xref: /netbsd-src/usr.bin/xlint/lint1/tree.c (revision e670fd5c413e99c2f6a37901bb21c537fcd322d2)
1 /*	$NetBSD: tree.c,v 1.334 2021/08/14 13:00:55 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: tree.c,v 1.334 2021/08/14 13:00:55 rillig Exp $");
41 #endif
42 
43 #include <float.h>
44 #include <limits.h>
45 #include <math.h>
46 #include <signal.h>
47 #include <stdlib.h>
48 #include <string.h>
49 
50 #include "lint1.h"
51 #include "cgram.h"
52 
53 static	tnode_t	*build_integer_constant(tspec_t, int64_t);
54 static	void	check_pointer_comparison(op_t,
55 					 const tnode_t *, const tnode_t *);
56 static	bool	check_assign_types_compatible(op_t, int,
57 					      const tnode_t *, const tnode_t *);
58 static	void	check_bad_enum_operation(op_t,
59 					 const tnode_t *, const tnode_t *);
60 static	void	check_enum_type_mismatch(op_t, int,
61 				         const tnode_t *, const tnode_t *);
62 static	void	check_enum_int_mismatch(op_t, int,
63 					const tnode_t *, const tnode_t *);
64 static	tnode_t	*new_tnode(op_t, type_t *, tnode_t *, tnode_t *);
65 static	void	balance(op_t, tnode_t **, tnode_t **);
66 static	void	warn_incompatible_types(op_t, const type_t *, tspec_t,
67 					const type_t *, tspec_t);
68 static	void	warn_incompatible_pointers(const mod_t *,
69 					   const type_t *, const type_t *);
70 static	bool	has_constant_member(const type_t *);
71 static	void	check_prototype_conversion(int, tspec_t, tspec_t, type_t *,
72 					   tnode_t *);
73 static	void	check_integer_conversion(op_t, int, tspec_t, tspec_t, type_t *,
74 					 tnode_t *);
75 static	void	check_pointer_integer_conversion(op_t, tspec_t, type_t *,
76 						 tnode_t *);
77 static	void	check_pointer_conversion(tnode_t *, type_t *);
78 static	tnode_t	*build_struct_access(op_t, tnode_t *, tnode_t *);
79 static	tnode_t	*build_prepost_incdec(op_t, tnode_t *);
80 static	tnode_t	*build_real_imag(op_t, tnode_t *);
81 static	tnode_t	*build_address(tnode_t *, bool);
82 static	tnode_t	*build_plus_minus(op_t, tnode_t *, tnode_t *);
83 static	tnode_t	*build_bit_shift(op_t, tnode_t *, tnode_t *);
84 static	tnode_t	*build_colon(tnode_t *, tnode_t *);
85 static	tnode_t	*build_assignment(op_t, tnode_t *, tnode_t *);
86 static	tnode_t	*plength(type_t *);
87 static	tnode_t	*fold(tnode_t *);
88 static	tnode_t	*fold_test(tnode_t *);
89 static	tnode_t	*fold_float(tnode_t *);
90 static	tnode_t	*check_function_arguments(type_t *, tnode_t *);
91 static	tnode_t	*check_prototype_argument(int, type_t *, tnode_t *);
92 static	void	check_null_effect(const tnode_t *);
93 static	void	check_array_index(tnode_t *, bool);
94 static	void	check_integer_comparison(op_t, tnode_t *, tnode_t *);
95 static	void	check_precedence_confusion(tnode_t *);
96 
97 extern sig_atomic_t fpe;
98 
99 static const char *
100 op_name(op_t op)
101 {
102 	return modtab[op].m_name;
103 }
104 
105 /* Build 'pointer to tp', 'array of tp' or 'function returning tp'. */
106 type_t *
107 derive_type(type_t *tp, tspec_t t)
108 {
109 	type_t	*tp2;
110 
111 	tp2 = getblk(sizeof(*tp2));
112 	tp2->t_tspec = t;
113 	tp2->t_subt = tp;
114 	return tp2;
115 }
116 
117 /*
118  * Build 'pointer to tp', 'array of tp' or 'function returning tp'.  The
119  * memory is freed at the end of the current expression.
120  */
121 type_t *
122 expr_derive_type(type_t *tp, tspec_t t)
123 {
124 	type_t	*tp2;
125 
126 	tp2 = expr_zalloc(sizeof(*tp2));
127 	tp2->t_tspec = t;
128 	tp2->t_subt = tp;
129 	return tp2;
130 }
131 
132 /*
133  * Create a node for a constant.
