} else if (op == INIT && tp->t_bitfield) {
3798 		/* bit-field initializer does not fit */
3799 		warning(180);
3800 	} else if (op == INIT) {
3801 		/* initializer does not fit */
3802 		warning(178);
3803 	} else if (op == CASE) {
3804 		/* case label affected by conversion */
3805 		warning(196);
3806 	} else if (op == FARG) {
3807 		/* conversion of '%s' to '%s' is out of range, arg #%d */
3808 		warning(295,
3809 		    type_name(gettyp(ot)), type_name(tp), arg);
3810 	} else {
3811 		/* conversion of '%s' to '%s' is out of range */
3812 		warning(119,
3813 		    type_name(gettyp(ot)), type_name(tp));
3814 	}
3815 }
3816 
3817 static void
3818 convert_constant_check_range_loss(op_t op, int arg, const type_t *tp,
3819 				  tspec_t ot)
3820 {
3821 	if (op == ASSIGN && tp->t_bitfield) {
3822 		/* precision lost in bit-field assignment */
3823 		warning(166);
3824 	} else if (op == INIT && tp->t_bitfield) {
3825 		/* bit-field initializer out of range */
3826 		warning(11);
3827 	} else if (op == CASE) {
3828 		/* case label affected by conversion */
3829 		warning(196);
3830 	} else if (op == FARG) {
3831 		/* conversion of '%s' to '%s' is out of range, arg #%d */
3832 		warning(295, type_name(gettyp(ot)), type_name(tp), arg);
3833 	} else {
3834 		/* conversion of '%s' to '%s' is out of range */
3835 		warning(119, type_name(gettyp(ot)), type_name(tp));
3836 	}
3837 }
3838 
3839 static void
3840 convert_constant_check_range(tspec_t ot, const type_t *tp, tspec_t nt,
3841 			     op_t op, int arg, const val_t *v, val_t *nv)
3842 {
3843 	unsigned int obitsz, nbitsz;
3844 	uint64_t xmask, xmsk1;
3845 
3846 	obitsz = size_in_bits(ot);
3847 	nbitsz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
3848 	xmask = value_bits(nbitsz) ^ value_bits(obitsz);
3849 	xmsk1 = value_bits(nbitsz) ^ value_bits(obitsz - 1);
3850 	/*
3851 	 * For bitwise operations we are not interested in the arithmetic
3852 	 * value, but in the bits itself.
3853 	 */
3854 	if (op == ORASS || op == BITOR || op == BITXOR) {
3855 		convert_constant_check_range_bitor(
3856 		    nbitsz, obitsz, v, xmask, op);
3857 	} else if (op == ANDASS || op == BITAND) {
3858 		convert_constant_check_range_bitand(
3859 		    nbitsz, obitsz, xmask, nv, ot, v, tp, op);
3860 	} else if ((nt != PTR && is_uinteger(nt)) &&
3861 		   (ot != PTR && !is_uinteger(ot)) &&
3862 		   v->v_quad < 0) {
3863 		convert_constant_check_range_signed(op, arg);
3864 	} else if (nv->v_quad != v->v_quad && nbitsz <= obitsz &&
3865 		   (v->v_quad & xmask) != 0 &&
3866 		   (is_uinteger(ot) || (v->v_quad & xmsk1) != xmsk1)) {
3867 		convert_constant_check_range_truncated(op, arg, tp, ot);
3868 	} else if (nv->v_quad != v->v_quad) {
3869 		convert_constant_check_range_loss(op, arg, tp, ot);
3870 	}
3871 }
3872 
3873 /*
3874  * Converts a typed constant to a constant of another type.
3875  *
3876  * op		operator which requires conversion
3877  * arg		if op is FARG, # of argument
3878  * tp		type to which to convert the constant
3879  * nv		new constant
3880  * v		old constant
3881  */
3882 void
3883 convert_constant(op_t op, int arg, const type_t *tp, val_t *nv, val_t *v)
3884 {
3885 	/*
3886 	 * TODO: make 'v' const; the name of this function does not suggest
3887 	 *  that it modifies 'v'.
