xref: /netbsd-src/usr.bin/xlint/lint1/tree.c (revision 2a698ff5a341b6ec6aca83e780ad320a752687c1)
1 /*	$NetBSD: tree.c,v 1.266 2021/04/05 02:05:47 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: tree.c,v 1.266 2021/04/05 02:05:47 rillig Exp $");
41 #endif
42 
43 #include <float.h>
44 #include <limits.h>
45 #include <math.h>
46 #include <signal.h>
47 #include <stdlib.h>
48 #include <string.h>
49 
50 #include "lint1.h"
51 #include "cgram.h"
52 
53 static	tnode_t	*expr_new_integer_constant(tspec_t, int64_t);
54 static	void	check_pointer_comparison(op_t,
55 					 const tnode_t *, const tnode_t *);
56 static	bool	check_assign_types_compatible(op_t, int,
57 					      const tnode_t *, const tnode_t *);
58 static	void	check_bad_enum_operation(op_t,
59 					 const tnode_t *, const tnode_t *);
60 static	void	check_enum_type_mismatch(op_t, int,
61 				         const tnode_t *, const tnode_t *);
62 static	void	check_enum_int_mismatch(op_t, int,
63 					const tnode_t *, const tnode_t *);
64 static	tnode_t	*new_tnode(op_t, type_t *, tnode_t *, tnode_t *);
65 static	void	balance(op_t, tnode_t **, tnode_t **);
66 static	void	warn_incompatible_types(op_t, const type_t *, tspec_t,
67 					const type_t *, tspec_t);
68 static	void	warn_incompatible_pointers(const mod_t *,
69 					   const type_t *, const type_t *);
70 static	bool	has_constant_member(const type_t *);
71 static	void	check_prototype_conversion(int, tspec_t, tspec_t, type_t *,
72 					   tnode_t *);
73 static	void	check_integer_conversion(op_t, int, tspec_t, tspec_t, type_t *,
74 					 tnode_t *);
75 static	void	check_pointer_integer_conversion(op_t, tspec_t, type_t *,
76 						 tnode_t *);
77 static	void	check_pointer_conversion(op_t, tnode_t *, type_t *);
78 static	tnode_t	*build_struct_access(op_t, tnode_t *, tnode_t *);
79 static	tnode_t	*build_prepost_incdec(op_t, tnode_t *);
80 static	tnode_t	*build_real_imag(op_t, tnode_t *);
81 static	tnode_t	*build_address(tnode_t *, bool);
82 static	tnode_t	*build_plus_minus(op_t, tnode_t *, tnode_t *);
83 static	tnode_t	*build_bit_shift(op_t, tnode_t *, tnode_t *);
84 static	tnode_t	*build_colon(tnode_t *, tnode_t *);
85 static	tnode_t	*build_assignment(op_t, tnode_t *, tnode_t *);
86 static	tnode_t	*plength(type_t *);
87 static	tnode_t	*fold(tnode_t *);
88 static	tnode_t	*fold_test(tnode_t *);
89 static	tnode_t	*fold_float(tnode_t *);
90 static	tnode_t	*check_function_arguments(type_t *, tnode_t *);
91 static	tnode_t	*check_prototype_argument(int, type_t *, tnode_t *);
92 static	void	check_null_effect(const tnode_t *);
93 static	void	display_expression(const tnode_t *, int);
94 static	void	check_array_index(tnode_t *, bool);
95 static	void	check_integer_comparison(op_t, tnode_t *, tnode_t *);
96 static	void	check_precedence_confusion(tnode_t *);
97 
98 extern sig_atomic_t fpe;
99 
100 static const char *
101 op_name(op_t op)
102 {
103 	return modtab[op].m_name;
104 }
105 
106 #ifdef DEBUG
107 void
108 debug_node(const tnode_t *tn, int indent)
109 {
110 	op_t op;
111 
112 	if (tn == NULL) {
113 		printf("%*s" "null\n", indent, "");
114 		return;
115 	}
116 
117 	op = tn->tn_op;
118 	printf("%*s%s with type '%s'%s%s",
119 	    2 * indent, "",
120 	    op == CVT && !tn->tn_cast ? "convert" : op_name(op),
121 	    type_name(tn->tn_type), tn->tn_lvalue ? ", lvalue" : "",
122 	    tn->tn_parenthesized ? ", parenthesized" : "");
123 
124 	if (op == NAME)
125 		printf(" %s\n", tn->tn_sym->s_name);
126 	else if (op == CON && is_floating(tn->tn_type->t_tspec))
127 		printf(", value %Lg", tn->tn_val->v_ldbl);
128 	else if (op == CON && is_uinteger(tn->tn_type->t_tspec))
129 		printf(", value %llu\n", (unsigned long long)tn->tn_val->v_quad);
130 	else if (op == CON && is_integer(tn->tn_type->t_tspec))
131 		printf(", value %lld\n", (long long)tn->tn_val->v_quad);
132 	else if (op == CON)
133 		printf(", unknown value\n");
134 	else if (op == STRING)
135 		printf(", length %zu\n", tn->tn_string->st_len);
136 	else {
137 		printf("\n");
138 
139 		debug_node(tn->tn_left, indent + 1);
140 		if (modtab[op].m_binary || tn->tn_right != NULL)
141 			debug_node(tn->tn_right, indent + 1);
142 	}
143 }
144 #endif
145 
146 /* Build 'pointer to tp', 'array of tp' or 'function returning tp'. */
147 type_t *
148 derive_type(type_t *tp, tspec_t t)
149 {
150 	type_t	*tp2;
151 
152 	tp2 = getblk(sizeof(*tp2));
153 	tp2->t_tspec = t;
154 	tp2->t_subt = tp;
155 	return tp2;
156 }
157 
158 /*
159  * Build 'pointer to tp', 'array of tp' or 'function returning tp'.  The
160  * memory is freed at the end of the current expression.
161  */
162 type_t *
163 expr_derive_type(type_t *tp, tspec_t t)
164 {
165 	type_t	*tp2;
166 
167 	tp2 = expr_zalloc(sizeof(*tp2));
168 	tp2->t_tspec = t;
169 	tp2->t_subt = tp;
170 	return tp2;
171 }
172 
173 /*
174  * Create a node for a constant.
175  */
176 tnode_t *
177 expr_new_constant(type_t *tp, val_t *v)
178 {
179 	tnode_t	*n;
180 
181 	n = expr_zalloc_tnode();
182 	n->tn_op = CON;
183 	n->tn_type = tp;
184 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
185 	n->tn_val->v_tspec = tp->t_tspec;
186 	n->tn_val->v_ansiu = v->v_ansiu;
187 	n->tn_val->v_u = v->v_u;
188 	free(v);
189 	return n;
190 }
191 
192 static tnode_t *
193 expr_new_integer_constant(tspec_t t, int64_t q)
194 {
195 	tnode_t	*n;
196 
197 	n = expr_zalloc_tnode();
198 	n->tn_op = CON;
199 	n->tn_type = gettyp(t);
200 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
201 	n->tn_val->v_tspec = t;
202 	n->tn_val->v_quad = q;
203 	return n;
204 }
205 
206 static void
207 fallback_symbol(sym_t *sym)
208 {
209 
210 	if (Tflag && strcmp(sym->s_name, "__lint_false") == 0) {
211 		sym->s_scl = CTCONST; /* close enough */
212 		sym->s_type = gettyp(BOOL);
213 		sym->s_value.v_tspec = BOOL;
214 		sym->s_value.v_ansiu = false;
215 		sym->s_value.v_quad = 0;
216 		return;
217 	}
218 
219 	if (Tflag && strcmp(sym->s_name, "__lint_true") == 0) {
220 		sym->s_scl = CTCONST; /* close enough */
221 		sym->s_type = gettyp(BOOL);
222 		sym->s_value.v_tspec = BOOL;
223 		sym->s_value.v_ansiu = false;
224 		sym->s_value.v_quad = 1;
225 		return;
226 	}
227 
228 	if (block_level > 0 && (strcmp(sym->s_name, "__FUNCTION__") == 0 ||
229 			   strcmp(sym->s_name, "__PRETTY_FUNCTION__") == 0)) {
230 		/* __FUNCTION__/__PRETTY_FUNCTION__ is a GCC extension */
231 		gnuism(316);
232 		sym->s_type = derive_type(gettyp(CHAR), PTR);
233 		sym->s_type->t_const = true;
234 		return;
235 	}
236 
237 	if (block_level > 0 && strcmp(sym->s_name, "__func__") == 0) {
238 		if (!Sflag)
239 			/* __func__ is a C9X feature */
240 			warning(317);
241 		sym->s_type = derive_type(gettyp(CHAR), PTR);
242 		sym->s_type->t_const = true;
243 		return;
244 	}
245 
246 	/* '%s' undefined */
247 	error(99, sym->s_name);
248 }
249 
250 /*
251  * Create a node for a name (symbol table entry).
252  * follow_token is the token which follows the name.
253  */
254 tnode_t *
255 new_name_node(sym_t *sym, int follow_token)
256 {
257 	tnode_t	*n;
258 
259 	if (sym->s_scl == NOSCL) {
260 		sym->s_scl = EXTERN;
261 		sym->s_def = DECL;
262 		if (follow_token == T_LPAREN) {
263 			if (sflag) {
264 				/* function implicitly declared to ... */
265 				warning(215);
266 			}
267 			/*
268 			 * XXX if tflag is set the symbol should be
269 			 * exported to level 0
270 			 */
271 			sym->s_type = derive_type(sym->s_type, FUNC);
272 		} else {
273 			fallback_symbol(sym);
274 		}
275 	}
276 
277 	lint_assert(sym->s_kind == FVFT || sym->s_kind == FMEMBER);
278 
279 	n = expr_zalloc_tnode();
280 	n->tn_type = sym->s_type;
281 	if (sym->s_scl != CTCONST) {
282 		n->tn_op = NAME;
283 		n->tn_sym = sym;
284 		if (sym->s_kind == FVFT && sym->s_type->t_tspec != FUNC)
285 			n->tn_lvalue = true;
286 	} else {
287 		n->tn_op = CON;
288 		n->tn_val = expr_zalloc(sizeof(*n->tn_val));
289 		*n->tn_val = sym->s_value;
290 	}
291 
292 	return n;
293 }
294 
295 tnode_t *
296 new_string_node(strg_t *strg)
297 {
298 	size_t	len;
299 	tnode_t	*n;
300 
301 	len = strg->st_len;
302 
303 	n = expr_zalloc_tnode();
304 
305 	n->tn_op = STRING;
306 	n->tn_type = expr_derive_type(gettyp(strg->st_tspec), ARRAY);
307 	n->tn_type->t_dim = len + 1;
308 	n->tn_lvalue = true;
309 
310 	n->tn_string = expr_zalloc(sizeof(*n->tn_string));
311 	n->tn_string->st_tspec = strg->st_tspec;
312 	n->tn_string->st_len = len;
313 
314 	if (strg->st_tspec == CHAR) {
315 		n->tn_string->st_cp = expr_zalloc(len + 1);
316 		(void)memcpy(n->tn_string->st_cp, strg->st_cp, len + 1);
317 		free(strg->st_cp);
318 	} else {
319 		size_t size = (len + 1) * sizeof(*n->tn_string->st_wcp);
320 		n->tn_string->st_wcp = expr_zalloc(size);
321 		(void)memcpy(n->tn_string->st_wcp, strg->st_wcp, size);
322 		free(strg->st_wcp);
323 	}
324 	free(strg);
325 
326 	return n;
327 }
328 
329 /*
330  * Returns a symbol which has the same name as the msym argument and is a
331  * member of the struct or union specified by the tn argument.
332  */
333 sym_t *
334 struct_or_union_member(tnode_t *tn, op_t op, sym_t *msym)
335 {
336 	struct_or_union	*str;
337 	type_t	*tp;
338 	sym_t	*sym, *csym;
339 	bool	eq;
340 	tspec_t	t;
341 
342 	/*
343 	 * Remove the member if it was unknown until now, which means
344 	 * that no defined struct or union has a member with the same name.
345 	 */
346 	if (msym->s_scl == NOSCL) {
347 		/* type '%s' does not have member '%s' */
348 		error(101, type_name(msym->s_type), msym->s_name);
349 		rmsym(msym);
350 		msym->s_kind = FMEMBER;
351 		msym->s_scl = MOS;
352 		msym->s_styp = expr_zalloc(sizeof(*msym->s_styp));
353 		msym->s_styp->sou_tag = expr_zalloc(
354 		    sizeof(*msym->s_styp->sou_tag));
355 		msym->s_styp->sou_tag->s_name = unnamed;
356 		msym->s_value.v_tspec = INT;
357 		return msym;
358 	}
359 
360 	/* Set str to the tag of which msym is expected to be a member. */
361 	str = NULL;
362 	t = (tp = tn->tn_type)->t_tspec;
363 	if (op == POINT) {
364 		if (t == STRUCT || t == UNION)
365 			str = tp->t_str;
366 	} else if (op == ARROW && t == PTR) {
367 		t = (tp = tp->t_subt)->t_tspec;
368 		if (t == STRUCT || t == UNION)
369 			str = tp->t_str;
370 	}
371 
372 	/*
373 	 * If this struct/union has a member with the name of msym, return it.
374 	 */
375 	if (str != NULL) {
376 		for (sym = msym; sym != NULL; sym = sym->s_link) {
377 			if (sym->s_scl != MOS && sym->s_scl != MOU)
378 				continue;
379 			if (sym->s_styp != str)
380 				continue;
381 			if (strcmp(sym->s_name, msym->s_name) != 0)
382 				continue;
383 			return sym;
384 		}
385 	}
386 
387 	/*
388 	 * Set eq to false if there are struct/union members with the same
389 	 * name and different types and/or offsets.
390 	 */
391 	eq = true;
392 	for (csym = msym; csym != NULL; csym = csym->s_link) {
393 		if (csym->s_scl != MOS && csym->s_scl != MOU)
394 			continue;
395 		if (strcmp(msym->s_name, csym->s_name) != 0)
396 			continue;
397 		for (sym = csym->s_link ; sym != NULL; sym = sym->s_link) {
398 			bool w;
399 
400 			if (sym->s_scl != MOS && sym->s_scl != MOU)
401 				continue;
402 			if (strcmp(csym->s_name, sym->s_name) != 0)
403 				continue;
404 			if (csym->s_value.v_quad != sym->s_value.v_quad) {
405 				eq = false;
406 				break;
407 			}
408 			w = false;
409 			eq = eqtype(csym->s_type, sym->s_type,
410 			    false, false, &w) && !w;
411 			if (!eq)
412 				break;
413 			if (csym->s_bitfield != sym->s_bitfield) {
414 				eq = false;
415 				break;
416 			}
417 			if (csym->s_bitfield) {
418 				type_t	*tp1, *tp2;
419 
420 				tp1 = csym->s_type;
421 				tp2 = sym->s_type;
422 				if (tp1->t_flen != tp2->t_flen) {
423 					eq = false;
424 					break;
425 				}
426 				if (tp1->t_foffs != tp2->t_foffs) {
427 					eq = false;
428 					break;
429 				}
430 			}
431 		}
432 		if (!eq)
433 			break;
434 	}
435 
436 	/*
437 	 * Now handle the case in which the left operand refers really
438 	 * to a struct/union, but the right operand is not member of it.
439 	 */
440 	if (str != NULL) {
441 		if (eq && tflag) {
442 			/* illegal member use: %s */
443 			warning(102, msym->s_name);
444 		} else {
445 			/* illegal member use: %s */
446 			error(102, msym->s_name);
447 		}
448 		return msym;
449 	}
450 
451 	/*
452 	 * Now the left operand of ARROW does not point to a struct/union
453 	 * or the left operand of POINT is no struct/union.
454 	 */
455 	if (eq) {
456 		if (op == POINT) {
457 			if (tflag) {
458 				/* left operand of '.' must be struct/... */
459 				warning(103);
460 			} else {
461 				/* left operand of '.' must be struct/... */
462 				error(103);
463 			}
464 		} else {
465 			if (tflag && tn->tn_type->t_tspec == PTR) {
466 				/* left operand of '->' must be pointer ... */
467 				warning(104, type_name(tn->tn_type));
468 			} else {
469 				/* left operand of '->' must be pointer ... */
470 				error(104, type_name(tn->tn_type));
471 			}
472 		}
473 	} else {
474 		if (tflag) {
475 			/* non-unique member requires struct/union %s */
476 			error(105, op == POINT ? "object" : "pointer");
477 		} else {
478 			/* unacceptable operand of '%s' */
479 			error(111, op_name(op));
480 		}
481 	}
482 
483 	return msym;
484 }
485 
486 /*
487  * Create a tree node. Called for most operands except function calls,
488  * sizeof and casts.
489  *
490  * op	operator
491  * ln	left operand
492  * rn	if not NULL, right operand
493  */
494 tnode_t *
495 build(op_t op, tnode_t *ln, tnode_t *rn)
496 {
497 	const mod_t *mp;
498 	tnode_t	*ntn;
499 	type_t	*rettp;
500 
501 	mp = &modtab[op];
502 
503 	/* If there was an error in one of the operands, return. */
504 	if (ln == NULL || (mp->m_binary && rn == NULL))
505 		return NULL;
506 
507 	/*
508 	 * Apply class conversions to the left operand, but only if its
509 	 * value is needed or it is compared with null.
510 	 */
511 	if (mp->m_left_value_context || mp->m_left_test_context)
512 		ln = cconv(ln);
513 	/*
514 	 * The right operand is almost always in a test or value context,
515 	 * except if it is a struct or union member.
516 	 */
517 	if (mp->m_binary && op != ARROW && op != POINT)
518 		rn = cconv(rn);
519 
520 	/*
521 	 * Print some warnings for comparisons of unsigned values with
522 	 * constants lower than or equal to null. This must be done
523 	 * before promote() because otherwise unsigned char and unsigned
524 	 * short would be promoted to int. Also types are tested to be
525 	 * CHAR, which would also become int.
526 	 */
527 	if (mp->m_comparison)
528 		check_integer_comparison(op, ln, rn);
529 
530 	/*
531 	 * Promote the left operand if it is in a test or value context
532 	 */
533 	if (mp->m_left_value_context || mp->m_left_test_context)
534 		ln = promote(op, false, ln);
535 	/*
536 	 * Promote the right operand, but only if it is no struct or
537 	 * union member, or if it is not to be assigned to the left operand
538 	 */
539 	if (mp->m_binary && op != ARROW && op != POINT &&
540 	    op != ASSIGN && op != RETURN) {
541 		rn = promote(op, false, rn);
542 	}
543 
544 	/*
545 	 * If the result of the operation is different for signed or
546 	 * unsigned operands and one of the operands is signed only in
547 	 * ANSI C, print a warning.
548 	 */
549 	if (mp->m_warn_if_left_unsigned_in_c90 &&
550 	    ln->tn_op == CON && ln->tn_val->v_ansiu) {
551 		/* ANSI C treats constant as unsigned, op %s */
552 		warning(218, mp->m_name);
553 		ln->tn_val->v_ansiu = false;
554 	}
555 	if (mp->m_warn_if_right_unsigned_in_c90 &&
556 	    rn->tn_op == CON && rn->tn_val->v_ansiu) {
557 		/* ANSI C treats constant as unsigned, op %s */
558 		warning(218, mp->m_name);
559 		rn->tn_val->v_ansiu = false;
560 	}
561 
562 	/* Make sure both operands are of the same type */
563 	if (mp->m_balance_operands || (tflag && (op == SHL || op == SHR)))
564 		balance(op, &ln, &rn);
565 
566 	/*
567 	 * Check types for compatibility with the operation and mutual
568 	 * compatibility. Return if there are serious problems.
