xref: /netbsd-src/usr.bin/xlint/lint1/tree.c (revision 5c6aa0100d8dbaa77a8faa025a206a8255b60297)
1 /*	$NetBSD: tree.c,v 1.271 2021/04/06 21:59:58 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: tree.c,v 1.271 2021/04/06 21:59:58 rillig Exp $");
41 #endif
42 
43 #include <float.h>
44 #include <limits.h>
45 #include <math.h>
46 #include <signal.h>
47 #include <stdlib.h>
48 #include <string.h>
49 
50 #include "lint1.h"
51 #include "cgram.h"
52 
53 static	tnode_t	*expr_new_integer_constant(tspec_t, int64_t);
54 static	void	check_pointer_comparison(op_t,
55 					 const tnode_t *, const tnode_t *);
56 static	bool	check_assign_types_compatible(op_t, int,
57 					      const tnode_t *, const tnode_t *);
58 static	void	check_bad_enum_operation(op_t,
59 					 const tnode_t *, const tnode_t *);
60 static	void	check_enum_type_mismatch(op_t, int,
61 				         const tnode_t *, const tnode_t *);
62 static	void	check_enum_int_mismatch(op_t, int,
63 					const tnode_t *, const tnode_t *);
64 static	tnode_t	*new_tnode(op_t, type_t *, tnode_t *, tnode_t *);
65 static	void	balance(op_t, tnode_t **, tnode_t **);
66 static	void	warn_incompatible_types(op_t, const type_t *, tspec_t,
67 					const type_t *, tspec_t);
68 static	void	warn_incompatible_pointers(const mod_t *,
69 					   const type_t *, const type_t *);
70 static	bool	has_constant_member(const type_t *);
71 static	void	check_prototype_conversion(int, tspec_t, tspec_t, type_t *,
72 					   tnode_t *);
73 static	void	check_integer_conversion(op_t, int, tspec_t, tspec_t, type_t *,
74 					 tnode_t *);
75 static	void	check_pointer_integer_conversion(op_t, tspec_t, type_t *,
76 						 tnode_t *);
77 static	void	check_pointer_conversion(op_t, tnode_t *, type_t *);
78 static	tnode_t	*build_struct_access(op_t, tnode_t *, tnode_t *);
79 static	tnode_t	*build_prepost_incdec(op_t, tnode_t *);
80 static	tnode_t	*build_real_imag(op_t, tnode_t *);
81 static	tnode_t	*build_address(tnode_t *, bool);
82 static	tnode_t	*build_plus_minus(op_t, tnode_t *, tnode_t *);
83 static	tnode_t	*build_bit_shift(op_t, tnode_t *, tnode_t *);
84 static	tnode_t	*build_colon(tnode_t *, tnode_t *);
85 static	tnode_t	*build_assignment(op_t, tnode_t *, tnode_t *);
86 static	tnode_t	*plength(type_t *);
87 static	tnode_t	*fold(tnode_t *);
88 static	tnode_t	*fold_test(tnode_t *);
89 static	tnode_t	*fold_float(tnode_t *);
90 static	tnode_t	*check_function_arguments(type_t *, tnode_t *);
91 static	tnode_t	*check_prototype_argument(int, type_t *, tnode_t *);
92 static	void	check_null_effect(const tnode_t *);
93 static	void	display_expression(const tnode_t *, int);
94 static	void	check_array_index(tnode_t *, bool);
95 static	void	check_integer_comparison(op_t, tnode_t *, tnode_t *);
96 static	void	check_precedence_confusion(tnode_t *);
97 
98 extern sig_atomic_t fpe;
99 
100 static const char *
101 op_name(op_t op)
102 {
103 	return modtab[op].m_name;
104 }
105 
106 #ifdef DEBUG
107 void
108 debug_node(const tnode_t *tn, int indent)
109 {
110 	op_t op;
111 
112 	if (tn == NULL) {
113 		printf("%*s" "null\n", indent, "");
114 		return;
115 	}
116 
117 	op = tn->tn_op;
118 	printf("%*s%s with type '%s'%s%s",
119 	    2 * indent, "",
120 	    op == CVT && !tn->tn_cast ? "convert" : op_name(op),
121 	    type_name(tn->tn_type), tn->tn_lvalue ? ", lvalue" : "",
122 	    tn->tn_parenthesized ? ", parenthesized" : "");
123 
124 	if (op == NAME)
125 		printf(" %s\n", tn->tn_sym->s_name);
126 	else if (op == CON && is_floating(tn->tn_type->t_tspec))
127 		printf(", value %Lg", tn->tn_val->v_ldbl);
128 	else if (op == CON && is_uinteger(tn->tn_type->t_tspec))
129 		printf(", value %llu\n", (unsigned long long)tn->tn_val->v_quad);
130 	else if (op == CON && is_integer(tn->tn_type->t_tspec))
131 		printf(", value %lld\n", (long long)tn->tn_val->v_quad);
132 	else if (op == CON)
133 		printf(", unknown value\n");
134 	else if (op == STRING)
135 		printf(", length %zu\n", tn->tn_string->st_len);
136 	else {
137 		printf("\n");
138 
139 		debug_node(tn->tn_left, indent + 1);
140 		if (modtab[op].m_binary || tn->tn_right != NULL)
141 			debug_node(tn->tn_right, indent + 1);
142 	}
143 }
144 #endif
145 
146 /* Build 'pointer to tp', 'array of tp' or 'function returning tp'. */
147 type_t *
148 derive_type(type_t *tp, tspec_t t)
149 {
150 	type_t	*tp2;
151 
152 	tp2 = getblk(sizeof(*tp2));
153 	tp2->t_tspec = t;
154 	tp2->t_subt = tp;
155 	return tp2;
156 }
157 
158 /*
159  * Build 'pointer to tp', 'array of tp' or 'function returning tp'.  The
160  * memory is freed at the end of the current expression.
161  */
162 type_t *
163 expr_derive_type(type_t *tp, tspec_t t)
164 {
165 	type_t	*tp2;
166 
167 	tp2 = expr_zalloc(sizeof(*tp2));
168 	tp2->t_tspec = t;
169 	tp2->t_subt = tp;
170 	return tp2;
171 }
172 
173 /*
174  * Create a node for a constant.
175  */
176 tnode_t *
177 expr_new_constant(type_t *tp, val_t *v)
178 {
179 	tnode_t	*n;
180 
181 	n = expr_zalloc_tnode();
182 	n->tn_op = CON;
183 	n->tn_type = tp;
184 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
185 	n->tn_val->v_tspec = tp->t_tspec;
186 	n->tn_val->v_ansiu = v->v_ansiu;
187 	n->tn_val->v_u = v->v_u;
188 	free(v);
189 	return n;
190 }
191 
192 static tnode_t *
193 expr_new_integer_constant(tspec_t t, int64_t q)
194 {
195 	tnode_t	*n;
196 
197 	n = expr_zalloc_tnode();
198 	n->tn_op = CON;
199 	n->tn_type = gettyp(t);
200 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
201 	n->tn_val->v_tspec = t;
202 	n->tn_val->v_quad = q;
203 	return n;
204 }
205 
206 static void
207 fallback_symbol(sym_t *sym)
208 {
209 
210 	if (fallback_symbol_strict_bool(sym))
211 		return;
212 
213 	if (block_level > 0 && (strcmp(sym->s_name, "__FUNCTION__") == 0 ||
214 			   strcmp(sym->s_name, "__PRETTY_FUNCTION__") == 0)) {
215 		/* __FUNCTION__/__PRETTY_FUNCTION__ is a GCC extension */
216 		gnuism(316);
217 		sym->s_type = derive_type(gettyp(CHAR), PTR);
218 		sym->s_type->t_const = true;
219 		return;
220 	}
221 
222 	if (block_level > 0 && strcmp(sym->s_name, "__func__") == 0) {
223 		if (!Sflag)
224 			/* __func__ is a C9X feature */
225 			warning(317);
226 		sym->s_type = derive_type(gettyp(CHAR), PTR);
227 		sym->s_type->t_const = true;
228 		return;
229 	}
230 
231 	/* '%s' undefined */
232 	error(99, sym->s_name);
233 }
234 
235 /*
236  * Create a node for a name (symbol table entry).
237  * follow_token is the token which follows the name.
238  */
239 tnode_t *
240 new_name_node(sym_t *sym, int follow_token)
241 {
242 	tnode_t	*n;
243 
244 	if (sym->s_scl == NOSCL) {
245 		sym->s_scl = EXTERN;
246 		sym->s_def = DECL;
247 		if (follow_token == T_LPAREN) {
248 			if (sflag) {
249 				/* function implicitly declared to ... */
250 				warning(215);
251 			}
252 			/*
253 			 * XXX if tflag is set the symbol should be
254 			 * exported to level 0
255 			 */
256 			sym->s_type = derive_type(sym->s_type, FUNC);
257 		} else {
258 			fallback_symbol(sym);
259 		}
260 	}
261 
262 	lint_assert(sym->s_kind == FVFT || sym->s_kind == FMEMBER);
263 
264 	n = expr_zalloc_tnode();
265 	n->tn_type = sym->s_type;
266 	if (sym->s_scl != CTCONST) {
267 		n->tn_op = NAME;
268 		n->tn_sym = sym;
269 		if (sym->s_kind == FVFT && sym->s_type->t_tspec != FUNC)
270 			n->tn_lvalue = true;
271 	} else {
272 		n->tn_op = CON;
273 		n->tn_val = expr_zalloc(sizeof(*n->tn_val));
274 		*n->tn_val = sym->s_value;
275 	}
276 
277 	return n;
278 }
279 
280 tnode_t *
281 new_string_node(strg_t *strg)
282 {
283 	size_t	len;
284 	tnode_t	*n;
285 
286 	len = strg->st_len;
287 
288 	n = expr_zalloc_tnode();
289 
290 	n->tn_op = STRING;
291 	n->tn_type = expr_derive_type(gettyp(strg->st_tspec), ARRAY);
292 	n->tn_type->t_dim = len + 1;
293 	n->tn_lvalue = true;
294 
295 	n->tn_string = expr_zalloc(sizeof(*n->tn_string));
296 	n->tn_string->st_tspec = strg->st_tspec;
297 	n->tn_string->st_len = len;
298 
299 	if (strg->st_tspec == CHAR) {
300 		n->tn_string->st_cp = expr_zalloc(len + 1);
301 		(void)memcpy(n->tn_string->st_cp, strg->st_cp, len + 1);
302 		free(strg->st_cp);
303 	} else {
304 		size_t size = (len + 1) * sizeof(*n->tn_string->st_wcp);
305 		n->tn_string->st_wcp = expr_zalloc(size);
306 		(void)memcpy(n->tn_string->st_wcp, strg->st_wcp, size);
307 		free(strg->st_wcp);
308 	}
309 	free(strg);
310 
311 	return n;
312 }
313 
314 /*
315  * Returns a symbol which has the same name as the msym argument and is a
316  * member of the struct or union specified by the tn argument.
317  */
318 sym_t *
319 struct_or_union_member(tnode_t *tn, op_t op, sym_t *msym)
320 {
321 	struct_or_union	*str;
322 	type_t	*tp;
323 	sym_t	*sym, *csym;
324 	bool	eq;
325 	tspec_t	t;
326 
327 	/*
328 	 * Remove the member if it was unknown until now, which means
329 	 * that no defined struct or union has a member with the same name.
330 	 */
331 	if (msym->s_scl == NOSCL) {
332 		/* type '%s' does not have member '%s' */
333 		error(101, type_name(msym->s_type), msym->s_name);
334 		rmsym(msym);
335 		msym->s_kind = FMEMBER;
336 		msym->s_scl = MOS;
337 		msym->s_styp = expr_zalloc(sizeof(*msym->s_styp));
338 		msym->s_styp->sou_tag = expr_zalloc(
339 		    sizeof(*msym->s_styp->sou_tag));
340 		msym->s_styp->sou_tag->s_name = unnamed;
341 		msym->s_value.v_tspec = INT;
342 		return msym;
343 	}
344 
345 	/* Set str to the tag of which msym is expected to be a member. */
346 	str = NULL;
347 	t = (tp = tn->tn_type)->t_tspec;
348 	if (op == POINT) {
349 		if (t == STRUCT || t == UNION)
350 			str = tp->t_str;
351 	} else if (op == ARROW && t == PTR) {
352 		t = (tp = tp->t_subt)->t_tspec;
353 		if (t == STRUCT || t == UNION)
354 			str = tp->t_str;
355 	}
356 
357 	/*
358 	 * If this struct/union has a member with the name of msym, return it.
359 	 */
360 	if (str != NULL) {
361 		for (sym = msym; sym != NULL; sym = sym->s_link) {
362 			if (sym->s_scl != MOS && sym->s_scl != MOU)
363 				continue;
364 			if (sym->s_styp != str)
365 				continue;
366 			if (strcmp(sym->s_name, msym->s_name) != 0)
367 				continue;
368 			return sym;
369 		}
370 	}
371 
372 	/*
373 	 * Set eq to false if there are struct/union members with the same
374 	 * name and different types and/or offsets.
375 	 */
376 	eq = true;
377 	for (csym = msym; csym != NULL; csym = csym->s_link) {
378 		if (csym->s_scl != MOS && csym->s_scl != MOU)
379 			continue;
380 		if (strcmp(msym->s_name, csym->s_name) != 0)
381 			continue;
382 		for (sym = csym->s_link ; sym != NULL; sym = sym->s_link) {
383 			bool w;
384 
385 			if (sym->s_scl != MOS && sym->s_scl != MOU)
386 				continue;
387 			if (strcmp(csym->s_name, sym->s_name) != 0)
388 				continue;
389 			if (csym->s_value.v_quad != sym->s_value.v_quad) {
390 				eq = false;
391 				break;
392 			}
393 			w = false;
394 			eq = eqtype(csym->s_type, sym->s_type,
395 			    false, false, &w) && !w;
396 			if (!eq)
397 				break;
398 			if (csym->s_bitfield != sym->s_bitfield) {
399 				eq = false;
400 				break;
401 			}
402 			if (csym->s_bitfield) {
403 				type_t	*tp1, *tp2;
404 
405 				tp1 = csym->s_type;
406 				tp2 = sym->s_type;
407 				if (tp1->t_flen != tp2->t_flen) {
408 					eq = false;
409 					break;
410 				}
411 				if (tp1->t_foffs != tp2->t_foffs) {
412 					eq = false;
413 					break;
414 				}
415 			}
416 		}
417 		if (!eq)
418 			break;
419 	}
420 
421 	/*
422 	 * Now handle the case in which the left operand refers really
423 	 * to a struct/union, but the right operand is not member of it.
424 	 */
425 	if (str != NULL) {
426 		if (eq && tflag) {
427 			/* illegal member use: %s */
428 			warning(102, msym->s_name);
429 		} else {
430 			/* illegal member use: %s */
431 			error(102, msym->s_name);
432 		}
433 		return msym;
434 	}
435 
436 	/*
437 	 * Now the left operand of ARROW does not point to a struct/union
438 	 * or the left operand of POINT is no struct/union.
439 	 */
440 	if (eq) {
441 		if (op == POINT) {
442 			if (tflag) {
443 				/* left operand of '.' must be struct/... */
444 				warning(103);
445 			} else {
446 				/* left operand of '.' must be struct/... */
447 				error(103);
448 			}
449 		} else {
450 			if (tflag && tn->tn_type->t_tspec == PTR) {
451 				/* left operand of '->' must be pointer ... */
452 				warning(104, type_name(tn->tn_type));
453 			} else {
454 				/* left operand of '->' must be pointer ... */
455 				error(104, type_name(tn->tn_type));
456 			}
457 		}
458 	} else {
459 		if (tflag) {
460 			/* non-unique member requires struct/union %s */
461 			error(105, op == POINT ? "object" : "pointer");
462 		} else {
463 			/* unacceptable operand of '%s' */
464 			error(111, op_name(op));
465 		}
466 	}
467 
468 	return msym;
469 }
470 
471 /*
472  * Create a tree node. Called for most operands except function calls,
473  * sizeof and casts.
474  *
475  * op	operator
476  * ln	left operand
477  * rn	if not NULL, right operand
478  */
479 tnode_t *
480 build(op_t op, tnode_t *ln, tnode_t *rn)
481 {
482 	const mod_t *mp;
483 	tnode_t	*ntn;
484 	type_t	*rettp;
485 
486 	mp = &modtab[op];
487 
488 	/* If there was an error in one of the operands, return. */
489 	if (ln == NULL || (mp->m_binary && rn == NULL))
490 		return NULL;
491 
492 	/*
493 	 * Apply class conversions to the left operand, but only if its
494 	 * value is needed or it is compared with null.
495 	 */
496 	if (mp->m_left_value_context || mp->m_left_test_context)
497 		ln = cconv(ln);
498 	/*
499 	 * The right operand is almost always in a test or value context,
500 	 * except if it is a struct or union member.
501 	 */
502 	if (mp->m_binary && op != ARROW && op != POINT)
503 		rn = cconv(rn);
504 
505 	/*
506 	 * Print some warnings for comparisons of unsigned values with
507 	 * constants lower than or equal to null. This must be done
508 	 * before promote() because otherwise unsigned char and unsigned
509 	 * short would be promoted to int. Also types are tested to be
510 	 * CHAR, which would also become int.
511 	 */
512 	if (mp->m_comparison)
513 		check_integer_comparison(op, ln, rn);
514 
515 	/*
516 	 * Promote the left operand if it is in a test or value context
517 	 */
518 	if (mp->m_left_value_context || mp->m_left_test_context)
519 		ln = promote(op, false, ln);
520 	/*
521 	 * Promote the right operand, but only if it is no struct or
522 	 * union member, or if it is not to be assigned to the left operand
523 	 */
524 	if (mp->m_binary && op != ARROW && op != POINT &&
525 	    op != ASSIGN && op != RETURN) {
526 		rn = promote(op, false, rn);
527 	}
528 
529 	/*
530 	 * If the result of the operation is different for signed or
531 	 * unsigned operands and one of the operands is signed only in
532 	 * ANSI C, print a warning.
533 	 */
534 	if (mp->m_warn_if_left_unsigned_in_c90 &&
535 	    ln->tn_op == CON && ln->tn_val->v_ansiu) {
536 		/* ANSI C treats constant as unsigned, op %s */
537 		warning(218, mp->m_name);
538 		ln->tn_val->v_ansiu = false;
539 	}
540 	if (mp->m_warn_if_right_unsigned_in_c90 &&
541 	    rn->tn_op == CON && rn->tn_val->v_ansiu) {
542 		/* ANSI C treats constant as unsigned, op %s */
543 		warning(218, mp->m_name);
544 		rn->tn_val->v_ansiu = false;
545 	}
546 
547 	/* Make sure both operands are of the same type */
548 	if (mp->m_balance_operands || (tflag && (op == SHL || op == SHR)))
549 		balance(op, &ln, &rn);
550 
551 	/*
552 	 * Check types for compatibility with the operation and mutual
553 	 * compatibility. Return if there are serious problems.
