xref: /netbsd-src/usr.bin/xlint/lint1/tree.c (revision 9fb66d812c00ebfb445c0b47dea128f32aa6fe96)
1 /*	$NetBSD: tree.c,v 1.277 2021/04/17 16:58:04 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: tree.c,v 1.277 2021/04/17 16:58:04 rillig Exp $");
41 #endif
42 
43 #include <float.h>
44 #include <limits.h>
45 #include <math.h>
46 #include <signal.h>
47 #include <stdlib.h>
48 #include <string.h>
49 
50 #include "lint1.h"
51 #include "cgram.h"
52 
53 static	tnode_t	*expr_new_integer_constant(tspec_t, int64_t);
54 static	void	check_pointer_comparison(op_t,
55 					 const tnode_t *, const tnode_t *);
56 static	bool	check_assign_types_compatible(op_t, int,
57 					      const tnode_t *, const tnode_t *);
58 static	void	check_bad_enum_operation(op_t,
59 					 const tnode_t *, const tnode_t *);
60 static	void	check_enum_type_mismatch(op_t, int,
61 				         const tnode_t *, const tnode_t *);
62 static	void	check_enum_int_mismatch(op_t, int,
63 					const tnode_t *, const tnode_t *);
64 static	tnode_t	*new_tnode(op_t, type_t *, tnode_t *, tnode_t *);
65 static	void	balance(op_t, tnode_t **, tnode_t **);
66 static	void	warn_incompatible_types(op_t, const type_t *, tspec_t,
67 					const type_t *, tspec_t);
68 static	void	warn_incompatible_pointers(const mod_t *,
69 					   const type_t *, const type_t *);
70 static	bool	has_constant_member(const type_t *);
71 static	void	check_prototype_conversion(int, tspec_t, tspec_t, type_t *,
72 					   tnode_t *);
73 static	void	check_integer_conversion(op_t, int, tspec_t, tspec_t, type_t *,
74 					 tnode_t *);
75 static	void	check_pointer_integer_conversion(op_t, tspec_t, type_t *,
76 						 tnode_t *);
77 static	void	check_pointer_conversion(tnode_t *, type_t *);
78 static	tnode_t	*build_struct_access(op_t, tnode_t *, tnode_t *);
79 static	tnode_t	*build_prepost_incdec(op_t, tnode_t *);
80 static	tnode_t	*build_real_imag(op_t, tnode_t *);
81 static	tnode_t	*build_address(tnode_t *, bool);
82 static	tnode_t	*build_plus_minus(op_t, tnode_t *, tnode_t *);
83 static	tnode_t	*build_bit_shift(op_t, tnode_t *, tnode_t *);
84 static	tnode_t	*build_colon(tnode_t *, tnode_t *);
85 static	tnode_t	*build_assignment(op_t, tnode_t *, tnode_t *);
86 static	tnode_t	*plength(type_t *);
87 static	tnode_t	*fold(tnode_t *);
88 static	tnode_t	*fold_test(tnode_t *);
89 static	tnode_t	*fold_float(tnode_t *);
90 static	tnode_t	*check_function_arguments(type_t *, tnode_t *);
91 static	tnode_t	*check_prototype_argument(int, type_t *, tnode_t *);
92 static	void	check_null_effect(const tnode_t *);
93 static	void	display_expression(const tnode_t *, int);
94 static	void	check_array_index(tnode_t *, bool);
95 static	void	check_integer_comparison(op_t, tnode_t *, tnode_t *);
96 static	void	check_precedence_confusion(tnode_t *);
97 
98 extern sig_atomic_t fpe;
99 
100 static const char *
101 op_name(op_t op)
102 {
103 	return modtab[op].m_name;
104 }
105 
106 #ifdef DEBUG
107 void
108 debug_node(const tnode_t *tn, int indent)
109 {
110 	op_t op;
111 
112 	if (tn == NULL) {
113 		printf("%*s" "null\n", indent, "");
114 		return;
115 	}
116 
117 	op = tn->tn_op;
118 	printf("%*s%s with type '%s'%s%s",
119 	    2 * indent, "",
120 	    op == CVT && !tn->tn_cast ? "convert" : op_name(op),
121 	    type_name(tn->tn_type), tn->tn_lvalue ? ", lvalue" : "",
122 	    tn->tn_parenthesized ? ", parenthesized" : "");
123 
124 	if (op == NAME)
125 		printf(" %s\n", tn->tn_sym->s_name);
126 	else if (op == CON && is_floating(tn->tn_type->t_tspec))
127 		printf(", value %Lg", tn->tn_val->v_ldbl);
128 	else if (op == CON && is_uinteger(tn->tn_type->t_tspec))
129 		printf(", value %llu\n", (unsigned long long)tn->tn_val->v_quad);
130 	else if (op == CON && is_integer(tn->tn_type->t_tspec))
131 		printf(", value %lld\n", (long long)tn->tn_val->v_quad);
132 	else if (op == CON)
133 		printf(", unknown value\n");
134 	else if (op == STRING)
135 		printf(", length %zu\n", tn->tn_string->st_len);
136 	else {
137 		printf("\n");
138 
139 		debug_node(tn->tn_left, indent + 1);
140 		if (modtab[op].m_binary || tn->tn_right != NULL)
141 			debug_node(tn->tn_right, indent + 1);
142 	}
143 }
144 #endif
145 
146 /* Build 'pointer to tp', 'array of tp' or 'function returning tp'. */
147 type_t *
148 derive_type(type_t *tp, tspec_t t)
149 {
150 	type_t	*tp2;
151 
152 	tp2 = getblk(sizeof(*tp2));
153 	tp2->t_tspec = t;
154 	tp2->t_subt = tp;
155 	return tp2;
156 }
157 
158 /*
159  * Build 'pointer to tp', 'array of tp' or 'function returning tp'.  The
160  * memory is freed at the end of the current expression.
161  */
162 type_t *
163 expr_derive_type(type_t *tp, tspec_t t)
164 {
165 	type_t	*tp2;
166 
167 	tp2 = expr_zalloc(sizeof(*tp2));
168 	tp2->t_tspec = t;
169 	tp2->t_subt = tp;
170 	return tp2;
171 }
172 
173 /*
174  * Create a node for a constant.
175  */
176 tnode_t *
177 expr_new_constant(type_t *tp, val_t *v)
178 {
179 	tnode_t	*n;
180 
181 	n = expr_zalloc_tnode();
182 	n->tn_op = CON;
183 	n->tn_type = tp;
184 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
185 	n->tn_val->v_tspec = tp->t_tspec;
186 	n->tn_val->v_ansiu = v->v_ansiu;
187 	n->tn_val->v_u = v->v_u;
188 	free(v);
189 	return n;
190 }
191 
192 static tnode_t *
193 expr_new_integer_constant(tspec_t t, int64_t q)
194 {
195 	tnode_t	*n;
196 
197 	n = expr_zalloc_tnode();
198 	n->tn_op = CON;
199 	n->tn_type = gettyp(t);
200 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
201 	n->tn_val->v_tspec = t;
202 	n->tn_val->v_quad = q;
203 	return n;
204 }
205 
206 static void
207 fallback_symbol(sym_t *sym)
208 {
209 
210 	if (fallback_symbol_strict_bool(sym))
211 		return;
212 
213 	if (block_level > 0 && (strcmp(sym->s_name, "__FUNCTION__") == 0 ||
214 			   strcmp(sym->s_name, "__PRETTY_FUNCTION__") == 0)) {
215 		/* __FUNCTION__/__PRETTY_FUNCTION__ is a GCC extension */
216 		gnuism(316);
217 		sym->s_type = derive_type(gettyp(CHAR), PTR);
218 		sym->s_type->t_const = true;
219 		return;
220 	}
221 
222 	if (block_level > 0 && strcmp(sym->s_name, "__func__") == 0) {
223 		if (!Sflag)
224 			/* __func__ is a C9X feature */
225 			warning(317);
226 		sym->s_type = derive_type(gettyp(CHAR), PTR);
227 		sym->s_type->t_const = true;
228 		return;
229 	}
230 
231 	/* '%s' undefined */
232 	error(99, sym->s_name);
233 }
234 
235 /*
236  * Create a node for a name (symbol table entry).
237  * follow_token is the token which follows the name.
238  */
239 tnode_t *
240 new_name_node(sym_t *sym, int follow_token)
241 {
242 	tnode_t	*n;
243 
244 	if (sym->s_scl == NOSCL) {
245 		sym->s_scl = EXTERN;
246 		sym->s_def = DECL;
247 		if (follow_token == T_LPAREN) {
248 			if (sflag) {
249 				/* function implicitly declared to ... */
250 				warning(215);
251 			}
252 			/*
253 			 * XXX if tflag is set the symbol should be
254 			 * exported to level 0
255 			 */
256 			sym->s_type = derive_type(sym->s_type, FUNC);
257 		} else {
258 			fallback_symbol(sym);
259 		}
260 	}
261 
262 	lint_assert(sym->s_kind == FVFT || sym->s_kind == FMEMBER);
263 
264 	n = expr_zalloc_tnode();
265 	n->tn_type = sym->s_type;
266 	if (sym->s_scl != CTCONST) {
267 		n->tn_op = NAME;
268 		n->tn_sym = sym;
269 		if (sym->s_kind == FVFT && sym->s_type->t_tspec != FUNC)
270 			n->tn_lvalue = true;
271 	} else {
272 		n->tn_op = CON;
273 		n->tn_val = expr_zalloc(sizeof(*n->tn_val));
274 		*n->tn_val = sym->s_value;
275 	}
276 
277 	return n;
278 }
279 
280 tnode_t *
281 new_string_node(strg_t *strg)
282 {
283 	size_t	len;
284 	tnode_t	*n;
285 
286 	len = strg->st_len;
287 
288 	n = expr_zalloc_tnode();
289 
290 	n->tn_op = STRING;
291 	n->tn_type = expr_derive_type(gettyp(strg->st_tspec), ARRAY);
292 	n->tn_type->t_dim = len + 1;
293 	n->tn_lvalue = true;
294 
295 	n->tn_string = expr_zalloc(sizeof(*n->tn_string));
296 	n->tn_string->st_tspec = strg->st_tspec;
297 	n->tn_string->st_len = len;
298 
299 	if (strg->st_tspec == CHAR) {
300 		n->tn_string->st_cp = expr_zalloc(len + 1);
301 		(void)memcpy(n->tn_string->st_cp, strg->st_cp, len + 1);
302 		free(strg->st_cp);
303 	} else {
304 		size_t size = (len + 1) * sizeof(*n->tn_string->st_wcp);
305 		n->tn_string->st_wcp = expr_zalloc(size);
306 		(void)memcpy(n->tn_string->st_wcp, strg->st_wcp, size);
307 		free(strg->st_wcp);
308 	}
309 	free(strg);
310 
311 	return n;
312 }
313 
314 /*
315  * Returns a symbol which has the same name as the msym argument and is a
316  * member of the struct or union specified by the tn argument.
317  */
318 sym_t *
319 struct_or_union_member(tnode_t *tn, op_t op, sym_t *msym)
320 {
321 	struct_or_union	*str;
322 	type_t	*tp;
323 	sym_t	*sym, *csym;
324 	bool	eq;
325 	tspec_t	t;
326 
327 	/*
328 	 * Remove the member if it was unknown until now, which means
329 	 * that no defined struct or union has a member with the same name.
330 	 */
331 	if (msym->s_scl == NOSCL) {
332 		/* type '%s' does not have member '%s' */
333 		error(101, type_name(msym->s_type), msym->s_name);
334 		rmsym(msym);
335 		msym->s_kind = FMEMBER;
336 		msym->s_scl = MOS;
337 		msym->s_styp = expr_zalloc(sizeof(*msym->s_styp));
338 		msym->s_styp->sou_tag = expr_zalloc(
339 		    sizeof(*msym->s_styp->sou_tag));
340 		msym->s_styp->sou_tag->s_name = unnamed;
341 		msym->s_value.v_tspec = INT;
342 		return msym;
343 	}
344 
345 	/* Set str to the tag of which msym is expected to be a member. */
346 	str = NULL;
347 	t = (tp = tn->tn_type)->t_tspec;
348 	if (op == POINT) {
349 		if (t == STRUCT || t == UNION)
350 			str = tp->t_str;
351 	} else if (op == ARROW && t == PTR) {
352 		t = (tp = tp->t_subt)->t_tspec;
353 		if (t == STRUCT || t == UNION)
354 			str = tp->t_str;
355 	}
356 
357 	/*
358 	 * If this struct/union has a member with the name of msym, return it.
359 	 */
360 	if (str != NULL) {
361 		for (sym = msym; sym != NULL; sym = sym->s_link) {
362 			if (sym->s_scl != MOS && sym->s_scl != MOU)
363 				continue;
364 			if (sym->s_styp != str)
365 				continue;
366 			if (strcmp(sym->s_name, msym->s_name) != 0)
367 				continue;
368 			return sym;
369 		}
370 	}
371 
372 	/*
373 	 * Set eq to false if there are struct/union members with the same
374 	 * name and different types and/or offsets.
375 	 */
376 	eq = true;
377 	for (csym = msym; csym != NULL; csym = csym->s_link) {
378 		if (csym->s_scl != MOS && csym->s_scl != MOU)
379 			continue;
380 		if (strcmp(msym->s_name, csym->s_name) != 0)
381 			continue;
382 		for (sym = csym->s_link ; sym != NULL; sym = sym->s_link) {
383 			bool w;
384 
385 			if (sym->s_scl != MOS && sym->s_scl != MOU)
386 				continue;
387 			if (strcmp(csym->s_name, sym->s_name) != 0)
388 				continue;
389 			if (csym->s_value.v_quad != sym->s_value.v_quad) {
390 				eq = false;
391 				break;
392 			}
393 			w = false;
394 			eq = eqtype(csym->s_type, sym->s_type,
395 			    false, false, &w) && !w;
396 			if (!eq)
397 				break;
398 			if (csym->s_bitfield != sym->s_bitfield) {
399 				eq = false;
400 				break;
401 			}
402 			if (csym->s_bitfield) {
403 				type_t	*tp1, *tp2;
404 
405 				tp1 = csym->s_type;
406 				tp2 = sym->s_type;
407 				if (tp1->t_flen != tp2->t_flen) {
408 					eq = false;
409 					break;
410 				}
411 				if (tp1->t_foffs != tp2->t_foffs) {
412 					eq = false;
413 					break;
414 				}
415 			}
416 		}
417 		if (!eq)
418 			break;
419 	}
420 
421 	/*
422 	 * Now handle the case in which the left operand refers really
423 	 * to a struct/union, but the right operand is not member of it.
424 	 */
425 	if (str != NULL) {
426 		if (eq && tflag) {
427 			/* illegal member use: %s */
428 			warning(102, msym->s_name);
429 		} else {
430 			/* illegal member use: %s */
431 			error(102, msym->s_name);
432 		}
433 		return msym;
434 	}
435 
436 	/*
437 	 * Now the left operand of ARROW does not point to a struct/union
438 	 * or the left operand of POINT is no struct/union.
439 	 */
440 	if (eq) {
441 		if (op == POINT) {
442 			if (tflag) {
443 				/* left operand of '.' must be struct/... */
444 				warning(103);
445 			} else {
446 				/* left operand of '.' must be struct/... */
447 				error(103);
448 			}
449 		} else {
450 			if (tflag && tn->tn_type->t_tspec == PTR) {
451 				/* left operand of '->' must be pointer ... */
452 				warning(104, type_name(tn->tn_type));
453 			} else {
454 				/* left operand of '->' must be pointer ... */
455 				error(104, type_name(tn->tn_type));
456 			}
457 		}
458 	} else {
459 		if (tflag) {
460 			/* non-unique member requires struct/union %s */
461 			error(105, op == POINT ? "object" : "pointer");
462 		} else {
463 			/* unacceptable operand of '%s' */
464 			error(111, op_name(op));
465 		}
466 	}
467 
468 	return msym;
469 }
470 
471 /*
472  * Create a tree node. Called for most operands except function calls,
473  * sizeof and casts.
474  *
475  * op	operator
476  * ln	left operand
477  * rn	if not NULL, right operand
478  */
479 tnode_t *
480 build(op_t op, tnode_t *ln, tnode_t *rn)
481 {
482 	const mod_t *mp;
483 	tnode_t	*ntn;
484 	type_t	*rettp;
485 
486 	mp = &modtab[op];
487 
488 	/* If there was an error in one of the operands, return. */
489 	if (ln == NULL || (mp->m_binary && rn == NULL))
490 		return NULL;
491 
492 	/*
493 	 * Apply class conversions to the left operand, but only if its
494 	 * value is needed or it is compared with null.
495 	 */
496 	if (mp->m_left_value_context || mp->m_left_test_context)
497 		ln = cconv(ln);
498 	/*
499 	 * The right operand is almost always in a test or value context,
500 	 * except if it is a struct or union member.
501 	 */
502 	if (mp->m_binary && op != ARROW && op != POINT)
503 		rn = cconv(rn);
504 
505 	/*
506 	 * Print some warnings for comparisons of unsigned values with
507 	 * constants lower than or equal to null. This must be done
508 	 * before promote() because otherwise unsigned char and unsigned
509 	 * short would be promoted to int. Also types are tested to be
510 	 * CHAR, which would also become int.
511 	 */
512 	if (mp->m_comparison)
513 		check_integer_comparison(op, ln, rn);
514 
515 	/*
516 	 * Promote the left operand if it is in a test or value context
517 	 */
518 	if (mp->m_left_value_context || mp->m_left_test_context)
519 		ln = promote(op, false, ln);
520 	/*
521 	 * Promote the right operand, but only if it is no struct or
522 	 * union member, or if it is not to be assigned to the left operand
523 	 */
524 	if (mp->m_binary && op != ARROW && op != POINT &&
525 	    op != ASSIGN && op != RETURN) {
526 		rn = promote(op, false, rn);
527 	}
528 
529 	/*
530 	 * If the result of the operation is different for signed or
531 	 * unsigned operands and one of the operands is signed only in
532 	 * ANSI C, print a warning.
533 	 */
534 	if (mp->m_warn_if_left_unsigned_in_c90 &&
535 	    ln->tn_op == CON && ln->tn_val->v_ansiu) {
536 		/* ANSI C treats constant as unsigned, op %s */
537 		warning(218, mp->m_name);
538 		ln->tn_val->v_ansiu = false;
539 	}
540 	if (mp->m_warn_if_right_unsigned_in_c90 &&
541 	    rn->tn_op == CON && rn->tn_val->v_ansiu) {
542 		/* ANSI C treats constant as unsigned, op %s */
543 		warning(218, mp->m_name);
544 		rn->tn_val->v_ansiu = false;
545 	}
546 
547 	/* Make sure both operands are of the same type */
548 	if (mp->m_balance_operands || (tflag && (op == SHL || op == SHR)))
549 		balance(op, &ln, &rn);
550 
551 	/*
552 	 * Check types for compatibility with the operation and mutual
553 	 * compatibility. Return if there are serious problems.