569 	 */
570 	if (!typeok(op, 0, ln, rn))
571 		return NULL;
572 
573 	/* And now create the node. */
574 	switch (op) {
575 	case POINT:
576 	case ARROW:
577 		ntn = build_struct_access(op, ln, rn);
578 		break;
579 	case INCAFT:
580 	case DECAFT:
581 	case INCBEF:
582 	case DECBEF:
583 		ntn = build_prepost_incdec(op, ln);
584 		break;
585 	case ADDR:
586 		ntn = build_address(ln, false);
587 		break;
588 	case INDIR:
589 		ntn = new_tnode(INDIR, ln->tn_type->t_subt, ln, NULL);
590 		break;
591 	case PLUS:
592 	case MINUS:
593 		ntn = build_plus_minus(op, ln, rn);
594 		break;
595 	case SHL:
596 	case SHR:
597 		ntn = build_bit_shift(op, ln, rn);
598 		break;
599 	case COLON:
600 		ntn = build_colon(ln, rn);
601 		break;
602 	case ASSIGN:
603 	case MULASS:
604 	case DIVASS:
605 	case MODASS:
606 	case ADDASS:
607 	case SUBASS:
608 	case SHLASS:
609 	case SHRASS:
610 	case ANDASS:
611 	case XORASS:
612 	case ORASS:
613 	case RETURN:
614 		ntn = build_assignment(op, ln, rn);
615 		break;
616 	case COMMA:
617 	case QUEST:
618 		ntn = new_tnode(op, rn->tn_type, ln, rn);
619 		break;
620 	case REAL:
621 	case IMAG:
622 		ntn = build_real_imag(op, ln);
623 		break;
624 	default:
625 		rettp = mp->m_returns_bool
626 		    ? gettyp(Tflag ? BOOL : INT) : ln->tn_type;
627 		lint_assert(mp->m_binary || rn == NULL);
628 		ntn = new_tnode(op, rettp, ln, rn);
629 		break;
630 	}
631 
632 	/* Return if an error occurred. */
633 	if (ntn == NULL)
634 		return NULL;
635 
636 	/* Print a warning if precedence confusion is possible */
637 	if (mp->m_possible_precedence_confusion)
638 		check_precedence_confusion(ntn);
639 
640 	/*
641 	 * Print a warning if one of the operands is in a context where
642 	 * it is compared with null and if this operand is a constant.
643 	 */
644 	if (mp->m_left_test_context) {
645 		if (ln->tn_op == CON ||
646 		    ((mp->m_binary && op != QUEST) && rn->tn_op == CON)) {
647 			if (hflag && !constcond_flag &&
648 			    !ln->tn_system_dependent)
649 				/* constant in conditional context */
650 				warning(161);
651 		}
652 	}
653 
654 	/* Fold if the operator requires it */
655 	if (mp->m_fold_constant_operands) {
656 		if (ln->tn_op == CON && (!mp->m_binary || rn->tn_op == CON)) {
657 			if (mp->m_left_test_context) {
658 				ntn = fold_test(ntn);
659 			} else if (is_floating(ntn->tn_type->t_tspec)) {
660 				ntn = fold_float(ntn);
661 			} else {
662 				ntn = fold(ntn);
663 			}
664 		} else if (op == QUEST && ln->tn_op == CON) {
665 			ntn = ln->tn_val->v_quad != 0
666 			    ? rn->tn_left : rn->tn_right;
667 		}
668 	}
669 
670 	return ntn;
671 }
672 
673 /*
674  * Perform class conversions.
675  *
676  * Arrays of type T are converted into pointers to type T.
677  * Functions are converted to pointers to functions.
678  * Lvalues are converted to rvalues.
679  *
680  * C99 6.3 "Conversions"
681  * C99 6.3.2 "Other operands"
682  * C99 6.3.2.1 "Lvalues, arrays, and function designators"
683  */
684 tnode_t *
685 cconv(tnode_t *tn)
686 {
687 	type_t	*tp;
688 
689 	/*
690 	 * Array-lvalue (array of type T) is converted into rvalue
691 	 * (pointer to type T)
692 	 */
693 	if (tn->tn_type->t_tspec == ARRAY) {
694 		if (!tn->tn_lvalue) {
695 			/* XXX print correct operator */
696 			/* %soperand of '%s' must be lvalue */
697 			gnuism(114, "", op_name(ADDR));
698 		}
699 		tn = new_tnode(ADDR,
700 		    expr_derive_type(tn->tn_type->t_subt, PTR), tn, NULL);
701 	}
702 
703 	/*
704 	 * Expression of type function (function with return value of type T)
705 	 * in rvalue-expression (pointer to function with return value
706 	 * of type T)
707 	 */
708 	if (tn->tn_type->t_tspec == FUNC)
709 		tn = build_address(tn, true);
710 
711 	/* lvalue to rvalue */
712 	if (tn->tn_lvalue) {
713 		tp = expr_dup_type(tn->tn_type);
714 		tp->t_const = tp->t_volatile = false;
715 		tn = new_tnode(LOAD, tp, tn, NULL);
716 	}
717 
718 	return tn;
719 }
720 
721 const tnode_t *
722 before_conversion(const tnode_t *tn)
723 {
724 	while (tn->tn_op == CVT && !tn->tn_cast)
725 		tn = tn->tn_left;
726 	return tn;
727 }
728 
729 static bool
730 is_null_pointer(const tnode_t *tn)
731 {
732 	tspec_t t = tn->tn_type->t_tspec;
733 
734 	return ((t == PTR && tn->tn_type->t_subt->t_tspec == VOID) ||
735 		is_integer(t))
736 	       && (tn->tn_op == CON && tn->tn_val->v_quad == 0);
737 }
738 
739 /*
740  * See if the node is valid as operand of an operator that compares its
741  * argument with 0.
742  */
743 bool
744 is_typeok_bool_operand(const tnode_t *tn)
745 {
746 	tspec_t t;
747 
748 	lint_assert(Tflag);
749 
750 	tn = before_conversion(tn);
751 	t = tn->tn_type->t_tspec;
752 
753 	if (t == BOOL)
754 		return true;
755 
756 	if (tn->tn_from_system_header && is_scalar(t))
757 		return true;
758 
759 	/* For enums that are used as bit sets, allow "flags & FLAG". */
760 	if (tn->tn_op == BITAND &&
761 	    tn->tn_left->tn_op == CVT &&
762 	    tn->tn_left->tn_type->t_tspec == INT && !tn->tn_left->tn_cast &&
763 	    tn->tn_left->tn_left->tn_type->t_tspec == ENUM &&
764 	    /*
765 	     * XXX: Somehow the type information got lost here.  The type
766 	     * of the enum constant on the right-hand side should still be
767 	     * ENUM, but is INT.
768 	     */
769 	    tn->tn_right->tn_type->t_tspec == INT)
770 		return true;
771 
772 	return false;
773 }
774 
775 static bool
776 typeok_incdec(op_t op, const tnode_t *tn, const type_t *tp)
777 {
778 	/* operand has scalar type (checked in typeok) */
779 	if (!tn->tn_lvalue) {
780 		if (tn->tn_op == CVT && tn->tn_cast &&
781 		    tn->tn_left->tn_op == LOAD) {
782 			if (tn->tn_type->t_tspec == PTR)
783 				return true;
784 			/* a cast does not yield an lvalue */
785 			error(163);
786 		}
787 		/* %soperand of '%s' must be lvalue */
788 		error(114, "", op_name(op));
789 		return false;
790 	} else if (tp->t_const) {
791 		if (!tflag)
792 			/* %soperand of '%s' must be modifiable lvalue */
793 			warning(115, "", op_name(op));
794 	}
795 	return true;
796 }
797 
798 static bool
799 typeok_address(const mod_t *mp,
800 	    const tnode_t *tn, const type_t *tp, tspec_t t)
801 {
802 	if (t == ARRAY || t == FUNC) {
803 		/* ok, a warning comes later (in build_address()) */
804 	} else if (!tn->tn_lvalue) {
805 		if (tn->tn_op == CVT && tn->tn_cast &&
806 		    tn->tn_left->tn_op == LOAD) {
807 			if (tn->tn_type->t_tspec == PTR)
808 				return true;
809 			/* a cast does not yield an lvalue */
810 			error(163);
811 		}
812 		/* %soperand of '%s' must be lvalue */
813 		error(114, "", mp->m_name);
814 		return false;
815 	} else if (is_scalar(t)) {
816 		if (tp->t_bitfield) {
817 			/* cannot take address of bit-field */
818 			error(112);
819 			return false;
820 		}
821 	} else if (t != STRUCT && t != UNION) {
822 		/* unacceptable operand of '%s' */
823 		error(111, mp->m_name);
824 		return false;
825 	}
826 	if (tn->tn_op == NAME && tn->tn_sym->s_reg) {
827 		/* cannot take address of register %s */
828 		error(113, tn->tn_sym->s_name);
829 		return false;
830 	}
831 	return true;
832 }
833 
834 static bool
835 typeok_star(tspec_t t)
836 {
837 	/* until now there were no type checks for this operator */
838 	if (t != PTR) {
839 		/* cannot dereference non-pointer type */
840 		error(96);
841 		return false;
842 	}
843 	return true;
844 }
845 
846 static bool
847 typeok_plus(op_t op,
848 	    const type_t *ltp, tspec_t lt,
849 	    const type_t *rtp, tspec_t rt)
850 {
851 	/* operands have scalar types (checked above) */
852 	if ((lt == PTR && !is_integer(rt)) || (rt == PTR && !is_integer(lt))) {
853 		warn_incompatible_types(op, ltp, lt, rtp, rt);
854 		return false;
855 	}
856 	return true;
857 }
858 
859 static bool
860 typeok_minus(op_t op,
861 	     const type_t *ltp, tspec_t lt,
862 	     const type_t *rtp, tspec_t rt)
863 {
864 	/* operands have scalar types (checked above) */
865 	if (lt == PTR && (!is_integer(rt) && rt != PTR)) {
866 		warn_incompatible_types(op, ltp, lt, rtp, rt);
867 		return false;
868 	} else if (rt == PTR && lt != PTR) {
869 		warn_incompatible_types(op, ltp, lt, rtp, rt);
870 		return false;
871 	}
872 	if (lt == PTR && rt == PTR) {
873 		if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
874 			/* illegal pointer subtraction */
875 			error(116);
876 		}
877 	}
878 	return true;
879 }
880 
881 static void
882 typeok_shr(const mod_t *mp,
883 	   const tnode_t *ln, tspec_t lt,
884 	   const tnode_t *rn, tspec_t rt)
885 {
886 	tspec_t olt, ort;
887 
888 	olt = before_conversion(ln)->tn_type->t_tspec;
889 	ort = before_conversion(rn)->tn_type->t_tspec;
890 
891 	/* operands have integer types (checked above) */
892 	if (pflag && !is_uinteger(lt)) {
893 		/*
894 		 * The left operand is signed. This means that
895 		 * the operation is (possibly) nonportable.
896 		 */
897 		if (ln->tn_op != CON) {
898 			/* bitwise '%s' on signed value possibly nonportable */
899 			warning(117, mp->m_name);
900 		} else if (ln->tn_val->v_quad < 0) {
901 			/* bitwise '%s' on signed value nonportable */
902 			warning(120, mp->m_name);
903 		}
904 	} else if (!tflag && !sflag && !is_uinteger(olt) && is_uinteger(ort)) {
905 		/*
906 		 * The left operand would become unsigned in
907 		 * traditional C.
908 		 */
909 		if (hflag &&
910 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
911 			/* semantics of '%s' change in ANSI C; use ... */
912 			warning(118, mp->m_name);
913 		}
914 	} else if (!tflag && !sflag && !is_uinteger(olt) && !is_uinteger(ort) &&
915 		   portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
916 		/*
917 		 * In traditional C the left operand would be extended,
918 		 * possibly with 1, and then shifted.
919 		 */
920 		if (hflag &&
921 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
922 			/* semantics of '%s' change in ANSI C; use ... */
923 			warning(118, mp->m_name);
924 		}
925 	}
926 }
927 
928 static void
929 typeok_shl(const mod_t *mp, tspec_t lt, tspec_t rt)
930 {
931 	/*
932 	 * C90 does not perform balancing for shift operations,
933 	 * but traditional C does. If the width of the right operand
934 	 * is greater than the width of the left operand, then in
935 	 * traditional C the left operand would be extended to the
936 	 * width of the right operand. For SHL this may result in
937 	 * different results.
938 	 */
939 	if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
940 		/*
941 		 * XXX If both operands are constant, make sure
942 		 * that there is really a difference between
943 		 * ANSI C and traditional C.
944 		 */
945 		if (hflag)
946 			/* semantics of '%s' change in ANSI C; use ... */
947 			warning(118, mp->m_name);
948 	}
949 }
950 
951 static void
952 typeok_shift(tspec_t lt, const tnode_t *rn, tspec_t rt)
953 {
954 	if (rn->tn_op == CON) {
955 		if (!is_uinteger(rt) && rn->tn_val->v_quad < 0) {
956 			/* negative shift */
957 			warning(121);
958 		} else if ((uint64_t)rn->tn_val->v_quad ==
959 			   (uint64_t)size_in_bits(lt)) {
960 			/* shift equal to size of object */
961 			warning(267);
962 		} else if ((uint64_t)rn->tn_val->v_quad >
963 			   (uint64_t)size_in_bits(lt)) {
964 			/* shift greater than size of object */
965 			warning(122);
966 		}
967 	}
968 }
969 
970 static bool
971 is_typeok_eq(const tnode_t *ln, tspec_t lt, const tnode_t *rn, tspec_t rt)
972 {
973 	if (lt == PTR && is_null_pointer(rn))
974 		return true;
975 	if (rt == PTR && is_null_pointer(ln))
976 		return true;
977 	return false;
978 }
979 
980 static bool
981 typeok_ordered_comparison(op_t op,
982 			  const tnode_t *ln, const type_t *ltp, tspec_t lt,
983 			  const tnode_t *rn, const type_t *rtp, tspec_t rt)
984 {
985 	if (lt == PTR && rt == PTR) {
986 		check_pointer_comparison(op, ln, rn);
987 		return true;
988 	}
989 
990 	if (lt != PTR && rt != PTR)
991 		return true;
992 
993 	if (!is_integer(lt) && !is_integer(rt)) {
994 		warn_incompatible_types(op, ltp, lt, rtp, rt);
995 		return false;
996 	}
997 
998 	const char *lx = lt == PTR ? "pointer" : "integer";
999 	const char *rx = rt == PTR ? "pointer" : "integer";
1000 	/* illegal combination of %s (%s) and %s (%s), op %s */
1001 	warning(123, lx, type_name(ltp), rx, type_name(rtp), op_name(op));
1002 	return true;
1003 }
1004 
1005 static bool
1006 typeok_quest(tspec_t lt, const tnode_t **rn)
1007 {
1008 	if (!is_scalar(lt)) {
1009 		/* first operand must have scalar type, op ? : */
1010 		error(170);
1011 		return false;
1012 	}
1013 	while ((*rn)->tn_op == CVT)
1014 		*rn = (*rn)->tn_left;
1015 	lint_assert((*rn)->tn_op == COLON);
1016 	return true;
1017 }
1018 
1019 static void
1020 typeok_colon_pointer(const mod_t *mp, const type_t *ltp, const type_t *rtp)
1021 {
1022 	type_t *lstp = ltp->t_subt;
1023 	type_t *rstp = rtp->t_subt;
1024 	tspec_t lst = lstp->t_tspec;
1025 	tspec_t rst = rstp->t_tspec;
1026 
1027 	if ((lst == VOID && rst == FUNC) || (lst == FUNC && rst == VOID)) {
1028 		/* (void *)0 handled above */
1029 		if (sflag)
1030 			/* ANSI C forbids conv. of %s to %s, op %s */
1031 			warning(305, "function pointer", "'void *'",
1032 			    mp->m_name);
1033 		return;
1034 	}
1035 
1036 	if (eqptrtype(lstp, rstp, true))
1037 		return;
1038 	if (!eqtype(lstp, rstp, true, false, NULL))
1039 		warn_incompatible_pointers(mp, ltp, rtp);
1040 }
1041 
1042 static bool
1043 typeok_colon(const mod_t *mp,
1044 	     const tnode_t *ln, const type_t *ltp, tspec_t lt,
1045 	     const tnode_t *rn, const type_t *rtp, tspec_t rt)
1046 {
1047 
1048 	if (is_arithmetic(lt) && is_arithmetic(rt))
1049 		return true;
1050 	if (lt == BOOL && rt == BOOL)
1051 		return true;
1052 
1053 	if (lt == STRUCT && rt == STRUCT && ltp->t_str == rtp->t_str)
1054 		return true;
1055 	if (lt == UNION && rt == UNION && ltp->t_str == rtp->t_str)
1056 		return true;
1057 
1058 	if (lt == PTR && is_null_pointer(rn))
1059 		return true;
1060 	if (rt == PTR && is_null_pointer(ln))
1061 		return true;
1062 
1063 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1064 		const char *lx = lt == PTR ?  "pointer" : "integer";
1065 		const char *rx = rt == PTR ?  "pointer" : "integer";
1066 		/* illegal combination of %s (%s) and %s (%s), op %s */
1067 		warning(123, lx, type_name(ltp),
1068 		    rx, type_name(rtp), mp->m_name);
1069 		return true;
1070 	}
1071 
1072 	if (lt == VOID || rt == VOID) {
1073 		if (lt != VOID || rt != VOID)
1074 			/* incompatible types '%s' and '%s' in conditional */
1075 			warning(126, type_name(ltp), type_name(rtp));
1076 		return true;
1077 	}
1078 
1079 	if (lt == PTR && rt == PTR) {
1080 		typeok_colon_pointer(mp, ltp, rtp);
1081 		return true;
1082 	}
1083 
1084 	/* incompatible types '%s' and '%s' in conditional */
1085 	error(126, type_name(ltp), type_name(rtp));
1086 	return false;
1087 }
1088 
1089 static bool
1090 typeok_assign(const mod_t *mp, const tnode_t *ln, const type_t *ltp, tspec_t lt)
1091 {
1092 	if (!ln->tn_lvalue) {
1093 		if (ln->tn_op == CVT && ln->tn_cast &&
1094 		    ln->tn_left->tn_op == LOAD) {
1095 			if (ln->tn_type->t_tspec == PTR)
1096 				return true;
1097 			/* a cast does not yield an lvalue */
1098 			error(163);
1099 		}
1100 		/* %soperand of '%s' must be lvalue */
1101 		error(114, "left ", mp->m_name);
1102 		return false;
1103 	} else if (ltp->t_const || ((lt == STRUCT || lt == UNION) &&
1104 				    has_constant_member(ltp))) {
1105 		if (!tflag)
1106 			/* %soperand of '%s' must be modifiable lvalue */
1107 			warning(115, "left ", mp->m_name);
1108 	}
1109 	return true;
1110 }
1111 
1112 /*
1113  * See if in strict bool mode, the operator takes either two bool operands
1114  * or two arbitrary other operands.
1115  */
1116 static bool
1117 is_assignment_bool_or_other(op_t op)
1118 {
1119 	return op == ASSIGN ||
1120 	       op == ANDASS || op == XORASS || op == ORASS ||
1121 	       op == RETURN || op == INIT || op == FARG;
1122 }
1123 
1124 static bool
1125 is_symmetric_bool_or_other(op_t op)
1126 {
1127 	return op == EQ || op == NE ||
1128 	       op == BITAND || op == BITXOR || op == BITOR ||
1129 	       op == COLON;
1130 }
1131 
1132 static bool
1133 is_int_constant_zero(const tnode_t *tn, tspec_t t)
1134 {
1135 	return t == INT && tn->tn_op == CON && tn->tn_val->v_quad == 0;
1136 }
1137 
1138 static bool
1139 is_typeok_strict_bool(op_t op,
1140 		      const tnode_t *ln, tspec_t lt,
1141 		      const tnode_t *rn, tspec_t rt)
1142 {
1143 	if (rn == NULL)
1144 		return true;	/* TODO: check unary operators as well. */
1145 
1146 	if ((lt == BOOL) == (rt == BOOL))
1147 		return true;
1148 
1149 	if ((ln->tn_from_system_header || rn->tn_from_system_header) &&
1150 	    (is_int_constant_zero(ln, lt) || is_int_constant_zero(rn, rt)))
1151 		return true;
1152 
1153 	if (is_assignment_bool_or_other(op)) {
1154 		return lt != BOOL &&
1155 		       (ln->tn_from_system_header || rn->tn_from_system_header);
1156 	}
1157 
1158 	return !is_symmetric_bool_or_other(op);
1159 }
1160 
1161 /*
1162  * Some operators require that either both operands are bool or both are
1163  * scalar.
