xref: /netbsd-src/usr.bin/xlint/lint1/tree.c (revision 122b5006ee1bd67145794b4cde92f4fe4781a5ec)
1 /*	$NetBSD: tree.c,v 1.393 2021/11/01 19:48:51 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: tree.c,v 1.393 2021/11/01 19:48:51 rillig Exp $");
41 #endif
42 
43 #include <float.h>
44 #include <limits.h>
45 #include <math.h>
46 #include <signal.h>
47 #include <stdlib.h>
48 #include <string.h>
49 
50 #include "lint1.h"
51 #include "cgram.h"
52 
53 static	tnode_t	*build_integer_constant(tspec_t, int64_t);
54 static	void	check_pointer_comparison(op_t,
55 					 const tnode_t *, const tnode_t *);
56 static	bool	check_assign_types_compatible(op_t, int,
57 					      const tnode_t *, const tnode_t *);
58 static	void	check_bad_enum_operation(op_t,
59 					 const tnode_t *, const tnode_t *);
60 static	void	check_enum_type_mismatch(op_t, int,
61 				         const tnode_t *, const tnode_t *);
62 static	void	check_enum_int_mismatch(op_t, int,
63 					const tnode_t *, const tnode_t *);
64 static	tnode_t	*new_tnode(op_t, type_t *, tnode_t *, tnode_t *);
65 static	void	balance(op_t, tnode_t **, tnode_t **);
66 static	void	warn_incompatible_types(op_t, const type_t *, tspec_t,
67 					const type_t *, tspec_t);
68 static	void	warn_incompatible_pointers(const mod_t *,
69 					   const type_t *, const type_t *);
70 static	bool	has_constant_member(const type_t *);
71 static	void	check_prototype_conversion(int, tspec_t, tspec_t, type_t *,
72 					   tnode_t *);
73 static	void	check_integer_conversion(op_t, int, tspec_t, tspec_t, type_t *,
74 					 tnode_t *);
75 static	void	check_pointer_integer_conversion(op_t, tspec_t, type_t *,
76 						 tnode_t *);
77 static	void	check_pointer_conversion(tnode_t *, type_t *);
78 static	tnode_t	*build_struct_access(op_t, tnode_t *, tnode_t *);
79 static	tnode_t	*build_prepost_incdec(op_t, tnode_t *);
80 static	tnode_t	*build_real_imag(op_t, tnode_t *);
81 static	tnode_t	*build_address(tnode_t *, bool);
82 static	tnode_t	*build_plus_minus(op_t, tnode_t *, tnode_t *);
83 static	tnode_t	*build_bit_shift(op_t, tnode_t *, tnode_t *);
84 static	tnode_t	*build_colon(tnode_t *, tnode_t *);
85 static	tnode_t	*build_assignment(op_t, tnode_t *, tnode_t *);
86 static	tnode_t	*plength(type_t *);
87 static	tnode_t	*fold(tnode_t *);
88 static	tnode_t	*fold_test(tnode_t *);
89 static	tnode_t	*fold_float(tnode_t *);
90 static	tnode_t	*check_function_arguments(type_t *, tnode_t *);
91 static	tnode_t	*check_prototype_argument(int, type_t *, tnode_t *);
92 static	void	check_null_effect(const tnode_t *);
93 static	void	check_array_index(tnode_t *, bool);
94 static	void	check_integer_comparison(op_t, tnode_t *, tnode_t *);
95 static	void	check_precedence_confusion(tnode_t *);
96 
97 extern sig_atomic_t fpe;
98 
99 static const char *
100 op_name(op_t op)
101 {
102 	return modtab[op].m_name;
103 }
104 
105 /* Build 'pointer to tp', 'array of tp' or 'function returning tp'. */
106 type_t *
107 derive_type(type_t *tp, tspec_t t)
108 {
109 	type_t	*tp2;
110 
111 	tp2 = getblk(sizeof(*tp2));
112 	tp2->t_tspec = t;
113 	tp2->t_subt = tp;
114 	return tp2;
115 }
116 
117 /*
118  * Derive 'pointer to tp' or 'function returning tp'.
119  * The memory is freed at the end of the current expression.
120  */
121 type_t *
122 expr_derive_type(type_t *tp, tspec_t t)
123 {
124 	type_t	*tp2;
125 
126 	tp2 = expr_zalloc(sizeof(*tp2));
127 	tp2->t_tspec = t;
128 	tp2->t_subt = tp;
129 	return tp2;
130 }
131 
132 /*
133  * Create a node for a constant.
134  */
135 tnode_t *
136 build_constant(type_t *tp, val_t *v)
137 {
138 	tnode_t	*n;
139 
140 	n = expr_zalloc_tnode();
141 	n->tn_op = CON;
142 	n->tn_type = tp;
143 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
144 	n->tn_val->v_tspec = tp->t_tspec;
145 	n->tn_val->v_unsigned_since_c90 = v->v_unsigned_since_c90;
146 	n->tn_val->v_u = v->v_u;
147 	free(v);
148 	return n;
149 }
150 
151 static tnode_t *
152 build_integer_constant(tspec_t t, int64_t q)
153 {
154 	tnode_t	*n;
155 
156 	n = expr_zalloc_tnode();
157 	n->tn_op = CON;
158 	n->tn_type = gettyp(t);
159 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
160 	n->tn_val->v_tspec = t;
161 	n->tn_val->v_quad = q;
162 	return n;
163 }
164 
165 static void
166 fallback_symbol(sym_t *sym)
167 {
168 
169 	if (fallback_symbol_strict_bool(sym))
170 		return;
171 
172 	if (block_level > 0 && (strcmp(sym->s_name, "__FUNCTION__") == 0 ||
173 			   strcmp(sym->s_name, "__PRETTY_FUNCTION__") == 0)) {
174 		/* __FUNCTION__/__PRETTY_FUNCTION__ is a GCC extension */
175 		gnuism(316);
176 		sym->s_type = derive_type(gettyp(CHAR), PTR);
177 		sym->s_type->t_const = true;
178 		return;
179 	}
180 
181 	if (block_level > 0 && strcmp(sym->s_name, "__func__") == 0) {
182 		if (!Sflag)
183 			/* __func__ is a C9X feature */
184 			warning(317);
185 		sym->s_type = derive_type(gettyp(CHAR), PTR);
186 		sym->s_type->t_const = true;
187 		return;
188 	}
189 
190 	/* '%s' undefined */
191 	error(99, sym->s_name);
192 }
193 
194 /*
195  * Functions that are predeclared by GCC or other compilers can be called
196  * with arbitrary arguments.  Since lint usually runs after a successful
197  * compilation, it's the compiler's job to catch any errors.
198  */
199 bool
200 is_compiler_builtin(const char *name)
201 {
202 	/* https://gcc.gnu.org/onlinedocs/gcc/C-Extensions.html */
203 	if (gflag) {
204 		if (strncmp(name, "__atomic_", 9) == 0 ||
205 		    strncmp(name, "__builtin_", 10) == 0 ||
206 		    /* obsolete but still in use, as of 2021 */
207 		    strncmp(name, "__sync_", 7) == 0)
208 			return true;
209 	}
210 
211 	/* https://software.intel.com/sites/landingpage/IntrinsicsGuide/ */
212 	if (strncmp(name, "_mm_", 4) == 0)
213 		return true;
214 
215 	return false;
216 }
217 
218 static bool
219 str_endswith(const char *haystack, const char *needle)
220 {
221 	size_t hlen = strlen(haystack);
222 	size_t nlen = strlen(needle);
223 
224 	return nlen <= hlen &&
225 	       memcmp(haystack + hlen - nlen, needle, nlen) == 0;
226 }
227 
228 /* https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html */
229 static bool
230 is_gcc_bool_builtin(const char *name)
231 {
232 	return strncmp(name, "__builtin_", 10) == 0 &&
233 	       (str_endswith(name, "_overflow") ||
234 		str_endswith(name, "_overflow_p"));
235 }
236 
237 static void
238 build_name_call(sym_t *sym)
239 {
240 
241 	if (is_compiler_builtin(sym->s_name)) {
242 		/*
243 		 * Do not warn about these, just assume that
244 		 * they are regular functions compatible with
245 		 * non-prototype calling conventions.
246 		 */
247 
248 		if (is_gcc_bool_builtin(sym->s_name))
249 			sym->s_type = gettyp(BOOL);
250 
251 	} else if (Sflag) {
252 		/* function '%s' implicitly declared to return int */
253 		error(215, sym->s_name);
254 	} else if (sflag) {
255 		/* function '%s' implicitly declared to return int */
256 		warning(215, sym->s_name);
257 	}
258 
259 	/* XXX if tflag is set, the symbol should be exported to level 0 */
260 	sym->s_type = derive_type(sym->s_type, FUNC);
261 }
262 
263 /*
264  * Create a node for a name (symbol table entry).
265  * follow_token is the token which follows the name.
266  */
267 tnode_t *
268 build_name(sym_t *sym, int follow_token)
269 {
270 	tnode_t	*n;
271 
272 	if (sym->s_scl == NOSCL) {
273 		sym->s_scl = EXTERN;
274 		sym->s_def = DECL;
275 		if (follow_token == T_LPAREN) {
276 			build_name_call(sym);
277 		} else {
278 			fallback_symbol(sym);
279 		}
280 	}
281 
282 	lint_assert(sym->s_kind == FVFT || sym->s_kind == FMEMBER);
283 
284 	n = expr_zalloc_tnode();
285 	n->tn_type = sym->s_type;
286 	if (sym->s_scl != CTCONST) {
287 		n->tn_op = NAME;
288 		n->tn_sym = sym;
289 		if (sym->s_kind == FVFT && sym->s_type->t_tspec != FUNC)
290 			n->tn_lvalue = true;
291 	} else {
292 		n->tn_op = CON;
293 		n->tn_val = expr_zalloc(sizeof(*n->tn_val));
294 		*n->tn_val = sym->s_value;
295 	}
296 
297 	return n;
298 }
299 
300 tnode_t *
301 build_string(strg_t *strg)
302 {
303 	size_t	len;
304 	tnode_t	*n;
305 	type_t *tp;
306 
307 	len = strg->st_len;
308 
309 	n = expr_zalloc_tnode();
310 
311 	tp = expr_zalloc(sizeof(*tp));
312 	tp->t_tspec = ARRAY;
313 	tp->t_subt = gettyp(strg->st_tspec);
314 	tp->t_dim = (int)(len + 1);
315 
316 	n->tn_op = STRING;
317 	n->tn_type = tp;
318 	n->tn_lvalue = true;
319 
320 	n->tn_string = expr_zalloc(sizeof(*n->tn_string));
321 	n->tn_string->st_tspec = strg->st_tspec;
322 	n->tn_string->st_len = len;
323 
324 	if (strg->st_tspec == CHAR) {
325 		n->tn_string->st_cp = expr_zalloc(len + 1);
326 		(void)memcpy(n->tn_string->st_cp, strg->st_cp, len + 1);
327 		free(strg->st_cp);
328 	} else {
329 		size_t size = (len + 1) * sizeof(*n->tn_string->st_wcp);
330 		n->tn_string->st_wcp = expr_zalloc(size);
331 		(void)memcpy(n->tn_string->st_wcp, strg->st_wcp, size);
332 		free(strg->st_wcp);
333 	}
334 	free(strg);
335 
336 	return n;
337 }
338 
339 /*
340  * Returns a symbol which has the same name as the msym argument and is a
341  * member of the struct or union specified by the tn argument.
342  */
343 sym_t *
344 struct_or_union_member(tnode_t *tn, op_t op, sym_t *msym)
345 {
346 	struct_or_union	*str;
347 	type_t	*tp;
348 	sym_t	*sym, *csym;
349 	bool	eq;
350 	tspec_t	t;
351 
352 	/*
353 	 * Remove the member if it was unknown until now, which means
354 	 * that no defined struct or union has a member with the same name.
355 	 */
356 	if (msym->s_scl == NOSCL) {
357 		/* type '%s' does not have member '%s' */
358 		error(101, type_name(tn->tn_type), msym->s_name);
359 		rmsym(msym);
360 		msym->s_kind = FMEMBER;
361 		msym->s_scl = MOS;
362 		msym->s_styp = expr_zalloc(sizeof(*msym->s_styp));
363 		msym->s_styp->sou_tag = expr_zalloc(
364 		    sizeof(*msym->s_styp->sou_tag));
365 		msym->s_styp->sou_tag->s_name = unnamed;
366 		msym->s_value.v_tspec = INT;
367 		return msym;
368 	}
369 
370 	/* Set str to the tag of which msym is expected to be a member. */
371 	str = NULL;
372 	t = (tp = tn->tn_type)->t_tspec;
373 	if (op == POINT) {
374 		if (t == STRUCT || t == UNION)
375 			str = tp->t_str;
376 	} else if (op == ARROW && t == PTR) {
377 		t = (tp = tp->t_subt)->t_tspec;
378 		if (t == STRUCT || t == UNION)
379 			str = tp->t_str;
380 	}
381 
382 	/*
383 	 * If this struct/union has a member with the name of msym, return it.
384 	 */
385 	if (str != NULL) {
386 		for (sym = msym; sym != NULL; sym = sym->s_link) {
387 			if (sym->s_scl != MOS && sym->s_scl != MOU)
388 				continue;
389 			if (sym->s_styp != str)
390 				continue;
391 			if (strcmp(sym->s_name, msym->s_name) != 0)
392 				continue;
393 			return sym;
394 		}
395 	}
396 
397 	/*
398 	 * Set eq to false if there are struct/union members with the same
399 	 * name and different types and/or offsets.
400 	 */
401 	eq = true;
402 	for (csym = msym; csym != NULL; csym = csym->s_link) {
403 		if (csym->s_scl != MOS && csym->s_scl != MOU)
404 			continue;
405 		if (strcmp(msym->s_name, csym->s_name) != 0)
406 			continue;
407 		for (sym = csym->s_link; sym != NULL; sym = sym->s_link) {
408 			bool w;
409 
410 			if (sym->s_scl != MOS && sym->s_scl != MOU)
411 				continue;
412 			if (strcmp(csym->s_name, sym->s_name) != 0)
413 				continue;
414 			if (csym->s_value.v_quad != sym->s_value.v_quad) {
415 				eq = false;
416 				break;
417 			}
418 			w = false;
419 			eq = eqtype(csym->s_type, sym->s_type,
420 			    false, false, &w) && !w;
421 			if (!eq)
422 				break;
423 			if (csym->s_bitfield != sym->s_bitfield) {
424 				eq = false;
425 				break;
426 			}
427 			if (csym->s_bitfield) {
428 				type_t	*tp1, *tp2;
429 
430 				tp1 = csym->s_type;
431 				tp2 = sym->s_type;
432 				if (tp1->t_flen != tp2->t_flen) {
433 					eq = false;
434 					break;
435 				}
436 				if (tp1->t_foffs != tp2->t_foffs) {
437 					eq = false;
438 					break;
439 				}
440 			}
441 		}
442 		if (!eq)
443 			break;
444 	}
445 
446 	/*
447 	 * Now handle the case in which the left operand refers really
448 	 * to a struct/union, but the right operand is not member of it.
449 	 */
450 	if (str != NULL) {
451 		if (eq && tflag) {
452 			/* illegal member use: %s */
453 			warning(102, msym->s_name);
454 		} else {
455 			/* illegal member use: %s */
456 			error(102, msym->s_name);
457 		}
458 		return msym;
459 	}
460 
461 	/*
462 	 * Now the left operand of ARROW does not point to a struct/union
463 	 * or the left operand of POINT is no struct/union.
464 	 */
465 	if (eq) {
466 		if (op == POINT) {
467 			if (tflag) {
468 				/* left operand of '.' must be struct ... */
469 				warning(103, type_name(tn->tn_type));
470 			} else {
471 				/* left operand of '.' must be struct ... */
472 				error(103, type_name(tn->tn_type));
473 			}
474 		} else {
475 			if (tflag && tn->tn_type->t_tspec == PTR) {
476 				/* left operand of '->' must be pointer ... */
477 				warning(104, type_name(tn->tn_type));
478 			} else {
479 				/* left operand of '->' must be pointer ... */
480 				error(104, type_name(tn->tn_type));
481 			}
482 		}
483 	} else {
484 		if (tflag) {
485 			/* non-unique member requires struct/union %s */
486 			error(105, op == POINT ? "object" : "pointer");
487 		} else {
488 			/* unacceptable operand of '%s' */
489 			error(111, op_name(op));
490 		}
491 	}
492 
493 	return msym;
494 }
495 
496 tnode_t *
497 build_generic_selection(const tnode_t *expr,
498 			struct generic_association *sel)
499 {
500 	tnode_t *default_result = NULL;
501 
502 	for (; sel != NULL; sel = sel->ga_prev)
503 		if (expr != NULL &&
504 		    eqtype(sel->ga_arg, expr->tn_type, false, false, NULL))
505 			return sel->ga_result;
506 		else if (sel->ga_arg == NULL)
507 			default_result = sel->ga_result;
508 	return default_result;
509 }
510 
511 /*
512  * Create a tree node. Called for most operands except function calls,
513  * sizeof and casts.
514  *
515  * op	operator
516  * ln	left operand
517  * rn	if not NULL, right operand
518  */
519 tnode_t *
520 build_binary(tnode_t *ln, op_t op, tnode_t *rn)
521 {
522 	const mod_t *mp;
523 	tnode_t	*ntn;
524 	type_t	*rettp;
525 
526 	mp = &modtab[op];
527 
528 	/* If there was an error in one of the operands, return. */
529 	if (ln == NULL || (mp->m_binary && rn == NULL))
530 		return NULL;
531 
532 	/*
533 	 * Apply class conversions to the left operand, but only if its
534 	 * value is needed or it is compared with null.
535 	 */
536 	if (mp->m_left_value_context || mp->m_left_test_context)
537 		ln = cconv(ln);
538 	/*
539 	 * The right operand is almost always in a test or value context,
540 	 * except if it is a struct or union member.
541 	 */
542 	if (mp->m_binary && op != ARROW && op != POINT)
543 		rn = cconv(rn);
544 
545 	/*
546 	 * Print some warnings for comparisons of unsigned values with
547 	 * constants lower than or equal to null. This must be done
548 	 * before promote() because otherwise unsigned char and unsigned
549 	 * short would be promoted to int. Also types are tested to be
550 	 * CHAR, which would also become int.
551 	 */
552 	if (mp->m_comparison)
553 		check_integer_comparison(op, ln, rn);
554 
555 	/*
556 	 * Promote the left operand if it is in a test or value context
557 	 */
558 	if (mp->m_left_value_context || mp->m_left_test_context)
559 		ln = promote(op, false, ln);
560 	/*
561 	 * Promote the right operand, but only if it is no struct or
562 	 * union member, or if it is not to be assigned to the left operand
563 	 */
564 	if (mp->m_binary && op != ARROW && op != POINT &&
565 	    op != ASSIGN && op != RETURN && op != INIT) {
566 		rn = promote(op, false, rn);
567 	}
568 
569 	/*
570 	 * If the result of the operation is different for signed or
571 	 * unsigned operands and one of the operands is signed only in
572 	 * ANSI C, print a warning.
573 	 */
574 	if (mp->m_warn_if_left_unsigned_in_c90 &&
575 	    ln->tn_op == CON && ln->tn_val->v_unsigned_since_c90) {
576 		/* ANSI C treats constant as unsigned, op %s */
577 		warning(218, mp->m_name);
578 		ln->tn_val->v_unsigned_since_c90 = false;
579 	}
580 	if (mp->m_warn_if_right_unsigned_in_c90 &&
581 	    rn->tn_op == CON && rn->tn_val->v_unsigned_since_c90) {
582 		/* ANSI C treats constant as unsigned, op %s */
583 		warning(218, mp->m_name);
584 		rn->tn_val->v_unsigned_since_c90 = false;
585 	}
586 
587 	/* Make sure both operands are of the same type */
588 	if (mp->m_balance_operands || (tflag && (op == SHL || op == SHR)))
589 		balance(op, &ln, &rn);
590 
591 	/*
592 	 * Check types for compatibility with the operation and mutual
593 	 * compatibility. Return if there are serious problems.