554 	 */
555 	if (!typeok(op, 0, ln, rn))
556 		return NULL;
557 
558 	/* And now create the node. */
559 	switch (op) {
560 	case POINT:
561 	case ARROW:
562 		ntn = build_struct_access(op, ln, rn);
563 		break;
564 	case INCAFT:
565 	case DECAFT:
566 	case INCBEF:
567 	case DECBEF:
568 		ntn = build_prepost_incdec(op, ln);
569 		break;
570 	case ADDR:
571 		ntn = build_address(ln, false);
572 		break;
573 	case INDIR:
574 		ntn = new_tnode(INDIR, ln->tn_type->t_subt, ln, NULL);
575 		break;
576 	case PLUS:
577 	case MINUS:
578 		ntn = build_plus_minus(op, ln, rn);
579 		break;
580 	case SHL:
581 	case SHR:
582 		ntn = build_bit_shift(op, ln, rn);
583 		break;
584 	case COLON:
585 		ntn = build_colon(ln, rn);
586 		break;
587 	case ASSIGN:
588 	case MULASS:
589 	case DIVASS:
590 	case MODASS:
591 	case ADDASS:
592 	case SUBASS:
593 	case SHLASS:
594 	case SHRASS:
595 	case ANDASS:
596 	case XORASS:
597 	case ORASS:
598 	case RETURN:
599 		ntn = build_assignment(op, ln, rn);
600 		break;
601 	case COMMA:
602 	case QUEST:
603 		ntn = new_tnode(op, rn->tn_type, ln, rn);
604 		break;
605 	case REAL:
606 	case IMAG:
607 		ntn = build_real_imag(op, ln);
608 		break;
609 	default:
610 		rettp = mp->m_returns_bool
611 		    ? gettyp(Tflag ? BOOL : INT) : ln->tn_type;
612 		lint_assert(mp->m_binary || rn == NULL);
613 		ntn = new_tnode(op, rettp, ln, rn);
614 		break;
615 	}
616 
617 	/* Return if an error occurred. */
618 	if (ntn == NULL)
619 		return NULL;
620 
621 	/* Print a warning if precedence confusion is possible */
622 	if (mp->m_possible_precedence_confusion)
623 		check_precedence_confusion(ntn);
624 
625 	/*
626 	 * Print a warning if one of the operands is in a context where
627 	 * it is compared with null and if this operand is a constant.
628 	 */
629 	if (mp->m_left_test_context) {
630 		if (ln->tn_op == CON ||
631 		    ((mp->m_binary && op != QUEST) && rn->tn_op == CON)) {
632 			if (hflag && !constcond_flag &&
633 			    !ln->tn_system_dependent)
634 				/* constant in conditional context */
635 				warning(161);
636 		}
637 	}
638 
639 	/* Fold if the operator requires it */
640 	if (mp->m_fold_constant_operands) {
641 		if (ln->tn_op == CON && (!mp->m_binary || rn->tn_op == CON)) {
642 			if (mp->m_left_test_context) {
643 				ntn = fold_test(ntn);
644 			} else if (is_floating(ntn->tn_type->t_tspec)) {
645 				ntn = fold_float(ntn);
646 			} else {
647 				ntn = fold(ntn);
648 			}
649 		} else if (op == QUEST && ln->tn_op == CON) {
650 			ntn = ln->tn_val->v_quad != 0
651 			    ? rn->tn_left : rn->tn_right;
652 		}
653 	}
654 
655 	return ntn;
656 }
657 
658 /*
659  * Perform class conversions.
660  *
661  * Arrays of type T are converted into pointers to type T.
662  * Functions are converted to pointers to functions.
663  * Lvalues are converted to rvalues.
664  *
665  * C99 6.3 "Conversions"
666  * C99 6.3.2 "Other operands"
667  * C99 6.3.2.1 "Lvalues, arrays, and function designators"
668  */
669 tnode_t *
670 cconv(tnode_t *tn)
671 {
672 	type_t	*tp;
673 
674 	/*
675 	 * Array-lvalue (array of type T) is converted into rvalue
676 	 * (pointer to type T)
677 	 */
678 	if (tn->tn_type->t_tspec == ARRAY) {
679 		if (!tn->tn_lvalue) {
680 			/* XXX print correct operator */
681 			/* %soperand of '%s' must be lvalue */
682 			gnuism(114, "", op_name(ADDR));
683 		}
684 		tn = new_tnode(ADDR,
685 		    expr_derive_type(tn->tn_type->t_subt, PTR), tn, NULL);
686 	}
687 
688 	/*
689 	 * Expression of type function (function with return value of type T)
690 	 * in rvalue-expression (pointer to function with return value
691 	 * of type T)
692 	 */
693 	if (tn->tn_type->t_tspec == FUNC)
694 		tn = build_address(tn, true);
695 
696 	/* lvalue to rvalue */
697 	if (tn->tn_lvalue) {
698 		tp = expr_dup_type(tn->tn_type);
699 		tp->t_const = tp->t_volatile = false;
700 		tn = new_tnode(LOAD, tp, tn, NULL);
701 	}
702 
703 	return tn;
704 }
705 
706 const tnode_t *
707 before_conversion(const tnode_t *tn)
708 {
709 	while (tn->tn_op == CVT && !tn->tn_cast)
710 		tn = tn->tn_left;
711 	return tn;
712 }
713 
714 static bool
715 is_null_pointer(const tnode_t *tn)
716 {
717 	tspec_t t = tn->tn_type->t_tspec;
718 
719 	return ((t == PTR && tn->tn_type->t_subt->t_tspec == VOID) ||
720 		is_integer(t))
721 	       && (tn->tn_op == CON && tn->tn_val->v_quad == 0);
722 }
723 
724 static bool
725 typeok_incdec(op_t op, const tnode_t *tn, const type_t *tp)
726 {
727 	/* operand has scalar type (checked in typeok) */
728 	if (!tn->tn_lvalue) {
729 		if (tn->tn_op == CVT && tn->tn_cast &&
730 		    tn->tn_left->tn_op == LOAD) {
731 			if (tn->tn_type->t_tspec == PTR)
732 				return true;
733 			/* a cast does not yield an lvalue */
734 			error(163);
735 		}
736 		/* %soperand of '%s' must be lvalue */
737 		error(114, "", op_name(op));
738 		return false;
739 	} else if (tp->t_const) {
740 		if (!tflag)
741 			/* %soperand of '%s' must be modifiable lvalue */
742 			warning(115, "", op_name(op));
743 	}
744 	return true;
745 }
746 
747 static bool
748 typeok_address(const mod_t *mp,
749 	    const tnode_t *tn, const type_t *tp, tspec_t t)
750 {
751 	if (t == ARRAY || t == FUNC) {
752 		/* ok, a warning comes later (in build_address()) */
753 	} else if (!tn->tn_lvalue) {
754 		if (tn->tn_op == CVT && tn->tn_cast &&
755 		    tn->tn_left->tn_op == LOAD) {
756 			if (tn->tn_type->t_tspec == PTR)
757 				return true;
758 			/* a cast does not yield an lvalue */
759 			error(163);
760 		}
761 		/* %soperand of '%s' must be lvalue */
762 		error(114, "", mp->m_name);
763 		return false;
764 	} else if (is_scalar(t)) {
765 		if (tp->t_bitfield) {
766 			/* cannot take address of bit-field */
767 			error(112);
768 			return false;
769 		}
770 	} else if (t != STRUCT && t != UNION) {
771 		/* unacceptable operand of '%s' */
772 		error(111, mp->m_name);
773 		return false;
774 	}
775 	if (tn->tn_op == NAME && tn->tn_sym->s_reg) {
776 		/* cannot take address of register %s */
777 		error(113, tn->tn_sym->s_name);
778 		return false;
779 	}
780 	return true;
781 }
782 
783 static bool
784 typeok_star(tspec_t t)
785 {
786 	/* until now there were no type checks for this operator */
787 	if (t != PTR) {
788 		/* cannot dereference non-pointer type */
789 		error(96);
790 		return false;
791 	}
792 	return true;
793 }
794 
795 static bool
796 typeok_plus(op_t op,
797 	    const type_t *ltp, tspec_t lt,
798 	    const type_t *rtp, tspec_t rt)
799 {
800 	/* operands have scalar types (checked above) */
801 	if ((lt == PTR && !is_integer(rt)) || (rt == PTR && !is_integer(lt))) {
802 		warn_incompatible_types(op, ltp, lt, rtp, rt);
803 		return false;
804 	}
805 	return true;
806 }
807 
808 static bool
809 typeok_minus(op_t op,
810 	     const type_t *ltp, tspec_t lt,
811 	     const type_t *rtp, tspec_t rt)
812 {
813 	/* operands have scalar types (checked above) */
814 	if (lt == PTR && (!is_integer(rt) && rt != PTR)) {
815 		warn_incompatible_types(op, ltp, lt, rtp, rt);
816 		return false;
817 	} else if (rt == PTR && lt != PTR) {
818 		warn_incompatible_types(op, ltp, lt, rtp, rt);
819 		return false;
820 	}
821 	if (lt == PTR && rt == PTR) {
822 		if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
823 			/* illegal pointer subtraction */
824 			error(116);
825 		}
826 	}
827 	return true;
828 }
829 
830 static void
831 typeok_shr(const mod_t *mp,
832 	   const tnode_t *ln, tspec_t lt,
833 	   const tnode_t *rn, tspec_t rt)
834 {
835 	tspec_t olt, ort;
836 
837 	olt = before_conversion(ln)->tn_type->t_tspec;
838 	ort = before_conversion(rn)->tn_type->t_tspec;
839 
840 	/* operands have integer types (checked above) */
841 	if (pflag && !is_uinteger(lt)) {
842 		/*
843 		 * The left operand is signed. This means that
844 		 * the operation is (possibly) nonportable.
845 		 */
846 		if (ln->tn_op != CON) {
847 			/* bitwise '%s' on signed value possibly nonportable */
848 			warning(117, mp->m_name);
849 		} else if (ln->tn_val->v_quad < 0) {
850 			/* bitwise '%s' on signed value nonportable */
851 			warning(120, mp->m_name);
852 		}
853 	} else if (!tflag && !sflag && !is_uinteger(olt) && is_uinteger(ort)) {
854 		/*
855 		 * The left operand would become unsigned in
856 		 * traditional C.
857 		 */
858 		if (hflag && !Sflag &&
859 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
860 			/* semantics of '%s' change in ANSI C; use ... */
861 			warning(118, mp->m_name);
862 		}
863 	} else if (!tflag && !sflag && !is_uinteger(olt) && !is_uinteger(ort) &&
864 		   portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
865 		/*
866 		 * In traditional C the left operand would be extended,
867 		 * possibly with 1, and then shifted.
868 		 */
869 		if (hflag && !Sflag &&
870 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
871 			/* semantics of '%s' change in ANSI C; use ... */
872 			warning(118, mp->m_name);
873 		}
874 	}
875 }
876 
877 static void
878 typeok_shl(const mod_t *mp, tspec_t lt, tspec_t rt)
879 {
880 	/*
881 	 * C90 does not perform balancing for shift operations,
882 	 * but traditional C does. If the width of the right operand
883 	 * is greater than the width of the left operand, then in
884 	 * traditional C the left operand would be extended to the
885 	 * width of the right operand. For SHL this may result in
886 	 * different results.
887 	 */
888 	if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
889 		/*
890 		 * XXX If both operands are constant, make sure
891 		 * that there is really a difference between
892 		 * ANSI C and traditional C.
893 		 */
894 		if (hflag && !Sflag)
895 			/* semantics of '%s' change in ANSI C; use ... */
896 			warning(118, mp->m_name);
897 	}
898 }
899 
900 static void
901 typeok_shift(tspec_t lt, const tnode_t *rn, tspec_t rt)
902 {
903 	if (rn->tn_op != CON)
904 		return;
905 
906 	if (!is_uinteger(rt) && rn->tn_val->v_quad < 0) {
907 		/* negative shift */
908 		warning(121);
909 	} else if ((uint64_t)rn->tn_val->v_quad ==
910 		   (uint64_t)size_in_bits(lt)) {
911 		/* shift equal to size of object */
912 		warning(267);
913 	} else if ((uint64_t)rn->tn_val->v_quad > (uint64_t)size_in_bits(lt)) {
914 		/* shift amount %llu is greater than bit-size %llu of '%s' */
915 		warning(122, (unsigned long long)rn->tn_val->v_quad,
916 		    (unsigned long long)size_in_bits(lt),
917 		    tspec_name(lt));
918 	}
919 }
920 
921 static bool
922 is_typeok_eq(const tnode_t *ln, tspec_t lt, const tnode_t *rn, tspec_t rt)
923 {
924 	if (lt == PTR && is_null_pointer(rn))
925 		return true;
926 	if (rt == PTR && is_null_pointer(ln))
927 		return true;
928 	return false;
929 }
930 
931 static bool
932 typeok_ordered_comparison(op_t op,
933 			  const tnode_t *ln, const type_t *ltp, tspec_t lt,
934 			  const tnode_t *rn, const type_t *rtp, tspec_t rt)
935 {
936 	if (lt == PTR && rt == PTR) {
937 		check_pointer_comparison(op, ln, rn);
938 		return true;
939 	}
940 
941 	if (lt != PTR && rt != PTR)
942 		return true;
943 
944 	if (!is_integer(lt) && !is_integer(rt)) {
945 		warn_incompatible_types(op, ltp, lt, rtp, rt);
946 		return false;
947 	}
948 
949 	const char *lx = lt == PTR ? "pointer" : "integer";
950 	const char *rx = rt == PTR ? "pointer" : "integer";
951 	/* illegal combination of %s (%s) and %s (%s), op %s */
952 	warning(123, lx, type_name(ltp), rx, type_name(rtp), op_name(op));
953 	return true;
954 }
955 
956 static bool
957 typeok_quest(tspec_t lt, const tnode_t **rn)
958 {
959 	if (!is_scalar(lt)) {
960 		/* first operand must have scalar type, op ? : */
961 		error(170);
962 		return false;
963 	}
964 	while ((*rn)->tn_op == CVT)
965 		*rn = (*rn)->tn_left;
966 	lint_assert((*rn)->tn_op == COLON);
967 	return true;
968 }
969 
970 static void
971 typeok_colon_pointer(const mod_t *mp, const type_t *ltp, const type_t *rtp)
972 {
973 	type_t *lstp = ltp->t_subt;
974 	type_t *rstp = rtp->t_subt;
975 	tspec_t lst = lstp->t_tspec;
976 	tspec_t rst = rstp->t_tspec;
977 
978 	if ((lst == VOID && rst == FUNC) || (lst == FUNC && rst == VOID)) {
979 		/* (void *)0 handled above */
980 		if (sflag)
981 			/* ANSI C forbids conv. of %s to %s, op %s */
982 			warning(305, "function pointer", "'void *'",
983 			    mp->m_name);
984 		return;
985 	}
986 
987 	if (eqptrtype(lstp, rstp, true))
988 		return;
989 	if (!eqtype(lstp, rstp, true, false, NULL))
990 		warn_incompatible_pointers(mp, ltp, rtp);
991 }
992 
993 static bool
994 typeok_colon(const mod_t *mp,
995 	     const tnode_t *ln, const type_t *ltp, tspec_t lt,
996 	     const tnode_t *rn, const type_t *rtp, tspec_t rt)
997 {
998 
999 	if (is_arithmetic(lt) && is_arithmetic(rt))
1000 		return true;
1001 	if (lt == BOOL && rt == BOOL)
1002 		return true;
1003 
1004 	if (lt == STRUCT && rt == STRUCT && ltp->t_str == rtp->t_str)
1005 		return true;
1006 	if (lt == UNION && rt == UNION && ltp->t_str == rtp->t_str)
1007 		return true;
1008 
1009 	if (lt == PTR && is_null_pointer(rn))
1010 		return true;
1011 	if (rt == PTR && is_null_pointer(ln))
1012 		return true;
1013 
1014 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1015 		const char *lx = lt == PTR ?  "pointer" : "integer";
1016 		const char *rx = rt == PTR ?  "pointer" : "integer";
1017 		/* illegal combination of %s (%s) and %s (%s), op %s */
1018 		warning(123, lx, type_name(ltp),
1019 		    rx, type_name(rtp), mp->m_name);
1020 		return true;
1021 	}
1022 
1023 	if (lt == VOID || rt == VOID) {
1024 		if (lt != VOID || rt != VOID)
1025 			/* incompatible types '%s' and '%s' in conditional */
1026 			warning(126, type_name(ltp), type_name(rtp));
1027 		return true;
1028 	}
1029 
1030 	if (lt == PTR && rt == PTR) {
1031 		typeok_colon_pointer(mp, ltp, rtp);
1032 		return true;
1033 	}
1034 
1035 	/* incompatible types '%s' and '%s' in conditional */
1036 	error(126, type_name(ltp), type_name(rtp));
1037 	return false;
1038 }
1039 
1040 static bool
1041 typeok_assign(const mod_t *mp, const tnode_t *ln, const type_t *ltp, tspec_t lt)
1042 {
1043 	if (!ln->tn_lvalue) {
1044 		if (ln->tn_op == CVT && ln->tn_cast &&
1045 		    ln->tn_left->tn_op == LOAD) {
1046 			if (ln->tn_type->t_tspec == PTR)
1047 				return true;
1048 			/* a cast does not yield an lvalue */
1049 			error(163);
1050 		}
1051 		/* %soperand of '%s' must be lvalue */
1052 		error(114, "left ", mp->m_name);
1053 		return false;
1054 	} else if (ltp->t_const || ((lt == STRUCT || lt == UNION) &&
1055 				    has_constant_member(ltp))) {
1056 		if (!tflag)
1057 			/* %soperand of '%s' must be modifiable lvalue */
1058 			warning(115, "left ", mp->m_name);
1059 	}
1060 	return true;
1061 }
1062 
1063 
1064 
1065 /* Check the types using the information from modtab[]. */
1066 static bool
1067 typeok_scalar(op_t op, const mod_t *mp,
1068 	      const type_t *ltp, tspec_t lt,
1069 	      const type_t *rtp, tspec_t rt)
1070 {
1071 	if (mp->m_takes_bool && lt == BOOL && rt == BOOL)
1072 		return true;
1073 	if (mp->m_requires_integer) {
1074 		if (!is_integer(lt) || (mp->m_binary && !is_integer(rt))) {
1075 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1076 			return false;
1077 		}
1078 	} else if (mp->m_requires_integer_or_complex) {
1079 		if ((!is_integer(lt) && !is_complex(lt)) ||
1080 		    (mp->m_binary && (!is_integer(rt) && !is_complex(rt)))) {
1081 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1082 			return false;
1083 		}
1084 	} else if (mp->m_requires_scalar) {
1085 		if (!is_scalar(lt) || (mp->m_binary && !is_scalar(rt))) {
1086 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1087 			return false;
1088 		}
1089 	} else if (mp->m_requires_arith) {
1090 		if (!is_arithmetic(lt) ||
1091 		    (mp->m_binary && !is_arithmetic(rt))) {
1092 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1093 			return false;
1094 		}
1095 	}
1096 	return true;
1097 }
1098 
1099 /* Check the types for specific operators and type combinations. */
1100 static bool
1101 typeok_op(op_t op, const mod_t *mp, int arg,
1102 	  const tnode_t *ln, const type_t *ltp, tspec_t lt,
1103 	  const tnode_t *rn, const type_t *rtp, tspec_t rt)
1104 {
1105 	switch (op) {
1106 	case POINT:
1107 		/*
1108 		 * Most errors required by ANSI C are reported in
1109 		 * struct_or_union_member().