1164  *
1165  * Code that passes this check can be compiled in a pre-C99 environment that
1166  * doesn't implement the special rule C99 6.3.1.2, without silent change in
1167  * behavior.
1168  */
1169 static bool
1170 typeok_strict_bool_compatible(op_t op, int arg,
1171 			      const tnode_t *ln, tspec_t lt,
1172 			      const tnode_t *rn, tspec_t rt)
1173 {
1174 
1175 	if (is_typeok_strict_bool(op, ln, lt, rn, rt))
1176 		return true;
1177 
1178 	if (op == FARG) {
1179 		/* argument #%d expects '%s', gets passed '%s' */
1180 		error(334, arg, tspec_name(lt), tspec_name(rt));
1181 	} else if (op == RETURN) {
1182 		/* return value type mismatch (%s) and (%s) */
1183 		error(211, tspec_name(lt), tspec_name(rt));
1184 	} else {
1185 		/* operands of '%s' have incompatible types (%s != %s) */
1186 		error(107, op_name(op), tspec_name(lt), tspec_name(rt));
1187 	}
1188 
1189 	return false;
1190 }
1191 
1192 /*
1193  * In strict bool mode, check whether the types of the operands match the
1194  * operator.
1195  */
1196 static bool
1197 typeok_scalar_strict_bool(op_t op, const mod_t *mp, int arg,
1198 			  const tnode_t *ln,
1199 			  const tnode_t *rn)
1200 
1201 {
1202 	tspec_t lt, rt;
1203 
1204 	ln = before_conversion(ln);
1205 	lt = ln->tn_type->t_tspec;
1206 
1207 	if (rn != NULL) {
1208 		rn = before_conversion(rn);
1209 		rt = rn->tn_type->t_tspec;
1210 	} else {
1211 		rt = NOTSPEC;
1212 	}
1213 
1214 	if (!typeok_strict_bool_compatible(op, arg, ln, lt, rn, rt))
1215 		return false;
1216 
1217 	if (mp->m_requires_bool || op == QUEST) {
1218 		bool binary = mp->m_binary;
1219 		bool lbool = is_typeok_bool_operand(ln);
1220 		bool ok = true;
1221 
1222 		if (!binary && !lbool) {
1223 			/* operand of '%s' must be bool, not '%s' */
1224 			error(330, op_name(op), tspec_name(lt));
1225 			ok = false;
1226 		}
1227 		if (binary && !lbool) {
1228 			/* left operand of '%s' must be bool, not '%s' */
1229 			error(331, op_name(op), tspec_name(lt));
1230 			ok = false;
1231 		}
1232 		if (binary && op != QUEST && !is_typeok_bool_operand(rn)) {
1233 			/* right operand of '%s' must be bool, not '%s' */
1234 			error(332, op_name(op), tspec_name(rt));
1235 			ok = false;
1236 		}
1237 		return ok;
1238 	}
1239 
1240 	if (!mp->m_takes_bool) {
1241 		bool binary = mp->m_binary;
1242 		bool lbool = ln->tn_type->t_tspec == BOOL;
1243 		bool ok = true;
1244 
1245 		if (!binary && lbool) {
1246 			/* operand of '%s' must not be bool */
1247 			error(335, op_name(op));
1248 			ok = false;
1249 		}
1250 		if (binary && lbool) {
1251 			/* left operand of '%s' must not be bool */
1252 			error(336, op_name(op));
1253 			ok = false;
1254 		}
1255 		if (binary && rn->tn_type->t_tspec == BOOL) {
1256 			/* right operand of '%s' must not be bool */
1257 			error(337, op_name(op));
1258 			ok = false;
1259 		}
1260 		return ok;
1261 	}
1262 
1263 	return true;
1264 }
1265 
1266 /* Check the types using the information from modtab[]. */
1267 static bool
1268 typeok_scalar(op_t op, const mod_t *mp,
1269 	      const type_t *ltp, tspec_t lt,
1270 	      const type_t *rtp, tspec_t rt)
1271 {
1272 	if (mp->m_takes_bool && lt == BOOL && rt == BOOL)
1273 		return true;
1274 	if (mp->m_requires_integer) {
1275 		if (!is_integer(lt) || (mp->m_binary && !is_integer(rt))) {
1276 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1277 			return false;
1278 		}
1279 	} else if (mp->m_requires_integer_or_complex) {
1280 		if ((!is_integer(lt) && !is_complex(lt)) ||
1281 		    (mp->m_binary && (!is_integer(rt) && !is_complex(rt)))) {
1282 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1283 			return false;
1284 		}
1285 	} else if (mp->m_requires_scalar) {
1286 		if (!is_scalar(lt) || (mp->m_binary && !is_scalar(rt))) {
1287 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1288 			return false;
1289 		}
1290 	} else if (mp->m_requires_arith) {
1291 		if (!is_arithmetic(lt) ||
1292 		    (mp->m_binary && !is_arithmetic(rt))) {
1293 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1294 			return false;
1295 		}
1296 	}
1297 	return true;
1298 }
1299 
1300 /* Check the types for specific operators and type combinations. */
1301 static bool
1302 typeok_op(op_t op, const mod_t *mp, int arg,
1303 	  const tnode_t *ln, const type_t *ltp, tspec_t lt,
1304 	  const tnode_t *rn, const type_t *rtp, tspec_t rt)
1305 {
1306 	switch (op) {
1307 	case POINT:
1308 		/*
1309 		 * Most errors required by ANSI C are reported in
1310 		 * struct_or_union_member().
1311 		 * Here we only must check for totally wrong things.
1312 		 */
1313 		if (lt == FUNC || lt == VOID || ltp->t_bitfield ||
1314 		    ((lt != STRUCT && lt != UNION) && !ln->tn_lvalue)) {
1315 			/* Without tflag we got already an error */
1316 			if (tflag)
1317 				/* unacceptable operand of '%s' */
1318 				error(111, mp->m_name);
1319 			return false;
1320 		}
1321 		/* Now we have an object we can create a pointer to */
1322 		break;
1323 	case ARROW:
1324 		if (lt != PTR && !(tflag && is_integer(lt))) {
1325 			/* Without tflag we got already an error */
1326 			if (tflag)
1327 				/* unacceptable operand of '%s' */
1328 				error(111, mp->m_name);
1329 			return false;
1330 		}
1331 		break;
1332 	case INCAFT:
1333 	case DECAFT:
1334 	case INCBEF:
1335 	case DECBEF:
1336 		if (!typeok_incdec(op, ln, ltp))
1337 			return false;
1338 		break;
1339 	case ADDR:
1340 		if (!typeok_address(mp, ln, ltp, lt))
1341 			return false;
1342 		break;
1343 	case INDIR:
1344 		if (!typeok_star(lt))
1345 			return false;
1346 		break;
1347 	case PLUS:
1348 		if (!typeok_plus(op, ltp, lt, rtp, rt))
1349 			return false;
1350 		break;
1351 	case MINUS:
1352 		if (!typeok_minus(op, ltp, lt, rtp, rt))
1353 			return false;
1354 		break;
1355 	case SHR:
1356 		typeok_shr(mp, ln, lt, rn, rt);
1357 		goto shift;
1358 	case SHL:
1359 		typeok_shl(mp, lt, rt);
1360 	shift:
1361 		typeok_shift(lt, rn, rt);
1362 		break;
1363 	case EQ:
1364 	case NE:
1365 		/*
1366 		 * Accept some things which are allowed with EQ and NE,
1367 		 * but not with ordered comparisons.
1368 		 */
1369 		if (is_typeok_eq(ln, lt, rn, rt))
1370 			break;
1371 		/* FALLTHROUGH */
1372 	case LT:
1373 	case GT:
1374 	case LE:
1375 	case GE:
1376 		if (!typeok_ordered_comparison(op, ln, ltp, lt, rn, rtp, rt))
1377 			return false;
1378 		break;
1379 	case QUEST:
1380 		if (!typeok_quest(lt, &rn))
1381 			return false;
1382 		break;
1383 	case COLON:
1384 		if (!typeok_colon(mp, ln, ltp, lt, rn, rtp, rt))
1385 			return false;
1386 		break;
1387 	case ASSIGN:
1388 	case INIT:
1389 	case FARG:
1390 	case RETURN:
1391 		if (!check_assign_types_compatible(op, arg, ln, rn))
1392 			return false;
1393 		goto assign;
1394 	case MULASS:
1395 	case DIVASS:
1396 	case MODASS:
1397 		goto assign;
1398 	case ADDASS:
1399 	case SUBASS:
1400 		/* operands have scalar types (checked above) */
1401 		if ((lt == PTR && !is_integer(rt)) || rt == PTR) {
1402 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1403 			return false;
1404 		}
1405 		goto assign;
1406 	case SHLASS:
1407 		goto assign;
1408 	case SHRASS:
1409 		if (pflag && !is_uinteger(lt) && !(tflag && is_uinteger(rt))) {
1410 			/* bitwise '%s' on signed value possibly nonportable */
1411 			warning(117, mp->m_name);
1412 		}
1413 		goto assign;
1414 	case ANDASS:
1415 	case XORASS:
1416 	case ORASS:
1417 		goto assign;
1418 	assign:
1419 		if (!typeok_assign(mp, ln, ltp, lt))
1420 			return false;
1421 		break;
1422 	case COMMA:
1423 		if (!modtab[ln->tn_op].m_has_side_effect)
1424 			check_null_effect(ln);
1425 		break;
1426 		/* LINTED206: (enumeration values not handled in switch) */
1427 	case CON:
1428 	case CASE:
1429 	case PUSH:
1430 	case LOAD:
1431 	case ICALL:
1432 	case CVT:
1433 	case CALL:
1434 	case FSEL:
1435 	case STRING:
1436 	case NAME:
1437 	case LOGOR:
1438 	case LOGAND:
1439 	case BITOR:
1440 	case BITXOR:
1441 	case BITAND:
1442 	case MOD:
1443 	case DIV:
1444 	case MULT:
1445 	case UMINUS:
1446 	case UPLUS:
1447 	case DEC:
1448 	case INC:
1449 	case COMPL:
1450 	case NOT:
1451 	case NOOP:
1452 	case REAL:
1453 	case IMAG:
1454 		break;
1455 	}
1456 	return true;
1457 }
1458 
1459 static void
1460 typeok_enum(op_t op, const mod_t *mp, int arg,
1461 	    const tnode_t *ln, const type_t *ltp,
1462 	    const tnode_t *rn, const type_t *rtp)
1463 {
1464 	if (mp->m_bad_on_enum &&
1465 	    (ltp->t_is_enum || (mp->m_binary && rtp->t_is_enum))) {
1466 		check_bad_enum_operation(op, ln, rn);
1467 	} else if (mp->m_valid_on_enum &&
1468 		   (ltp->t_is_enum && rtp != NULL && rtp->t_is_enum)) {
1469 		check_enum_type_mismatch(op, arg, ln, rn);
1470 	} else if (mp->m_valid_on_enum &&
1471 		   (ltp->t_is_enum || (rtp != NULL && rtp->t_is_enum))) {
1472 		check_enum_int_mismatch(op, arg, ln, rn);
1473 	}
1474 }
1475 
1476 /* Perform most type checks. Return whether the types are ok. */
1477 bool
1478 typeok(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1479 {
1480 	const mod_t *mp;
1481 	tspec_t	lt, rt;
1482 	type_t	*ltp, *rtp;
1483 
1484 	mp = &modtab[op];
1485 
1486 	lint_assert((ltp = ln->tn_type) != NULL);
1487 	lt = ltp->t_tspec;
1488 
1489 	if (mp->m_binary) {
1490 		lint_assert((rtp = rn->tn_type) != NULL);
1491 		rt = rtp->t_tspec;
1492 	} else {
1493 		rtp = NULL;
1494 		rt = NOTSPEC;
1495 	}
1496 
1497 	if (Tflag && !typeok_scalar_strict_bool(op, mp, arg, ln, rn))
1498 		return false;
1499 	if (!typeok_scalar(op, mp, ltp, lt, rtp, rt))
1500 		return false;
1501 
1502 	if (!typeok_op(op, mp, arg, ln, ltp, lt, rn, rtp, rt))
1503 		return false;
1504 
1505 	typeok_enum(op, mp, arg, ln, ltp, rn, rtp);
1506 	return true;
1507 }
1508 
1509 static void
1510 check_pointer_comparison(op_t op, const tnode_t *ln, const tnode_t *rn)
1511 {
1512 	type_t	*ltp, *rtp;
1513 	tspec_t	lst, rst;
1514 	const	char *lsts, *rsts;
1515 
1516 	lst = (ltp = ln->tn_type)->t_subt->t_tspec;
1517 	rst = (rtp = rn->tn_type)->t_subt->t_tspec;
1518 
1519 	if (lst == VOID || rst == VOID) {
1520 		if (sflag && (lst == FUNC || rst == FUNC)) {
1521 			/* (void *)0 already handled in typeok() */
1522 			*(lst == FUNC ? &lsts : &rsts) = "function pointer";
1523 			*(lst == VOID ? &lsts : &rsts) = "'void *'";
1524 			/* ANSI C forbids comparison of %s with %s */
1525 			warning(274, lsts, rsts);
1526 		}
1527 		return;
1528 	}
1529 
1530 	if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
1531 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1532 		return;
1533 	}
1534 
1535 	if (lst == FUNC && rst == FUNC) {
1536 		if (sflag && op != EQ && op != NE)
1537 			/* ANSI C forbids ordered comparisons of ... */
1538 			warning(125);
1539 	}
1540 }
1541 
1542 /*
1543  * Checks type compatibility for ASSIGN, INIT, FARG and RETURN
1544  * and prints warnings/errors if necessary.
1545  * If the types are (almost) compatible, 1 is returned, otherwise 0.
1546  */
1547 static bool
1548 check_assign_types_compatible(op_t op, int arg,
1549 			      const tnode_t *ln, const tnode_t *rn)
1550 {
1551 	tspec_t	lt, rt, lst = NOTSPEC, rst = NOTSPEC;
1552 	type_t	*ltp, *rtp, *lstp = NULL, *rstp = NULL;
1553 	const mod_t *mp;
1554 	const	char *lts, *rts;
1555 
1556 	if ((lt = (ltp = ln->tn_type)->t_tspec) == PTR)
1557 		lst = (lstp = ltp->t_subt)->t_tspec;
1558 	if ((rt = (rtp = rn->tn_type)->t_tspec) == PTR)
1559 		rst = (rstp = rtp->t_subt)->t_tspec;
1560 	mp = &modtab[op];
1561 
1562 	if (lt == BOOL && is_scalar(rt))	/* C99 6.3.1.2 */
1563 		return true;
1564 
1565 	if (is_arithmetic(lt) && (is_arithmetic(rt) || rt == BOOL))
1566 		return true;
1567 
1568 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION))
1569 		/* both are struct or union */
1570 		return ltp->t_str == rtp->t_str;
1571 
1572 	/* a null pointer may be assigned to any pointer */
1573 	if (lt == PTR && is_null_pointer(rn))
1574 		return true;
1575 
1576 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID)) {
1577 		/* two pointers, at least one pointer to void */
1578 		if (sflag && (lst == FUNC || rst == FUNC)) {
1579 			/* comb. of ptr to func and ptr to void */
1580 			*(lst == FUNC ? &lts : &rts) = "function pointer";
1581 			*(lst == VOID ? &lts : &rts) = "'void *'";
1582 			switch (op) {
1583 			case INIT:
1584 			case RETURN:
1585 				/* ANSI C forbids conversion of %s to %s */
1586 				warning(303, rts, lts);
1587 				break;
1588 			case FARG:
1589 				/* ANSI C forbids conv. of %s to %s, arg #%d */
1590 				warning(304, rts, lts, arg);
1591 				break;
1592 			default:
1593 				/* ANSI C forbids conv. of %s to %s, op %s */
1594 				warning(305, rts, lts, mp->m_name);
1595 				break;
1596 			}
1597 		}
1598 	}
1599 
1600 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID ||
1601 				       eqtype(lstp, rstp, true, false, NULL))) {
1602 		/* compatible pointer types (qualifiers ignored) */
1603 		if (!tflag &&
1604 		    ((!lstp->t_const && rstp->t_const) ||
1605 		     (!lstp->t_volatile && rstp->t_volatile))) {
1606 			/* left side has not all qualifiers of right */
1607 			switch (op) {
1608 			case INIT:
1609 			case RETURN:
1610 				/* incompatible pointer types (%s != %s) */
1611 				warning(182, type_name(lstp), type_name(rstp));
1612 				break;
1613 			case FARG:
1614 				/* converting '%s' to incompatible '%s' ... */
1615 				warning(153,
1616 				    type_name(rtp), type_name(ltp), arg);
1617 				break;
1618 			default:
1619 				/* operands have incompatible pointer type... */
1620 				warning(128, mp->m_name,
1621 				    type_name(lstp), type_name(rstp));
1622 				break;
1623 			}
1624 		}
1625 		return true;
1626 	}
1627 
1628 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1629 		const char *lx = lt == PTR ? "pointer" : "integer";
1630 		const char *rx = rt == PTR ? "pointer" : "integer";
1631 
1632 		switch (op) {
1633 		case INIT:
1634 		case RETURN:
1635 			/* illegal combination of %s (%s) and %s (%s) */
1636 			warning(183, lx, type_name(ltp), rx, type_name(rtp));
1637 			break;
1638 		case FARG:
1639 			/* illegal comb. of %s (%s) and %s (%s), arg #%d */
1640 			warning(154,
1641 			    lx, type_name(ltp), rx, type_name(rtp), arg);
1642 			break;
1643 		default:
1644 			/* illegal combination of %s (%s) and %s (%s), op %s */
1645 			warning(123,
1646 			    lx, type_name(ltp), rx, type_name(rtp), mp->m_name);
1647 			break;
1648 		}
1649 		return true;
1650 	}
1651 
1652 	if (lt == PTR && rt == PTR) {
1653 		switch (op) {
1654 		case INIT:
1655 		case RETURN:
1656 			warn_incompatible_pointers(NULL, ltp, rtp);
1657 			break;
1658 		case FARG:
1659 			/* converting '%s' to incompatible '%s' for ... */
1660 			warning(153, type_name(rtp), type_name(ltp), arg);
1661 			break;
1662 		default:
1663 			warn_incompatible_pointers(mp, ltp, rtp);
1664 			break;
1665 		}
1666 		return true;
1667 	}
1668 
1669 	switch (op) {
1670 	case INIT:
1671 		/* cannot initialize '%s' from '%s' */
1672 		error(185, type_name(ltp), type_name(rtp));
1673 		break;
1674 	case RETURN:
1675 		/* return value type mismatch (%s) and (%s) */
1676 		error(211, type_name(ltp), type_name(rtp));
1677 		break;
1678 	case FARG:
1679 		/* argument is incompatible with prototype, arg #%d */
1680 		warning(155, arg);
1681 		break;
1682 	default:
1683 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1684 		break;
1685 	}
1686 
1687 	return false;
1688 }
1689 
1690 /* Prints a warning if a strange operator is used on an enum type. */
1691 static void
1692 check_bad_enum_operation(op_t op, const tnode_t *ln, const tnode_t *rn)
1693 {
1694 
1695 	if (!eflag)
1696 		return;
1697 
1698 	if (!(ln->tn_type->t_is_enum ||
1699 	      (modtab[op].m_binary && rn->tn_type->t_is_enum))) {
1700 		return;
1701 	}
1702 
1703 	/*
1704 	 * Enum as offset to a pointer is an exception (otherwise enums
1705 	 * could not be used as array indices).