594 	 */
595 	if (!typeok(op, 0, ln, rn))
596 		return NULL;
597 
598 	/* And now create the node. */
599 	switch (op) {
600 	case POINT:
601 	case ARROW:
602 		ntn = build_struct_access(op, ln, rn);
603 		break;
604 	case INCAFT:
605 	case DECAFT:
606 	case INCBEF:
607 	case DECBEF:
608 		ntn = build_prepost_incdec(op, ln);
609 		break;
610 	case ADDR:
611 		ntn = build_address(ln, false);
612 		break;
613 	case INDIR:
614 		ntn = new_tnode(INDIR, ln->tn_type->t_subt, ln, NULL);
615 		break;
616 	case PLUS:
617 	case MINUS:
618 		ntn = build_plus_minus(op, ln, rn);
619 		break;
620 	case SHL:
621 	case SHR:
622 		ntn = build_bit_shift(op, ln, rn);
623 		break;
624 	case COLON:
625 		ntn = build_colon(ln, rn);
626 		break;
627 	case ASSIGN:
628 	case MULASS:
629 	case DIVASS:
630 	case MODASS:
631 	case ADDASS:
632 	case SUBASS:
633 	case SHLASS:
634 	case SHRASS:
635 	case ANDASS:
636 	case XORASS:
637 	case ORASS:
638 	case RETURN:
639 	case INIT:
640 		ntn = build_assignment(op, ln, rn);
641 		break;
642 	case COMMA:
643 	case QUEST:
644 		ntn = new_tnode(op, rn->tn_type, ln, rn);
645 		break;
646 	case REAL:
647 	case IMAG:
648 		ntn = build_real_imag(op, ln);
649 		break;
650 	default:
651 		rettp = mp->m_returns_bool
652 		    ? gettyp(Tflag ? BOOL : INT) : ln->tn_type;
653 		lint_assert(mp->m_binary || rn == NULL);
654 		ntn = new_tnode(op, rettp, ln, rn);
655 		break;
656 	}
657 
658 	/* Return if an error occurred. */
659 	if (ntn == NULL)
660 		return NULL;
661 
662 	/* Print a warning if precedence confusion is possible */
663 	if (mp->m_possible_precedence_confusion)
664 		check_precedence_confusion(ntn);
665 
666 	/*
667 	 * Print a warning if one of the operands is in a context where
668 	 * it is compared with null and if this operand is a constant.
669 	 */
670 	if (mp->m_left_test_context) {
671 		if (ln->tn_op == CON ||
672 		    ((mp->m_binary && op != QUEST) && rn->tn_op == CON)) {
673 			if (hflag && !constcond_flag &&
674 			    !ln->tn_system_dependent)
675 				/* constant in conditional context */
676 				warning(161);
677 		}
678 	}
679 
680 	/* Fold if the operator requires it */
681 	if (mp->m_fold_constant_operands) {
682 		if (ln->tn_op == CON && (!mp->m_binary || rn->tn_op == CON)) {
683 			if (mp->m_left_test_context) {
684 				ntn = fold_test(ntn);
685 			} else if (is_floating(ntn->tn_type->t_tspec)) {
686 				ntn = fold_float(ntn);
687 			} else {
688 				ntn = fold(ntn);
689 			}
690 		} else if (op == QUEST && ln->tn_op == CON) {
691 			ntn = ln->tn_val->v_quad != 0
692 			    ? rn->tn_left : rn->tn_right;
693 		}
694 	}
695 
696 	return ntn;
697 }
698 
699 tnode_t *
700 build_unary(op_t op, tnode_t *tn)
701 {
702 	return build_binary(tn, op, NULL);
703 }
704 
705 tnode_t *
706 build_member_access(tnode_t *ln, op_t op, sbuf_t *member)
707 {
708 	sym_t	*msym;
709 
710 	if (ln == NULL)
711 		return NULL;
712 
713 	if (op == ARROW) {
714 		/* must do this before struct_or_union_member is called */
715 		ln = cconv(ln);
716 	}
717 	msym = struct_or_union_member(ln, op, getsym(member));
718 	return build_binary(ln, op, build_name(msym, 0));
719 }
720 
721 /*
722  * Perform class conversions.
723  *
724  * Arrays of type T are converted into pointers to type T.
725  * Functions are converted to pointers to functions.
726  * Lvalues are converted to rvalues.
727  *
728  * C99 6.3 "Conversions"
729  * C99 6.3.2 "Other operands"
730  * C99 6.3.2.1 "Lvalues, arrays, and function designators"
731  */
732 tnode_t *
733 cconv(tnode_t *tn)
734 {
735 	type_t	*tp;
736 
737 	/*
738 	 * Array-lvalue (array of type T) is converted into rvalue
739 	 * (pointer to type T)
740 	 */
741 	if (tn->tn_type->t_tspec == ARRAY) {
742 		if (!tn->tn_lvalue) {
743 			/* XXX print correct operator */
744 			/* %soperand of '%s' must be lvalue */
745 			gnuism(114, "", op_name(ADDR));
746 		}
747 		tn = new_tnode(ADDR,
748 		    expr_derive_type(tn->tn_type->t_subt, PTR), tn, NULL);
749 	}
750 
751 	/*
752 	 * Expression of type function (function with return value of type T)
753 	 * in rvalue-expression (pointer to function with return value
754 	 * of type T)
755 	 */
756 	if (tn->tn_type->t_tspec == FUNC)
757 		tn = build_address(tn, true);
758 
759 	/* lvalue to rvalue */
760 	if (tn->tn_lvalue) {
761 		tp = expr_dup_type(tn->tn_type);
762 		/* C99 6.3.2.1p2 sentence 2 says to remove the qualifiers. */
763 		tp->t_const = tp->t_volatile = false;
764 		tn = new_tnode(LOAD, tp, tn, NULL);
765 	}
766 
767 	return tn;
768 }
769 
770 const tnode_t *
771 before_conversion(const tnode_t *tn)
772 {
773 	while (tn->tn_op == CVT && !tn->tn_cast)
774 		tn = tn->tn_left;
775 	return tn;
776 }
777 
778 static bool
779 is_null_pointer(const tnode_t *tn)
780 {
781 	tspec_t t = tn->tn_type->t_tspec;
782 
783 	return ((t == PTR && tn->tn_type->t_subt->t_tspec == VOID) ||
784 		is_integer(t))
785 	       && (tn->tn_op == CON && tn->tn_val->v_quad == 0);
786 }
787 
788 /*
789  * Most errors required by ANSI C are reported in struct_or_union_member().
790  * Here we only check for totally wrong things.
791  */
792 static bool
793 typeok_point(const tnode_t *ln, const type_t *ltp, tspec_t lt)
794 {
795 	if (lt == FUNC || lt == VOID || ltp->t_bitfield ||
796 	    ((lt != STRUCT && lt != UNION) && !ln->tn_lvalue)) {
797 		/* Without tflag we got already an error */
798 		if (tflag)
799 			/* unacceptable operand of '%s' */
800 			error(111, op_name(POINT));
801 		return false;
802 	}
803 	return true;
804 }
805 
806 static bool
807 typeok_arrow(tspec_t lt)
808 {
809 	if (lt == PTR || (tflag && is_integer(lt)))
810 		return true;
811 
812 	/* Without tflag we got already an error */
813 	if (tflag)
814 		/* unacceptable operand of '%s' */
815 		error(111, op_name(ARROW));
816 	return false;
817 }
818 
819 static bool
820 typeok_incdec(op_t op, const tnode_t *tn, const type_t *tp)
821 {
822 	/* operand has scalar type (checked in typeok) */
823 	if (!tn->tn_lvalue) {
824 		if (tn->tn_op == CVT && tn->tn_cast &&
825 		    tn->tn_left->tn_op == LOAD) {
826 			/* a cast does not yield an lvalue */
827 			error(163);
828 		}
829 		/* %soperand of '%s' must be lvalue */
830 		error(114, "", op_name(op));
831 		return false;
832 	} else if (tp->t_const) {
833 		if (!tflag)
834 			/* %soperand of '%s' must be modifiable lvalue */
835 			warning(115, "", op_name(op));
836 	}
837 	return true;
838 }
839 
840 static bool
841 typeok_address(const mod_t *mp,
842 	       const tnode_t *tn, const type_t *tp, tspec_t t)
843 {
844 	if (t == ARRAY || t == FUNC) {
845 		/* ok, a warning comes later (in build_address()) */
846 	} else if (!tn->tn_lvalue) {
847 		if (tn->tn_op == CVT && tn->tn_cast &&
848 		    tn->tn_left->tn_op == LOAD) {
849 			/* a cast does not yield an lvalue */
850 			error(163);
851 		}
852 		/* %soperand of '%s' must be lvalue */
853 		error(114, "", mp->m_name);
854 		return false;
855 	} else if (is_scalar(t)) {
856 		if (tp->t_bitfield) {
857 			/* cannot take address of bit-field */
858 			error(112);
859 			return false;
860 		}
861 	} else if (t != STRUCT && t != UNION) {
862 		/* unacceptable operand of '%s' */
863 		error(111, mp->m_name);
864 		return false;
865 	}
866 	if (tn->tn_op == NAME && tn->tn_sym->s_reg) {
867 		/* cannot take address of register %s */
868 		error(113, tn->tn_sym->s_name);
869 		return false;
870 	}
871 	return true;
872 }
873 
874 static bool
875 typeok_indir(tspec_t t)
876 {
877 	/* until now there were no type checks for this operator */
878 	if (t != PTR) {
879 		/* cannot dereference non-pointer type */
880 		error(96);
881 		return false;
882 	}
883 	return true;
884 }
885 
886 static bool
887 typeok_plus(op_t op,
888 	    const type_t *ltp, tspec_t lt,
889 	    const type_t *rtp, tspec_t rt)
890 {
891 	/* operands have scalar types (checked above) */
892 	if ((lt == PTR && !is_integer(rt)) || (rt == PTR && !is_integer(lt))) {
893 		warn_incompatible_types(op, ltp, lt, rtp, rt);
894 		return false;
895 	}
896 	return true;
897 }
898 
899 static bool
900 typeok_minus(op_t op,
901 	     const type_t *ltp, tspec_t lt,
902 	     const type_t *rtp, tspec_t rt)
903 {
904 	/* operands have scalar types (checked above) */
905 	if (lt == PTR && (!is_integer(rt) && rt != PTR)) {
906 		warn_incompatible_types(op, ltp, lt, rtp, rt);
907 		return false;
908 	} else if (rt == PTR && lt != PTR) {
909 		warn_incompatible_types(op, ltp, lt, rtp, rt);
910 		return false;
911 	}
912 	if (lt == PTR && rt == PTR) {
913 		if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
914 			/* illegal pointer subtraction */
915 			error(116);
916 		}
917 	}
918 	return true;
919 }
920 
921 static void
922 typeok_shr(const mod_t *mp,
923 	   const tnode_t *ln, tspec_t lt,
924 	   const tnode_t *rn, tspec_t rt)
925 {
926 	tspec_t olt, ort;
927 
928 	olt = before_conversion(ln)->tn_type->t_tspec;
929 	ort = before_conversion(rn)->tn_type->t_tspec;
930 
931 	/* operands have integer types (checked above) */
932 	if (pflag && !is_uinteger(olt)) {
933 		/*
934 		 * The left operand is signed. This means that
935 		 * the operation is (possibly) nonportable.
936 		 */
937 		if (ln->tn_op != CON) {
938 			/* bitwise '%s' on signed value possibly nonportable */
939 			warning(117, mp->m_name);
940 		} else if (ln->tn_val->v_quad < 0) {
941 			/* bitwise '%s' on signed value nonportable */
942 			warning(120, mp->m_name);
943 		}
944 	} else if (!tflag && !sflag && !is_uinteger(olt) && is_uinteger(ort)) {
945 		/*
946 		 * The left operand would become unsigned in
947 		 * traditional C.
948 		 */
949 		if (hflag && !Sflag &&
950 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
951 			/* semantics of '%s' change in ANSI C; use ... */
952 			warning(118, mp->m_name);
953 		}
954 	} else if (!tflag && !sflag && !is_uinteger(olt) && !is_uinteger(ort) &&
955 		   portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
956 		/*
957 		 * In traditional C the left operand would be extended,
958 		 * possibly with 1, and then shifted.
959 		 */
960 		if (hflag && !Sflag &&
961 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
962 			/* semantics of '%s' change in ANSI C; use ... */
963 			warning(118, mp->m_name);
964 		}
965 	}
966 }
967 
968 static void
969 typeok_shl(const mod_t *mp, tspec_t lt, tspec_t rt)
970 {
971 	/*
972 	 * C90 does not perform balancing for shift operations,
973 	 * but traditional C does. If the width of the right operand
974 	 * is greater than the width of the left operand, then in
975 	 * traditional C the left operand would be extended to the
976 	 * width of the right operand. For SHL this may result in
977 	 * different results.
978 	 */
979 	if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
980 		/*
981 		 * XXX If both operands are constant, make sure
982 		 * that there is really a difference between
983 		 * ANSI C and traditional C.
984 		 */
985 		if (hflag && !Sflag)
986 			/* semantics of '%s' change in ANSI C; use ... */
987 			warning(118, mp->m_name);
988 	}
989 }
990 
991 static void
992 typeok_shift(tspec_t lt, const tnode_t *rn, tspec_t rt)
993 {
994 	if (rn->tn_op != CON)
995 		return;
996 
997 	if (!is_uinteger(rt) && rn->tn_val->v_quad < 0) {
998 		/* negative shift */
999 		warning(121);
1000 	} else if ((uint64_t)rn->tn_val->v_quad ==
1001 		   (uint64_t)size_in_bits(lt)) {
1002 		/* shift equal to size of object */
1003 		warning(267);
1004 	} else if ((uint64_t)rn->tn_val->v_quad > (uint64_t)size_in_bits(lt)) {
1005 		/* shift amount %llu is greater than bit-size %llu of '%s' */
1006 		warning(122, (unsigned long long)rn->tn_val->v_quad,
1007 		    (unsigned long long)size_in_bits(lt),
1008 		    tspec_name(lt));
1009 	}
1010 }
1011 
1012 static bool
1013 is_typeok_eq(const tnode_t *ln, tspec_t lt, const tnode_t *rn, tspec_t rt)
1014 {
1015 	if (lt == PTR && is_null_pointer(rn))
1016 		return true;
1017 	if (rt == PTR && is_null_pointer(ln))
1018 		return true;
1019 	return false;
1020 }
1021 
1022 static bool
1023 typeok_compare(op_t op,
1024 	       const tnode_t *ln, const type_t *ltp, tspec_t lt,
1025 	       const tnode_t *rn, const type_t *rtp, tspec_t rt)
1026 {
1027 	const char *lx, *rx;
1028 
1029 	if (lt == PTR && rt == PTR) {
1030 		check_pointer_comparison(op, ln, rn);
1031 		return true;
1032 	}
1033 
1034 	if (lt != PTR && rt != PTR)
1035 		return true;
1036 
1037 	if (!is_integer(lt) && !is_integer(rt)) {
1038 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1039 		return false;
1040 	}
1041 
1042 	lx = lt == PTR ? "pointer" : "integer";
1043 	rx = rt == PTR ? "pointer" : "integer";
1044 	/* illegal combination of %s (%s) and %s (%s), op %s */
1045 	warning(123, lx, type_name(ltp), rx, type_name(rtp), op_name(op));
1046 	return true;
1047 }
1048 
1049 static bool
1050 typeok_quest(tspec_t lt, const tnode_t *rn)
1051 {
1052 	if (!is_scalar(lt)) {
1053 		/* first operand must have scalar type, op ? : */
1054 		error(170);
1055 		return false;
1056 	}
1057 	lint_assert(before_conversion(rn)->tn_op == COLON);
1058 	return true;
1059 }
1060 
1061 static void
1062 typeok_colon_pointer(const mod_t *mp, const type_t *ltp, const type_t *rtp)
1063 {
1064 	type_t *lstp = ltp->t_subt;
1065 	type_t *rstp = rtp->t_subt;
1066 	tspec_t lst = lstp->t_tspec;
1067 	tspec_t rst = rstp->t_tspec;
1068 
1069 	if ((lst == VOID && rst == FUNC) || (lst == FUNC && rst == VOID)) {
1070 		/* (void *)0 handled above */
1071 		if (sflag)
1072 			/* ANSI C forbids conversion of %s to %s, op %s */
1073 			warning(305, "function pointer", "'void *'",
1074 			    mp->m_name);
1075 		return;
1076 	}
1077 
1078 	if (eqptrtype(lstp, rstp, true))
1079 		return;
1080 	if (!eqtype(lstp, rstp, true, false, NULL))
1081 		warn_incompatible_pointers(mp, ltp, rtp);
1082 }
1083 
1084 static bool
1085 typeok_colon(const mod_t *mp,
1086 	     const tnode_t *ln, const type_t *ltp, tspec_t lt,
1087 	     const tnode_t *rn, const type_t *rtp, tspec_t rt)
1088 {
1089 
1090 	if (is_arithmetic(lt) && is_arithmetic(rt))
1091 		return true;
1092 	if (lt == BOOL && rt == BOOL)
1093 		return true;
1094 
1095 	if (lt == STRUCT && rt == STRUCT && ltp->t_str == rtp->t_str)
1096 		return true;
1097 	if (lt == UNION && rt == UNION && ltp->t_str == rtp->t_str)
1098 		return true;
1099 
1100 	if (lt == PTR && is_null_pointer(rn))
1101 		return true;
1102 	if (rt == PTR && is_null_pointer(ln))
1103 		return true;
1104 
1105 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1106 		const char *lx = lt == PTR ? "pointer" : "integer";
1107 		const char *rx = rt == PTR ? "pointer" : "integer";
1108 		/* illegal combination of %s (%s) and %s (%s), op %s */
1109 		warning(123, lx, type_name(ltp),
1110 		    rx, type_name(rtp), mp->m_name);
1111 		return true;
1112 	}
1113 
1114 	if (lt == VOID || rt == VOID) {
1115 		if (lt != VOID || rt != VOID)
1116 			/* incompatible types '%s' and '%s' in conditional */
1117 			warning(126, type_name(ltp), type_name(rtp));
1118 		return true;
1119 	}
1120 
1121 	if (lt == PTR && rt == PTR) {
1122 		typeok_colon_pointer(mp, ltp, rtp);
1123 		return true;
1124 	}
1125 
1126 	/* incompatible types '%s' and '%s' in conditional */
1127 	error(126, type_name(ltp), type_name(rtp));
1128 	return false;
1129 }
1130 
1131 static bool
1132 typeok_assign(op_t op, const tnode_t *ln, const type_t *ltp, tspec_t lt)
1133 {
1134 	if (op == RETURN || op == INIT || op == FARG)
1135 		return true;
1136 
1137 	if (!ln->tn_lvalue) {
1138 		if (ln->tn_op == CVT && ln->tn_cast &&
1139 		    ln->tn_left->tn_op == LOAD) {
1140 			/* a cast does not yield an lvalue */
1141 			error(163);
1142 		}
1143 		/* %soperand of '%s' must be lvalue */
1144 		error(114, "left ", op_name(op));
1145 		return false;
1146 	} else if (ltp->t_const || ((lt == STRUCT || lt == UNION) &&
1147 				    has_constant_member(ltp))) {
1148 		if (!tflag)
1149 			/* %soperand of '%s' must be modifiable lvalue */
1150 			warning(115, "left ", op_name(op));
1151 	}
1152 	return true;
1153 }
1154 
1155 /* Check the types using the information from modtab[]. */
1156 static bool
1157 typeok_scalar(op_t op, const mod_t *mp,
1158 	      const type_t *ltp, tspec_t lt,
1159 	      const type_t *rtp, tspec_t rt)
1160 {
1161 	if (mp->m_takes_bool && lt == BOOL && rt == BOOL)
1162 		return true;
1163 	if (mp->m_requires_integer) {
1164 		if (!is_integer(lt) || (mp->m_binary && !is_integer(rt))) {
1165 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1166 			return false;
1167 		}
1168 	} else if (mp->m_requires_integer_or_complex) {
1169 		if ((!is_integer(lt) && !is_complex(lt)) ||
1170 		    (mp->m_binary && (!is_integer(rt) && !is_complex(rt)))) {
1171 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1172 			return false;
1173 		}
1174 	} else if (mp->m_requires_scalar) {
1175 		if (!is_scalar(lt) || (mp->m_binary && !is_scalar(rt))) {
1176 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1177 			return false;
1178 		}
1179 	} else if (mp->m_requires_arith) {
1180 		if (!is_arithmetic(lt) ||
1181 		    (mp->m_binary && !is_arithmetic(rt))) {
1182 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1183 			return false;
1184 		}
1185 	}
1186 	return true;
1187 }
1188 
1189 /*
1190  * Check the types for specific operators and type combinations.
1191  *
1192  * At this point, the operands already conform to the type requirements of
1193  * the operator, such as being integer, floating or scalar.