1110 		 * Here we only must check for totally wrong things.
1111 		 */
1112 		if (lt == FUNC || lt == VOID || ltp->t_bitfield ||
1113 		    ((lt != STRUCT && lt != UNION) && !ln->tn_lvalue)) {
1114 			/* Without tflag we got already an error */
1115 			if (tflag)
1116 				/* unacceptable operand of '%s' */
1117 				error(111, mp->m_name);
1118 			return false;
1119 		}
1120 		/* Now we have an object we can create a pointer to */
1121 		break;
1122 	case ARROW:
1123 		if (lt != PTR && !(tflag && is_integer(lt))) {
1124 			/* Without tflag we got already an error */
1125 			if (tflag)
1126 				/* unacceptable operand of '%s' */
1127 				error(111, mp->m_name);
1128 			return false;
1129 		}
1130 		break;
1131 	case INCAFT:
1132 	case DECAFT:
1133 	case INCBEF:
1134 	case DECBEF:
1135 		if (!typeok_incdec(op, ln, ltp))
1136 			return false;
1137 		break;
1138 	case ADDR:
1139 		if (!typeok_address(mp, ln, ltp, lt))
1140 			return false;
1141 		break;
1142 	case INDIR:
1143 		if (!typeok_star(lt))
1144 			return false;
1145 		break;
1146 	case PLUS:
1147 		if (!typeok_plus(op, ltp, lt, rtp, rt))
1148 			return false;
1149 		break;
1150 	case MINUS:
1151 		if (!typeok_minus(op, ltp, lt, rtp, rt))
1152 			return false;
1153 		break;
1154 	case SHR:
1155 		typeok_shr(mp, ln, lt, rn, rt);
1156 		goto shift;
1157 	case SHL:
1158 		typeok_shl(mp, lt, rt);
1159 	shift:
1160 		typeok_shift(lt, rn, rt);
1161 		break;
1162 	case EQ:
1163 	case NE:
1164 		/*
1165 		 * Accept some things which are allowed with EQ and NE,
1166 		 * but not with ordered comparisons.
1167 		 */
1168 		if (is_typeok_eq(ln, lt, rn, rt))
1169 			break;
1170 		/* FALLTHROUGH */
1171 	case LT:
1172 	case GT:
1173 	case LE:
1174 	case GE:
1175 		if (!typeok_ordered_comparison(op, ln, ltp, lt, rn, rtp, rt))
1176 			return false;
1177 		break;
1178 	case QUEST:
1179 		if (!typeok_quest(lt, &rn))
1180 			return false;
1181 		break;
1182 	case COLON:
1183 		if (!typeok_colon(mp, ln, ltp, lt, rn, rtp, rt))
1184 			return false;
1185 		break;
1186 	case ASSIGN:
1187 	case INIT:
1188 	case FARG:
1189 	case RETURN:
1190 		if (!check_assign_types_compatible(op, arg, ln, rn))
1191 			return false;
1192 		goto assign;
1193 	case MULASS:
1194 	case DIVASS:
1195 	case MODASS:
1196 		goto assign;
1197 	case ADDASS:
1198 	case SUBASS:
1199 		/* operands have scalar types (checked above) */
1200 		if ((lt == PTR && !is_integer(rt)) || rt == PTR) {
1201 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1202 			return false;
1203 		}
1204 		goto assign;
1205 	case SHLASS:
1206 		goto assign;
1207 	case SHRASS:
1208 		if (pflag && !is_uinteger(lt) && !(tflag && is_uinteger(rt))) {
1209 			/* bitwise '%s' on signed value possibly nonportable */
1210 			warning(117, mp->m_name);
1211 		}
1212 		goto assign;
1213 	case ANDASS:
1214 	case XORASS:
1215 	case ORASS:
1216 		goto assign;
1217 	assign:
1218 		if (!typeok_assign(mp, ln, ltp, lt))
1219 			return false;
1220 		break;
1221 	case COMMA:
1222 		if (!modtab[ln->tn_op].m_has_side_effect)
1223 			check_null_effect(ln);
1224 		break;
1225 		/* LINTED206: (enumeration values not handled in switch) */
1226 	case CON:
1227 	case CASE:
1228 	case PUSH:
1229 	case LOAD:
1230 	case ICALL:
1231 	case CVT:
1232 	case CALL:
1233 	case FSEL:
1234 	case STRING:
1235 	case NAME:
1236 	case LOGOR:
1237 	case LOGAND:
1238 	case BITOR:
1239 	case BITXOR:
1240 	case BITAND:
1241 	case MOD:
1242 	case DIV:
1243 	case MULT:
1244 	case UMINUS:
1245 	case UPLUS:
1246 	case DEC:
1247 	case INC:
1248 	case COMPL:
1249 	case NOT:
1250 	case NOOP:
1251 	case REAL:
1252 	case IMAG:
1253 		break;
1254 	}
1255 	return true;
1256 }
1257 
1258 static void
1259 typeok_enum(op_t op, const mod_t *mp, int arg,
1260 	    const tnode_t *ln, const type_t *ltp,
1261 	    const tnode_t *rn, const type_t *rtp)
1262 {
1263 	if (mp->m_bad_on_enum &&
1264 	    (ltp->t_is_enum || (mp->m_binary && rtp->t_is_enum))) {
1265 		check_bad_enum_operation(op, ln, rn);
1266 	} else if (mp->m_valid_on_enum &&
1267 		   (ltp->t_is_enum && rtp != NULL && rtp->t_is_enum)) {
1268 		check_enum_type_mismatch(op, arg, ln, rn);
1269 	} else if (mp->m_valid_on_enum &&
1270 		   (ltp->t_is_enum || (rtp != NULL && rtp->t_is_enum))) {
1271 		check_enum_int_mismatch(op, arg, ln, rn);
1272 	}
1273 }
1274 
1275 /* Perform most type checks. Return whether the types are ok. */
1276 bool
1277 typeok(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1278 {
1279 	const mod_t *mp;
1280 	tspec_t	lt, rt;
1281 	type_t	*ltp, *rtp;
1282 
1283 	mp = &modtab[op];
1284 
1285 	lint_assert((ltp = ln->tn_type) != NULL);
1286 	lt = ltp->t_tspec;
1287 
1288 	if (mp->m_binary) {
1289 		lint_assert((rtp = rn->tn_type) != NULL);
1290 		rt = rtp->t_tspec;
1291 	} else {
1292 		rtp = NULL;
1293 		rt = NOTSPEC;
1294 	}
1295 
1296 	if (Tflag && !typeok_scalar_strict_bool(op, mp, arg, ln, rn))
1297 		return false;
1298 	if (!typeok_scalar(op, mp, ltp, lt, rtp, rt))
1299 		return false;
1300 
1301 	if (!typeok_op(op, mp, arg, ln, ltp, lt, rn, rtp, rt))
1302 		return false;
1303 
1304 	typeok_enum(op, mp, arg, ln, ltp, rn, rtp);
1305 	return true;
1306 }
1307 
1308 static void
1309 check_pointer_comparison(op_t op, const tnode_t *ln, const tnode_t *rn)
1310 {
1311 	type_t	*ltp, *rtp;
1312 	tspec_t	lst, rst;
1313 	const	char *lsts, *rsts;
1314 
1315 	lst = (ltp = ln->tn_type)->t_subt->t_tspec;
1316 	rst = (rtp = rn->tn_type)->t_subt->t_tspec;
1317 
1318 	if (lst == VOID || rst == VOID) {
1319 		if (sflag && (lst == FUNC || rst == FUNC)) {
1320 			/* (void *)0 already handled in typeok() */
1321 			*(lst == FUNC ? &lsts : &rsts) = "function pointer";
1322 			*(lst == VOID ? &lsts : &rsts) = "'void *'";
1323 			/* ANSI C forbids comparison of %s with %s */
1324 			warning(274, lsts, rsts);
1325 		}
1326 		return;
1327 	}
1328 
1329 	if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
1330 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1331 		return;
1332 	}
1333 
1334 	if (lst == FUNC && rst == FUNC) {
1335 		if (sflag && op != EQ && op != NE)
1336 			/* ANSI C forbids ordered comparisons of ... */
1337 			warning(125);
1338 	}
1339 }
1340 
1341 /*
1342  * Checks type compatibility for ASSIGN, INIT, FARG and RETURN
1343  * and prints warnings/errors if necessary.
1344  * If the types are (almost) compatible, 1 is returned, otherwise 0.
1345  */
1346 static bool
1347 check_assign_types_compatible(op_t op, int arg,
1348 			      const tnode_t *ln, const tnode_t *rn)
1349 {
1350 	tspec_t	lt, rt, lst = NOTSPEC, rst = NOTSPEC;
1351 	type_t	*ltp, *rtp, *lstp = NULL, *rstp = NULL;
1352 	const mod_t *mp;
1353 	const	char *lts, *rts;
1354 
1355 	if ((lt = (ltp = ln->tn_type)->t_tspec) == PTR)
1356 		lst = (lstp = ltp->t_subt)->t_tspec;
1357 	if ((rt = (rtp = rn->tn_type)->t_tspec) == PTR)
1358 		rst = (rstp = rtp->t_subt)->t_tspec;
1359 	mp = &modtab[op];
1360 
1361 	if (lt == BOOL && is_scalar(rt))	/* C99 6.3.1.2 */
1362 		return true;
1363 
1364 	if (is_arithmetic(lt) && (is_arithmetic(rt) || rt == BOOL))
1365 		return true;
1366 
1367 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION))
1368 		/* both are struct or union */
1369 		return ltp->t_str == rtp->t_str;
1370 
1371 	/* a null pointer may be assigned to any pointer */
1372 	if (lt == PTR && is_null_pointer(rn))
1373 		return true;
1374 
1375 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID)) {
1376 		/* two pointers, at least one pointer to void */
1377 		if (sflag && (lst == FUNC || rst == FUNC)) {
1378 			/* comb. of ptr to func and ptr to void */
1379 			*(lst == FUNC ? &lts : &rts) = "function pointer";
1380 			*(lst == VOID ? &lts : &rts) = "'void *'";
1381 			switch (op) {
1382 			case INIT:
1383 			case RETURN:
1384 				/* ANSI C forbids conversion of %s to %s */
1385 				warning(303, rts, lts);
1386 				break;
1387 			case FARG:
1388 				/* ANSI C forbids conv. of %s to %s, arg #%d */
1389 				warning(304, rts, lts, arg);
1390 				break;
1391 			default:
1392 				/* ANSI C forbids conv. of %s to %s, op %s */
1393 				warning(305, rts, lts, mp->m_name);
1394 				break;
1395 			}
1396 		}
1397 	}
1398 
1399 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID ||
1400 				       eqtype(lstp, rstp, true, false, NULL))) {
1401 		/* compatible pointer types (qualifiers ignored) */
1402 		if (!tflag &&
1403 		    ((!lstp->t_const && rstp->t_const) ||
1404 		     (!lstp->t_volatile && rstp->t_volatile))) {
1405 			/* left side has not all qualifiers of right */
1406 			switch (op) {
1407 			case INIT:
1408 			case RETURN:
1409 				/* incompatible pointer types (%s != %s) */
1410 				warning(182, type_name(lstp), type_name(rstp));
1411 				break;
1412 			case FARG:
1413 				/* converting '%s' to incompatible '%s' ... */
1414 				warning(153,
1415 				    type_name(rtp), type_name(ltp), arg);
1416 				break;
1417 			default:
1418 				/* operands have incompatible pointer type... */
1419 				warning(128, mp->m_name,
1420 				    type_name(lstp), type_name(rstp));
1421 				break;
1422 			}
1423 		}
1424 		return true;
1425 	}
1426 
1427 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1428 		const char *lx = lt == PTR ? "pointer" : "integer";
1429 		const char *rx = rt == PTR ? "pointer" : "integer";
1430 
1431 		switch (op) {
1432 		case INIT:
1433 		case RETURN:
1434 			/* illegal combination of %s (%s) and %s (%s) */
1435 			warning(183, lx, type_name(ltp), rx, type_name(rtp));
1436 			break;
1437 		case FARG:
1438 			/* illegal comb. of %s (%s) and %s (%s), arg #%d */
1439 			warning(154,
1440 			    lx, type_name(ltp), rx, type_name(rtp), arg);
1441 			break;
1442 		default:
1443 			/* illegal combination of %s (%s) and %s (%s), op %s */
1444 			warning(123,
1445 			    lx, type_name(ltp), rx, type_name(rtp), mp->m_name);
1446 			break;
1447 		}
1448 		return true;
1449 	}
1450 
1451 	if (lt == PTR && rt == PTR) {
1452 		switch (op) {
1453 		case INIT:
1454 		case RETURN:
1455 			warn_incompatible_pointers(NULL, ltp, rtp);
1456 			break;
1457 		case FARG:
1458 			/* converting '%s' to incompatible '%s' for ... */
1459 			warning(153, type_name(rtp), type_name(ltp), arg);
1460 			break;
1461 		default:
1462 			warn_incompatible_pointers(mp, ltp, rtp);
1463 			break;
1464 		}
1465 		return true;
1466 	}
1467 
1468 	switch (op) {
1469 	case INIT:
1470 		/* cannot initialize '%s' from '%s' */
1471 		error(185, type_name(ltp), type_name(rtp));
1472 		break;
1473 	case RETURN:
1474 		/* return value type mismatch (%s) and (%s) */
1475 		error(211, type_name(ltp), type_name(rtp));
1476 		break;
1477 	case FARG:
1478 		/* argument is incompatible with prototype, arg #%d */
1479 		warning(155, arg);
1480 		break;
1481 	default:
1482 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1483 		break;
1484 	}
1485 
1486 	return false;
1487 }
1488 
1489 /* Prints a warning if a strange operator is used on an enum type. */
1490 static void
1491 check_bad_enum_operation(op_t op, const tnode_t *ln, const tnode_t *rn)
1492 {
1493 
1494 	if (!eflag)
1495 		return;
1496 
1497 	if (!(ln->tn_type->t_is_enum ||
1498 	      (modtab[op].m_binary && rn->tn_type->t_is_enum))) {
1499 		return;
1500 	}
1501 
1502 	/*
1503 	 * Enum as offset to a pointer is an exception (otherwise enums
1504 	 * could not be used as array indices).
1505 	 */
1506 	if (op == PLUS &&
1507 	    ((ln->tn_type->t_is_enum && rn->tn_type->t_tspec == PTR) ||
1508 	     (rn->tn_type->t_is_enum && ln->tn_type->t_tspec == PTR))) {
1509 		return;
1510 	}
1511 
1512 	/* dubious operation on enum, op %s */
1513 	warning(241, op_name(op));
1514 
1515 }
1516 
1517 /*
1518  * Prints a warning if an operator is applied to two different enum types.
1519  */
1520 static void
1521 check_enum_type_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1522 {
1523 	const mod_t *mp;
1524 
1525 	mp = &modtab[op];
1526 
1527 	if (ln->tn_type->t_enum != rn->tn_type->t_enum) {
1528 		switch (op) {
1529 		case INIT:
1530 			/* enum type mismatch between '%s' and '%s' in ... */
1531 			warning(210,
1532 			    type_name(ln->tn_type), type_name(rn->tn_type));
1533 			break;
1534 		case FARG:
1535 			/* enum type mismatch, arg #%d (%s != %s) */
1536 			warning(156, arg,
1537 			    type_name(ln->tn_type), type_name(rn->tn_type));
1538 			break;
1539 		case RETURN:
1540 			/* return value type mismatch (%s) and (%s) */
1541 			warning(211,
1542 			    type_name(ln->tn_type), type_name(rn->tn_type));
1543 			break;
1544 		default:
1545 			/* enum type mismatch: '%s' '%s' '%s' */
1546 			warning(130, type_name(ln->tn_type), mp->m_name,
1547 			    type_name(rn->tn_type));
1548 			break;
1549 		}
1550 	} else if (Pflag && mp->m_comparison && op != EQ && op != NE) {
1551 		if (eflag)
1552 			/* dubious comparison of enums, op %s */
1553 			warning(243, mp->m_name);
1554 	}
1555 }
1556 
1557 /* Prints a warning if the operands mix between enum and integer. */
1558 static void
1559 check_enum_int_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1560 {
1561 
1562 	if (!eflag)
1563 		return;
1564 
1565 	switch (op) {
1566 	case INIT:
1567 		/*
1568 		 * Initialization with 0 is allowed. Otherwise, all implicit
1569 		 * initializations would need to be warned upon as well.
1570 		 */
1571 		if (!rn->tn_type->t_is_enum && rn->tn_op == CON &&
1572 		    is_integer(rn->tn_type->t_tspec) &&
1573 		    rn->tn_val->v_quad == 0) {
1574 			return;
1575 		}
1576 		/* initialization of '%s' with '%s' */
1577 		warning(277, type_name(ln->tn_type), type_name(rn->tn_type));
1578 		break;
1579 	case FARG:
1580 		/* combination of '%s' and '%s', arg #%d */
1581 		warning(278,
1582 		    type_name(ln->tn_type), type_name(rn->tn_type), arg);
1583 		break;
1584 	case RETURN:
1585 		/* combination of '%s' and '%s' in return */
1586 		warning(279, type_name(ln->tn_type), type_name(rn->tn_type));
1587 		break;
1588 	default:
1589 		/* combination of '%s' and '%s', op %s */
1590 		warning(242, type_name(ln->tn_type), type_name(rn->tn_type),
1591 		    op_name(op));
1592 		break;
1593 	}
1594 }
1595 
1596 /*
1597  * Build and initialize a new node.
1598  */
1599 static tnode_t *
1600 new_tnode(op_t op, type_t *type, tnode_t *ln, tnode_t *rn)
1601 {
1602 	tnode_t	*ntn;
1603 	tspec_t	t;
1604 #ifdef notyet
1605 	size_t l;
1606 	uint64_t rnum;
1607 #endif
1608 
1609 	ntn = expr_zalloc_tnode();
1610 
1611 	ntn->tn_op = op;
1612 	ntn->tn_type = type;
1613 	if (ln->tn_from_system_header)
1614 		ntn->tn_from_system_header = true;
1615 	if (rn != NULL && rn->tn_from_system_header)
1616 		ntn->tn_from_system_header = true;
1617 	ntn->tn_left = ln;
1618 	ntn->tn_right = rn;
1619 
1620 	switch (op) {
1621 #ifdef notyet
1622 	case SHR:
1623 		if (rn->tn_op != CON)
1624 			break;
1625 		rnum = rn->tn_val->v_quad;
1626 		l = type_size_in_bits(ln->tn_type) / CHAR_SIZE;
1627 		t = ln->tn_type->t_tspec;
1628 		switch (l) {
1629 		case 8:
1630 			if (rnum >= 56)
1631 				t = UCHAR;
1632 			else if (rnum >= 48)
1633 				t = USHORT;
1634 			else if (rnum >= 32)
1635 				t = UINT;
1636 			break;
1637 		case 4:
1638 			if (rnum >= 24)
1639 				t = UCHAR;
1640 			else if (rnum >= 16)
1641 				t = USHORT;
1642 			break;
1643 		case 2:
1644 			if (rnum >= 8)
1645 				t = UCHAR;
1646 			break;
1647 		default:
1648 			break;
1649 		}
1650 		if (t != ln->tn_type->t_tspec)
1651 			ntn->tn_type->t_tspec = t;
1652 		break;
1653 #endif
1654 	case INDIR:
1655 	case FSEL:
1656 		lint_assert(ln->tn_type->t_tspec == PTR);
1657 		t = ln->tn_type->t_subt->t_tspec;
1658 		if (t != FUNC && t != VOID)
1659 			ntn->tn_lvalue = true;
1660 		break;
1661 	default:
1662 		break;
1663 	}
1664 
1665 	return ntn;
1666 }
1667 
1668 /*
1669  * Performs the "integer promotions" (C99 6.3.1.1p2), which convert small
1670  * integer types to either int or unsigned int.