554 	 */
555 	if (!typeok(op, 0, ln, rn))
556 		return NULL;
557 
558 	/* And now create the node. */
559 	switch (op) {
560 	case POINT:
561 	case ARROW:
562 		ntn = build_struct_access(op, ln, rn);
563 		break;
564 	case INCAFT:
565 	case DECAFT:
566 	case INCBEF:
567 	case DECBEF:
568 		ntn = build_prepost_incdec(op, ln);
569 		break;
570 	case ADDR:
571 		ntn = build_address(ln, false);
572 		break;
573 	case INDIR:
574 		ntn = new_tnode(INDIR, ln->tn_type->t_subt, ln, NULL);
575 		break;
576 	case PLUS:
577 	case MINUS:
578 		ntn = build_plus_minus(op, ln, rn);
579 		break;
580 	case SHL:
581 	case SHR:
582 		ntn = build_bit_shift(op, ln, rn);
583 		break;
584 	case COLON:
585 		ntn = build_colon(ln, rn);
586 		break;
587 	case ASSIGN:
588 	case MULASS:
589 	case DIVASS:
590 	case MODASS:
591 	case ADDASS:
592 	case SUBASS:
593 	case SHLASS:
594 	case SHRASS:
595 	case ANDASS:
596 	case XORASS:
597 	case ORASS:
598 	case RETURN:
599 		ntn = build_assignment(op, ln, rn);
600 		break;
601 	case COMMA:
602 	case QUEST:
603 		ntn = new_tnode(op, rn->tn_type, ln, rn);
604 		break;
605 	case REAL:
606 	case IMAG:
607 		ntn = build_real_imag(op, ln);
608 		break;
609 	default:
610 		rettp = mp->m_returns_bool
611 		    ? gettyp(Tflag ? BOOL : INT) : ln->tn_type;
612 		lint_assert(mp->m_binary || rn == NULL);
613 		ntn = new_tnode(op, rettp, ln, rn);
614 		break;
615 	}
616 
617 	/* Return if an error occurred. */
618 	if (ntn == NULL)
619 		return NULL;
620 
621 	/* Print a warning if precedence confusion is possible */
622 	if (mp->m_possible_precedence_confusion)
623 		check_precedence_confusion(ntn);
624 
625 	/*
626 	 * Print a warning if one of the operands is in a context where
627 	 * it is compared with null and if this operand is a constant.
628 	 */
629 	if (mp->m_left_test_context) {
630 		if (ln->tn_op == CON ||
631 		    ((mp->m_binary && op != QUEST) && rn->tn_op == CON)) {
632 			if (hflag && !constcond_flag &&
633 			    !ln->tn_system_dependent)
634 				/* constant in conditional context */
635 				warning(161);
636 		}
637 	}
638 
639 	/* Fold if the operator requires it */
640 	if (mp->m_fold_constant_operands) {
641 		if (ln->tn_op == CON && (!mp->m_binary || rn->tn_op == CON)) {
642 			if (mp->m_left_test_context) {
643 				ntn = fold_test(ntn);
644 			} else if (is_floating(ntn->tn_type->t_tspec)) {
645 				ntn = fold_float(ntn);
646 			} else {
647 				ntn = fold(ntn);
648 			}
649 		} else if (op == QUEST && ln->tn_op == CON) {
650 			ntn = ln->tn_val->v_quad != 0
651 			    ? rn->tn_left : rn->tn_right;
652 		}
653 	}
654 
655 	return ntn;
656 }
657 
658 /*
659  * Perform class conversions.
660  *
661  * Arrays of type T are converted into pointers to type T.
662  * Functions are converted to pointers to functions.
663  * Lvalues are converted to rvalues.
664  *
665  * C99 6.3 "Conversions"
666  * C99 6.3.2 "Other operands"
667  * C99 6.3.2.1 "Lvalues, arrays, and function designators"
668  */
669 tnode_t *
670 cconv(tnode_t *tn)
671 {
672 	type_t	*tp;
673 
674 	/*
675 	 * Array-lvalue (array of type T) is converted into rvalue
676 	 * (pointer to type T)
677 	 */
678 	if (tn->tn_type->t_tspec == ARRAY) {
679 		if (!tn->tn_lvalue) {
680 			/* XXX print correct operator */
681 			/* %soperand of '%s' must be lvalue */
682 			gnuism(114, "", op_name(ADDR));
683 		}
684 		tn = new_tnode(ADDR,
685 		    expr_derive_type(tn->tn_type->t_subt, PTR), tn, NULL);
686 	}
687 
688 	/*
689 	 * Expression of type function (function with return value of type T)
690 	 * in rvalue-expression (pointer to function with return value
691 	 * of type T)
692 	 */
693 	if (tn->tn_type->t_tspec == FUNC)
694 		tn = build_address(tn, true);
695 
696 	/* lvalue to rvalue */
697 	if (tn->tn_lvalue) {
698 		tp = expr_dup_type(tn->tn_type);
699 		tp->t_const = tp->t_volatile = false;
700 		tn = new_tnode(LOAD, tp, tn, NULL);
701 	}
702 
703 	return tn;
704 }
705 
706 const tnode_t *
707 before_conversion(const tnode_t *tn)
708 {
709 	while (tn->tn_op == CVT && !tn->tn_cast)
710 		tn = tn->tn_left;
711 	return tn;
712 }
713 
714 static bool
715 is_null_pointer(const tnode_t *tn)
716 {
717 	tspec_t t = tn->tn_type->t_tspec;
718 
719 	return ((t == PTR && tn->tn_type->t_subt->t_tspec == VOID) ||
720 		is_integer(t))
721 	       && (tn->tn_op == CON && tn->tn_val->v_quad == 0);
722 }
723 
724 static bool
725 typeok_incdec(op_t op, const tnode_t *tn, const type_t *tp)
726 {
727 	/* operand has scalar type (checked in typeok) */
728 	if (!tn->tn_lvalue) {
729 		if (tn->tn_op == CVT && tn->tn_cast &&
730 		    tn->tn_left->tn_op == LOAD) {
731 			if (tn->tn_type->t_tspec == PTR)
732 				return true;
733 			/* a cast does not yield an lvalue */
734 			error(163);
735 		}
736 		/* %soperand of '%s' must be lvalue */
737 		error(114, "", op_name(op));
738 		return false;
739 	} else if (tp->t_const) {
740 		if (!tflag)
741 			/* %soperand of '%s' must be modifiable lvalue */
742 			warning(115, "", op_name(op));
743 	}
744 	return true;
745 }
746 
747 static bool
748 typeok_address(const mod_t *mp,
749 	    const tnode_t *tn, const type_t *tp, tspec_t t)
750 {
751 	if (t == ARRAY || t == FUNC) {
752 		/* ok, a warning comes later (in build_address()) */
753 	} else if (!tn->tn_lvalue) {
754 		if (tn->tn_op == CVT && tn->tn_cast &&
755 		    tn->tn_left->tn_op == LOAD) {
756 			if (tn->tn_type->t_tspec == PTR)
757 				return true;
758 			/* a cast does not yield an lvalue */
759 			error(163);
760 		}
761 		/* %soperand of '%s' must be lvalue */
762 		error(114, "", mp->m_name);
763 		return false;
764 	} else if (is_scalar(t)) {
765 		if (tp->t_bitfield) {
766 			/* cannot take address of bit-field */
767 			error(112);
768 			return false;
769 		}
770 	} else if (t != STRUCT && t != UNION) {
771 		/* unacceptable operand of '%s' */
772 		error(111, mp->m_name);
773 		return false;
774 	}
775 	if (tn->tn_op == NAME && tn->tn_sym->s_reg) {
776 		/* cannot take address of register %s */
777 		error(113, tn->tn_sym->s_name);
778 		return false;
779 	}
780 	return true;
781 }
782 
783 static bool
784 typeok_star(tspec_t t)
785 {
786 	/* until now there were no type checks for this operator */
787 	if (t != PTR) {
788 		/* cannot dereference non-pointer type */
789 		error(96);
790 		return false;
791 	}
792 	return true;
793 }
794 
795 static bool
796 typeok_plus(op_t op,
797 	    const type_t *ltp, tspec_t lt,
798 	    const type_t *rtp, tspec_t rt)
799 {
800 	/* operands have scalar types (checked above) */
801 	if ((lt == PTR && !is_integer(rt)) || (rt == PTR && !is_integer(lt))) {
802 		warn_incompatible_types(op, ltp, lt, rtp, rt);
803 		return false;
804 	}
805 	return true;
806 }
807 
808 static bool
809 typeok_minus(op_t op,
810 	     const type_t *ltp, tspec_t lt,
811 	     const type_t *rtp, tspec_t rt)
812 {
813 	/* operands have scalar types (checked above) */
814 	if (lt == PTR && (!is_integer(rt) && rt != PTR)) {
815 		warn_incompatible_types(op, ltp, lt, rtp, rt);
816 		return false;
817 	} else if (rt == PTR && lt != PTR) {
818 		warn_incompatible_types(op, ltp, lt, rtp, rt);
819 		return false;
820 	}
821 	if (lt == PTR && rt == PTR) {
822 		if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
823 			/* illegal pointer subtraction */
824 			error(116);
825 		}
826 	}
827 	return true;
828 }
829 
830 static void
831 typeok_shr(const mod_t *mp,
832 	   const tnode_t *ln, tspec_t lt,
833 	   const tnode_t *rn, tspec_t rt)
834 {
835 	tspec_t olt, ort;
836 
837 	olt = before_conversion(ln)->tn_type->t_tspec;
838 	ort = before_conversion(rn)->tn_type->t_tspec;
839 
840 	/* operands have integer types (checked above) */
841 	if (pflag && !is_uinteger(lt)) {
842 		/*
843 		 * The left operand is signed. This means that
844 		 * the operation is (possibly) nonportable.
845 		 */
846 		if (ln->tn_op != CON) {
847 			/* bitwise '%s' on signed value possibly nonportable */
848 			warning(117, mp->m_name);
849 		} else if (ln->tn_val->v_quad < 0) {
850 			/* bitwise '%s' on signed value nonportable */
851 			warning(120, mp->m_name);
852 		}
853 	} else if (!tflag && !sflag && !is_uinteger(olt) && is_uinteger(ort)) {
854 		/*
855 		 * The left operand would become unsigned in
856 		 * traditional C.
857 		 */
858 		if (hflag && !Sflag &&
859 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
860 			/* semantics of '%s' change in ANSI C; use ... */
861 			warning(118, mp->m_name);
862 		}
863 	} else if (!tflag && !sflag && !is_uinteger(olt) && !is_uinteger(ort) &&
864 		   portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
865 		/*
866 		 * In traditional C the left operand would be extended,
867 		 * possibly with 1, and then shifted.
868 		 */
869 		if (hflag && !Sflag &&
870 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
871 			/* semantics of '%s' change in ANSI C; use ... */
872 			warning(118, mp->m_name);
873 		}
874 	}
875 }
876 
877 static void
878 typeok_shl(const mod_t *mp, tspec_t lt, tspec_t rt)
879 {
880 	/*
881 	 * C90 does not perform balancing for shift operations,
882 	 * but traditional C does. If the width of the right operand
883 	 * is greater than the width of the left operand, then in
884 	 * traditional C the left operand would be extended to the
885 	 * width of the right operand. For SHL this may result in
886 	 * different results.
887 	 */
888 	if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
889 		/*
890 		 * XXX If both operands are constant, make sure
891 		 * that there is really a difference between
892 		 * ANSI C and traditional C.
893 		 */
894 		if (hflag && !Sflag)
895 			/* semantics of '%s' change in ANSI C; use ... */
896 			warning(118, mp->m_name);
897 	}
898 }
899 
900 static void
901 typeok_shift(tspec_t lt, const tnode_t *rn, tspec_t rt)
902 {
903 	if (rn->tn_op != CON)
904 		return;
905 
906 	if (!is_uinteger(rt) && rn->tn_val->v_quad < 0) {
907 		/* negative shift */
908 		warning(121);
909 	} else if ((uint64_t)rn->tn_val->v_quad ==
910 		   (uint64_t)size_in_bits(lt)) {
911 		/* shift equal to size of object */
912 		warning(267);
913 	} else if ((uint64_t)rn->tn_val->v_quad > (uint64_t)size_in_bits(lt)) {
914 		/* shift amount %llu is greater than bit-size %llu of '%s' */
915 		warning(122, (unsigned long long)rn->tn_val->v_quad,
916 		    (unsigned long long)size_in_bits(lt),
917 		    tspec_name(lt));
918 	}
919 }
920 
921 static bool
922 is_typeok_eq(const tnode_t *ln, tspec_t lt, const tnode_t *rn, tspec_t rt)
923 {
924 	if (lt == PTR && is_null_pointer(rn))
925 		return true;
926 	if (rt == PTR && is_null_pointer(ln))
927 		return true;
928 	return false;
929 }
930 
931 static bool
932 typeok_ordered_comparison(op_t op,
933 			  const tnode_t *ln, const type_t *ltp, tspec_t lt,
934 			  const tnode_t *rn, const type_t *rtp, tspec_t rt)
935 {
936 	if (lt == PTR && rt == PTR) {
937 		check_pointer_comparison(op, ln, rn);
938 		return true;
939 	}
940 
941 	if (lt != PTR && rt != PTR)
942 		return true;
943 
944 	if (!is_integer(lt) && !is_integer(rt)) {
945 		warn_incompatible_types(op, ltp, lt, rtp, rt);
946 		return false;
947 	}
948 
949 	const char *lx = lt == PTR ? "pointer" : "integer";
950 	const char *rx = rt == PTR ? "pointer" : "integer";
951 	/* illegal combination of %s (%s) and %s (%s), op %s */
952 	warning(123, lx, type_name(ltp), rx, type_name(rtp), op_name(op));
953 	return true;
954 }
955 
956 static bool
957 typeok_quest(tspec_t lt, const tnode_t **rn)
958 {
959 	if (!is_scalar(lt)) {
960 		/* first operand must have scalar type, op ? : */
961 		error(170);
962 		return false;
963 	}
964 	while ((*rn)->tn_op == CVT)
965 		*rn = (*rn)->tn_left;
966 	lint_assert((*rn)->tn_op == COLON);
967 	return true;
968 }
969 
970 static void
971 typeok_colon_pointer(const mod_t *mp, const type_t *ltp, const type_t *rtp)
972 {
973 	type_t *lstp = ltp->t_subt;
974 	type_t *rstp = rtp->t_subt;
975 	tspec_t lst = lstp->t_tspec;
976 	tspec_t rst = rstp->t_tspec;
977 
978 	if ((lst == VOID && rst == FUNC) || (lst == FUNC && rst == VOID)) {
979 		/* (void *)0 handled above */
980 		if (sflag)
981 			/* ANSI C forbids conv. of %s to %s, op %s */
982 			warning(305, "function pointer", "'void *'",
983 			    mp->m_name);
984 		return;
985 	}
986 
987 	if (eqptrtype(lstp, rstp, true))
988 		return;
989 	if (!eqtype(lstp, rstp, true, false, NULL))
990 		warn_incompatible_pointers(mp, ltp, rtp);
991 }
992 
993 static bool
994 typeok_colon(const mod_t *mp,
995 	     const tnode_t *ln, const type_t *ltp, tspec_t lt,
996 	     const tnode_t *rn, const type_t *rtp, tspec_t rt)
997 {
998 
999 	if (is_arithmetic(lt) && is_arithmetic(rt))
1000 		return true;
1001 	if (lt == BOOL && rt == BOOL)
1002 		return true;
1003 
1004 	if (lt == STRUCT && rt == STRUCT && ltp->t_str == rtp->t_str)
1005 		return true;
1006 	if (lt == UNION && rt == UNION && ltp->t_str == rtp->t_str)
1007 		return true;
1008 
1009 	if (lt == PTR && is_null_pointer(rn))
1010 		return true;
1011 	if (rt == PTR && is_null_pointer(ln))
1012 		return true;
1013 
1014 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1015 		const char *lx = lt == PTR ?  "pointer" : "integer";
1016 		const char *rx = rt == PTR ?  "pointer" : "integer";
1017 		/* illegal combination of %s (%s) and %s (%s), op %s */
1018 		warning(123, lx, type_name(ltp),
1019 		    rx, type_name(rtp), mp->m_name);
1020 		return true;
1021 	}
1022 
1023 	if (lt == VOID || rt == VOID) {
1024 		if (lt != VOID || rt != VOID)
1025 			/* incompatible types '%s' and '%s' in conditional */
1026 			warning(126, type_name(ltp), type_name(rtp));
1027 		return true;
1028 	}
1029 
1030 	if (lt == PTR && rt == PTR) {
1031 		typeok_colon_pointer(mp, ltp, rtp);
1032 		return true;
1033 	}
1034 
1035 	/* incompatible types '%s' and '%s' in conditional */
1036 	error(126, type_name(ltp), type_name(rtp));
1037 	return false;
1038 }
1039 
1040 static bool
1041 typeok_assign(const mod_t *mp, const tnode_t *ln, const type_t *ltp, tspec_t lt)
1042 {
1043 	if (!ln->tn_lvalue) {
1044 		if (ln->tn_op == CVT && ln->tn_cast &&
1045 		    ln->tn_left->tn_op == LOAD) {
1046 			if (ln->tn_type->t_tspec == PTR)
1047 				return true;
1048 			/* a cast does not yield an lvalue */
1049 			error(163);
1050 		}
1051 		/* %soperand of '%s' must be lvalue */
1052 		error(114, "left ", mp->m_name);
1053 		return false;
1054 	} else if (ltp->t_const || ((lt == STRUCT || lt == UNION) &&
1055 				    has_constant_member(ltp))) {
1056 		if (!tflag)
1057 			/* %soperand of '%s' must be modifiable lvalue */
1058 			warning(115, "left ", mp->m_name);
1059 	}
1060 	return true;
1061 }
1062 
1063 
1064 
1065 /* Check the types using the information from modtab[]. */
1066 static bool
1067 typeok_scalar(op_t op, const mod_t *mp,
1068 	      const type_t *ltp, tspec_t lt,
1069 	      const type_t *rtp, tspec_t rt)
1070 {
1071 	if (mp->m_takes_bool && lt == BOOL && rt == BOOL)
1072 		return true;
1073 	if (mp->m_requires_integer) {
1074 		if (!is_integer(lt) || (mp->m_binary && !is_integer(rt))) {
1075 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1076 			return false;
1077 		}
1078 	} else if (mp->m_requires_integer_or_complex) {
1079 		if ((!is_integer(lt) && !is_complex(lt)) ||
1080 		    (mp->m_binary && (!is_integer(rt) && !is_complex(rt)))) {
1081 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1082 			return false;
1083 		}
1084 	} else if (mp->m_requires_scalar) {
1085 		if (!is_scalar(lt) || (mp->m_binary && !is_scalar(rt))) {
1086 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1087 			return false;
1088 		}
1089 	} else if (mp->m_requires_arith) {
1090 		if (!is_arithmetic(lt) ||
1091 		    (mp->m_binary && !is_arithmetic(rt))) {
1092 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1093 			return false;
1094 		}
1095 	}
1096 	return true;
1097 }
1098 
1099 /* Check the types for specific operators and type combinations. */
1100 static bool
1101 typeok_op(op_t op, const mod_t *mp, int arg,
1102 	  const tnode_t *ln, const type_t *ltp, tspec_t lt,
1103 	  const tnode_t *rn, const type_t *rtp, tspec_t rt)
1104 {
1105 	switch (op) {
1106 	case POINT:
1107 		/*
1108 		 * Most errors required by ANSI C are reported in
1109 		 * struct_or_union_member().