1194  */
1195 static bool
1196 typeok_op(op_t op, const mod_t *mp, int arg,
1197 	  const tnode_t *ln, const type_t *ltp, tspec_t lt,
1198 	  const tnode_t *rn, const type_t *rtp, tspec_t rt)
1199 {
1200 	switch (op) {
1201 	case ARROW:
1202 		return typeok_arrow(lt);
1203 	case POINT:
1204 		return typeok_point(ln, ltp, lt);
1205 	case INCBEF:
1206 	case DECBEF:
1207 	case INCAFT:
1208 	case DECAFT:
1209 		return typeok_incdec(op, ln, ltp);
1210 	case INDIR:
1211 		return typeok_indir(lt);
1212 	case ADDR:
1213 		return typeok_address(mp, ln, ltp, lt);
1214 	case PLUS:
1215 		return typeok_plus(op, ltp, lt, rtp, rt);
1216 	case MINUS:
1217 		return typeok_minus(op, ltp, lt, rtp, rt);
1218 	case SHL:
1219 		typeok_shl(mp, lt, rt);
1220 		goto shift;
1221 	case SHR:
1222 		typeok_shr(mp, ln, lt, rn, rt);
1223 	shift:
1224 		typeok_shift(lt, rn, rt);
1225 		break;
1226 	case LT:
1227 	case LE:
1228 	case GT:
1229 	case GE:
1230 	compare:
1231 		return typeok_compare(op, ln, ltp, lt, rn, rtp, rt);
1232 	case EQ:
1233 	case NE:
1234 		if (is_typeok_eq(ln, lt, rn, rt))
1235 			break;
1236 		goto compare;
1237 	case QUEST:
1238 		return typeok_quest(lt, rn);
1239 	case COLON:
1240 		return typeok_colon(mp, ln, ltp, lt, rn, rtp, rt);
1241 	case ASSIGN:
1242 	case INIT:
1243 	case FARG:
1244 	case RETURN:
1245 		if (!check_assign_types_compatible(op, arg, ln, rn))
1246 			return false;
1247 		goto assign;
1248 	case MULASS:
1249 	case DIVASS:
1250 	case MODASS:
1251 		goto assign;
1252 	case ADDASS:
1253 	case SUBASS:
1254 		if ((lt == PTR && !is_integer(rt)) || rt == PTR) {
1255 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1256 			return false;
1257 		}
1258 		goto assign;
1259 	case SHLASS:
1260 		goto assign;
1261 	case SHRASS:
1262 		if (pflag && !is_uinteger(lt) && !(tflag && is_uinteger(rt))) {
1263 			/* bitwise '%s' on signed value possibly nonportable */
1264 			warning(117, mp->m_name);
1265 		}
1266 		goto assign;
1267 	case ANDASS:
1268 	case XORASS:
1269 	case ORASS:
1270 	assign:
1271 		return typeok_assign(op, ln, ltp, lt);
1272 	case COMMA:
1273 		if (!modtab[ln->tn_op].m_has_side_effect)
1274 			check_null_effect(ln);
1275 		break;
1276 	default:
1277 		break;
1278 	}
1279 	return true;
1280 }
1281 
1282 static void
1283 typeok_enum(op_t op, const mod_t *mp, int arg,
1284 	    const tnode_t *ln, const type_t *ltp,
1285 	    const tnode_t *rn, const type_t *rtp)
1286 {
1287 	if (mp->m_bad_on_enum &&
1288 	    (ltp->t_is_enum || (mp->m_binary && rtp->t_is_enum))) {
1289 		check_bad_enum_operation(op, ln, rn);
1290 	} else if (mp->m_valid_on_enum &&
1291 		   (ltp->t_is_enum && rtp != NULL && rtp->t_is_enum)) {
1292 		check_enum_type_mismatch(op, arg, ln, rn);
1293 	} else if (mp->m_valid_on_enum &&
1294 		   (ltp->t_is_enum || (rtp != NULL && rtp->t_is_enum))) {
1295 		check_enum_int_mismatch(op, arg, ln, rn);
1296 	}
1297 }
1298 
1299 /* Perform most type checks. Return whether the types are ok. */
1300 bool
1301 typeok(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1302 {
1303 	const mod_t *mp;
1304 	tspec_t	lt, rt;
1305 	type_t	*ltp, *rtp;
1306 
1307 	mp = &modtab[op];
1308 
1309 	lint_assert((ltp = ln->tn_type) != NULL);
1310 	lt = ltp->t_tspec;
1311 
1312 	if (mp->m_binary) {
1313 		lint_assert((rtp = rn->tn_type) != NULL);
1314 		rt = rtp->t_tspec;
1315 	} else {
1316 		rtp = NULL;
1317 		rt = NOTSPEC;
1318 	}
1319 
1320 	if (Tflag && !typeok_scalar_strict_bool(op, mp, arg, ln, rn))
1321 		return false;
1322 	if (!typeok_scalar(op, mp, ltp, lt, rtp, rt))
1323 		return false;
1324 
1325 	if (!typeok_op(op, mp, arg, ln, ltp, lt, rn, rtp, rt))
1326 		return false;
1327 
1328 	typeok_enum(op, mp, arg, ln, ltp, rn, rtp);
1329 	return true;
1330 }
1331 
1332 static void
1333 check_pointer_comparison(op_t op, const tnode_t *ln, const tnode_t *rn)
1334 {
1335 	type_t	*ltp, *rtp;
1336 	tspec_t	lst, rst;
1337 	const	char *lsts, *rsts;
1338 
1339 	lst = (ltp = ln->tn_type)->t_subt->t_tspec;
1340 	rst = (rtp = rn->tn_type)->t_subt->t_tspec;
1341 
1342 	if (lst == VOID || rst == VOID) {
1343 		if (sflag && (lst == FUNC || rst == FUNC)) {
1344 			/* (void *)0 already handled in typeok() */
1345 			*(lst == FUNC ? &lsts : &rsts) = "function pointer";
1346 			*(lst == VOID ? &lsts : &rsts) = "'void *'";
1347 			/* ANSI C forbids comparison of %s with %s */
1348 			warning(274, lsts, rsts);
1349 		}
1350 		return;
1351 	}
1352 
1353 	if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
1354 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1355 		return;
1356 	}
1357 
1358 	if (lst == FUNC && rst == FUNC) {
1359 		if (sflag && op != EQ && op != NE)
1360 			/* ANSI C forbids ordered comparisons of ... */
1361 			warning(125);
1362 	}
1363 }
1364 
1365 static bool
1366 is_direct_function_call(const tnode_t *tn, const char **out_name)
1367 {
1368 
1369 	if (!(tn->tn_op == CALL &&
1370 	      tn->tn_left->tn_op == ADDR &&
1371 	      tn->tn_left->tn_left->tn_op == NAME))
1372 		return false;
1373 
1374 	*out_name = tn->tn_left->tn_left->tn_sym->s_name;
1375 	return true;
1376 }
1377 
1378 static bool
1379 is_unconst_function(const char *name)
1380 {
1381 
1382 	return strcmp(name, "memchr") == 0 ||
1383 	       strcmp(name, "strchr") == 0 ||
1384 	       strcmp(name, "strpbrk") == 0 ||
1385 	       strcmp(name, "strrchr") == 0 ||
1386 	       strcmp(name, "strstr") == 0;
1387 }
1388 
1389 static bool
1390 is_const_char_pointer(const tnode_t *tn)
1391 {
1392 	const type_t *tp;
1393 
1394 	/*
1395 	 * For traditional reasons, C99 6.4.5p5 defines that string literals
1396 	 * have type 'char[]'.  They are often implicitly converted to
1397 	 * 'char *', for example when they are passed as function arguments.
1398 	 *
1399 	 * C99 6.4.5p6 further defines that modifying a string that is
1400 	 * constructed from a string literal invokes undefined behavior.
1401 	 *
1402 	 * Out of these reasons, string literals are treated as 'effectively
1403 	 * const' here.
1404 	 */
1405 	if (tn->tn_op == CVT &&
1406 	    tn->tn_left->tn_op == ADDR &&
1407 	    tn->tn_left->tn_left->tn_op == STRING)
1408 		return true;
1409 
1410 	tp = before_conversion(tn)->tn_type;
1411 	return tp->t_tspec == PTR &&
1412 	       tp->t_subt->t_tspec == CHAR &&
1413 	       tp->t_subt->t_const;
1414 }
1415 
1416 static bool
1417 is_const_pointer(const tnode_t *tn)
1418 {
1419 	const type_t *tp;
1420 
1421 	tp = before_conversion(tn)->tn_type;
1422 	return tp->t_tspec == PTR && tp->t_subt->t_const;
1423 }
1424 
1425 static bool
1426 is_first_arg_const_char_pointer(const tnode_t *tn)
1427 {
1428 	const tnode_t *an;
1429 
1430 	an = tn->tn_right;
1431 	if (an == NULL)
1432 		return false;
1433 
1434 	while (an->tn_right != NULL)
1435 		an = an->tn_right;
1436 	return is_const_char_pointer(an->tn_left);
1437 }
1438 
1439 static bool
1440 is_second_arg_const_pointer(const tnode_t *tn)
1441 {
1442 	const tnode_t *an;
1443 
1444 	an = tn->tn_right;
1445 	if (an == NULL || an->tn_right == NULL)
1446 		return false;
1447 
1448 	while (an->tn_right->tn_right != NULL)
1449 		an = an->tn_right;
1450 	return is_const_pointer(an->tn_left);
1451 }
1452 
1453 static void
1454 check_unconst_function(const type_t *lstp, const tnode_t *rn)
1455 {
1456 	const char *function_name;
1457 
1458 	if (lstp->t_tspec == CHAR && !lstp->t_const &&
1459 	    is_direct_function_call(rn, &function_name) &&
1460 	    is_unconst_function(function_name) &&
1461 	    is_first_arg_const_char_pointer(rn)) {
1462 		/* call to '%s' effectively discards 'const' from argument */
1463 		warning(346, function_name);
1464 	}
1465 
1466 	if (!lstp->t_const &&
1467 	    is_direct_function_call(rn, &function_name) &&
1468 	    strcmp(function_name, "bsearch") == 0 &&
1469 	    is_second_arg_const_pointer(rn)) {
1470 		/* call to '%s' effectively discards 'const' from argument */
1471 		warning(346, function_name);
1472 	}
1473 }
1474 
1475 static void
1476 check_assign_void_pointer(op_t op, int arg,
1477 			  tspec_t lt, tspec_t lst,
1478 			  tspec_t rt, tspec_t rst)
1479 {
1480 	const char *lts, *rts;
1481 
1482 	if (!(lt == PTR && rt == PTR && (lst == VOID || rst == VOID)))
1483 		return;
1484 	/* two pointers, at least one pointer to void */
1485 
1486 	if (!(sflag && (lst == FUNC || rst == FUNC)))
1487 		return;
1488 	/* comb. of ptr to func and ptr to void */
1489 
1490 	*(lst == FUNC ? &lts : &rts) = "function pointer";
1491 	*(lst == VOID ? &lts : &rts) = "'void *'";
1492 
1493 	switch (op) {
1494 	case INIT:
1495 	case RETURN:
1496 		/* ANSI C forbids conversion of %s to %s */
1497 		warning(303, rts, lts);
1498 		break;
1499 	case FARG:
1500 		/* ANSI C forbids conversion of %s to %s, arg #%d */
1501 		warning(304, rts, lts, arg);
1502 		break;
1503 	default:
1504 		/* ANSI C forbids conversion of %s to %s, op %s */
1505 		warning(305, rts, lts, op_name(op));
1506 		break;
1507 	}
1508 }
1509 
1510 static bool
1511 check_assign_void_pointer_compat(op_t op, int arg,
1512 				 const type_t *const ltp, tspec_t const lt,
1513 				 const type_t *const lstp, tspec_t const lst,
1514 				 const tnode_t *const rn,
1515 				 const type_t *const rtp, tspec_t const rt,
1516 				 const type_t *const rstp, tspec_t const rst)
1517 {
1518 	if (!(lt == PTR && rt == PTR && (lst == VOID || rst == VOID ||
1519 					 eqtype(lstp, rstp, true, false, NULL))))
1520 		return false;
1521 
1522 	/* compatible pointer types (qualifiers ignored) */
1523 	if (!tflag &&
1524 	    ((!lstp->t_const && rstp->t_const) ||
1525 	     (!lstp->t_volatile && rstp->t_volatile))) {
1526 		/* left side has not all qualifiers of right */
1527 		switch (op) {
1528 		case INIT:
1529 		case RETURN:
1530 			/* incompatible pointer types (%s != %s) */
1531 			warning(182, type_name(lstp), type_name(rstp));
1532 			break;
1533 		case FARG:
1534 			/* converting '%s' to incompatible '%s' ... */
1535 			warning(153,
1536 			    type_name(rtp), type_name(ltp), arg);
1537 			break;
1538 		default:
1539 			/* operands have incompatible pointer type... */
1540 			warning(128, op_name(op),
1541 			    type_name(lstp), type_name(rstp));
1542 			break;
1543 		}
1544 	}
1545 
1546 	if (!tflag)
1547 		check_unconst_function(lstp, rn);
1548 
1549 	return true;
1550 }
1551 
1552 static bool
1553 check_assign_pointer_integer(op_t op, int arg,
1554 			     const type_t *const ltp, tspec_t const lt,
1555 			     const type_t *const rtp, tspec_t const rt)
1556 {
1557 	const char *lx, *rx;
1558 
1559 	if (!((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)))
1560 		return false;
1561 
1562 	lx = lt == PTR ? "pointer" : "integer";
1563 	rx = rt == PTR ? "pointer" : "integer";
1564 
1565 	switch (op) {
1566 	case INIT:
1567 	case RETURN:
1568 		/* illegal combination of %s (%s) and %s (%s) */
1569 		warning(183, lx, type_name(ltp), rx, type_name(rtp));
1570 		break;
1571 	case FARG:
1572 		/* illegal combination of %s (%s) and %s (%s), arg #%d */
1573 		warning(154,
1574 		    lx, type_name(ltp), rx, type_name(rtp), arg);
1575 		break;
1576 	default:
1577 		/* illegal combination of %s (%s) and %s (%s), op %s */
1578 		warning(123,
1579 		    lx, type_name(ltp), rx, type_name(rtp), op_name(op));
1580 		break;
1581 	}
1582 	return true;
1583 }
1584 
1585 static bool
1586 check_assign_pointer(op_t op, int arg,
1587 		     const type_t *ltp, tspec_t lt,
1588 		     const type_t *rtp, tspec_t rt)
1589 {
1590 	if (!(lt == PTR && rt == PTR))
1591 		return false;
1592 
1593 	switch (op) {
1594 	case RETURN:
1595 		warn_incompatible_pointers(NULL, ltp, rtp);
1596 		break;
1597 	case FARG:
1598 		/* converting '%s' to incompatible '%s' for ... */
1599 		warning(153, type_name(rtp), type_name(ltp), arg);
1600 		break;
1601 	default:
1602 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1603 		break;
1604 	}
1605 	return true;
1606 }
1607 
1608 static void
1609 warn_assign(op_t op, int arg,
1610 	    const type_t *ltp, tspec_t lt,
1611 	    const type_t *rtp, tspec_t rt)
1612 {
1613 	switch (op) {
1614 	case INIT:
1615 		/* cannot initialize '%s' from '%s' */
1616 		error(185, type_name(ltp), type_name(rtp));
1617 		break;
1618 	case RETURN:
1619 		/* return value type mismatch (%s) and (%s) */
1620 		error(211, type_name(ltp), type_name(rtp));
1621 		break;
1622 	case FARG:
1623 		/* passing '%s' to incompatible '%s', arg #%d */
1624 		warning(155, type_name(rtp), type_name(ltp), arg);
1625 		break;
1626 	default:
1627 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1628 		break;
1629 	}
1630 }
1631 
1632 /*
1633  * Checks type compatibility for ASSIGN, INIT, FARG and RETURN
1634  * and prints warnings/errors if necessary.
1635  * Returns whether the types are (almost) compatible.
1636  */
1637 static bool
1638 check_assign_types_compatible(op_t op, int arg,
1639 			      const tnode_t *ln, const tnode_t *rn)
1640 {
1641 	tspec_t	lt, rt, lst = NOTSPEC, rst = NOTSPEC;
1642 	type_t	*ltp, *rtp, *lstp = NULL, *rstp = NULL;
1643 
1644 	if ((lt = (ltp = ln->tn_type)->t_tspec) == PTR)
1645 		lst = (lstp = ltp->t_subt)->t_tspec;
1646 	if ((rt = (rtp = rn->tn_type)->t_tspec) == PTR)
1647 		rst = (rstp = rtp->t_subt)->t_tspec;
1648 
1649 	if (lt == BOOL && is_scalar(rt))	/* C99 6.3.1.2 */
1650 		return true;
1651 
1652 	if (is_arithmetic(lt) && (is_arithmetic(rt) || rt == BOOL))
1653 		return true;
1654 
1655 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION))
1656 		/* both are struct or union */
1657 		return ltp->t_str == rtp->t_str;
1658 
1659 	/* a null pointer may be assigned to any pointer */
1660 	if (lt == PTR && is_null_pointer(rn))
1661 		return true;
1662 
1663 	check_assign_void_pointer(op, arg, lt, lst, rt, rst);
1664 
1665 	if (check_assign_void_pointer_compat(op, arg,
1666 	    ltp, lt, lstp, lst, rn, rtp, rt, rstp, rst))
1667 		return true;
1668 
1669 	if (check_assign_pointer_integer(op, arg, ltp, lt, rtp, rt))
1670 		return true;
1671 
1672 	if (check_assign_pointer(op, arg, ltp, lt, rtp, rt))
1673 		return true;
1674 
1675 	warn_assign(op, arg, ltp, lt, rtp, rt);
1676 	return false;
1677 }
1678 
1679 /* Prints a warning if a strange operator is used on an enum type. */
1680 static void
1681 check_bad_enum_operation(op_t op, const tnode_t *ln, const tnode_t *rn)
1682 {
1683 
1684 	if (!eflag)
1685 		return;
1686 
1687 	/*
1688 	 * Enum as offset to a pointer is an exception (otherwise enums
1689 	 * could not be used as array indices).
1690 	 */
1691 	if (op == PLUS &&
1692 	    ((ln->tn_type->t_is_enum && rn->tn_type->t_tspec == PTR) ||
1693 	     (rn->tn_type->t_is_enum && ln->tn_type->t_tspec == PTR))) {
1694 		return;
1695 	}
1696 
1697 	/* dubious operation on enum, op %s */
1698 	warning(241, op_name(op));
1699 }
1700 
1701 /*
1702  * Prints a warning if an operator is applied to two different enum types.
1703  */
1704 static void
1705 check_enum_type_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1706 {
1707 	const mod_t *mp;
1708 
1709 	mp = &modtab[op];
1710 
1711 	if (ln->tn_type->t_enum != rn->tn_type->t_enum) {
1712 		switch (op) {
1713 		case INIT:
1714 			/* enum type mismatch between '%s' and '%s' in ... */
1715 			warning(210,
1716 			    type_name(ln->tn_type), type_name(rn->tn_type));
1717 			break;
1718 		case FARG:
1719 			/* enum type mismatch, arg #%d (%s != %s) */
1720 			warning(156, arg,
1721 			    type_name(ln->tn_type), type_name(rn->tn_type));
1722 			break;
1723 		case RETURN:
1724 			/* return value type mismatch (%s) and (%s) */
1725 			warning(211,
1726 			    type_name(ln->tn_type), type_name(rn->tn_type));
1727 			break;
1728 		default:
1729 			/* enum type mismatch: '%s' '%s' '%s' */
1730 			warning(130, type_name(ln->tn_type), mp->m_name,
1731 			    type_name(rn->tn_type));
1732 			break;
1733 		}
1734 	} else if (Pflag && mp->m_comparison && op != EQ && op != NE) {
1735 		if (eflag)
1736 			/* dubious comparison of enums, op %s */
1737 			warning(243, mp->m_name);
1738 	}
1739 }
1740 
1741 /* Prints a warning if the operands mix between enum and integer. */
1742 static void
1743 check_enum_int_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1744 {
1745 
1746 	if (!eflag)
1747 		return;
1748 
1749 	switch (op) {
1750 	case INIT:
1751 		/*
1752 		 * Initialization with 0 is allowed. Otherwise, all implicit
1753 		 * initializations would need to be warned upon as well.