1671  *
1672  * If tflag is set or the operand is a function argument with no type
1673  * information (no prototype or variable # of args), converts float to double.
1674  */
1675 tnode_t *
1676 promote(op_t op, bool farg, tnode_t *tn)
1677 {
1678 	tspec_t	t;
1679 	type_t	*ntp;
1680 	u_int	len;
1681 
1682 	t = tn->tn_type->t_tspec;
1683 
1684 	if (!is_arithmetic(t))
1685 		return tn;
1686 
1687 	if (!tflag) {
1688 		/*
1689 		 * ANSI C requires that the result is always of type INT
1690 		 * if INT can represent all possible values of the previous
1691 		 * type.
1692 		 */
1693 		if (tn->tn_type->t_bitfield) {
1694 			len = tn->tn_type->t_flen;
1695 			if (size_in_bits(INT) > len) {
1696 				t = INT;
1697 			} else {
1698 				lint_assert(len == size_in_bits(INT));
1699 				if (is_uinteger(t)) {
1700 					t = UINT;
1701 				} else {
1702 					t = INT;
1703 				}
1704 			}
1705 		} else if (t == CHAR || t == UCHAR || t == SCHAR) {
1706 			t = (size_in_bits(CHAR) < size_in_bits(INT)
1707 			     || t != UCHAR) ? INT : UINT;
1708 		} else if (t == SHORT || t == USHORT) {
1709 			t = (size_in_bits(SHORT) < size_in_bits(INT)
1710 			     || t == SHORT) ? INT : UINT;
1711 		} else if (t == ENUM) {
1712 			t = INT;
1713 		} else if (farg && t == FLOAT) {
1714 			t = DOUBLE;
1715 		}
1716 	} else {
1717 		/*
1718 		 * In traditional C, keep unsigned and promote FLOAT
1719 		 * to DOUBLE.
1720 		 */
1721 		if (t == UCHAR || t == USHORT) {
1722 			t = UINT;
1723 		} else if (t == CHAR || t == SCHAR || t == SHORT) {
1724 			t = INT;
1725 		} else if (t == FLOAT) {
1726 			t = DOUBLE;
1727 		} else if (t == ENUM) {
1728 			t = INT;
1729 		}
1730 	}
1731 
1732 	if (t != tn->tn_type->t_tspec) {
1733 		ntp = expr_dup_type(tn->tn_type);
1734 		ntp->t_tspec = t;
1735 		/*
1736 		 * Keep t_is_enum so we are later able to check compatibility
1737 		 * of enum types.
1738 		 */
1739 		tn = convert(op, 0, ntp, tn);
1740 	}
1741 
1742 	return tn;
1743 }
1744 
1745 /*
1746  * Apply the "usual arithmetic conversions" (C99 6.3.1.8).
1747  *
1748  * This gives both operands the same type.
1749  * This is done in different ways for traditional C and C90.
1750  */
1751 static void
1752 balance(op_t op, tnode_t **lnp, tnode_t **rnp)
1753 {
1754 	tspec_t	lt, rt, t;
1755 	int	i;
1756 	bool	u;
1757 	type_t	*ntp;
1758 	static const tspec_t tl[] = {
1759 		LDOUBLE, DOUBLE, FLOAT, UQUAD, QUAD, ULONG, LONG, UINT, INT,
1760 	};
1761 
1762 	lt = (*lnp)->tn_type->t_tspec;
1763 	rt = (*rnp)->tn_type->t_tspec;
1764 
1765 	if (!is_arithmetic(lt) || !is_arithmetic(rt))
1766 		return;
1767 
1768 	if (!tflag) {
1769 		if (lt == rt) {
1770 			t = lt;
1771 		} else if (lt == LCOMPLEX || rt == LCOMPLEX) {
1772 			t = LCOMPLEX;
1773 		} else if (lt == DCOMPLEX || rt == DCOMPLEX) {
1774 			t = DCOMPLEX;
1775 		} else if (lt == COMPLEX || rt == COMPLEX) {
1776 			t = COMPLEX;
1777 		} else if (lt == FCOMPLEX || rt == FCOMPLEX) {
1778 			t = FCOMPLEX;
1779 		} else if (lt == LDOUBLE || rt == LDOUBLE) {
1780 			t = LDOUBLE;
1781 		} else if (lt == DOUBLE || rt == DOUBLE) {
1782 			t = DOUBLE;
1783 		} else if (lt == FLOAT || rt == FLOAT) {
1784 			t = FLOAT;
1785 		} else {
1786 			/*
1787 			 * If type A has more bits than type B it should
1788 			 * be able to hold all possible values of type B.
1789 			 */
1790 			if (size_in_bits(lt) > size_in_bits(rt)) {
1791 				t = lt;
1792 			} else if (size_in_bits(lt) < size_in_bits(rt)) {
1793 				t = rt;
1794 			} else {
1795 				for (i = 3; tl[i] != INT; i++) {
1796 					if (tl[i] == lt || tl[i] == rt)
1797 						break;
1798 				}
1799 				if ((is_uinteger(lt) || is_uinteger(rt)) &&
1800 				    !is_uinteger(tl[i])) {
1801 					i--;
1802 				}
1803 				t = tl[i];
1804 			}
1805 		}
1806 	} else {
1807 		/* Keep unsigned in traditional C */
1808 		u = is_uinteger(lt) || is_uinteger(rt);
1809 		for (i = 0; tl[i] != INT; i++) {
1810 			if (lt == tl[i] || rt == tl[i])
1811 				break;
1812 		}
1813 		t = tl[i];
1814 		if (u && is_integer(t) && !is_uinteger(t))
1815 			t = unsigned_type(t);
1816 	}
1817 
1818 	if (t != lt) {
1819 		ntp = expr_dup_type((*lnp)->tn_type);
1820 		ntp->t_tspec = t;
1821 		*lnp = convert(op, 0, ntp, *lnp);
1822 	}
1823 	if (t != rt) {
1824 		ntp = expr_dup_type((*rnp)->tn_type);
1825 		ntp->t_tspec = t;
1826 		*rnp = convert(op, 0, ntp, *rnp);
1827 	}
1828 }
1829 
1830 /*
1831  * Insert a conversion operator, which converts the type of the node
1832  * to another given type.
1833  * If op is FARG, arg is the number of the argument (used for warnings).
1834  */
1835 tnode_t *
1836 convert(op_t op, int arg, type_t *tp, tnode_t *tn)
1837 {
1838 	tnode_t	*ntn;
1839 	tspec_t	nt, ot;
1840 
1841 	nt = tp->t_tspec;
1842 	ot = tn->tn_type->t_tspec;
1843 
1844 	if (!tflag && !sflag && op == FARG)
1845 		check_prototype_conversion(arg, nt, ot, tp, tn);
1846 	if (is_integer(nt) && is_integer(ot)) {
1847 		check_integer_conversion(op, arg, nt, ot, tp, tn);
1848 	} else if (nt == PTR && is_null_pointer(tn)) {
1849 		/* a null pointer may be assigned to any pointer. */
1850 	} else if (is_integer(nt) && nt != BOOL && ot == PTR) {
1851 		check_pointer_integer_conversion(op, nt, tp, tn);
1852 	} else if (nt == PTR && ot == PTR) {
1853 		check_pointer_conversion(op, tn, tp);
1854 	}
1855 
1856 	ntn = expr_zalloc_tnode();
1857 	ntn->tn_op = CVT;
1858 	ntn->tn_type = tp;
1859 	ntn->tn_cast = op == CVT;
1860 	ntn->tn_from_system_header |= tn->tn_from_system_header;
1861 	ntn->tn_right = NULL;
1862 	if (tn->tn_op != CON || nt == VOID) {
1863 		ntn->tn_left = tn;
1864 	} else {
1865 		ntn->tn_op = CON;
1866 		ntn->tn_val = expr_zalloc(sizeof(*ntn->tn_val));
1867 		convert_constant(op, arg, ntn->tn_type, ntn->tn_val,
1868 		    tn->tn_val);
1869 	}
1870 
1871 	return ntn;
1872 }
1873 
1874 /*
1875  * Print a warning if a prototype causes a type conversion that is
1876  * different from what would happen to the same argument in the
1877  * absence of a prototype.
1878  *
1879  * Errors/warnings about illegal type combinations are already printed
1880  * in check_assign_types_compatible().
1881  */
1882 static void
1883 check_prototype_conversion(int arg, tspec_t nt, tspec_t ot, type_t *tp,
1884 			   tnode_t *tn)
1885 {
1886 	tnode_t	*ptn;
1887 
1888 	if (!is_arithmetic(nt) || !is_arithmetic(ot))
1889 		return;
1890 
1891 	/*
1892 	 * If the type of the formal parameter is char/short, a warning
1893 	 * would be useless, because functions declared the old style
1894 	 * can't expect char/short arguments.
1895 	 */
1896 	/* XXX: what about SCHAR? */
1897 	if (nt == CHAR || nt == UCHAR || nt == SHORT || nt == USHORT)
1898 		return;
1899 
1900 	/* get default promotion */
1901 	ptn = promote(NOOP, true, tn);
1902 	ot = ptn->tn_type->t_tspec;
1903 
1904 	/* return if types are the same with and without prototype */
1905 	if (nt == ot || (nt == ENUM && ot == INT))
1906 		return;
1907 
1908 	if (is_floating(nt) != is_floating(ot) ||
1909 	    portable_size_in_bits(nt) != portable_size_in_bits(ot)) {
1910 		/* representation and/or width change */
1911 		if (!is_integer(ot) ||
1912 		    portable_size_in_bits(ot) > portable_size_in_bits(INT)) {
1913 			/* argument #%d is converted from '%s' to '%s' ... */
1914 			warning(259,
1915 			    arg, type_name(tn->tn_type), type_name(tp));
1916 		}
1917 	} else if (hflag) {
1918 		/*
1919 		 * they differ in sign or base type (char, short, int,
1920 		 * long, long long, float, double, long double)
1921 		 *
1922 		 * if they differ only in sign and the argument is a constant
1923 		 * and the msb of the argument is not set, print no warning
1924 		 */
1925 		if (ptn->tn_op == CON && is_integer(nt) &&
1926 		    signed_type(nt) == signed_type(ot) &&
1927 		    msb(ptn->tn_val->v_quad, ot, -1) == 0) {
1928 			/* ok */
1929 		} else {
1930 			/* argument #%d is converted from '%s' to '%s' ... */
1931 			warning(259,
1932 			    arg, type_name(tn->tn_type), type_name(tp));
1933 		}
1934 	}
1935 }
1936 
1937 /*
1938  * Print warnings for conversions of integer types which may cause problems.
1939  */
1940 /* ARGSUSED */
1941 static void
1942 check_integer_conversion(op_t op, int arg, tspec_t nt, tspec_t ot, type_t *tp,
1943 			 tnode_t *tn)
1944 {
1945 	char opbuf[16];
1946 
1947 	if (tn->tn_op == CON)
1948 		return;
1949 
1950 	if (op == CVT)
1951 		return;
1952 
1953 	if (Sflag && nt == BOOL)
1954 		return;		/* See C99 6.3.1.2 */
1955 
1956 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
1957 	    is_uinteger(nt) != is_uinteger(ot)) {
1958 		if (aflag > 0 && pflag) {
1959 			if (op == FARG) {
1960 				/* conversion to '%s' may sign-extend ... */
1961 				warning(297, type_name(tp), arg);
1962 			} else {
1963 				/* conversion to '%s' may sign-extend ... */
1964 				warning(131, type_name(tp));
1965 			}
1966 		}
1967 	}
1968 
1969 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot)) {
1970 		switch (tn->tn_op) {
1971 		case PLUS:
1972 		case MINUS:
1973 		case MULT:
1974 		case SHL:
1975 			/* suggest cast from '%s' to '%s' on op %s to ... */
1976 			warning(324, type_name(gettyp(ot)), type_name(tp),
1977 			    print_tnode(opbuf, sizeof(opbuf), tn));
1978 			break;
1979 		default:
1980 			break;
1981 		}
1982 	}
1983 
1984 	if (portable_size_in_bits(nt) < portable_size_in_bits(ot) &&
1985 	    (ot == LONG || ot == ULONG || ot == QUAD || ot == UQUAD ||
1986 	     aflag > 1)) {
1987 		/* conversion from '%s' may lose accuracy */
1988 		if (aflag > 0) {
1989 			if (op == FARG) {
1990 				/* conv. from '%s' to '%s' may lose ... */
1991 				warning(298,
1992 				    type_name(tn->tn_type), type_name(tp), arg);
1993 			} else {
1994 				/* conv. from '%s' to '%s' may lose accuracy */
1995 				warning(132,
1996 				    type_name(tn->tn_type), type_name(tp));
1997 			}
1998 		}
1999 	}
2000 }
2001 
2002 /*
2003  * Print warnings for dubious conversions of pointer to integer.
2004  */
2005 static void
2006 check_pointer_integer_conversion(op_t op, tspec_t nt, type_t *tp, tnode_t *tn)
2007 {
2008 
2009 	if (tn->tn_op == CON)
2010 		return;
2011 	if (op != CVT)
2012 		return;		/* We got already an error. */
2013 	if (portable_size_in_bits(nt) >= portable_size_in_bits(PTR))
2014 		return;
2015 
2016 	if (pflag && size_in_bits(nt) >= size_in_bits(PTR)) {
2017 		/* conversion of pointer to '%s' may lose bits */
2018 		warning(134, type_name(tp));
2019 	} else {
2020 		/* conversion of pointer to '%s' loses bits */
2021 		warning(133, type_name(tp));
2022 	}
2023 }
2024 
2025 static bool
2026 should_warn_about_pointer_cast(const type_t *tp, tspec_t nst,
2027 			       const tnode_t *tn, tspec_t ost)
2028 {
2029 	if (nst == STRUCT || nst == UNION)
2030 		if (tp->t_subt->t_str != tn->tn_type->t_subt->t_str)
2031 			return true;
2032 
2033 	if (nst == CHAR || nst == UCHAR)
2034 		return false;	/* for the sake of traditional C code */
2035 
2036 	return portable_size_in_bits(nst) != portable_size_in_bits(ost);
2037 }
2038 
2039 /*
2040  * Warn about questionable pointer conversions.
2041  */
2042 static void
2043 check_pointer_conversion(op_t op, tnode_t *tn, type_t *tp)
2044 {
2045 	tspec_t nst, ost;
2046 	const char *nts, *ots;
2047 
2048 	/*
2049 	 * We got already an error (pointers of different types
2050 	 * without a cast) or we will not get a warning.
2051 	 */
2052 	if (op != CVT)
2053 		return;
2054 
2055 	nst = tp->t_subt->t_tspec;
2056 	ost = tn->tn_type->t_subt->t_tspec;
2057 
2058 	if (nst == VOID || ost == VOID) {
2059 		if (sflag && (nst == FUNC || ost == FUNC)) {
2060 			/* null pointers are already handled in convert() */
2061 			*(nst == FUNC ? &nts : &ots) = "function pointer";
2062 			*(nst == VOID ? &nts : &ots) = "'void *'";
2063 			/* ANSI C forbids conversion of %s to %s */
2064 			warning(303, ots, nts);
2065 		}
2066 		return;
2067 	} else if (nst == FUNC && ost == FUNC) {
2068 		return;
2069 	} else if (nst == FUNC || ost == FUNC) {
2070 		/* converting '%s' to '%s' is questionable */
2071 		warning(229, type_name(tn->tn_type), type_name(tp));
2072 		return;
2073 	}
2074 
2075 	if (hflag && alignment_in_bits(tp->t_subt) >
2076 		     alignment_in_bits(tn->tn_type->t_subt)) {
2077 		/* converting '%s' to '%s' may cause alignment problem */
2078 		warning(135, type_name(tn->tn_type), type_name(tp));
2079 	}
2080 
2081 	if (cflag && should_warn_about_pointer_cast(tp, nst, tn, ost)) {
2082 		/* pointer cast from '%s' to '%s' may be troublesome */
2083 		warning(247, type_name(tn->tn_type), type_name(tp));
2084 	}
2085 }
2086 
2087 /*
2088  * Converts a typed constant to a constant of another type.