1706 	 */
1707 	if (op == PLUS &&
1708 	    ((ln->tn_type->t_is_enum && rn->tn_type->t_tspec == PTR) ||
1709 	     (rn->tn_type->t_is_enum && ln->tn_type->t_tspec == PTR))) {
1710 		return;
1711 	}
1712 
1713 	/* dubious operation on enum, op %s */
1714 	warning(241, op_name(op));
1715 
1716 }
1717 
1718 /*
1719  * Prints a warning if an operator is applied to two different enum types.
1720  */
1721 static void
1722 check_enum_type_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1723 {
1724 	const mod_t *mp;
1725 
1726 	mp = &modtab[op];
1727 
1728 	if (ln->tn_type->t_enum != rn->tn_type->t_enum) {
1729 		switch (op) {
1730 		case INIT:
1731 			/* enum type mismatch between '%s' and '%s' in ... */
1732 			warning(210,
1733 			    type_name(ln->tn_type), type_name(rn->tn_type));
1734 			break;
1735 		case FARG:
1736 			/* enum type mismatch, arg #%d (%s != %s) */
1737 			warning(156, arg,
1738 			    type_name(ln->tn_type), type_name(rn->tn_type));
1739 			break;
1740 		case RETURN:
1741 			/* return value type mismatch (%s) and (%s) */
1742 			warning(211,
1743 			    type_name(ln->tn_type), type_name(rn->tn_type));
1744 			break;
1745 		default:
1746 			/* enum type mismatch: '%s' '%s' '%s' */
1747 			warning(130, type_name(ln->tn_type), mp->m_name,
1748 			    type_name(rn->tn_type));
1749 			break;
1750 		}
1751 	} else if (Pflag && mp->m_comparison && op != EQ && op != NE) {
1752 		if (eflag)
1753 			/* dubious comparison of enums, op %s */
1754 			warning(243, mp->m_name);
1755 	}
1756 }
1757 
1758 /* Prints a warning if the operands mix between enum and integer. */
1759 static void
1760 check_enum_int_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1761 {
1762 
1763 	if (!eflag)
1764 		return;
1765 
1766 	switch (op) {
1767 	case INIT:
1768 		/*
1769 		 * Initialization with 0 is allowed. Otherwise, all implicit
1770 		 * initializations would need to be warned upon as well.
1771 		 */
1772 		if (!rn->tn_type->t_is_enum && rn->tn_op == CON &&
1773 		    is_integer(rn->tn_type->t_tspec) &&
1774 		    rn->tn_val->v_quad == 0) {
1775 			return;
1776 		}
1777 		/* initialization of '%s' with '%s' */
1778 		warning(277, type_name(ln->tn_type), type_name(rn->tn_type));
1779 		break;
1780 	case FARG:
1781 		/* combination of '%s' and '%s', arg #%d */
1782 		warning(278,
1783 		    type_name(ln->tn_type), type_name(rn->tn_type), arg);
1784 		break;
1785 	case RETURN:
1786 		/* combination of '%s' and '%s' in return */
1787 		warning(279, type_name(ln->tn_type), type_name(rn->tn_type));
1788 		break;
1789 	default:
1790 		/* combination of '%s' and '%s', op %s */
1791 		warning(242, type_name(ln->tn_type), type_name(rn->tn_type),
1792 		    op_name(op));
1793 		break;
1794 	}
1795 }
1796 
1797 /*
1798  * Build and initialize a new node.
1799  */
1800 static tnode_t *
1801 new_tnode(op_t op, type_t *type, tnode_t *ln, tnode_t *rn)
1802 {
1803 	tnode_t	*ntn;
1804 	tspec_t	t;
1805 #ifdef notyet
1806 	size_t l;
1807 	uint64_t rnum;
1808 #endif
1809 
1810 	ntn = expr_zalloc_tnode();
1811 
1812 	ntn->tn_op = op;
1813 	ntn->tn_type = type;
1814 	if (ln->tn_from_system_header)
1815 		ntn->tn_from_system_header = true;
1816 	if (rn != NULL && rn->tn_from_system_header)
1817 		ntn->tn_from_system_header = true;
1818 	ntn->tn_left = ln;
1819 	ntn->tn_right = rn;
1820 
1821 	switch (op) {
1822 #ifdef notyet
1823 	case SHR:
1824 		if (rn->tn_op != CON)
1825 			break;
1826 		rnum = rn->tn_val->v_quad;
1827 		l = type_size_in_bits(ln->tn_type) / CHAR_SIZE;
1828 		t = ln->tn_type->t_tspec;
1829 		switch (l) {
1830 		case 8:
1831 			if (rnum >= 56)
1832 				t = UCHAR;
1833 			else if (rnum >= 48)
1834 				t = USHORT;
1835 			else if (rnum >= 32)
1836 				t = UINT;
1837 			break;
1838 		case 4:
1839 			if (rnum >= 24)
1840 				t = UCHAR;
1841 			else if (rnum >= 16)
1842 				t = USHORT;
1843 			break;
1844 		case 2:
1845 			if (rnum >= 8)
1846 				t = UCHAR;
1847 			break;
1848 		default:
1849 			break;
1850 		}
1851 		if (t != ln->tn_type->t_tspec)
1852 			ntn->tn_type->t_tspec = t;
1853 		break;
1854 #endif
1855 	case INDIR:
1856 	case FSEL:
1857 		lint_assert(ln->tn_type->t_tspec == PTR);
1858 		t = ln->tn_type->t_subt->t_tspec;
1859 		if (t != FUNC && t != VOID)
1860 			ntn->tn_lvalue = true;
1861 		break;
1862 	default:
1863 		break;
1864 	}
1865 
1866 	return ntn;
1867 }
1868 
1869 /*
1870  * Performs the "integer promotions" (C99 6.3.1.1p2), which convert small
1871  * integer types to either int or unsigned int.
1872  *
1873  * If tflag is set or the operand is a function argument with no type
1874  * information (no prototype or variable # of args), converts float to double.
1875  */
1876 tnode_t *
1877 promote(op_t op, bool farg, tnode_t *tn)
1878 {
1879 	tspec_t	t;
1880 	type_t	*ntp;
1881 	u_int	len;
1882 
1883 	t = tn->tn_type->t_tspec;
1884 
1885 	if (!is_arithmetic(t))
1886 		return tn;
1887 
1888 	if (!tflag) {
1889 		/*
1890 		 * ANSI C requires that the result is always of type INT
1891 		 * if INT can represent all possible values of the previous
1892 		 * type.
1893 		 */
1894 		if (tn->tn_type->t_bitfield) {
1895 			len = tn->tn_type->t_flen;
1896 			if (size_in_bits(INT) > len) {
1897 				t = INT;
1898 			} else {
1899 				lint_assert(len == size_in_bits(INT));
1900 				if (is_uinteger(t)) {
1901 					t = UINT;
1902 				} else {
1903 					t = INT;
1904 				}
1905 			}
1906 		} else if (t == CHAR || t == UCHAR || t == SCHAR) {
1907 			t = (size_in_bits(CHAR) < size_in_bits(INT)
1908 			     || t != UCHAR) ? INT : UINT;
1909 		} else if (t == SHORT || t == USHORT) {
1910 			t = (size_in_bits(SHORT) < size_in_bits(INT)
1911 			     || t == SHORT) ? INT : UINT;
1912 		} else if (t == ENUM) {
1913 			t = INT;
1914 		} else if (farg && t == FLOAT) {
1915 			t = DOUBLE;
1916 		}
1917 	} else {
1918 		/*
1919 		 * In traditional C, keep unsigned and promote FLOAT
1920 		 * to DOUBLE.
1921 		 */
1922 		if (t == UCHAR || t == USHORT) {
1923 			t = UINT;
1924 		} else if (t == CHAR || t == SCHAR || t == SHORT) {
1925 			t = INT;
1926 		} else if (t == FLOAT) {
1927 			t = DOUBLE;
1928 		} else if (t == ENUM) {
1929 			t = INT;
1930 		}
1931 	}
1932 
1933 	if (t != tn->tn_type->t_tspec) {
1934 		ntp = expr_dup_type(tn->tn_type);
1935 		ntp->t_tspec = t;
1936 		/*
1937 		 * Keep t_is_enum so we are later able to check compatibility
1938 		 * of enum types.
1939 		 */
1940 		tn = convert(op, 0, ntp, tn);
1941 	}
1942 
1943 	return tn;
1944 }
1945 
1946 /*
1947  * Apply the "usual arithmetic conversions" (C99 6.3.1.8).
1948  *
1949  * This gives both operands the same type.
1950  * This is done in different ways for traditional C and C90.
1951  */
1952 static void
1953 balance(op_t op, tnode_t **lnp, tnode_t **rnp)
1954 {
1955 	tspec_t	lt, rt, t;
1956 	int	i;
1957 	bool	u;
1958 	type_t	*ntp;
1959 	static const tspec_t tl[] = {
1960 		LDOUBLE, DOUBLE, FLOAT, UQUAD, QUAD, ULONG, LONG, UINT, INT,
1961 	};
1962 
1963 	lt = (*lnp)->tn_type->t_tspec;
1964 	rt = (*rnp)->tn_type->t_tspec;
1965 
1966 	if (!is_arithmetic(lt) || !is_arithmetic(rt))
1967 		return;
1968 
1969 	if (!tflag) {
1970 		if (lt == rt) {
1971 			t = lt;
1972 		} else if (lt == LCOMPLEX || rt == LCOMPLEX) {
1973 			t = LCOMPLEX;
1974 		} else if (lt == DCOMPLEX || rt == DCOMPLEX) {
1975 			t = DCOMPLEX;
1976 		} else if (lt == COMPLEX || rt == COMPLEX) {
1977 			t = COMPLEX;
1978 		} else if (lt == FCOMPLEX || rt == FCOMPLEX) {
1979 			t = FCOMPLEX;
1980 		} else if (lt == LDOUBLE || rt == LDOUBLE) {
1981 			t = LDOUBLE;
1982 		} else if (lt == DOUBLE || rt == DOUBLE) {
1983 			t = DOUBLE;
1984 		} else if (lt == FLOAT || rt == FLOAT) {
1985 			t = FLOAT;
1986 		} else {
1987 			/*
1988 			 * If type A has more bits than type B it should
1989 			 * be able to hold all possible values of type B.
1990 			 */
1991 			if (size_in_bits(lt) > size_in_bits(rt)) {
1992 				t = lt;
1993 			} else if (size_in_bits(lt) < size_in_bits(rt)) {
1994 				t = rt;
1995 			} else {
1996 				for (i = 3; tl[i] != INT; i++) {
1997 					if (tl[i] == lt || tl[i] == rt)
1998 						break;
1999 				}
2000 				if ((is_uinteger(lt) || is_uinteger(rt)) &&
2001 				    !is_uinteger(tl[i])) {
2002 					i--;
2003 				}
2004 				t = tl[i];
2005 			}
2006 		}
2007 	} else {
2008 		/* Keep unsigned in traditional C */
2009 		u = is_uinteger(lt) || is_uinteger(rt);
2010 		for (i = 0; tl[i] != INT; i++) {
2011 			if (lt == tl[i] || rt == tl[i])
2012 				break;
2013 		}
2014 		t = tl[i];
2015 		if (u && is_integer(t) && !is_uinteger(t))
2016 			t = unsigned_type(t);
2017 	}
2018 
2019 	if (t != lt) {
2020 		ntp = expr_dup_type((*lnp)->tn_type);
2021 		ntp->t_tspec = t;
2022 		*lnp = convert(op, 0, ntp, *lnp);
2023 	}
2024 	if (t != rt) {
2025 		ntp = expr_dup_type((*rnp)->tn_type);
2026 		ntp->t_tspec = t;
2027 		*rnp = convert(op, 0, ntp, *rnp);
2028 	}
2029 }
2030 
2031 /*
2032  * Insert a conversion operator, which converts the type of the node
2033  * to another given type.
2034  * If op is FARG, arg is the number of the argument (used for warnings).
2035  */
2036 tnode_t *
2037 convert(op_t op, int arg, type_t *tp, tnode_t *tn)
2038 {
2039 	tnode_t	*ntn;
2040 	tspec_t	nt, ot;
2041 
2042 	nt = tp->t_tspec;
2043 	ot = tn->tn_type->t_tspec;
2044 
2045 	if (!tflag && !sflag && op == FARG)
2046 		check_prototype_conversion(arg, nt, ot, tp, tn);
2047 	if (is_integer(nt) && is_integer(ot)) {
2048 		check_integer_conversion(op, arg, nt, ot, tp, tn);
2049 	} else if (nt == PTR && is_null_pointer(tn)) {
2050 		/* a null pointer may be assigned to any pointer. */
2051 	} else if (is_integer(nt) && nt != BOOL && ot == PTR) {
2052 		check_pointer_integer_conversion(op, nt, tp, tn);
2053 	} else if (nt == PTR && ot == PTR) {
2054 		check_pointer_conversion(op, tn, tp);
2055 	}
2056 
2057 	ntn = expr_zalloc_tnode();
2058 	ntn->tn_op = CVT;
2059 	ntn->tn_type = tp;
2060 	ntn->tn_cast = op == CVT;
2061 	ntn->tn_from_system_header |= tn->tn_from_system_header;
2062 	ntn->tn_right = NULL;
2063 	if (tn->tn_op != CON || nt == VOID) {
2064 		ntn->tn_left = tn;
2065 	} else {
2066 		ntn->tn_op = CON;
2067 		ntn->tn_val = expr_zalloc(sizeof(*ntn->tn_val));
2068 		convert_constant(op, arg, ntn->tn_type, ntn->tn_val,
2069 		    tn->tn_val);
2070 	}
2071 
2072 	return ntn;
2073 }
2074 
2075 /*
2076  * Print a warning if a prototype causes a type conversion that is
2077  * different from what would happen to the same argument in the
2078  * absence of a prototype.
2079  *
2080  * Errors/warnings about illegal type combinations are already printed
2081  * in check_assign_types_compatible().
2082  */
2083 static void
2084 check_prototype_conversion(int arg, tspec_t nt, tspec_t ot, type_t *tp,
2085 			   tnode_t *tn)
2086 {
2087 	tnode_t	*ptn;
2088 
2089 	if (!is_arithmetic(nt) || !is_arithmetic(ot))
2090 		return;
2091 
2092 	/*
2093 	 * If the type of the formal parameter is char/short, a warning
2094 	 * would be useless, because functions declared the old style
2095 	 * can't expect char/short arguments.
2096 	 */
2097 	/* XXX: what about SCHAR? */
2098 	if (nt == CHAR || nt == UCHAR || nt == SHORT || nt == USHORT)
2099 		return;
2100 
2101 	/* get default promotion */
2102 	ptn = promote(NOOP, true, tn);
2103 	ot = ptn->tn_type->t_tspec;
2104 
2105 	/* return if types are the same with and without prototype */
2106 	if (nt == ot || (nt == ENUM && ot == INT))
2107 		return;
2108 
2109 	if (is_floating(nt) != is_floating(ot) ||
2110 	    portable_size_in_bits(nt) != portable_size_in_bits(ot)) {
2111 		/* representation and/or width change */
2112 		if (!is_integer(ot) ||
2113 		    portable_size_in_bits(ot) > portable_size_in_bits(INT)) {
2114 			/* argument #%d is converted from '%s' to '%s' ... */
2115 			warning(259,
2116 			    arg, type_name(tn->tn_type), type_name(tp));
2117 		}
2118 	} else if (hflag) {
2119 		/*
2120 		 * they differ in sign or base type (char, short, int,
2121 		 * long, long long, float, double, long double)
2122 		 *
2123 		 * if they differ only in sign and the argument is a constant
2124 		 * and the msb of the argument is not set, print no warning
2125 		 */
2126 		if (ptn->tn_op == CON && is_integer(nt) &&
2127 		    signed_type(nt) == signed_type(ot) &&
2128 		    msb(ptn->tn_val->v_quad, ot, -1) == 0) {
2129 			/* ok */
2130 		} else {
2131 			/* argument #%d is converted from '%s' to '%s' ... */
2132 			warning(259,
2133 			    arg, type_name(tn->tn_type), type_name(tp));
2134 		}
2135 	}
2136 }
2137 
2138 /*
2139  * Print warnings for conversions of integer types which may cause problems.
2140  */
2141 /* ARGSUSED */
2142 static void
2143 check_integer_conversion(op_t op, int arg, tspec_t nt, tspec_t ot, type_t *tp,
2144 			 tnode_t *tn)
2145 {
2146 	char opbuf[16];
2147 
2148 	if (tn->tn_op == CON)
2149 		return;
2150 
2151 	if (op == CVT)
2152 		return;
2153 
2154 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
2155 	    is_uinteger(nt) != is_uinteger(ot)) {
2156 		if (aflag > 0 && pflag) {
2157 			if (op == FARG) {
2158 				/* conversion to '%s' may sign-extend ... */
2159 				warning(297, type_name(tp), arg);
2160 			} else {
2161 				/* conversion to '%s' may sign-extend ... */
2162 				warning(131, type_name(tp));
2163 			}
2164 		}
2165 	}
2166 
2167 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot)) {
2168 		switch (tn->tn_op) {
2169 		case PLUS:
2170 		case MINUS:
2171 		case MULT:
2172 		case SHL:
2173 			/* suggest cast from '%s' to '%s' on op %s to ... */
2174 			warning(324, type_name(gettyp(ot)), type_name(tp),
2175 			    print_tnode(opbuf, sizeof(opbuf), tn));
2176 			break;
2177 		default:
2178 			break;
2179 		}
2180 	}
2181 
2182 	if (portable_size_in_bits(nt) < portable_size_in_bits(ot) &&
2183 	    (ot == LONG || ot == ULONG || ot == QUAD || ot == UQUAD ||
2184 	     aflag > 1)) {
2185 		/* conversion from '%s' may lose accuracy */
2186 		if (aflag > 0) {
2187 			if (op == FARG) {
2188 				/* conv. from '%s' to '%s' may lose ... */
2189 				warning(298,
2190 				    type_name(tn->tn_type), type_name(tp), arg);
2191 			} else {
2192 				/* conv. from '%s' to '%s' may lose accuracy */
2193 				warning(132,
2194 				    type_name(tn->tn_type), type_name(tp));
2195 			}
2196 		}
2197 	}
2198 }
2199 
2200 /*
2201  * Print warnings for dubious conversions of pointer to integer.
2202  */
2203 static void
2204 check_pointer_integer_conversion(op_t op, tspec_t nt, type_t *tp, tnode_t *tn)
2205 {
2206 
2207 	if (tn->tn_op == CON)
2208 		return;
2209 	if (op != CVT)
2210 		return;		/* We got already an error. */
2211 	if (portable_size_in_bits(nt) >= portable_size_in_bits(PTR))
2212 		return;
2213 
2214 	if (pflag && size_in_bits(nt) >= size_in_bits(PTR)) {
2215 		/* conversion of pointer to '%s' may lose bits */
2216 		warning(134, type_name(tp));
2217 	} else {
2218 		/* conversion of pointer to '%s' loses bits */
2219 		warning(133, type_name(tp));
2220 	}
2221 }
2222 
2223 static bool
2224 should_warn_about_pointer_cast(const type_t *tp, tspec_t nst,
2225 			       const tnode_t *tn, tspec_t ost)
2226 {
2227 	if (nst == STRUCT || nst == UNION)
2228 		if (tp->t_subt->t_str != tn->tn_type->t_subt->t_str)
2229 			return true;
2230 
2231 	if (nst == CHAR || nst == UCHAR)
2232 		return false;	/* for the sake of traditional C code */
2233 
2234 	return portable_size_in_bits(nst) != portable_size_in_bits(ost);
2235 }
2236 
2237 /*
2238  * Warn about questionable pointer conversions.
2239  */
2240 static void
2241 check_pointer_conversion(op_t op, tnode_t *tn, type_t *tp)
2242 {
2243 	tspec_t nst, ost;
2244 	const char *nts, *ots;
2245 
2246 	/*
2247 	 * We got already an error (pointers of different types
2248 	 * without a cast) or we will not get a warning.