1754 		 */
1755 		if (!rn->tn_type->t_is_enum && rn->tn_op == CON &&
1756 		    is_integer(rn->tn_type->t_tspec) &&
1757 		    rn->tn_val->v_quad == 0) {
1758 			return;
1759 		}
1760 		/* initialization of '%s' with '%s' */
1761 		warning(277, type_name(ln->tn_type), type_name(rn->tn_type));
1762 		break;
1763 	case FARG:
1764 		/* combination of '%s' and '%s', arg #%d */
1765 		warning(278,
1766 		    type_name(ln->tn_type), type_name(rn->tn_type), arg);
1767 		break;
1768 	case RETURN:
1769 		/* combination of '%s' and '%s' in return */
1770 		warning(279, type_name(ln->tn_type), type_name(rn->tn_type));
1771 		break;
1772 	default:
1773 		/* combination of '%s' and '%s', op %s */
1774 		warning(242, type_name(ln->tn_type), type_name(rn->tn_type),
1775 		    op_name(op));
1776 		break;
1777 	}
1778 }
1779 
1780 static void
1781 check_enum_array_index(const tnode_t *ln, const tnode_t *rn)
1782 {
1783 	int max_array_index;
1784 	int64_t max_enum_value;
1785 	const struct sym *ec, *max_ec;
1786 	const type_t *lt, *rt;
1787 
1788 	if (ln->tn_op != ADDR || ln->tn_left->tn_op != NAME)
1789 		return;
1790 
1791 	lt = ln->tn_left->tn_type;
1792 	if (lt->t_tspec != ARRAY || lt->t_incomplete_array)
1793 		return;
1794 
1795 	if (rn->tn_op != CVT || !rn->tn_type->t_is_enum)
1796 		return;
1797 	if (rn->tn_left->tn_op != LOAD)
1798 		return;
1799 
1800 	rt = rn->tn_left->tn_type;
1801 	ec = rt->t_enum->en_first_enumerator;
1802 	max_ec = ec;
1803 	lint_assert(ec != NULL);
1804 	for (ec = ec->s_next; ec != NULL; ec = ec->s_next)
1805 		if (ec->s_value.v_quad > max_ec->s_value.v_quad)
1806 			max_ec = ec;
1807 
1808 	max_enum_value = max_ec->s_value.v_quad;
1809 	lint_assert(INT_MIN <= max_enum_value && max_enum_value <= INT_MAX);
1810 
1811 	max_array_index = lt->t_dim - 1;
1812 	if (max_enum_value == max_array_index)
1813 		return;
1814 
1815 	/*
1816 	 * If the largest enum constant is named '*_NUM_*', it is typically
1817 	 * not part of the allowed enum values but a marker for the number
1818 	 * of actual enum values.
1819 	 */
1820 	if (max_enum_value == max_array_index + 1 &&
1821 	    (strstr(max_ec->s_name, "NUM") != NULL ||
1822 	     strstr(max_ec->s_name, "num") != NULL))
1823 		return;
1824 
1825 	/* maximum value %d of '%s' does not match maximum array index %d */
1826 	warning(348, (int)max_enum_value, type_name(rt), max_array_index);
1827 	print_previous_declaration(-1, max_ec);
1828 }
1829 
1830 /*
1831  * Build and initialize a new node.
1832  */
1833 static tnode_t *
1834 new_tnode(op_t op, type_t *type, tnode_t *ln, tnode_t *rn)
1835 {
1836 	tnode_t	*ntn;
1837 	tspec_t	t;
1838 #if 0 /* not yet */
1839 	size_t l;
1840 	uint64_t rnum;
1841 #endif
1842 
1843 	ntn = expr_zalloc_tnode();
1844 
1845 	ntn->tn_op = op;
1846 	ntn->tn_type = type;
1847 	ntn->tn_relaxed = ln->tn_relaxed || (rn != NULL && rn->tn_relaxed);
1848 	ntn->tn_left = ln;
1849 	ntn->tn_right = rn;
1850 
1851 	switch (op) {
1852 #if 0 /* not yet */
1853 	case SHR:
1854 		if (rn->tn_op != CON)
1855 			break;
1856 		rnum = rn->tn_val->v_quad;
1857 		l = type_size_in_bits(ln->tn_type) / CHAR_SIZE;
1858 		t = ln->tn_type->t_tspec;
1859 		switch (l) {
1860 		case 8:
1861 			if (rnum >= 56)
1862 				t = UCHAR;
1863 			else if (rnum >= 48)
1864 				t = USHORT;
1865 			else if (rnum >= 32)
1866 				t = UINT;
1867 			break;
1868 		case 4:
1869 			if (rnum >= 24)
1870 				t = UCHAR;
1871 			else if (rnum >= 16)
1872 				t = USHORT;
1873 			break;
1874 		case 2:
1875 			if (rnum >= 8)
1876 				t = UCHAR;
1877 			break;
1878 		default:
1879 			break;
1880 		}
1881 		if (t != ln->tn_type->t_tspec)
1882 			ntn->tn_type->t_tspec = t;
1883 		break;
1884 #endif
1885 	case INDIR:
1886 	case FSEL:
1887 		lint_assert(ln->tn_type->t_tspec == PTR);
1888 		t = ln->tn_type->t_subt->t_tspec;
1889 		if (t != FUNC && t != VOID)
1890 			ntn->tn_lvalue = true;
1891 		break;
1892 	default:
1893 		break;
1894 	}
1895 
1896 	return ntn;
1897 }
1898 
1899 /*
1900  * Performs the "integer promotions" (C99 6.3.1.1p2), which convert small
1901  * integer types to either int or unsigned int.
1902  *
1903  * If tflag is set or the operand is a function argument with no type
1904  * information (no prototype or variable # of args), converts float to double.
1905  */
1906 tnode_t *
1907 promote(op_t op, bool farg, tnode_t *tn)
1908 {
1909 	tspec_t	t;
1910 	type_t	*ntp;
1911 	unsigned int len;
1912 
1913 	t = tn->tn_type->t_tspec;
1914 
1915 	if (!is_arithmetic(t))
1916 		return tn;
1917 
1918 	if (!tflag) {
1919 		/*
1920 		 * C99 6.3.1.1p2 requires for types with lower rank than int
1921 		 * that "If an int can represent all the values of the
1922 		 * original type, the value is converted to an int; otherwise
1923 		 * it is converted to an unsigned int", and that "All other
1924 		 * types are unchanged by the integer promotions".
1925 		 */
1926 		if (tn->tn_type->t_bitfield) {
1927 			len = tn->tn_type->t_flen;
1928 			if (len < size_in_bits(INT)) {
1929 				t = INT;
1930 			} else if (len == size_in_bits(INT)) {
1931 				t = is_uinteger(t) ? UINT : INT;
1932 			}
1933 		} else if (t == CHAR || t == UCHAR || t == SCHAR) {
1934 			t = (size_in_bits(CHAR) < size_in_bits(INT)
1935 			     || t != UCHAR) ? INT : UINT;
1936 		} else if (t == SHORT || t == USHORT) {
1937 			t = (size_in_bits(SHORT) < size_in_bits(INT)
1938 			     || t == SHORT) ? INT : UINT;
1939 		} else if (t == ENUM) {
1940 			t = INT;
1941 		} else if (farg && t == FLOAT) {
1942 			t = DOUBLE;
1943 		}
1944 	} else {
1945 		/*
1946 		 * In traditional C, keep unsigned and promote FLOAT
1947 		 * to DOUBLE.
1948 		 */
1949 		if (t == UCHAR || t == USHORT) {
1950 			t = UINT;
1951 		} else if (t == CHAR || t == SCHAR || t == SHORT) {
1952 			t = INT;
1953 		} else if (t == FLOAT) {
1954 			t = DOUBLE;
1955 		} else if (t == ENUM) {
1956 			t = INT;
1957 		}
1958 	}
1959 
1960 	if (t != tn->tn_type->t_tspec) {
1961 		ntp = expr_dup_type(tn->tn_type);
1962 		ntp->t_tspec = t;
1963 		/*
1964 		 * Keep t_is_enum even though t_tspec gets converted from
1965 		 * ENUM to INT, so we are later able to check compatibility
1966 		 * of enum types.
1967 		 */
1968 		tn = convert(op, 0, ntp, tn);
1969 	}
1970 
1971 	return tn;
1972 }
1973 
1974 /*
1975  * Apply the "usual arithmetic conversions" (C99 6.3.1.8).
1976  *
1977  * This gives both operands the same type.
1978  * This is done in different ways for traditional C and C90.
1979  */
1980 static void
1981 balance(op_t op, tnode_t **lnp, tnode_t **rnp)
1982 {
1983 	tspec_t	lt, rt, t;
1984 	int	i;
1985 	bool	u;
1986 	type_t	*ntp;
1987 	static const tspec_t tl[] = {
1988 		LDOUBLE, DOUBLE, FLOAT,
1989 #ifdef INT128_SIZE
1990 		UINT128, INT128,
1991 #endif
1992 		UQUAD, QUAD,
1993 		ULONG, LONG,
1994 		UINT, INT,
1995 	};
1996 
1997 	lt = (*lnp)->tn_type->t_tspec;
1998 	rt = (*rnp)->tn_type->t_tspec;
1999 
2000 	if (!is_arithmetic(lt) || !is_arithmetic(rt))
2001 		return;
2002 
2003 	if (!tflag) {
2004 		if (lt == rt) {
2005 			t = lt;
2006 		} else if (lt == LCOMPLEX || rt == LCOMPLEX) {
2007 			t = LCOMPLEX;
2008 		} else if (lt == DCOMPLEX || rt == DCOMPLEX) {
2009 			t = DCOMPLEX;
2010 		} else if (lt == FCOMPLEX || rt == FCOMPLEX) {
2011 			t = FCOMPLEX;
2012 		} else if (lt == LDOUBLE || rt == LDOUBLE) {
2013 			t = LDOUBLE;
2014 		} else if (lt == DOUBLE || rt == DOUBLE) {
2015 			t = DOUBLE;
2016 		} else if (lt == FLOAT || rt == FLOAT) {
2017 			t = FLOAT;
2018 		} else {
2019 			/*
2020 			 * If type A has more bits than type B it should
2021 			 * be able to hold all possible values of type B.
2022 			 */
2023 			if (size_in_bits(lt) > size_in_bits(rt)) {
2024 				t = lt;
2025 			} else if (size_in_bits(lt) < size_in_bits(rt)) {
2026 				t = rt;
2027 			} else {
2028 				for (i = 3; tl[i] != INT; i++) {
2029 					if (tl[i] == lt || tl[i] == rt)
2030 						break;
2031 				}
2032 				if ((is_uinteger(lt) || is_uinteger(rt)) &&
2033 				    !is_uinteger(tl[i])) {
2034 					i--;
2035 				}
2036 				t = tl[i];
2037 			}
2038 		}
2039 	} else {
2040 		/* Keep unsigned in traditional C */
2041 		u = is_uinteger(lt) || is_uinteger(rt);
2042 		for (i = 0; tl[i] != INT; i++) {
2043 			if (lt == tl[i] || rt == tl[i])
2044 				break;
2045 		}
2046 		t = tl[i];
2047 		if (u && is_integer(t) && !is_uinteger(t))
2048 			t = unsigned_type(t);
2049 	}
2050 
2051 	if (t != lt) {
2052 		ntp = expr_dup_type((*lnp)->tn_type);
2053 		ntp->t_tspec = t;
2054 		*lnp = convert(op, 0, ntp, *lnp);
2055 	}
2056 	if (t != rt) {
2057 		ntp = expr_dup_type((*rnp)->tn_type);
2058 		ntp->t_tspec = t;
2059 		*rnp = convert(op, 0, ntp, *rnp);
2060 	}
2061 }
2062 
2063 /*
2064  * Insert a conversion operator, which converts the type of the node
2065  * to another given type.
2066  * If op is FARG, arg is the number of the argument (used for warnings).
2067  */
2068 tnode_t *
2069 convert(op_t op, int arg, type_t *tp, tnode_t *tn)
2070 {
2071 	tnode_t	*ntn;
2072 	tspec_t	nt, ot;
2073 
2074 	nt = tp->t_tspec;
2075 	ot = tn->tn_type->t_tspec;
2076 
2077 	if (!tflag && !sflag && op == FARG)
2078 		check_prototype_conversion(arg, nt, ot, tp, tn);
2079 	if (is_integer(nt) && is_integer(ot)) {
2080 		check_integer_conversion(op, arg, nt, ot, tp, tn);
2081 	} else if (nt == PTR && is_null_pointer(tn)) {
2082 		/* a null pointer may be assigned to any pointer. */
2083 	} else if (is_integer(nt) && nt != BOOL && ot == PTR) {
2084 		check_pointer_integer_conversion(op, nt, tp, tn);
2085 	} else if (nt == PTR && ot == PTR && op == CVT) {
2086 		check_pointer_conversion(tn, tp);
2087 	}
2088 
2089 	ntn = expr_zalloc_tnode();
2090 	ntn->tn_op = CVT;
2091 	ntn->tn_type = tp;
2092 	ntn->tn_cast = op == CVT;
2093 	ntn->tn_relaxed |= tn->tn_relaxed;
2094 	ntn->tn_right = NULL;
2095 	if (tn->tn_op != CON || nt == VOID) {
2096 		ntn->tn_left = tn;
2097 	} else {
2098 		ntn->tn_op = CON;
2099 		ntn->tn_val = expr_zalloc(sizeof(*ntn->tn_val));
2100 		convert_constant(op, arg, ntn->tn_type, ntn->tn_val,
2101 		    tn->tn_val);
2102 	}
2103 
2104 	return ntn;
2105 }
2106 
2107 static bool
2108 should_warn_about_prototype_conversion(tspec_t nt,
2109 				       tspec_t ot, const tnode_t *ptn)
2110 {
2111 
2112 	if (nt == ot)
2113 		return false;
2114 
2115 	if (nt == ENUM && ot == INT)
2116 		return false;
2117 
2118 	if (is_floating(nt) != is_floating(ot) ||
2119 	    portable_size_in_bits(nt) != portable_size_in_bits(ot)) {
2120 		/* representation and/or width change */
2121 		if (!is_integer(ot))
2122 			return true;
2123 		/*
2124 		 * XXX: Investigate whether this rule makes sense; see
2125 		 * tests/usr.bin/xlint/lint1/platform_long.c.
2126 		 */
2127 		return portable_size_in_bits(ot) > portable_size_in_bits(INT);
2128 	}
2129 
2130 	if (!hflag)
2131 		return false;
2132 
2133 	/*
2134 	 * If the types differ only in sign and the argument has the same
2135 	 * representation in both types, print no warning.
2136 	 */
2137 	if (ptn->tn_op == CON && is_integer(nt) &&
2138 	    signed_type(nt) == signed_type(ot) &&
2139 	    !msb(ptn->tn_val->v_quad, ot))
2140 		return false;
2141 
2142 	return true;
2143 }
2144 
2145 /*
2146  * Warn if a prototype causes a type conversion that is different from what
2147  * would happen to the same argument in the absence of a prototype.  This
2148  * check is intended for code that needs to stay compatible with pre-C90 C.
2149  *
2150  * Errors/warnings about illegal type combinations are already printed
2151  * in check_assign_types_compatible().
2152  */
2153 static void
2154 check_prototype_conversion(int arg, tspec_t nt, tspec_t ot, type_t *tp,
2155 			   tnode_t *tn)
2156 {
2157 	tnode_t	*ptn;
2158 
2159 	if (!is_arithmetic(nt) || !is_arithmetic(ot))
2160 		return;
2161 
2162 	/*
2163 	 * If the type of the formal parameter is char/short, a warning
2164 	 * would be useless, because functions declared the old style
2165 	 * can't expect char/short arguments.
2166 	 */
2167 	if (nt == CHAR || nt == SCHAR || nt == UCHAR ||
2168 	    nt == SHORT || nt == USHORT)
2169 		return;
2170 
2171 	/* apply the default promotion */
2172 	ptn = promote(NOOP, true, tn);
2173 	ot = ptn->tn_type->t_tspec;
2174 
2175 	if (should_warn_about_prototype_conversion(nt, ot, ptn)) {
2176 		/* argument #%d is converted from '%s' to '%s' ... */
2177 		warning(259, arg, type_name(tn->tn_type), type_name(tp));
2178 	}
2179 }
2180 
2181 /*
2182  * Print warnings for conversions of integer types which may cause problems.
2183  */
2184 static void
2185 check_integer_conversion(op_t op, int arg, tspec_t nt, tspec_t ot, type_t *tp,
2186 			 tnode_t *tn)
2187 {
2188 
2189 	if (tn->tn_op == CON)
2190 		return;
2191 
2192 	if (op == CVT)
2193 		return;
2194 
2195 	if (Sflag && nt == BOOL)
2196 		return;		/* See C99 6.3.1.2 */
2197 
2198 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
2199 	    is_uinteger(nt) != is_uinteger(ot)) {
2200 		if (aflag > 0 && pflag) {
2201 			if (op == FARG) {
2202 				/* conversion to '%s' may sign-extend ... */
2203 				warning(297, type_name(tp), arg);
2204 			} else {
2205 				/* conversion to '%s' may sign-extend ... */
2206 				warning(131, type_name(tp));
2207 			}
2208 		}
2209 	}
2210 
2211 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot)) {
2212 		switch (tn->tn_op) {
2213 		case PLUS:
2214 		case MINUS:
2215 		case MULT:
2216 		case SHL:
2217 			/* suggest cast from '%s' to '%s' on op %s to ... */
2218 			warning(324, type_name(gettyp(ot)), type_name(tp),
2219 			    op_name(tn->tn_op));
2220 			break;
2221 		default:
2222 			break;
2223 		}
2224 	}
2225 
2226 	if (portable_size_in_bits(nt) < portable_size_in_bits(ot) &&
2227 	    (ot == LONG || ot == ULONG || ot == QUAD || ot == UQUAD ||
2228 	     aflag > 1)) {
2229 		/* conversion from '%s' may lose accuracy */
2230 		if (aflag > 0) {
2231 			if (op == FARG) {
2232 				/* conversion from '%s' to '%s' may ... */
2233 				warning(298,
2234 				    type_name(tn->tn_type), type_name(tp), arg);
2235 			} else {
2236 				/* conversion from '%s' to '%s' may ... */
2237 				warning(132,
2238 				    type_name(tn->tn_type), type_name(tp));
2239 			}
2240 		}
2241 	}
2242 }
2243 
2244 /*
2245  * Print warnings for dubious conversions of pointer to integer.
2246  */
2247 static void
2248 check_pointer_integer_conversion(op_t op, tspec_t nt, type_t *tp, tnode_t *tn)
2249 {
2250 
2251 	if (tn->tn_op == CON)
2252 		return;
2253 	if (op != CVT)
2254 		return;		/* We got already an error. */
2255 	if (portable_size_in_bits(nt) >= portable_size_in_bits(PTR))
2256 		return;
2257 
2258 	if (pflag && size_in_bits(nt) >= size_in_bits(PTR)) {
2259 		/* conversion of pointer to '%s' may lose bits */
2260 		warning(134, type_name(tp));
2261 	} else {
2262 		/* conversion of pointer to '%s' loses bits */
2263 		warning(133, type_name(tp));
2264 	}
2265 }
2266 
2267 static bool
2268 should_warn_about_pointer_cast(const type_t *nstp, tspec_t nst,
2269 			       const type_t *ostp, tspec_t ost)
2270 {
2271 	/*
2272 	 * Casting a pointer to 'struct S' to a pointer to another struct that
2273 	 * has 'struct S' as its first member is ok, see msg_247.c, 'struct
2274 	 * counter'.
2275 	 */
2276 	if (nst == STRUCT && ost == STRUCT &&
2277 	    nstp->t_str->sou_first_member != NULL &&
2278 	    nstp->t_str->sou_first_member->s_type == ostp)
2279 		return false;
2280 
2281 	if (is_incomplete(nstp) || is_incomplete(ostp))
2282 		return false;
2283 
2284 	if ((nst == STRUCT || nst == UNION) && nstp->t_str != ostp->t_str)
2285 		return true;
2286 
2287 	if (nst == CHAR || nst == UCHAR)
2288 		return false;	/* for the sake of traditional C code */
2289 	if (ost == CHAR || ost == UCHAR)
2290 		return false;	/* for the sake of traditional C code */
2291 
2292 	return portable_size_in_bits(nst) != portable_size_in_bits(ost);
2293 }
2294 
2295 /*
2296  * Warn about questionable pointer conversions.