134  */
135 tnode_t *
136 build_constant(type_t *tp, val_t *v)
137 {
138 	tnode_t	*n;
139 
140 	n = expr_zalloc_tnode();
141 	n->tn_op = CON;
142 	n->tn_type = tp;
143 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
144 	n->tn_val->v_tspec = tp->t_tspec;
145 	n->tn_val->v_unsigned_since_c90 = v->v_unsigned_since_c90;
146 	n->tn_val->v_u = v->v_u;
147 	free(v);
148 	return n;
149 }
150 
151 static tnode_t *
152 build_integer_constant(tspec_t t, int64_t q)
153 {
154 	tnode_t	*n;
155 
156 	n = expr_zalloc_tnode();
157 	n->tn_op = CON;
158 	n->tn_type = gettyp(t);
159 	n->tn_val = expr_zalloc(sizeof(*n->tn_val));
160 	n->tn_val->v_tspec = t;
161 	n->tn_val->v_quad = q;
162 	return n;
163 }
164 
165 static void
166 fallback_symbol(sym_t *sym)
167 {
168 
169 	if (fallback_symbol_strict_bool(sym))
170 		return;
171 
172 	if (block_level > 0 && (strcmp(sym->s_name, "__FUNCTION__") == 0 ||
173 			   strcmp(sym->s_name, "__PRETTY_FUNCTION__") == 0)) {
174 		/* __FUNCTION__/__PRETTY_FUNCTION__ is a GCC extension */
175 		gnuism(316);
176 		sym->s_type = derive_type(gettyp(CHAR), PTR);
177 		sym->s_type->t_const = true;
178 		return;
179 	}
180 
181 	if (block_level > 0 && strcmp(sym->s_name, "__func__") == 0) {
182 		if (!Sflag)
183 			/* __func__ is a C9X feature */
184 			warning(317);
185 		sym->s_type = derive_type(gettyp(CHAR), PTR);
186 		sym->s_type->t_const = true;
187 		return;
188 	}
189 
190 	/* '%s' undefined */
191 	error(99, sym->s_name);
192 }
193 
194 /* https://gcc.gnu.org/onlinedocs/gcc/C-Extensions.html */
195 static bool
196 is_gcc_builtin(const char *name)
197 {
198 	return strncmp(name, "__atomic_", 9) == 0 ||
199 	       strncmp(name, "__builtin_", 10) == 0;
200 }
201 
202 /*
203  * Create a node for a name (symbol table entry).
204  * follow_token is the token which follows the name.
205  */
206 tnode_t *
207 build_name(sym_t *sym, int follow_token)
208 {
209 	tnode_t	*n;
210 
211 	if (sym->s_scl == NOSCL) {
212 		sym->s_scl = EXTERN;
213 		sym->s_def = DECL;
214 		if (follow_token == T_LPAREN) {
215 			if (gflag && is_gcc_builtin(sym->s_name)) {
216 				/*
217 				 * Do not warn about these, just assume that
218 				 * they are regular functions compatible with
219 				 * non-prototype calling conventions.
220 				 */
221 			} else if (Sflag) {
222 				/* function '%s' implicitly declared to ... */
223 				warning(215, sym->s_name);
224 			} else if (sflag) {
225 				/* function '%s' implicitly declared to ... */
226 				warning(215, sym->s_name);
227 			}
228 			/*
229 			 * XXX if tflag is set the symbol should be
230 			 * exported to level 0
231 			 */
232 			sym->s_type = derive_type(sym->s_type, FUNC);
233 		} else {
234 			fallback_symbol(sym);
235 		}
236 	}
237 
238 	lint_assert(sym->s_kind == FVFT || sym->s_kind == FMEMBER);
239 
240 	n = expr_zalloc_tnode();
241 	n->tn_type = sym->s_type;
242 	if (sym->s_scl != CTCONST) {
243 		n->tn_op = NAME;
244 		n->tn_sym = sym;
245 		if (sym->s_kind == FVFT && sym->s_type->t_tspec != FUNC)
246 			n->tn_lvalue = true;
247 	} else {
248 		n->tn_op = CON;
249 		n->tn_val = expr_zalloc(sizeof(*n->tn_val));
250 		*n->tn_val = sym->s_value;
251 	}
252 
253 	return n;
254 }
255 
256 tnode_t *
257 build_string(strg_t *strg)
258 {
259 	size_t	len;
260 	tnode_t	*n;
261 
262 	len = strg->st_len;
263 
264 	n = expr_zalloc_tnode();
265 
266 	n->tn_op = STRING;
267 	n->tn_type = expr_derive_type(gettyp(strg->st_tspec), ARRAY);
268 	n->tn_type->t_dim = len + 1;
269 	n->tn_lvalue = true;
270 
271 	n->tn_string = expr_zalloc(sizeof(*n->tn_string));
272 	n->tn_string->st_tspec = strg->st_tspec;
273 	n->tn_string->st_len = len;
274 
275 	if (strg->st_tspec == CHAR) {
276 		n->tn_string->st_cp = expr_zalloc(len + 1);
277 		(void)memcpy(n->tn_string->st_cp, strg->st_cp, len + 1);
278 		free(strg->st_cp);
279 	} else {
280 		size_t size = (len + 1) * sizeof(*n->tn_string->st_wcp);
281 		n->tn_string->st_wcp = expr_zalloc(size);
282 		(void)memcpy(n->tn_string->st_wcp, strg->st_wcp, size);
283 		free(strg->st_wcp);
284 	}
285 	free(strg);
286 
287 	return n;
288 }
289 
290 /*
291  * Returns a symbol which has the same name as the msym argument and is a
292  * member of the struct or union specified by the tn argument.