3888 	 */
3889 	tspec_t ot = v->v_tspec;
3890 	tspec_t nt = nv->v_tspec = tp->t_tspec;
3891 	bool range_check = false;
3892 
3893 	if (nt == BOOL) {	/* C99 6.3.1.2 */
3894 		nv->v_unsigned_since_c90 = false;
3895 		nv->v_quad = is_nonzero_val(v) ? 1 : 0;
3896 		return;
3897 	}
3898 
3899 	if (ot == FLOAT || ot == DOUBLE || ot == LDOUBLE) {
3900 		convert_constant_floating(op, arg, ot, tp, nt, v, nv);
3901 	} else if (!convert_constant_to_floating(nt, nv, ot, v)) {
3902 		range_check = true;	/* Check for lost precision. */
3903 		nv->v_quad = v->v_quad;
3904 	}
3905 
3906 	if (allow_trad && allow_c90 && v->v_unsigned_since_c90 &&
3907 	    (is_floating(nt) || (
3908 		(is_integer(nt) && !is_uinteger(nt) &&
3909 		 portable_size_in_bits(nt) > portable_size_in_bits(ot))))) {
3910 		/* ANSI C treats constant as unsigned */
3911 		warning(157);
3912 		v->v_unsigned_since_c90 = false;
3913 	}
3914 
3915 	if (is_integer(nt)) {
3916 		nv->v_quad = convert_integer(nv->v_quad, nt,
3917 		    tp->t_bitfield ? tp->t_flen : size_in_bits(nt));
3918 	}
3919 
3920 	if (range_check && op != CVT)
3921 		convert_constant_check_range(ot, tp, nt, op, arg, v, nv);
3922 }
3923 
3924 /*
3925  * Create a constant node for sizeof.
3926  */
3927 tnode_t *
3928 build_sizeof(const type_t *tp)
3929 {
3930 	unsigned int size_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3931 	tnode_t *tn = build_integer_constant(SIZEOF_TSPEC, size_in_bytes);
3932 	tn->tn_system_dependent = true;
3933 	debug_step("build_sizeof '%s' = %u", type_name(tp), size_in_bytes);
3934 	return tn;
3935 }
3936 
3937 /*
3938  * Create a constant node for offsetof.
3939  */
3940 /* ARGSUSED */ /* FIXME: See implementation comments. */
3941 tnode_t *
3942 build_offsetof(const type_t *tp, const sym_t *sym)
3943 {
3944 	unsigned int offset_in_bytes;
3945 	tnode_t *tn;
3946 
3947 	if (!is_struct_or_union(tp->t_tspec))
3948 		/* unacceptable operand of '%s' */
3949 		error(111, "offsetof");
3950 
3951 	/* FIXME: Don't wrongly use the size of the whole type, use sym. */
3952 	offset_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3953 	tn = build_integer_constant(SIZEOF_TSPEC, offset_in_bytes);
3954 	tn->tn_system_dependent = true;
3955 	return tn;
3956 }
3957 
3958 unsigned int
3959 type_size_in_bits(const type_t *tp)
3960 {
3961 	unsigned int elsz;
3962 
3963 	unsigned int elem = 1;
3964 	bool flex = false;
3965 	lint_assert(tp != NULL);
3966 	while (tp->t_tspec == ARRAY) {
3967 		flex = true;	/* allow c99 flex arrays [] [0] */
3968 		elem *= tp->t_dim;
3969 		tp = tp->t_subt;
3970 	}
3971 	if (elem == 0) {
3972 		if (!flex) {
3973 			/* cannot take size/alignment of incomplete type */
3974 			error(143);
3975 			elem = 1;
3976 		}
3977 	}
3978 	switch (tp->t_tspec) {
3979 	case FUNC:
3980 		/* cannot take size/alignment of function type '%s' */
3981 		error(144, type_name(tp));
3982 		elsz = 1;
3983 		break;
3984 	case STRUCT:
3985 	case UNION:
3986 		if (is_incomplete(tp)) {
3987 			/* cannot take size/alignment of incomplete type */
3988 			error(143);
3989 			elsz = 1;
3990 		} else {
3991 			elsz = tp->t_sou->sou_size_in_bits;
3992 		}
3993 		break;
3994 	case ENUM:
3995 		if (is_incomplete(tp)) {
3996 			/* cannot take size/alignment of incomplete type */
3997 			warning(143);
3998 		}
3999 		/* FALLTHROUGH */
4000 	default:
4001 		if (tp->t_bitfield) {
4002 			/* cannot take size/alignment of bit-field */
4003 			error(145);
4004 		}
4005 		if (tp->t_tspec == VOID) {
4006 			/* cannot take size/alignment of void */
4007 			error(146);
4008 			elsz = 1;
4009 		} else {
4010 			elsz = size_in_bits(tp->t_tspec);
4011 			lint_assert(elsz > 0);
4012 		}
4013 		break;
4014 	}
4015 
4016 	return elem * elsz;
4017 }
4018 
4019 tnode_t *
4020 build_alignof(const type_t *tp)
4021 {
4022 	switch (tp->t_tspec) {
4023 	case ARRAY:
4024 		break;
4025 
4026 	case FUNC:
4027 		/* cannot take size/alignment of function type '%s' */
4028 		error(144, type_name(tp));
4029 		return 0;
4030 
4031 	case STRUCT:
4032 	case UNION:
4033 		if (is_incomplete(tp)) {
4034 			/* cannot take size/alignment of incomplete type */