2297  */
2298 static void
2299 check_pointer_conversion(tnode_t *tn, type_t *ntp)
2300 {
2301 	const type_t *nstp, *otp, *ostp;
2302 	tspec_t nst, ost;
2303 	const char *nts, *ots;
2304 
2305 	nstp = ntp->t_subt;
2306 	otp = tn->tn_type;
2307 	ostp = otp->t_subt;
2308 	nst = nstp->t_tspec;
2309 	ost = ostp->t_tspec;
2310 
2311 	if (nst == VOID || ost == VOID) {
2312 		if (sflag && (nst == FUNC || ost == FUNC)) {
2313 			/* null pointers are already handled in convert() */
2314 			*(nst == FUNC ? &nts : &ots) = "function pointer";
2315 			*(nst == VOID ? &nts : &ots) = "'void *'";
2316 			/* ANSI C forbids conversion of %s to %s */
2317 			warning(303, ots, nts);
2318 		}
2319 		return;
2320 	} else if (nst == FUNC && ost == FUNC) {
2321 		return;
2322 	} else if (nst == FUNC || ost == FUNC) {
2323 		/* converting '%s' to '%s' is questionable */
2324 		warning(229, type_name(otp), type_name(ntp));
2325 		return;
2326 	}
2327 
2328 	if (hflag && alignment_in_bits(nstp) > alignment_in_bits(ostp) &&
2329 	    ost != CHAR && ost != UCHAR &&
2330 	    !is_incomplete(ostp)) {
2331 		/* converting '%s' to '%s' may cause alignment problem */
2332 		warning(135, type_name(otp), type_name(ntp));
2333 	}
2334 
2335 	if (cflag && should_warn_about_pointer_cast(nstp, nst, ostp, ost)) {
2336 		/* pointer cast from '%s' to '%s' may be troublesome */
2337 		warning(247, type_name(otp), type_name(ntp));
2338 	}
2339 }
2340 
2341 static void
2342 convert_constant_floating(op_t op, int arg, tspec_t ot, const type_t *tp,
2343 			  tspec_t nt, val_t *v, val_t *nv)
2344 {
2345 	ldbl_t	max = 0.0, min = 0.0;
2346 
2347 	switch (nt) {
2348 	case CHAR:
2349 		max = TARG_CHAR_MAX;	min = TARG_CHAR_MIN;	break;
2350 	case UCHAR:
2351 		max = TARG_UCHAR_MAX;	min = 0;		break;
2352 	case SCHAR:
2353 		max = TARG_SCHAR_MAX;	min = TARG_SCHAR_MIN;	break;
2354 	case SHORT:
2355 		max = TARG_SHRT_MAX;	min = TARG_SHRT_MIN;	break;
2356 	case USHORT:
2357 		max = TARG_USHRT_MAX;	min = 0;		break;
2358 	case ENUM:
2359 	case INT:
2360 		max = TARG_INT_MAX;	min = TARG_INT_MIN;	break;
2361 	case UINT:
2362 		max = TARG_UINT_MAX;	min = 0;		break;
2363 	case LONG:
2364 		max = TARG_LONG_MAX;	min = TARG_LONG_MIN;	break;
2365 	case ULONG:
2366 		max = TARG_ULONG_MAX;	min = 0;		break;
2367 	case QUAD:
2368 		max = QUAD_MAX;		min = QUAD_MIN;		break;
2369 	case UQUAD:
2370 		max = UQUAD_MAX;	min = 0;		break;
2371 	case FLOAT:
2372 	case FCOMPLEX:
2373 		max = FLT_MAX;		min = -FLT_MAX;		break;
2374 	case DOUBLE:
2375 	case DCOMPLEX:
2376 		max = DBL_MAX;		min = -DBL_MAX;		break;
2377 	case PTR:
2378 		/* Got already an error because of float --> ptr */
2379 	case LDOUBLE:
2380 	case LCOMPLEX:
2381 		/* LINTED 248 */
2382 		max = LDBL_MAX;		min = -max;		break;
2383 	default:
2384 		lint_assert(/*CONSTCOND*/false);
2385 	}
2386 	if (v->v_ldbl > max || v->v_ldbl < min) {
2387 		lint_assert(nt != LDOUBLE);
2388 		if (op == FARG) {
2389 			/* conversion of '%s' to '%s' is out of range, ... */
2390 			warning(295,
2391 			    type_name(gettyp(ot)), type_name(tp), arg);
2392 		} else {
2393 			/* conversion of '%s' to '%s' is out of range */
2394 			warning(119,
2395 			    type_name(gettyp(ot)), type_name(tp));
2396 		}
2397 		v->v_ldbl = v->v_ldbl > 0 ? max : min;
2398 	}
2399 
2400 	if (nt == FLOAT) {
2401 		nv->v_ldbl = (float)v->v_ldbl;
2402 	} else if (nt == DOUBLE) {
2403 		nv->v_ldbl = (double)v->v_ldbl;
2404 	} else if (nt == LDOUBLE) {
2405 		nv->v_ldbl = v->v_ldbl;
2406 	} else {
2407 		nv->v_quad = (int64_t)v->v_ldbl;
2408 	}
2409 }
2410 
2411 static bool
2412 convert_constant_to_floating(tspec_t nt, val_t *nv,
2413 			     tspec_t ot, const val_t *v)
2414 {
2415 	if (nt == FLOAT) {
2416 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2417 		    (float)(uint64_t)v->v_quad : (float)v->v_quad;
2418 	} else if (nt == DOUBLE) {
2419 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2420 		    (double)(uint64_t)v->v_quad : (double)v->v_quad;
2421 	} else if (nt == LDOUBLE) {
2422 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2423 		    (ldbl_t)(uint64_t)v->v_quad : (ldbl_t)v->v_quad;
2424 	} else
2425 		return false;
2426 	return true;
2427 }
2428 
2429 /*
2430  * Print a warning if bits which were set are lost due to the conversion.
2431  * This can happen with operator ORASS only.
2432  */
2433 static void
2434 convert_constant_check_range_bitor(size_t nsz, size_t osz, const val_t *v,
2435 				   uint64_t xmask, op_t op)
2436 {
2437 	if (nsz < osz && (v->v_quad & xmask) != 0) {
2438 		/* constant truncated by conversion, op %s */
2439 		warning(306, op_name(op));
2440 	}
2441 }
2442 
2443 /*
2444  * Print a warning if additional bits are not all 1
2445  * and the most significant bit of the old value is 1,
2446  * or if at least one (but not all) removed bit was 0.
2447  */
2448 static void
2449 convert_constant_check_range_bitand(size_t nsz, size_t osz,
2450 				    uint64_t xmask, const val_t *nv,
2451 				    tspec_t ot, const val_t *v,
2452 				    const type_t *tp, op_t op)
2453 {
2454 	if (nsz > osz &&
2455 	    (nv->v_quad & bit((unsigned int)(osz - 1))) != 0 &&
2456 	    (nv->v_quad & xmask) != xmask) {
2457 		/* extra bits set to 0 in conversion of '%s' to '%s', ... */
2458 		warning(309, type_name(gettyp(ot)),
2459 		    type_name(tp), op_name(op));
2460 	} else if (nsz < osz &&
2461 		   (v->v_quad & xmask) != xmask &&
2462 		   (v->v_quad & xmask) != 0) {
2463 		/* constant truncated by conversion, op %s */
2464 		warning(306, op_name(op));
2465 	}
2466 }
2467 
2468 static void
2469 convert_constant_check_range_signed(op_t op, int arg)
2470 {
2471 	if (op == ASSIGN) {
2472 		/* assignment of negative constant to unsigned type */
2473 		warning(164);
2474 	} else if (op == INIT) {
2475 		/* initialization of unsigned with negative constant */
2476 		warning(221);
2477 	} else if (op == FARG) {
2478 		/* conversion of negative constant to unsigned type, ... */
2479 		warning(296, arg);
2480 	} else if (modtab[op].m_comparison) {
2481 		/* handled by check_integer_comparison() */
2482 	} else {
2483 		/* conversion of negative constant to unsigned type */
2484 		warning(222);
2485 	}
2486 }
2487 
2488 /*
2489  * Loss of significant bit(s). All truncated bits
2490  * of unsigned types or all truncated bits plus the
2491  * msb of the target for signed types are considered
2492  * to be significant bits. Loss of significant bits
2493  * means that at least one of the bits was set in an
2494  * unsigned type or that at least one but not all of
2495  * the bits was set in a signed type.
2496  * Loss of significant bits means that it is not
2497  * possible, also not with necessary casts, to convert
2498  * back to the original type. A example for a
2499  * necessary cast is:
2500  *	char c;	int	i; c = 128;
2501  *	i = c;			** yields -128 **
2502  *	i = (unsigned char)c;	** yields 128 **
2503  */
2504 static void
2505 convert_constant_check_range_truncated(op_t op, int arg, const type_t *tp,
2506 				       tspec_t ot)
2507 {
2508 	if (op == ASSIGN && tp->t_bitfield) {
2509 		/* precision lost in bit-field assignment */
2510 		warning(166);
2511 	} else if (op == ASSIGN) {
2512 		/* constant truncated by assignment */
2513 		warning(165);
2514 	} else if (op == INIT && tp->t_bitfield) {
2515 		/* bit-field initializer does not fit */
2516 		warning(180);
2517 	} else if (op == INIT) {
2518 		/* initializer does not fit */
2519 		warning(178);
2520 	} else if (op == CASE) {
2521 		/* case label affected by conversion */
2522 		warning(196);
2523 	} else if (op == FARG) {
2524 		/* conversion of '%s' to '%s' is out of range, arg #%d */
2525 		warning(295,
2526 		    type_name(gettyp(ot)), type_name(tp), arg);
2527 	} else {
2528 		/* conversion of '%s' to '%s' is out of range */
2529 		warning(119,
2530 		    type_name(gettyp(ot)), type_name(tp));
2531 	}
2532 }
2533 
2534 static void
2535 convert_constant_check_range_loss(op_t op, int arg, const type_t *tp,
2536 				  tspec_t ot)
2537 {
2538 	if (op == ASSIGN && tp->t_bitfield) {
2539 		/* precision lost in bit-field assignment */
2540 		warning(166);
2541 	} else if (op == INIT && tp->t_bitfield) {
2542 		/* bit-field initializer out of range */
2543 		warning(11);
2544 	} else if (op == CASE) {
2545 		/* case label affected by conversion */
2546 		warning(196);
2547 	} else if (op == FARG) {
2548 		/* conversion of '%s' to '%s' is out of range, arg #%d */
2549 		warning(295,
2550 		    type_name(gettyp(ot)), type_name(tp), arg);
2551 	} else {
2552 		/* conversion of '%s' to '%s' is out of range */
2553 		warning(119,
2554 		    type_name(gettyp(ot)), type_name(tp));
2555 	}
2556 }
2557 
2558 static void
2559 convert_constant_check_range(tspec_t ot, const type_t *tp, tspec_t nt,
2560 			     op_t op, int arg, const val_t *v, val_t *nv)
2561 {
2562 	unsigned int osz, nsz;
2563 	uint64_t xmask, xmsk1;
2564 
2565 	osz = size_in_bits(ot);
2566 	nsz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2567 	xmask = value_bits(nsz) ^ value_bits(osz);
2568 	xmsk1 = value_bits(nsz) ^ value_bits(osz - 1);
2569 	/*
2570 	 * For bitwise operations we are not interested in the
2571 	 * value, but in the bits itself.
2572 	 */
2573 	if (op == ORASS || op == BITOR || op == BITXOR) {
2574 		convert_constant_check_range_bitor(nsz, osz, v, xmask, op);
2575 	} else if (op == ANDASS || op == BITAND) {
2576 		convert_constant_check_range_bitand(nsz, osz, xmask, nv, ot,
2577 		    v, tp, op);
2578 	} else if ((nt != PTR && is_uinteger(nt)) &&
2579 		   (ot != PTR && !is_uinteger(ot)) &&
2580 		   v->v_quad < 0) {
2581 		convert_constant_check_range_signed(op, arg);
2582 	} else if (nv->v_quad != v->v_quad && nsz <= osz &&
2583 		   (v->v_quad & xmask) != 0 &&
2584 		   (is_uinteger(ot) || (v->v_quad & xmsk1) != xmsk1)) {
2585 		convert_constant_check_range_truncated(op, arg, tp, ot);
2586 	} else if (nv->v_quad != v->v_quad) {
2587 		convert_constant_check_range_loss(op, arg, tp, ot);
2588 	}
2589 }
2590 
2591 /*
2592  * Converts a typed constant to a constant of another type.
2593  *
2594  * op		operator which requires conversion
2595  * arg		if op is FARG, # of argument
2596  * tp		type in which to convert the constant
2597  * nv		new constant
2598  * v		old constant
2599  */
2600 void
2601 convert_constant(op_t op, int arg, const type_t *tp, val_t *nv, val_t *v)
2602 {
2603 	tspec_t ot, nt;
2604 	unsigned int sz;
2605 	bool range_check;
2606 
2607 	/*
2608 	 * TODO: make 'v' const; the name of this function does not suggest
2609 	 *  that it modifies 'v'.
2610 	 */
2611 	ot = v->v_tspec;
2612 	nt = nv->v_tspec = tp->t_tspec;
2613 	range_check = false;
2614 
2615 	if (nt == BOOL) {	/* C99 6.3.1.2 */
2616 		nv->v_unsigned_since_c90 = false;
2617 		nv->v_quad = is_nonzero_val(v) ? 1 : 0;
2618 		return;
2619 	}
2620 
2621 	if (ot == FLOAT || ot == DOUBLE || ot == LDOUBLE) {
2622 		convert_constant_floating(op, arg, ot, tp, nt, v, nv);
2623 	} else if (!convert_constant_to_floating(nt, nv, ot, v)) {
2624 		range_check = true;	/* Check for lost precision. */
2625 		nv->v_quad = v->v_quad;
2626 	}
2627 
2628 	if ((v->v_unsigned_since_c90 && is_floating(nt)) ||
2629 	    (v->v_unsigned_since_c90 && (is_integer(nt) && !is_uinteger(nt) &&
2630 			    portable_size_in_bits(nt) >
2631 			    portable_size_in_bits(ot)))) {
2632 		/* ANSI C treats constant as unsigned */
2633 		warning(157);
2634 		v->v_unsigned_since_c90 = false;
2635 	}
2636 
2637 	if (is_integer(nt)) {
2638 		sz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2639 		nv->v_quad = convert_integer(nv->v_quad, nt, sz);
2640 	}
2641 
2642 	if (range_check && op != CVT)
2643 		convert_constant_check_range(ot, tp, nt, op, arg, v, nv);
2644 }
2645 
2646 /*
2647  * Called if incompatible types were detected.
2648  * Prints a appropriate warning.
2649  */
2650 static void
2651 warn_incompatible_types(op_t op,
2652 			const type_t *ltp, tspec_t lt,
2653 			const type_t *rtp, tspec_t rt)
2654 {
2655 	const mod_t *mp;
2656 
2657 	mp = &modtab[op];
2658 
2659 	if (lt == VOID || (mp->m_binary && rt == VOID)) {
2660 		/* void type illegal in expression */
2661 		error(109);
2662 	} else if (op == ASSIGN) {
2663 		if ((lt == STRUCT || lt == UNION) &&
2664 		    (rt == STRUCT || rt == UNION)) {
2665 			/* assignment of different structures (%s != %s) */
2666 			error(240, tspec_name(lt), tspec_name(rt));
2667 		} else {
2668 			/* cannot assign to '%s' from '%s' */
2669 			error(171, type_name(ltp), type_name(rtp));
2670 		}
2671 	} else if (mp->m_binary) {
2672 		/* operands of '%s' have incompatible types (%s != %s) */
2673 		error(107, mp->m_name, tspec_name(lt), tspec_name(rt));
2674 	} else {
2675 		lint_assert(rt == NOTSPEC);
2676 		/* operand of '%s' has invalid type (%s) */
2677 		error(108, mp->m_name, tspec_name(lt));
2678 	}
2679 }
2680 
2681 /*
2682  * Called if incompatible pointer types are detected.
2683  * Print an appropriate warning.
2684  */
2685 static void
2686 warn_incompatible_pointers(const mod_t *mp,
2687 			   const type_t *ltp, const type_t *rtp)
2688 {
2689 	tspec_t	lt, rt;
2690 
2691 	lint_assert(ltp->t_tspec == PTR);
2692 	lint_assert(rtp->t_tspec == PTR);
2693 
2694 	lt = ltp->t_subt->t_tspec;
2695 	rt = rtp->t_subt->t_tspec;
2696 
2697 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION)) {
2698 		if (mp == NULL) {
2699 			/* illegal structure pointer combination */
2700 			warning(244);
2701 		} else {
2702 			/* incompatible structure pointers: '%s' '%s' '%s' */
2703 			warning(245, type_name(ltp), mp->m_name, type_name(rtp));
2704 		}
2705 	} else {
2706 		if (mp == NULL) {
2707 			/* illegal combination of '%s' and '%s' */
2708 			warning(184, type_name(ltp), type_name(rtp));
2709 		} else {
2710 			/* illegal combination of '%s' and '%s', op '%s' */
2711 			warning(124,
2712 			    type_name(ltp), type_name(rtp), mp->m_name);
2713 		}
2714 	}
2715 }
2716 
2717 /* Return a type based on tp1, with added qualifiers from tp2. */
2718 static type_t *
2719 merge_qualifiers(type_t *tp1, const type_t *tp2)
2720 {
2721 	type_t *ntp, *nstp;
2722 	bool c1, c2, v1, v2;
2723 
2724 	lint_assert(tp1->t_tspec == PTR);
2725 	lint_assert(tp2->t_tspec == PTR);
2726 
2727 	c1 = tp1->t_subt->t_const;
2728 	c2 = tp2->t_subt->t_const;
2729 	v1 = tp1->t_subt->t_volatile;
2730 	v2 = tp2->t_subt->t_volatile;
2731 
2732 	if (c1 == (c1 | c2) && v1 == (v1 | v2))
2733 		return tp1;
2734 
2735 	nstp = expr_dup_type(tp1->t_subt);
2736 	nstp->t_const |= c2;
2737 	nstp->t_volatile |= v2;
2738 
2739 	ntp = expr_dup_type(tp1);
2740 	ntp->t_subt = nstp;
2741 	return ntp;
2742 }
2743 
2744 /*
2745  * Returns true if the given structure or union has a constant member
2746  * (maybe recursively).
2747  */
2748 static bool
2749 has_constant_member(const type_t *tp)
2750 {
2751 	sym_t *m;
2752 
2753 	lint_assert(is_struct_or_union(tp->t_tspec));
2754 
2755 	for (m = tp->t_str->sou_first_member; m != NULL; m = m->s_next) {
2756 		const type_t *mtp = m->s_type;
2757 		if (mtp->t_const)
2758 			return true;
2759 		if (is_struct_or_union(mtp->t_tspec) &&
2760 		    has_constant_member(mtp))
2761 			return true;
2762 	}
2763 	return false;
2764 }
2765 
2766 /*
2767  * Create a new node for one of the operators POINT and ARROW.
2768  */
2769 static tnode_t *
2770 build_struct_access(op_t op, tnode_t *ln, tnode_t *rn)
2771 {
2772 	tnode_t	*ntn, *ctn;
2773 	bool	nolval;
2774 
2775 	lint_assert(rn->tn_op == NAME);
2776 	lint_assert(rn->tn_sym->s_value.v_tspec == INT);
2777 	lint_assert(rn->tn_sym->s_scl == MOS || rn->tn_sym->s_scl == MOU);
2778 
2779 	/*
2780 	 * Remember if the left operand is an lvalue (structure members
2781 	 * are lvalues if and only if the structure itself is an lvalue).
2782 	 */
2783 	nolval = op == POINT && !ln->tn_lvalue;
2784 
2785 	if (op == POINT) {
2786 		ln = build_address(ln, true);
2787 	} else if (ln->tn_type->t_tspec != PTR) {
2788 		lint_assert(tflag);
2789 		lint_assert(is_integer(ln->tn_type->t_tspec));
2790 		ln = convert(NOOP, 0, expr_derive_type(gettyp(VOID), PTR), ln);
2791 	}
2792 
2793 	ctn = build_integer_constant(PTRDIFF_TSPEC,
2794 	    rn->tn_sym->s_value.v_quad / CHAR_SIZE);
2795 
2796 	ntn = new_tnode(PLUS, expr_derive_type(rn->tn_type, PTR), ln, ctn);
2797 	if (ln->tn_op == CON)
2798 		ntn = fold(ntn);
2799 
2800 	if (rn->tn_type->t_bitfield) {
2801 		ntn = new_tnode(FSEL, ntn->tn_type->t_subt, ntn, NULL);
2802 	} else {
2803 		ntn = new_tnode(INDIR, ntn->tn_type->t_subt, ntn, NULL);
2804 	}
2805 
2806 	if (nolval)
2807 		ntn->tn_lvalue = false;
2808 
2809 	return ntn;
2810 }
2811 
2812 /*
2813  * Create a node for INCAFT, INCBEF, DECAFT and DECBEF.