293  */
294 sym_t *
295 struct_or_union_member(tnode_t *tn, op_t op, sym_t *msym)
296 {
297 	struct_or_union	*str;
298 	type_t	*tp;
299 	sym_t	*sym, *csym;
300 	bool	eq;
301 	tspec_t	t;
302 
303 	/*
304 	 * Remove the member if it was unknown until now, which means
305 	 * that no defined struct or union has a member with the same name.
306 	 */
307 	if (msym->s_scl == NOSCL) {
308 		/* type '%s' does not have member '%s' */
309 		error(101, type_name(tn->tn_type), msym->s_name);
310 		rmsym(msym);
311 		msym->s_kind = FMEMBER;
312 		msym->s_scl = MOS;
313 		msym->s_styp = expr_zalloc(sizeof(*msym->s_styp));
314 		msym->s_styp->sou_tag = expr_zalloc(
315 		    sizeof(*msym->s_styp->sou_tag));
316 		msym->s_styp->sou_tag->s_name = unnamed;
317 		msym->s_value.v_tspec = INT;
318 		return msym;
319 	}
320 
321 	/* Set str to the tag of which msym is expected to be a member. */
322 	str = NULL;
323 	t = (tp = tn->tn_type)->t_tspec;
324 	if (op == POINT) {
325 		if (t == STRUCT || t == UNION)
326 			str = tp->t_str;
327 	} else if (op == ARROW && t == PTR) {
328 		t = (tp = tp->t_subt)->t_tspec;
329 		if (t == STRUCT || t == UNION)
330 			str = tp->t_str;
331 	}
332 
333 	/*
334 	 * If this struct/union has a member with the name of msym, return it.
335 	 */
336 	if (str != NULL) {
337 		for (sym = msym; sym != NULL; sym = sym->s_link) {
338 			if (sym->s_scl != MOS && sym->s_scl != MOU)
339 				continue;
340 			if (sym->s_styp != str)
341 				continue;
342 			if (strcmp(sym->s_name, msym->s_name) != 0)
343 				continue;
344 			return sym;
345 		}
346 	}
347 
348 	/*
349 	 * Set eq to false if there are struct/union members with the same
350 	 * name and different types and/or offsets.
351 	 */
352 	eq = true;
353 	for (csym = msym; csym != NULL; csym = csym->s_link) {
354 		if (csym->s_scl != MOS && csym->s_scl != MOU)
355 			continue;
356 		if (strcmp(msym->s_name, csym->s_name) != 0)
357 			continue;
358 		for (sym = csym->s_link ; sym != NULL; sym = sym->s_link) {
359 			bool w;
360 
361 			if (sym->s_scl != MOS && sym->s_scl != MOU)
362 				continue;
363 			if (strcmp(csym->s_name, sym->s_name) != 0)
364 				continue;
365 			if (csym->s_value.v_quad != sym->s_value.v_quad) {
366 				eq = false;
367 				break;
368 			}
369 			w = false;
370 			eq = eqtype(csym->s_type, sym->s_type,
371 			    false, false, &w) && !w;
372 			if (!eq)
373 				break;
374 			if (csym->s_bitfield != sym->s_bitfield) {
375 				eq = false;
376 				break;
377 			}
378 			if (csym->s_bitfield) {
379 				type_t	*tp1, *tp2;
380 
381 				tp1 = csym->s_type;
382 				tp2 = sym->s_type;
383 				if (tp1->t_flen != tp2->t_flen) {
384 					eq = false;
385 					break;
386 				}
387 				if (tp1->t_foffs != tp2->t_foffs) {
388 					eq = false;
389 					break;
390 				}
391 			}
392 		}
393 		if (!eq)
394 			break;
395 	}
396 
397 	/*
398 	 * Now handle the case in which the left operand refers really
399 	 * to a struct/union, but the right operand is not member of it.
400 	 */
401 	if (str != NULL) {
402 		if (eq && tflag) {
403 			/* illegal member use: %s */
404 			warning(102, msym->s_name);
405 		} else {
406 			/* illegal member use: %s */
407 			error(102, msym->s_name);
408 		}
409 		return msym;
410 	}
411 
412 	/*
413 	 * Now the left operand of ARROW does not point to a struct/union
414 	 * or the left operand of POINT is no struct/union.