1110 		 * Here we only must check for totally wrong things.
1111 		 */
1112 		if (lt == FUNC || lt == VOID || ltp->t_bitfield ||
1113 		    ((lt != STRUCT && lt != UNION) && !ln->tn_lvalue)) {
1114 			/* Without tflag we got already an error */
1115 			if (tflag)
1116 				/* unacceptable operand of '%s' */
1117 				error(111, mp->m_name);
1118 			return false;
1119 		}
1120 		/* Now we have an object we can create a pointer to */
1121 		break;
1122 	case ARROW:
1123 		if (lt != PTR && !(tflag && is_integer(lt))) {
1124 			/* Without tflag we got already an error */
1125 			if (tflag)
1126 				/* unacceptable operand of '%s' */
1127 				error(111, mp->m_name);
1128 			return false;
1129 		}
1130 		break;
1131 	case INCAFT:
1132 	case DECAFT:
1133 	case INCBEF:
1134 	case DECBEF:
1135 		if (!typeok_incdec(op, ln, ltp))
1136 			return false;
1137 		break;
1138 	case ADDR:
1139 		if (!typeok_address(mp, ln, ltp, lt))
1140 			return false;
1141 		break;
1142 	case INDIR:
1143 		if (!typeok_star(lt))
1144 			return false;
1145 		break;
1146 	case PLUS:
1147 		if (!typeok_plus(op, ltp, lt, rtp, rt))
1148 			return false;
1149 		break;
1150 	case MINUS:
1151 		if (!typeok_minus(op, ltp, lt, rtp, rt))
1152 			return false;
1153 		break;
1154 	case SHR:
1155 		typeok_shr(mp, ln, lt, rn, rt);
1156 		goto shift;
1157 	case SHL:
1158 		typeok_shl(mp, lt, rt);
1159 	shift:
1160 		typeok_shift(lt, rn, rt);
1161 		break;
1162 	case EQ:
1163 	case NE:
1164 		/*
1165 		 * Accept some things which are allowed with EQ and NE,
1166 		 * but not with ordered comparisons.
1167 		 */
1168 		if (is_typeok_eq(ln, lt, rn, rt))
1169 			break;
1170 		/* FALLTHROUGH */
1171 	case LT:
1172 	case GT:
1173 	case LE:
1174 	case GE:
1175 		if (!typeok_ordered_comparison(op, ln, ltp, lt, rn, rtp, rt))
1176 			return false;
1177 		break;
1178 	case QUEST:
1179 		if (!typeok_quest(lt, &rn))
1180 			return false;
1181 		break;
1182 	case COLON:
1183 		if (!typeok_colon(mp, ln, ltp, lt, rn, rtp, rt))
1184 			return false;
1185 		break;
1186 	case ASSIGN:
1187 	case INIT:
1188 	case FARG:
1189 	case RETURN:
1190 		if (!check_assign_types_compatible(op, arg, ln, rn))
1191 			return false;
1192 		goto assign;
1193 	case MULASS:
1194 	case DIVASS:
1195 	case MODASS:
1196 		goto assign;
1197 	case ADDASS:
1198 	case SUBASS:
1199 		/* operands have scalar types (checked above) */
1200 		if ((lt == PTR && !is_integer(rt)) || rt == PTR) {
1201 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1202 			return false;
1203 		}
1204 		goto assign;
1205 	case SHLASS:
1206 		goto assign;
1207 	case SHRASS:
1208 		if (pflag && !is_uinteger(lt) && !(tflag && is_uinteger(rt))) {
1209 			/* bitwise '%s' on signed value possibly nonportable */
1210 			warning(117, mp->m_name);
1211 		}
1212 		goto assign;
1213 	case ANDASS:
1214 	case XORASS:
1215 	case ORASS:
1216 		goto assign;
1217 	assign:
1218 		if (!typeok_assign(mp, ln, ltp, lt))
1219 			return false;
1220 		break;
1221 	case COMMA:
1222 		if (!modtab[ln->tn_op].m_has_side_effect)
1223 			check_null_effect(ln);
1224 		break;
1225 		/* LINTED206: (enumeration values not handled in switch) */
1226 	case CON:
1227 	case CASE:
1228 	case PUSH:
1229 	case LOAD:
1230 	case ICALL:
1231 	case CVT:
1232 	case CALL:
1233 	case FSEL:
1234 	case STRING:
1235 	case NAME:
1236 	case LOGOR:
1237 	case LOGAND:
1238 	case BITOR:
1239 	case BITXOR:
1240 	case BITAND:
1241 	case MOD:
1242 	case DIV:
1243 	case MULT:
1244 	case UMINUS:
1245 	case UPLUS:
1246 	case DEC:
1247 	case INC:
1248 	case COMPL:
1249 	case NOT:
1250 	case NOOP:
1251 	case REAL:
1252 	case IMAG:
1253 		break;
1254 	}
1255 	return true;
1256 }
1257 
1258 static void
1259 typeok_enum(op_t op, const mod_t *mp, int arg,
1260 	    const tnode_t *ln, const type_t *ltp,
1261 	    const tnode_t *rn, const type_t *rtp)
1262 {
1263 	if (mp->m_bad_on_enum &&
1264 	    (ltp->t_is_enum || (mp->m_binary && rtp->t_is_enum))) {
1265 		check_bad_enum_operation(op, ln, rn);
1266 	} else if (mp->m_valid_on_enum &&
1267 		   (ltp->t_is_enum && rtp != NULL && rtp->t_is_enum)) {
1268 		check_enum_type_mismatch(op, arg, ln, rn);
1269 	} else if (mp->m_valid_on_enum &&
1270 		   (ltp->t_is_enum || (rtp != NULL && rtp->t_is_enum))) {
1271 		check_enum_int_mismatch(op, arg, ln, rn);
1272 	}
1273 }
1274 
1275 /* Perform most type checks. Return whether the types are ok. */
1276 bool
1277 typeok(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1278 {
1279 	const mod_t *mp;
1280 	tspec_t	lt, rt;
1281 	type_t	*ltp, *rtp;
1282 
1283 	mp = &modtab[op];
1284 
1285 	lint_assert((ltp = ln->tn_type) != NULL);
1286 	lt = ltp->t_tspec;
1287 
1288 	if (mp->m_binary) {
1289 		lint_assert((rtp = rn->tn_type) != NULL);
1290 		rt = rtp->t_tspec;
1291 	} else {
1292 		rtp = NULL;
1293 		rt = NOTSPEC;
1294 	}
1295 
1296 	if (Tflag && !typeok_scalar_strict_bool(op, mp, arg, ln, rn))
1297 		return false;
1298 	if (!typeok_scalar(op, mp, ltp, lt, rtp, rt))
1299 		return false;
1300 
1301 	if (!typeok_op(op, mp, arg, ln, ltp, lt, rn, rtp, rt))
1302 		return false;
1303 
1304 	typeok_enum(op, mp, arg, ln, ltp, rn, rtp);
1305 	return true;
1306 }
1307 
1308 static void
1309 check_pointer_comparison(op_t op, const tnode_t *ln, const tnode_t *rn)
1310 {
1311 	type_t	*ltp, *rtp;
1312 	tspec_t	lst, rst;
1313 	const	char *lsts, *rsts;
1314 
1315 	lst = (ltp = ln->tn_type)->t_subt->t_tspec;
1316 	rst = (rtp = rn->tn_type)->t_subt->t_tspec;
1317 
1318 	if (lst == VOID || rst == VOID) {
1319 		if (sflag && (lst == FUNC || rst == FUNC)) {
1320 			/* (void *)0 already handled in typeok() */
1321 			*(lst == FUNC ? &lsts : &rsts) = "function pointer";
1322 			*(lst == VOID ? &lsts : &rsts) = "'void *'";
1323 			/* ANSI C forbids comparison of %s with %s */
1324 			warning(274, lsts, rsts);
1325 		}
1326 		return;
1327 	}
1328 
1329 	if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
1330 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1331 		return;
1332 	}
1333 
1334 	if (lst == FUNC && rst == FUNC) {
1335 		if (sflag && op != EQ && op != NE)
1336 			/* ANSI C forbids ordered comparisons of ... */
1337 			warning(125);
1338 	}
1339 }
1340 
1341 /*
1342  * Checks type compatibility for ASSIGN, INIT, FARG and RETURN
1343  * and prints warnings/errors if necessary.
1344  * If the types are (almost) compatible, 1 is returned, otherwise 0.
1345  */
1346 static bool
1347 check_assign_types_compatible(op_t op, int arg,
1348 			      const tnode_t *ln, const tnode_t *rn)
1349 {
1350 	tspec_t	lt, rt, lst = NOTSPEC, rst = NOTSPEC;
1351 	type_t	*ltp, *rtp, *lstp = NULL, *rstp = NULL;
1352 	const mod_t *mp;
1353 	const	char *lts, *rts;
1354 
1355 	if ((lt = (ltp = ln->tn_type)->t_tspec) == PTR)
1356 		lst = (lstp = ltp->t_subt)->t_tspec;
1357 	if ((rt = (rtp = rn->tn_type)->t_tspec) == PTR)
1358 		rst = (rstp = rtp->t_subt)->t_tspec;
1359 	mp = &modtab[op];
1360 
1361 	if (lt == BOOL && is_scalar(rt))	/* C99 6.3.1.2 */
1362 		return true;
1363 
1364 	if (is_arithmetic(lt) && (is_arithmetic(rt) || rt == BOOL))
1365 		return true;
1366 
1367 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION))
1368 		/* both are struct or union */
1369 		return ltp->t_str == rtp->t_str;
1370 
1371 	/* a null pointer may be assigned to any pointer */
1372 	if (lt == PTR && is_null_pointer(rn))
1373 		return true;
1374 
1375 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID)) {
1376 		/* two pointers, at least one pointer to void */
1377 		if (sflag && (lst == FUNC || rst == FUNC)) {
1378 			/* comb. of ptr to func and ptr to void */
1379 			*(lst == FUNC ? &lts : &rts) = "function pointer";
1380 			*(lst == VOID ? &lts : &rts) = "'void *'";
1381 			switch (op) {
1382 			case INIT:
1383 			case RETURN:
1384 				/* ANSI C forbids conversion of %s to %s */
1385 				warning(303, rts, lts);
1386 				break;
1387 			case FARG:
1388 				/* ANSI C forbids conv. of %s to %s, arg #%d */
1389 				warning(304, rts, lts, arg);
1390 				break;
1391 			default:
1392 				/* ANSI C forbids conv. of %s to %s, op %s */
1393 				warning(305, rts, lts, mp->m_name);
1394 				break;
1395 			}
1396 		}
1397 	}
1398 
1399 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID ||
1400 				       eqtype(lstp, rstp, true, false, NULL))) {
1401 		/* compatible pointer types (qualifiers ignored) */
1402 		if (!tflag &&
1403 		    ((!lstp->t_const && rstp->t_const) ||
1404 		     (!lstp->t_volatile && rstp->t_volatile))) {
1405 			/* left side has not all qualifiers of right */
1406 			switch (op) {
1407 			case INIT:
1408 			case RETURN:
1409 				/* incompatible pointer types (%s != %s) */
1410 				warning(182, type_name(lstp), type_name(rstp));
1411 				break;
1412 			case FARG:
1413 				/* converting '%s' to incompatible '%s' ... */
1414 				warning(153,
1415 				    type_name(rtp), type_name(ltp), arg);
1416 				break;
1417 			default:
1418 				/* operands have incompatible pointer type... */
1419 				warning(128, mp->m_name,
1420 				    type_name(lstp), type_name(rstp));
1421 				break;
1422 			}
1423 		}
1424 		return true;
1425 	}
1426 
1427 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1428 		const char *lx = lt == PTR ? "pointer" : "integer";
1429 		const char *rx = rt == PTR ? "pointer" : "integer";
1430 
1431 		switch (op) {
1432 		case INIT:
1433 		case RETURN:
1434 			/* illegal combination of %s (%s) and %s (%s) */
1435 			warning(183, lx, type_name(ltp), rx, type_name(rtp));
1436 			break;
1437 		case FARG:
1438 			/* illegal comb. of %s (%s) and %s (%s), arg #%d */
1439 			warning(154,
1440 			    lx, type_name(ltp), rx, type_name(rtp), arg);
1441 			break;
1442 		default:
1443 			/* illegal combination of %s (%s) and %s (%s), op %s */
1444 			warning(123,
1445 			    lx, type_name(ltp), rx, type_name(rtp), mp->m_name);
1446 			break;
1447 		}
1448 		return true;
1449 	}
1450 
1451 	if (lt == PTR && rt == PTR) {
1452 		switch (op) {
1453 		case INIT:
1454 		case RETURN:
1455 			warn_incompatible_pointers(NULL, ltp, rtp);
1456 			break;
1457 		case FARG:
1458 			/* converting '%s' to incompatible '%s' for ... */
1459 			warning(153, type_name(rtp), type_name(ltp), arg);
1460 			break;
1461 		default:
1462 			warn_incompatible_pointers(mp, ltp, rtp);
1463 			break;
1464 		}
1465 		return true;
1466 	}
1467 
1468 	switch (op) {
1469 	case INIT:
1470 		/* cannot initialize '%s' from '%s' */
1471 		error(185, type_name(ltp), type_name(rtp));
1472 		break;
1473 	case RETURN:
1474 		/* return value type mismatch (%s) and (%s) */
1475 		error(211, type_name(ltp), type_name(rtp));
1476 		break;
1477 	case FARG:
1478 		/* argument is incompatible with prototype, arg #%d */
1479 		warning(155, arg);
1480 		break;
1481 	default:
1482 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1483 		break;
1484 	}
1485 
1486 	return false;
1487 }
1488 
1489 /* Prints a warning if a strange operator is used on an enum type. */
1490 static void
1491 check_bad_enum_operation(op_t op, const tnode_t *ln, const tnode_t *rn)
1492 {
1493 
1494 	if (!eflag)
1495 		return;
1496 
1497 	if (!(ln->tn_type->t_is_enum ||
1498 	      (modtab[op].m_binary && rn->tn_type->t_is_enum))) {
1499 		return;
1500 	}
1501 
1502 	/*
1503 	 * Enum as offset to a pointer is an exception (otherwise enums
1504 	 * could not be used as array indices).
1505 	 */
1506 	if (op == PLUS &&
1507 	    ((ln->tn_type->t_is_enum && rn->tn_type->t_tspec == PTR) ||
1508 	     (rn->tn_type->t_is_enum && ln->tn_type->t_tspec == PTR))) {
1509 		return;
1510 	}
1511 
1512 	/* dubious operation on enum, op %s */
1513 	warning(241, op_name(op));
1514 
1515 }
1516 
1517 /*
1518  * Prints a warning if an operator is applied to two different enum types.
1519  */
1520 static void
1521 check_enum_type_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1522 {
1523 	const mod_t *mp;
1524 
1525 	mp = &modtab[op];
1526 
1527 	if (ln->tn_type->t_enum != rn->tn_type->t_enum) {
1528 		switch (op) {
1529 		case INIT:
1530 			/* enum type mismatch between '%s' and '%s' in ... */
1531 			warning(210,
1532 			    type_name(ln->tn_type), type_name(rn->tn_type));
1533 			break;
1534 		case FARG:
1535 			/* enum type mismatch, arg #%d (%s != %s) */
1536 			warning(156, arg,
1537 			    type_name(ln->tn_type), type_name(rn->tn_type));
1538 			break;
1539 		case RETURN:
1540 			/* return value type mismatch (%s) and (%s) */
1541 			warning(211,
1542 			    type_name(ln->tn_type), type_name(rn->tn_type));
1543 			break;
1544 		default:
1545 			/* enum type mismatch: '%s' '%s' '%s' */
1546 			warning(130, type_name(ln->tn_type), mp->m_name,
1547 			    type_name(rn->tn_type));
1548 			break;
1549 		}
1550 	} else if (Pflag && mp->m_comparison && op != EQ && op != NE) {
1551 		if (eflag)
1552 			/* dubious comparison of enums, op %s */
1553 			warning(243, mp->m_name);
1554 	}
1555 }
1556 
1557 /* Prints a warning if the operands mix between enum and integer. */
1558 static void
1559 check_enum_int_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1560 {
1561 
1562 	if (!eflag)
1563 		return;
1564 
1565 	switch (op) {
1566 	case INIT:
1567 		/*
1568 		 * Initialization with 0 is allowed. Otherwise, all implicit
1569 		 * initializations would need to be warned upon as well.
1570 		 */
1571 		if (!rn->tn_type->t_is_enum && rn->tn_op == CON &&
1572 		    is_integer(rn->tn_type->t_tspec) &&
1573 		    rn->tn_val->v_quad == 0) {
1574 			return;
1575 		}
1576 		/* initialization of '%s' with '%s' */
1577 		warning(277, type_name(ln->tn_type), type_name(rn->tn_type));
1578 		break;
1579 	case FARG:
1580 		/* combination of '%s' and '%s', arg #%d */
1581 		warning(278,
1582 		    type_name(ln->tn_type), type_name(rn->tn_type), arg);
1583 		break;
1584 	case RETURN:
1585 		/* combination of '%s' and '%s' in return */
1586 		warning(279, type_name(ln->tn_type), type_name(rn->tn_type));
1587 		break;
1588 	default:
1589 		/* combination of '%s' and '%s', op %s */
1590 		warning(242, type_name(ln->tn_type), type_name(rn->tn_type),
1591 		    op_name(op));
1592 		break;
1593 	}
1594 }
1595 
1596 /*
1597  * Build and initialize a new node.
1598  */
1599 static tnode_t *
1600 new_tnode(op_t op, type_t *type, tnode_t *ln, tnode_t *rn)
1601 {
1602 	tnode_t	*ntn;
1603 	tspec_t	t;
1604 #ifdef notyet
1605 	size_t l;
1606 	uint64_t rnum;
1607 #endif
1608 
1609 	ntn = expr_zalloc_tnode();
1610 
1611 	ntn->tn_op = op;
1612 	ntn->tn_type = type;
1613 	if (ln->tn_from_system_header)
1614 		ntn->tn_from_system_header = true;
1615 	if (rn != NULL && rn->tn_from_system_header)
1616 		ntn->tn_from_system_header = true;
1617 	ntn->tn_left = ln;
1618 	ntn->tn_right = rn;
1619 
1620 	switch (op) {
1621 #ifdef notyet
1622 	case SHR:
1623 		if (rn->tn_op != CON)
1624 			break;
1625 		rnum = rn->tn_val->v_quad;
1626 		l = type_size_in_bits(ln->tn_type) / CHAR_SIZE;
1627 		t = ln->tn_type->t_tspec;
1628 		switch (l) {
1629 		case 8:
1630 			if (rnum >= 56)
1631 				t = UCHAR;
1632 			else if (rnum >= 48)
1633 				t = USHORT;
1634 			else if (rnum >= 32)
1635 				t = UINT;
1636 			break;
1637 		case 4:
1638 			if (rnum >= 24)
1639 				t = UCHAR;
1640 			else if (rnum >= 16)
1641 				t = USHORT;
1642 			break;
1643 		case 2:
1644 			if (rnum >= 8)
1645 				t = UCHAR;
1646 			break;
1647 		default:
1648 			break;
1649 		}
1650 		if (t != ln->tn_type->t_tspec)
1651 			ntn->tn_type->t_tspec = t;
1652 		break;
1653 #endif
1654 	case INDIR:
1655 	case FSEL:
1656 		lint_assert(ln->tn_type->t_tspec == PTR);
1657 		t = ln->tn_type->t_subt->t_tspec;
1658 		if (t != FUNC && t != VOID)
1659 			ntn->tn_lvalue = true;
1660 		break;
1661 	default:
1662 		break;
1663 	}
1664 
1665 	return ntn;
1666 }
1667 
1668 /*
1669  * Performs the "integer promotions" (C99 6.3.1.1p2), which convert small
1670  * integer types to either int or unsigned int.