2249 	 */
2250 	if (op != CVT)
2251 		return;
2252 
2253 	nst = tp->t_subt->t_tspec;
2254 	ost = tn->tn_type->t_subt->t_tspec;
2255 
2256 	if (nst == VOID || ost == VOID) {
2257 		if (sflag && (nst == FUNC || ost == FUNC)) {
2258 			/* null pointers are already handled in convert() */
2259 			*(nst == FUNC ? &nts : &ots) = "function pointer";
2260 			*(nst == VOID ? &nts : &ots) = "'void *'";
2261 			/* ANSI C forbids conversion of %s to %s */
2262 			warning(303, ots, nts);
2263 		}
2264 		return;
2265 	} else if (nst == FUNC && ost == FUNC) {
2266 		return;
2267 	} else if (nst == FUNC || ost == FUNC) {
2268 		/* converting '%s' to '%s' is questionable */
2269 		warning(229, type_name(tn->tn_type), type_name(tp));
2270 		return;
2271 	}
2272 
2273 	if (hflag && alignment_in_bits(tp->t_subt) >
2274 		     alignment_in_bits(tn->tn_type->t_subt)) {
2275 		/* converting '%s' to '%s' may cause alignment problem */
2276 		warning(135, type_name(tn->tn_type), type_name(tp));
2277 	}
2278 
2279 	if (cflag && should_warn_about_pointer_cast(tp, nst, tn, ost)) {
2280 		/* pointer cast from '%s' to '%s' may be troublesome */
2281 		warning(247, type_name(tn->tn_type), type_name(tp));
2282 	}
2283 }
2284 
2285 /*
2286  * Converts a typed constant to a constant of another type.
2287  *
2288  * op		operator which requires conversion
2289  * arg		if op is FARG, # of argument
2290  * tp		type in which to convert the constant
2291  * nv		new constant
2292  * v		old constant
2293  */
2294 void
2295 convert_constant(op_t op, int arg, const type_t *tp, val_t *nv, val_t *v)
2296 {
2297 	tspec_t	ot, nt;
2298 	ldbl_t	max = 0.0, min = 0.0;
2299 	int	sz;
2300 	bool	rchk;
2301 	int64_t	xmask, xmsk1;
2302 	int	osz, nsz;
2303 
2304 	ot = v->v_tspec;
2305 	nt = nv->v_tspec = tp->t_tspec;
2306 	rchk = false;
2307 
2308 	if (nt == BOOL) {	/* C99 6.3.1.2 */
2309 		nv->v_ansiu = false;
2310 		nv->v_quad = is_nonzero_val(v) ? 1 : 0;
2311 		return;
2312 	}
2313 
2314 	if (ot == FLOAT || ot == DOUBLE || ot == LDOUBLE) {
2315 		switch (nt) {
2316 		case CHAR:
2317 			max = TARG_CHAR_MAX;	min = TARG_CHAR_MIN;	break;
2318 		case UCHAR:
2319 			max = TARG_UCHAR_MAX;	min = 0;		break;
2320 		case SCHAR:
2321 			max = TARG_SCHAR_MAX;	min = TARG_SCHAR_MIN;	break;
2322 		case SHORT:
2323 			max = TARG_SHRT_MAX;	min = TARG_SHRT_MIN;	break;
2324 		case USHORT:
2325 			max = TARG_USHRT_MAX;	min = 0;		break;
2326 		case ENUM:
2327 		case INT:
2328 			max = TARG_INT_MAX;	min = TARG_INT_MIN;	break;
2329 		case UINT:
2330 			max = (u_int)TARG_UINT_MAX;min = 0;		break;
2331 		case LONG:
2332 			max = TARG_LONG_MAX;	min = TARG_LONG_MIN;	break;
2333 		case ULONG:
2334 			max = (u_long)TARG_ULONG_MAX; min = 0;		break;
2335 		case QUAD:
2336 			max = QUAD_MAX;		min = QUAD_MIN;		break;
2337 		case UQUAD:
2338 			max = (uint64_t)UQUAD_MAX; min = 0;		break;
2339 		case FLOAT:
2340 		case FCOMPLEX:
2341 			max = FLT_MAX;		min = -FLT_MAX;		break;
2342 		case DOUBLE:
2343 		case DCOMPLEX:
2344 			max = DBL_MAX;		min = -DBL_MAX;		break;
2345 		case PTR:
2346 			/* Got already an error because of float --> ptr */
2347 		case LDOUBLE:
2348 		case LCOMPLEX:
2349 			max = LDBL_MAX;		min = -LDBL_MAX;	break;
2350 		default:
2351 			lint_assert(/*CONSTCOND*/false);
2352 		}
2353 		if (v->v_ldbl > max || v->v_ldbl < min) {
2354 			lint_assert(nt != LDOUBLE);
2355 			if (op == FARG) {
2356 				/* conv. of '%s' to '%s' is out of range, ... */
2357 				warning(295,
2358 				    type_name(gettyp(ot)), type_name(tp), arg);
2359 			} else {
2360 				/* conversion of '%s' to '%s' is out of range */
2361 				warning(119,
2362 				    type_name(gettyp(ot)), type_name(tp));
2363 			}
2364 			v->v_ldbl = v->v_ldbl > 0 ? max : min;
2365 		}
2366 		if (nt == FLOAT) {
2367 			nv->v_ldbl = (float)v->v_ldbl;
2368 		} else if (nt == DOUBLE) {
2369 			nv->v_ldbl = (double)v->v_ldbl;
2370 		} else if (nt == LDOUBLE) {
2371 			nv->v_ldbl = v->v_ldbl;
2372 		} else {
2373 			nv->v_quad = (nt == PTR || is_uinteger(nt)) ?
2374 				(int64_t)v->v_ldbl : (int64_t)v->v_ldbl;
2375 		}
2376 	} else {
2377 		if (nt == FLOAT) {
2378 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2379 			       (float)(uint64_t)v->v_quad : (float)v->v_quad;
2380 		} else if (nt == DOUBLE) {
2381 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2382 			       (double)(uint64_t)v->v_quad : (double)v->v_quad;
2383 		} else if (nt == LDOUBLE) {
2384 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2385 			       (ldbl_t)(uint64_t)v->v_quad : (ldbl_t)v->v_quad;
2386 		} else {
2387 			rchk = true;		/* Check for lost precision. */
2388 			nv->v_quad = v->v_quad;
2389 		}
2390 	}
2391 
2392 	if (v->v_ansiu && is_floating(nt)) {
2393 		/* ANSI C treats constant as unsigned */
2394 		warning(157);
2395 		v->v_ansiu = false;
2396 	} else if (v->v_ansiu && (is_integer(nt) && !is_uinteger(nt) &&
2397 				  portable_size_in_bits(nt) >
2398 				  portable_size_in_bits(ot))) {
2399 		/* ANSI C treats constant as unsigned */
2400 		warning(157);
2401 		v->v_ansiu = false;
2402 	}
2403 
2404 	switch (nt) {
2405 	case FLOAT:
2406 	case FCOMPLEX:
2407 	case DOUBLE:
2408 	case DCOMPLEX:
2409 	case LDOUBLE:
2410 	case LCOMPLEX:
2411 		break;
2412 	default:
2413 		sz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2414 		nv->v_quad = xsign(nv->v_quad, nt, sz);
2415 		break;
2416 	}
2417 
2418 	if (rchk && op != CVT) {
2419 		osz = size_in_bits(ot);
2420 		nsz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2421 		xmask = qlmasks[nsz] ^ qlmasks[osz];
2422 		xmsk1 = qlmasks[nsz] ^ qlmasks[osz - 1];
2423 		/*
2424 		 * For bitwise operations we are not interested in the
2425 		 * value, but in the bits itself.
2426 		 */
2427 		if (op == ORASS || op == BITOR || op == BITXOR) {
2428 			/*
2429 			 * Print a warning if bits which were set are
2430 			 * lost due to the conversion.
2431 			 * This can happen with operator ORASS only.
2432 			 */
2433 			if (nsz < osz && (v->v_quad & xmask) != 0) {
2434 				/* constant truncated by conv., op %s */
2435 				warning(306, op_name(op));
2436 			}
2437 		} else if (op == ANDASS || op == BITAND) {
2438 			/*
2439 			 * Print a warning if additional bits are not all 1
2440 			 * and the most significant bit of the old value is 1,
2441 			 * or if at least one (but not all) removed bit was 0.
2442 			 */
2443 			if (nsz > osz &&
2444 			    (nv->v_quad & qbmasks[osz - 1]) != 0 &&
2445 			    (nv->v_quad & xmask) != xmask) {
2446 				/* extra bits set to 0 in conv. of '%s' ... */
2447 				warning(309, type_name(gettyp(ot)),
2448 				    type_name(tp), op_name(op));
2449 			} else if (nsz < osz &&
2450 				   (v->v_quad & xmask) != xmask &&
2451 				   (v->v_quad & xmask) != 0) {
2452 				/* constant truncated by conv., op %s */
2453 				warning(306, op_name(op));
2454 			}
2455 		} else if ((nt != PTR && is_uinteger(nt)) &&
2456 			   (ot != PTR && !is_uinteger(ot)) &&
2457 			   v->v_quad < 0) {
2458 			if (op == ASSIGN) {
2459 				/* assignment of negative constant to ... */
2460 				warning(164);
2461 			} else if (op == INIT) {
2462 				/* initialization of unsigned with neg... */
2463 				warning(221);
2464 			} else if (op == FARG) {
2465 				/* conversion of negative constant to ... */
2466 				warning(296, arg);
2467 			} else if (modtab[op].m_comparison) {
2468 				/* handled by check_integer_comparison() */
2469 			} else {
2470 				/* conversion of negative constant to ... */
2471 				warning(222);
2472 			}
2473 		} else if (nv->v_quad != v->v_quad && nsz <= osz &&
2474 			   (v->v_quad & xmask) != 0 &&
2475 			   (is_uinteger(ot) || (v->v_quad & xmsk1) != xmsk1)) {
2476 			/*
2477 			 * Loss of significant bit(s). All truncated bits
2478 			 * of unsigned types or all truncated bits plus the
2479 			 * msb of the target for signed types are considered
2480 			 * to be significant bits. Loss of significant bits
2481 			 * means that at least on of the bits was set in an
2482 			 * unsigned type or that at least one, but not all of
2483 			 * the bits was set in an signed type.
2484 			 * Loss of significant bits means that it is not
2485 			 * possible, also not with necessary casts, to convert
2486 			 * back to the original type. A example for a
2487 			 * necessary cast is:
2488 			 *	char c;	int	i; c = 128;
2489 			 *	i = c;			** yields -128 **
2490 			 *	i = (unsigned char)c;	** yields 128 **
2491 			 */
2492 			if (op == ASSIGN && tp->t_bitfield) {
2493 				/* precision lost in bit-field assignment */
2494 				warning(166);
2495 			} else if (op == ASSIGN) {
2496 				/* constant truncated by assignment */
2497 				warning(165);
2498 			} else if (op == INIT && tp->t_bitfield) {
2499 				/* bit-field initializer does not fit */
2500 				warning(180);
2501 			} else if (op == INIT) {
2502 				/* initializer does not fit */
2503 				warning(178);
2504 			} else if (op == CASE) {
2505 				/* case label affected by conversion */
2506 				warning(196);
2507 			} else if (op == FARG) {
2508 				/* conv. of '%s' to '%s' is out of range, ... */
2509 				warning(295,
2510 				    type_name(gettyp(ot)), type_name(tp), arg);
2511 			} else {
2512 				/* conversion of '%s' to '%s' is out of range */
2513 				warning(119,
2514 				    type_name(gettyp(ot)), type_name(tp));
2515 			}
2516 		} else if (nv->v_quad != v->v_quad) {
2517 			if (op == ASSIGN && tp->t_bitfield) {
2518 				/* precision lost in bit-field assignment */
2519 				warning(166);
2520 			} else if (op == INIT && tp->t_bitfield) {
2521 				/* bit-field initializer out of range */
2522 				warning(11);
2523 			} else if (op == CASE) {
2524 				/* case label affected by conversion */
2525 				warning(196);
2526 			} else if (op == FARG) {
2527 				/* conv. of '%s' to '%s' is out of range, ... */
2528 				warning(295,
2529 				    type_name(gettyp(ot)), type_name(tp), arg);
2530 			} else {
2531 				/* conversion of '%s' to '%s' is out of range */
2532 				warning(119,
2533 				    type_name(gettyp(ot)), type_name(tp));
2534 			}
2535 		}
2536 	}
2537 }
2538 
2539 /*
2540  * Called if incompatible types were detected.
2541  * Prints a appropriate warning.
2542  */
2543 static void
2544 warn_incompatible_types(op_t op,
2545 			const type_t *ltp, tspec_t lt,
2546 			const type_t *rtp, tspec_t rt)
2547 {
2548 	const mod_t *mp;
2549 
2550 	mp = &modtab[op];
2551 
2552 	if (lt == VOID || (mp->m_binary && rt == VOID)) {
2553 		/* void type illegal in expression */
2554 		error(109);
2555 	} else if (op == ASSIGN) {
2556 		if ((lt == STRUCT || lt == UNION) &&
2557 		    (rt == STRUCT || rt == UNION)) {
2558 			/* assignment of different structures (%s != %s) */
2559 			error(240, tspec_name(lt), tspec_name(rt));
2560 		} else {
2561 			/* cannot assign to '%s' from '%s' */
2562 			error(171, type_name(ltp), type_name(rtp));
2563 		}
2564 	} else if (mp->m_binary) {
2565 		/* operands of '%s' have incompatible types (%s != %s) */
2566 		error(107, mp->m_name, tspec_name(lt), tspec_name(rt));
2567 	} else {
2568 		lint_assert(rt == NOTSPEC);
2569 		/* operand of '%s' has invalid type (%s) */
2570 		error(108, mp->m_name, tspec_name(lt));
2571 	}
2572 }
2573 
2574 /*
2575  * Called if incompatible pointer types are detected.
2576  * Print an appropriate warning.
2577  */
2578 static void
2579 warn_incompatible_pointers(const mod_t *mp,
2580 			   const type_t *ltp, const type_t *rtp)
2581 {
2582 	tspec_t	lt, rt;
2583 
2584 	lint_assert(ltp->t_tspec == PTR);
2585 	lint_assert(rtp->t_tspec == PTR);
2586 
2587 	lt = ltp->t_subt->t_tspec;
2588 	rt = rtp->t_subt->t_tspec;
2589 
2590 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION)) {
2591 		if (mp == NULL) {
2592 			/* illegal structure pointer combination */
2593 			warning(244);
2594 		} else {
2595 			/* incompatible structure pointers: '%s' '%s' '%s' */
2596 			warning(245, type_name(ltp), mp->m_name, type_name(rtp));
2597 		}
2598 	} else {
2599 		if (mp == NULL) {
2600 			/* illegal pointer combination */
2601 			warning(184);
2602 		} else {
2603 			/* illegal pointer combination (%s) and (%s), op %s */
2604 			warning(124,
2605 			    type_name(ltp), type_name(rtp), mp->m_name);
2606 		}
2607 	}
2608 }
2609 
2610 /* Return a type based on tp1, with added qualifiers from tp2. */
2611 static type_t *
2612 merge_qualifiers(type_t *tp1, const type_t *tp2)
2613 {
2614 	type_t *ntp, *nstp;
2615 
2616 	lint_assert(tp1->t_tspec == PTR);
2617 	lint_assert(tp2->t_tspec == PTR);
2618 
2619 	bool c1 = tp1->t_subt->t_const;
2620 	bool c2 = tp2->t_subt->t_const;
2621 	bool v1 = tp1->t_subt->t_volatile;
2622 	bool v2 = tp2->t_subt->t_volatile;
2623 
2624 	if (c1 == (c1 | c2) && v1 == (v1 | v2))
2625 		return tp1;
2626 
2627 	nstp = expr_dup_type(tp1->t_subt);
2628 	nstp->t_const |= c2;
2629 	nstp->t_volatile |= v2;
2630 
2631 	ntp = expr_dup_type(tp1);
2632 	ntp->t_subt = nstp;
2633 	return ntp;
2634 }
2635 
2636 /*
2637  * Returns true if the given structure or union has a constant member
2638  * (maybe recursively).
2639  */
2640 static bool
2641 has_constant_member(const type_t *tp)
2642 {
2643 	sym_t	*m;
2644 	tspec_t	t;
2645 
2646 	lint_assert((t = tp->t_tspec) == STRUCT || t == UNION);
2647 
2648 	for (m = tp->t_str->sou_first_member; m != NULL; m = m->s_next) {
2649 		tp = m->s_type;
2650 		if (tp->t_const)
2651 			return true;
2652 		if ((t = tp->t_tspec) == STRUCT || t == UNION) {
2653 			if (has_constant_member(m->s_type))
2654 				return true;
2655 		}
2656 	}
2657 	return false;
2658 }
2659 
2660 /*
2661  * Create a new node for one of the operators POINT and ARROW.
2662  */
2663 static tnode_t *
2664 build_struct_access(op_t op, tnode_t *ln, tnode_t *rn)
2665 {
2666 	tnode_t	*ntn, *ctn;
2667 	bool	nolval;
2668 
2669 	lint_assert(rn->tn_op == NAME);
2670 	lint_assert(rn->tn_sym->s_value.v_tspec == INT);
2671 	lint_assert(rn->tn_sym->s_scl == MOS || rn->tn_sym->s_scl == MOU);
2672 
2673 	/*
2674 	 * Remember if the left operand is an lvalue (structure members
2675 	 * are lvalues if and only if the structure itself is an lvalue).
2676 	 */
2677 	nolval = op == POINT && !ln->tn_lvalue;
2678 
2679 	if (op == POINT) {
2680 		ln = build_address(ln, true);
2681 	} else if (ln->tn_type->t_tspec != PTR) {
2682 		lint_assert(tflag);
2683 		lint_assert(is_integer(ln->tn_type->t_tspec));
2684 		ln = convert(NOOP, 0, expr_derive_type(gettyp(VOID), PTR), ln);
2685 	}
2686 
2687 	ctn = expr_new_integer_constant(PTRDIFF_TSPEC,
2688 	    rn->tn_sym->s_value.v_quad / CHAR_SIZE);
2689 
2690 	ntn = new_tnode(PLUS, expr_derive_type(rn->tn_type, PTR), ln, ctn);
2691 	if (ln->tn_op == CON)
2692 		ntn = fold(ntn);
2693 
2694 	if (rn->tn_type->t_bitfield) {
2695 		ntn = new_tnode(FSEL, ntn->tn_type->t_subt, ntn, NULL);
2696 	} else {
2697 		ntn = new_tnode(INDIR, ntn->tn_type->t_subt, ntn, NULL);
2698 	}
2699 
2700 	if (nolval)
2701 		ntn->tn_lvalue = false;
2702 
2703 	return ntn;
2704 }
2705 
2706 /*
2707  * Create a node for INCAFT, INCBEF, DECAFT and DECBEF.