4035 			error(143);
4036 			return 0;
4037 		}
4038 		break;
4039 	case ENUM:
4040 		break;
4041 	default:
4042 		if (tp->t_bitfield) {
4043 			/* cannot take size/alignment of bit-field */
4044 			error(145);
4045 			return 0;
4046 		}
4047 		if (tp->t_tspec == VOID) {
4048 			/* cannot take size/alignment of void */
4049 			error(146);
4050 			return 0;
4051 		}
4052 		break;
4053 	}
4054 
4055 	return build_integer_constant(SIZEOF_TSPEC,
4056 	    (int64_t)alignment_in_bits(tp) / CHAR_SIZE);
4057 }
4058 
4059 static tnode_t *
4060 cast_to_union(tnode_t *otn, type_t *ntp)
4061 {
4062 
4063 	if (!allow_gcc) {
4064 		/* union cast is a GCC extension */
4065 		error(328);
4066 		return NULL;
4067 	}
4068 
4069 	for (const sym_t *m = ntp->t_sou->sou_first_member;
4070 	    m != NULL; m = m->s_next) {
4071 		if (types_compatible(m->s_type, otn->tn_type,
4072 		    false, false, NULL)) {
4073 			tnode_t *ntn = expr_alloc_tnode();
4074 			ntn->tn_op = CVT;
4075 			ntn->tn_type = ntp;
4076 			ntn->tn_cast = true;
4077 			ntn->tn_left = otn;
4078 			ntn->tn_right = NULL;
4079 			return ntn;
4080 		}
4081 	}
4082 
4083 	/* type '%s' is not a member of '%s' */
4084 	error(329, type_name(otn->tn_type), type_name(ntp));
4085 	return NULL;
4086 }
4087 
4088 /*
4089  * Type casts.
4090  */
4091 tnode_t *
4092 cast(tnode_t *tn, type_t *tp)
4093 {
4094 	tspec_t	nt, ot;
4095 
4096 	if (tn == NULL)
4097 		return NULL;
4098 
4099 	tn = cconv(tn);
4100 
4101 	lint_assert(tp != NULL);
4102 	nt = tp->t_tspec;
4103 	ot = tn->tn_type->t_tspec;
4104 
4105 	if (nt == VOID) {
4106 		/*
4107 		 * C90 6.3.4, C99 6.5.4p2 and C11 6.5.4p2 allow any type to
4108 		 * be cast to void.  The only other allowed casts are from a
4109 		 * scalar type to a scalar type.
4110 		 */
4111 	} else if (nt == UNION) {
4112 		return cast_to_union(tn, tp);
4113 	} else if (nt == STRUCT || nt == ARRAY || nt == FUNC) {
4114 		/* Casting to a struct is an undocumented GCC extension. */
4115 		if (!(allow_gcc && nt == STRUCT))
4116 			goto invalid_cast;
4117 	} else if (is_struct_or_union(ot)) {
4118 		goto invalid_cast;
4119 	} else if (ot == VOID) {
4120 		/* improper cast of void expression */
4121 		error(148);
4122 		return NULL;
4123 	} else if (is_integer(nt) && is_scalar(ot)) {
4124 		/* ok */
4125 	} else if (is_floating(nt) && is_arithmetic(ot)) {
4126 		/* ok */
4127 	} else if (nt == PTR && is_integer(ot)) {
4128 		/* ok */
4129 	} else if (nt == PTR && ot == PTR) {
4130 		if (!tp->t_subt->t_const && tn->tn_type->t_subt->t_const) {
4131 			if (hflag)
4132 				/* cast discards 'const' from type '%s' */
4133 				warning(275, type_name(tn->tn_type));
4134 		}
4135 	} else
4136 		goto invalid_cast;
4137 
4138 	if (any_query_enabled && types_compatible(tp, tn->tn_type,
4139 	    false, false, NULL)) {
4140 		/* no-op cast from '%s' to '%s' */
4141 		query_message(6, type_name(tn->tn_type), type_name(tp));
4142 	}
4143 
4144 	tn = convert(CVT, 0, tp, tn);
4145 	tn->tn_cast = true;
4146 
4147 	return tn;
4148 
4149 invalid_cast:
4150 	/* invalid cast from '%s' to '%s' */
4151 	error(147, type_name(tn->tn_type), type_name(tp));
4152 	return NULL;
4153 }
4154 
4155 /*
4156  * Create the node for a function argument.
4157  * All necessary conversions and type checks are done in
4158  * build_function_call because build_function_argument has no
4159  * information about expected argument types.
4160  */
4161 tnode_t *
4162 build_function_argument(tnode_t *args, tnode_t *arg)
4163 {
4164 	/*
4165 	 * If there was a serious error in the expression for the argument,
4166 	 * create a dummy argument so the positions of the remaining arguments
4167 	 * will not change.
4168 	 */
4169 	if (arg == NULL)
4170 		arg = build_integer_constant(INT, 0);
4171 
4172 	return new_tnode(PUSH, arg->tn_sys, arg->tn_type, arg, args);
4173 }
4174 
4175 /*
4176  * Compare the type of an argument with the corresponding type of a
4177  * prototype parameter. If it is a valid combination, but both types
4178  * are not the same, insert a conversion to convert the argument into
4179  * the type of the parameter.