1671  *
1672  * If tflag is set or the operand is a function argument with no type
1673  * information (no prototype or variable # of args), converts float to double.
1674  */
1675 tnode_t *
1676 promote(op_t op, bool farg, tnode_t *tn)
1677 {
1678 	tspec_t	t;
1679 	type_t	*ntp;
1680 	u_int	len;
1681 
1682 	t = tn->tn_type->t_tspec;
1683 
1684 	if (!is_arithmetic(t))
1685 		return tn;
1686 
1687 	if (!tflag) {
1688 		/*
1689 		 * ANSI C requires that the result is always of type INT
1690 		 * if INT can represent all possible values of the previous
1691 		 * type.
1692 		 */
1693 		if (tn->tn_type->t_bitfield) {
1694 			len = tn->tn_type->t_flen;
1695 			if (size_in_bits(INT) > len) {
1696 				t = INT;
1697 			} else {
1698 				lint_assert(len == size_in_bits(INT));
1699 				if (is_uinteger(t)) {
1700 					t = UINT;
1701 				} else {
1702 					t = INT;
1703 				}
1704 			}
1705 		} else if (t == CHAR || t == UCHAR || t == SCHAR) {
1706 			t = (size_in_bits(CHAR) < size_in_bits(INT)
1707 			     || t != UCHAR) ? INT : UINT;
1708 		} else if (t == SHORT || t == USHORT) {
1709 			t = (size_in_bits(SHORT) < size_in_bits(INT)
1710 			     || t == SHORT) ? INT : UINT;
1711 		} else if (t == ENUM) {
1712 			t = INT;
1713 		} else if (farg && t == FLOAT) {
1714 			t = DOUBLE;
1715 		}
1716 	} else {
1717 		/*
1718 		 * In traditional C, keep unsigned and promote FLOAT
1719 		 * to DOUBLE.
1720 		 */
1721 		if (t == UCHAR || t == USHORT) {
1722 			t = UINT;
1723 		} else if (t == CHAR || t == SCHAR || t == SHORT) {
1724 			t = INT;
1725 		} else if (t == FLOAT) {
1726 			t = DOUBLE;
1727 		} else if (t == ENUM) {
1728 			t = INT;
1729 		}
1730 	}
1731 
1732 	if (t != tn->tn_type->t_tspec) {
1733 		ntp = expr_dup_type(tn->tn_type);
1734 		ntp->t_tspec = t;
1735 		/*
1736 		 * Keep t_is_enum so we are later able to check compatibility
1737 		 * of enum types.
1738 		 */
1739 		tn = convert(op, 0, ntp, tn);
1740 	}
1741 
1742 	return tn;
1743 }
1744 
1745 /*
1746  * Apply the "usual arithmetic conversions" (C99 6.3.1.8).
1747  *
1748  * This gives both operands the same type.
1749  * This is done in different ways for traditional C and C90.
1750  */
1751 static void
1752 balance(op_t op, tnode_t **lnp, tnode_t **rnp)
1753 {
1754 	tspec_t	lt, rt, t;
1755 	int	i;
1756 	bool	u;
1757 	type_t	*ntp;
1758 	static const tspec_t tl[] = {
1759 		LDOUBLE, DOUBLE, FLOAT, UQUAD, QUAD, ULONG, LONG, UINT, INT,
1760 	};
1761 
1762 	lt = (*lnp)->tn_type->t_tspec;
1763 	rt = (*rnp)->tn_type->t_tspec;
1764 
1765 	if (!is_arithmetic(lt) || !is_arithmetic(rt))
1766 		return;
1767 
1768 	if (!tflag) {
1769 		if (lt == rt) {
1770 			t = lt;
1771 		} else if (lt == LCOMPLEX || rt == LCOMPLEX) {
1772 			t = LCOMPLEX;
1773 		} else if (lt == DCOMPLEX || rt == DCOMPLEX) {
1774 			t = DCOMPLEX;
1775 		} else if (lt == COMPLEX || rt == COMPLEX) {
1776 			t = COMPLEX;
1777 		} else if (lt == FCOMPLEX || rt == FCOMPLEX) {
1778 			t = FCOMPLEX;
1779 		} else if (lt == LDOUBLE || rt == LDOUBLE) {
1780 			t = LDOUBLE;
1781 		} else if (lt == DOUBLE || rt == DOUBLE) {
1782 			t = DOUBLE;
1783 		} else if (lt == FLOAT || rt == FLOAT) {
1784 			t = FLOAT;
1785 		} else {
1786 			/*
1787 			 * If type A has more bits than type B it should
1788 			 * be able to hold all possible values of type B.
1789 			 */
1790 			if (size_in_bits(lt) > size_in_bits(rt)) {
1791 				t = lt;
1792 			} else if (size_in_bits(lt) < size_in_bits(rt)) {
1793 				t = rt;
1794 			} else {
1795 				for (i = 3; tl[i] != INT; i++) {
1796 					if (tl[i] == lt || tl[i] == rt)
1797 						break;
1798 				}
1799 				if ((is_uinteger(lt) || is_uinteger(rt)) &&
1800 				    !is_uinteger(tl[i])) {
1801 					i--;
1802 				}
1803 				t = tl[i];
1804 			}
1805 		}
1806 	} else {
1807 		/* Keep unsigned in traditional C */
1808 		u = is_uinteger(lt) || is_uinteger(rt);
1809 		for (i = 0; tl[i] != INT; i++) {
1810 			if (lt == tl[i] || rt == tl[i])
1811 				break;
1812 		}
1813 		t = tl[i];
1814 		if (u && is_integer(t) && !is_uinteger(t))
1815 			t = unsigned_type(t);
1816 	}
1817 
1818 	if (t != lt) {
1819 		ntp = expr_dup_type((*lnp)->tn_type);
1820 		ntp->t_tspec = t;
1821 		*lnp = convert(op, 0, ntp, *lnp);
1822 	}
1823 	if (t != rt) {
1824 		ntp = expr_dup_type((*rnp)->tn_type);
1825 		ntp->t_tspec = t;
1826 		*rnp = convert(op, 0, ntp, *rnp);
1827 	}
1828 }
1829 
1830 /*
1831  * Insert a conversion operator, which converts the type of the node
1832  * to another given type.
1833  * If op is FARG, arg is the number of the argument (used for warnings).
1834  */
1835 tnode_t *
1836 convert(op_t op, int arg, type_t *tp, tnode_t *tn)
1837 {
1838 	tnode_t	*ntn;
1839 	tspec_t	nt, ot;
1840 
1841 	nt = tp->t_tspec;
1842 	ot = tn->tn_type->t_tspec;
1843 
1844 	if (!tflag && !sflag && op == FARG)
1845 		check_prototype_conversion(arg, nt, ot, tp, tn);
1846 	if (is_integer(nt) && is_integer(ot)) {
1847 		check_integer_conversion(op, arg, nt, ot, tp, tn);
1848 	} else if (nt == PTR && is_null_pointer(tn)) {
1849 		/* a null pointer may be assigned to any pointer. */
1850 	} else if (is_integer(nt) && nt != BOOL && ot == PTR) {
1851 		check_pointer_integer_conversion(op, nt, tp, tn);
1852 	} else if (nt == PTR && ot == PTR && op == CVT) {
1853 		check_pointer_conversion(tn, tp);
1854 	}
1855 
1856 	ntn = expr_zalloc_tnode();
1857 	ntn->tn_op = CVT;
1858 	ntn->tn_type = tp;
1859 	ntn->tn_cast = op == CVT;
1860 	ntn->tn_from_system_header |= tn->tn_from_system_header;
1861 	ntn->tn_right = NULL;
1862 	if (tn->tn_op != CON || nt == VOID) {
1863 		ntn->tn_left = tn;
1864 	} else {
1865 		ntn->tn_op = CON;
1866 		ntn->tn_val = expr_zalloc(sizeof(*ntn->tn_val));
1867 		convert_constant(op, arg, ntn->tn_type, ntn->tn_val,
1868 		    tn->tn_val);
1869 	}
1870 
1871 	return ntn;
1872 }
1873 
1874 /*
1875  * Print a warning if a prototype causes a type conversion that is
1876  * different from what would happen to the same argument in the
1877  * absence of a prototype.
1878  *
1879  * Errors/warnings about illegal type combinations are already printed
1880  * in check_assign_types_compatible().
1881  */
1882 static void
1883 check_prototype_conversion(int arg, tspec_t nt, tspec_t ot, type_t *tp,
1884 			   tnode_t *tn)
1885 {
1886 	tnode_t	*ptn;
1887 
1888 	if (!is_arithmetic(nt) || !is_arithmetic(ot))
1889 		return;
1890 
1891 	/*
1892 	 * If the type of the formal parameter is char/short, a warning
1893 	 * would be useless, because functions declared the old style
1894 	 * can't expect char/short arguments.
1895 	 */
1896 	/* XXX: what about SCHAR? */
1897 	if (nt == CHAR || nt == UCHAR || nt == SHORT || nt == USHORT)
1898 		return;
1899 
1900 	/* get default promotion */
1901 	ptn = promote(NOOP, true, tn);
1902 	ot = ptn->tn_type->t_tspec;
1903 
1904 	/* return if types are the same with and without prototype */
1905 	if (nt == ot || (nt == ENUM && ot == INT))
1906 		return;
1907 
1908 	if (is_floating(nt) != is_floating(ot) ||
1909 	    portable_size_in_bits(nt) != portable_size_in_bits(ot)) {
1910 		/* representation and/or width change */
1911 		if (!is_integer(ot) ||
1912 		    portable_size_in_bits(ot) > portable_size_in_bits(INT)) {
1913 			/* argument #%d is converted from '%s' to '%s' ... */
1914 			warning(259,
1915 			    arg, type_name(tn->tn_type), type_name(tp));
1916 		}
1917 	} else if (hflag) {
1918 		/*
1919 		 * they differ in sign or base type (char, short, int,
1920 		 * long, long long, float, double, long double)
1921 		 *
1922 		 * if they differ only in sign and the argument is a constant
1923 		 * and the msb of the argument is not set, print no warning
1924 		 */
1925 		if (ptn->tn_op == CON && is_integer(nt) &&
1926 		    signed_type(nt) == signed_type(ot) &&
1927 		    msb(ptn->tn_val->v_quad, ot, -1) == 0) {
1928 			/* ok */
1929 		} else {
1930 			/* argument #%d is converted from '%s' to '%s' ... */
1931 			warning(259,
1932 			    arg, type_name(tn->tn_type), type_name(tp));
1933 		}
1934 	}
1935 }
1936 
1937 /*
1938  * Print warnings for conversions of integer types which may cause problems.
1939  */
1940 /* ARGSUSED */
1941 static void
1942 check_integer_conversion(op_t op, int arg, tspec_t nt, tspec_t ot, type_t *tp,
1943 			 tnode_t *tn)
1944 {
1945 	char opbuf[16];
1946 
1947 	if (tn->tn_op == CON)
1948 		return;
1949 
1950 	if (op == CVT)
1951 		return;
1952 
1953 	if (Sflag && nt == BOOL)
1954 		return;		/* See C99 6.3.1.2 */
1955 
1956 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
1957 	    is_uinteger(nt) != is_uinteger(ot)) {
1958 		if (aflag > 0 && pflag) {
1959 			if (op == FARG) {
1960 				/* conversion to '%s' may sign-extend ... */
1961 				warning(297, type_name(tp), arg);
1962 			} else {
1963 				/* conversion to '%s' may sign-extend ... */
1964 				warning(131, type_name(tp));
1965 			}
1966 		}
1967 	}
1968 
1969 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot)) {
1970 		switch (tn->tn_op) {
1971 		case PLUS:
1972 		case MINUS:
1973 		case MULT:
1974 		case SHL:
1975 			/* suggest cast from '%s' to '%s' on op %s to ... */
1976 			warning(324, type_name(gettyp(ot)), type_name(tp),
1977 			    print_tnode(opbuf, sizeof(opbuf), tn));
1978 			break;
1979 		default:
1980 			break;
1981 		}
1982 	}
1983 
1984 	if (portable_size_in_bits(nt) < portable_size_in_bits(ot) &&
1985 	    (ot == LONG || ot == ULONG || ot == QUAD || ot == UQUAD ||
1986 	     aflag > 1)) {
1987 		/* conversion from '%s' may lose accuracy */
1988 		if (aflag > 0) {
1989 			if (op == FARG) {
1990 				/* conv. from '%s' to '%s' may lose ... */
1991 				warning(298,
1992 				    type_name(tn->tn_type), type_name(tp), arg);
1993 			} else {
1994 				/* conv. from '%s' to '%s' may lose accuracy */
1995 				warning(132,
1996 				    type_name(tn->tn_type), type_name(tp));
1997 			}
1998 		}
1999 	}
2000 }
2001 
2002 /*
2003  * Print warnings for dubious conversions of pointer to integer.
2004  */
2005 static void
2006 check_pointer_integer_conversion(op_t op, tspec_t nt, type_t *tp, tnode_t *tn)
2007 {
2008 
2009 	if (tn->tn_op == CON)
2010 		return;
2011 	if (op != CVT)
2012 		return;		/* We got already an error. */
2013 	if (portable_size_in_bits(nt) >= portable_size_in_bits(PTR))
2014 		return;
2015 
2016 	if (pflag && size_in_bits(nt) >= size_in_bits(PTR)) {
2017 		/* conversion of pointer to '%s' may lose bits */
2018 		warning(134, type_name(tp));
2019 	} else {
2020 		/* conversion of pointer to '%s' loses bits */
2021 		warning(133, type_name(tp));
2022 	}
2023 }
2024 
2025 static bool
2026 should_warn_about_pointer_cast(const type_t *nstp, tspec_t nst,
2027 			       const type_t *ostp, tspec_t ost)
2028 {
2029 	/*
2030 	 * Casting a pointer to 'struct S' to a pointer to another struct that
2031 	 * has 'struct S' as its first member is ok, see msg_247.c, 'struct
2032 	 * counter'.
2033 	 */
2034 	if (nst == STRUCT && ost == STRUCT &&
2035 	    nstp->t_str->sou_first_member != NULL &&
2036 	    nstp->t_str->sou_first_member->s_type == ostp)
2037 		return false;
2038 
2039 	if (is_incomplete(nstp) || is_incomplete(ostp))
2040 		return false;
2041 
2042 	if ((nst == STRUCT || nst == UNION) && nstp->t_str != ostp->t_str)
2043 		return true;
2044 
2045 	if (nst == CHAR || nst == UCHAR)
2046 		return false;	/* for the sake of traditional C code */
2047 
2048 	return portable_size_in_bits(nst) != portable_size_in_bits(ost);
2049 }
2050 
2051 /*
2052  * Warn about questionable pointer conversions.
2053  */
2054 static void
2055 check_pointer_conversion(tnode_t *tn, type_t *ntp)
2056 {
2057 	const type_t *nstp, *otp, *ostp;
2058 	tspec_t nst, ost;
2059 	const char *nts, *ots;
2060 
2061 	nstp = ntp->t_subt;
2062 	otp = tn->tn_type;
2063 	ostp = otp->t_subt;
2064 	nst = nstp->t_tspec;
2065 	ost = ostp->t_tspec;
2066 
2067 	if (nst == VOID || ost == VOID) {
2068 		if (sflag && (nst == FUNC || ost == FUNC)) {
2069 			/* null pointers are already handled in convert() */
2070 			*(nst == FUNC ? &nts : &ots) = "function pointer";
2071 			*(nst == VOID ? &nts : &ots) = "'void *'";
2072 			/* ANSI C forbids conversion of %s to %s */
2073 			warning(303, ots, nts);
2074 		}
2075 		return;
2076 	} else if (nst == FUNC && ost == FUNC) {
2077 		return;
2078 	} else if (nst == FUNC || ost == FUNC) {
2079 		/* converting '%s' to '%s' is questionable */
2080 		warning(229, type_name(otp), type_name(ntp));
2081 		return;
2082 	}
2083 
2084 	if (hflag && alignment_in_bits(nstp) > alignment_in_bits(ostp) &&
2085 	    !is_incomplete(ostp)) {
2086 		/* converting '%s' to '%s' may cause alignment problem */
2087 		warning(135, type_name(otp), type_name(ntp));
2088 	}
2089 
2090 	if (cflag && should_warn_about_pointer_cast(nstp, nst, ostp, ost)) {
2091 		/* pointer cast from '%s' to '%s' may be troublesome */
2092 		warning(247, type_name(otp), type_name(ntp));
2093 	}
2094 }
2095 
2096 /*
2097  * Converts a typed constant to a constant of another type.
2098  *
2099  * op		operator which requires conversion
2100  * arg		if op is FARG, # of argument
2101  * tp		type in which to convert the constant
2102  * nv		new constant
2103  * v		old constant
2104  */
2105 void
2106 convert_constant(op_t op, int arg, const type_t *tp, val_t *nv, val_t *v)
2107 {
2108 	tspec_t	ot, nt;
2109 	ldbl_t	max = 0.0, min = 0.0;
2110 	int	sz;
2111 	bool	rchk;
2112 	int64_t	xmask, xmsk1;
2113 	int	osz, nsz;
2114 
2115 	/*
2116 	 * TODO: make 'v' const; the name of this function does not suggest
2117 	 *  that it modifies 'v'.