2814  */
2815 static tnode_t *
2816 build_prepost_incdec(op_t op, tnode_t *ln)
2817 {
2818 	tnode_t	*cn, *ntn;
2819 
2820 	lint_assert(ln != NULL);
2821 
2822 	if (ln->tn_type->t_tspec == PTR) {
2823 		cn = plength(ln->tn_type);
2824 	} else {
2825 		cn = build_integer_constant(INT, (int64_t)1);
2826 	}
2827 	ntn = new_tnode(op, ln->tn_type, ln, cn);
2828 
2829 	return ntn;
2830 }
2831 
2832 /*
2833  * Create a node for REAL, IMAG
2834  */
2835 static tnode_t *
2836 build_real_imag(op_t op, tnode_t *ln)
2837 {
2838 	tnode_t	*cn, *ntn;
2839 
2840 	lint_assert(ln != NULL);
2841 
2842 	if (ln->tn_op == NAME) {
2843 		/*
2844 		 * This may be too much, but it avoids wrong warnings.
2845 		 * See d_c99_complex_split.c.
2846 		 */
2847 		mark_as_used(ln->tn_sym, false, false);
2848 		mark_as_set(ln->tn_sym);
2849 	}
2850 
2851 	switch (ln->tn_type->t_tspec) {
2852 	case LCOMPLEX:
2853 		/* XXX: integer and LDOUBLE don't match. */
2854 		cn = build_integer_constant(LDOUBLE, (int64_t)1);
2855 		break;
2856 	case DCOMPLEX:
2857 		/* XXX: integer and DOUBLE don't match. */
2858 		cn = build_integer_constant(DOUBLE, (int64_t)1);
2859 		break;
2860 	case FCOMPLEX:
2861 		/* XXX: integer and FLOAT don't match. */
2862 		cn = build_integer_constant(FLOAT, (int64_t)1);
2863 		break;
2864 	default:
2865 		/* __%s__ is illegal for type %s */
2866 		error(276, op == REAL ? "real" : "imag",
2867 		    type_name(ln->tn_type));
2868 		return NULL;
2869 	}
2870 	ntn = new_tnode(op, cn->tn_type, ln, cn);
2871 	ntn->tn_lvalue = true;
2872 
2873 	return ntn;
2874 }
2875 
2876 /*
2877  * Create a tree node for the unary & operator
2878  */
2879 static tnode_t *
2880 build_address(tnode_t *tn, bool noign)
2881 {
2882 	tspec_t	t;
2883 
2884 	if (!noign && ((t = tn->tn_type->t_tspec) == ARRAY || t == FUNC)) {
2885 		if (tflag)
2886 			/* '&' before array or function: ignored */
2887 			warning(127);
2888 		return tn;
2889 	}
2890 
2891 	/* eliminate &* */
2892 	if (tn->tn_op == INDIR &&
2893 	    tn->tn_left->tn_type->t_tspec == PTR &&
2894 	    tn->tn_left->tn_type->t_subt == tn->tn_type) {
2895 		return tn->tn_left;
2896 	}
2897 
2898 	return new_tnode(ADDR, expr_derive_type(tn->tn_type, PTR), tn, NULL);
2899 }
2900 
2901 /*
2902  * Create a node for operators PLUS and MINUS.
2903  */
2904 static tnode_t *
2905 build_plus_minus(op_t op, tnode_t *ln, tnode_t *rn)
2906 {
2907 	tnode_t	*ntn, *ctn;
2908 	type_t	*tp;
2909 
2910 	/* If pointer and integer, then pointer to the lhs. */
2911 	if (rn->tn_type->t_tspec == PTR && is_integer(ln->tn_type->t_tspec)) {
2912 		ntn = ln;
2913 		ln = rn;
2914 		rn = ntn;
2915 	}
2916 
2917 	if (ln->tn_type->t_tspec == PTR && rn->tn_type->t_tspec != PTR) {
2918 		lint_assert(is_integer(rn->tn_type->t_tspec));
2919 
2920 		check_ctype_macro_invocation(ln, rn);
2921 		check_enum_array_index(ln, rn);
2922 
2923 		ctn = plength(ln->tn_type);
2924 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2925 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2926 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2927 		if (rn->tn_left->tn_op == CON)
2928 			rn = fold(rn);
2929 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2930 
2931 	} else if (rn->tn_type->t_tspec == PTR) {
2932 
2933 		lint_assert(ln->tn_type->t_tspec == PTR);
2934 		lint_assert(op == MINUS);
2935 		tp = gettyp(PTRDIFF_TSPEC);
2936 		ntn = new_tnode(op, tp, ln, rn);
2937 		if (ln->tn_op == CON && rn->tn_op == CON)
2938 			ntn = fold(ntn);
2939 		ctn = plength(ln->tn_type);
2940 		balance(NOOP, &ntn, &ctn);
2941 		ntn = new_tnode(DIV, tp, ntn, ctn);
2942 
2943 	} else {
2944 
2945 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2946 
2947 	}
2948 	return ntn;
2949 }
2950 
2951 /*
2952  * Create a node for operators SHL and SHR.
2953  */
2954 static tnode_t *
2955 build_bit_shift(op_t op, tnode_t *ln, tnode_t *rn)
2956 {
2957 	tspec_t	t;
2958 	tnode_t	*ntn;
2959 
2960 	if ((t = rn->tn_type->t_tspec) != INT && t != UINT)
2961 		rn = convert(CVT, 0, gettyp(INT), rn);
2962 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2963 	return ntn;
2964 }
2965 
2966 /*
2967  * Create a node for COLON.
2968  */
2969 static tnode_t *
2970 build_colon(tnode_t *ln, tnode_t *rn)
2971 {
2972 	tspec_t	lt, rt, pdt;
2973 	type_t	*tp;
2974 	tnode_t	*ntn;
2975 
2976 	lt = ln->tn_type->t_tspec;
2977 	rt = rn->tn_type->t_tspec;
2978 	pdt = PTRDIFF_TSPEC;
2979 
2980 	/*
2981 	 * Arithmetic types are balanced, all other type combinations
2982 	 * still need to be handled.
2983 	 */
2984 	if (is_arithmetic(lt) && is_arithmetic(rt)) {
2985 		tp = ln->tn_type;
2986 	} else if (lt == BOOL && rt == BOOL) {
2987 		tp = ln->tn_type;
2988 	} else if (lt == VOID || rt == VOID) {
2989 		tp = gettyp(VOID);
2990 	} else if (lt == STRUCT || lt == UNION) {
2991 		/* Both types must be identical. */
2992 		lint_assert(rt == STRUCT || rt == UNION);
2993 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2994 		if (is_incomplete(ln->tn_type)) {
2995 			/* unknown operand size, op %s */
2996 			error(138, op_name(COLON));
2997 			return NULL;
2998 		}
2999 		tp = ln->tn_type;
3000 	} else if (lt == PTR && is_integer(rt)) {
3001 		if (rt != pdt) {
3002 			rn = convert(NOOP, 0, gettyp(pdt), rn);
3003 			rt = pdt;
3004 		}
3005 		tp = ln->tn_type;
3006 	} else if (rt == PTR && is_integer(lt)) {
3007 		if (lt != pdt) {
3008 			ln = convert(NOOP, 0, gettyp(pdt), ln);
3009 			lt = pdt;
3010 		}
3011 		tp = rn->tn_type;
3012 	} else if (lt == PTR && ln->tn_type->t_subt->t_tspec == VOID) {
3013 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
3014 	} else if (rt == PTR && rn->tn_type->t_subt->t_tspec == VOID) {
3015 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
3016 	} else {
3017 		/*
3018 		 * XXX For now we simply take the left type. This is
3019 		 * probably wrong, if one type contains a function prototype
3020 		 * and the other one, at the same place, only an old style
3021 		 * declaration.
3022 		 */
3023 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
3024 	}
3025 
3026 	ntn = new_tnode(COLON, tp, ln, rn);
3027 
3028 	return ntn;
3029 }
3030 
3031 /*
3032  * Create a node for an assignment operator (both = and op= ).
3033  */
3034 static tnode_t *
3035 build_assignment(op_t op, tnode_t *ln, tnode_t *rn)
3036 {
3037 	tspec_t	lt, rt;
3038 	tnode_t	*ntn, *ctn;
3039 
3040 	lint_assert(ln != NULL);
3041 	lint_assert(rn != NULL);
3042 
3043 	lt = ln->tn_type->t_tspec;
3044 	rt = rn->tn_type->t_tspec;
3045 
3046 	if ((op == ADDASS || op == SUBASS) && lt == PTR) {
3047 		lint_assert(is_integer(rt));
3048 		ctn = plength(ln->tn_type);
3049 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
3050 			rn = convert(NOOP, 0, ctn->tn_type, rn);
3051 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
3052 		if (rn->tn_left->tn_op == CON)
3053 			rn = fold(rn);
3054 	}
3055 
3056 	if ((op == ASSIGN || op == RETURN || op == INIT) &&
3057 	    (lt == STRUCT || rt == STRUCT)) {
3058 		lint_assert(lt == rt);
3059 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
3060 		if (is_incomplete(ln->tn_type)) {
3061 			if (op == RETURN) {
3062 				/* cannot return incomplete type */
3063 				error(212);
3064 			} else {
3065 				/* unknown operand size, op %s */
3066 				error(138, op_name(op));
3067 			}
3068 			return NULL;
3069 		}
3070 	}
3071 
3072 	if (op == SHLASS) {
3073 		if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
3074 			if (hflag)
3075 				/* semantics of '%s' change in ANSI C; ... */
3076 				warning(118, "<<=");
3077 		}
3078 	} else if (op != SHRASS) {
3079 		if (op == ASSIGN || lt != PTR) {
3080 			if (lt != rt ||
3081 			    (ln->tn_type->t_bitfield && rn->tn_op == CON)) {
3082 				rn = convert(op, 0, ln->tn_type, rn);
3083 				rt = lt;
3084 			}
3085 		}
3086 	}
3087 
3088 	ntn = new_tnode(op, ln->tn_type, ln, rn);
3089 
3090 	return ntn;
3091 }
3092 
3093 /*
3094  * Get length of type tp->t_subt, as a constant expression of type ptrdiff_t
3095  * as seen from the target platform.
3096  */
3097 static tnode_t *
3098 plength(type_t *tp)
3099 {
3100 	int elem, elsz_in_bits;
3101 
3102 	lint_assert(tp->t_tspec == PTR);
3103 	tp = tp->t_subt;
3104 
3105 	elem = 1;
3106 	elsz_in_bits = 0;
3107 
3108 	while (tp->t_tspec == ARRAY) {
3109 		elem *= tp->t_dim;
3110 		tp = tp->t_subt;
3111 	}
3112 
3113 	switch (tp->t_tspec) {
3114 	case FUNC:
3115 		/* pointer to function is not allowed here */
3116 		error(110);
3117 		break;
3118 	case VOID:
3119 		/* cannot do pointer arithmetic on operand of unknown size */
3120 		gnuism(136);
3121 		break;
3122 	case STRUCT:
3123 	case UNION:
3124 		if ((elsz_in_bits = tp->t_str->sou_size_in_bits) == 0)
3125 			/* cannot do pointer arithmetic on operand of ... */
3126 			error(136);
3127 		break;
3128 	case ENUM:
3129 		if (is_incomplete(tp)) {
3130 			/* cannot do pointer arithmetic on operand of ... */
3131 			warning(136);
3132 		}
3133 		/* FALLTHROUGH */
3134 	default:
3135 		if ((elsz_in_bits = size_in_bits(tp->t_tspec)) == 0) {
3136 			/* cannot do pointer arithmetic on operand of ... */
3137 			error(136);
3138 		} else {
3139 			lint_assert(elsz_in_bits != -1);
3140 		}
3141 		break;
3142 	}
3143 
3144 	if (elem == 0 && elsz_in_bits != 0) {
3145 		/* cannot do pointer arithmetic on operand of unknown size */
3146 		error(136);
3147 	}
3148 
3149 	if (elsz_in_bits == 0)
3150 		elsz_in_bits = CHAR_SIZE;
3151 
3152 	return build_integer_constant(PTRDIFF_TSPEC,
3153 	    (int64_t)(elem * elsz_in_bits / CHAR_SIZE));
3154 }
3155 
3156 /*
3157  * XXX
3158  * Note: There appear to be a number of bugs in detecting overflow in
3159  * this function. An audit and a set of proper regression tests are needed.
3160  *     --Perry Metzger, Nov. 16, 2001
3161  */
3162 /*
3163  * Do only as much as necessary to compute constant expressions.
3164  * Called only if the operator allows folding and all operands are constants.
3165  */
3166 static tnode_t *
3167 fold(tnode_t *tn)
3168 {
3169 	val_t *v;
3170 	tspec_t t;
3171 	bool utyp, ovfl;
3172 	int64_t sl, sr = 0, q = 0, mask;
3173 	uint64_t ul, ur = 0;
3174 	tnode_t *cn;
3175 
3176 	v = xcalloc(1, sizeof(*v));
3177 	v->v_tspec = tn->tn_type->t_tspec;
3178 
3179 	t = tn->tn_left->tn_type->t_tspec;
3180 	utyp = !is_integer(t) || is_uinteger(t);
3181 	ul = sl = tn->tn_left->tn_val->v_quad;
3182 	if (is_binary(tn))
3183 		ur = sr = tn->tn_right->tn_val->v_quad;
3184 
3185 	mask = value_bits(size_in_bits(t));
3186 	ovfl = false;
3187 
3188 	switch (tn->tn_op) {
3189 	case UPLUS:
3190 		q = sl;
3191 		break;
3192 	case UMINUS:
3193 		q = -sl;
3194 		if (sl != 0 && msb(q, t) == msb(sl, t))
3195 			ovfl = true;
3196 		break;
3197 	case COMPL:
3198 		q = ~sl;
3199 		break;
3200 	case MULT:
3201 		if (utyp) {
3202 			q = ul * ur;
3203 			if (q != (q & mask))
3204 				ovfl = true;
3205 			else if ((ul != 0) && ((q / ul) != ur))
3206 				ovfl = true;
3207 		} else {
3208 			q = sl * sr;
3209 			if (msb(q, t) != (msb(sl, t) ^ msb(sr, t)))
3210 				ovfl = true;
3211 		}
3212 		break;
3213 	case DIV:
3214 		if (sr == 0) {
3215 			/* division by 0 */
3216 			error(139);
3217 			q = utyp ? -1 : INT64_MAX;
3218 		} else {
3219 			q = utyp ? (int64_t)(ul / ur) : sl / sr;
3220 		}
3221 		break;
3222 	case MOD:
3223 		if (sr == 0) {
3224 			/* modulus by 0 */
3225 			error(140);
3226 			q = 0;
3227 		} else {
3228 			q = utyp ? (int64_t)(ul % ur) : sl % sr;
3229 		}
3230 		break;
3231 	case PLUS:
3232 		q = utyp ? (int64_t)(ul + ur) : sl + sr;
3233 		if (msb(sl, t) && msb(sr, t) && !msb(q, t))
3234 			ovfl = true;
3235 		if (!utyp && !msb(sl, t) && !msb(sr, t) && msb(q, t))
3236 			ovfl = true;
3237 		break;
3238 	case MINUS:
3239 		q = utyp ? (int64_t)(ul - ur) : sl - sr;
3240 		if (!utyp && msb(sl, t) && !msb(sr, t) && !msb(q, t))
3241 			ovfl = true;
3242 		if (!msb(sl, t) && msb(sr, t) && msb(q, t))
3243 			ovfl = true;
3244 		break;
3245 	case SHL:
3246 		q = utyp ? (int64_t)(ul << sr) : sl << sr;
3247 		break;
3248 	case SHR:
3249 		/*
3250 		 * The sign must be explicitly extended because
3251 		 * shifts of signed values are implementation dependent.
3252 		 */
3253 		q = ul >> sr;
3254 		q = convert_integer(q, t, size_in_bits(t) - (int)sr);
3255 		break;
3256 	case LT:
3257 		q = (utyp ? ul < ur : sl < sr) ? 1 : 0;
3258 		break;
3259 	case LE:
3260 		q = (utyp ? ul <= ur : sl <= sr) ? 1 : 0;
3261 		break;
3262 	case GE:
3263 		q = (utyp ? ul >= ur : sl >= sr) ? 1 : 0;
3264 		break;
3265 	case GT:
3266 		q = (utyp ? ul > ur : sl > sr) ? 1 : 0;
3267 		break;
3268 	case EQ:
3269 		q = (utyp ? ul == ur : sl == sr) ? 1 : 0;
3270 		break;
3271 	case NE:
3272 		q = (utyp ? ul != ur : sl != sr) ? 1 : 0;
3273 		break;
3274 	case BITAND:
3275 		q = utyp ? (int64_t)(ul & ur) : sl & sr;
3276 		break;
3277 	case BITXOR:
3278 		q = utyp ? (int64_t)(ul ^ ur) : sl ^ sr;
3279 		break;
3280 	case BITOR:
3281 		q = utyp ? (int64_t)(ul | ur) : sl | sr;
3282 		break;
3283 	default:
3284 		lint_assert(/*CONSTCOND*/false);
3285 	}
3286 
3287 	/* XXX does not work for quads. */
3288 	if (ovfl ||
3289 	    ((uint64_t)(q | mask) != ~(uint64_t)0 && (q & ~mask) != 0)) {
3290 		if (hflag)
3291 			/* integer overflow detected, op '%s' */
3292 			warning(141, op_name(tn->tn_op));
3293 	}
3294 
3295 	v->v_quad = convert_integer(q, t, 0);
3296 
3297 	cn = build_constant(tn->tn_type, v);
3298 	if (tn->tn_left->tn_system_dependent)
3299 		cn->tn_system_dependent = true;
3300 	if (is_binary(tn) && tn->tn_right->tn_system_dependent)
3301 		cn->tn_system_dependent = true;
3302 
3303 	return cn;
3304 }
3305 
3306 /*
3307  * Fold constant nodes, as much as is needed for comparing the value with 0
3308  * (test context, for controlling expressions).
3309  */
3310 static tnode_t *
3311 fold_test(tnode_t *tn)
3312 {
3313 	bool	l, r;
3314 	val_t	*v;
3315 
3316 	v = xcalloc(1, sizeof(*v));
3317 	v->v_tspec = tn->tn_type->t_tspec;
3318 	lint_assert(v->v_tspec == INT || (Tflag && v->v_tspec == BOOL));
3319 
3320 	l = constant_is_nonzero(tn->tn_left);
3321 	r = is_binary(tn) && constant_is_nonzero(tn->tn_right);
3322 
3323 	switch (tn->tn_op) {
3324 	case NOT:
3325 		if (hflag && !constcond_flag)
3326 			/* constant argument to '!' */
3327 			warning(239);
3328 		v->v_quad = !l ? 1 : 0;
3329 		break;
3330 	case LOGAND:
3331 		v->v_quad = l && r ? 1 : 0;
3332 		break;
3333 	case LOGOR:
3334 		v->v_quad = l || r ? 1 : 0;
3335 		break;
3336 	default:
3337 		lint_assert(/*CONSTCOND*/false);
3338 	}
3339 
3340 	return build_constant(tn->tn_type, v);
3341 }
3342 
3343 static ldbl_t
3344 floating_error_value(tspec_t t, ldbl_t lv)
3345 {
3346 	if (t == FLOAT) {
3347 		return lv < 0 ? -FLT_MAX : FLT_MAX;
3348 	} else if (t == DOUBLE) {
3349 		return lv < 0 ? -DBL_MAX : DBL_MAX;
3350 	} else {
3351 		/* LINTED 248: floating-point constant out of range */
3352 		ldbl_t max = LDBL_MAX;
3353 		return lv < 0 ? -max : max;
3354 	}
3355 }
3356 
3357 /*
3358  * Fold constant nodes having operands with floating point type.