4180  */
4181 static tnode_t *
4182 check_prototype_argument(
4183 	int	n,		/* pos of arg */
4184 	type_t	*tp,		/* expected type (from prototype) */
4185 	tnode_t	*tn)		/* argument */
4186 {
4187 	tnode_t	*ln = xcalloc(1, sizeof(*ln));
4188 	ln->tn_type = expr_unqualified_type(tp);
4189 	ln->tn_lvalue = true;
4190 	if (typeok(FARG, n, ln, tn)) {
4191 		bool dowarn;
4192 		if (!types_compatible(tp, tn->tn_type,
4193 		    true, false, (dowarn = false, &dowarn)) || dowarn)
4194 			tn = convert(FARG, n, tp, tn);
4195 	}
4196 	free(ln);
4197 	return tn;
4198 }
4199 
4200 /*
4201  * Check types of all function arguments and insert conversions,
4202  * if necessary.
4203  */
4204 static tnode_t *
4205 check_function_arguments(type_t *ftp, tnode_t *args)
4206 {
4207 	tnode_t	*arg;
4208 	sym_t	*asym;
4209 	tspec_t	at;
4210 	int	narg, npar, n, i;
4211 
4212 	/* get # of args in the prototype */
4213 	npar = 0;
4214 	for (asym = ftp->t_args; asym != NULL; asym = asym->s_next)
4215 		npar++;
4216 
4217 	/* get # of args in function call */
4218 	narg = 0;
4219 	for (arg = args; arg != NULL; arg = arg->tn_right)
4220 		narg++;
4221 
4222 	asym = ftp->t_args;
4223 	if (ftp->t_proto && npar != narg && !(ftp->t_vararg && npar < narg)) {
4224 		/* argument mismatch: %d %s passed, %d expected */
4225 		error(150, narg, narg > 1 ? "arguments" : "argument", npar);
4226 		asym = NULL;
4227 	}
4228 
4229 	for (n = 1; n <= narg; n++) {
4230 
4231 		/*
4232 		 * The rightmost argument is at the top of the argument
4233 		 * subtree.
4234 		 */
4235 		for (i = narg, arg = args; i > n; i--, arg = arg->tn_right)
4236 			continue;
4237 
4238 		/* some things which are always not allowed */
4239 		if ((at = arg->tn_left->tn_type->t_tspec) == VOID) {
4240 			/* void expressions may not be arguments, arg #%d */
4241 			error(151, n);
4242 			return NULL;
4243 		} else if (is_struct_or_union(at) &&
4244 			   is_incomplete(arg->tn_left->tn_type)) {
4245 			/* argument cannot have unknown size, arg #%d */
4246 			error(152, n);
4247 			return NULL;
4248 		} else if (is_integer(at) &&
4249 			   arg->tn_left->tn_type->t_is_enum &&
4250 			   is_incomplete(arg->tn_left->tn_type)) {
4251 			/* argument cannot have unknown size, arg #%d */
4252 			warning(152, n);
4253 		}
4254 
4255 		/* class conversions (arg in value context) */
4256 		arg->tn_left = cconv(arg->tn_left);
4257 
4258 		if (asym != NULL) {
4259 			arg->tn_left = check_prototype_argument(
4260 			    n, asym->s_type, arg->tn_left);
4261 		} else {
4262 			arg->tn_left = promote(NOOP, true, arg->tn_left);
4263 		}
4264 		arg->tn_type = arg->tn_left->tn_type;
4265 
4266 		if (asym != NULL)
4267 			asym = asym->s_next;
4268 	}
4269 
4270 	return args;
4271 }
4272 
4273 /*
4274  * Create the node for a function call. Also check types of
4275  * function arguments and insert conversions, if necessary.
4276  */
4277 tnode_t *
4278 build_function_call(tnode_t *func, bool sys, tnode_t *args)
4279 {
4280 	tnode_t	*ntn;
4281 	op_t	fcop;
4282 
4283 	if (func == NULL)
4284 		return NULL;
4285 
4286 	if (func->tn_op == NAME && func->tn_type->t_tspec == FUNC) {
4287 		fcop = CALL;
4288 	} else {
4289 		fcop = ICALL;
4290 	}
4291 
4292 	check_ctype_function_call(func, args);
4293 
4294 	/*
4295 	 * after cconv() func will always be a pointer to a function
4296 	 * if it is a valid function designator.
4297 	 */
4298 	func = cconv(func);
4299 
4300 	if (func->tn_type->t_tspec != PTR ||
4301 	    func->tn_type->t_subt->t_tspec != FUNC) {
4302 		/* cannot call '%s', must be a function */
4303 		error(149, type_name(func->tn_type));
4304 		return NULL;
4305 	}
4306 
4307 	args = check_function_arguments(func->tn_type->t_subt, args);
4308 
4309 	ntn = new_tnode(fcop, sys, func->tn_type->t_subt->t_subt, func, args);
4310 
4311 	return ntn;
4312 }
4313 
4314 /*
4315  * Return the value of an integral constant expression.