2118 	 */
2119 	ot = v->v_tspec;
2120 	nt = nv->v_tspec = tp->t_tspec;
2121 	rchk = false;
2122 
2123 	if (nt == BOOL) {	/* C99 6.3.1.2 */
2124 		nv->v_ansiu = false;
2125 		nv->v_quad = is_nonzero_val(v) ? 1 : 0;
2126 		return;
2127 	}
2128 
2129 	if (ot == FLOAT || ot == DOUBLE || ot == LDOUBLE) {
2130 		switch (nt) {
2131 		case CHAR:
2132 			max = TARG_CHAR_MAX;	min = TARG_CHAR_MIN;	break;
2133 		case UCHAR:
2134 			max = TARG_UCHAR_MAX;	min = 0;		break;
2135 		case SCHAR:
2136 			max = TARG_SCHAR_MAX;	min = TARG_SCHAR_MIN;	break;
2137 		case SHORT:
2138 			max = TARG_SHRT_MAX;	min = TARG_SHRT_MIN;	break;
2139 		case USHORT:
2140 			max = TARG_USHRT_MAX;	min = 0;		break;
2141 		case ENUM:
2142 		case INT:
2143 			max = TARG_INT_MAX;	min = TARG_INT_MIN;	break;
2144 		case UINT:
2145 			max = (u_int)TARG_UINT_MAX;min = 0;		break;
2146 		case LONG:
2147 			max = TARG_LONG_MAX;	min = TARG_LONG_MIN;	break;
2148 		case ULONG:
2149 			max = (u_long)TARG_ULONG_MAX; min = 0;		break;
2150 		case QUAD:
2151 			max = QUAD_MAX;		min = QUAD_MIN;		break;
2152 		case UQUAD:
2153 			max = (uint64_t)UQUAD_MAX; min = 0;		break;
2154 		case FLOAT:
2155 		case FCOMPLEX:
2156 			max = FLT_MAX;		min = -FLT_MAX;		break;
2157 		case DOUBLE:
2158 		case DCOMPLEX:
2159 			max = DBL_MAX;		min = -DBL_MAX;		break;
2160 		case PTR:
2161 			/* Got already an error because of float --> ptr */
2162 		case LDOUBLE:
2163 		case LCOMPLEX:
2164 			max = LDBL_MAX;		min = -LDBL_MAX;	break;
2165 		default:
2166 			lint_assert(/*CONSTCOND*/false);
2167 		}
2168 		if (v->v_ldbl > max || v->v_ldbl < min) {
2169 			lint_assert(nt != LDOUBLE);
2170 			if (op == FARG) {
2171 				/* conv. of '%s' to '%s' is out of range, ... */
2172 				warning(295,
2173 				    type_name(gettyp(ot)), type_name(tp), arg);
2174 			} else {
2175 				/* conversion of '%s' to '%s' is out of range */
2176 				warning(119,
2177 				    type_name(gettyp(ot)), type_name(tp));
2178 			}
2179 			v->v_ldbl = v->v_ldbl > 0 ? max : min;
2180 		}
2181 		if (nt == FLOAT) {
2182 			nv->v_ldbl = (float)v->v_ldbl;
2183 		} else if (nt == DOUBLE) {
2184 			nv->v_ldbl = (double)v->v_ldbl;
2185 		} else if (nt == LDOUBLE) {
2186 			nv->v_ldbl = v->v_ldbl;
2187 		} else {
2188 			nv->v_quad = (nt == PTR || is_uinteger(nt)) ?
2189 				(int64_t)v->v_ldbl : (int64_t)v->v_ldbl;
2190 		}
2191 	} else {
2192 		if (nt == FLOAT) {
2193 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2194 			       (float)(uint64_t)v->v_quad : (float)v->v_quad;
2195 		} else if (nt == DOUBLE) {
2196 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2197 			       (double)(uint64_t)v->v_quad : (double)v->v_quad;
2198 		} else if (nt == LDOUBLE) {
2199 			nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2200 			       (ldbl_t)(uint64_t)v->v_quad : (ldbl_t)v->v_quad;
2201 		} else {
2202 			rchk = true;		/* Check for lost precision. */
2203 			nv->v_quad = v->v_quad;
2204 		}
2205 	}
2206 
2207 	if (v->v_ansiu && is_floating(nt)) {
2208 		/* ANSI C treats constant as unsigned */
2209 		warning(157);
2210 		v->v_ansiu = false;
2211 	} else if (v->v_ansiu && (is_integer(nt) && !is_uinteger(nt) &&
2212 				  portable_size_in_bits(nt) >
2213 				  portable_size_in_bits(ot))) {
2214 		/* ANSI C treats constant as unsigned */
2215 		warning(157);
2216 		v->v_ansiu = false;
2217 	}
2218 
2219 	switch (nt) {
2220 	case FLOAT:
2221 	case FCOMPLEX:
2222 	case DOUBLE:
2223 	case DCOMPLEX:
2224 	case LDOUBLE:
2225 	case LCOMPLEX:
2226 		break;
2227 	default:
2228 		sz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2229 		nv->v_quad = xsign(nv->v_quad, nt, sz);
2230 		break;
2231 	}
2232 
2233 	if (rchk && op != CVT) {
2234 		osz = size_in_bits(ot);
2235 		nsz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2236 		xmask = qlmasks[nsz] ^ qlmasks[osz];
2237 		xmsk1 = qlmasks[nsz] ^ qlmasks[osz - 1];
2238 		/*
2239 		 * For bitwise operations we are not interested in the
2240 		 * value, but in the bits itself.
2241 		 */
2242 		if (op == ORASS || op == BITOR || op == BITXOR) {
2243 			/*
2244 			 * Print a warning if bits which were set are
2245 			 * lost due to the conversion.
2246 			 * This can happen with operator ORASS only.
2247 			 */
2248 			if (nsz < osz && (v->v_quad & xmask) != 0) {
2249 				/* constant truncated by conv., op %s */
2250 				warning(306, op_name(op));
2251 			}
2252 		} else if (op == ANDASS || op == BITAND) {
2253 			/*
2254 			 * Print a warning if additional bits are not all 1
2255 			 * and the most significant bit of the old value is 1,
2256 			 * or if at least one (but not all) removed bit was 0.
2257 			 */
2258 			if (nsz > osz &&
2259 			    (nv->v_quad & qbmasks[osz - 1]) != 0 &&
2260 			    (nv->v_quad & xmask) != xmask) {
2261 				/* extra bits set to 0 in conv. of '%s' ... */
2262 				warning(309, type_name(gettyp(ot)),
2263 				    type_name(tp), op_name(op));
2264 			} else if (nsz < osz &&
2265 				   (v->v_quad & xmask) != xmask &&
2266 				   (v->v_quad & xmask) != 0) {
2267 				/* constant truncated by conv., op %s */
2268 				warning(306, op_name(op));
2269 			}
2270 		} else if ((nt != PTR && is_uinteger(nt)) &&
2271 			   (ot != PTR && !is_uinteger(ot)) &&
2272 			   v->v_quad < 0) {
2273 			if (op == ASSIGN) {
2274 				/* assignment of negative constant to ... */
2275 				warning(164);
2276 			} else if (op == INIT) {
2277 				/* initialization of unsigned with neg... */
2278 				warning(221);
2279 			} else if (op == FARG) {
2280 				/* conversion of negative constant to ... */
2281 				warning(296, arg);
2282 			} else if (modtab[op].m_comparison) {
2283 				/* handled by check_integer_comparison() */
2284 			} else {
2285 				/* conversion of negative constant to ... */
2286 				warning(222);
2287 			}
2288 		} else if (nv->v_quad != v->v_quad && nsz <= osz &&
2289 			   (v->v_quad & xmask) != 0 &&
2290 			   (is_uinteger(ot) || (v->v_quad & xmsk1) != xmsk1)) {
2291 			/*
2292 			 * Loss of significant bit(s). All truncated bits
2293 			 * of unsigned types or all truncated bits plus the
2294 			 * msb of the target for signed types are considered
2295 			 * to be significant bits. Loss of significant bits
2296 			 * means that at least on of the bits was set in an
2297 			 * unsigned type or that at least one, but not all of
2298 			 * the bits was set in an signed type.
2299 			 * Loss of significant bits means that it is not
2300 			 * possible, also not with necessary casts, to convert
2301 			 * back to the original type. A example for a
2302 			 * necessary cast is:
2303 			 *	char c;	int	i; c = 128;
2304 			 *	i = c;			** yields -128 **
2305 			 *	i = (unsigned char)c;	** yields 128 **
2306 			 */
2307 			if (op == ASSIGN && tp->t_bitfield) {
2308 				/* precision lost in bit-field assignment */
2309 				warning(166);
2310 			} else if (op == ASSIGN) {
2311 				/* constant truncated by assignment */
2312 				warning(165);
2313 			} else if (op == INIT && tp->t_bitfield) {
2314 				/* bit-field initializer does not fit */
2315 				warning(180);
2316 			} else if (op == INIT) {
2317 				/* initializer does not fit */
2318 				warning(178);
2319 			} else if (op == CASE) {
2320 				/* case label affected by conversion */
2321 				warning(196);
2322 			} else if (op == FARG) {
2323 				/* conv. of '%s' to '%s' is out of range, ... */
2324 				warning(295,
2325 				    type_name(gettyp(ot)), type_name(tp), arg);
2326 			} else {
2327 				/* conversion of '%s' to '%s' is out of range */
2328 				warning(119,
2329 				    type_name(gettyp(ot)), type_name(tp));
2330 			}
2331 		} else if (nv->v_quad != v->v_quad) {
2332 			if (op == ASSIGN && tp->t_bitfield) {
2333 				/* precision lost in bit-field assignment */
2334 				warning(166);
2335 			} else if (op == INIT && tp->t_bitfield) {
2336 				/* bit-field initializer out of range */
2337 				warning(11);
2338 			} else if (op == CASE) {
2339 				/* case label affected by conversion */
2340 				warning(196);
2341 			} else if (op == FARG) {
2342 				/* conv. of '%s' to '%s' is out of range, ... */
2343 				warning(295,
2344 				    type_name(gettyp(ot)), type_name(tp), arg);
2345 			} else {
2346 				/* conversion of '%s' to '%s' is out of range */
2347 				warning(119,
2348 				    type_name(gettyp(ot)), type_name(tp));
2349 			}
2350 		}
2351 	}
2352 }
2353 
2354 /*
2355  * Called if incompatible types were detected.
2356  * Prints a appropriate warning.
2357  */
2358 static void
2359 warn_incompatible_types(op_t op,
2360 			const type_t *ltp, tspec_t lt,
2361 			const type_t *rtp, tspec_t rt)
2362 {
2363 	const mod_t *mp;
2364 
2365 	mp = &modtab[op];
2366 
2367 	if (lt == VOID || (mp->m_binary && rt == VOID)) {
2368 		/* void type illegal in expression */
2369 		error(109);
2370 	} else if (op == ASSIGN) {
2371 		if ((lt == STRUCT || lt == UNION) &&
2372 		    (rt == STRUCT || rt == UNION)) {
2373 			/* assignment of different structures (%s != %s) */
2374 			error(240, tspec_name(lt), tspec_name(rt));
2375 		} else {
2376 			/* cannot assign to '%s' from '%s' */
2377 			error(171, type_name(ltp), type_name(rtp));
2378 		}
2379 	} else if (mp->m_binary) {
2380 		/* operands of '%s' have incompatible types (%s != %s) */
2381 		error(107, mp->m_name, tspec_name(lt), tspec_name(rt));
2382 	} else {
2383 		lint_assert(rt == NOTSPEC);
2384 		/* operand of '%s' has invalid type (%s) */
2385 		error(108, mp->m_name, tspec_name(lt));
2386 	}
2387 }
2388 
2389 /*
2390  * Called if incompatible pointer types are detected.
2391  * Print an appropriate warning.
2392  */
2393 static void
2394 warn_incompatible_pointers(const mod_t *mp,
2395 			   const type_t *ltp, const type_t *rtp)
2396 {
2397 	tspec_t	lt, rt;
2398 
2399 	lint_assert(ltp->t_tspec == PTR);
2400 	lint_assert(rtp->t_tspec == PTR);
2401 
2402 	lt = ltp->t_subt->t_tspec;
2403 	rt = rtp->t_subt->t_tspec;
2404 
2405 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION)) {
2406 		if (mp == NULL) {
2407 			/* illegal structure pointer combination */
2408 			warning(244);
2409 		} else {
2410 			/* incompatible structure pointers: '%s' '%s' '%s' */
2411 			warning(245, type_name(ltp), mp->m_name, type_name(rtp));
2412 		}
2413 	} else {
2414 		if (mp == NULL) {
2415 			/* illegal pointer combination */
2416 			warning(184);
2417 		} else {
2418 			/* illegal pointer combination (%s) and (%s), op %s */
2419 			warning(124,
2420 			    type_name(ltp), type_name(rtp), mp->m_name);
2421 		}
2422 	}
2423 }
2424 
2425 /* Return a type based on tp1, with added qualifiers from tp2. */
2426 static type_t *
2427 merge_qualifiers(type_t *tp1, const type_t *tp2)
2428 {
2429 	type_t *ntp, *nstp;
2430 
2431 	lint_assert(tp1->t_tspec == PTR);
2432 	lint_assert(tp2->t_tspec == PTR);
2433 
2434 	bool c1 = tp1->t_subt->t_const;
2435 	bool c2 = tp2->t_subt->t_const;
2436 	bool v1 = tp1->t_subt->t_volatile;
2437 	bool v2 = tp2->t_subt->t_volatile;
2438 
2439 	if (c1 == (c1 | c2) && v1 == (v1 | v2))
2440 		return tp1;
2441 
2442 	nstp = expr_dup_type(tp1->t_subt);
2443 	nstp->t_const |= c2;
2444 	nstp->t_volatile |= v2;
2445 
2446 	ntp = expr_dup_type(tp1);
2447 	ntp->t_subt = nstp;
2448 	return ntp;
2449 }
2450 
2451 /*
2452  * Returns true if the given structure or union has a constant member
2453  * (maybe recursively).
2454  */
2455 static bool
2456 has_constant_member(const type_t *tp)
2457 {
2458 	sym_t	*m;
2459 	tspec_t	t;
2460 
2461 	lint_assert((t = tp->t_tspec) == STRUCT || t == UNION);
2462 
2463 	for (m = tp->t_str->sou_first_member; m != NULL; m = m->s_next) {
2464 		tp = m->s_type;
2465 		if (tp->t_const)
2466 			return true;
2467 		if ((t = tp->t_tspec) == STRUCT || t == UNION) {
2468 			if (has_constant_member(m->s_type))
2469 				return true;
2470 		}
2471 	}
2472 	return false;
2473 }
2474 
2475 /*
2476  * Create a new node for one of the operators POINT and ARROW.
2477  */
2478 static tnode_t *
2479 build_struct_access(op_t op, tnode_t *ln, tnode_t *rn)
2480 {
2481 	tnode_t	*ntn, *ctn;
2482 	bool	nolval;
2483 
2484 	lint_assert(rn->tn_op == NAME);
2485 	lint_assert(rn->tn_sym->s_value.v_tspec == INT);
2486 	lint_assert(rn->tn_sym->s_scl == MOS || rn->tn_sym->s_scl == MOU);
2487 
2488 	/*
2489 	 * Remember if the left operand is an lvalue (structure members
2490 	 * are lvalues if and only if the structure itself is an lvalue).
2491 	 */
2492 	nolval = op == POINT && !ln->tn_lvalue;
2493 
2494 	if (op == POINT) {
2495 		ln = build_address(ln, true);
2496 	} else if (ln->tn_type->t_tspec != PTR) {
2497 		lint_assert(tflag);
2498 		lint_assert(is_integer(ln->tn_type->t_tspec));
2499 		ln = convert(NOOP, 0, expr_derive_type(gettyp(VOID), PTR), ln);
2500 	}
2501 
2502 	ctn = expr_new_integer_constant(PTRDIFF_TSPEC,
2503 	    rn->tn_sym->s_value.v_quad / CHAR_SIZE);
2504 
2505 	ntn = new_tnode(PLUS, expr_derive_type(rn->tn_type, PTR), ln, ctn);
2506 	if (ln->tn_op == CON)
2507 		ntn = fold(ntn);
2508 
2509 	if (rn->tn_type->t_bitfield) {
2510 		ntn = new_tnode(FSEL, ntn->tn_type->t_subt, ntn, NULL);
2511 	} else {
2512 		ntn = new_tnode(INDIR, ntn->tn_type->t_subt, ntn, NULL);
2513 	}
2514 
2515 	if (nolval)
2516 		ntn->tn_lvalue = false;
2517 
2518 	return ntn;
2519 }
2520 
2521 /*
2522  * Create a node for INCAFT, INCBEF, DECAFT and DECBEF.
2523  */
2524 static tnode_t *
2525 build_prepost_incdec(op_t op, tnode_t *ln)
2526 {
2527 	tnode_t	*cn, *ntn;
2528 
2529 	lint_assert(ln != NULL);
2530 
2531 	if (ln->tn_type->t_tspec == PTR) {
2532 		cn = plength(ln->tn_type);
2533 	} else {
2534 		cn = expr_new_integer_constant(INT, (int64_t)1);
2535 	}
2536 	ntn = new_tnode(op, ln->tn_type, ln, cn);
2537 
2538 	return ntn;
2539 }
2540 
2541 /*
2542  * Create a node for REAL, IMAG
2543  */
2544 static tnode_t *
2545 build_real_imag(op_t op, tnode_t *ln)
2546 {
2547 	tnode_t	*cn, *ntn;
2548 
2549 	lint_assert(ln != NULL);
2550 
2551 	if (ln->tn_op == NAME) {
2552 		/*
2553 		 * This may be too much, but it avoids wrong warnings.
2554 		 * See d_c99_complex_split.c.
2555 		 */
2556 		mark_as_used(ln->tn_sym, false, false);
2557 		mark_as_set(ln->tn_sym);
2558 	}
2559 
2560 	switch (ln->tn_type->t_tspec) {
2561 	case LCOMPLEX:
2562 		/* XXX: integer and LDOUBLE don't match. */
2563 		cn = expr_new_integer_constant(LDOUBLE, (int64_t)1);
2564 		break;
2565 	case DCOMPLEX:
2566 		/* XXX: integer and DOUBLE don't match. */
2567 		cn = expr_new_integer_constant(DOUBLE, (int64_t)1);
2568 		break;
2569 	case FCOMPLEX:
2570 		/* XXX: integer and FLOAT don't match. */
2571 		cn = expr_new_integer_constant(FLOAT, (int64_t)1);
2572 		break;
2573 	default:
2574 		/* __%s__ is illegal for type %s */
2575 		error(276, op == REAL ? "real" : "imag",
2576 		    type_name(ln->tn_type));
2577 		return NULL;
2578 	}
2579 	ntn = new_tnode(op, cn->tn_type, ln, cn);
2580 	ntn->tn_lvalue = true;
2581 
2582 	return ntn;
2583 }
2584 /*
2585  * Create a tree node for the unary & operator
2586  */
2587 static tnode_t *
2588 build_address(tnode_t *tn, bool noign)
2589 {
2590 	tspec_t	t;
2591 
2592 	if (!noign && ((t = tn->tn_type->t_tspec) == ARRAY || t == FUNC)) {
2593 		if (tflag)
2594 			/* '&' before array or function: ignored */
2595 			warning(127);
2596 		return tn;
2597 	}
2598 
2599 	/* eliminate &* */
2600 	if (tn->tn_op == INDIR &&
2601 	    tn->tn_left->tn_type->t_tspec == PTR &&
2602 	    tn->tn_left->tn_type->t_subt == tn->tn_type) {
2603 		return tn->tn_left;
2604 	}
2605 
2606 	return new_tnode(ADDR, expr_derive_type(tn->tn_type, PTR), tn, NULL);
2607 }
2608 
2609 /*
2610  * Create a node for operators PLUS and MINUS.