415 	 */
416 	if (eq) {
417 		if (op == POINT) {
418 			if (tflag) {
419 				/* left operand of '.' must be struct ... */
420 				warning(103, type_name(tn->tn_type));
421 			} else {
422 				/* left operand of '.' must be struct ... */
423 				error(103, type_name(tn->tn_type));
424 			}
425 		} else {
426 			if (tflag && tn->tn_type->t_tspec == PTR) {
427 				/* left operand of '->' must be pointer ... */
428 				warning(104, type_name(tn->tn_type));
429 			} else {
430 				/* left operand of '->' must be pointer ... */
431 				error(104, type_name(tn->tn_type));
432 			}
433 		}
434 	} else {
435 		if (tflag) {
436 			/* non-unique member requires struct/union %s */
437 			error(105, op == POINT ? "object" : "pointer");
438 		} else {
439 			/* unacceptable operand of '%s' */
440 			error(111, op_name(op));
441 		}
442 	}
443 
444 	return msym;
445 }
446 
447 tnode_t *
448 build_generic_selection(const tnode_t *expr,
449 			struct generic_association *sel)
450 {
451 	tnode_t *default_result = NULL;
452 
453 	for (; sel != NULL; sel = sel->ga_prev)
454 		if (expr != NULL &&
455 		    eqtype(sel->ga_arg, expr->tn_type, false, false, NULL))
456 			return sel->ga_result;
457 		else if (sel->ga_arg == NULL)
458 			default_result = sel->ga_result;
459 	return default_result;
460 }
461 
462 /*
463  * Create a tree node. Called for most operands except function calls,
464  * sizeof and casts.
465  *
466  * op	operator
467  * ln	left operand
468  * rn	if not NULL, right operand
469  */
470 tnode_t *
471 build_binary(tnode_t *ln, op_t op, tnode_t *rn)
472 {
473 	const mod_t *mp;
474 	tnode_t	*ntn;
475 	type_t	*rettp;
476 
477 	mp = &modtab[op];
478 
479 	/* If there was an error in one of the operands, return. */
480 	if (ln == NULL || (mp->m_binary && rn == NULL))
481 		return NULL;
482 
483 	/*
484 	 * Apply class conversions to the left operand, but only if its
485 	 * value is needed or it is compared with null.
486 	 */
487 	if (mp->m_left_value_context || mp->m_left_test_context)
488 		ln = cconv(ln);
489 	/*
490 	 * The right operand is almost always in a test or value context,
491 	 * except if it is a struct or union member.
492 	 */
493 	if (mp->m_binary && op != ARROW && op != POINT)
494 		rn = cconv(rn);
495 
496 	/*
497 	 * Print some warnings for comparisons of unsigned values with
498 	 * constants lower than or equal to null. This must be done
499 	 * before promote() because otherwise unsigned char and unsigned
500 	 * short would be promoted to int. Also types are tested to be
501 	 * CHAR, which would also become int.
502 	 */
503 	if (mp->m_comparison)
504 		check_integer_comparison(op, ln, rn);
505 
506 	/*
507 	 * Promote the left operand if it is in a test or value context
508 	 */
509 	if (mp->m_left_value_context || mp->m_left_test_context)
510 		ln = promote(op, false, ln);
511 	/*
512 	 * Promote the right operand, but only if it is no struct or
513 	 * union member, or if it is not to be assigned to the left operand
514 	 */
515 	if (mp->m_binary && op != ARROW && op != POINT &&
516 	    op != ASSIGN && op != RETURN && op != INIT) {
517 		rn = promote(op, false, rn);
518 	}
519 
520 	/*
521 	 * If the result of the operation is different for signed or
522 	 * unsigned operands and one of the operands is signed only in
523 	 * ANSI C, print a warning.
524 	 */
525 	if (mp->m_warn_if_left_unsigned_in_c90 &&
526 	    ln->tn_op == CON && ln->tn_val->v_unsigned_since_c90) {
527 		/* ANSI C treats constant as unsigned, op %s */
528 		warning(218, mp->m_name);
529 		ln->tn_val->v_unsigned_since_c90 = false;
530 	}
531 	if (mp->m_warn_if_right_unsigned_in_c90 &&
532 	    rn->tn_op == CON && rn->tn_val->v_unsigned_since_c90) {
533 		/* ANSI C treats constant as unsigned, op %s */
534 		warning(218, mp->m_name);
535 		rn->tn_val->v_unsigned_since_c90 = false;
536 	}
537 
538 	/* Make sure both operands are of the same type */
539 	if (mp->m_balance_operands || (tflag && (op == SHL || op == SHR)))
540 		balance(op, &ln, &rn);
541 
542 	/*
543 	 * Check types for compatibility with the operation and mutual
544 	 * compatibility. Return if there are serious problems.