2708  */
2709 static tnode_t *
2710 build_prepost_incdec(op_t op, tnode_t *ln)
2711 {
2712 	tnode_t	*cn, *ntn;
2713 
2714 	lint_assert(ln != NULL);
2715 
2716 	if (ln->tn_type->t_tspec == PTR) {
2717 		cn = plength(ln->tn_type);
2718 	} else {
2719 		cn = expr_new_integer_constant(INT, (int64_t)1);
2720 	}
2721 	ntn = new_tnode(op, ln->tn_type, ln, cn);
2722 
2723 	return ntn;
2724 }
2725 
2726 /*
2727  * Create a node for REAL, IMAG
2728  */
2729 static tnode_t *
2730 build_real_imag(op_t op, tnode_t *ln)
2731 {
2732 	tnode_t	*cn, *ntn;
2733 
2734 	lint_assert(ln != NULL);
2735 
2736 	switch (ln->tn_type->t_tspec) {
2737 	case LCOMPLEX:
2738 		/* XXX: integer and LDOUBLE don't match. */
2739 		cn = expr_new_integer_constant(LDOUBLE, (int64_t)1);
2740 		break;
2741 	case DCOMPLEX:
2742 		/* XXX: integer and DOUBLE don't match. */
2743 		cn = expr_new_integer_constant(DOUBLE, (int64_t)1);
2744 		break;
2745 	case FCOMPLEX:
2746 		/* XXX: integer and FLOAT don't match. */
2747 		cn = expr_new_integer_constant(FLOAT, (int64_t)1);
2748 		break;
2749 	default:
2750 		/* __%s__ is illegal for type %s */
2751 		error(276, op == REAL ? "real" : "imag",
2752 		    type_name(ln->tn_type));
2753 		return NULL;
2754 	}
2755 	ntn = new_tnode(op, cn->tn_type, ln, cn);
2756 	ntn->tn_lvalue = true;
2757 
2758 	return ntn;
2759 }
2760 /*
2761  * Create a tree node for the unary & operator
2762  */
2763 static tnode_t *
2764 build_address(tnode_t *tn, bool noign)
2765 {
2766 	tspec_t	t;
2767 
2768 	if (!noign && ((t = tn->tn_type->t_tspec) == ARRAY || t == FUNC)) {
2769 		if (tflag)
2770 			/* '&' before array or function: ignored */
2771 			warning(127);
2772 		return tn;
2773 	}
2774 
2775 	/* eliminate &* */
2776 	if (tn->tn_op == INDIR &&
2777 	    tn->tn_left->tn_type->t_tspec == PTR &&
2778 	    tn->tn_left->tn_type->t_subt == tn->tn_type) {
2779 		return tn->tn_left;
2780 	}
2781 
2782 	return new_tnode(ADDR, expr_derive_type(tn->tn_type, PTR), tn, NULL);
2783 }
2784 
2785 /*
2786  * Create a node for operators PLUS and MINUS.
2787  */
2788 static tnode_t *
2789 build_plus_minus(op_t op, tnode_t *ln, tnode_t *rn)
2790 {
2791 	tnode_t	*ntn, *ctn;
2792 	type_t	*tp;
2793 
2794 	/* If pointer and integer, then pointer to the lhs. */
2795 	if (rn->tn_type->t_tspec == PTR && is_integer(ln->tn_type->t_tspec)) {
2796 		ntn = ln;
2797 		ln = rn;
2798 		rn = ntn;
2799 	}
2800 
2801 	if (ln->tn_type->t_tspec == PTR && rn->tn_type->t_tspec != PTR) {
2802 
2803 		/* XXX: this assertion should be easy to trigger */
2804 		lint_assert(is_integer(rn->tn_type->t_tspec));
2805 
2806 		check_ctype_macro_invocation(ln, rn);
2807 
2808 		ctn = plength(ln->tn_type);
2809 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2810 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2811 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2812 		if (rn->tn_left->tn_op == CON)
2813 			rn = fold(rn);
2814 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2815 
2816 	} else if (rn->tn_type->t_tspec == PTR) {
2817 
2818 		lint_assert(ln->tn_type->t_tspec == PTR);
2819 		lint_assert(op == MINUS);
2820 		tp = gettyp(PTRDIFF_TSPEC);
2821 		ntn = new_tnode(op, tp, ln, rn);
2822 		if (ln->tn_op == CON && rn->tn_op == CON)
2823 			ntn = fold(ntn);
2824 		ctn = plength(ln->tn_type);
2825 		balance(NOOP, &ntn, &ctn);
2826 		ntn = new_tnode(DIV, tp, ntn, ctn);
2827 
2828 	} else {
2829 
2830 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2831 
2832 	}
2833 	return ntn;
2834 }
2835 
2836 /*
2837  * Create a node for operators SHL and SHR.
2838  */
2839 static tnode_t *
2840 build_bit_shift(op_t op, tnode_t *ln, tnode_t *rn)
2841 {
2842 	tspec_t	t;
2843 	tnode_t	*ntn;
2844 
2845 	if ((t = rn->tn_type->t_tspec) != INT && t != UINT)
2846 		rn = convert(CVT, 0, gettyp(INT), rn);
2847 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2848 	return ntn;
2849 }
2850 
2851 /*
2852  * Create a node for COLON.
2853  */
2854 static tnode_t *
2855 build_colon(tnode_t *ln, tnode_t *rn)
2856 {
2857 	tspec_t	lt, rt, pdt;
2858 	type_t	*tp;
2859 	tnode_t	*ntn;
2860 
2861 	lt = ln->tn_type->t_tspec;
2862 	rt = rn->tn_type->t_tspec;
2863 	pdt = PTRDIFF_TSPEC;
2864 
2865 	/*
2866 	 * Arithmetic types are balanced, all other type combinations
2867 	 * still need to be handled.
2868 	 */
2869 	if (is_arithmetic(lt) && is_arithmetic(rt)) {
2870 		tp = ln->tn_type;
2871 	} else if (lt == BOOL && rt == BOOL) {
2872 		tp = ln->tn_type;
2873 	} else if (lt == VOID || rt == VOID) {
2874 		tp = gettyp(VOID);
2875 	} else if (lt == STRUCT || lt == UNION) {
2876 		/* Both types must be identical. */
2877 		lint_assert(rt == STRUCT || rt == UNION);
2878 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2879 		if (is_incomplete(ln->tn_type)) {
2880 			/* unknown operand size, op %s */
2881 			error(138, op_name(COLON));
2882 			return NULL;
2883 		}
2884 		tp = ln->tn_type;
2885 	} else if (lt == PTR && is_integer(rt)) {
2886 		if (rt != pdt) {
2887 			rn = convert(NOOP, 0, gettyp(pdt), rn);
2888 			rt = pdt;
2889 		}
2890 		tp = ln->tn_type;
2891 	} else if (rt == PTR && is_integer(lt)) {
2892 		if (lt != pdt) {
2893 			ln = convert(NOOP, 0, gettyp(pdt), ln);
2894 			lt = pdt;
2895 		}
2896 		tp = rn->tn_type;
2897 	} else if (lt == PTR && ln->tn_type->t_subt->t_tspec == VOID) {
2898 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
2899 	} else if (rt == PTR && rn->tn_type->t_subt->t_tspec == VOID) {
2900 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2901 	} else {
2902 		/*
2903 		 * XXX For now we simply take the left type. This is
2904 		 * probably wrong, if one type contains a function prototype
2905 		 * and the other one, at the same place, only an old style
2906 		 * declaration.
2907 		 */
2908 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2909 	}
2910 
2911 	ntn = new_tnode(COLON, tp, ln, rn);
2912 
2913 	return ntn;
2914 }
2915 
2916 /*
2917  * Create a node for an assignment operator (both = and op= ).
2918  */
2919 static tnode_t *
2920 build_assignment(op_t op, tnode_t *ln, tnode_t *rn)
2921 {
2922 	tspec_t	lt, rt;
2923 	tnode_t	*ntn, *ctn;
2924 
2925 	lint_assert(ln != NULL);
2926 	lint_assert(rn != NULL);
2927 
2928 	lt = ln->tn_type->t_tspec;
2929 	rt = rn->tn_type->t_tspec;
2930 
2931 	if ((op == ADDASS || op == SUBASS) && lt == PTR) {
2932 		lint_assert(is_integer(rt));
2933 		ctn = plength(ln->tn_type);
2934 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2935 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2936 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2937 		if (rn->tn_left->tn_op == CON)
2938 			rn = fold(rn);
2939 	}
2940 
2941 	if ((op == ASSIGN || op == RETURN) && (lt == STRUCT || rt == STRUCT)) {
2942 		lint_assert(lt == rt);
2943 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2944 		if (is_incomplete(ln->tn_type)) {
2945 			if (op == RETURN) {
2946 				/* cannot return incomplete type */
2947 				error(212);
2948 			} else {
2949 				/* unknown operand size, op %s */
2950 				error(138, op_name(op));
2951 			}
2952 			return NULL;
2953 		}
2954 	}
2955 
2956 	if (op == SHLASS) {
2957 		if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
2958 			if (hflag)
2959 				/* semantics of '%s' change in ANSI C; ... */
2960 				warning(118, "<<=");
2961 		}
2962 	} else if (op != SHRASS) {
2963 		if (op == ASSIGN || lt != PTR) {
2964 			if (lt != rt ||
2965 			    (ln->tn_type->t_bitfield && rn->tn_op == CON)) {
2966 				rn = convert(op, 0, ln->tn_type, rn);
2967 				rt = lt;
2968 			}
2969 		}
2970 	}
2971 
2972 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2973 
2974 	return ntn;
2975 }
2976 
2977 /*
2978  * Get length of type tp->t_subt.
2979  */
2980 static tnode_t *
2981 plength(type_t *tp)
2982 {
2983 	int	elem, elsz;
2984 
2985 	lint_assert(tp->t_tspec == PTR);
2986 	tp = tp->t_subt;
2987 
2988 	elem = 1;
2989 	elsz = 0;
2990 
2991 	while (tp->t_tspec == ARRAY) {
2992 		elem *= tp->t_dim;
2993 		tp = tp->t_subt;
2994 	}
2995 
2996 	switch (tp->t_tspec) {
2997 	case FUNC:
2998 		/* pointer to function is not allowed here */
2999 		error(110);
3000 		break;
3001 	case VOID:
3002 		/* cannot do pointer arithmetic on operand of unknown size */
3003 		gnuism(136);
3004 		break;
3005 	case STRUCT:
3006 	case UNION:
3007 		if ((elsz = tp->t_str->sou_size_in_bits) == 0)
3008 			/* cannot do pointer arithmetic on operand of ... */
3009 			error(136);
3010 		break;
3011 	case ENUM:
3012 		if (is_incomplete(tp)) {
3013 			/* cannot do pointer arithmetic on operand of ... */
3014 			warning(136);
3015 		}
3016 		/* FALLTHROUGH */
3017 	default:
3018 		if ((elsz = size_in_bits(tp->t_tspec)) == 0) {
3019 			/* cannot do pointer arithmetic on operand of ... */
3020 			error(136);
3021 		} else {
3022 			lint_assert(elsz != -1);
3023 		}
3024 		break;
3025 	}
3026 
3027 	if (elem == 0 && elsz != 0) {
3028 		/* cannot do pointer arithmetic on operand of unknown size */
3029 		error(136);
3030 	}
3031 
3032 	if (elsz == 0)
3033 		elsz = CHAR_SIZE;
3034 
3035 	return expr_new_integer_constant(PTRDIFF_TSPEC,
3036 	    (int64_t)(elem * elsz / CHAR_SIZE));
3037 }
3038 
3039 /*
3040  * XXX
3041  * Note: There appear to be a number of bugs in detecting overflow in
3042  * this function. An audit and a set of proper regression tests are needed.
3043  *     --Perry Metzger, Nov. 16, 2001
3044  */
3045 /*
3046  * Do only as much as necessary to compute constant expressions.
3047  * Called only if the operator allows folding and all operands are constants.
3048  */
3049 static tnode_t *
3050 fold(tnode_t *tn)
3051 {
3052 	val_t	*v;
3053 	tspec_t	t;
3054 	bool	utyp, ovfl;
3055 	int64_t	sl, sr = 0, q = 0, mask;
3056 	uint64_t ul, ur = 0;
3057 	tnode_t	*cn;
3058 
3059 	v = xcalloc(1, sizeof(*v));
3060 	v->v_tspec = t = tn->tn_type->t_tspec;
3061 
3062 	utyp = t == PTR || is_uinteger(t);
3063 	ul = sl = tn->tn_left->tn_val->v_quad;
3064 	if (modtab[tn->tn_op].m_binary)
3065 		ur = sr = tn->tn_right->tn_val->v_quad;
3066 
3067 	mask = qlmasks[size_in_bits(t)];
3068 	ovfl = false;
3069 
3070 	switch (tn->tn_op) {
3071 	case UPLUS:
3072 		q = sl;
3073 		break;
3074 	case UMINUS:
3075 		q = -sl;
3076 		if (sl != 0 && msb(q, t, -1) == msb(sl, t, -1))
3077 			ovfl = true;
3078 		break;
3079 	case COMPL:
3080 		q = ~sl;
3081 		break;
3082 	case MULT:
3083 		if (utyp) {
3084 			q = ul * ur;
3085 			if (q != (q & mask))
3086 				ovfl = true;
3087 			else if ((ul != 0) && ((q / ul) != ur))
3088 				ovfl = true;
3089 		} else {
3090 			q = sl * sr;
3091 			if (msb(q, t, -1) != (msb(sl, t, -1) ^ msb(sr, t, -1)))
3092 				ovfl = true;
3093 		}
3094 		break;
3095 	case DIV:
3096 		if (sr == 0) {
3097 			/* division by 0 */
3098 			error(139);
3099 			q = utyp ? UQUAD_MAX : QUAD_MAX;
3100 		} else {
3101 			q = utyp ? (int64_t)(ul / ur) : sl / sr;
3102 		}
3103 		break;
3104 	case MOD:
3105 		if (sr == 0) {
3106 			/* modulus by 0 */
3107 			error(140);
3108 			q = 0;
3109 		} else {
3110 			q = utyp ? (int64_t)(ul % ur) : sl % sr;
3111 		}
3112 		break;
3113 	case PLUS:
3114 		q = utyp ? (int64_t)(ul + ur) : sl + sr;
3115 		if (msb(sl, t, -1)  != 0 && msb(sr, t, -1) != 0) {
3116 			if (msb(q, t, -1) == 0)
3117 				ovfl = true;
3118 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) == 0) {
3119 			if (msb(q, t, -1) != 0)
3120 				ovfl = true;
3121 		}
3122 		break;
3123 	case MINUS:
3124 		q = utyp ? (int64_t)(ul - ur) : sl - sr;
3125 		if (msb(sl, t, -1) != 0 && msb(sr, t, -1) == 0) {
3126 			if (msb(q, t, -1) == 0)
3127 				ovfl = true;
3128 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) != 0) {
3129 			if (msb(q, t, -1) != 0)
3130 				ovfl = true;
3131 		}
3132 		break;
3133 	case SHL:
3134 		q = utyp ? (int64_t)(ul << sr) : sl << sr;
3135 		break;
3136 	case SHR:
3137 		/*
3138 		 * The sign must be explicitly extended because
3139 		 * shifts of signed values are implementation dependent.
3140 		 */
3141 		q = ul >> sr;
3142 		q = xsign(q, t, size_in_bits(t) - (int)sr);
3143 		break;
3144 	case LT:
3145 		q = (utyp ? ul < ur : sl < sr) ? 1 : 0;
3146 		break;
3147 	case LE:
3148 		q = (utyp ? ul <= ur : sl <= sr) ? 1 : 0;
3149 		break;
3150 	case GE:
3151 		q = (utyp ? ul >= ur : sl >= sr) ? 1 : 0;
3152 		break;
3153 	case GT:
3154 		q = (utyp ? ul > ur : sl > sr) ? 1 : 0;
3155 		break;
3156 	case EQ:
3157 		q = (utyp ? ul == ur : sl == sr) ? 1 : 0;
3158 		break;
3159 	case NE:
3160 		q = (utyp ? ul != ur : sl != sr) ? 1 : 0;
3161 		break;
3162 	case BITAND:
3163 		q = utyp ? (int64_t)(ul & ur) : sl & sr;
3164 		break;
3165 	case BITXOR:
3166 		q = utyp ? (int64_t)(ul ^ ur) : sl ^ sr;
3167 		break;
3168 	case BITOR:
3169 		q = utyp ? (int64_t)(ul | ur) : sl | sr;
3170 		break;
3171 	default:
3172 		lint_assert(/*CONSTCOND*/false);
3173 	}
3174 
3175 	/* XXX does not work for quads. */
3176 	if (ovfl || ((uint64_t)(q | mask) != ~(uint64_t)0 &&
3177 	    (q & ~mask) != 0)) {
3178 		if (hflag)
3179 			/* integer overflow detected, op %s */
3180 			warning(141, op_name(tn->tn_op));
3181 	}
3182 
3183 	v->v_quad = xsign(q, t, -1);
3184 
3185 	cn = expr_new_constant(tn->tn_type, v);
3186 	if (tn->tn_left->tn_system_dependent)
3187 		cn->tn_system_dependent = true;
3188 	if (modtab[tn->tn_op].m_binary && tn->tn_right->tn_system_dependent)
3189 		cn->tn_system_dependent = true;
3190 
3191 	return cn;
3192 }
3193 
3194 /*
3195  * Fold constant nodes, as much as is needed for comparing the value with 0
3196  * (test context, for controlling expressions).
3197  */
3198 static tnode_t *
3199 fold_test(tnode_t *tn)
3200 {
3201 	bool	l, r;
3202 	val_t	*v;
3203 
3204 	v = xcalloc(1, sizeof(*v));
3205 	v->v_tspec = tn->tn_type->t_tspec;
3206 	lint_assert(v->v_tspec == INT || (Tflag && v->v_tspec == BOOL));
3207 
3208 	l = constant_is_nonzero(tn->tn_left);
3209 	r = modtab[tn->tn_op].m_binary && constant_is_nonzero(tn->tn_right);
3210 
3211 	switch (tn->tn_op) {
3212 	case NOT:
3213 		if (hflag && !constcond_flag)
3214 			/* constant argument to '!' */
3215 			warning(239);
3216 		v->v_quad = !l ? 1 : 0;
3217 		break;
3218 	case LOGAND:
3219 		v->v_quad = l && r ? 1 : 0;
3220 		break;
3221 	case LOGOR:
3222 		v->v_quad = l || r ? 1 : 0;
3223 		break;
3224 	default:
3225 		lint_assert(/*CONSTCOND*/false);
3226 	}
3227 
3228 	return expr_new_constant(tn->tn_type, v);
3229 }
3230 
3231 /*
3232  * Fold constant nodes having operands with floating point type.
3233  */
3234 static tnode_t *
3235 fold_float(tnode_t *tn)
3236 {
3237 	val_t	*v;
3238 	tspec_t	t;
3239 	ldbl_t	l, r = 0;
3240 
3241 	fpe = 0;
3242 	v = xcalloc(1, sizeof(*v));
3243 	v->v_tspec = t = tn->tn_type->t_tspec;
3244 
3245 	lint_assert(is_floating(t));
3246 	lint_assert(t == tn->tn_left->tn_type->t_tspec);
3247 	lint_assert(!modtab[tn->tn_op].m_binary ||
3248 	    t == tn->tn_right->tn_type->t_tspec);
3249 
3250 	l = tn->tn_left->tn_val->v_ldbl;
3251 	if (modtab[tn->tn_op].m_binary)
3252 		r = tn->tn_right->tn_val->v_ldbl;
3253 
3254 	switch (tn->tn_op) {
3255 	case UPLUS:
3256 		v->v_ldbl = l;
3257 		break;
3258 	case UMINUS:
3259 		v->v_ldbl = -l;
3260 		break;
3261 	case MULT:
3262 		v->v_ldbl = l * r;
3263 		break;
3264 	case DIV:
3265 		if (r == 0.0) {
3266 			/* division by 0 */
3267 			error(139);
3268 			if (t == FLOAT) {
3269 				v->v_ldbl = l < 0 ? -FLT_MAX : FLT_MAX;
3270 			} else if (t == DOUBLE) {
3271 				v->v_ldbl = l < 0 ? -DBL_MAX : DBL_MAX;
3272 			} else {
3273 				v->v_ldbl = l < 0 ? -LDBL_MAX : LDBL_MAX;
3274 			}
3275 		} else {
3276 			v->v_ldbl = l / r;
3277 		}
3278 		break;
3279 	case PLUS:
3280 		v->v_ldbl = l + r;
3281 		break;
3282 	case MINUS:
3283 		v->v_ldbl = l - r;
3284 		break;
3285 	case LT:
3286 		v->v_quad = l < r ? 1 : 0;
3287 		break;
3288 	case LE:
3289 		v->v_quad = l <= r ? 1 : 0;
3290 		break;
3291 	case GE:
3292 		v->v_quad = l >= r ? 1 : 0;
3293 		break;
3294 	case GT:
3295 		v->v_quad = l > r ? 1 : 0;
3296 		break;
3297 	case EQ:
3298 		v->v_quad = l == r ? 1 : 0;
3299 		break;
3300 	case NE:
3301 		v->v_quad = l != r ? 1 : 0;
3302 		break;
3303 	default:
3304 		lint_assert(/*CONSTCOND*/false);
3305 	}
3306 
3307 	lint_assert(fpe != 0 || isnan((double)v->v_ldbl) == 0);
3308 	if (fpe != 0 || finite((double)v->v_ldbl) == 0 ||
3309 	    (t == FLOAT &&
3310 	     (v->v_ldbl > FLT_MAX || v->v_ldbl < -FLT_MAX)) ||
3311 	    (t == DOUBLE &&
3312 	     (v->v_ldbl > DBL_MAX || v->v_ldbl < -DBL_MAX))) {
3313 		/* floating point overflow detected, op %s */
3314 		warning(142, op_name(tn->tn_op));
3315 		if (t == FLOAT) {
3316 			v->v_ldbl = v->v_ldbl < 0 ? -FLT_MAX : FLT_MAX;
3317 		} else if (t == DOUBLE) {
3318 			v->v_ldbl = v->v_ldbl < 0 ? -DBL_MAX : DBL_MAX;
3319 		} else {
3320 			v->v_ldbl = v->v_ldbl < 0 ? -LDBL_MAX: LDBL_MAX;
3321 		}
3322 	    fpe = 0;
3323 	}
3324 
3325 	return expr_new_constant(tn->tn_type, v);
3326 }
3327 
3328 
3329 /*
3330  * Create a constant node for sizeof.