4316  * If the expression is not constant or its type is not an integer
4317  * type, an error message is printed.
4318  */
4319 val_t *
4320 constant(tnode_t *tn, bool required)
4321 {
4322 
4323 	if (tn != NULL)
4324 		tn = cconv(tn);
4325 	if (tn != NULL)
4326 		tn = promote(NOOP, false, tn);
4327 
4328 	val_t *v = xcalloc(1, sizeof(*v));
4329 
4330 	if (tn == NULL) {
4331 		lint_assert(nerr != 0);
4332 		debug_step("constant node is null; returning 1 instead");
4333 		v->v_tspec = INT;
4334 		v->v_quad = 1;
4335 		return v;
4336 	}
4337 
4338 	v->v_tspec = tn->tn_type->t_tspec;
4339 
4340 	if (tn->tn_op == CON) {
4341 		lint_assert(tn->tn_type->t_tspec == tn->tn_val->v_tspec);
4342 		if (is_integer(tn->tn_val->v_tspec)) {
4343 			v->v_unsigned_since_c90 =
4344 			    tn->tn_val->v_unsigned_since_c90;
4345 			v->v_quad = tn->tn_val->v_quad;
4346 			return v;
4347 		}
4348 		v->v_quad = tn->tn_val->v_ldbl;
4349 	} else {
4350 		v->v_quad = 1;
4351 	}
4352 
4353 	if (required)
4354 		/* integral constant expression expected */
4355 		error(55);
4356 	else
4357 		/* variable array dimension is a C99/GCC extension */
4358 		c99ism(318);
4359 
4360 	if (!is_integer(v->v_tspec))
4361 		v->v_tspec = INT;
4362 
4363 	return v;
4364 }
4365 
4366 static bool
4367 is_constcond_false(const tnode_t *tn, tspec_t t)
4368 {
4369 	return (t == BOOL || t == INT) &&
4370 	       tn->tn_op == CON && tn->tn_val->v_quad == 0;
4371 }
4372 
4373 /*
4374  * Perform some tests on expressions which can't be done in build_binary()
4375  * and functions called by build_binary(). These tests must be done here
4376  * because we need some information about the context in which the operations
4377  * are performed.
4378  * After all tests are performed and dofreeblk is true, expr() frees the
4379  * memory which is used for the expression.
4380  */
4381 void
4382 expr(tnode_t *tn, bool vctx, bool cond, bool dofreeblk, bool is_do_while)
4383 {
4384 
4385 	if (tn == NULL) {	/* in case of errors */
4386 		expr_free_all();
4387 		return;
4388 	}
4389 
4390 	/* expr() is also called in global initializations */
4391 	if (dcs->d_kind != DK_EXTERN && !is_do_while)
4392 		check_statement_reachable();
4393 
4394 	check_expr_misc(tn, vctx, cond, !cond, false, false, false);
4395 	if (tn->tn_op == ASSIGN && !tn->tn_parenthesized) {
4396 		if (hflag && cond)
4397 			/* assignment in conditional context */
4398 			warning(159);
4399 	} else if (tn->tn_op == CON) {
4400 		if (hflag && cond && !constcond_flag &&
4401 		    !tn->tn_system_dependent &&
4402 		    !(is_do_while &&
4403 		      is_constcond_false(tn, tn->tn_type->t_tspec)))
4404 			/* constant in conditional context */
4405 			warning(161);
4406 	}
4407 	if (!modtab[tn->tn_op].m_has_side_effect) {
4408 		/*
4409 		 * for left operands of COMMA this warning is already
4410 		 * printed
4411 		 */
4412 		if (tn->tn_op != COMMA && !vctx && !cond)
4413 			check_null_effect(tn);
4414 	}
4415 	debug_node(tn);
4416 
4417 	/* free the tree memory */
4418 	if (dofreeblk)
4419 		expr_free_all();
4420 }
4421 
4422 /*
4423  * Checks the range of array indices, if possible.
4424  * amper is set if only the address of the element is used. This
4425  * means that the index is allowed to refer to the first element
4426  * after the array.
4427  */
4428 static void
4429 check_array_index(tnode_t *tn, bool amper)
4430 {
4431 	const tnode_t *ln = tn->tn_left;
4432 	const tnode_t *rn = tn->tn_right;
4433 
4434 	/* We can only check constant indices. */
4435 	if (rn->tn_op != CON)
4436 		return;
4437 
4438 	/* Return if the left node does not stem from an array. */
4439 	if (ln->tn_op != ADDR)
4440 		return;
4441 	if (ln->tn_left->tn_op != STRING && ln->tn_left->tn_op != NAME)
4442 		return;
4443 	if (ln->tn_left->tn_type->t_tspec != ARRAY)
4444 		return;
4445 
4446 	/*
4447 	 * For incomplete array types, we can print a warning only if
4448 	 * the index is negative.