2611  */
2612 static tnode_t *
2613 build_plus_minus(op_t op, tnode_t *ln, tnode_t *rn)
2614 {
2615 	tnode_t	*ntn, *ctn;
2616 	type_t	*tp;
2617 
2618 	/* If pointer and integer, then pointer to the lhs. */
2619 	if (rn->tn_type->t_tspec == PTR && is_integer(ln->tn_type->t_tspec)) {
2620 		ntn = ln;
2621 		ln = rn;
2622 		rn = ntn;
2623 	}
2624 
2625 	if (ln->tn_type->t_tspec == PTR && rn->tn_type->t_tspec != PTR) {
2626 
2627 		/* XXX: this assertion should be easy to trigger */
2628 		lint_assert(is_integer(rn->tn_type->t_tspec));
2629 
2630 		check_ctype_macro_invocation(ln, rn);
2631 
2632 		ctn = plength(ln->tn_type);
2633 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2634 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2635 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2636 		if (rn->tn_left->tn_op == CON)
2637 			rn = fold(rn);
2638 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2639 
2640 	} else if (rn->tn_type->t_tspec == PTR) {
2641 
2642 		lint_assert(ln->tn_type->t_tspec == PTR);
2643 		lint_assert(op == MINUS);
2644 		tp = gettyp(PTRDIFF_TSPEC);
2645 		ntn = new_tnode(op, tp, ln, rn);
2646 		if (ln->tn_op == CON && rn->tn_op == CON)
2647 			ntn = fold(ntn);
2648 		ctn = plength(ln->tn_type);
2649 		balance(NOOP, &ntn, &ctn);
2650 		ntn = new_tnode(DIV, tp, ntn, ctn);
2651 
2652 	} else {
2653 
2654 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2655 
2656 	}
2657 	return ntn;
2658 }
2659 
2660 /*
2661  * Create a node for operators SHL and SHR.
2662  */
2663 static tnode_t *
2664 build_bit_shift(op_t op, tnode_t *ln, tnode_t *rn)
2665 {
2666 	tspec_t	t;
2667 	tnode_t	*ntn;
2668 
2669 	if ((t = rn->tn_type->t_tspec) != INT && t != UINT)
2670 		rn = convert(CVT, 0, gettyp(INT), rn);
2671 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2672 	return ntn;
2673 }
2674 
2675 /*
2676  * Create a node for COLON.
2677  */
2678 static tnode_t *
2679 build_colon(tnode_t *ln, tnode_t *rn)
2680 {
2681 	tspec_t	lt, rt, pdt;
2682 	type_t	*tp;
2683 	tnode_t	*ntn;
2684 
2685 	lt = ln->tn_type->t_tspec;
2686 	rt = rn->tn_type->t_tspec;
2687 	pdt = PTRDIFF_TSPEC;
2688 
2689 	/*
2690 	 * Arithmetic types are balanced, all other type combinations
2691 	 * still need to be handled.
2692 	 */
2693 	if (is_arithmetic(lt) && is_arithmetic(rt)) {
2694 		tp = ln->tn_type;
2695 	} else if (lt == BOOL && rt == BOOL) {
2696 		tp = ln->tn_type;
2697 	} else if (lt == VOID || rt == VOID) {
2698 		tp = gettyp(VOID);
2699 	} else if (lt == STRUCT || lt == UNION) {
2700 		/* Both types must be identical. */
2701 		lint_assert(rt == STRUCT || rt == UNION);
2702 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2703 		if (is_incomplete(ln->tn_type)) {
2704 			/* unknown operand size, op %s */
2705 			error(138, op_name(COLON));
2706 			return NULL;
2707 		}
2708 		tp = ln->tn_type;
2709 	} else if (lt == PTR && is_integer(rt)) {
2710 		if (rt != pdt) {
2711 			rn = convert(NOOP, 0, gettyp(pdt), rn);
2712 			rt = pdt;
2713 		}
2714 		tp = ln->tn_type;
2715 	} else if (rt == PTR && is_integer(lt)) {
2716 		if (lt != pdt) {
2717 			ln = convert(NOOP, 0, gettyp(pdt), ln);
2718 			lt = pdt;
2719 		}
2720 		tp = rn->tn_type;
2721 	} else if (lt == PTR && ln->tn_type->t_subt->t_tspec == VOID) {
2722 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
2723 	} else if (rt == PTR && rn->tn_type->t_subt->t_tspec == VOID) {
2724 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2725 	} else {
2726 		/*
2727 		 * XXX For now we simply take the left type. This is
2728 		 * probably wrong, if one type contains a function prototype
2729 		 * and the other one, at the same place, only an old style
2730 		 * declaration.
2731 		 */
2732 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2733 	}
2734 
2735 	ntn = new_tnode(COLON, tp, ln, rn);
2736 
2737 	return ntn;
2738 }
2739 
2740 /*
2741  * Create a node for an assignment operator (both = and op= ).
2742  */
2743 static tnode_t *
2744 build_assignment(op_t op, tnode_t *ln, tnode_t *rn)
2745 {
2746 	tspec_t	lt, rt;
2747 	tnode_t	*ntn, *ctn;
2748 
2749 	lint_assert(ln != NULL);
2750 	lint_assert(rn != NULL);
2751 
2752 	lt = ln->tn_type->t_tspec;
2753 	rt = rn->tn_type->t_tspec;
2754 
2755 	if ((op == ADDASS || op == SUBASS) && lt == PTR) {
2756 		lint_assert(is_integer(rt));
2757 		ctn = plength(ln->tn_type);
2758 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2759 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2760 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2761 		if (rn->tn_left->tn_op == CON)
2762 			rn = fold(rn);
2763 	}
2764 
2765 	if ((op == ASSIGN || op == RETURN) && (lt == STRUCT || rt == STRUCT)) {
2766 		lint_assert(lt == rt);
2767 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2768 		if (is_incomplete(ln->tn_type)) {
2769 			if (op == RETURN) {
2770 				/* cannot return incomplete type */
2771 				error(212);
2772 			} else {
2773 				/* unknown operand size, op %s */
2774 				error(138, op_name(op));
2775 			}
2776 			return NULL;
2777 		}
2778 	}
2779 
2780 	if (op == SHLASS) {
2781 		if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
2782 			if (hflag)
2783 				/* semantics of '%s' change in ANSI C; ... */
2784 				warning(118, "<<=");
2785 		}
2786 	} else if (op != SHRASS) {
2787 		if (op == ASSIGN || lt != PTR) {
2788 			if (lt != rt ||
2789 			    (ln->tn_type->t_bitfield && rn->tn_op == CON)) {
2790 				rn = convert(op, 0, ln->tn_type, rn);
2791 				rt = lt;
2792 			}
2793 		}
2794 	}
2795 
2796 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2797 
2798 	return ntn;
2799 }
2800 
2801 /*
2802  * Get length of type tp->t_subt.
2803  */
2804 static tnode_t *
2805 plength(type_t *tp)
2806 {
2807 	int	elem, elsz;
2808 
2809 	lint_assert(tp->t_tspec == PTR);
2810 	tp = tp->t_subt;
2811 
2812 	elem = 1;
2813 	elsz = 0;
2814 
2815 	while (tp->t_tspec == ARRAY) {
2816 		elem *= tp->t_dim;
2817 		tp = tp->t_subt;
2818 	}
2819 
2820 	switch (tp->t_tspec) {
2821 	case FUNC:
2822 		/* pointer to function is not allowed here */
2823 		error(110);
2824 		break;
2825 	case VOID:
2826 		/* cannot do pointer arithmetic on operand of unknown size */
2827 		gnuism(136);
2828 		break;
2829 	case STRUCT:
2830 	case UNION:
2831 		if ((elsz = tp->t_str->sou_size_in_bits) == 0)
2832 			/* cannot do pointer arithmetic on operand of ... */
2833 			error(136);
2834 		break;
2835 	case ENUM:
2836 		if (is_incomplete(tp)) {
2837 			/* cannot do pointer arithmetic on operand of ... */
2838 			warning(136);
2839 		}
2840 		/* FALLTHROUGH */
2841 	default:
2842 		if ((elsz = size_in_bits(tp->t_tspec)) == 0) {
2843 			/* cannot do pointer arithmetic on operand of ... */
2844 			error(136);
2845 		} else {
2846 			lint_assert(elsz != -1);
2847 		}
2848 		break;
2849 	}
2850 
2851 	if (elem == 0 && elsz != 0) {
2852 		/* cannot do pointer arithmetic on operand of unknown size */
2853 		error(136);
2854 	}
2855 
2856 	if (elsz == 0)
2857 		elsz = CHAR_SIZE;
2858 
2859 	return expr_new_integer_constant(PTRDIFF_TSPEC,
2860 	    (int64_t)(elem * elsz / CHAR_SIZE));
2861 }
2862 
2863 /*
2864  * XXX
2865  * Note: There appear to be a number of bugs in detecting overflow in
2866  * this function. An audit and a set of proper regression tests are needed.
2867  *     --Perry Metzger, Nov. 16, 2001
2868  */
2869 /*
2870  * Do only as much as necessary to compute constant expressions.
2871  * Called only if the operator allows folding and all operands are constants.
2872  */
2873 static tnode_t *
2874 fold(tnode_t *tn)
2875 {
2876 	val_t	*v;
2877 	tspec_t	t;
2878 	bool	utyp, ovfl;
2879 	int64_t	sl, sr = 0, q = 0, mask;
2880 	uint64_t ul, ur = 0;
2881 	tnode_t	*cn;
2882 
2883 	v = xcalloc(1, sizeof(*v));
2884 	v->v_tspec = t = tn->tn_type->t_tspec;
2885 
2886 	utyp = t == PTR || is_uinteger(t);
2887 	ul = sl = tn->tn_left->tn_val->v_quad;
2888 	if (modtab[tn->tn_op].m_binary)
2889 		ur = sr = tn->tn_right->tn_val->v_quad;
2890 
2891 	mask = qlmasks[size_in_bits(t)];
2892 	ovfl = false;
2893 
2894 	switch (tn->tn_op) {
2895 	case UPLUS:
2896 		q = sl;
2897 		break;
2898 	case UMINUS:
2899 		q = -sl;
2900 		if (sl != 0 && msb(q, t, -1) == msb(sl, t, -1))
2901 			ovfl = true;
2902 		break;
2903 	case COMPL:
2904 		q = ~sl;
2905 		break;
2906 	case MULT:
2907 		if (utyp) {
2908 			q = ul * ur;
2909 			if (q != (q & mask))
2910 				ovfl = true;
2911 			else if ((ul != 0) && ((q / ul) != ur))
2912 				ovfl = true;
2913 		} else {
2914 			q = sl * sr;
2915 			if (msb(q, t, -1) != (msb(sl, t, -1) ^ msb(sr, t, -1)))
2916 				ovfl = true;
2917 		}
2918 		break;
2919 	case DIV:
2920 		if (sr == 0) {
2921 			/* division by 0 */
2922 			error(139);
2923 			q = utyp ? UQUAD_MAX : QUAD_MAX;
2924 		} else {
2925 			q = utyp ? (int64_t)(ul / ur) : sl / sr;
2926 		}
2927 		break;
2928 	case MOD:
2929 		if (sr == 0) {
2930 			/* modulus by 0 */
2931 			error(140);
2932 			q = 0;
2933 		} else {
2934 			q = utyp ? (int64_t)(ul % ur) : sl % sr;
2935 		}
2936 		break;
2937 	case PLUS:
2938 		q = utyp ? (int64_t)(ul + ur) : sl + sr;
2939 		if (msb(sl, t, -1)  != 0 && msb(sr, t, -1) != 0) {
2940 			if (msb(q, t, -1) == 0)
2941 				ovfl = true;
2942 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) == 0) {
2943 			if (msb(q, t, -1) != 0)
2944 				ovfl = true;
2945 		}
2946 		break;
2947 	case MINUS:
2948 		q = utyp ? (int64_t)(ul - ur) : sl - sr;
2949 		if (msb(sl, t, -1) != 0 && msb(sr, t, -1) == 0) {
2950 			if (msb(q, t, -1) == 0)
2951 				ovfl = true;
2952 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) != 0) {
2953 			if (msb(q, t, -1) != 0)
2954 				ovfl = true;
2955 		}
2956 		break;
2957 	case SHL:
2958 		q = utyp ? (int64_t)(ul << sr) : sl << sr;
2959 		break;
2960 	case SHR:
2961 		/*
2962 		 * The sign must be explicitly extended because
2963 		 * shifts of signed values are implementation dependent.
2964 		 */
2965 		q = ul >> sr;
2966 		q = xsign(q, t, size_in_bits(t) - (int)sr);
2967 		break;
2968 	case LT:
2969 		q = (utyp ? ul < ur : sl < sr) ? 1 : 0;
2970 		break;
2971 	case LE:
2972 		q = (utyp ? ul <= ur : sl <= sr) ? 1 : 0;
2973 		break;
2974 	case GE:
2975 		q = (utyp ? ul >= ur : sl >= sr) ? 1 : 0;
2976 		break;
2977 	case GT:
2978 		q = (utyp ? ul > ur : sl > sr) ? 1 : 0;
2979 		break;
2980 	case EQ:
2981 		q = (utyp ? ul == ur : sl == sr) ? 1 : 0;
2982 		break;
2983 	case NE:
2984 		q = (utyp ? ul != ur : sl != sr) ? 1 : 0;
2985 		break;
2986 	case BITAND:
2987 		q = utyp ? (int64_t)(ul & ur) : sl & sr;
2988 		break;
2989 	case BITXOR:
2990 		q = utyp ? (int64_t)(ul ^ ur) : sl ^ sr;
2991 		break;
2992 	case BITOR:
2993 		q = utyp ? (int64_t)(ul | ur) : sl | sr;
2994 		break;
2995 	default:
2996 		lint_assert(/*CONSTCOND*/false);
2997 	}
2998 
2999 	/* XXX does not work for quads. */
3000 	if (ovfl || ((uint64_t)(q | mask) != ~(uint64_t)0 &&
3001 	    (q & ~mask) != 0)) {
3002 		if (hflag)
3003 			/* integer overflow detected, op %s */
3004 			warning(141, op_name(tn->tn_op));
3005 	}
3006 
3007 	v->v_quad = xsign(q, t, -1);
3008 
3009 	cn = expr_new_constant(tn->tn_type, v);
3010 	if (tn->tn_left->tn_system_dependent)
3011 		cn->tn_system_dependent = true;
3012 	if (modtab[tn->tn_op].m_binary && tn->tn_right->tn_system_dependent)
3013 		cn->tn_system_dependent = true;
3014 
3015 	return cn;
3016 }
3017 
3018 /*
3019  * Fold constant nodes, as much as is needed for comparing the value with 0
3020  * (test context, for controlling expressions).
3021  */
3022 static tnode_t *
3023 fold_test(tnode_t *tn)
3024 {
3025 	bool	l, r;
3026 	val_t	*v;
3027 
3028 	v = xcalloc(1, sizeof(*v));
3029 	v->v_tspec = tn->tn_type->t_tspec;
3030 	lint_assert(v->v_tspec == INT || (Tflag && v->v_tspec == BOOL));
3031 
3032 	l = constant_is_nonzero(tn->tn_left);
3033 	r = modtab[tn->tn_op].m_binary && constant_is_nonzero(tn->tn_right);
3034 
3035 	switch (tn->tn_op) {
3036 	case NOT:
3037 		if (hflag && !constcond_flag)
3038 			/* constant argument to '!' */
3039 			warning(239);
3040 		v->v_quad = !l ? 1 : 0;
3041 		break;
3042 	case LOGAND:
3043 		v->v_quad = l && r ? 1 : 0;
3044 		break;
3045 	case LOGOR:
3046 		v->v_quad = l || r ? 1 : 0;
3047 		break;
3048 	default:
3049 		lint_assert(/*CONSTCOND*/false);
3050 	}
3051 
3052 	return expr_new_constant(tn->tn_type, v);
3053 }
3054 
3055 /*
3056  * Fold constant nodes having operands with floating point type.
3057  */
3058 static tnode_t *
3059 fold_float(tnode_t *tn)
3060 {
3061 	val_t	*v;
3062 	tspec_t	t;
3063 	ldbl_t	l, r = 0;
3064 
3065 	fpe = 0;
3066 	v = xcalloc(1, sizeof(*v));
3067 	v->v_tspec = t = tn->tn_type->t_tspec;
3068 
3069 	lint_assert(is_floating(t));
3070 	lint_assert(t == tn->tn_left->tn_type->t_tspec);
3071 	lint_assert(!modtab[tn->tn_op].m_binary ||
3072 	    t == tn->tn_right->tn_type->t_tspec);
3073 
3074 	l = tn->tn_left->tn_val->v_ldbl;
3075 	if (modtab[tn->tn_op].m_binary)
3076 		r = tn->tn_right->tn_val->v_ldbl;
3077 
3078 	switch (tn->tn_op) {
3079 	case UPLUS:
3080 		v->v_ldbl = l;
3081 		break;
3082 	case UMINUS:
3083 		v->v_ldbl = -l;
3084 		break;
3085 	case MULT:
3086 		v->v_ldbl = l * r;
3087 		break;
3088 	case DIV:
3089 		if (r == 0.0) {
3090 			/* division by 0 */
3091 			error(139);
3092 			if (t == FLOAT) {
3093 				v->v_ldbl = l < 0 ? -FLT_MAX : FLT_MAX;
3094 			} else if (t == DOUBLE) {
3095 				v->v_ldbl = l < 0 ? -DBL_MAX : DBL_MAX;
3096 			} else {
3097 				v->v_ldbl = l < 0 ? -LDBL_MAX : LDBL_MAX;
3098 			}
3099 		} else {
3100 			v->v_ldbl = l / r;
3101 		}
3102 		break;
3103 	case PLUS:
3104 		v->v_ldbl = l + r;
3105 		break;
3106 	case MINUS:
3107 		v->v_ldbl = l - r;
3108 		break;
3109 	case LT:
3110 		v->v_quad = l < r ? 1 : 0;
3111 		break;
3112 	case LE:
3113 		v->v_quad = l <= r ? 1 : 0;
3114 		break;
3115 	case GE:
3116 		v->v_quad = l >= r ? 1 : 0;
3117 		break;
3118 	case GT:
3119 		v->v_quad = l > r ? 1 : 0;
3120 		break;
3121 	case EQ:
3122 		v->v_quad = l == r ? 1 : 0;
3123 		break;
3124 	case NE:
3125 		v->v_quad = l != r ? 1 : 0;
3126 		break;
3127 	default:
3128 		lint_assert(/*CONSTCOND*/false);
3129 	}
3130 
3131 	lint_assert(fpe != 0 || isnan((double)v->v_ldbl) == 0);
3132 	if (fpe != 0 || finite((double)v->v_ldbl) == 0 ||
3133 	    (t == FLOAT &&
3134 	     (v->v_ldbl > FLT_MAX || v->v_ldbl < -FLT_MAX)) ||
3135 	    (t == DOUBLE &&
3136 	     (v->v_ldbl > DBL_MAX || v->v_ldbl < -DBL_MAX))) {
3137 		/* floating point overflow detected, op %s */
3138 		warning(142, op_name(tn->tn_op));
3139 		if (t == FLOAT) {
3140 			v->v_ldbl = v->v_ldbl < 0 ? -FLT_MAX : FLT_MAX;
3141 		} else if (t == DOUBLE) {
3142 			v->v_ldbl = v->v_ldbl < 0 ? -DBL_MAX : DBL_MAX;
3143 		} else {
3144 			v->v_ldbl = v->v_ldbl < 0 ? -LDBL_MAX: LDBL_MAX;
3145 		}
3146 	    fpe = 0;
3147 	}
3148 
3149 	return expr_new_constant(tn->tn_type, v);
3150 }
3151 
3152 
3153 /*
3154  * Create a constant node for sizeof.