2089  *
2090  * op		operator which requires conversion
2091  * arg		if op is FARG, # of argument
2092  * tp		type in which to convert the constant
2093  * nv		new constant
2094  * v		old constant
2095  */
2096 void
2097 convert_constant(op_t op, int arg, const type_t *tp, val_t *nv, val_t *v)
2098 {
2099 	tspec_t	ot, nt;
2100 	ldbl_t	max = 0.0, min = 0.0;
2101 	int	sz;
2102 	bool	rchk;
2103 	int64_t	xmask, xmsk1;
2104 	int	osz, nsz;
2105 
2106 	ot = v->v_tspec;
2107 	nt = nv->v_tspec = tp->t_tspec;
2108 	rchk = false;
2109 
2110 	if (nt == BOOL) {	/* C99 6.3.1.2 */
2111 		nv->v_ansiu = false;
2112 		nv->v_quad = is_nonzero_val(v) ? 1 : 0;
2113 		return;
2114 	}
2115 
2116 	if (ot == FLOAT || ot == DOUBLE || ot == LDOUBLE) {
2117 		switch (nt) {
2118 		case CHAR:
2119 			max = TARG_CHAR_MAX;	min = TARG_CHAR_MIN;	break;
2120 		case UCHAR:
2121 			max = TARG_UCHAR_MAX;	min = 0;		break;
2122 		case SCHAR:
2123 			max = TARG_SCHAR_MAX;	min = TARG_SCHAR_MIN;	break;
2124 		case SHORT:
2125 			max = TARG_SHRT_MAX;	min = TARG_SHRT_MIN;	break;
2126 		case USHORT:
2127 			max = TARG_USHRT_MAX;	min = 0;		break;
2128 		case ENUM:
2129 		case INT:
2130 			max = TARG_INT_MAX;	min = TARG_INT_MIN;	break;
2131 		case UINT:
2132 			max = (u_int)TARG_UINT_MAX;min = 0;		break;
2133 		case LONG:
2134 			max = TARG_LONG_MAX;	min = TARG_LONG_MIN;	break;
2135 		case ULONG:
2136 			max = (u_long)TARG_ULONG_MAX; min = 0;		break;
2137 		case QUAD:
2138 			max = QUAD_MAX;		min = QUAD_MIN;		break;
2139 		case UQUAD:
2140 			max = (uint64_t)UQUAD_MAX; min = 0;		break;
2141 		case FLOAT:
2142 		case FCOMPLEX:
2143 			max = FLT_MAX;		min = -FLT_MAX;		break;
2144 		case DOUBLE:
2145 		case DCOMPLEX:
2146 			max = DBL_MAX;		min = -DBL_MAX;		break;
2147 		case PTR:
2148 			/* Got already an error because of float --> ptr */
2149 		case LDOUBLE:
2150 		case LCOMPLEX:
2151 			max = LDBL_MAX;		min = -LDBL_MAX;	break;
2152 		default:
2153 			lint_assert(/*CONSTCOND*/false);
2154 		}
2155 		if (v->v_ldbl > max || v->v_ldbl < min) {
2156 			lint_assert(nt != LDOUBLE);
2157 			if (op == FARG) {
2158 				/* conv. of '%s' to '%s' is out of range, ... */
2159 				warning(295,
2160 				    type_name(gettyp(ot)), type_name(tp), arg);
2161 			} else {
2162 				/* conversion of '%s' to '%s' is out of range */
2163 				warning(119,
2164 				    type_name(gettyp(ot)), type_name(tp));
2165 			}
2166 			v->v_ldbl = v->v_ldbl > 0 ? max : min;
2167 		}
2168 		if (nt == FLOAT) {
2169 			nv->v_ldbl = (float)v->v_ldbl;
2170 		} else if (nt == DOUBLE) {
2171 			nv->v_ldbl = (double)v->v_ldbl;
2172 		} else if (nt == LDOUBLE) {
2173 			nv->v_ldbl = v->v_ldbl;
2174 		} else {
2175 			nv->v_quad = (nt == PTR || is_uinteger(nt)) ?
2176 				(int64_t)v->v_ldbl : (int64_t)v->v_ldbl;
2177 		}
2178 	} else {
2179 		if (nt == FLOAT) {
2180 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2181 			       (float)(uint64_t)v->v_quad : (float)v->v_quad;
2182 		} else if (nt == DOUBLE) {
2183 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2184 			       (double)(uint64_t)v->v_quad : (double)v->v_quad;
2185 		} else if (nt == LDOUBLE) {
2186 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2187 			       (ldbl_t)(uint64_t)v->v_quad : (ldbl_t)v->v_quad;
2188 		} else {
2189 			rchk = true;		/* Check for lost precision. */
2190 			nv->v_quad = v->v_quad;
2191 		}
2192 	}
2193 
2194 	if (v->v_ansiu && is_floating(nt)) {
2195 		/* ANSI C treats constant as unsigned */
2196 		warning(157);
2197 		v->v_ansiu = false;
2198 	} else if (v->v_ansiu && (is_integer(nt) && !is_uinteger(nt) &&
2199 				  portable_size_in_bits(nt) >
2200 				  portable_size_in_bits(ot))) {
2201 		/* ANSI C treats constant as unsigned */
2202 		warning(157);
2203 		v->v_ansiu = false;
2204 	}
2205 
2206 	switch (nt) {
2207 	case FLOAT:
2208 	case FCOMPLEX:
2209 	case DOUBLE:
2210 	case DCOMPLEX:
2211 	case LDOUBLE:
2212 	case LCOMPLEX:
2213 		break;
2214 	default:
2215 		sz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2216 		nv->v_quad = xsign(nv->v_quad, nt, sz);
2217 		break;
2218 	}
2219 
2220 	if (rchk && op != CVT) {
2221 		osz = size_in_bits(ot);
2222 		nsz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2223 		xmask = qlmasks[nsz] ^ qlmasks[osz];
2224 		xmsk1 = qlmasks[nsz] ^ qlmasks[osz - 1];
2225 		/*
2226 		 * For bitwise operations we are not interested in the
2227 		 * value, but in the bits itself.
2228 		 */
2229 		if (op == ORASS || op == BITOR || op == BITXOR) {
2230 			/*
2231 			 * Print a warning if bits which were set are
2232 			 * lost due to the conversion.
2233 			 * This can happen with operator ORASS only.
2234 			 */
2235 			if (nsz < osz && (v->v_quad & xmask) != 0) {
2236 				/* constant truncated by conv., op %s */
2237 				warning(306, op_name(op));
2238 			}
2239 		} else if (op == ANDASS || op == BITAND) {
2240 			/*
2241 			 * Print a warning if additional bits are not all 1
2242 			 * and the most significant bit of the old value is 1,
2243 			 * or if at least one (but not all) removed bit was 0.
2244 			 */
2245 			if (nsz > osz &&
2246 			    (nv->v_quad & qbmasks[osz - 1]) != 0 &&
2247 			    (nv->v_quad & xmask) != xmask) {
2248 				/* extra bits set to 0 in conv. of '%s' ... */
2249 				warning(309, type_name(gettyp(ot)),
2250 				    type_name(tp), op_name(op));
2251 			} else if (nsz < osz &&
2252 				   (v->v_quad & xmask) != xmask &&
2253 				   (v->v_quad & xmask) != 0) {
2254 				/* constant truncated by conv., op %s */
2255 				warning(306, op_name(op));
2256 			}
2257 		} else if ((nt != PTR && is_uinteger(nt)) &&
2258 			   (ot != PTR && !is_uinteger(ot)) &&
2259 			   v->v_quad < 0) {
2260 			if (op == ASSIGN) {
2261 				/* assignment of negative constant to ... */
2262 				warning(164);
2263 			} else if (op == INIT) {
2264 				/* initialization of unsigned with neg... */
2265 				warning(221);
2266 			} else if (op == FARG) {
2267 				/* conversion of negative constant to ... */
2268 				warning(296, arg);
2269 			} else if (modtab[op].m_comparison) {
2270 				/* handled by check_integer_comparison() */
2271 			} else {
2272 				/* conversion of negative constant to ... */
2273 				warning(222);
2274 			}
2275 		} else if (nv->v_quad != v->v_quad && nsz <= osz &&
2276 			   (v->v_quad & xmask) != 0 &&
2277 			   (is_uinteger(ot) || (v->v_quad & xmsk1) != xmsk1)) {
2278 			/*
2279 			 * Loss of significant bit(s). All truncated bits
2280 			 * of unsigned types or all truncated bits plus the
2281 			 * msb of the target for signed types are considered
2282 			 * to be significant bits. Loss of significant bits
2283 			 * means that at least on of the bits was set in an
2284 			 * unsigned type or that at least one, but not all of
2285 			 * the bits was set in an signed type.
2286 			 * Loss of significant bits means that it is not
2287 			 * possible, also not with necessary casts, to convert
2288 			 * back to the original type. A example for a
2289 			 * necessary cast is:
2290 			 *	char c;	int	i; c = 128;
2291 			 *	i = c;			** yields -128 **
2292 			 *	i = (unsigned char)c;	** yields 128 **
2293 			 */
2294 			if (op == ASSIGN && tp->t_bitfield) {
2295 				/* precision lost in bit-field assignment */
2296 				warning(166);
2297 			} else if (op == ASSIGN) {
2298 				/* constant truncated by assignment */
2299 				warning(165);
2300 			} else if (op == INIT && tp->t_bitfield) {
2301 				/* bit-field initializer does not fit */
2302 				warning(180);
2303 			} else if (op == INIT) {
2304 				/* initializer does not fit */
2305 				warning(178);
2306 			} else if (op == CASE) {
2307 				/* case label affected by conversion */
2308 				warning(196);
2309 			} else if (op == FARG) {
2310 				/* conv. of '%s' to '%s' is out of range, ... */
2311 				warning(295,
2312 				    type_name(gettyp(ot)), type_name(tp), arg);
2313 			} else {
2314 				/* conversion of '%s' to '%s' is out of range */
2315 				warning(119,
2316 				    type_name(gettyp(ot)), type_name(tp));
2317 			}
2318 		} else if (nv->v_quad != v->v_quad) {
2319 			if (op == ASSIGN && tp->t_bitfield) {
2320 				/* precision lost in bit-field assignment */
2321 				warning(166);
2322 			} else if (op == INIT && tp->t_bitfield) {
2323 				/* bit-field initializer out of range */
2324 				warning(11);
2325 			} else if (op == CASE) {
2326 				/* case label affected by conversion */
2327 				warning(196);
2328 			} else if (op == FARG) {
2329 				/* conv. of '%s' to '%s' is out of range, ... */
2330 				warning(295,
2331 				    type_name(gettyp(ot)), type_name(tp), arg);
2332 			} else {
2333 				/* conversion of '%s' to '%s' is out of range */
2334 				warning(119,
2335 				    type_name(gettyp(ot)), type_name(tp));
2336 			}
2337 		}
2338 	}
2339 }
2340 
2341 /*
2342  * Called if incompatible types were detected.
2343  * Prints a appropriate warning.
2344  */
2345 static void
2346 warn_incompatible_types(op_t op,
2347 			const type_t *ltp, tspec_t lt,
2348 			const type_t *rtp, tspec_t rt)
2349 {
2350 	const mod_t *mp;
2351 
2352 	mp = &modtab[op];
2353 
2354 	if (lt == VOID || (mp->m_binary && rt == VOID)) {
2355 		/* void type illegal in expression */
2356 		error(109);
2357 	} else if (op == ASSIGN) {
2358 		if ((lt == STRUCT || lt == UNION) &&
2359 		    (rt == STRUCT || rt == UNION)) {
2360 			/* assignment of different structures (%s != %s) */
2361 			error(240, tspec_name(lt), tspec_name(rt));
2362 		} else {
2363 			/* cannot assign to '%s' from '%s' */
2364 			error(171, type_name(ltp), type_name(rtp));
2365 		}
2366 	} else if (mp->m_binary) {
2367 		/* operands of '%s' have incompatible types (%s != %s) */
2368 		error(107, mp->m_name, tspec_name(lt), tspec_name(rt));
2369 	} else {
2370 		lint_assert(rt == NOTSPEC);
2371 		/* operand of '%s' has invalid type (%s) */
2372 		error(108, mp->m_name, tspec_name(lt));
2373 	}
2374 }
2375 
2376 /*
2377  * Called if incompatible pointer types are detected.
2378  * Print an appropriate warning.
2379  */
2380 static void
2381 warn_incompatible_pointers(const mod_t *mp,
2382 			   const type_t *ltp, const type_t *rtp)
2383 {
2384 	tspec_t	lt, rt;
2385 
2386 	lint_assert(ltp->t_tspec == PTR);
2387 	lint_assert(rtp->t_tspec == PTR);
2388 
2389 	lt = ltp->t_subt->t_tspec;
2390 	rt = rtp->t_subt->t_tspec;
2391 
2392 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION)) {
2393 		if (mp == NULL) {
2394 			/* illegal structure pointer combination */
2395 			warning(244);
2396 		} else {
2397 			/* incompatible structure pointers: '%s' '%s' '%s' */
2398 			warning(245, type_name(ltp), mp->m_name, type_name(rtp));
2399 		}
2400 	} else {
2401 		if (mp == NULL) {
2402 			/* illegal pointer combination */
2403 			warning(184);
2404 		} else {
2405 			/* illegal pointer combination (%s) and (%s), op %s */
2406 			warning(124,
2407 			    type_name(ltp), type_name(rtp), mp->m_name);
2408 		}
2409 	}
2410 }
2411 
2412 /* Return a type based on tp1, with added qualifiers from tp2. */
2413 static type_t *
2414 merge_qualifiers(type_t *tp1, const type_t *tp2)
2415 {
2416 	type_t *ntp, *nstp;
2417 
2418 	lint_assert(tp1->t_tspec == PTR);
2419 	lint_assert(tp2->t_tspec == PTR);
2420 
2421 	bool c1 = tp1->t_subt->t_const;
2422 	bool c2 = tp2->t_subt->t_const;
2423 	bool v1 = tp1->t_subt->t_volatile;
2424 	bool v2 = tp2->t_subt->t_volatile;
2425 
2426 	if (c1 == (c1 | c2) && v1 == (v1 | v2))
2427 		return tp1;
2428 
2429 	nstp = expr_dup_type(tp1->t_subt);
2430 	nstp->t_const |= c2;
2431 	nstp->t_volatile |= v2;
2432 
2433 	ntp = expr_dup_type(tp1);
2434 	ntp->t_subt = nstp;
2435 	return ntp;
2436 }
2437 
2438 /*
2439  * Returns true if the given structure or union has a constant member
2440  * (maybe recursively).
2441  */
2442 static bool
2443 has_constant_member(const type_t *tp)
2444 {
2445 	sym_t	*m;
2446 	tspec_t	t;
2447 
2448 	lint_assert((t = tp->t_tspec) == STRUCT || t == UNION);
2449 
2450 	for (m = tp->t_str->sou_first_member; m != NULL; m = m->s_next) {
2451 		tp = m->s_type;
2452 		if (tp->t_const)
2453 			return true;
2454 		if ((t = tp->t_tspec) == STRUCT || t == UNION) {
2455 			if (has_constant_member(m->s_type))
2456 				return true;
2457 		}
2458 	}
2459 	return false;
2460 }
2461 
2462 /*
2463  * Create a new node for one of the operators POINT and ARROW.
2464  */
2465 static tnode_t *
2466 build_struct_access(op_t op, tnode_t *ln, tnode_t *rn)
2467 {
2468 	tnode_t	*ntn, *ctn;
2469 	bool	nolval;
2470 
2471 	lint_assert(rn->tn_op == NAME);
2472 	lint_assert(rn->tn_sym->s_value.v_tspec == INT);
2473 	lint_assert(rn->tn_sym->s_scl == MOS || rn->tn_sym->s_scl == MOU);
2474 
2475 	/*
2476 	 * Remember if the left operand is an lvalue (structure members
2477 	 * are lvalues if and only if the structure itself is an lvalue).
2478 	 */
2479 	nolval = op == POINT && !ln->tn_lvalue;
2480 
2481 	if (op == POINT) {
2482 		ln = build_address(ln, true);
2483 	} else if (ln->tn_type->t_tspec != PTR) {
2484 		lint_assert(tflag);
2485 		lint_assert(is_integer(ln->tn_type->t_tspec));
2486 		ln = convert(NOOP, 0, expr_derive_type(gettyp(VOID), PTR), ln);
2487 	}
2488 
2489 	ctn = expr_new_integer_constant(PTRDIFF_TSPEC,
2490 	    rn->tn_sym->s_value.v_quad / CHAR_SIZE);
2491 
2492 	ntn = new_tnode(PLUS, expr_derive_type(rn->tn_type, PTR), ln, ctn);
2493 	if (ln->tn_op == CON)
2494 		ntn = fold(ntn);
2495 
2496 	if (rn->tn_type->t_bitfield) {
2497 		ntn = new_tnode(FSEL, ntn->tn_type->t_subt, ntn, NULL);
2498 	} else {
2499 		ntn = new_tnode(INDIR, ntn->tn_type->t_subt, ntn, NULL);
2500 	}
2501 
2502 	if (nolval)
2503 		ntn->tn_lvalue = false;
2504 
2505 	return ntn;
2506 }
2507 
2508 /*
2509  * Create a node for INCAFT, INCBEF, DECAFT and DECBEF.
2510  */
2511 static tnode_t *
2512 build_prepost_incdec(op_t op, tnode_t *ln)
2513 {
2514 	tnode_t	*cn, *ntn;
2515 
2516 	lint_assert(ln != NULL);
2517 
2518 	if (ln->tn_type->t_tspec == PTR) {
2519 		cn = plength(ln->tn_type);
2520 	} else {
2521 		cn = expr_new_integer_constant(INT, (int64_t)1);
2522 	}
2523 	ntn = new_tnode(op, ln->tn_type, ln, cn);
2524 
2525 	return ntn;
2526 }
2527 
2528 /*
2529  * Create a node for REAL, IMAG
2530  */
2531 static tnode_t *
2532 build_real_imag(op_t op, tnode_t *ln)
2533 {
2534 	tnode_t	*cn, *ntn;
2535 
2536 	lint_assert(ln != NULL);
2537 
2538 	switch (ln->tn_type->t_tspec) {
2539 	case LCOMPLEX:
2540 		/* XXX: integer and LDOUBLE don't match. */
2541 		cn = expr_new_integer_constant(LDOUBLE, (int64_t)1);
2542 		break;
2543 	case DCOMPLEX:
2544 		/* XXX: integer and DOUBLE don't match. */
2545 		cn = expr_new_integer_constant(DOUBLE, (int64_t)1);
2546 		break;
2547 	case FCOMPLEX:
2548 		/* XXX: integer and FLOAT don't match. */
2549 		cn = expr_new_integer_constant(FLOAT, (int64_t)1);
2550 		break;
2551 	default:
2552 		/* __%s__ is illegal for type %s */
2553 		error(276, op == REAL ? "real" : "imag",
2554 		    type_name(ln->tn_type));
2555 		return NULL;
2556 	}
2557 	ntn = new_tnode(op, cn->tn_type, ln, cn);
2558 	ntn->tn_lvalue = true;
2559 
2560 	return ntn;
2561 }
2562 /*
2563  * Create a tree node for the unary & operator
2564  */
2565 static tnode_t *
2566 build_address(tnode_t *tn, bool noign)
2567 {
2568 	tspec_t	t;
2569 
2570 	if (!noign && ((t = tn->tn_type->t_tspec) == ARRAY || t == FUNC)) {
2571 		if (tflag)
2572 			/* '&' before array or function: ignored */
2573 			warning(127);
2574 		return tn;
2575 	}
2576 
2577 	/* eliminate &* */
2578 	if (tn->tn_op == INDIR &&
2579 	    tn->tn_left->tn_type->t_tspec == PTR &&
2580 	    tn->tn_left->tn_type->t_subt == tn->tn_type) {
2581 		return tn->tn_left;
2582 	}
2583 
2584 	return new_tnode(ADDR, expr_derive_type(tn->tn_type, PTR), tn, NULL);
2585 }
2586 
2587 /*
2588  * Create a node for operators PLUS and MINUS.