545 	 */
546 	if (!typeok(op, 0, ln, rn))
547 		return NULL;
548 
549 	/* And now create the node. */
550 	switch (op) {
551 	case POINT:
552 	case ARROW:
553 		ntn = build_struct_access(op, ln, rn);
554 		break;
555 	case INCAFT:
556 	case DECAFT:
557 	case INCBEF:
558 	case DECBEF:
559 		ntn = build_prepost_incdec(op, ln);
560 		break;
561 	case ADDR:
562 		ntn = build_address(ln, false);
563 		break;
564 	case INDIR:
565 		ntn = new_tnode(INDIR, ln->tn_type->t_subt, ln, NULL);
566 		break;
567 	case PLUS:
568 	case MINUS:
569 		ntn = build_plus_minus(op, ln, rn);
570 		break;
571 	case SHL:
572 	case SHR:
573 		ntn = build_bit_shift(op, ln, rn);
574 		break;
575 	case COLON:
576 		ntn = build_colon(ln, rn);
577 		break;
578 	case ASSIGN:
579 	case MULASS:
580 	case DIVASS:
581 	case MODASS:
582 	case ADDASS:
583 	case SUBASS:
584 	case SHLASS:
585 	case SHRASS:
586 	case ANDASS:
587 	case XORASS:
588 	case ORASS:
589 	case RETURN:
590 	case INIT:
591 		ntn = build_assignment(op, ln, rn);
592 		break;
593 	case COMMA:
594 	case QUEST:
595 		ntn = new_tnode(op, rn->tn_type, ln, rn);
596 		break;
597 	case REAL:
598 	case IMAG:
599 		ntn = build_real_imag(op, ln);
600 		break;
601 	default:
602 		rettp = mp->m_returns_bool
603 		    ? gettyp(Tflag ? BOOL : INT) : ln->tn_type;
604 		lint_assert(mp->m_binary || rn == NULL);
605 		ntn = new_tnode(op, rettp, ln, rn);
606 		break;
607 	}
608 
609 	/* Return if an error occurred. */
610 	if (ntn == NULL)
611 		return NULL;
612 
613 	/* Print a warning if precedence confusion is possible */
614 	if (mp->m_possible_precedence_confusion)
615 		check_precedence_confusion(ntn);
616 
617 	/*
618 	 * Print a warning if one of the operands is in a context where
619 	 * it is compared with null and if this operand is a constant.
620 	 */
621 	if (mp->m_left_test_context) {
622 		if (ln->tn_op == CON ||
623 		    ((mp->m_binary && op != QUEST) && rn->tn_op == CON)) {
624 			if (hflag && !constcond_flag &&
625 			    !ln->tn_system_dependent)
626 				/* constant in conditional context */
627 				warning(161);
628 		}
629 	}
630 
631 	/* Fold if the operator requires it */
632 	if (mp->m_fold_constant_operands) {
633 		if (ln->tn_op == CON && (!mp->m_binary || rn->tn_op == CON)) {
634 			if (mp->m_left_test_context) {
635 				ntn = fold_test(ntn);
636 			} else if (is_floating(ntn->tn_type->t_tspec)) {
637 				ntn = fold_float(ntn);
638 			} else {
639 				ntn = fold(ntn);
640 			}
641 		} else if (op == QUEST && ln->tn_op == CON) {
642 			ntn = ln->tn_val->v_quad != 0
643 			    ? rn->tn_left : rn->tn_right;
644 		}
645 	}
646 
647 	return ntn;
648 }
649 
650 tnode_t *
651 build_unary(op_t op, tnode_t *tn)
652 {
653 	return build_binary(tn, op, NULL);
654 }
655 
656 tnode_t *
657 build_member_access(tnode_t *ln, op_t op, sbuf_t *member)
658 {
659 	sym_t	*msym;
660 
661 	if (ln == NULL)
662 		return NULL;
663 
664 	if (op == ARROW) {
665 		/* must do this before struct_or_union_member is called */
666 		ln = cconv(ln);
667 	}
668 	msym = struct_or_union_member(ln, op, getsym(member));
669 	return build_binary(ln, op, build_name(msym, 0));
670 }
671 
672 /*
673  * Perform class conversions.
674  *
675  * Arrays of type T are converted into pointers to type T.
676  * Functions are converted to pointers to functions.
677  * Lvalues are converted to rvalues.