3359  */
3360 static tnode_t *
3361 fold_float(tnode_t *tn)
3362 {
3363 	val_t	*v;
3364 	tspec_t	t;
3365 	ldbl_t	lv, rv = 0;
3366 
3367 	fpe = 0;
3368 	v = xcalloc(1, sizeof(*v));
3369 	v->v_tspec = t = tn->tn_type->t_tspec;
3370 
3371 	lint_assert(is_floating(t));
3372 	lint_assert(t == tn->tn_left->tn_type->t_tspec);
3373 	lint_assert(!is_binary(tn) || t == tn->tn_right->tn_type->t_tspec);
3374 
3375 	lv = tn->tn_left->tn_val->v_ldbl;
3376 	if (is_binary(tn))
3377 		rv = tn->tn_right->tn_val->v_ldbl;
3378 
3379 	switch (tn->tn_op) {
3380 	case UPLUS:
3381 		v->v_ldbl = lv;
3382 		break;
3383 	case UMINUS:
3384 		v->v_ldbl = -lv;
3385 		break;
3386 	case MULT:
3387 		v->v_ldbl = lv * rv;
3388 		break;
3389 	case DIV:
3390 		if (rv == 0.0) {
3391 			/* division by 0 */
3392 			error(139);
3393 			v->v_ldbl = floating_error_value(t, lv);
3394 		} else {
3395 			v->v_ldbl = lv / rv;
3396 		}
3397 		break;
3398 	case PLUS:
3399 		v->v_ldbl = lv + rv;
3400 		break;
3401 	case MINUS:
3402 		v->v_ldbl = lv - rv;
3403 		break;
3404 	case LT:
3405 		v->v_quad = lv < rv ? 1 : 0;
3406 		break;
3407 	case LE:
3408 		v->v_quad = lv <= rv ? 1 : 0;
3409 		break;
3410 	case GE:
3411 		v->v_quad = lv >= rv ? 1 : 0;
3412 		break;
3413 	case GT:
3414 		v->v_quad = lv > rv ? 1 : 0;
3415 		break;
3416 	case EQ:
3417 		v->v_quad = lv == rv ? 1 : 0;
3418 		break;
3419 	case NE:
3420 		v->v_quad = lv != rv ? 1 : 0;
3421 		break;
3422 	default:
3423 		lint_assert(/*CONSTCOND*/false);
3424 	}
3425 
3426 	lint_assert(fpe != 0 || isnan((double)v->v_ldbl) == 0);
3427 	if (fpe != 0 || isfinite((double)v->v_ldbl) == 0 ||
3428 	    (t == FLOAT &&
3429 	     (v->v_ldbl > FLT_MAX || v->v_ldbl < -FLT_MAX)) ||
3430 	    (t == DOUBLE &&
3431 	     (v->v_ldbl > DBL_MAX || v->v_ldbl < -DBL_MAX))) {
3432 		/* floating point overflow detected, op %s */
3433 		warning(142, op_name(tn->tn_op));
3434 		v->v_ldbl = floating_error_value(t, v->v_ldbl);
3435 		fpe = 0;
3436 	}
3437 
3438 	return build_constant(tn->tn_type, v);
3439 }
3440 
3441 
3442 /*
3443  * Create a constant node for sizeof.
3444  */
3445 tnode_t *
3446 build_sizeof(const type_t *tp)
3447 {
3448 	unsigned int size_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3449 	tnode_t *tn = build_integer_constant(SIZEOF_TSPEC, size_in_bytes);
3450 	tn->tn_system_dependent = true;
3451 	return tn;
3452 }
3453 
3454 /*
3455  * Create a constant node for offsetof.
3456  */
3457 /* ARGSUSED */ /* See implementation comments. */
3458 tnode_t *
3459 build_offsetof(const type_t *tp, const sym_t *sym)
3460 {
3461 	unsigned int offset_in_bytes;
3462 	tnode_t *tn;
3463 
3464 	if (!is_struct_or_union(tp->t_tspec))
3465 		/* unacceptable operand of '%s' */
3466 		error(111, "offsetof");
3467 
3468 	/* XXX: wrong size, no checking for sym fixme */
3469 	offset_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3470 	tn = build_integer_constant(SIZEOF_TSPEC, offset_in_bytes);
3471 	tn->tn_system_dependent = true;
3472 	return tn;
3473 }
3474 
3475 unsigned int
3476 type_size_in_bits(const type_t *tp)
3477 {
3478 	unsigned int elem, elsz;
3479 	bool	flex;
3480 
3481 	elem = 1;
3482 	flex = false;
3483 	while (tp->t_tspec == ARRAY) {
3484 		flex = true;	/* allow c99 flex arrays [] [0] */
3485 		elem *= tp->t_dim;
3486 		tp = tp->t_subt;
3487 	}
3488 	if (elem == 0) {
3489 		if (!flex) {
3490 			/* cannot take size/alignment of incomplete type */
3491 			error(143);
3492 			elem = 1;
3493 		}
3494 	}
3495 	switch (tp->t_tspec) {
3496 	case FUNC:
3497 		/* cannot take size/alignment of function */
3498 		error(144);
3499 		elsz = 1;
3500 		break;
3501 	case STRUCT:
3502 	case UNION:
3503 		if (is_incomplete(tp)) {
3504 			/* cannot take size/alignment of incomplete type */
3505 			error(143);
3506 			elsz = 1;
3507 		} else {
3508 			elsz = tp->t_str->sou_size_in_bits;
3509 		}
3510 		break;
3511 	case ENUM:
3512 		if (is_incomplete(tp)) {
3513 			/* cannot take size/alignment of incomplete type */
3514 			warning(143);
3515 		}
3516 		/* FALLTHROUGH */
3517 	default:
3518 		if (tp->t_bitfield) {
3519 			/* cannot take size/alignment of bit-field */
3520 			error(145);
3521 		}
3522 		if (tp->t_tspec == VOID) {
3523 			/* cannot take size/alignment of void */
3524 			error(146);
3525 			elsz = 1;
3526 		} else {
3527 			elsz = size_in_bits(tp->t_tspec);
3528 			lint_assert(elsz > 0);
3529 		}
3530 		break;
3531 	}
3532 
3533 	return elem * elsz;
3534 }
3535 
3536 tnode_t *
3537 build_alignof(const type_t *tp)
3538 {
3539 	switch (tp->t_tspec) {
3540 	case ARRAY:
3541 		break;
3542 
3543 	case FUNC:
3544 		/* cannot take size/alignment of function */
3545 		error(144);
3546 		return 0;
3547 
3548 	case STRUCT:
3549 	case UNION:
3550 		if (is_incomplete(tp)) {
3551 			/* cannot take size/alignment of incomplete type */
3552 			error(143);
3553 			return 0;
3554 		}
3555 		break;
3556 	case ENUM:
3557 		break;
3558 	default:
3559 		if (tp->t_bitfield) {
3560 			/* cannot take size/alignment of bit-field */
3561 			error(145);
3562 			return 0;
3563 		}
3564 		if (tp->t_tspec == VOID) {
3565 			/* cannot take size/alignment of void */
3566 			error(146);
3567 			return 0;
3568 		}
3569 		break;
3570 	}
3571 
3572 	return build_integer_constant(SIZEOF_TSPEC,
3573 	    (int64_t)alignment_in_bits(tp) / CHAR_SIZE);
3574 }
3575 
3576 /*
3577  * Type casts.
3578  */
3579 tnode_t *
3580 cast(tnode_t *tn, type_t *tp)
3581 {
3582 	tspec_t	nt, ot;
3583 
3584 	if (tn == NULL)
3585 		return NULL;
3586 
3587 	/*
3588 	 * XXX: checking for tp == NULL is only a quick fix for PR 22119.
3589 	 *  The proper fix needs to be investigated properly.
3590 	 *  See d_pr_22119.c for how to get here.
3591 	 */
3592 	if (tp == NULL)
3593 		return NULL;
3594 
3595 	tn = cconv(tn);
3596 
3597 	nt = tp->t_tspec;
3598 	ot = tn->tn_type->t_tspec;
3599 
3600 	if (nt == VOID) {
3601 		/*
3602 		 * XXX ANSI C requires scalar types or void (Plauger & Brodie).
3603 		 * But this seems really questionable.
3604 		 */
3605 	} else if (nt == UNION) {
3606 		sym_t *m;
3607 		struct_or_union *str = tp->t_str;
3608 		if (!gflag) {
3609 			/* union cast is a GCC extension */
3610 			error(328);
3611 			return NULL;
3612 		}
3613 		for (m = str->sou_first_member; m != NULL; m = m->s_next) {
3614 			if (eqtype(m->s_type, tn->tn_type,
3615 			    false, false, NULL)) {
3616 				tn = expr_zalloc_tnode();
3617 				tn->tn_op = CVT;
3618 				tn->tn_type = tp;
3619 				tn->tn_cast = true;
3620 				tn->tn_right = NULL;
3621 				return tn;
3622 			}
3623 		}
3624 		/* type '%s' is not a member of '%s' */
3625 		error(329, type_name(tn->tn_type), type_name(tp));
3626 		return NULL;
3627 	} else if (nt == STRUCT || nt == ARRAY || nt == FUNC) {
3628 		/* Casting to a struct is an undocumented GCC extension. */
3629 		if (!(gflag && nt == STRUCT))
3630 			goto invalid_cast;
3631 	} else if (ot == STRUCT || ot == UNION) {
3632 		goto invalid_cast;
3633 	} else if (ot == VOID) {
3634 		/* improper cast of void expression */
3635 		error(148);
3636 		return NULL;
3637 	} else if (is_integer(nt) && is_scalar(ot)) {
3638 		/* ok */
3639 	} else if (is_floating(nt) && is_arithmetic(ot)) {
3640 		/* ok */
3641 	} else if (nt == PTR && is_integer(ot)) {
3642 		/* ok */
3643 	} else if (nt == PTR && ot == PTR) {
3644 		if (!tp->t_subt->t_const && tn->tn_type->t_subt->t_const) {
3645 			if (hflag)
3646 				/* cast discards 'const' from type '%s' */
3647 				warning(275, type_name(tn->tn_type));
3648 		}
3649 	} else
3650 		goto invalid_cast;
3651 
3652 	tn = convert(CVT, 0, tp, tn);
3653 	tn->tn_cast = true;
3654 
3655 	return tn;
3656 
3657 invalid_cast:
3658 	/* invalid cast from '%s' to '%s' */
3659 	error(147, type_name(tn->tn_type), type_name(tp));
3660 	return NULL;
3661 }
3662 
3663 /*
3664  * Create the node for a function argument.
3665  * All necessary conversions and type checks are done in
3666  * build_function_call because build_function_argument has no
3667  * information about expected argument types.
3668  */
3669 tnode_t *
3670 build_function_argument(tnode_t *args, tnode_t *arg)
3671 {
3672 	tnode_t	*ntn;
3673 
3674 	/*
3675 	 * If there was a serious error in the expression for the argument,
3676 	 * create a dummy argument so the positions of the remaining arguments
3677 	 * will not change.
3678 	 */
3679 	if (arg == NULL)
3680 		arg = build_integer_constant(INT, 0);
3681 
3682 	ntn = new_tnode(PUSH, arg->tn_type, arg, args);
3683 
3684 	return ntn;
3685 }
3686 
3687 /*
3688  * Create the node for a function call. Also check types of
3689  * function arguments and insert conversions, if necessary.
3690  */
3691 tnode_t *
3692 build_function_call(tnode_t *func, tnode_t *args)
3693 {
3694 	tnode_t	*ntn;
3695 	op_t	fcop;
3696 
3697 	if (func == NULL)
3698 		return NULL;
3699 
3700 	if (func->tn_op == NAME && func->tn_type->t_tspec == FUNC) {
3701 		fcop = CALL;
3702 	} else {
3703 		fcop = ICALL;
3704 	}
3705 
3706 	check_ctype_function_call(func, args);
3707 
3708 	/*
3709 	 * after cconv() func will always be a pointer to a function
3710 	 * if it is a valid function designator.
3711 	 */
3712 	func = cconv(func);
3713 
3714 	if (func->tn_type->t_tspec != PTR ||
3715 	    func->tn_type->t_subt->t_tspec != FUNC) {
3716 		/* illegal function (type %s) */
3717 		error(149, type_name(func->tn_type));
3718 		return NULL;
3719 	}
3720 
3721 	args = check_function_arguments(func->tn_type->t_subt, args);
3722 
3723 	ntn = new_tnode(fcop, func->tn_type->t_subt->t_subt, func, args);
3724 
3725 	return ntn;
3726 }
3727 
3728 /*
3729  * Check types of all function arguments and insert conversions,
3730  * if necessary.
3731  */
3732 static tnode_t *
3733 check_function_arguments(type_t *ftp, tnode_t *args)
3734 {
3735 	tnode_t	*arg;
3736 	sym_t	*asym;
3737 	tspec_t	at;
3738 	int	narg, npar, n, i;
3739 
3740 	/* get # of args in the prototype */
3741 	npar = 0;
3742 	for (asym = ftp->t_args; asym != NULL; asym = asym->s_next)
3743 		npar++;
3744 
3745 	/* get # of args in function call */
3746 	narg = 0;
3747 	for (arg = args; arg != NULL; arg = arg->tn_right)
3748 		narg++;
3749 
3750 	asym = ftp->t_args;
3751 	if (ftp->t_proto && npar != narg && !(ftp->t_vararg && npar < narg)) {
3752 		/* argument mismatch: %d arg%s passed, %d expected */
3753 		error(150, narg, narg > 1 ? "s" : "", npar);
3754 		asym = NULL;
3755 	}
3756 
3757 	for (n = 1; n <= narg; n++) {
3758 
3759 		/*
3760 		 * The rightmost argument is at the top of the argument
3761 		 * subtree.
3762 		 */
3763 		for (i = narg, arg = args; i > n; i--, arg = arg->tn_right)
3764 			continue;
3765 
3766 		/* some things which are always not allowed */
3767 		if ((at = arg->tn_left->tn_type->t_tspec) == VOID) {
3768 			/* void expressions may not be arguments, arg #%d */
3769 			error(151, n);
3770 			return NULL;
3771 		} else if ((at == STRUCT || at == UNION) &&
3772 			   is_incomplete(arg->tn_left->tn_type)) {
3773 			/* argument cannot have unknown size, arg #%d */
3774 			error(152, n);
3775 			return NULL;
3776 		} else if (is_integer(at) &&
3777 			   arg->tn_left->tn_type->t_is_enum &&
3778 			   is_incomplete(arg->tn_left->tn_type)) {
3779 			/* argument cannot have unknown size, arg #%d */
3780 			warning(152, n);
3781 		}
3782 
3783 		/* class conversions (arg in value context) */
3784 		arg->tn_left = cconv(arg->tn_left);
3785 
3786 		if (asym != NULL) {
3787 			arg->tn_left = check_prototype_argument(
3788 			    n, asym->s_type, arg->tn_left);
3789 		} else {
3790 			arg->tn_left = promote(NOOP, true, arg->tn_left);
3791 		}
3792 		arg->tn_type = arg->tn_left->tn_type;
3793 
3794 		if (asym != NULL)
3795 			asym = asym->s_next;
3796 	}
3797 
3798 	return args;
3799 }
3800 
3801 /*
3802  * Compare the type of an argument with the corresponding type of a
3803  * prototype parameter. If it is a valid combination, but both types
3804  * are not the same, insert a conversion to convert the argument into
3805  * the type of the parameter.
3806  */
3807 static tnode_t *
3808 check_prototype_argument(
3809 	int	n,		/* pos of arg */
3810 	type_t	*tp,		/* expected type (from prototype) */
3811 	tnode_t	*tn)		/* argument */
3812 {
3813 	tnode_t	*ln;
3814 	bool	dowarn;
3815 
3816 	ln = xcalloc(1, sizeof(*ln));
3817 	ln->tn_type = expr_unqualified_type(tp);
3818 	ln->tn_lvalue = true;
3819 	if (typeok(FARG, n, ln, tn)) {
3820 		if (!eqtype(tp, tn->tn_type,
3821 		    true, false, (dowarn = false, &dowarn)) || dowarn)
3822 			tn = convert(FARG, n, tp, tn);
3823 	}
3824 	free(ln);
3825 	return tn;
3826 }
3827 
3828 /*
3829  * Return the value of an integral constant expression.
3830  * If the expression is not constant or its type is not an integer
3831  * type, an error message is printed.
3832  */
3833 val_t *
3834 constant(tnode_t *tn, bool required)
3835 {
3836 	val_t	*v;
3837 
3838 	if (tn != NULL)
3839 		tn = cconv(tn);
3840 	if (tn != NULL)
3841 		tn = promote(NOOP, false, tn);
3842 
3843 	v = xcalloc(1, sizeof(*v));
3844 
3845 	if (tn == NULL) {
3846 		lint_assert(nerr != 0);
3847 		debug_step("constant node is null; returning 1 instead");
3848 		v->v_tspec = INT;
3849 		v->v_quad = 1;
3850 		return v;
3851 	}
3852 
3853 	v->v_tspec = tn->tn_type->t_tspec;
3854 
3855 	if (tn->tn_op == CON) {
3856 		lint_assert(tn->tn_type->t_tspec == tn->tn_val->v_tspec);
3857 		if (is_integer(tn->tn_val->v_tspec)) {
3858 			v->v_unsigned_since_c90 =
3859 			    tn->tn_val->v_unsigned_since_c90;
3860 			v->v_quad = tn->tn_val->v_quad;
3861 			return v;
3862 		}
3863 		v->v_quad = tn->tn_val->v_ldbl;
3864 	} else {
3865 		v->v_quad = 1;
3866 	}
3867 
3868 	if (required)
3869 		/* integral constant expression expected */
3870 		error(55);
3871 	else
3872 		/* variable array dimension is a C99/GCC extension */
3873 		c99ism(318);
3874 
3875 	if (!is_integer(v->v_tspec))
3876 		v->v_tspec = INT;
3877 
3878 	return v;
3879 }
3880 
3881 static bool
3882 is_constcond_false(const tnode_t *tn, tspec_t t)
3883 {
3884 	return (t == BOOL || t == INT) &&
3885 	       tn->tn_op == CON && tn->tn_val->v_quad == 0;
3886 }
3887 
3888 /*
3889  * Perform some tests on expressions which can't be done in build_binary()
3890  * and functions called by build_binary(). These tests must be done here
3891  * because we need some information about the context in which the operations
3892  * are performed.
3893  * After all tests are performed and dofreeblk is true, expr() frees the
3894  * memory which is used for the expression.
3895  */
3896 void
3897 expr(tnode_t *tn, bool vctx, bool tctx, bool dofreeblk, bool is_do_while)
3898 {
3899 
3900 	if (tn == NULL) {	/* in case of errors */
3901 		expr_free_all();
3902 		return;
3903 	}
3904 
3905 	/* expr() is also called in global initializations */
3906 	if (dcs->d_ctx != EXTERN && !is_do_while)
3907 		check_statement_reachable();
3908 
3909 	check_expr_misc(tn, vctx, tctx, !tctx, false, false, false);
3910 	if (tn->tn_op == ASSIGN) {
3911 		if (hflag && tctx)
3912 			/* assignment in conditional context */
3913 			warning(159);
3914 	} else if (tn->tn_op == CON) {
3915 		if (hflag && tctx && !constcond_flag &&
3916 		    !tn->tn_system_dependent &&
3917 		    !(is_do_while &&
3918 		      is_constcond_false(tn, tn->tn_type->t_tspec)))
3919 			/* constant in conditional context */
3920 			warning(161);
3921 	}
3922 	if (!modtab[tn->tn_op].m_has_side_effect) {
3923 		/*
3924 		 * for left operands of COMMA this warning is already
3925 		 * printed
3926 		 */
3927 		if (tn->tn_op != COMMA && !vctx && !tctx)
3928 			check_null_effect(tn);
3929 	}
3930 	debug_node(tn);
3931 
3932 	/* free the tree memory */
3933 	if (dofreeblk)
3934 		expr_free_all();
3935 }
3936 
3937 static bool
3938 has_side_effect(const tnode_t *tn) /* NOLINT(misc-no-recursion) */
3939 {
3940 	op_t op = tn->tn_op;
3941 
3942 	if (modtab[op].m_has_side_effect)
3943 		return true;
3944 
3945 	if (op == CVT && tn->tn_type->t_tspec == VOID)
3946 		return has_side_effect(tn->tn_left);
3947 
3948 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3949 	if (op == LOGAND || op == LOGOR)
3950 		return has_side_effect(tn->tn_right);
3951 
3952 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3953 	if (op == QUEST)
3954 		return has_side_effect(tn->tn_right);
3955 
3956 	if (op == COLON || op == COMMA) {
3957 		return has_side_effect(tn->tn_left) ||
3958 		       has_side_effect(tn->tn_right);
3959 	}
3960 
3961 	return false;
3962 }
3963 
3964 static bool
3965 is_void_cast(const tnode_t *tn)
3966 {
3967 
3968 	return tn->tn_op == CVT && tn->tn_cast &&
3969 	       tn->tn_type->t_tspec == VOID;
3970 }
3971 
3972 static bool
3973 is_local_symbol(const tnode_t *tn)
3974 {
3975 
3976 	return tn->tn_op == LOAD &&
3977 	       tn->tn_left->tn_op == NAME &&
3978 	       tn->tn_left->tn_sym->s_scl == AUTO;
3979 }
3980 
3981 static bool
3982 is_int_constant_zero(const tnode_t *tn)
3983 {
3984 
3985 	return tn->tn_op == CON &&
3986 	       tn->tn_type->t_tspec == INT &&
3987 	       tn->tn_val->v_quad == 0;
3988 }
3989 
3990 static void
3991 check_null_effect(const tnode_t *tn)
3992 {
3993 
3994 	if (!hflag)
3995 		return;
3996 	if (has_side_effect(tn))
3997 		return;
3998 	if (is_void_cast(tn) && is_local_symbol(tn->tn_left))
3999 		return;
4000 	if (is_void_cast(tn) && is_int_constant_zero(tn->tn_left))
4001 		return;
4002 
4003 	/* expression has null effect */
4004 	warning(129);
4005 }
4006 
4007 static void
4008 check_expr_addr(const tnode_t *ln, bool szof, bool fcall)
4009 {
4010 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4011 	if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
4012 		if (!szof)
4013 			mark_as_set(ln->tn_sym);
4014 		mark_as_used(ln->tn_sym, fcall, szof);
4015 	}
4016 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4017 		/* check the range of array indices */
4018 		check_array_index(ln->tn_left, true);
4019 }
4020 
4021 static void
4022 check_expr_load(const tnode_t *ln)
4023 {
4024 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4025 		/* check the range of array indices */
4026 		check_array_index(ln->tn_left, false);
4027 }
4028 
4029 static void
4030 check_expr_side_effect(const tnode_t *ln, bool szof)
4031 {
4032 	scl_t sc;
4033 	dinfo_t *di;
4034 
4035 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4036 	if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
4037 		sc = ln->tn_sym->s_scl;
4038 		/*
4039 		 * Look if there was a asm statement in one of the
4040 		 * compound statements we are in. If not, we don't
4041 		 * print a warning.