3331  */
3332 tnode_t *
3333 build_sizeof(const type_t *tp)
3334 {
3335 	int64_t size_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3336 	tnode_t *tn = expr_new_integer_constant(SIZEOF_TSPEC, size_in_bytes);
3337 	tn->tn_system_dependent = true;
3338 	return tn;
3339 }
3340 
3341 /*
3342  * Create a constant node for offsetof.
3343  */
3344 tnode_t *
3345 build_offsetof(const type_t *tp, const sym_t *sym)
3346 {
3347 	tspec_t t = tp->t_tspec;
3348 	if (t != STRUCT && t != UNION)
3349 		/* unacceptable operand of '%s' */
3350 		error(111, "offsetof");
3351 
3352 	// XXX: wrong size, no checking for sym fixme
3353 	int64_t offset_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3354 	tnode_t *tn = expr_new_integer_constant(SIZEOF_TSPEC, offset_in_bytes);
3355 	tn->tn_system_dependent = true;
3356 	return tn;
3357 }
3358 
3359 int64_t
3360 type_size_in_bits(const type_t *tp)
3361 {
3362 	int	elem, elsz;
3363 	bool	flex;
3364 
3365 	elem = 1;
3366 	flex = false;
3367 	while (tp->t_tspec == ARRAY) {
3368 		flex = true;	/* allow c99 flex arrays [] [0] */
3369 		elem *= tp->t_dim;
3370 		tp = tp->t_subt;
3371 	}
3372 	if (elem == 0) {
3373 		if (!flex) {
3374 			/* cannot take size/alignment of incomplete type */
3375 			error(143);
3376 			elem = 1;
3377 		}
3378 	}
3379 	switch (tp->t_tspec) {
3380 	case FUNC:
3381 		/* cannot take size/alignment of function */
3382 		error(144);
3383 		elsz = 1;
3384 		break;
3385 	case STRUCT:
3386 	case UNION:
3387 		if (is_incomplete(tp)) {
3388 			/* cannot take size/alignment of incomplete type */
3389 			error(143);
3390 			elsz = 1;
3391 		} else {
3392 			elsz = tp->t_str->sou_size_in_bits;
3393 		}
3394 		break;
3395 	case ENUM:
3396 		if (is_incomplete(tp)) {
3397 			/* cannot take size/alignment of incomplete type */
3398 			warning(143);
3399 		}
3400 		/* FALLTHROUGH */
3401 	default:
3402 		if (tp->t_bitfield) {
3403 			/* cannot take size/alignment of bit-field */
3404 			error(145);
3405 		}
3406 		if (tp->t_tspec == VOID) {
3407 			/* cannot take size/alignment of void */
3408 			error(146);
3409 			elsz = 1;
3410 		} else {
3411 			elsz = size_in_bits(tp->t_tspec);
3412 			lint_assert(elsz > 0);
3413 		}
3414 		break;
3415 	}
3416 
3417 	return (int64_t)elem * elsz;
3418 }
3419 
3420 tnode_t *
3421 build_alignof(const type_t *tp)
3422 {
3423 	switch (tp->t_tspec) {
3424 	case ARRAY:
3425 		break;
3426 
3427 	case FUNC:
3428 		/* cannot take size/alignment of function */
3429 		error(144);
3430 		return 0;
3431 
3432 	case STRUCT:
3433 	case UNION:
3434 		if (is_incomplete(tp)) {
3435 			/* cannot take size/alignment of incomplete type */
3436 			error(143);
3437 			return 0;
3438 		}
3439 		break;
3440 	case ENUM:
3441 		break;
3442 	default:
3443 		if (tp->t_bitfield) {
3444 			/* cannot take size/alignment of bit-field */
3445 			error(145);
3446 			return 0;
3447 		}
3448 		if (tp->t_tspec == VOID) {
3449 			/* cannot take size/alignment of void */
3450 			error(146);
3451 			return 0;
3452 		}
3453 		break;
3454 	}
3455 
3456 	return expr_new_integer_constant(SIZEOF_TSPEC,
3457 	    (int64_t)alignment_in_bits(tp) / CHAR_SIZE);
3458 }
3459 
3460 /*
3461  * Type casts.
3462  */
3463 tnode_t *
3464 cast(tnode_t *tn, type_t *tp)
3465 {
3466 	tspec_t	nt, ot;
3467 
3468 	if (tn == NULL)
3469 		return NULL;
3470 
3471 	/*
3472 	 * XXX: checking for tp == NULL is only a quick fix for PR 22119.
3473 	 *  The proper fix needs to be investigated properly.
3474 	 *  See d_pr_22119.c for how to get here.
3475 	 */
3476 	if (tp == NULL)
3477 		return NULL;
3478 
3479 	tn = cconv(tn);
3480 
3481 	nt = tp->t_tspec;
3482 	ot = tn->tn_type->t_tspec;
3483 
3484 	if (nt == VOID) {
3485 		/*
3486 		 * XXX ANSI C requires scalar types or void (Plauger & Brodie).
3487 		 * But this seems really questionable.
3488 		 */
3489 	} else if (nt == UNION) {
3490 		sym_t *m;
3491 		struct_or_union *str = tp->t_str;
3492 		if (!Sflag) {
3493 			/* union cast is a C9X feature */
3494 			error(328);
3495 			return NULL;
3496 		}
3497 		for (m = str->sou_first_member; m != NULL; m = m->s_next) {
3498 			if (sametype(m->s_type, tn->tn_type)) {
3499 				tn = expr_zalloc_tnode();
3500 				tn->tn_op = CVT;
3501 				tn->tn_type = tp;
3502 				tn->tn_cast = true;
3503 				tn->tn_right = NULL;
3504 				return tn;
3505 			}
3506 		}
3507 		/* type '%s' is not a member of '%s' */
3508 		error(329, type_name(tn->tn_type), type_name(tp));
3509 		return NULL;
3510 	} else if (nt == STRUCT || nt == ARRAY || nt == FUNC) {
3511 		if (!Sflag || nt == ARRAY || nt == FUNC) {
3512 			/* invalid cast expression */
3513 			error(147);
3514 			return NULL;
3515 		}
3516 	} else if (ot == STRUCT || ot == UNION) {
3517 		/* invalid cast expression */
3518 		error(147);
3519 		return NULL;
3520 	} else if (ot == VOID) {
3521 		/* improper cast of void expression */
3522 		error(148);
3523 		return NULL;
3524 	} else if (is_integer(nt) && is_scalar(ot)) {
3525 		/* ok */
3526 	} else if (is_floating(nt) && is_arithmetic(ot)) {
3527 		/* ok */
3528 	} else if (nt == PTR && is_integer(ot)) {
3529 		/* ok */
3530 	} else if (nt == PTR && ot == PTR) {
3531 		if (!tp->t_subt->t_const && tn->tn_type->t_subt->t_const) {
3532 			if (hflag)
3533 				/* cast discards 'const' from type '%s' */
3534 				warning(275, type_name(tn->tn_type));
3535 		}
3536 	} else {
3537 		/* invalid cast expression */
3538 		error(147);
3539 		return NULL;
3540 	}
3541 
3542 	tn = convert(CVT, 0, tp, tn);
3543 	tn->tn_cast = true;
3544 
3545 	return tn;
3546 }
3547 
3548 /*
3549  * Create the node for a function argument.
3550  * All necessary conversions and type checks are done in
3551  * new_function_call_node because new_function_argument_node has no
3552  * information about expected argument types.
3553  */
3554 tnode_t *
3555 new_function_argument_node(tnode_t *args, tnode_t *arg)
3556 {
3557 	tnode_t	*ntn;
3558 
3559 	/*
3560 	 * If there was a serious error in the expression for the argument,
3561 	 * create a dummy argument so the positions of the remaining arguments
3562 	 * will not change.
3563 	 */
3564 	if (arg == NULL)
3565 		arg = expr_new_integer_constant(INT, 0);
3566 
3567 	ntn = new_tnode(PUSH, arg->tn_type, arg, args);
3568 
3569 	return ntn;
3570 }
3571 
3572 /*
3573  * Create the node for a function call. Also check types of
3574  * function arguments and insert conversions, if necessary.
3575  */
3576 tnode_t *
3577 new_function_call_node(tnode_t *func, tnode_t *args)
3578 {
3579 	tnode_t	*ntn;
3580 	op_t	fcop;
3581 
3582 	if (func == NULL)
3583 		return NULL;
3584 
3585 	if (func->tn_op == NAME && func->tn_type->t_tspec == FUNC) {
3586 		fcop = CALL;
3587 	} else {
3588 		fcop = ICALL;
3589 	}
3590 
3591 	check_ctype_function_call(func, args);
3592 
3593 	/*
3594 	 * after cconv() func will always be a pointer to a function
3595 	 * if it is a valid function designator.
3596 	 */
3597 	func = cconv(func);
3598 
3599 	if (func->tn_type->t_tspec != PTR ||
3600 	    func->tn_type->t_subt->t_tspec != FUNC) {
3601 		/* illegal function (type %s) */
3602 		error(149, type_name(func->tn_type));
3603 		return NULL;
3604 	}
3605 
3606 	args = check_function_arguments(func->tn_type->t_subt, args);
3607 
3608 	ntn = new_tnode(fcop, func->tn_type->t_subt->t_subt, func, args);
3609 
3610 	return ntn;
3611 }
3612 
3613 /*
3614  * Check types of all function arguments and insert conversions,
3615  * if necessary.
3616  */
3617 static tnode_t *
3618 check_function_arguments(type_t *ftp, tnode_t *args)
3619 {
3620 	tnode_t	*arg;
3621 	sym_t	*asym;
3622 	tspec_t	at;
3623 	int	narg, npar, n, i;
3624 
3625 	/* get # of args in the prototype */
3626 	npar = 0;
3627 	for (asym = ftp->t_args; asym != NULL; asym = asym->s_next)
3628 		npar++;
3629 
3630 	/* get # of args in function call */
3631 	narg = 0;
3632 	for (arg = args; arg != NULL; arg = arg->tn_right)
3633 		narg++;
3634 
3635 	asym = ftp->t_args;
3636 	if (ftp->t_proto && npar != narg && !(ftp->t_vararg && npar < narg)) {
3637 		/* argument mismatch: %d arg%s passed, %d expected */
3638 		error(150, narg, narg > 1 ? "s" : "", npar);
3639 		asym = NULL;
3640 	}
3641 
3642 	for (n = 1; n <= narg; n++) {
3643 
3644 		/*
3645 		 * The rightmost argument is at the top of the argument
3646 		 * subtree.
3647 		 */
3648 		for (i = narg, arg = args; i > n; i--, arg = arg->tn_right)
3649 			continue;
3650 
3651 		/* some things which are always not allowed */
3652 		if ((at = arg->tn_left->tn_type->t_tspec) == VOID) {
3653 			/* void expressions may not be arguments, arg #%d */
3654 			error(151, n);
3655 			return NULL;
3656 		} else if ((at == STRUCT || at == UNION) &&
3657 			   is_incomplete(arg->tn_left->tn_type)) {
3658 			/* argument cannot have unknown size, arg #%d */
3659 			error(152, n);
3660 			return NULL;
3661 		} else if (is_integer(at) &&
3662 			   arg->tn_left->tn_type->t_is_enum &&
3663 			   is_incomplete(arg->tn_left->tn_type)) {
3664 			/* argument cannot have unknown size, arg #%d */
3665 			warning(152, n);
3666 		}
3667 
3668 		/* class conversions (arg in value context) */
3669 		arg->tn_left = cconv(arg->tn_left);
3670 
3671 		if (asym != NULL) {
3672 			arg->tn_left = check_prototype_argument(
3673 			    n, asym->s_type, arg->tn_left);
3674 		} else {
3675 			arg->tn_left = promote(NOOP, true, arg->tn_left);
3676 		}
3677 		arg->tn_type = arg->tn_left->tn_type;
3678 
3679 		if (asym != NULL)
3680 			asym = asym->s_next;
3681 	}
3682 
3683 	return args;
3684 }
3685 
3686 /*
3687  * Compare the type of an argument with the corresponding type of a
3688  * prototype parameter. If it is a valid combination, but both types
3689  * are not the same, insert a conversion to convert the argument into
3690  * the type of the parameter.
3691  */
3692 static tnode_t *
3693 check_prototype_argument(
3694 	int	n,		/* pos of arg */
3695 	type_t	*tp,		/* expected type (from prototype) */
3696 	tnode_t	*tn)		/* argument */
3697 {
3698 	tnode_t	*ln;
3699 	bool	dowarn;
3700 
3701 	ln = xcalloc(1, sizeof(*ln));
3702 	ln->tn_type = expr_dup_type(tp);
3703 	ln->tn_type->t_const = false;
3704 	ln->tn_lvalue = true;
3705 	if (typeok(FARG, n, ln, tn)) {
3706 		if (!eqtype(tp, tn->tn_type,
3707 		    true, false, (dowarn = false, &dowarn)) || dowarn)
3708 			tn = convert(FARG, n, tp, tn);
3709 	}
3710 	free(ln);
3711 	return tn;
3712 }
3713 
3714 /*
3715  * Return the value of an integral constant expression.
3716  * If the expression is not constant or its type is not an integer
3717  * type, an error message is printed.
3718  */
3719 val_t *
3720 constant(tnode_t *tn, bool required)
3721 {
3722 	val_t	*v;
3723 
3724 	if (tn != NULL)
3725 		tn = cconv(tn);
3726 	if (tn != NULL)
3727 		tn = promote(NOOP, false, tn);
3728 
3729 	v = xcalloc(1, sizeof(*v));
3730 
3731 	if (tn == NULL) {
3732 		lint_assert(nerr != 0);
3733 		if (dflag)
3734 			printf("constant node is null; returning 1 instead\n");
3735 		v->v_tspec = INT;
3736 		v->v_quad = 1;
3737 		return v;
3738 	}
3739 
3740 	v->v_tspec = tn->tn_type->t_tspec;
3741 
3742 	if (tn->tn_op == CON) {
3743 		lint_assert(tn->tn_type->t_tspec == tn->tn_val->v_tspec);
3744 		if (is_integer(tn->tn_val->v_tspec)) {
3745 			v->v_ansiu = tn->tn_val->v_ansiu;
3746 			v->v_quad = tn->tn_val->v_quad;
3747 			return v;
3748 		}
3749 		v->v_quad = tn->tn_val->v_ldbl;
3750 	} else {
3751 		v->v_quad = 1;
3752 	}
3753 
3754 	if (required)
3755 		/* integral constant expression expected */
3756 		error(55);
3757 	else
3758 		/* variable array dimension is a C99/GCC extension */
3759 		c99ism(318);
3760 
3761 	if (!is_integer(v->v_tspec))
3762 		v->v_tspec = INT;
3763 
3764 	return v;
3765 }
3766 
3767 static bool
3768 is_constcond_false(const tnode_t *tn, tspec_t t)
3769 {
3770 	return (t == BOOL || t == INT) &&
3771 	       tn->tn_op == CON && tn->tn_val->v_quad == 0;
3772 }
3773 
3774 /*
3775  * Perform some tests on expressions which can't be done in build() and
3776  * functions called by build(). These tests must be done here because
3777  * we need some information about the context in which the operations
3778  * are performed.
3779  * After all tests are performed and dofreeblk is true, expr() frees the
3780  * memory which is used for the expression.
3781  */
3782 void
3783 expr(tnode_t *tn, bool vctx, bool tctx, bool dofreeblk, bool constcond_false_ok)
3784 {
3785 
3786 	lint_assert(tn != NULL || nerr != 0);
3787 
3788 	if (tn == NULL) {
3789 		expr_free_all();
3790 		return;
3791 	}
3792 
3793 	/* expr() is also called in global initializations */
3794 	/* TODO: rename constcond_false_ok */
3795 	if (dcs->d_ctx != EXTERN && !constcond_false_ok)
3796 		check_statement_reachable();
3797 
3798 	check_expr_misc(tn, vctx, tctx, !tctx, false, false, false);
3799 	if (tn->tn_op == ASSIGN) {
3800 		if (hflag && tctx)
3801 			/* assignment in conditional context */
3802 			warning(159);
3803 	} else if (tn->tn_op == CON) {
3804 		if (hflag && tctx && !constcond_flag &&
3805 		    !tn->tn_system_dependent &&
3806 		    !(constcond_false_ok &&
3807 		      is_constcond_false(tn, tn->tn_type->t_tspec)))
3808 			/* constant in conditional context */
3809 			warning(161);
3810 	}
3811 	if (!modtab[tn->tn_op].m_has_side_effect) {
3812 		/*
3813 		 * for left operands of COMMA this warning is already
3814 		 * printed
3815 		 */
3816 		if (tn->tn_op != COMMA && !vctx && !tctx)
3817 			check_null_effect(tn);
3818 	}
3819 	if (dflag)
3820 		display_expression(tn, 0);
3821 
3822 	/* free the tree memory */
3823 	if (dofreeblk)
3824 		expr_free_all();
3825 }
3826 
3827 static bool
3828 has_side_effect(const tnode_t *tn) // NOLINT(misc-no-recursion)
3829 {
3830 	op_t op = tn->tn_op;
3831 
3832 	if (modtab[op].m_has_side_effect)
3833 		return true;
3834 
3835 	if (op == CVT && tn->tn_type->t_tspec == VOID)
3836 		return has_side_effect(tn->tn_left);
3837 
3838 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3839 	if (op == LOGAND || op == LOGOR)
3840 		return has_side_effect(tn->tn_right);
3841 
3842 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3843 	if (op == QUEST)
3844 		return has_side_effect(tn->tn_right);
3845 
3846 	if (op == COLON || op == COMMA) {
3847 		return has_side_effect(tn->tn_left) ||
3848 		       has_side_effect(tn->tn_right);
3849 	}
3850 
3851 	return false;
3852 }
3853 
3854 static void
3855 check_null_effect(const tnode_t *tn)
3856 {
3857 
3858 	if (hflag && !has_side_effect(tn)) {
3859 		/* expression has null effect */
3860 		warning(129);
3861 	}
3862 }
3863 
3864 /*
3865  * Dump an expression to stdout
3866  * only used for debugging
3867  */
3868 static void
3869 display_expression(const tnode_t *tn, int offs)
3870 {
3871 	uint64_t uq;
3872 
3873 	if (tn == NULL) {
3874 		(void)printf("%*s%s\n", offs, "", "NULL");
3875 		return;
3876 	}
3877 	(void)printf("%*sop %s  ", offs, "", op_name(tn->tn_op));
3878 
3879 	if (tn->tn_op == NAME) {
3880 		(void)printf("%s: %s ",
3881 		    tn->tn_sym->s_name,
3882 		    storage_class_name(tn->tn_sym->s_scl));
3883 	} else if (tn->tn_op == CON && is_floating(tn->tn_type->t_tspec)) {
3884 		(void)printf("%#g ", (double)tn->tn_val->v_ldbl);
3885 	} else if (tn->tn_op == CON && is_integer(tn->tn_type->t_tspec)) {
3886 		uq = tn->tn_val->v_quad;
3887 		(void)printf("0x %08lx %08lx ",
3888 		    (long)(uq >> 32) & 0xffffffffl,
3889 		    (long)uq & 0xffffffffl);
3890 	} else if (tn->tn_op == CON) {
3891 		lint_assert(tn->tn_type->t_tspec == PTR);
3892 		(void)printf("0x%0*lx ", (int)(sizeof(void *) * CHAR_BIT / 4),
3893 			     (u_long)tn->tn_val->v_quad);
3894 	} else if (tn->tn_op == STRING) {
3895 		if (tn->tn_string->st_tspec == CHAR) {
3896 			(void)printf("\"%s\"", tn->tn_string->st_cp);
3897 		} else {
3898 			char	*s;
3899 			size_t	n;
3900 			n = MB_CUR_MAX * (tn->tn_string->st_len + 1);
3901 			s = xmalloc(n);
3902 			(void)wcstombs(s, tn->tn_string->st_wcp, n);
3903 			(void)printf("L\"%s\"", s);
3904 			free(s);
3905 		}
3906 		(void)printf(" ");
3907 	} else if (tn->tn_op == FSEL) {
3908 		(void)printf("o=%d, l=%d ", tn->tn_type->t_foffs,
3909 			     tn->tn_type->t_flen);
3910 	}
3911 	(void)printf("%s\n", ttos(tn->tn_type));
3912 	if (tn->tn_op == NAME || tn->tn_op == CON || tn->tn_op == STRING)
3913 		return;
3914 	display_expression(tn->tn_left, offs + 2);
3915 	if (modtab[tn->tn_op].m_binary ||
3916 	    (tn->tn_op == PUSH && tn->tn_right != NULL)) {
3917 		display_expression(tn->tn_right, offs + 2);
3918 	}
3919 }
3920 
3921 /*
3922  * Called by expr() to recursively perform some tests.