2589  */
2590 static tnode_t *
2591 build_plus_minus(op_t op, tnode_t *ln, tnode_t *rn)
2592 {
2593 	tnode_t	*ntn, *ctn;
2594 	type_t	*tp;
2595 
2596 	/* If pointer and integer, then pointer to the lhs. */
2597 	if (rn->tn_type->t_tspec == PTR && is_integer(ln->tn_type->t_tspec)) {
2598 		ntn = ln;
2599 		ln = rn;
2600 		rn = ntn;
2601 	}
2602 
2603 	if (ln->tn_type->t_tspec == PTR && rn->tn_type->t_tspec != PTR) {
2604 
2605 		/* XXX: this assertion should be easy to trigger */
2606 		lint_assert(is_integer(rn->tn_type->t_tspec));
2607 
2608 		check_ctype_macro_invocation(ln, rn);
2609 
2610 		ctn = plength(ln->tn_type);
2611 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2612 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2613 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2614 		if (rn->tn_left->tn_op == CON)
2615 			rn = fold(rn);
2616 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2617 
2618 	} else if (rn->tn_type->t_tspec == PTR) {
2619 
2620 		lint_assert(ln->tn_type->t_tspec == PTR);
2621 		lint_assert(op == MINUS);
2622 		tp = gettyp(PTRDIFF_TSPEC);
2623 		ntn = new_tnode(op, tp, ln, rn);
2624 		if (ln->tn_op == CON && rn->tn_op == CON)
2625 			ntn = fold(ntn);
2626 		ctn = plength(ln->tn_type);
2627 		balance(NOOP, &ntn, &ctn);
2628 		ntn = new_tnode(DIV, tp, ntn, ctn);
2629 
2630 	} else {
2631 
2632 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2633 
2634 	}
2635 	return ntn;
2636 }
2637 
2638 /*
2639  * Create a node for operators SHL and SHR.
2640  */
2641 static tnode_t *
2642 build_bit_shift(op_t op, tnode_t *ln, tnode_t *rn)
2643 {
2644 	tspec_t	t;
2645 	tnode_t	*ntn;
2646 
2647 	if ((t = rn->tn_type->t_tspec) != INT && t != UINT)
2648 		rn = convert(CVT, 0, gettyp(INT), rn);
2649 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2650 	return ntn;
2651 }
2652 
2653 /*
2654  * Create a node for COLON.
2655  */
2656 static tnode_t *
2657 build_colon(tnode_t *ln, tnode_t *rn)
2658 {
2659 	tspec_t	lt, rt, pdt;
2660 	type_t	*tp;
2661 	tnode_t	*ntn;
2662 
2663 	lt = ln->tn_type->t_tspec;
2664 	rt = rn->tn_type->t_tspec;
2665 	pdt = PTRDIFF_TSPEC;
2666 
2667 	/*
2668 	 * Arithmetic types are balanced, all other type combinations
2669 	 * still need to be handled.
2670 	 */
2671 	if (is_arithmetic(lt) && is_arithmetic(rt)) {
2672 		tp = ln->tn_type;
2673 	} else if (lt == BOOL && rt == BOOL) {
2674 		tp = ln->tn_type;
2675 	} else if (lt == VOID || rt == VOID) {
2676 		tp = gettyp(VOID);
2677 	} else if (lt == STRUCT || lt == UNION) {
2678 		/* Both types must be identical. */
2679 		lint_assert(rt == STRUCT || rt == UNION);
2680 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2681 		if (is_incomplete(ln->tn_type)) {
2682 			/* unknown operand size, op %s */
2683 			error(138, op_name(COLON));
2684 			return NULL;
2685 		}
2686 		tp = ln->tn_type;
2687 	} else if (lt == PTR && is_integer(rt)) {
2688 		if (rt != pdt) {
2689 			rn = convert(NOOP, 0, gettyp(pdt), rn);
2690 			rt = pdt;
2691 		}
2692 		tp = ln->tn_type;
2693 	} else if (rt == PTR && is_integer(lt)) {
2694 		if (lt != pdt) {
2695 			ln = convert(NOOP, 0, gettyp(pdt), ln);
2696 			lt = pdt;
2697 		}
2698 		tp = rn->tn_type;
2699 	} else if (lt == PTR && ln->tn_type->t_subt->t_tspec == VOID) {
2700 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
2701 	} else if (rt == PTR && rn->tn_type->t_subt->t_tspec == VOID) {
2702 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2703 	} else {
2704 		/*
2705 		 * XXX For now we simply take the left type. This is
2706 		 * probably wrong, if one type contains a function prototype
2707 		 * and the other one, at the same place, only an old style
2708 		 * declaration.
2709 		 */
2710 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2711 	}
2712 
2713 	ntn = new_tnode(COLON, tp, ln, rn);
2714 
2715 	return ntn;
2716 }
2717 
2718 /*
2719  * Create a node for an assignment operator (both = and op= ).
2720  */
2721 static tnode_t *
2722 build_assignment(op_t op, tnode_t *ln, tnode_t *rn)
2723 {
2724 	tspec_t	lt, rt;
2725 	tnode_t	*ntn, *ctn;
2726 
2727 	lint_assert(ln != NULL);
2728 	lint_assert(rn != NULL);
2729 
2730 	lt = ln->tn_type->t_tspec;
2731 	rt = rn->tn_type->t_tspec;
2732 
2733 	if ((op == ADDASS || op == SUBASS) && lt == PTR) {
2734 		lint_assert(is_integer(rt));
2735 		ctn = plength(ln->tn_type);
2736 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2737 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2738 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2739 		if (rn->tn_left->tn_op == CON)
2740 			rn = fold(rn);
2741 	}
2742 
2743 	if ((op == ASSIGN || op == RETURN) && (lt == STRUCT || rt == STRUCT)) {
2744 		lint_assert(lt == rt);
2745 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2746 		if (is_incomplete(ln->tn_type)) {
2747 			if (op == RETURN) {
2748 				/* cannot return incomplete type */
2749 				error(212);
2750 			} else {
2751 				/* unknown operand size, op %s */
2752 				error(138, op_name(op));
2753 			}
2754 			return NULL;
2755 		}
2756 	}
2757 
2758 	if (op == SHLASS) {
2759 		if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
2760 			if (hflag)
2761 				/* semantics of '%s' change in ANSI C; ... */
2762 				warning(118, "<<=");
2763 		}
2764 	} else if (op != SHRASS) {
2765 		if (op == ASSIGN || lt != PTR) {
2766 			if (lt != rt ||
2767 			    (ln->tn_type->t_bitfield && rn->tn_op == CON)) {
2768 				rn = convert(op, 0, ln->tn_type, rn);
2769 				rt = lt;
2770 			}
2771 		}
2772 	}
2773 
2774 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2775 
2776 	return ntn;
2777 }
2778 
2779 /*
2780  * Get length of type tp->t_subt.
2781  */
2782 static tnode_t *
2783 plength(type_t *tp)
2784 {
2785 	int	elem, elsz;
2786 
2787 	lint_assert(tp->t_tspec == PTR);
2788 	tp = tp->t_subt;
2789 
2790 	elem = 1;
2791 	elsz = 0;
2792 
2793 	while (tp->t_tspec == ARRAY) {
2794 		elem *= tp->t_dim;
2795 		tp = tp->t_subt;
2796 	}
2797 
2798 	switch (tp->t_tspec) {
2799 	case FUNC:
2800 		/* pointer to function is not allowed here */
2801 		error(110);
2802 		break;
2803 	case VOID:
2804 		/* cannot do pointer arithmetic on operand of unknown size */
2805 		gnuism(136);
2806 		break;
2807 	case STRUCT:
2808 	case UNION:
2809 		if ((elsz = tp->t_str->sou_size_in_bits) == 0)
2810 			/* cannot do pointer arithmetic on operand of ... */
2811 			error(136);
2812 		break;
2813 	case ENUM:
2814 		if (is_incomplete(tp)) {
2815 			/* cannot do pointer arithmetic on operand of ... */
2816 			warning(136);
2817 		}
2818 		/* FALLTHROUGH */
2819 	default:
2820 		if ((elsz = size_in_bits(tp->t_tspec)) == 0) {
2821 			/* cannot do pointer arithmetic on operand of ... */
2822 			error(136);
2823 		} else {
2824 			lint_assert(elsz != -1);
2825 		}
2826 		break;
2827 	}
2828 
2829 	if (elem == 0 && elsz != 0) {
2830 		/* cannot do pointer arithmetic on operand of unknown size */
2831 		error(136);
2832 	}
2833 
2834 	if (elsz == 0)
2835 		elsz = CHAR_SIZE;
2836 
2837 	return expr_new_integer_constant(PTRDIFF_TSPEC,
2838 	    (int64_t)(elem * elsz / CHAR_SIZE));
2839 }
2840 
2841 /*
2842  * XXX
2843  * Note: There appear to be a number of bugs in detecting overflow in
2844  * this function. An audit and a set of proper regression tests are needed.
2845  *     --Perry Metzger, Nov. 16, 2001
2846  */
2847 /*
2848  * Do only as much as necessary to compute constant expressions.
2849  * Called only if the operator allows folding and all operands are constants.
2850  */
2851 static tnode_t *
2852 fold(tnode_t *tn)
2853 {
2854 	val_t	*v;
2855 	tspec_t	t;
2856 	bool	utyp, ovfl;
2857 	int64_t	sl, sr = 0, q = 0, mask;
2858 	uint64_t ul, ur = 0;
2859 	tnode_t	*cn;
2860 
2861 	v = xcalloc(1, sizeof(*v));
2862 	v->v_tspec = t = tn->tn_type->t_tspec;
2863 
2864 	utyp = t == PTR || is_uinteger(t);
2865 	ul = sl = tn->tn_left->tn_val->v_quad;
2866 	if (modtab[tn->tn_op].m_binary)
2867 		ur = sr = tn->tn_right->tn_val->v_quad;
2868 
2869 	mask = qlmasks[size_in_bits(t)];
2870 	ovfl = false;
2871 
2872 	switch (tn->tn_op) {
2873 	case UPLUS:
2874 		q = sl;
2875 		break;
2876 	case UMINUS:
2877 		q = -sl;
2878 		if (sl != 0 && msb(q, t, -1) == msb(sl, t, -1))
2879 			ovfl = true;
2880 		break;
2881 	case COMPL:
2882 		q = ~sl;
2883 		break;
2884 	case MULT:
2885 		if (utyp) {
2886 			q = ul * ur;
2887 			if (q != (q & mask))
2888 				ovfl = true;
2889 			else if ((ul != 0) && ((q / ul) != ur))
2890 				ovfl = true;
2891 		} else {
2892 			q = sl * sr;
2893 			if (msb(q, t, -1) != (msb(sl, t, -1) ^ msb(sr, t, -1)))
2894 				ovfl = true;
2895 		}
2896 		break;
2897 	case DIV:
2898 		if (sr == 0) {
2899 			/* division by 0 */
2900 			error(139);
2901 			q = utyp ? UQUAD_MAX : QUAD_MAX;
2902 		} else {
2903 			q = utyp ? (int64_t)(ul / ur) : sl / sr;
2904 		}
2905 		break;
2906 	case MOD:
2907 		if (sr == 0) {
2908 			/* modulus by 0 */
2909 			error(140);
2910 			q = 0;
2911 		} else {
2912 			q = utyp ? (int64_t)(ul % ur) : sl % sr;
2913 		}
2914 		break;
2915 	case PLUS:
2916 		q = utyp ? (int64_t)(ul + ur) : sl + sr;
2917 		if (msb(sl, t, -1)  != 0 && msb(sr, t, -1) != 0) {
2918 			if (msb(q, t, -1) == 0)
2919 				ovfl = true;
2920 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) == 0) {
2921 			if (msb(q, t, -1) != 0)
2922 				ovfl = true;
2923 		}
2924 		break;
2925 	case MINUS:
2926 		q = utyp ? (int64_t)(ul - ur) : sl - sr;
2927 		if (msb(sl, t, -1) != 0 && msb(sr, t, -1) == 0) {
2928 			if (msb(q, t, -1) == 0)
2929 				ovfl = true;
2930 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) != 0) {
2931 			if (msb(q, t, -1) != 0)
2932 				ovfl = true;
2933 		}
2934 		break;
2935 	case SHL:
2936 		q = utyp ? (int64_t)(ul << sr) : sl << sr;
2937 		break;
2938 	case SHR:
2939 		/*
2940 		 * The sign must be explicitly extended because
2941 		 * shifts of signed values are implementation dependent.
2942 		 */
2943 		q = ul >> sr;
2944 		q = xsign(q, t, size_in_bits(t) - (int)sr);
2945 		break;
2946 	case LT:
2947 		q = (utyp ? ul < ur : sl < sr) ? 1 : 0;
2948 		break;
2949 	case LE:
2950 		q = (utyp ? ul <= ur : sl <= sr) ? 1 : 0;
2951 		break;
2952 	case GE:
2953 		q = (utyp ? ul >= ur : sl >= sr) ? 1 : 0;
2954 		break;
2955 	case GT:
2956 		q = (utyp ? ul > ur : sl > sr) ? 1 : 0;
2957 		break;
2958 	case EQ:
2959 		q = (utyp ? ul == ur : sl == sr) ? 1 : 0;
2960 		break;
2961 	case NE:
2962 		q = (utyp ? ul != ur : sl != sr) ? 1 : 0;
2963 		break;
2964 	case BITAND:
2965 		q = utyp ? (int64_t)(ul & ur) : sl & sr;
2966 		break;
2967 	case BITXOR:
2968 		q = utyp ? (int64_t)(ul ^ ur) : sl ^ sr;
2969 		break;
2970 	case BITOR:
2971 		q = utyp ? (int64_t)(ul | ur) : sl | sr;
2972 		break;
2973 	default:
2974 		lint_assert(/*CONSTCOND*/false);
2975 	}
2976 
2977 	/* XXX does not work for quads. */
2978 	if (ovfl || ((uint64_t)(q | mask) != ~(uint64_t)0 &&
2979 	    (q & ~mask) != 0)) {
2980 		if (hflag)
2981 			/* integer overflow detected, op %s */
2982 			warning(141, op_name(tn->tn_op));
2983 	}
2984 
2985 	v->v_quad = xsign(q, t, -1);
2986 
2987 	cn = expr_new_constant(tn->tn_type, v);
2988 	if (tn->tn_left->tn_system_dependent)
2989 		cn->tn_system_dependent = true;
2990 	if (modtab[tn->tn_op].m_binary && tn->tn_right->tn_system_dependent)
2991 		cn->tn_system_dependent = true;
2992 
2993 	return cn;
2994 }
2995 
2996 /*
2997  * Fold constant nodes, as much as is needed for comparing the value with 0
2998  * (test context, for controlling expressions).
2999  */
3000 static tnode_t *
3001 fold_test(tnode_t *tn)
3002 {
3003 	bool	l, r;
3004 	val_t	*v;
3005 
3006 	v = xcalloc(1, sizeof(*v));
3007 	v->v_tspec = tn->tn_type->t_tspec;
3008 	lint_assert(v->v_tspec == INT || (Tflag && v->v_tspec == BOOL));
3009 
3010 	l = constant_is_nonzero(tn->tn_left);
3011 	r = modtab[tn->tn_op].m_binary && constant_is_nonzero(tn->tn_right);
3012 
3013 	switch (tn->tn_op) {
3014 	case NOT:
3015 		if (hflag && !constcond_flag)
3016 			/* constant argument to '!' */
3017 			warning(239);
3018 		v->v_quad = !l ? 1 : 0;
3019 		break;
3020 	case LOGAND:
3021 		v->v_quad = l && r ? 1 : 0;
3022 		break;
3023 	case LOGOR:
3024 		v->v_quad = l || r ? 1 : 0;
3025 		break;
3026 	default:
3027 		lint_assert(/*CONSTCOND*/false);
3028 	}
3029 
3030 	return expr_new_constant(tn->tn_type, v);
3031 }
3032 
3033 /*
3034  * Fold constant nodes having operands with floating point type.
3035  */
3036 static tnode_t *
3037 fold_float(tnode_t *tn)
3038 {
3039 	val_t	*v;
3040 	tspec_t	t;
3041 	ldbl_t	l, r = 0;
3042 
3043 	fpe = 0;
3044 	v = xcalloc(1, sizeof(*v));
3045 	v->v_tspec = t = tn->tn_type->t_tspec;
3046 
3047 	lint_assert(is_floating(t));
3048 	lint_assert(t == tn->tn_left->tn_type->t_tspec);
3049 	lint_assert(!modtab[tn->tn_op].m_binary ||
3050 	    t == tn->tn_right->tn_type->t_tspec);
3051 
3052 	l = tn->tn_left->tn_val->v_ldbl;
3053 	if (modtab[tn->tn_op].m_binary)
3054 		r = tn->tn_right->tn_val->v_ldbl;
3055 
3056 	switch (tn->tn_op) {
3057 	case UPLUS:
3058 		v->v_ldbl = l;
3059 		break;
3060 	case UMINUS:
3061 		v->v_ldbl = -l;
3062 		break;
3063 	case MULT:
3064 		v->v_ldbl = l * r;
3065 		break;
3066 	case DIV:
3067 		if (r == 0.0) {
3068 			/* division by 0 */
3069 			error(139);
3070 			if (t == FLOAT) {
3071 				v->v_ldbl = l < 0 ? -FLT_MAX : FLT_MAX;
3072 			} else if (t == DOUBLE) {
3073 				v->v_ldbl = l < 0 ? -DBL_MAX : DBL_MAX;
3074 			} else {
3075 				v->v_ldbl = l < 0 ? -LDBL_MAX : LDBL_MAX;
3076 			}
3077 		} else {
3078 			v->v_ldbl = l / r;
3079 		}
3080 		break;
3081 	case PLUS:
3082 		v->v_ldbl = l + r;
3083 		break;
3084 	case MINUS:
3085 		v->v_ldbl = l - r;
3086 		break;
3087 	case LT:
3088 		v->v_quad = l < r ? 1 : 0;
3089 		break;
3090 	case LE:
3091 		v->v_quad = l <= r ? 1 : 0;
3092 		break;
3093 	case GE:
3094 		v->v_quad = l >= r ? 1 : 0;
3095 		break;
3096 	case GT:
3097 		v->v_quad = l > r ? 1 : 0;
3098 		break;
3099 	case EQ:
3100 		v->v_quad = l == r ? 1 : 0;
3101 		break;
3102 	case NE:
3103 		v->v_quad = l != r ? 1 : 0;
3104 		break;
3105 	default:
3106 		lint_assert(/*CONSTCOND*/false);
3107 	}
3108 
3109 	lint_assert(fpe != 0 || isnan((double)v->v_ldbl) == 0);
3110 	if (fpe != 0 || finite((double)v->v_ldbl) == 0 ||
3111 	    (t == FLOAT &&
3112 	     (v->v_ldbl > FLT_MAX || v->v_ldbl < -FLT_MAX)) ||
3113 	    (t == DOUBLE &&
3114 	     (v->v_ldbl > DBL_MAX || v->v_ldbl < -DBL_MAX))) {
3115 		/* floating point overflow detected, op %s */
3116 		warning(142, op_name(tn->tn_op));
3117 		if (t == FLOAT) {
3118 			v->v_ldbl = v->v_ldbl < 0 ? -FLT_MAX : FLT_MAX;
3119 		} else if (t == DOUBLE) {
3120 			v->v_ldbl = v->v_ldbl < 0 ? -DBL_MAX : DBL_MAX;
3121 		} else {
3122 			v->v_ldbl = v->v_ldbl < 0 ? -LDBL_MAX: LDBL_MAX;
3123 		}
3124 	    fpe = 0;
3125 	}
3126 
3127 	return expr_new_constant(tn->tn_type, v);
3128 }
3129 
3130 
3131 /*
3132  * Create a constant node for sizeof.