678  *
679  * C99 6.3 "Conversions"
680  * C99 6.3.2 "Other operands"
681  * C99 6.3.2.1 "Lvalues, arrays, and function designators"
682  */
683 tnode_t *
684 cconv(tnode_t *tn)
685 {
686 	type_t	*tp;
687 
688 	/*
689 	 * Array-lvalue (array of type T) is converted into rvalue
690 	 * (pointer to type T)
691 	 */
692 	if (tn->tn_type->t_tspec == ARRAY) {
693 		if (!tn->tn_lvalue) {
694 			/* XXX print correct operator */
695 			/* %soperand of '%s' must be lvalue */
696 			gnuism(114, "", op_name(ADDR));
697 		}
698 		tn = new_tnode(ADDR,
699 		    expr_derive_type(tn->tn_type->t_subt, PTR), tn, NULL);
700 	}
701 
702 	/*
703 	 * Expression of type function (function with return value of type T)
704 	 * in rvalue-expression (pointer to function with return value
705 	 * of type T)
706 	 */
707 	if (tn->tn_type->t_tspec == FUNC)
708 		tn = build_address(tn, true);
709 
710 	/* lvalue to rvalue */
711 	if (tn->tn_lvalue) {
712 		tp = expr_dup_type(tn->tn_type);
713 		/* C99 6.3.2.1p2 sentence 2 says to remove the qualifiers. */
714 		tp->t_const = tp->t_volatile = false;
715 		tn = new_tnode(LOAD, tp, tn, NULL);
716 	}
717 
718 	return tn;
719 }
720 
721 const tnode_t *
722 before_conversion(const tnode_t *tn)
723 {
724 	while (tn->tn_op == CVT && !tn->tn_cast)
725 		tn = tn->tn_left;
726 	return tn;
727 }
728 
729 static bool
730 is_null_pointer(const tnode_t *tn)
731 {
732 	tspec_t t = tn->tn_type->t_tspec;
733 
734 	return ((t == PTR && tn->tn_type->t_subt->t_tspec == VOID) ||
735 		is_integer(t))
736 	       && (tn->tn_op == CON && tn->tn_val->v_quad == 0);
737 }
738 
739 static bool
740 typeok_incdec(op_t op, const tnode_t *tn, const type_t *tp)
741 {
742 	/* operand has scalar type (checked in typeok) */
743 	if (!tn->tn_lvalue) {
744 		if (tn->tn_op == CVT && tn->tn_cast &&
745 		    tn->tn_left->tn_op == LOAD) {
746 			/* a cast does not yield an lvalue */
747 			error(163);
748 		}
749 		/* %soperand of '%s' must be lvalue */
750 		error(114, "", op_name(op));
751 		return false;
752 	} else if (tp->t_const) {
753 		if (!tflag)
754 			/* %soperand of '%s' must be modifiable lvalue */
755 			warning(115, "", op_name(op));
756 	}
757 	return true;
758 }
759 
760 static bool
761 typeok_address(const mod_t *mp,
762 	    const tnode_t *tn, const type_t *tp, tspec_t t)
763 {
764 	if (t == ARRAY || t == FUNC) {
765 		/* ok, a warning comes later (in build_address()) */
766 	} else if (!tn->tn_lvalue) {
767 		if (tn->tn_op == CVT && tn->tn_cast &&
768 		    tn->tn_left->tn_op == LOAD) {
769 			/* a cast does not yield an lvalue */
770 			error(163);
771 		}
772 		/* %soperand of '%s' must be lvalue */
773 		error(114, "", mp->m_name);
774 		return false;
775 	} else if (is_scalar(t)) {
776 		if (tp->t_bitfield) {
777 			/* cannot take address of bit-field */
778 			error(112);
779 			return false;
780 		}
781 	} else if (t != STRUCT && t != UNION) {
782 		/* unacceptable operand of '%s' */
783 		error(111, mp->m_name);
784 		return false;
785 	}
786 	if (tn->tn_op == NAME && tn->tn_sym->s_reg) {
787 		/* cannot take address of register %s */
788 		error(113, tn->tn_sym->s_name);
789 		return false;
790 	}
791 	return true;
792 }
793 
794 static bool
795 typeok_star(tspec_t t)
796 {
797 	/* until now there were no type checks for this operator */
798 	if (t != PTR) {
799 		/* cannot dereference non-pointer type */
800 		error(96);
801 		return false;
802 	}
803 	return true;
804 }
805 
806 static bool
807 typeok_plus(op_t op,
808 	    const type_t *ltp, tspec_t lt,
809 	    const type_t *rtp, tspec_t rt)
810 {
811 	/* operands have scalar types (checked above) */
812 	if ((lt == PTR && !is_integer(rt)) || (rt == PTR && !is_integer(lt))) {
813 		warn_incompatible_types(op, ltp, lt, rtp, rt);
814 		return false;
815 	}
816 	return true;
817 }
818 
819 static bool
820 typeok_minus(op_t op,
821 	     const type_t *ltp, tspec_t lt,
822 	     const type_t *rtp, tspec_t rt)
823 {
824 	/* operands have scalar types (checked above) */
825 	if (lt == PTR && (!is_integer(rt) && rt != PTR)) {
826 		warn_incompatible_types(op, ltp, lt, rtp, rt);
827 		return false;
828 	} else if (rt == PTR && lt != PTR) {
829 		warn_incompatible_types(op, ltp, lt, rtp, rt);
830 		return false;
831 	}
832 	if (lt == PTR && rt == PTR) {
833 		if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
834 			/* illegal pointer subtraction */
835 			error(116);
836 		}
837 	}
838 	return true;
839 }
840 
841 static void
842 typeok_shr(const mod_t *mp,
843 	   const tnode_t *ln, tspec_t lt,
844 	   const tnode_t *rn, tspec_t rt)
845 {
846 	tspec_t olt, ort;
847 
848 	olt = before_conversion(ln)->tn_type->t_tspec;
849 	ort = before_conversion(rn)->tn_type->t_tspec;
850 
851 	/* operands have integer types (checked above) */
852 	if (pflag && !is_uinteger(lt)) {
853 		/*
854 		 * The left operand is signed. This means that
855 		 * the operation is (possibly) nonportable.