4449 	 */
4450 	if (is_incomplete(ln->tn_left->tn_type) && rn->tn_val->v_quad >= 0)
4451 		return;
4452 
4453 	/* Get the size of one array element */
4454 	int elsz = length_in_bits(ln->tn_type->t_subt, NULL);
4455 	if (elsz == 0)
4456 		return;
4457 	elsz /= CHAR_SIZE;
4458 
4459 	/* Change the unit of the index from bytes to element size. */
4460 	int64_t con;
4461 	if (is_uinteger(rn->tn_type->t_tspec))
4462 		con = (uint64_t)rn->tn_val->v_quad / elsz;
4463 	else
4464 		con = rn->tn_val->v_quad / elsz;
4465 
4466 	int dim = ln->tn_left->tn_type->t_dim + (amper ? 1 : 0);
4467 
4468 	if (!is_uinteger(rn->tn_type->t_tspec) && con < 0) {
4469 		/* array subscript cannot be negative: %ld */
4470 		warning(167, (long)con);
4471 	} else if (dim > 0 && (uint64_t)con >= (uint64_t)dim) {
4472 		/* array subscript cannot be > %d: %ld */
4473 		warning(168, dim - 1, (long)con);
4474 	}
4475 }
4476 
4477 static void
4478 check_expr_addr(const tnode_t *ln, bool szof, bool fcall)
4479 {
4480 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4481 	if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
4482 		if (!szof)
4483 			mark_as_set(ln->tn_sym);
4484 		mark_as_used(ln->tn_sym, fcall, szof);
4485 	}
4486 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4487 		/* check the range of array indices */
4488 		check_array_index(ln->tn_left, true);
4489 }
4490 
4491 static void
4492 check_expr_load(const tnode_t *ln)
4493 {
4494 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4495 		/* check the range of array indices */
4496 		check_array_index(ln->tn_left, false);
4497 }
4498 
4499 static void
4500 check_expr_side_effect(const tnode_t *ln, bool szof)
4501 {
4502 	dinfo_t *di;
4503 
4504 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4505 	if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
4506 		scl_t sc = ln->tn_sym->s_scl;
4507 		/*
4508 		 * Look if there was a asm statement in one of the
4509 		 * compound statements we are in. If not, we don't
4510 		 * print a warning.
4511 		 */
4512 		for (di = dcs; di != NULL; di = di->d_enclosing) {
4513 			if (di->d_asm)
4514 				break;
4515 		}
4516 		if (sc != EXTERN && sc != STATIC &&
4517 		    !ln->tn_sym->s_set && !szof && di == NULL) {
4518 			/* '%s' may be used before set */
4519 			warning(158, ln->tn_sym->s_name);
4520 			mark_as_set(ln->tn_sym);
4521 		}
4522 		mark_as_used(ln->tn_sym, false, false);
4523 	}
4524 }
4525 
4526 static void
4527 check_expr_assign(const tnode_t *ln, bool szof)
4528 {
4529 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4530 	if (ln->tn_op == NAME && !szof && (reached || !warn_about_unreachable)) {
4531 		mark_as_set(ln->tn_sym);
4532 		if (ln->tn_sym->s_scl == EXTERN)
4533 			outusg(ln->tn_sym);
4534 	}
4535 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4536 		/* check the range of array indices */
4537 		check_array_index(ln->tn_left, false);
4538 }
4539 
4540 static void
4541 check_expr_call(const tnode_t *tn, const tnode_t *ln,
4542 		bool szof, bool vctx, bool cond, bool retval_discarded)
4543 {
4544 	lint_assert(ln->tn_op == ADDR);
4545 	lint_assert(ln->tn_left->tn_op == NAME);
4546 	if (!szof &&
4547 	    !is_compiler_builtin(ln->tn_left->tn_sym->s_name))
4548 		outcall(tn, vctx || cond, retval_discarded);
4549 }
4550 
4551 static bool
4552 check_expr_op(const tnode_t *tn, op_t op, const tnode_t *ln,
4553 	      bool szof, bool fcall, bool vctx, bool cond,
4554 	      bool retval_discarded, bool eqwarn)
4555 {
4556 	switch (op) {
4557 	case ADDR:
4558 		check_expr_addr(ln, szof, fcall);
4559 		break;
4560 	case LOAD:
4561 		check_expr_load(ln);
4562 		/* FALLTHROUGH */
4563 	case PUSH:
4564 	case INCBEF:
4565 	case DECBEF:
4566 	case INCAFT:
4567 	case DECAFT:
4568 	case ADDASS:
4569 	case SUBASS:
4570 	case MULASS:
4571 	case DIVASS:
4572 	case MODASS:
4573 	case ANDASS:
4574 	case ORASS:
4575 	case XORASS:
4576 	case SHLASS:
4577 	case SHRASS:
4578 	case REAL:
4579 	case IMAG:
4580 		check_expr_side_effect(ln, szof);
4581 		break;
4582 	case ASSIGN:
4583 		check_expr_assign(ln, szof);
4584 		break;
4585 	case CALL:
4586 		check_expr_call(tn, ln, szof, vctx, cond, retval_discarded);
4587 		break;
4588 	case EQ:
4589 		if (hflag && eqwarn)
4590 			/* operator '==' found where '=' was expected */
4591 			warning(160);
4592 		break;
4593 	case CON:
4594 	case NAME:
4595 	case STRING:
4596 		return false;
4597 	default:
4598 		break;
4599 	}
4600 	return true;
4601 }
4602 
4603 /*
4604  *	vctx			???