3133  */
3134 tnode_t *
3135 build_sizeof(const type_t *tp)
3136 {
3137 	int64_t size_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3138 	tnode_t *tn = expr_new_integer_constant(SIZEOF_TSPEC, size_in_bytes);
3139 	tn->tn_system_dependent = true;
3140 	return tn;
3141 }
3142 
3143 /*
3144  * Create a constant node for offsetof.
3145  */
3146 tnode_t *
3147 build_offsetof(const type_t *tp, const sym_t *sym)
3148 {
3149 	tspec_t t = tp->t_tspec;
3150 	if (t != STRUCT && t != UNION)
3151 		/* unacceptable operand of '%s' */
3152 		error(111, "offsetof");
3153 
3154 	// XXX: wrong size, no checking for sym fixme
3155 	int64_t offset_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3156 	tnode_t *tn = expr_new_integer_constant(SIZEOF_TSPEC, offset_in_bytes);
3157 	tn->tn_system_dependent = true;
3158 	return tn;
3159 }
3160 
3161 int64_t
3162 type_size_in_bits(const type_t *tp)
3163 {
3164 	int	elem, elsz;
3165 	bool	flex;
3166 
3167 	elem = 1;
3168 	flex = false;
3169 	while (tp->t_tspec == ARRAY) {
3170 		flex = true;	/* allow c99 flex arrays [] [0] */
3171 		elem *= tp->t_dim;
3172 		tp = tp->t_subt;
3173 	}
3174 	if (elem == 0) {
3175 		if (!flex) {
3176 			/* cannot take size/alignment of incomplete type */
3177 			error(143);
3178 			elem = 1;
3179 		}
3180 	}
3181 	switch (tp->t_tspec) {
3182 	case FUNC:
3183 		/* cannot take size/alignment of function */
3184 		error(144);
3185 		elsz = 1;
3186 		break;
3187 	case STRUCT:
3188 	case UNION:
3189 		if (is_incomplete(tp)) {
3190 			/* cannot take size/alignment of incomplete type */
3191 			error(143);
3192 			elsz = 1;
3193 		} else {
3194 			elsz = tp->t_str->sou_size_in_bits;
3195 		}
3196 		break;
3197 	case ENUM:
3198 		if (is_incomplete(tp)) {
3199 			/* cannot take size/alignment of incomplete type */
3200 			warning(143);
3201 		}
3202 		/* FALLTHROUGH */
3203 	default:
3204 		if (tp->t_bitfield) {
3205 			/* cannot take size/alignment of bit-field */
3206 			error(145);
3207 		}
3208 		if (tp->t_tspec == VOID) {
3209 			/* cannot take size/alignment of void */
3210 			error(146);
3211 			elsz = 1;
3212 		} else {
3213 			elsz = size_in_bits(tp->t_tspec);
3214 			lint_assert(elsz > 0);
3215 		}
3216 		break;
3217 	}
3218 
3219 	return (int64_t)elem * elsz;
3220 }
3221 
3222 tnode_t *
3223 build_alignof(const type_t *tp)
3224 {
3225 	switch (tp->t_tspec) {
3226 	case ARRAY:
3227 		break;
3228 
3229 	case FUNC:
3230 		/* cannot take size/alignment of function */
3231 		error(144);
3232 		return 0;
3233 
3234 	case STRUCT:
3235 	case UNION:
3236 		if (is_incomplete(tp)) {
3237 			/* cannot take size/alignment of incomplete type */
3238 			error(143);
3239 			return 0;
3240 		}
3241 		break;
3242 	case ENUM:
3243 		break;
3244 	default:
3245 		if (tp->t_bitfield) {
3246 			/* cannot take size/alignment of bit-field */
3247 			error(145);
3248 			return 0;
3249 		}
3250 		if (tp->t_tspec == VOID) {
3251 			/* cannot take size/alignment of void */
3252 			error(146);
3253 			return 0;
3254 		}
3255 		break;
3256 	}
3257 
3258 	return expr_new_integer_constant(SIZEOF_TSPEC,
3259 	    (int64_t)alignment_in_bits(tp) / CHAR_SIZE);
3260 }
3261 
3262 /*
3263  * Type casts.
3264  */
3265 tnode_t *
3266 cast(tnode_t *tn, type_t *tp)
3267 {
3268 	tspec_t	nt, ot;
3269 
3270 	if (tn == NULL)
3271 		return NULL;
3272 
3273 	/*
3274 	 * XXX: checking for tp == NULL is only a quick fix for PR 22119.
3275 	 *  The proper fix needs to be investigated properly.
3276 	 *  See d_pr_22119.c for how to get here.
3277 	 */
3278 	if (tp == NULL)
3279 		return NULL;
3280 
3281 	tn = cconv(tn);
3282 
3283 	nt = tp->t_tspec;
3284 	ot = tn->tn_type->t_tspec;
3285 
3286 	if (nt == VOID) {
3287 		/*
3288 		 * XXX ANSI C requires scalar types or void (Plauger & Brodie).
3289 		 * But this seems really questionable.
3290 		 */
3291 	} else if (nt == UNION) {
3292 		sym_t *m;
3293 		struct_or_union *str = tp->t_str;
3294 		if (!Sflag) {
3295 			/* union cast is a C9X feature */
3296 			error(328);
3297 			return NULL;
3298 		}
3299 		for (m = str->sou_first_member; m != NULL; m = m->s_next) {
3300 			if (sametype(m->s_type, tn->tn_type)) {
3301 				tn = expr_zalloc_tnode();
3302 				tn->tn_op = CVT;
3303 				tn->tn_type = tp;
3304 				tn->tn_cast = true;
3305 				tn->tn_right = NULL;
3306 				return tn;
3307 			}
3308 		}
3309 		/* type '%s' is not a member of '%s' */
3310 		error(329, type_name(tn->tn_type), type_name(tp));
3311 		return NULL;
3312 	} else if (nt == STRUCT || nt == ARRAY || nt == FUNC) {
3313 		if (!Sflag || nt == ARRAY || nt == FUNC) {
3314 			/* invalid cast expression */
3315 			error(147);
3316 			return NULL;
3317 		}
3318 	} else if (ot == STRUCT || ot == UNION) {
3319 		/* invalid cast expression */
3320 		error(147);
3321 		return NULL;
3322 	} else if (ot == VOID) {
3323 		/* improper cast of void expression */
3324 		error(148);
3325 		return NULL;
3326 	} else if (is_integer(nt) && is_scalar(ot)) {
3327 		/* ok */
3328 	} else if (is_floating(nt) && is_arithmetic(ot)) {
3329 		/* ok */
3330 	} else if (nt == PTR && is_integer(ot)) {
3331 		/* ok */
3332 	} else if (nt == PTR && ot == PTR) {
3333 		if (!tp->t_subt->t_const && tn->tn_type->t_subt->t_const) {
3334 			if (hflag)
3335 				/* cast discards 'const' from type '%s' */
3336 				warning(275, type_name(tn->tn_type));
3337 		}
3338 	} else {
3339 		/* invalid cast expression */
3340 		error(147);
3341 		return NULL;
3342 	}
3343 
3344 	tn = convert(CVT, 0, tp, tn);
3345 	tn->tn_cast = true;
3346 
3347 	return tn;
3348 }
3349 
3350 /*
3351  * Create the node for a function argument.
3352  * All necessary conversions and type checks are done in
3353  * new_function_call_node because new_function_argument_node has no
3354  * information about expected argument types.
3355  */
3356 tnode_t *
3357 new_function_argument_node(tnode_t *args, tnode_t *arg)
3358 {
3359 	tnode_t	*ntn;
3360 
3361 	/*
3362 	 * If there was a serious error in the expression for the argument,
3363 	 * create a dummy argument so the positions of the remaining arguments
3364 	 * will not change.
3365 	 */
3366 	if (arg == NULL)
3367 		arg = expr_new_integer_constant(INT, 0);
3368 
3369 	ntn = new_tnode(PUSH, arg->tn_type, arg, args);
3370 
3371 	return ntn;
3372 }
3373 
3374 /*
3375  * Create the node for a function call. Also check types of
3376  * function arguments and insert conversions, if necessary.
3377  */
3378 tnode_t *
3379 new_function_call_node(tnode_t *func, tnode_t *args)
3380 {
3381 	tnode_t	*ntn;
3382 	op_t	fcop;
3383 
3384 	if (func == NULL)
3385 		return NULL;
3386 
3387 	if (func->tn_op == NAME && func->tn_type->t_tspec == FUNC) {
3388 		fcop = CALL;
3389 	} else {
3390 		fcop = ICALL;
3391 	}
3392 
3393 	check_ctype_function_call(func, args);
3394 
3395 	/*
3396 	 * after cconv() func will always be a pointer to a function
3397 	 * if it is a valid function designator.
3398 	 */
3399 	func = cconv(func);
3400 
3401 	if (func->tn_type->t_tspec != PTR ||
3402 	    func->tn_type->t_subt->t_tspec != FUNC) {
3403 		/* illegal function (type %s) */
3404 		error(149, type_name(func->tn_type));
3405 		return NULL;
3406 	}
3407 
3408 	args = check_function_arguments(func->tn_type->t_subt, args);
3409 
3410 	ntn = new_tnode(fcop, func->tn_type->t_subt->t_subt, func, args);
3411 
3412 	return ntn;
3413 }
3414 
3415 /*
3416  * Check types of all function arguments and insert conversions,
3417  * if necessary.
3418  */
3419 static tnode_t *
3420 check_function_arguments(type_t *ftp, tnode_t *args)
3421 {
3422 	tnode_t	*arg;
3423 	sym_t	*asym;
3424 	tspec_t	at;
3425 	int	narg, npar, n, i;
3426 
3427 	/* get # of args in the prototype */
3428 	npar = 0;
3429 	for (asym = ftp->t_args; asym != NULL; asym = asym->s_next)
3430 		npar++;
3431 
3432 	/* get # of args in function call */
3433 	narg = 0;
3434 	for (arg = args; arg != NULL; arg = arg->tn_right)
3435 		narg++;
3436 
3437 	asym = ftp->t_args;
3438 	if (ftp->t_proto && npar != narg && !(ftp->t_vararg && npar < narg)) {
3439 		/* argument mismatch: %d arg%s passed, %d expected */
3440 		error(150, narg, narg > 1 ? "s" : "", npar);
3441 		asym = NULL;
3442 	}
3443 
3444 	for (n = 1; n <= narg; n++) {
3445 
3446 		/*
3447 		 * The rightmost argument is at the top of the argument
3448 		 * subtree.
3449 		 */
3450 		for (i = narg, arg = args; i > n; i--, arg = arg->tn_right)
3451 			continue;
3452 
3453 		/* some things which are always not allowed */
3454 		if ((at = arg->tn_left->tn_type->t_tspec) == VOID) {
3455 			/* void expressions may not be arguments, arg #%d */
3456 			error(151, n);
3457 			return NULL;
3458 		} else if ((at == STRUCT || at == UNION) &&
3459 			   is_incomplete(arg->tn_left->tn_type)) {
3460 			/* argument cannot have unknown size, arg #%d */
3461 			error(152, n);
3462 			return NULL;
3463 		} else if (is_integer(at) &&
3464 			   arg->tn_left->tn_type->t_is_enum &&
3465 			   is_incomplete(arg->tn_left->tn_type)) {
3466 			/* argument cannot have unknown size, arg #%d */
3467 			warning(152, n);
3468 		}
3469 
3470 		/* class conversions (arg in value context) */
3471 		arg->tn_left = cconv(arg->tn_left);
3472 
3473 		if (asym != NULL) {
3474 			arg->tn_left = check_prototype_argument(
3475 			    n, asym->s_type, arg->tn_left);
3476 		} else {
3477 			arg->tn_left = promote(NOOP, true, arg->tn_left);
3478 		}
3479 		arg->tn_type = arg->tn_left->tn_type;
3480 
3481 		if (asym != NULL)
3482 			asym = asym->s_next;
3483 	}
3484 
3485 	return args;
3486 }
3487 
3488 /*
3489  * Compare the type of an argument with the corresponding type of a
3490  * prototype parameter. If it is a valid combination, but both types
3491  * are not the same, insert a conversion to convert the argument into
3492  * the type of the parameter.
3493  */
3494 static tnode_t *
3495 check_prototype_argument(
3496 	int	n,		/* pos of arg */
3497 	type_t	*tp,		/* expected type (from prototype) */
3498 	tnode_t	*tn)		/* argument */
3499 {
3500 	tnode_t	*ln;
3501 	bool	dowarn;
3502 
3503 	ln = xcalloc(1, sizeof(*ln));
3504 	ln->tn_type = expr_dup_type(tp);
3505 	ln->tn_type->t_const = false;
3506 	ln->tn_lvalue = true;
3507 	if (typeok(FARG, n, ln, tn)) {
3508 		if (!eqtype(tp, tn->tn_type,
3509 		    true, false, (dowarn = false, &dowarn)) || dowarn)
3510 			tn = convert(FARG, n, tp, tn);
3511 	}
3512 	free(ln);
3513 	return tn;
3514 }
3515 
3516 /*
3517  * Return the value of an integral constant expression.
3518  * If the expression is not constant or its type is not an integer
3519  * type, an error message is printed.
3520  */
3521 val_t *
3522 constant(tnode_t *tn, bool required)
3523 {
3524 	val_t	*v;
3525 
3526 	if (tn != NULL)
3527 		tn = cconv(tn);
3528 	if (tn != NULL)
3529 		tn = promote(NOOP, false, tn);
3530 
3531 	v = xcalloc(1, sizeof(*v));
3532 
3533 	if (tn == NULL) {
3534 		lint_assert(nerr != 0);
3535 		if (dflag)
3536 			printf("constant node is null; returning 1 instead\n");
3537 		v->v_tspec = INT;
3538 		v->v_quad = 1;
3539 		return v;
3540 	}
3541 
3542 	v->v_tspec = tn->tn_type->t_tspec;
3543 
3544 	if (tn->tn_op == CON) {
3545 		lint_assert(tn->tn_type->t_tspec == tn->tn_val->v_tspec);
3546 		if (is_integer(tn->tn_val->v_tspec)) {
3547 			v->v_ansiu = tn->tn_val->v_ansiu;
3548 			v->v_quad = tn->tn_val->v_quad;
3549 			return v;
3550 		}
3551 		v->v_quad = tn->tn_val->v_ldbl;
3552 	} else {
3553 		v->v_quad = 1;
3554 	}
3555 
3556 	if (required)
3557 		/* integral constant expression expected */
3558 		error(55);
3559 	else
3560 		/* variable array dimension is a C99/GCC extension */
3561 		c99ism(318);
3562 
3563 	if (!is_integer(v->v_tspec))
3564 		v->v_tspec = INT;
3565 
3566 	return v;
3567 }
3568 
3569 static bool
3570 is_constcond_false(const tnode_t *tn, tspec_t t)
3571 {
3572 	return (t == BOOL || t == INT) &&
3573 	       tn->tn_op == CON && tn->tn_val->v_quad == 0;
3574 }
3575 
3576 /*
3577  * Perform some tests on expressions which can't be done in build() and
3578  * functions called by build(). These tests must be done here because
3579  * we need some information about the context in which the operations
3580  * are performed.
3581  * After all tests are performed and dofreeblk is true, expr() frees the
3582  * memory which is used for the expression.
3583  */
3584 void
3585 expr(tnode_t *tn, bool vctx, bool tctx, bool dofreeblk, bool constcond_false_ok)
3586 {
3587 
3588 	lint_assert(tn != NULL || nerr != 0);
3589 
3590 	if (tn == NULL) {
3591 		expr_free_all();
3592 		return;
3593 	}
3594 
3595 	/* expr() is also called in global initializations */
3596 	/* TODO: rename constcond_false_ok */
3597 	if (dcs->d_ctx != EXTERN && !constcond_false_ok)
3598 		check_statement_reachable();
3599 
3600 	check_expr_misc(tn, vctx, tctx, !tctx, false, false, false);
3601 	if (tn->tn_op == ASSIGN) {
3602 		if (hflag && tctx)
3603 			/* assignment in conditional context */
3604 			warning(159);
3605 	} else if (tn->tn_op == CON) {
3606 		if (hflag && tctx && !constcond_flag &&
3607 		    !tn->tn_system_dependent &&
3608 		    !(constcond_false_ok &&
3609 		      is_constcond_false(tn, tn->tn_type->t_tspec)))
3610 			/* constant in conditional context */
3611 			warning(161);
3612 	}
3613 	if (!modtab[tn->tn_op].m_has_side_effect) {
3614 		/*
3615 		 * for left operands of COMMA this warning is already
3616 		 * printed
3617 		 */
3618 		if (tn->tn_op != COMMA && !vctx && !tctx)
3619 			check_null_effect(tn);
3620 	}
3621 	if (dflag)
3622 		display_expression(tn, 0);
3623 
3624 	/* free the tree memory */
3625 	if (dofreeblk)
3626 		expr_free_all();
3627 }
3628 
3629 static bool
3630 has_side_effect(const tnode_t *tn) // NOLINT(misc-no-recursion)
3631 {
3632 	op_t op = tn->tn_op;
3633 
3634 	if (modtab[op].m_has_side_effect)
3635 		return true;
3636 
3637 	if (op == CVT && tn->tn_type->t_tspec == VOID)
3638 		return has_side_effect(tn->tn_left);
3639 
3640 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3641 	if (op == LOGAND || op == LOGOR)
3642 		return has_side_effect(tn->tn_right);
3643 
3644 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3645 	if (op == QUEST)
3646 		return has_side_effect(tn->tn_right);
3647 
3648 	if (op == COLON || op == COMMA) {
3649 		return has_side_effect(tn->tn_left) ||
3650 		       has_side_effect(tn->tn_right);
3651 	}
3652 
3653 	return false;
3654 }
3655 
3656 static void
3657 check_null_effect(const tnode_t *tn)
3658 {
3659 
3660 	if (hflag && !has_side_effect(tn)) {
3661 		/* expression has null effect */
3662 		warning(129);
3663 	}
3664 }
3665 
3666 /*
3667  * Dump an expression to stdout
3668  * only used for debugging
3669  */
3670 static void
3671 display_expression(const tnode_t *tn, int offs)
3672 {
3673 	uint64_t uq;
3674 
3675 	if (tn == NULL) {
3676 		(void)printf("%*s%s\n", offs, "", "NULL");
3677 		return;
3678 	}
3679 	(void)printf("%*sop %s  ", offs, "", op_name(tn->tn_op));
3680 
3681 	if (tn->tn_op == NAME) {
3682 		(void)printf("%s: %s ",
3683 		    tn->tn_sym->s_name,
3684 		    storage_class_name(tn->tn_sym->s_scl));
3685 	} else if (tn->tn_op == CON && is_floating(tn->tn_type->t_tspec)) {
3686 		(void)printf("%#g ", (double)tn->tn_val->v_ldbl);
3687 	} else if (tn->tn_op == CON && is_integer(tn->tn_type->t_tspec)) {
3688 		uq = tn->tn_val->v_quad;
3689 		(void)printf("0x %08lx %08lx ",
3690 		    (long)(uq >> 32) & 0xffffffffl,
3691 		    (long)uq & 0xffffffffl);
3692 	} else if (tn->tn_op == CON) {
3693 		lint_assert(tn->tn_type->t_tspec == PTR);
3694 		(void)printf("0x%0*lx ", (int)(sizeof(void *) * CHAR_BIT / 4),
3695 			     (u_long)tn->tn_val->v_quad);
3696 	} else if (tn->tn_op == STRING) {
3697 		if (tn->tn_string->st_tspec == CHAR) {
3698 			(void)printf("\"%s\"", tn->tn_string->st_cp);
3699 		} else {
3700 			char	*s;
3701 			size_t	n;
3702 			n = MB_CUR_MAX * (tn->tn_string->st_len + 1);
3703 			s = xmalloc(n);
3704 			(void)wcstombs(s, tn->tn_string->st_wcp, n);
3705 			(void)printf("L\"%s\"", s);
3706 			free(s);
3707 		}
3708 		(void)printf(" ");
3709 	} else if (tn->tn_op == FSEL) {
3710 		(void)printf("o=%d, l=%d ", tn->tn_type->t_foffs,
3711 			     tn->tn_type->t_flen);
3712 	}
3713 	(void)printf("%s\n", ttos(tn->tn_type));
3714 	if (tn->tn_op == NAME || tn->tn_op == CON || tn->tn_op == STRING)
3715 		return;
3716 	display_expression(tn->tn_left, offs + 2);
3717 	if (modtab[tn->tn_op].m_binary ||
3718 	    (tn->tn_op == PUSH && tn->tn_right != NULL)) {
3719 		display_expression(tn->tn_right, offs + 2);
3720 	}
3721 }
3722 
3723 /*
3724  * Called by expr() to recursively perform some tests.