856 		 */
857 		if (ln->tn_op != CON) {
858 			/* bitwise '%s' on signed value possibly nonportable */
859 			warning(117, mp->m_name);
860 		} else if (ln->tn_val->v_quad < 0) {
861 			/* bitwise '%s' on signed value nonportable */
862 			warning(120, mp->m_name);
863 		}
864 	} else if (!tflag && !sflag && !is_uinteger(olt) && is_uinteger(ort)) {
865 		/*
866 		 * The left operand would become unsigned in
867 		 * traditional C.
868 		 */
869 		if (hflag && !Sflag &&
870 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
871 			/* semantics of '%s' change in ANSI C; use ... */
872 			warning(118, mp->m_name);
873 		}
874 	} else if (!tflag && !sflag && !is_uinteger(olt) && !is_uinteger(ort) &&
875 		   portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
876 		/*
877 		 * In traditional C the left operand would be extended,
878 		 * possibly with 1, and then shifted.
879 		 */
880 		if (hflag && !Sflag &&
881 		    (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
882 			/* semantics of '%s' change in ANSI C; use ... */
883 			warning(118, mp->m_name);
884 		}
885 	}
886 }
887 
888 static void
889 typeok_shl(const mod_t *mp, tspec_t lt, tspec_t rt)
890 {
891 	/*
892 	 * C90 does not perform balancing for shift operations,
893 	 * but traditional C does. If the width of the right operand
894 	 * is greater than the width of the left operand, then in
895 	 * traditional C the left operand would be extended to the
896 	 * width of the right operand. For SHL this may result in
897 	 * different results.
898 	 */
899 	if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
900 		/*
901 		 * XXX If both operands are constant, make sure
902 		 * that there is really a difference between
903 		 * ANSI C and traditional C.
904 		 */
905 		if (hflag && !Sflag)
906 			/* semantics of '%s' change in ANSI C; use ... */
907 			warning(118, mp->m_name);
908 	}
909 }
910 
911 static void
912 typeok_shift(tspec_t lt, const tnode_t *rn, tspec_t rt)
913 {
914 	if (rn->tn_op != CON)
915 		return;
916 
917 	if (!is_uinteger(rt) && rn->tn_val->v_quad < 0) {
918 		/* negative shift */
919 		warning(121);
920 	} else if ((uint64_t)rn->tn_val->v_quad ==
921 		   (uint64_t)size_in_bits(lt)) {
922 		/* shift equal to size of object */
923 		warning(267);
924 	} else if ((uint64_t)rn->tn_val->v_quad > (uint64_t)size_in_bits(lt)) {
925 		/* shift amount %llu is greater than bit-size %llu of '%s' */
926 		warning(122, (unsigned long long)rn->tn_val->v_quad,
927 		    (unsigned long long)size_in_bits(lt),
928 		    tspec_name(lt));
929 	}
930 }
931 
932 static bool
933 is_typeok_eq(const tnode_t *ln, tspec_t lt, const tnode_t *rn, tspec_t rt)
934 {
935 	if (lt == PTR && is_null_pointer(rn))
936 		return true;
937 	if (rt == PTR && is_null_pointer(ln))
938 		return true;
939 	return false;
940 }
941 
942 static bool
943 typeok_ordered_comparison(op_t op,
944 			  const tnode_t *ln, const type_t *ltp, tspec_t lt,
945 			  const tnode_t *rn, const type_t *rtp, tspec_t rt)
946 {
947 	if (lt == PTR && rt == PTR) {
948 		check_pointer_comparison(op, ln, rn);
949 		return true;
950 	}
951 
952 	if (lt != PTR && rt != PTR)
953 		return true;
954 
955 	if (!is_integer(lt) && !is_integer(rt)) {
956 		warn_incompatible_types(op, ltp, lt, rtp, rt);
957 		return false;
958 	}
959 
960 	const char *lx = lt == PTR ? "pointer" : "integer";
961 	const char *rx = rt == PTR ? "pointer" : "integer";
962 	/* illegal combination of %s (%s) and %s (%s), op %s */
963 	warning(123, lx, type_name(ltp), rx, type_name(rtp), op_name(op));
964 	return true;
965 }
966 
967 static bool
968 typeok_quest(tspec_t lt, const tnode_t **rn)
969 {
970 	if (!is_scalar(lt)) {
971 		/* first operand must have scalar type, op ? : */
972 		error(170);
973 		return false;
974 	}
975 	while ((*rn)->tn_op == CVT)
976 		*rn = (*rn)->tn_left;
977 	lint_assert((*rn)->tn_op == COLON);
978 	return true;
979 }
980 
981 static void
982 typeok_colon_pointer(const mod_t *mp, const type_t *ltp, const type_t *rtp)
983 {
984 	type_t *lstp = ltp->t_subt;
985 	type_t *rstp = rtp->t_subt;
986 	tspec_t lst = lstp->t_tspec;
987 	tspec_t rst = rstp->t_tspec;
988 