3155  */
3156 tnode_t *
3157 build_sizeof(const type_t *tp)
3158 {
3159 	int64_t size_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3160 	tnode_t *tn = expr_new_integer_constant(SIZEOF_TSPEC, size_in_bytes);
3161 	tn->tn_system_dependent = true;
3162 	return tn;
3163 }
3164 
3165 /*
3166  * Create a constant node for offsetof.
3167  */
3168 tnode_t *
3169 build_offsetof(const type_t *tp, const sym_t *sym)
3170 {
3171 	tspec_t t = tp->t_tspec;
3172 	if (t != STRUCT && t != UNION)
3173 		/* unacceptable operand of '%s' */
3174 		error(111, "offsetof");
3175 
3176 	// XXX: wrong size, no checking for sym fixme
3177 	int64_t offset_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3178 	tnode_t *tn = expr_new_integer_constant(SIZEOF_TSPEC, offset_in_bytes);
3179 	tn->tn_system_dependent = true;
3180 	return tn;
3181 }
3182 
3183 int64_t
3184 type_size_in_bits(const type_t *tp)
3185 {
3186 	int	elem, elsz;
3187 	bool	flex;
3188 
3189 	elem = 1;
3190 	flex = false;
3191 	while (tp->t_tspec == ARRAY) {
3192 		flex = true;	/* allow c99 flex arrays [] [0] */
3193 		elem *= tp->t_dim;
3194 		tp = tp->t_subt;
3195 	}
3196 	if (elem == 0) {
3197 		if (!flex) {
3198 			/* cannot take size/alignment of incomplete type */
3199 			error(143);
3200 			elem = 1;
3201 		}
3202 	}
3203 	switch (tp->t_tspec) {
3204 	case FUNC:
3205 		/* cannot take size/alignment of function */
3206 		error(144);
3207 		elsz = 1;
3208 		break;
3209 	case STRUCT:
3210 	case UNION:
3211 		if (is_incomplete(tp)) {
3212 			/* cannot take size/alignment of incomplete type */
3213 			error(143);
3214 			elsz = 1;
3215 		} else {
3216 			elsz = tp->t_str->sou_size_in_bits;
3217 		}
3218 		break;
3219 	case ENUM:
3220 		if (is_incomplete(tp)) {
3221 			/* cannot take size/alignment of incomplete type */
3222 			warning(143);
3223 		}
3224 		/* FALLTHROUGH */
3225 	default:
3226 		if (tp->t_bitfield) {
3227 			/* cannot take size/alignment of bit-field */
3228 			error(145);
3229 		}
3230 		if (tp->t_tspec == VOID) {
3231 			/* cannot take size/alignment of void */
3232 			error(146);
3233 			elsz = 1;
3234 		} else {
3235 			elsz = size_in_bits(tp->t_tspec);
3236 			lint_assert(elsz > 0);
3237 		}
3238 		break;
3239 	}
3240 
3241 	return (int64_t)elem * elsz;
3242 }
3243 
3244 tnode_t *
3245 build_alignof(const type_t *tp)
3246 {
3247 	switch (tp->t_tspec) {
3248 	case ARRAY:
3249 		break;
3250 
3251 	case FUNC:
3252 		/* cannot take size/alignment of function */
3253 		error(144);
3254 		return 0;
3255 
3256 	case STRUCT:
3257 	case UNION:
3258 		if (is_incomplete(tp)) {
3259 			/* cannot take size/alignment of incomplete type */
3260 			error(143);
3261 			return 0;
3262 		}
3263 		break;
3264 	case ENUM:
3265 		break;
3266 	default:
3267 		if (tp->t_bitfield) {
3268 			/* cannot take size/alignment of bit-field */
3269 			error(145);
3270 			return 0;
3271 		}
3272 		if (tp->t_tspec == VOID) {
3273 			/* cannot take size/alignment of void */
3274 			error(146);
3275 			return 0;
3276 		}
3277 		break;
3278 	}
3279 
3280 	return expr_new_integer_constant(SIZEOF_TSPEC,
3281 	    (int64_t)alignment_in_bits(tp) / CHAR_SIZE);
3282 }
3283 
3284 /*
3285  * Type casts.
3286  */
3287 tnode_t *
3288 cast(tnode_t *tn, type_t *tp)
3289 {
3290 	tspec_t	nt, ot;
3291 
3292 	if (tn == NULL)
3293 		return NULL;
3294 
3295 	/*
3296 	 * XXX: checking for tp == NULL is only a quick fix for PR 22119.
3297 	 *  The proper fix needs to be investigated properly.
3298 	 *  See d_pr_22119.c for how to get here.
3299 	 */
3300 	if (tp == NULL)
3301 		return NULL;
3302 
3303 	tn = cconv(tn);
3304 
3305 	nt = tp->t_tspec;
3306 	ot = tn->tn_type->t_tspec;
3307 
3308 	if (nt == VOID) {
3309 		/*
3310 		 * XXX ANSI C requires scalar types or void (Plauger & Brodie).
3311 		 * But this seems really questionable.
3312 		 */
3313 	} else if (nt == UNION) {
3314 		sym_t *m;
3315 		struct_or_union *str = tp->t_str;
3316 		if (!Sflag) {
3317 			/* union cast is a C9X feature */
3318 			error(328);
3319 			return NULL;
3320 		}
3321 		for (m = str->sou_first_member; m != NULL; m = m->s_next) {
3322 			if (sametype(m->s_type, tn->tn_type)) {
3323 				tn = expr_zalloc_tnode();
3324 				tn->tn_op = CVT;
3325 				tn->tn_type = tp;
3326 				tn->tn_cast = true;
3327 				tn->tn_right = NULL;
3328 				return tn;
3329 			}
3330 		}
3331 		/* type '%s' is not a member of '%s' */
3332 		error(329, type_name(tn->tn_type), type_name(tp));
3333 		return NULL;
3334 	} else if (nt == STRUCT || nt == ARRAY || nt == FUNC) {
3335 		if (!Sflag || nt == ARRAY || nt == FUNC) {
3336 			/* invalid cast expression */
3337 			error(147);
3338 			return NULL;
3339 		}
3340 	} else if (ot == STRUCT || ot == UNION) {
3341 		/* invalid cast expression */
3342 		error(147);
3343 		return NULL;
3344 	} else if (ot == VOID) {
3345 		/* improper cast of void expression */
3346 		error(148);
3347 		return NULL;
3348 	} else if (is_integer(nt) && is_scalar(ot)) {
3349 		/* ok */
3350 	} else if (is_floating(nt) && is_arithmetic(ot)) {
3351 		/* ok */
3352 	} else if (nt == PTR && is_integer(ot)) {
3353 		/* ok */
3354 	} else if (nt == PTR && ot == PTR) {
3355 		if (!tp->t_subt->t_const && tn->tn_type->t_subt->t_const) {
3356 			if (hflag)
3357 				/* cast discards 'const' from type '%s' */
3358 				warning(275, type_name(tn->tn_type));
3359 		}
3360 	} else {
3361 		/* invalid cast expression */
3362 		error(147);
3363 		return NULL;
3364 	}
3365 
3366 	tn = convert(CVT, 0, tp, tn);
3367 	tn->tn_cast = true;
3368 
3369 	return tn;
3370 }
3371 
3372 /*
3373  * Create the node for a function argument.
3374  * All necessary conversions and type checks are done in
3375  * new_function_call_node because new_function_argument_node has no
3376  * information about expected argument types.
3377  */
3378 tnode_t *
3379 new_function_argument_node(tnode_t *args, tnode_t *arg)
3380 {
3381 	tnode_t	*ntn;
3382 
3383 	/*
3384 	 * If there was a serious error in the expression for the argument,
3385 	 * create a dummy argument so the positions of the remaining arguments
3386 	 * will not change.
3387 	 */
3388 	if (arg == NULL)
3389 		arg = expr_new_integer_constant(INT, 0);
3390 
3391 	ntn = new_tnode(PUSH, arg->tn_type, arg, args);
3392 
3393 	return ntn;
3394 }
3395 
3396 /*
3397  * Create the node for a function call. Also check types of
3398  * function arguments and insert conversions, if necessary.
3399  */
3400 tnode_t *
3401 new_function_call_node(tnode_t *func, tnode_t *args)
3402 {
3403 	tnode_t	*ntn;
3404 	op_t	fcop;
3405 
3406 	if (func == NULL)
3407 		return NULL;
3408 
3409 	if (func->tn_op == NAME && func->tn_type->t_tspec == FUNC) {
3410 		fcop = CALL;
3411 	} else {
3412 		fcop = ICALL;
3413 	}
3414 
3415 	check_ctype_function_call(func, args);
3416 
3417 	/*
3418 	 * after cconv() func will always be a pointer to a function
3419 	 * if it is a valid function designator.
3420 	 */
3421 	func = cconv(func);
3422 
3423 	if (func->tn_type->t_tspec != PTR ||
3424 	    func->tn_type->t_subt->t_tspec != FUNC) {
3425 		/* illegal function (type %s) */
3426 		error(149, type_name(func->tn_type));
3427 		return NULL;
3428 	}
3429 
3430 	args = check_function_arguments(func->tn_type->t_subt, args);
3431 
3432 	ntn = new_tnode(fcop, func->tn_type->t_subt->t_subt, func, args);
3433 
3434 	return ntn;
3435 }
3436 
3437 /*
3438  * Check types of all function arguments and insert conversions,
3439  * if necessary.
3440  */
3441 static tnode_t *
3442 check_function_arguments(type_t *ftp, tnode_t *args)
3443 {
3444 	tnode_t	*arg;
3445 	sym_t	*asym;
3446 	tspec_t	at;
3447 	int	narg, npar, n, i;
3448 
3449 	/* get # of args in the prototype */
3450 	npar = 0;
3451 	for (asym = ftp->t_args; asym != NULL; asym = asym->s_next)
3452 		npar++;
3453 
3454 	/* get # of args in function call */
3455 	narg = 0;
3456 	for (arg = args; arg != NULL; arg = arg->tn_right)
3457 		narg++;
3458 
3459 	asym = ftp->t_args;
3460 	if (ftp->t_proto && npar != narg && !(ftp->t_vararg && npar < narg)) {
3461 		/* argument mismatch: %d arg%s passed, %d expected */
3462 		error(150, narg, narg > 1 ? "s" : "", npar);
3463 		asym = NULL;
3464 	}
3465 
3466 	for (n = 1; n <= narg; n++) {
3467 
3468 		/*
3469 		 * The rightmost argument is at the top of the argument
3470 		 * subtree.
3471 		 */
3472 		for (i = narg, arg = args; i > n; i--, arg = arg->tn_right)
3473 			continue;
3474 
3475 		/* some things which are always not allowed */
3476 		if ((at = arg->tn_left->tn_type->t_tspec) == VOID) {
3477 			/* void expressions may not be arguments, arg #%d */
3478 			error(151, n);
3479 			return NULL;
3480 		} else if ((at == STRUCT || at == UNION) &&
3481 			   is_incomplete(arg->tn_left->tn_type)) {
3482 			/* argument cannot have unknown size, arg #%d */
3483 			error(152, n);
3484 			return NULL;
3485 		} else if (is_integer(at) &&
3486 			   arg->tn_left->tn_type->t_is_enum &&
3487 			   is_incomplete(arg->tn_left->tn_type)) {
3488 			/* argument cannot have unknown size, arg #%d */
3489 			warning(152, n);
3490 		}
3491 
3492 		/* class conversions (arg in value context) */
3493 		arg->tn_left = cconv(arg->tn_left);
3494 
3495 		if (asym != NULL) {
3496 			arg->tn_left = check_prototype_argument(
3497 			    n, asym->s_type, arg->tn_left);
3498 		} else {
3499 			arg->tn_left = promote(NOOP, true, arg->tn_left);
3500 		}
3501 		arg->tn_type = arg->tn_left->tn_type;
3502 
3503 		if (asym != NULL)
3504 			asym = asym->s_next;
3505 	}
3506 
3507 	return args;
3508 }
3509 
3510 /*
3511  * Compare the type of an argument with the corresponding type of a
3512  * prototype parameter. If it is a valid combination, but both types
3513  * are not the same, insert a conversion to convert the argument into
3514  * the type of the parameter.
3515  */
3516 static tnode_t *
3517 check_prototype_argument(
3518 	int	n,		/* pos of arg */
3519 	type_t	*tp,		/* expected type (from prototype) */
3520 	tnode_t	*tn)		/* argument */
3521 {
3522 	tnode_t	*ln;
3523 	bool	dowarn;
3524 
3525 	ln = xcalloc(1, sizeof(*ln));
3526 	ln->tn_type = expr_dup_type(tp);
3527 	ln->tn_type->t_const = false;
3528 	ln->tn_lvalue = true;
3529 	if (typeok(FARG, n, ln, tn)) {
3530 		if (!eqtype(tp, tn->tn_type,
3531 		    true, false, (dowarn = false, &dowarn)) || dowarn)
3532 			tn = convert(FARG, n, tp, tn);
3533 	}
3534 	free(ln);
3535 	return tn;
3536 }
3537 
3538 /*
3539  * Return the value of an integral constant expression.
3540  * If the expression is not constant or its type is not an integer
3541  * type, an error message is printed.
3542  */
3543 val_t *
3544 constant(tnode_t *tn, bool required)
3545 {
3546 	val_t	*v;
3547 
3548 	if (tn != NULL)
3549 		tn = cconv(tn);
3550 	if (tn != NULL)
3551 		tn = promote(NOOP, false, tn);
3552 
3553 	v = xcalloc(1, sizeof(*v));
3554 
3555 	if (tn == NULL) {
3556 		lint_assert(nerr != 0);
3557 		if (dflag)
3558 			printf("constant node is null; returning 1 instead\n");
3559 		v->v_tspec = INT;
3560 		v->v_quad = 1;
3561 		return v;
3562 	}
3563 
3564 	v->v_tspec = tn->tn_type->t_tspec;
3565 
3566 	if (tn->tn_op == CON) {
3567 		lint_assert(tn->tn_type->t_tspec == tn->tn_val->v_tspec);
3568 		if (is_integer(tn->tn_val->v_tspec)) {
3569 			v->v_ansiu = tn->tn_val->v_ansiu;
3570 			v->v_quad = tn->tn_val->v_quad;
3571 			return v;
3572 		}
3573 		v->v_quad = tn->tn_val->v_ldbl;
3574 	} else {
3575 		v->v_quad = 1;
3576 	}
3577 
3578 	if (required)
3579 		/* integral constant expression expected */
3580 		error(55);
3581 	else
3582 		/* variable array dimension is a C99/GCC extension */
3583 		c99ism(318);
3584 
3585 	if (!is_integer(v->v_tspec))
3586 		v->v_tspec = INT;
3587 
3588 	return v;
3589 }
3590 
3591 static bool
3592 is_constcond_false(const tnode_t *tn, tspec_t t)
3593 {
3594 	return (t == BOOL || t == INT) &&
3595 	       tn->tn_op == CON && tn->tn_val->v_quad == 0;
3596 }
3597 
3598 /*
3599  * Perform some tests on expressions which can't be done in build() and
3600  * functions called by build(). These tests must be done here because
3601  * we need some information about the context in which the operations
3602  * are performed.
3603  * After all tests are performed and dofreeblk is true, expr() frees the
3604  * memory which is used for the expression.
3605  */
3606 void
3607 expr(tnode_t *tn, bool vctx, bool tctx, bool dofreeblk, bool constcond_false_ok)
3608 {
3609 
3610 	lint_assert(tn != NULL || nerr != 0);
3611 
3612 	if (tn == NULL) {
3613 		expr_free_all();
3614 		return;
3615 	}
3616 
3617 	/* expr() is also called in global initializations */
3618 	/* TODO: rename constcond_false_ok */
3619 	if (dcs->d_ctx != EXTERN && !constcond_false_ok)
3620 		check_statement_reachable();
3621 
3622 	check_expr_misc(tn, vctx, tctx, !tctx, false, false, false);
3623 	if (tn->tn_op == ASSIGN) {
3624 		if (hflag && tctx)
3625 			/* assignment in conditional context */
3626 			warning(159);
3627 	} else if (tn->tn_op == CON) {
3628 		if (hflag && tctx && !constcond_flag &&
3629 		    !tn->tn_system_dependent &&
3630 		    !(constcond_false_ok &&
3631 		      is_constcond_false(tn, tn->tn_type->t_tspec)))
3632 			/* constant in conditional context */
3633 			warning(161);
3634 	}
3635 	if (!modtab[tn->tn_op].m_has_side_effect) {
3636 		/*
3637 		 * for left operands of COMMA this warning is already
3638 		 * printed
3639 		 */
3640 		if (tn->tn_op != COMMA && !vctx && !tctx)
3641 			check_null_effect(tn);
3642 	}
3643 	if (dflag)
3644 		display_expression(tn, 0);
3645 
3646 	/* free the tree memory */
3647 	if (dofreeblk)
3648 		expr_free_all();
3649 }
3650 
3651 static bool
3652 has_side_effect(const tnode_t *tn) // NOLINT(misc-no-recursion)
3653 {
3654 	op_t op = tn->tn_op;
3655 
3656 	if (modtab[op].m_has_side_effect)
3657 		return true;
3658 
3659 	if (op == CVT && tn->tn_type->t_tspec == VOID)
3660 		return has_side_effect(tn->tn_left);
3661 
3662 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3663 	if (op == LOGAND || op == LOGOR)
3664 		return has_side_effect(tn->tn_right);
3665 
3666 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3667 	if (op == QUEST)
3668 		return has_side_effect(tn->tn_right);
3669 
3670 	if (op == COLON || op == COMMA) {
3671 		return has_side_effect(tn->tn_left) ||
3672 		       has_side_effect(tn->tn_right);
3673 	}
3674 
3675 	return false;
3676 }
3677 
3678 static void
3679 check_null_effect(const tnode_t *tn)
3680 {
3681 
3682 	if (hflag && !has_side_effect(tn)) {
3683 		/* expression has null effect */
3684 		warning(129);
3685 	}
3686 }
3687 
3688 /*
3689  * Dump an expression to stdout
3690  * only used for debugging
3691  */
3692 static void
3693 display_expression(const tnode_t *tn, int offs)
3694 {
3695 	uint64_t uq;
3696 
3697 	if (tn == NULL) {
3698 		(void)printf("%*s%s\n", offs, "", "NULL");
3699 		return;
3700 	}
3701 	(void)printf("%*sop %s  ", offs, "", op_name(tn->tn_op));
3702 
3703 	if (tn->tn_op == NAME) {
3704 		(void)printf("%s: %s ",
3705 		    tn->tn_sym->s_name,
3706 		    storage_class_name(tn->tn_sym->s_scl));
3707 	} else if (tn->tn_op == CON && is_floating(tn->tn_type->t_tspec)) {
3708 		(void)printf("%#g ", (double)tn->tn_val->v_ldbl);
3709 	} else if (tn->tn_op == CON && is_integer(tn->tn_type->t_tspec)) {
3710 		uq = tn->tn_val->v_quad;
3711 		(void)printf("0x %08lx %08lx ",
3712 		    (long)(uq >> 32) & 0xffffffffl,
3713 		    (long)uq & 0xffffffffl);
3714 	} else if (tn->tn_op == CON) {
3715 		lint_assert(tn->tn_type->t_tspec == PTR);
3716 		(void)printf("0x%0*lx ", (int)(sizeof(void *) * CHAR_BIT / 4),
3717 			     (u_long)tn->tn_val->v_quad);
3718 	} else if (tn->tn_op == STRING) {
3719 		if (tn->tn_string->st_tspec == CHAR) {
3720 			(void)printf("\"%s\"", tn->tn_string->st_cp);
3721 		} else {
3722 			char	*s;
3723 			size_t	n;
3724 			n = MB_CUR_MAX * (tn->tn_string->st_len + 1);
3725 			s = xmalloc(n);
3726 			(void)wcstombs(s, tn->tn_string->st_wcp, n);
3727 			(void)printf("L\"%s\"", s);
3728 			free(s);
3729 		}
3730 		(void)printf(" ");
3731 	} else if (tn->tn_op == FSEL) {
3732 		(void)printf("o=%d, l=%d ", tn->tn_type->t_foffs,
3733 			     tn->tn_type->t_flen);
3734 	}
3735 	(void)printf("%s\n", ttos(tn->tn_type));
3736 	if (tn->tn_op == NAME || tn->tn_op == CON || tn->tn_op == STRING)
3737 		return;
3738 	display_expression(tn->tn_left, offs + 2);
3739 	if (modtab[tn->tn_op].m_binary ||
3740 	    (tn->tn_op == PUSH && tn->tn_right != NULL)) {
3741 		display_expression(tn->tn_right, offs + 2);
3742 	}
3743 }
3744 
3745 /*
3746  * Called by expr() to recursively perform some tests.