4605  *	cond			whether the expression is a condition that
4606  *				will be compared with 0
4607  *	eqwarn			whether the operator '==' might be a
4608  *				misspelled '='
4609  *	fcall			whether the expression is a function call
4610  *	retval_discarded	whether the return value of a function call
4611  *				is discarded; such calls will be analyzed by
4612  *				lint2 in messages 4, 8 and 9
4613  *	szof			whether the expression is part of a sizeof
4614  *				expression, which means that its value is
4615  *				discarded since only the type is relevant
4616  */
4617 void
4618 check_expr_misc(const tnode_t *tn, bool vctx, bool cond,
4619 		bool eqwarn, bool fcall, bool retval_discarded, bool szof)
4620 {
4621 	tnode_t *ln, *rn;
4622 	const mod_t *mp;
4623 	op_t op;
4624 	bool cvctx, ccond, eq, discard;
4625 
4626 	if (tn == NULL)
4627 		return;
4628 
4629 	ln = tn->tn_left;
4630 	rn = tn->tn_right;
4631 	mp = &modtab[op = tn->tn_op];
4632 
4633 	if (!check_expr_op(tn, op, ln,
4634 	    szof, fcall, vctx, cond, retval_discarded, eqwarn))
4635 		return;
4636 
4637 	cvctx = mp->m_value_context;
4638 	ccond = mp->m_compares_with_zero;
4639 	eq = mp->m_warn_if_operand_eq &&
4640 	     !ln->tn_parenthesized &&
4641 	     rn != NULL && !rn->tn_parenthesized;
4642 
4643 	/*
4644 	 * values of operands of ':' are not used if the type of at least
4645 	 * one of the operands (for gcc compatibility) is void
4646 	 * XXX test/value context of QUEST should probably be used as
4647 	 * context for both operands of COLON
4648 	 */
4649 	if (op == COLON && tn->tn_type->t_tspec == VOID)
4650 		cvctx = ccond = false;
4651 	discard = op == CVT && tn->tn_type->t_tspec == VOID;
4652 	check_expr_misc(ln, cvctx, ccond, eq, op == CALL, discard, szof);
4653 
4654 	switch (op) {
4655 	case PUSH:
4656 		if (rn != NULL)
4657 			check_expr_misc(rn, false, false, eq, false, false,
4658 			    szof);
4659 		break;
4660 	case LOGAND:
4661 	case LOGOR:
4662 		check_expr_misc(rn, false, true, eq, false, false, szof);
4663 		break;
4664 	case COLON:
4665 		check_expr_misc(rn, cvctx, ccond, eq, false, false, szof);
4666 		break;
4667 	case COMMA:
4668 		check_expr_misc(rn, vctx, cond, false, false, false, szof);
4669 		break;
4670 	default:
4671 		if (mp->m_binary)
4672 			check_expr_misc(rn, true, false, eq, false, false,
4673 			    szof);
4674 		break;
4675 	}
4676 }
4677 
4678 /*
4679  * Return whether the expression can be used for static initialization.
4680  *
4681  * Constant initialization expressions must be constant or an address
4682  * of a static object with an optional offset. In the first case,
4683  * the result is returned in *offsp. In the second case, the static
4684  * object is returned in *symp and the offset in *offsp.
4685  *
4686  * The expression can consist of PLUS, MINUS, ADDR, NAME, STRING and
4687  * CON. Type conversions are allowed if they do not change binary
4688  * representation (including width).