4042 		 */
4043 		for (di = dcs; di != NULL; di = di->d_next) {
4044 			if (di->d_asm)
4045 				break;
4046 		}
4047 		if (sc != EXTERN && sc != STATIC &&
4048 		    !ln->tn_sym->s_set && !szof && di == NULL) {
4049 			/* %s may be used before set */
4050 			warning(158, ln->tn_sym->s_name);
4051 			mark_as_set(ln->tn_sym);
4052 		}
4053 		mark_as_used(ln->tn_sym, false, false);
4054 	}
4055 }
4056 
4057 static void
4058 check_expr_assign(const tnode_t *ln, bool szof)
4059 {
4060 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4061 	if (ln->tn_op == NAME && !szof && (reached || !warn_about_unreachable)) {
4062 		mark_as_set(ln->tn_sym);
4063 		if (ln->tn_sym->s_scl == EXTERN)
4064 			outusg(ln->tn_sym);
4065 	}
4066 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4067 		/* check the range of array indices */
4068 		check_array_index(ln->tn_left, false);
4069 }
4070 
4071 static void
4072 check_expr_call(const tnode_t *tn, const tnode_t *ln,
4073 		bool szof, bool vctx, bool tctx, bool retval_discarded)
4074 {
4075 	lint_assert(ln->tn_op == ADDR);
4076 	lint_assert(ln->tn_left->tn_op == NAME);
4077 	if (!szof &&
4078 	    !is_compiler_builtin(ln->tn_left->tn_sym->s_name))
4079 		outcall(tn, vctx || tctx, retval_discarded);
4080 }
4081 
4082 static bool
4083 check_expr_op(const tnode_t *tn, op_t op, const tnode_t *ln,
4084 	      bool szof, bool fcall, bool vctx, bool tctx,
4085 	      bool retval_discarded, bool eqwarn)
4086 {
4087 	switch (op) {
4088 	case ADDR:
4089 		check_expr_addr(ln, szof, fcall);
4090 		break;
4091 	case LOAD:
4092 		check_expr_load(ln);
4093 		/* FALLTHROUGH */
4094 	case PUSH:
4095 	case INCBEF:
4096 	case DECBEF:
4097 	case INCAFT:
4098 	case DECAFT:
4099 	case ADDASS:
4100 	case SUBASS:
4101 	case MULASS:
4102 	case DIVASS:
4103 	case MODASS:
4104 	case ANDASS:
4105 	case ORASS:
4106 	case XORASS:
4107 	case SHLASS:
4108 	case SHRASS:
4109 	case REAL:
4110 	case IMAG:
4111 		check_expr_side_effect(ln, szof);
4112 		break;
4113 	case ASSIGN:
4114 		check_expr_assign(ln, szof);
4115 		break;
4116 	case CALL:
4117 		check_expr_call(tn, ln, szof, vctx, tctx, retval_discarded);
4118 		break;
4119 	case EQ:
4120 		if (hflag && eqwarn)
4121 			/* operator '==' found where '=' was expected */
4122 			warning(160);
4123 		break;
4124 	case CON:
4125 	case NAME:
4126 	case STRING:
4127 		return false;
4128 		/* LINTED206: (enumeration values not handled in switch) */
4129 	case BITOR:
4130 	case BITXOR:
4131 	case NE:
4132 	case GE:
4133 	case GT:
4134 	case LE:
4135 	case LT:
4136 	case SHR:
4137 	case SHL:
4138 	case MINUS:
4139 	case PLUS:
4140 	case MOD:
4141 	case DIV:
4142 	case MULT:
4143 	case INDIR:
4144 	case UMINUS:
4145 	case UPLUS:
4146 	case DEC:
4147 	case INC:
4148 	case COMPL:
4149 	case NOT:
4150 	case POINT:
4151 	case ARROW:
4152 	case NOOP:
4153 	case BITAND:
4154 	case FARG:
4155 	case CASE:
4156 	case INIT:
4157 	case RETURN:
4158 	case ICALL:
4159 	case CVT:
4160 	case COMMA:
4161 	case FSEL:
4162 	case COLON:
4163 	case QUEST:
4164 	case LOGOR:
4165 	case LOGAND:
4166 		break;
4167 	}
4168 	return true;
4169 }
4170 
4171 /* ARGSUSED */
4172 void
4173 check_expr_misc(const tnode_t *tn, bool vctx, bool tctx,
4174 		bool eqwarn, bool fcall, bool retval_discarded, bool szof)
4175 {
4176 	tnode_t *ln, *rn;
4177 	const mod_t *mp;
4178 	op_t op;
4179 	bool cvctx, ctctx, eq, discard;
4180 
4181 	if (tn == NULL)
4182 		return;
4183 
4184 	ln = tn->tn_left;
4185 	rn = tn->tn_right;
4186 	mp = &modtab[op = tn->tn_op];
4187 
4188 	if (!check_expr_op(tn, op, ln,
4189 	    szof, fcall, vctx, tctx, retval_discarded, eqwarn))
4190 		return;
4191 
4192 	cvctx = mp->m_left_value_context;
4193 	ctctx = mp->m_left_test_context;
4194 	eq = mp->m_warn_if_operand_eq &&
4195 	     !ln->tn_parenthesized &&
4196 	     rn != NULL && !rn->tn_parenthesized;
4197 
4198 	/*
4199 	 * values of operands of ':' are not used if the type of at least
4200 	 * one of the operands (for gcc compatibility) is void
4201 	 * XXX test/value context of QUEST should probably be used as
4202 	 * context for both operands of COLON
4203 	 */
4204 	if (op == COLON && tn->tn_type->t_tspec == VOID)
4205 		cvctx = ctctx = false;
4206 	discard = op == CVT && tn->tn_type->t_tspec == VOID;
4207 	check_expr_misc(ln, cvctx, ctctx, eq, op == CALL, discard, szof);
4208 
4209 	switch (op) {
4210 	case PUSH:
4211 		if (rn != NULL)
4212 			check_expr_misc(rn, false, false, eq, false, false,
4213 			    szof);
4214 		break;
4215 	case LOGAND:
4216 	case LOGOR:
4217 		check_expr_misc(rn, false, true, eq, false, false, szof);
4218 		break;
4219 	case COLON:
4220 		check_expr_misc(rn, cvctx, ctctx, eq, false, false, szof);
4221 		break;
4222 	case COMMA:
4223 		check_expr_misc(rn, vctx, tctx, eq, false, false, szof);
4224 		break;
4225 	default:
4226 		if (mp->m_binary)
4227 			check_expr_misc(rn, true, false, eq, false, false,
4228 			    szof);
4229 		break;
4230 	}
4231 }
4232 
4233 /*
4234  * Checks the range of array indices, if possible.
4235  * amper is set if only the address of the element is used. This
4236  * means that the index is allowed to refer to the first element
4237  * after the array.
4238  */
4239 static void
4240 check_array_index(tnode_t *tn, bool amper)
4241 {
4242 	int	dim;
4243 	tnode_t	*ln, *rn;
4244 	int	elsz;
4245 	int64_t	con;
4246 
4247 	ln = tn->tn_left;
4248 	rn = tn->tn_right;
4249 
4250 	/* We can only check constant indices. */
4251 	if (rn->tn_op != CON)
4252 		return;
4253 
4254 	/* Return if the left node does not stem from an array. */
4255 	if (ln->tn_op != ADDR)
4256 		return;
4257 	if (ln->tn_left->tn_op != STRING && ln->tn_left->tn_op != NAME)
4258 		return;
4259 	if (ln->tn_left->tn_type->t_tspec != ARRAY)
4260 		return;
4261 
4262 	/*
4263 	 * For incomplete array types, we can print a warning only if
4264 	 * the index is negative.
4265 	 */
4266 	if (is_incomplete(ln->tn_left->tn_type) && rn->tn_val->v_quad >= 0)
4267 		return;
4268 
4269 	/* Get the size of one array element */
4270 	if ((elsz = length(ln->tn_type->t_subt, NULL)) == 0)
4271 		return;
4272 	elsz /= CHAR_SIZE;
4273 
4274 	/* Change the unit of the index from bytes to element size. */
4275 	if (is_uinteger(rn->tn_type->t_tspec)) {
4276 		con = (uint64_t)rn->tn_val->v_quad / elsz;
4277 	} else {
4278 		con = rn->tn_val->v_quad / elsz;
4279 	}
4280 
4281 	dim = ln->tn_left->tn_type->t_dim + (amper ? 1 : 0);
4282 
4283 	if (!is_uinteger(rn->tn_type->t_tspec) && con < 0) {
4284 		/* array subscript cannot be negative: %ld */
4285 		warning(167, (long)con);
4286 	} else if (dim > 0 && (uint64_t)con >= (uint64_t)dim) {
4287 		/* array subscript cannot be > %d: %ld */
4288 		warning(168, dim - 1, (long)con);
4289 	}
4290 }
4291 
4292 static bool
4293 is_out_of_char_range(const tnode_t *tn)
4294 {
4295 	return tn->tn_op == CON &&
4296 	       !(0 <= tn->tn_val->v_quad &&
4297 		 tn->tn_val->v_quad < 1 << (CHAR_SIZE - 1));
4298 }
4299 
4300 /*
4301  * Check for ordered comparisons of unsigned values with 0.
4302  */
4303 static void
4304 check_integer_comparison(op_t op, tnode_t *ln, tnode_t *rn)
4305 {
4306 	tspec_t	lt, rt;
4307 
4308 	lt = ln->tn_type->t_tspec;
4309 	rt = rn->tn_type->t_tspec;
4310 
4311 	if (ln->tn_op != CON && rn->tn_op != CON)
4312 		return;
4313 
4314 	if (!is_integer(lt) || !is_integer(rt))
4315 		return;
4316 
4317 	if (hflag || pflag) {
4318 		if (lt == CHAR && is_out_of_char_range(rn)) {
4319 			/* nonportable character comparison '%s %d' */
4320 			warning(230, op_name(op), (int)rn->tn_val->v_quad);
4321 			return;
4322 		}
4323 		if (rt == CHAR && is_out_of_char_range(ln)) {
4324 			/* nonportable character comparison '%s %d' */
4325 			warning(230, op_name(op), (int)ln->tn_val->v_quad);
4326 			return;
4327 		}
4328 	}
4329 
4330 	if (is_uinteger(lt) && !is_uinteger(rt) &&
4331 	    rn->tn_op == CON && rn->tn_val->v_quad <= 0) {
4332 		if (rn->tn_val->v_quad < 0) {
4333 			/* comparison of %s with %s, op %s */
4334 			warning(162, type_name(ln->tn_type),
4335 			    "negative constant", op_name(op));
4336 		} else if (op == LT || op == GE) {
4337 			/* comparison of %s with %s, op %s */
4338 			warning(162, type_name(ln->tn_type), "0", op_name(op));
4339 		}
4340 		return;
4341 	}
4342 	if (is_uinteger(rt) && !is_uinteger(lt) &&
4343 	    ln->tn_op == CON && ln->tn_val->v_quad <= 0) {
4344 		if (ln->tn_val->v_quad < 0) {
4345 			/* comparison of %s with %s, op %s */
4346 			warning(162, "negative constant",
4347 			    type_name(rn->tn_type), op_name(op));
4348 		} else if (op == GT || op == LE) {
4349 			/* comparison of %s with %s, op %s */
4350 			warning(162, "0", type_name(rn->tn_type), op_name(op));
4351 		}
4352 		return;
4353 	}
4354 }
4355 
4356 /*
4357  * Return whether the expression can be used for static initialization.
4358  *
4359  * Constant initialization expressions must be constant or an address
4360  * of a static object with an optional offset. In the first case,
4361  * the result is returned in *offsp. In the second case, the static
4362  * object is returned in *symp and the offset in *offsp.
4363  *
4364  * The expression can consist of PLUS, MINUS, ADDR, NAME, STRING and
4365  * CON. Type conversions are allowed if they do not change binary
4366  * representation (including width).
4367  *
4368  * C99 6.6 "Constant expressions"
4369  * C99 6.7.8p4 restricts initializers for static storage duration
4370  */
4371 bool
4372 constant_addr(const tnode_t *tn, const sym_t **symp, ptrdiff_t *offsp)
4373 {
4374 	const sym_t *sym;
4375 	ptrdiff_t offs1, offs2;
4376 	tspec_t	t, ot;
4377 
4378 	switch (tn->tn_op) {
4379 	case MINUS:
4380 		if (tn->tn_right->tn_op == CVT)
4381 			return constant_addr(tn->tn_right, symp, offsp);
4382 		else if (tn->tn_right->tn_op != CON)
4383 			return false;
4384 		/* FALLTHROUGH */
4385 	case PLUS:
4386 		offs1 = offs2 = 0;
4387 		if (tn->tn_left->tn_op == CON) {
4388 			offs1 = (ptrdiff_t)tn->tn_left->tn_val->v_quad;
4389 			if (!constant_addr(tn->tn_right, &sym, &offs2))
4390 				return false;
4391 		} else if (tn->tn_right->tn_op == CON) {
4392 			offs2 = (ptrdiff_t)tn->tn_right->tn_val->v_quad;
4393 			if (tn->tn_op == MINUS)
4394 				offs2 = -offs2;
4395 			if (!constant_addr(tn->tn_left, &sym, &offs1))
4396 				return false;
4397 		} else {
4398 			return false;
4399 		}
4400 		*symp = sym;
4401 		*offsp = offs1 + offs2;
4402 		return true;
4403 	case ADDR:
4404 		if (tn->tn_left->tn_op == NAME) {
4405 			*symp = tn->tn_left->tn_sym;
4406 			*offsp = 0;
4407 			return true;
4408 		} else {
4409 			/*
4410 			 * If this would be the front end of a compiler we
4411 			 * would return a label instead of 0, at least if
4412 			 * 'tn->tn_left->tn_op == STRING'.
4413 			 */
4414 			*symp = NULL;
4415 			*offsp = 0;
4416 			return true;
4417 		}
4418 	case CVT:
4419 		t = tn->tn_type->t_tspec;
4420 		ot = tn->tn_left->tn_type->t_tspec;
4421 		if ((!is_integer(t) && t != PTR) ||
4422 		    (!is_integer(ot) && ot != PTR)) {
4423 			return false;
4424 		}
4425 #if 0
4426 		/*
4427 		 * consider:
4428 		 *	struct foo {
4429 		 *		unsigned char a;
4430 		 *	} f = {
4431 		 *		(unsigned char)(unsigned long)
4432 		 *		    (&(((struct foo *)0)->a))
4433 		 *	};
4434 		 * since psize(unsigned long) != psize(unsigned char),
4435 		 * this fails.
4436 		 */
4437 		else if (psize(t) != psize(ot))
4438 			return -1;
4439 #endif
4440 		return constant_addr(tn->tn_left, symp, offsp);
4441 	default:
4442 		return false;
4443 	}
4444 }
4445 
4446 /* Append s2 to s1, then free s2. */
4447 strg_t *
4448 cat_strings(strg_t *s1, strg_t *s2)
4449 {
4450 	size_t len1, len2, sz;
4451 
4452 	if (s1->st_tspec != s2->st_tspec) {
4453 		/* cannot concatenate wide and regular string literals */
4454 		error(292);
4455 		return s1;
4456 	}
4457 
4458 	len1 = s1->st_len;
4459 	len2 = s2->st_len;
4460 
4461 	if (s1->st_tspec == CHAR) {
4462 		sz = sizeof(*s1->st_cp);
4463 		s1->st_cp = xrealloc(s1->st_cp, (len1 + len2 + 1) * sz);
4464 		memcpy(s1->st_cp + len1, s2->st_cp, (len2 + 1) * sz);
4465 		free(s2->st_cp);
4466 	} else {
4467 		sz = sizeof(*s1->st_wcp);
4468 		s1->st_wcp = xrealloc(s1->st_wcp, (len1 + len2 + 1) * sz);
4469 		memcpy(s1->st_wcp + len1, s2->st_wcp, (len2 + 1) * sz);
4470 		free(s2->st_wcp);
4471 	}
4472 
4473 	s1->st_len = len1 + len2;
4474 	free(s2);
4475 
4476 	return s1;
4477 }
4478 
4479 static bool
4480 is_confusing_precedence(op_t op, op_t lop, bool lparen, op_t rop, bool rparen)
4481 {
4482 
4483 	if (op == SHL || op == SHR) {
4484 		if (!lparen && (lop == PLUS || lop == MINUS))
4485 			return true;
4486 		if (!rparen && (rop == PLUS || rop == MINUS))
4487 			return true;
4488 		return false;
4489 	}
4490 
4491 	if (op == LOGOR) {
4492 		if (!lparen && lop == LOGAND)
4493 			return true;
4494 		if (!rparen && rop == LOGAND)
4495 			return true;
4496 		return false;
4497 	}
4498 
4499 	lint_assert(op == BITAND || op == BITXOR || op == BITOR);
4500 	if (!lparen && lop != op) {
4501 		if (lop == PLUS || lop == MINUS)
4502 			return true;
4503 		if (lop == BITAND || lop == BITXOR)
4504 			return true;
4505 	}
4506 	if (!rparen && rop != op) {
4507 		if (rop == PLUS || rop == MINUS)
4508 			return true;
4509 		if (rop == BITAND || rop == BITXOR)
4510 			return true;
4511 	}
4512 	return false;
4513 }
4514 
4515 /*
4516  * Print a warning if the given node has operands which should be
4517  * parenthesized.
4518  *
4519  * XXX Does not work if an operand is a constant expression. Constant
4520  * expressions are already folded.
4521  */
4522 static void
4523 check_precedence_confusion(tnode_t *tn)
4524 {
4525 	tnode_t *ln, *rn;
4526 
4527 	if (!hflag)
4528 		return;
4529 
4530 	debug_node(tn);
4531 
4532 	lint_assert(is_binary(tn));
4533 	for (ln = tn->tn_left; ln->tn_op == CVT; ln = ln->tn_left)
4534 		continue;
4535 	for (rn = tn->tn_right; rn->tn_op == CVT; rn = rn->tn_left)
4536 		continue;
4537 
4538 	if (is_confusing_precedence(tn->tn_op,
4539 	    ln->tn_op, ln->tn_parenthesized,
4540 	    rn->tn_op, rn->tn_parenthesized)) {
4541 		/* precedence confusion possible: parenthesize! */
4542 		warning(169);
4543 	}
4544 }
4545