3747  */
3748 /* ARGSUSED */
3749 void
3750 check_expr_misc(const tnode_t *tn, bool vctx, bool tctx,
3751 		bool eqwarn, bool fcall, bool rvdisc, bool szof)
3752 {
3753 	tnode_t	*ln, *rn;
3754 	const mod_t *mp;
3755 	op_t	op;
3756 	scl_t	sc;
3757 	dinfo_t	*di;
3758 
3759 	if (tn == NULL)
3760 		return;
3761 
3762 	ln = tn->tn_left;
3763 	rn = tn->tn_right;
3764 	mp = &modtab[op = tn->tn_op];
3765 
3766 	switch (op) {
3767 	case ADDR:
3768 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3769 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3770 			if (!szof)
3771 				mark_as_set(ln->tn_sym);
3772 			mark_as_used(ln->tn_sym, fcall, szof);
3773 		}
3774 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3775 			/* check the range of array indices */
3776 			check_array_index(ln->tn_left, true);
3777 		break;
3778 	case LOAD:
3779 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3780 			/* check the range of array indices */
3781 			check_array_index(ln->tn_left, false);
3782 		/* FALLTHROUGH */
3783 	case PUSH:
3784 	case INCBEF:
3785 	case DECBEF:
3786 	case INCAFT:
3787 	case DECAFT:
3788 	case ADDASS:
3789 	case SUBASS:
3790 	case MULASS:
3791 	case DIVASS:
3792 	case MODASS:
3793 	case ANDASS:
3794 	case ORASS:
3795 	case XORASS:
3796 	case SHLASS:
3797 	case SHRASS:
3798 	case REAL:
3799 	case IMAG:
3800 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3801 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3802 			sc = ln->tn_sym->s_scl;
3803 			/*
3804 			 * Look if there was a asm statement in one of the
3805 			 * compound statements we are in. If not, we don't
3806 			 * print a warning.
3807 			 */
3808 			for (di = dcs; di != NULL; di = di->d_next) {
3809 				if (di->d_asm)
3810 					break;
3811 			}
3812 			if (sc != EXTERN && sc != STATIC &&
3813 			    !ln->tn_sym->s_set && !szof && di == NULL) {
3814 				/* %s may be used before set */
3815 				warning(158, ln->tn_sym->s_name);
3816 				mark_as_set(ln->tn_sym);
3817 			}
3818 			mark_as_used(ln->tn_sym, false, false);
3819 		}
3820 		break;
3821 	case ASSIGN:
3822 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3823 		if (ln->tn_op == NAME && !szof && (reached || !warn_about_unreachable)) {
3824 			mark_as_set(ln->tn_sym);
3825 			if (ln->tn_sym->s_scl == EXTERN)
3826 				outusg(ln->tn_sym);
3827 		}
3828 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3829 			/* check the range of array indices */
3830 			check_array_index(ln->tn_left, false);
3831 		break;
3832 	case CALL:
3833 		lint_assert(ln->tn_op == ADDR);
3834 		lint_assert(ln->tn_left->tn_op == NAME);
3835 		if (!szof)
3836 			outcall(tn, vctx || tctx, rvdisc);
3837 		break;
3838 	case EQ:
3839 		if (hflag && eqwarn)
3840 			/* operator '==' found where '=' was expected */
3841 			warning(160);
3842 		break;
3843 	case CON:
3844 	case NAME:
3845 	case STRING:
3846 		return;
3847 		/* LINTED206: (enumeration values not handled in switch) */
3848 	case BITOR:
3849 	case BITXOR:
3850 	case NE:
3851 	case GE:
3852 	case GT:
3853 	case LE:
3854 	case LT:
3855 	case SHR:
3856 	case SHL:
3857 	case MINUS:
3858 	case PLUS:
3859 	case MOD:
3860 	case DIV:
3861 	case MULT:
3862 	case INDIR:
3863 	case UMINUS:
3864 	case UPLUS:
3865 	case DEC:
3866 	case INC:
3867 	case COMPL:
3868 	case NOT:
3869 	case POINT:
3870 	case ARROW:
3871 	case NOOP:
3872 	case BITAND:
3873 	case FARG:
3874 	case CASE:
3875 	case INIT:
3876 	case RETURN:
3877 	case ICALL:
3878 	case CVT:
3879 	case COMMA:
3880 	case FSEL:
3881 	case COLON:
3882 	case QUEST:
3883 	case LOGOR:
3884 	case LOGAND:
3885 		break;
3886 	}
3887 
3888 	bool cvctx = mp->m_left_value_context;
3889 	bool ctctx = mp->m_left_test_context;
3890 	bool eq = mp->m_warn_if_operand_eq &&
3891 		  !ln->tn_parenthesized &&
3892 		  rn != NULL && !rn->tn_parenthesized;
3893 
3894 	/*
3895 	 * values of operands of ':' are not used if the type of at least
3896 	 * one of the operands (for gcc compatibility) is void
3897 	 * XXX test/value context of QUEST should probably be used as
3898 	 * context for both operands of COLON
3899 	 */
3900 	if (op == COLON && tn->tn_type->t_tspec == VOID)
3901 		cvctx = ctctx = false;
3902 	bool discard = op == CVT && tn->tn_type->t_tspec == VOID;
3903 	check_expr_misc(ln, cvctx, ctctx, eq, op == CALL, discard, szof);
3904 
3905 	switch (op) {
3906 	case PUSH:
3907 		if (rn != NULL)
3908 			check_expr_misc(rn, false, false, eq, false, false,
3909 			    szof);
3910 		break;
3911 	case LOGAND:
3912 	case LOGOR:
3913 		check_expr_misc(rn, false, true, eq, false, false, szof);
3914 		break;
3915 	case COLON:
3916 		check_expr_misc(rn, cvctx, ctctx, eq, false, false, szof);
3917 		break;
3918 	case COMMA:
3919 		check_expr_misc(rn, vctx, tctx, eq, false, false, szof);
3920 		break;
3921 	default:
3922 		if (mp->m_binary)
3923 			check_expr_misc(rn, true, false, eq, false, false,
3924 			    szof);
3925 		break;
3926 	}
3927 
3928 }
3929 
3930 /*
3931  * Checks the range of array indices, if possible.
3932  * amper is set if only the address of the element is used. This
3933  * means that the index is allowed to refer to the first element
3934  * after the array.
3935  */
3936 static void
3937 check_array_index(tnode_t *tn, bool amper)
3938 {
3939 	int	dim;
3940 	tnode_t	*ln, *rn;
3941 	int	elsz;
3942 	int64_t	con;
3943 
3944 	ln = tn->tn_left;
3945 	rn = tn->tn_right;
3946 
3947 	/* We can only check constant indices. */
3948 	if (rn->tn_op != CON)
3949 		return;
3950 
3951 	/* Return if the left node does not stem from an array. */
3952 	if (ln->tn_op != ADDR)
3953 		return;
3954 	if (ln->tn_left->tn_op != STRING && ln->tn_left->tn_op != NAME)
3955 		return;
3956 	if (ln->tn_left->tn_type->t_tspec != ARRAY)
3957 		return;
3958 
3959 	/*
3960 	 * For incomplete array types, we can print a warning only if
3961 	 * the index is negative.
3962 	 */
3963 	if (is_incomplete(ln->tn_left->tn_type) && rn->tn_val->v_quad >= 0)
3964 		return;
3965 
3966 	/* Get the size of one array element */
3967 	if ((elsz = length(ln->tn_type->t_subt, NULL)) == 0)
3968 		return;
3969 	elsz /= CHAR_SIZE;
3970 
3971 	/* Change the unit of the index from bytes to element size. */
3972 	if (is_uinteger(rn->tn_type->t_tspec)) {
3973 		con = (uint64_t)rn->tn_val->v_quad / elsz;
3974 	} else {
3975 		con = rn->tn_val->v_quad / elsz;
3976 	}
3977 
3978 	dim = ln->tn_left->tn_type->t_dim + (amper ? 1 : 0);
3979 
3980 	if (!is_uinteger(rn->tn_type->t_tspec) && con < 0) {
3981 		/* array subscript cannot be negative: %ld */
3982 		warning(167, (long)con);
3983 	} else if (dim > 0 && (uint64_t)con >= (uint64_t)dim) {
3984 		/* array subscript cannot be > %d: %ld */
3985 		warning(168, dim - 1, (long)con);
3986 	}
3987 }
3988 
3989 /*
3990  * Check for ordered comparisons of unsigned values with 0.
3991  */
3992 static void
3993 check_integer_comparison(op_t op, tnode_t *ln, tnode_t *rn)
3994 {
3995 	tspec_t	lt, rt;
3996 
3997 	lt = ln->tn_type->t_tspec;
3998 	rt = rn->tn_type->t_tspec;
3999 
4000 	if (ln->tn_op != CON && rn->tn_op != CON)
4001 		return;
4002 
4003 	if (!is_integer(lt) || !is_integer(rt))
4004 		return;
4005 
4006 	if ((hflag || pflag) && lt == CHAR && rn->tn_op == CON &&
4007 	    (rn->tn_val->v_quad < 0 ||
4008 	     rn->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
4009 		/* nonportable character comparison, op %s */
4010 		warning(230, op_name(op));
4011 		return;
4012 	}
4013 	if ((hflag || pflag) && rt == CHAR && ln->tn_op == CON &&
4014 	    (ln->tn_val->v_quad < 0 ||
4015 	     ln->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
4016 		/* nonportable character comparison, op %s */
4017 		warning(230, op_name(op));
4018 		return;
4019 	}
4020 	if (is_uinteger(lt) && !is_uinteger(rt) &&
4021 	    rn->tn_op == CON && rn->tn_val->v_quad <= 0) {
4022 		if (rn->tn_val->v_quad < 0) {
4023 			/* comparison of %s with %s, op %s */
4024 			warning(162, type_name(ln->tn_type),
4025 			    "negative constant", op_name(op));
4026 		} else if (op == LT || op == GE || (hflag && op == LE)) {
4027 			/* comparison of %s with %s, op %s */
4028 			warning(162, type_name(ln->tn_type), "0", op_name(op));
4029 		}
4030 		return;
4031 	}
4032 	if (is_uinteger(rt) && !is_uinteger(lt) &&
4033 	    ln->tn_op == CON && ln->tn_val->v_quad <= 0) {
4034 		if (ln->tn_val->v_quad < 0) {
4035 			/* comparison of %s with %s, op %s */
4036 			warning(162, "negative constant",
4037 			    type_name(rn->tn_type), op_name(op));
4038 		} else if (op == GT || op == LE || (hflag && op == GE)) {
4039 			/* comparison of %s with %s, op %s */
4040 			warning(162, "0", type_name(rn->tn_type), op_name(op));
4041 		}
4042 		return;
4043 	}
4044 }
4045 
4046 /*
4047  * Return whether the expression can be used for static initialization.
4048  *
4049  * Constant initialization expressions must be constant or an address
4050  * of a static object with an optional offset. In the first case,
4051  * the result is returned in *offsp. In the second case, the static
4052  * object is returned in *symp and the offset in *offsp.
4053  *
4054  * The expression can consist of PLUS, MINUS, ADDR, NAME, STRING and
4055  * CON. Type conversions are allowed if they do not change binary
4056  * representation (including width).
4057  */
4058 bool
4059 constant_addr(const tnode_t *tn, const sym_t **symp, ptrdiff_t *offsp)
4060 {
4061 	const sym_t *sym;
4062 	ptrdiff_t offs1, offs2;
4063 	tspec_t	t, ot;
4064 
4065 	switch (tn->tn_op) {
4066 	case MINUS:
4067 		if (tn->tn_right->tn_op == CVT)
4068 			return constant_addr(tn->tn_right, symp, offsp);
4069 		else if (tn->tn_right->tn_op != CON)
4070 			return false;
4071 		/* FALLTHROUGH */
4072 	case PLUS:
4073 		offs1 = offs2 = 0;
4074 		if (tn->tn_left->tn_op == CON) {
4075 			offs1 = (ptrdiff_t)tn->tn_left->tn_val->v_quad;
4076 			if (!constant_addr(tn->tn_right, &sym, &offs2))
4077 				return false;
4078 		} else if (tn->tn_right->tn_op == CON) {
4079 			offs2 = (ptrdiff_t)tn->tn_right->tn_val->v_quad;
4080 			if (tn->tn_op == MINUS)
4081 				offs2 = -offs2;
4082 			if (!constant_addr(tn->tn_left, &sym, &offs1))
4083 				return false;
4084 		} else {
4085 			return false;
4086 		}
4087 		*symp = sym;
4088 		*offsp = offs1 + offs2;
4089 		return true;
4090 	case ADDR:
4091 		if (tn->tn_left->tn_op == NAME) {
4092 			*symp = tn->tn_left->tn_sym;
4093 			*offsp = 0;
4094 			return true;
4095 		} else {
4096 			/*
4097 			 * If this would be the front end of a compiler we
4098 			 * would return a label instead of 0, at least if
4099 			 * 'tn->tn_left->tn_op == STRING'.
4100 			 */
4101 			*symp = NULL;
4102 			*offsp = 0;
4103 			return true;
4104 		}
4105 	case CVT:
4106 		t = tn->tn_type->t_tspec;
4107 		ot = tn->tn_left->tn_type->t_tspec;
4108 		if ((!is_integer(t) && t != PTR) ||
4109 		    (!is_integer(ot) && ot != PTR)) {
4110 			return false;
4111 		}
4112 #ifdef notdef
4113 		/*
4114 		 * consider:
4115 		 *	struct foo {
4116 		 *		unsigned char a;
4117 		 *	} f = {
4118 		 *		(u_char)(u_long)(&(((struct foo *)0)->a))
4119 		 *	};
4120 		 * since psize(u_long) != psize(u_char) this fails.
4121 		 */
4122 		else if (psize(t) != psize(ot))
4123 			return -1;
4124 #endif
4125 		return constant_addr(tn->tn_left, symp, offsp);
4126 	default:
4127 		return false;
4128 	}
4129 }
4130 
4131 /*
4132  * Concatenate two string constants.
4133  */
4134 strg_t *
4135 cat_strings(strg_t *strg1, strg_t *strg2)
4136 {
4137 	size_t	len1, len2, len;
4138 
4139 	if (strg1->st_tspec != strg2->st_tspec) {
4140 		/* cannot concatenate wide and regular string literals */
4141 		error(292);
4142 		return strg1;
4143 	}
4144 
4145 	len1 = strg1->st_len;
4146 	len2 = strg2->st_len + 1;	/* + NUL */
4147 	len = len1 + len2;
4148 
4149 #define COPY(F) \
4150     do { \
4151 	strg1->F = xrealloc(strg1->F, len * sizeof(*strg1->F)); \
4152 	(void)memcpy(strg1->F + len1, strg2->F, len2 * sizeof(*strg1->F)); \
4153 	free(strg2->F); \
4154     } while (/*CONSTCOND*/false)
4155 
4156 	if (strg1->st_tspec == CHAR)
4157 		COPY(st_cp);
4158 	else
4159 		COPY(st_wcp);
4160 
4161 	strg1->st_len = len - 1; /* - NUL */
4162 	free(strg2);
4163 
4164 	return strg1;
4165 }
4166 
4167 static bool
4168 is_confusing_precedence(op_t op, op_t lop, bool lparen, op_t rop, bool rparen)
4169 {
4170 
4171 	if (op == SHL || op == SHR) {
4172 		if (!lparen && (lop == PLUS || lop == MINUS))
4173 			return true;
4174 		if (!rparen && (rop == PLUS || rop == MINUS))
4175 			return true;
4176 		return false;
4177 	}
4178 
4179 	if (op == LOGOR) {
4180 		if (!lparen && lop == LOGAND)
4181 			return true;
4182 		if (!rparen && rop == LOGAND)
4183 			return true;
4184 		return false;
4185 	}
4186 
4187 	lint_assert(op == BITAND || op == BITXOR || op == BITOR);
4188 	if (!lparen && lop != op) {
4189 		if (lop == PLUS || lop == MINUS)
4190 			return true;
4191 		if (lop == BITAND || lop == BITXOR)
4192 			return true;
4193 	}
4194 	if (!rparen && rop != op) {
4195 		if (rop == PLUS || rop == MINUS)
4196 			return true;
4197 		if (rop == BITAND || rop == BITXOR)
4198 			return true;
4199 	}
4200 	return false;
4201 }
4202 
4203 /*
4204  * Print a warning if the given node has operands which should be
4205  * parenthesized.
4206  *
4207  * XXX Does not work if an operand is a constant expression. Constant
4208  * expressions are already folded.
4209  */
4210 static void
4211 check_precedence_confusion(tnode_t *tn)
4212 {
4213 	tnode_t *ln, *rn;
4214 
4215 	if (!hflag)
4216 		return;
4217 
4218 	debug_node(tn, 0);
4219 
4220 	lint_assert(modtab[tn->tn_op].m_binary);
4221 	for (ln = tn->tn_left; ln->tn_op == CVT; ln = ln->tn_left)
4222 		continue;
4223 	for (rn = tn->tn_right; rn->tn_op == CVT; rn = rn->tn_left)
4224 		continue;
4225 
4226 	if (is_confusing_precedence(tn->tn_op,
4227 	    ln->tn_op, ln->tn_parenthesized,
4228 	    rn->tn_op, rn->tn_parenthesized)) {
4229 		/* precedence confusion possible: parenthesize! */
4230 		warning(169);
4231 	}
4232 }
4233