3725  */
3726 /* ARGSUSED */
3727 void
3728 check_expr_misc(const tnode_t *tn, bool vctx, bool tctx,
3729 		bool eqwarn, bool fcall, bool rvdisc, bool szof)
3730 {
3731 	tnode_t	*ln, *rn;
3732 	const mod_t *mp;
3733 	op_t	op;
3734 	scl_t	sc;
3735 	dinfo_t	*di;
3736 
3737 	if (tn == NULL)
3738 		return;
3739 
3740 	ln = tn->tn_left;
3741 	rn = tn->tn_right;
3742 	mp = &modtab[op = tn->tn_op];
3743 
3744 	switch (op) {
3745 	case ADDR:
3746 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3747 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3748 			if (!szof)
3749 				mark_as_set(ln->tn_sym);
3750 			mark_as_used(ln->tn_sym, fcall, szof);
3751 		}
3752 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3753 			/* check the range of array indices */
3754 			check_array_index(ln->tn_left, true);
3755 		break;
3756 	case LOAD:
3757 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3758 			/* check the range of array indices */
3759 			check_array_index(ln->tn_left, false);
3760 		/* FALLTHROUGH */
3761 	case PUSH:
3762 	case INCBEF:
3763 	case DECBEF:
3764 	case INCAFT:
3765 	case DECAFT:
3766 	case ADDASS:
3767 	case SUBASS:
3768 	case MULASS:
3769 	case DIVASS:
3770 	case MODASS:
3771 	case ANDASS:
3772 	case ORASS:
3773 	case XORASS:
3774 	case SHLASS:
3775 	case SHRASS:
3776 	case REAL:
3777 	case IMAG:
3778 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3779 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3780 			sc = ln->tn_sym->s_scl;
3781 			/*
3782 			 * Look if there was a asm statement in one of the
3783 			 * compound statements we are in. If not, we don't
3784 			 * print a warning.
3785 			 */
3786 			for (di = dcs; di != NULL; di = di->d_next) {
3787 				if (di->d_asm)
3788 					break;
3789 			}
3790 			if (sc != EXTERN && sc != STATIC &&
3791 			    !ln->tn_sym->s_set && !szof && di == NULL) {
3792 				/* %s may be used before set */
3793 				warning(158, ln->tn_sym->s_name);
3794 				mark_as_set(ln->tn_sym);
3795 			}
3796 			mark_as_used(ln->tn_sym, false, false);
3797 		}
3798 		break;
3799 	case ASSIGN:
3800 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3801 		if (ln->tn_op == NAME && !szof && (reached || !warn_about_unreachable)) {
3802 			mark_as_set(ln->tn_sym);
3803 			if (ln->tn_sym->s_scl == EXTERN)
3804 				outusg(ln->tn_sym);
3805 		}
3806 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3807 			/* check the range of array indices */
3808 			check_array_index(ln->tn_left, false);
3809 		break;
3810 	case CALL:
3811 		lint_assert(ln->tn_op == ADDR);
3812 		lint_assert(ln->tn_left->tn_op == NAME);
3813 		if (!szof)
3814 			outcall(tn, vctx || tctx, rvdisc);
3815 		break;
3816 	case EQ:
3817 		if (hflag && eqwarn)
3818 			/* operator '==' found where '=' was expected */
3819 			warning(160);
3820 		break;
3821 	case CON:
3822 	case NAME:
3823 	case STRING:
3824 		return;
3825 		/* LINTED206: (enumeration values not handled in switch) */
3826 	case BITOR:
3827 	case BITXOR:
3828 	case NE:
3829 	case GE:
3830 	case GT:
3831 	case LE:
3832 	case LT:
3833 	case SHR:
3834 	case SHL:
3835 	case MINUS:
3836 	case PLUS:
3837 	case MOD:
3838 	case DIV:
3839 	case MULT:
3840 	case INDIR:
3841 	case UMINUS:
3842 	case UPLUS:
3843 	case DEC:
3844 	case INC:
3845 	case COMPL:
3846 	case NOT:
3847 	case POINT:
3848 	case ARROW:
3849 	case NOOP:
3850 	case BITAND:
3851 	case FARG:
3852 	case CASE:
3853 	case INIT:
3854 	case RETURN:
3855 	case ICALL:
3856 	case CVT:
3857 	case COMMA:
3858 	case FSEL:
3859 	case COLON:
3860 	case QUEST:
3861 	case LOGOR:
3862 	case LOGAND:
3863 		break;
3864 	}
3865 
3866 	bool cvctx = mp->m_left_value_context;
3867 	bool ctctx = mp->m_left_test_context;
3868 	bool eq = mp->m_warn_if_operand_eq &&
3869 		  !ln->tn_parenthesized &&
3870 		  rn != NULL && !rn->tn_parenthesized;
3871 
3872 	/*
3873 	 * values of operands of ':' are not used if the type of at least
3874 	 * one of the operands (for gcc compatibility) is void
3875 	 * XXX test/value context of QUEST should probably be used as
3876 	 * context for both operands of COLON
3877 	 */
3878 	if (op == COLON && tn->tn_type->t_tspec == VOID)
3879 		cvctx = ctctx = false;
3880 	bool discard = op == CVT && tn->tn_type->t_tspec == VOID;
3881 	check_expr_misc(ln, cvctx, ctctx, eq, op == CALL, discard, szof);
3882 
3883 	switch (op) {
3884 	case PUSH:
3885 		if (rn != NULL)
3886 			check_expr_misc(rn, false, false, eq, false, false,
3887 			    szof);
3888 		break;
3889 	case LOGAND:
3890 	case LOGOR:
3891 		check_expr_misc(rn, false, true, eq, false, false, szof);
3892 		break;
3893 	case COLON:
3894 		check_expr_misc(rn, cvctx, ctctx, eq, false, false, szof);
3895 		break;
3896 	case COMMA:
3897 		check_expr_misc(rn, vctx, tctx, eq, false, false, szof);
3898 		break;
3899 	default:
3900 		if (mp->m_binary)
3901 			check_expr_misc(rn, true, false, eq, false, false,
3902 			    szof);
3903 		break;
3904 	}
3905 
3906 }
3907 
3908 /*
3909  * Checks the range of array indices, if possible.
3910  * amper is set if only the address of the element is used. This
3911  * means that the index is allowed to refer to the first element
3912  * after the array.
3913  */
3914 static void
3915 check_array_index(tnode_t *tn, bool amper)
3916 {
3917 	int	dim;
3918 	tnode_t	*ln, *rn;
3919 	int	elsz;
3920 	int64_t	con;
3921 
3922 	ln = tn->tn_left;
3923 	rn = tn->tn_right;
3924 
3925 	/* We can only check constant indices. */
3926 	if (rn->tn_op != CON)
3927 		return;
3928 
3929 	/* Return if the left node does not stem from an array. */
3930 	if (ln->tn_op != ADDR)
3931 		return;
3932 	if (ln->tn_left->tn_op != STRING && ln->tn_left->tn_op != NAME)
3933 		return;
3934 	if (ln->tn_left->tn_type->t_tspec != ARRAY)
3935 		return;
3936 
3937 	/*
3938 	 * For incomplete array types, we can print a warning only if
3939 	 * the index is negative.
3940 	 */
3941 	if (is_incomplete(ln->tn_left->tn_type) && rn->tn_val->v_quad >= 0)
3942 		return;
3943 
3944 	/* Get the size of one array element */
3945 	if ((elsz = length(ln->tn_type->t_subt, NULL)) == 0)
3946 		return;
3947 	elsz /= CHAR_SIZE;
3948 
3949 	/* Change the unit of the index from bytes to element size. */
3950 	if (is_uinteger(rn->tn_type->t_tspec)) {
3951 		con = (uint64_t)rn->tn_val->v_quad / elsz;
3952 	} else {
3953 		con = rn->tn_val->v_quad / elsz;
3954 	}
3955 
3956 	dim = ln->tn_left->tn_type->t_dim + (amper ? 1 : 0);
3957 
3958 	if (!is_uinteger(rn->tn_type->t_tspec) && con < 0) {
3959 		/* array subscript cannot be negative: %ld */
3960 		warning(167, (long)con);
3961 	} else if (dim > 0 && (uint64_t)con >= (uint64_t)dim) {
3962 		/* array subscript cannot be > %d: %ld */
3963 		warning(168, dim - 1, (long)con);
3964 	}
3965 }
3966 
3967 /*
3968  * Check for ordered comparisons of unsigned values with 0.
3969  */
3970 static void
3971 check_integer_comparison(op_t op, tnode_t *ln, tnode_t *rn)
3972 {
3973 	tspec_t	lt, rt;
3974 
3975 	lt = ln->tn_type->t_tspec;
3976 	rt = rn->tn_type->t_tspec;
3977 
3978 	if (ln->tn_op != CON && rn->tn_op != CON)
3979 		return;
3980 
3981 	if (!is_integer(lt) || !is_integer(rt))
3982 		return;
3983 
3984 	if ((hflag || pflag) && lt == CHAR && rn->tn_op == CON &&
3985 	    (rn->tn_val->v_quad < 0 ||
3986 	     rn->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
3987 		/* nonportable character comparison, op %s */
3988 		warning(230, op_name(op));
3989 		return;
3990 	}
3991 	if ((hflag || pflag) && rt == CHAR && ln->tn_op == CON &&
3992 	    (ln->tn_val->v_quad < 0 ||
3993 	     ln->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
3994 		/* nonportable character comparison, op %s */
3995 		warning(230, op_name(op));
3996 		return;
3997 	}
3998 	if (is_uinteger(lt) && !is_uinteger(rt) &&
3999 	    rn->tn_op == CON && rn->tn_val->v_quad <= 0) {
4000 		if (rn->tn_val->v_quad < 0) {
4001 			/* comparison of %s with %s, op %s */
4002 			warning(162, type_name(ln->tn_type),
4003 			    "negative constant", op_name(op));
4004 		} else if (op == LT || op == GE || (hflag && op == LE)) {
4005 			/* comparison of %s with %s, op %s */
4006 			warning(162, type_name(ln->tn_type), "0", op_name(op));
4007 		}
4008 		return;
4009 	}
4010 	if (is_uinteger(rt) && !is_uinteger(lt) &&
4011 	    ln->tn_op == CON && ln->tn_val->v_quad <= 0) {
4012 		if (ln->tn_val->v_quad < 0) {
4013 			/* comparison of %s with %s, op %s */
4014 			warning(162, "negative constant",
4015 			    type_name(rn->tn_type), op_name(op));
4016 		} else if (op == GT || op == LE || (hflag && op == GE)) {
4017 			/* comparison of %s with %s, op %s */
4018 			warning(162, "0", type_name(rn->tn_type), op_name(op));
4019 		}
4020 		return;
4021 	}
4022 }
4023 
4024 /*
4025  * Return whether the expression can be used for static initialization.
4026  *
4027  * Constant initialization expressions must be constant or an address
4028  * of a static object with an optional offset. In the first case,
4029  * the result is returned in *offsp. In the second case, the static
4030  * object is returned in *symp and the offset in *offsp.
4031  *
4032  * The expression can consist of PLUS, MINUS, ADDR, NAME, STRING and
4033  * CON. Type conversions are allowed if they do not change binary
4034  * representation (including width).
4035  */
4036 bool
4037 constant_addr(const tnode_t *tn, const sym_t **symp, ptrdiff_t *offsp)
4038 {
4039 	const sym_t *sym;
4040 	ptrdiff_t offs1, offs2;
4041 	tspec_t	t, ot;
4042 
4043 	switch (tn->tn_op) {
4044 	case MINUS:
4045 		if (tn->tn_right->tn_op == CVT)
4046 			return constant_addr(tn->tn_right, symp, offsp);
4047 		else if (tn->tn_right->tn_op != CON)
4048 			return false;
4049 		/* FALLTHROUGH */
4050 	case PLUS:
4051 		offs1 = offs2 = 0;
4052 		if (tn->tn_left->tn_op == CON) {
4053 			offs1 = (ptrdiff_t)tn->tn_left->tn_val->v_quad;
4054 			if (!constant_addr(tn->tn_right, &sym, &offs2))
4055 				return false;
4056 		} else if (tn->tn_right->tn_op == CON) {
4057 			offs2 = (ptrdiff_t)tn->tn_right->tn_val->v_quad;
4058 			if (tn->tn_op == MINUS)
4059 				offs2 = -offs2;
4060 			if (!constant_addr(tn->tn_left, &sym, &offs1))
4061 				return false;
4062 		} else {
4063 			return false;
4064 		}
4065 		*symp = sym;
4066 		*offsp = offs1 + offs2;
4067 		return true;
4068 	case ADDR:
4069 		if (tn->tn_left->tn_op == NAME) {
4070 			*symp = tn->tn_left->tn_sym;
4071 			*offsp = 0;
4072 			return true;
4073 		} else {
4074 			/*
4075 			 * If this would be the front end of a compiler we
4076 			 * would return a label instead of 0, at least if
4077 			 * 'tn->tn_left->tn_op == STRING'.
4078 			 */
4079 			*symp = NULL;
4080 			*offsp = 0;
4081 			return true;
4082 		}
4083 	case CVT:
4084 		t = tn->tn_type->t_tspec;
4085 		ot = tn->tn_left->tn_type->t_tspec;
4086 		if ((!is_integer(t) && t != PTR) ||
4087 		    (!is_integer(ot) && ot != PTR)) {
4088 			return false;
4089 		}
4090 #ifdef notdef
4091 		/*
4092 		 * consider:
4093 		 *	struct foo {
4094 		 *		unsigned char a;
4095 		 *	} f = {
4096 		 *		(u_char)(u_long)(&(((struct foo *)0)->a))
4097 		 *	};
4098 		 * since psize(u_long) != psize(u_char) this fails.
4099 		 */
4100 		else if (psize(t) != psize(ot))
4101 			return -1;
4102 #endif
4103 		return constant_addr(tn->tn_left, symp, offsp);
4104 	default:
4105 		return false;
4106 	}
4107 }
4108 
4109 /*
4110  * Concatenate two string constants.
4111  */
4112 strg_t *
4113 cat_strings(strg_t *strg1, strg_t *strg2)
4114 {
4115 	size_t	len1, len2, len;
4116 
4117 	if (strg1->st_tspec != strg2->st_tspec) {
4118 		/* cannot concatenate wide and regular string literals */
4119 		error(292);
4120 		return strg1;
4121 	}
4122 
4123 	len1 = strg1->st_len;
4124 	len2 = strg2->st_len + 1;	/* + NUL */
4125 	len = len1 + len2;
4126 
4127 #define COPY(F) \
4128     do { \
4129 	strg1->F = xrealloc(strg1->F, len * sizeof(*strg1->F)); \
4130 	(void)memcpy(strg1->F + len1, strg2->F, len2 * sizeof(*strg1->F)); \
4131 	free(strg2->F); \
4132     } while (/*CONSTCOND*/false)
4133 
4134 	if (strg1->st_tspec == CHAR)
4135 		COPY(st_cp);
4136 	else
4137 		COPY(st_wcp);
4138 
4139 	strg1->st_len = len - 1; /* - NUL */
4140 	free(strg2);
4141 
4142 	return strg1;
4143 }
4144 
4145 static bool
4146 is_confusing_precedence(op_t op, op_t lop, bool lparen, op_t rop, bool rparen)
4147 {
4148 
4149 	if (op == SHL || op == SHR) {
4150 		if (!lparen && (lop == PLUS || lop == MINUS))
4151 			return true;
4152 		if (!rparen && (rop == PLUS || rop == MINUS))
4153 			return true;
4154 		return false;
4155 	}
4156 
4157 	if (op == LOGOR) {
4158 		if (!lparen && lop == LOGAND)
4159 			return true;
4160 		if (!rparen && rop == LOGAND)
4161 			return true;
4162 		return false;
4163 	}
4164 
4165 	lint_assert(op == BITAND || op == BITXOR || op == BITOR);
4166 	if (!lparen && lop != op) {
4167 		if (lop == PLUS || lop == MINUS)
4168 			return true;
4169 		if (lop == BITAND || lop == BITXOR)
4170 			return true;
4171 	}
4172 	if (!rparen && rop != op) {
4173 		if (rop == PLUS || rop == MINUS)
4174 			return true;
4175 		if (rop == BITAND || rop == BITXOR)
4176 			return true;
4177 	}
4178 	return false;
4179 }
4180 
4181 /*
4182  * Print a warning if the given node has operands which should be
4183  * parenthesized.
4184  *
4185  * XXX Does not work if an operand is a constant expression. Constant
4186  * expressions are already folded.
4187  */
4188 static void
4189 check_precedence_confusion(tnode_t *tn)
4190 {
4191 	tnode_t *ln, *rn;
4192 
4193 	if (!hflag)
4194 		return;
4195 
4196 	debug_node(tn, 0);
4197 
4198 	lint_assert(modtab[tn->tn_op].m_binary);
4199 	for (ln = tn->tn_left; ln->tn_op == CVT; ln = ln->tn_left)
4200 		continue;
4201 	for (rn = tn->tn_right; rn->tn_op == CVT; rn = rn->tn_left)
4202 		continue;
4203 
4204 	if (is_confusing_precedence(tn->tn_op,
4205 	    ln->tn_op, ln->tn_parenthesized,
4206 	    rn->tn_op, rn->tn_parenthesized)) {
4207 		/* precedence confusion possible: parenthesize! */
4208 		warning(169);
4209 	}
4210 }
4211