4689  *
4690  * C99 6.6 "Constant expressions"
4691  * C99 6.7.8p4 restricts initializers for static storage duration
4692  */
4693 bool
4694 constant_addr(const tnode_t *tn, const sym_t **symp, ptrdiff_t *offsp)
4695 {
4696 	const sym_t *sym;
4697 	ptrdiff_t offs1, offs2;
4698 	tspec_t	t, ot;
4699 
4700 	switch (tn->tn_op) {
4701 	case MINUS:
4702 		if (tn->tn_right->tn_op == CVT)
4703 			return constant_addr(tn->tn_right, symp, offsp);
4704 		else if (tn->tn_right->tn_op != CON)
4705 			return false;
4706 		/* FALLTHROUGH */
4707 	case PLUS:
4708 		offs1 = offs2 = 0;
4709 		if (tn->tn_left->tn_op == CON) {
4710 			offs1 = (ptrdiff_t)tn->tn_left->tn_val->v_quad;
4711 			if (!constant_addr(tn->tn_right, &sym, &offs2))
4712 				return false;
4713 		} else if (tn->tn_right->tn_op == CON) {
4714 			offs2 = (ptrdiff_t)tn->tn_right->tn_val->v_quad;
4715 			if (tn->tn_op == MINUS)
4716 				offs2 = -offs2;
4717 			if (!constant_addr(tn->tn_left, &sym, &offs1))
4718 				return false;
4719 		} else {
4720 			return false;
4721 		}
4722 		*symp = sym;
4723 		*offsp = offs1 + offs2;
4724 		return true;
4725 	case ADDR:
4726 		if (tn->tn_left->tn_op == NAME) {
4727 			*symp = tn->tn_left->tn_sym;
4728 			*offsp = 0;
4729 			return true;
4730 		} else {
4731 			/*
4732 			 * If this would be the front end of a compiler we
4733 			 * would return a label instead of 0, at least if
4734 			 * 'tn->tn_left->tn_op == STRING'.
4735 			 */
4736 			*symp = NULL;
4737 			*offsp = 0;
4738 			return true;
4739 		}
4740 	case CVT:
4741 		t = tn->tn_type->t_tspec;
4742 		ot = tn->tn_left->tn_type->t_tspec;
4743 		if ((!is_integer(t) && t != PTR) ||
4744 		    (!is_integer(ot) && ot != PTR)) {
4745 			return false;
4746 		}
4747 #if 0
4748 		/*
4749 		 * consider:
4750 		 *	struct foo {
4751 		 *		unsigned char a;
4752 		 *	} f = {
4753 		 *		(unsigned char)(unsigned long)
4754 		 *		    (&(((struct foo *)0)->a))
4755 		 *	};
4756 		 * since psize(unsigned long) != psize(unsigned char),
4757 		 * this fails.
4758 		 */
4759 		else if (psize(t) != psize(ot))
4760 			return -1;
4761 #endif
4762 		return constant_addr(tn->tn_left, symp, offsp);
4763 	default:
4764 		return false;
4765 	}
4766 }
4767 
4768 /* Append s2 to s1, then free s2. */
4769 strg_t *
4770 cat_strings(strg_t *s1, strg_t *s2)
4771 {
4772 
4773 	if (s1->st_char != s2->st_char) {
4774 		/* cannot concatenate wide and regular string literals */
4775 		error(292);
4776 		return s1;
4777 	}
4778 
4779 	size_t len1 = s1->st_len;
4780 	size_t len2 = s2->st_len;
4781 	size_t chsize = s1->st_char ? sizeof(char) : sizeof(wchar_t);
4782 	size_t size1 = len1 * chsize;
4783 	size_t size2 = (len2 + 1) * chsize;
4784 	s1->st_mem = xrealloc(s1->st_mem, size1 + size2);
4785 	memcpy((char *)s1->st_mem + size1, s2->st_mem, size2);
4786 	free(s2->st_mem);
4787 
4788 	s1->st_len = len1 + len2;
4789 	free(s2);
4790 
4791 	return s1;
4792 }
4793 
4794 
4795 typedef struct stmt_expr {
4796 	memory_pool se_mem;
4797 	sym_t *se_sym;
4798 	struct stmt_expr *se_enclosing;
4799 } stmt_expr;
4800 
4801 static stmt_expr *stmt_exprs;
4802 
4803 void
4804 begin_statement_expr(void)
4805 {
4806 	stmt_expr *se = xmalloc(sizeof(*se));
4807 	se->se_mem = expr_save_memory();
4808 	se->se_sym = NULL;
4809 	se->se_enclosing = stmt_exprs;
4810 	stmt_exprs = se;
4811 }
4812 
4813 void
4814 do_statement_expr(tnode_t *tn)
4815 {
4816 	block_level--;
4817 	mem_block_level--;
4818 	stmt_exprs->se_sym = tn != NULL
4819 	    ? mktempsym(block_dup_type(tn->tn_type))
4820 	    : NULL;		/* after a syntax error */
4821 	mem_block_level++;
4822 	block_level++;
4823 	/* ({ }) is a GCC extension */
4824 	gnuism(320);
4825 }
4826 
4827 tnode_t *
4828 end_statement_expr(void)
4829 {
4830 	stmt_expr *se = stmt_exprs;
4831 	if (se->se_sym == NULL)
4832 		return NULL;	/* after a syntax error */
4833 	tnode_t *tn = build_name(se->se_sym, false);
4834 	(void)expr_save_memory();	/* leak */
4835 	expr_restore_memory(se->se_mem);
4836 	stmt_exprs = se->se_enclosing;
4837 	free(se);
4838 	return tn;
4839 }
4840