3923  */
3924 /* ARGSUSED */
3925 void
3926 check_expr_misc(const tnode_t *tn, bool vctx, bool tctx,
3927 		bool eqwarn, bool fcall, bool rvdisc, bool szof)
3928 {
3929 	tnode_t	*ln, *rn;
3930 	const mod_t *mp;
3931 	op_t	op;
3932 	scl_t	sc;
3933 	dinfo_t	*di;
3934 
3935 	if (tn == NULL)
3936 		return;
3937 
3938 	ln = tn->tn_left;
3939 	rn = tn->tn_right;
3940 	mp = &modtab[op = tn->tn_op];
3941 
3942 	switch (op) {
3943 	case ADDR:
3944 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3945 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3946 			if (!szof)
3947 				mark_as_set(ln->tn_sym);
3948 			mark_as_used(ln->tn_sym, fcall, szof);
3949 		}
3950 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3951 			/* check the range of array indices */
3952 			check_array_index(ln->tn_left, true);
3953 		break;
3954 	case LOAD:
3955 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3956 			/* check the range of array indices */
3957 			check_array_index(ln->tn_left, false);
3958 		/* FALLTHROUGH */
3959 	case PUSH:
3960 	case INCBEF:
3961 	case DECBEF:
3962 	case INCAFT:
3963 	case DECAFT:
3964 	case ADDASS:
3965 	case SUBASS:
3966 	case MULASS:
3967 	case DIVASS:
3968 	case MODASS:
3969 	case ANDASS:
3970 	case ORASS:
3971 	case XORASS:
3972 	case SHLASS:
3973 	case SHRASS:
3974 	case REAL:
3975 	case IMAG:
3976 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3977 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3978 			sc = ln->tn_sym->s_scl;
3979 			/*
3980 			 * Look if there was a asm statement in one of the
3981 			 * compound statements we are in. If not, we don't
3982 			 * print a warning.
3983 			 */
3984 			for (di = dcs; di != NULL; di = di->d_next) {
3985 				if (di->d_asm)
3986 					break;
3987 			}
3988 			if (sc != EXTERN && sc != STATIC &&
3989 			    !ln->tn_sym->s_set && !szof && di == NULL) {
3990 				/* %s may be used before set */
3991 				warning(158, ln->tn_sym->s_name);
3992 				mark_as_set(ln->tn_sym);
3993 			}
3994 			mark_as_used(ln->tn_sym, false, false);
3995 		}
3996 		break;
3997 	case ASSIGN:
3998 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3999 		if (ln->tn_op == NAME && !szof && (reached || !warn_about_unreachable)) {
4000 			mark_as_set(ln->tn_sym);
4001 			if (ln->tn_sym->s_scl == EXTERN)
4002 				outusg(ln->tn_sym);
4003 		}
4004 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4005 			/* check the range of array indices */
4006 			check_array_index(ln->tn_left, false);
4007 		break;
4008 	case CALL:
4009 		lint_assert(ln->tn_op == ADDR);
4010 		lint_assert(ln->tn_left->tn_op == NAME);
4011 		if (!szof)
4012 			outcall(tn, vctx || tctx, rvdisc);
4013 		break;
4014 	case EQ:
4015 		if (hflag && eqwarn)
4016 			/* operator '==' found where '=' was expected */
4017 			warning(160);
4018 		break;
4019 	case CON:
4020 	case NAME:
4021 	case STRING:
4022 		return;
4023 		/* LINTED206: (enumeration values not handled in switch) */
4024 	case BITOR:
4025 	case BITXOR:
4026 	case NE:
4027 	case GE:
4028 	case GT:
4029 	case LE:
4030 	case LT:
4031 	case SHR:
4032 	case SHL:
4033 	case MINUS:
4034 	case PLUS:
4035 	case MOD:
4036 	case DIV:
4037 	case MULT:
4038 	case INDIR:
4039 	case UMINUS:
4040 	case UPLUS:
4041 	case DEC:
4042 	case INC:
4043 	case COMPL:
4044 	case NOT:
4045 	case POINT:
4046 	case ARROW:
4047 	case NOOP:
4048 	case BITAND:
4049 	case FARG:
4050 	case CASE:
4051 	case INIT:
4052 	case RETURN:
4053 	case ICALL:
4054 	case CVT:
4055 	case COMMA:
4056 	case FSEL:
4057 	case COLON:
4058 	case QUEST:
4059 	case LOGOR:
4060 	case LOGAND:
4061 		break;
4062 	}
4063 
4064 	bool cvctx = mp->m_left_value_context;
4065 	bool ctctx = mp->m_left_test_context;
4066 	bool eq = mp->m_warn_if_operand_eq &&
4067 		  !ln->tn_parenthesized &&
4068 		  rn != NULL && !rn->tn_parenthesized;
4069 
4070 	/*
4071 	 * values of operands of ':' are not used if the type of at least
4072 	 * one of the operands (for gcc compatibility) is void
4073 	 * XXX test/value context of QUEST should probably be used as
4074 	 * context for both operands of COLON
4075 	 */
4076 	if (op == COLON && tn->tn_type->t_tspec == VOID)
4077 		cvctx = ctctx = false;
4078 	bool discard = op == CVT && tn->tn_type->t_tspec == VOID;
4079 	check_expr_misc(ln, cvctx, ctctx, eq, op == CALL, discard, szof);
4080 
4081 	switch (op) {
4082 	case PUSH:
4083 		if (rn != NULL)
4084 			check_expr_misc(rn, false, false, eq, false, false,
4085 			    szof);
4086 		break;
4087 	case LOGAND:
4088 	case LOGOR:
4089 		check_expr_misc(rn, false, true, eq, false, false, szof);
4090 		break;
4091 	case COLON:
4092 		check_expr_misc(rn, cvctx, ctctx, eq, false, false, szof);
4093 		break;
4094 	case COMMA:
4095 		check_expr_misc(rn, vctx, tctx, eq, false, false, szof);
4096 		break;
4097 	default:
4098 		if (mp->m_binary)
4099 			check_expr_misc(rn, true, false, eq, false, false,
4100 			    szof);
4101 		break;
4102 	}
4103 
4104 }
4105 
4106 /*
4107  * Checks the range of array indices, if possible.
4108  * amper is set if only the address of the element is used. This
4109  * means that the index is allowed to refer to the first element
4110  * after the array.
4111  */
4112 static void
4113 check_array_index(tnode_t *tn, bool amper)
4114 {
4115 	int	dim;
4116 	tnode_t	*ln, *rn;
4117 	int	elsz;
4118 	int64_t	con;
4119 
4120 	ln = tn->tn_left;
4121 	rn = tn->tn_right;
4122 
4123 	/* We can only check constant indices. */
4124 	if (rn->tn_op != CON)
4125 		return;
4126 
4127 	/* Return if the left node does not stem from an array. */
4128 	if (ln->tn_op != ADDR)
4129 		return;
4130 	if (ln->tn_left->tn_op != STRING && ln->tn_left->tn_op != NAME)
4131 		return;
4132 	if (ln->tn_left->tn_type->t_tspec != ARRAY)
4133 		return;
4134 
4135 	/*
4136 	 * For incomplete array types, we can print a warning only if
4137 	 * the index is negative.
4138 	 */
4139 	if (is_incomplete(ln->tn_left->tn_type) && rn->tn_val->v_quad >= 0)
4140 		return;
4141 
4142 	/* Get the size of one array element */
4143 	if ((elsz = length(ln->tn_type->t_subt, NULL)) == 0)
4144 		return;
4145 	elsz /= CHAR_SIZE;
4146 
4147 	/* Change the unit of the index from bytes to element size. */
4148 	if (is_uinteger(rn->tn_type->t_tspec)) {
4149 		con = (uint64_t)rn->tn_val->v_quad / elsz;
4150 	} else {
4151 		con = rn->tn_val->v_quad / elsz;
4152 	}
4153 
4154 	dim = ln->tn_left->tn_type->t_dim + (amper ? 1 : 0);
4155 
4156 	if (!is_uinteger(rn->tn_type->t_tspec) && con < 0) {
4157 		/* array subscript cannot be negative: %ld */
4158 		warning(167, (long)con);
4159 	} else if (dim > 0 && (uint64_t)con >= (uint64_t)dim) {
4160 		/* array subscript cannot be > %d: %ld */
4161 		warning(168, dim - 1, (long)con);
4162 	}
4163 }
4164 
4165 /*
4166  * Check for ordered comparisons of unsigned values with 0.
4167  */
4168 static void
4169 check_integer_comparison(op_t op, tnode_t *ln, tnode_t *rn)
4170 {
4171 	tspec_t	lt, rt;
4172 
4173 	lt = ln->tn_type->t_tspec;
4174 	rt = rn->tn_type->t_tspec;
4175 
4176 	if (ln->tn_op != CON && rn->tn_op != CON)
4177 		return;
4178 
4179 	if (!is_integer(lt) || !is_integer(rt))
4180 		return;
4181 
4182 	if ((hflag || pflag) && lt == CHAR && rn->tn_op == CON &&
4183 	    (rn->tn_val->v_quad < 0 ||
4184 	     rn->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
4185 		/* nonportable character comparison, op %s */
4186 		warning(230, op_name(op));
4187 		return;
4188 	}
4189 	if ((hflag || pflag) && rt == CHAR && ln->tn_op == CON &&
4190 	    (ln->tn_val->v_quad < 0 ||
4191 	     ln->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
4192 		/* nonportable character comparison, op %s */
4193 		warning(230, op_name(op));
4194 		return;
4195 	}
4196 	if (is_uinteger(lt) && !is_uinteger(rt) &&
4197 	    rn->tn_op == CON && rn->tn_val->v_quad <= 0) {
4198 		if (rn->tn_val->v_quad < 0) {
4199 			/* comparison of %s with %s, op %s */
4200 			warning(162, type_name(ln->tn_type),
4201 			    "negative constant", op_name(op));
4202 		} else if (op == LT || op == GE || (hflag && op == LE)) {
4203 			/* comparison of %s with %s, op %s */
4204 			warning(162, type_name(ln->tn_type), "0", op_name(op));
4205 		}
4206 		return;
4207 	}
4208 	if (is_uinteger(rt) && !is_uinteger(lt) &&
4209 	    ln->tn_op == CON && ln->tn_val->v_quad <= 0) {
4210 		if (ln->tn_val->v_quad < 0) {
4211 			/* comparison of %s with %s, op %s */
4212 			warning(162, "negative constant",
4213 			    type_name(rn->tn_type), op_name(op));
4214 		} else if (op == GT || op == LE || (hflag && op == GE)) {
4215 			/* comparison of %s with %s, op %s */
4216 			warning(162, "0", type_name(rn->tn_type), op_name(op));
4217 		}
4218 		return;
4219 	}
4220 }
4221 
4222 /*
4223  * Return whether the expression can be used for static initialization.
4224  *
4225  * Constant initialization expressions must be constant or an address
4226  * of a static object with an optional offset. In the first case,
4227  * the result is returned in *offsp. In the second case, the static
4228  * object is returned in *symp and the offset in *offsp.
4229  *
4230  * The expression can consist of PLUS, MINUS, ADDR, NAME, STRING and
4231  * CON. Type conversions are allowed if they do not change binary
4232  * representation (including width).
4233  */
4234 bool
4235 constant_addr(const tnode_t *tn, const sym_t **symp, ptrdiff_t *offsp)
4236 {
4237 	const sym_t *sym;
4238 	ptrdiff_t offs1, offs2;
4239 	tspec_t	t, ot;
4240 
4241 	switch (tn->tn_op) {
4242 	case MINUS:
4243 		if (tn->tn_right->tn_op == CVT)
4244 			return constant_addr(tn->tn_right, symp, offsp);
4245 		else if (tn->tn_right->tn_op != CON)
4246 			return false;
4247 		/* FALLTHROUGH */
4248 	case PLUS:
4249 		offs1 = offs2 = 0;
4250 		if (tn->tn_left->tn_op == CON) {
4251 			offs1 = (ptrdiff_t)tn->tn_left->tn_val->v_quad;
4252 			if (!constant_addr(tn->tn_right, &sym, &offs2))
4253 				return false;
4254 		} else if (tn->tn_right->tn_op == CON) {
4255 			offs2 = (ptrdiff_t)tn->tn_right->tn_val->v_quad;
4256 			if (tn->tn_op == MINUS)
4257 				offs2 = -offs2;
4258 			if (!constant_addr(tn->tn_left, &sym, &offs1))
4259 				return false;
4260 		} else {
4261 			return false;
4262 		}
4263 		*symp = sym;
4264 		*offsp = offs1 + offs2;
4265 		return true;
4266 	case ADDR:
4267 		if (tn->tn_left->tn_op == NAME) {
4268 			*symp = tn->tn_left->tn_sym;
4269 			*offsp = 0;
4270 			return true;
4271 		} else {
4272 			/*
4273 			 * If this would be the front end of a compiler we
4274 			 * would return a label instead of 0, at least if
4275 			 * 'tn->tn_left->tn_op == STRING'.
4276 			 */
4277 			*symp = NULL;
4278 			*offsp = 0;
4279 			return true;
4280 		}
4281 	case CVT:
4282 		t = tn->tn_type->t_tspec;
4283 		ot = tn->tn_left->tn_type->t_tspec;
4284 		if ((!is_integer(t) && t != PTR) ||
4285 		    (!is_integer(ot) && ot != PTR)) {
4286 			return false;
4287 		}
4288 #ifdef notdef
4289 		/*
4290 		 * consider:
4291 		 *	struct foo {
4292 		 *		unsigned char a;
4293 		 *	} f = {
4294 		 *		(u_char)(u_long)(&(((struct foo *)0)->a))
4295 		 *	};
4296 		 * since psize(u_long) != psize(u_char) this fails.
4297 		 */
4298 		else if (psize(t) != psize(ot))
4299 			return -1;
4300 #endif
4301 		return constant_addr(tn->tn_left, symp, offsp);
4302 	default:
4303 		return false;
4304 	}
4305 }
4306 
4307 /*
4308  * Concatenate two string constants.
4309  */
4310 strg_t *
4311 cat_strings(strg_t *strg1, strg_t *strg2)
4312 {
4313 	size_t	len1, len2, len;
4314 
4315 	if (strg1->st_tspec != strg2->st_tspec) {
4316 		/* cannot concatenate wide and regular string literals */
4317 		error(292);
4318 		return strg1;
4319 	}
4320 
4321 	len1 = strg1->st_len;
4322 	len2 = strg2->st_len + 1;	/* + NUL */
4323 	len = len1 + len2;
4324 
4325 #define COPY(F) \
4326     do { \
4327 	strg1->F = xrealloc(strg1->F, len * sizeof(*strg1->F)); \
4328 	(void)memcpy(strg1->F + len1, strg2->F, len2 * sizeof(*strg1->F)); \
4329 	free(strg2->F); \
4330     } while (/*CONSTCOND*/false)
4331 
4332 	if (strg1->st_tspec == CHAR)
4333 		COPY(st_cp);
4334 	else
4335 		COPY(st_wcp);
4336 
4337 	strg1->st_len = len - 1; /* - NUL */
4338 	free(strg2);
4339 
4340 	return strg1;
4341 }
4342 
4343 static bool
4344 is_confusing_precedence(op_t op, op_t lop, bool lparen, op_t rop, bool rparen)
4345 {
4346 
4347 	if (op == SHL || op == SHR) {
4348 		if (!lparen && (lop == PLUS || lop == MINUS))
4349 			return true;
4350 		if (!rparen && (rop == PLUS || rop == MINUS))
4351 			return true;
4352 		return false;
4353 	}
4354 
4355 	if (op == LOGOR) {
4356 		if (!lparen && lop == LOGAND)
4357 			return true;
4358 		if (!rparen && rop == LOGAND)
4359 			return true;
4360 		return false;
4361 	}
4362 
4363 	lint_assert(op == BITAND || op == BITXOR || op == BITOR);
4364 	if (!lparen && lop != op) {
4365 		if (lop == PLUS || lop == MINUS)
4366 			return true;
4367 		if (lop == BITAND || lop == BITXOR)
4368 			return true;
4369 	}
4370 	if (!rparen && rop != op) {
4371 		if (rop == PLUS || rop == MINUS)
4372 			return true;
4373 		if (rop == BITAND || rop == BITXOR)
4374 			return true;
4375 	}
4376 	return false;
4377 }
4378 
4379 /*
4380  * Print a warning if the given node has operands which should be
4381  * parenthesized.
4382  *
4383  * XXX Does not work if an operand is a constant expression. Constant
4384  * expressions are already folded.
4385  */
4386 static void
4387 check_precedence_confusion(tnode_t *tn)
4388 {
4389 	tnode_t *ln, *rn;
4390 
4391 	if (!hflag)
4392 		return;
4393 
4394 	debug_node(tn, 0);
4395 
4396 	lint_assert(modtab[tn->tn_op].m_binary);
4397 	for (ln = tn->tn_left; ln->tn_op == CVT; ln = ln->tn_left)
4398 		continue;
4399 	for (rn = tn->tn_right; rn->tn_op == CVT; rn = rn->tn_left)
4400 		continue;
4401 
4402 	if (is_confusing_precedence(tn->tn_op,
4403 	    ln->tn_op, ln->tn_parenthesized,
4404 	    rn->tn_op, rn->tn_parenthesized)) {
4405 		/* precedence confusion possible: parenthesize! */
4406 		warning(169);
4407 	}
4408 }
4409