989 	if ((lst == VOID && rst == FUNC) || (lst == FUNC && rst == VOID)) {
990 		/* (void *)0 handled above */
991 		if (sflag)
992 			/* ANSI C forbids conv. of %s to %s, op %s */
993 			warning(305, "function pointer", "'void *'",
994 			    mp->m_name);
995 		return;
996 	}
997 
998 	if (eqptrtype(lstp, rstp, true))
999 		return;
1000 	if (!eqtype(lstp, rstp, true, false, NULL))
1001 		warn_incompatible_pointers(mp, ltp, rtp);
1002 }
1003 
1004 static bool
1005 typeok_colon(const mod_t *mp,
1006 	     const tnode_t *ln, const type_t *ltp, tspec_t lt,
1007 	     const tnode_t *rn, const type_t *rtp, tspec_t rt)
1008 {
1009 
1010 	if (is_arithmetic(lt) && is_arithmetic(rt))
1011 		return true;
1012 	if (lt == BOOL && rt == BOOL)
1013 		return true;
1014 
1015 	if (lt == STRUCT && rt == STRUCT && ltp->t_str == rtp->t_str)
1016 		return true;
1017 	if (lt == UNION && rt == UNION && ltp->t_str == rtp->t_str)
1018 		return true;
1019 
1020 	if (lt == PTR && is_null_pointer(rn))
1021 		return true;
1022 	if (rt == PTR && is_null_pointer(ln))
1023 		return true;
1024 
1025 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1026 		const char *lx = lt == PTR ?  "pointer" : "integer";
1027 		const char *rx = rt == PTR ?  "pointer" : "integer";
1028 		/* illegal combination of %s (%s) and %s (%s), op %s */
1029 		warning(123, lx, type_name(ltp),
1030 		    rx, type_name(rtp), mp->m_name);
1031 		return true;
1032 	}
1033 
1034 	if (lt == VOID || rt == VOID) {
1035 		if (lt != VOID || rt != VOID)
1036 			/* incompatible types '%s' and '%s' in conditional */
1037 			warning(126, type_name(ltp), type_name(rtp));
1038 		return true;
1039 	}
1040 
1041 	if (lt == PTR && rt == PTR) {
1042 		typeok_colon_pointer(mp, ltp, rtp);
1043 		return true;
1044 	}
1045 
1046 	/* incompatible types '%s' and '%s' in conditional */
1047 	error(126, type_name(ltp), type_name(rtp));
1048 	return false;
1049 }
1050 
1051 static bool
1052 typeok_assign(op_t op, const tnode_t *ln, const type_t *ltp, tspec_t lt)
1053 {
1054 	if (op == RETURN || op == INIT || op == FARG)
1055 		return true;
1056 
1057 	if (!ln->tn_lvalue) {
1058 		if (ln->tn_op == CVT && ln->tn_cast &&
1059 		    ln->tn_left->tn_op == LOAD) {
1060 			/* a cast does not yield an lvalue */
1061 			error(163);
1062 		}
1063 		/* %soperand of '%s' must be lvalue */
1064 		error(114, "left ", op_name(op));
1065 		return false;
1066 	} else if (ltp->t_const || ((lt == STRUCT || lt == UNION) &&
1067 				    has_constant_member(ltp))) {
1068 		if (!tflag)
1069 			/* %soperand of '%s' must be modifiable lvalue */
1070 			warning(115, "left ", op_name(op));
1071 	}
1072 	return true;
1073 }
1074 
1075 /* Check the types using the information from modtab[]. */
1076 static bool
1077 typeok_scalar(op_t op, const mod_t *mp,
1078 	      const type_t *ltp, tspec_t lt,
1079 	      const type_t *rtp, tspec_t rt)
1080 {
1081 	if (mp->m_takes_bool && lt == BOOL && rt == BOOL)
1082 		return true;
1083 	if (mp->m_requires_integer) {
1084 		if (!is_integer(lt) || (mp->m_binary && !is_integer(rt))) {
1085 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1086 			return false;
1087 		}
1088 	} else if (mp->m_requires_integer_or_complex) {
1089 		if ((!is_integer(lt) && !is_complex(lt)) ||
1090 		    (mp->m_binary && (!is_integer(rt) && !is_complex(rt)))) {
1091 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1092 			return false;
1093 		}
1094 	} else if (mp->m_requires_scalar) {
1095 		if (!is_scalar(lt) || (mp->m_binary && !is_scalar(rt))) {
1096 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1097 			return false;
1098 		}
1099 	} else if (mp->m_requires_arith) {
1100 		if (!is_arithmetic(lt) ||
1101 		    (mp->m_binary && !is_arithmetic(rt))) {
1102 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1103 			return false;
1104 		}
1105 	}
1106 	return true;
1107 }
1108 
1109 /* Check the types for specific operators and type combinations. */
1110 static bool
1111 typeok_op(op_t op, const mod_t *mp, int arg,
1112 	  const tnode_t *ln, const type_t *ltp, tspec_t lt,
1113 	  const tnode_t *rn, const type_t *rtp, tspec_t rt)
1114 {
1115 	switch (op) {
1116 	case POINT:
1117 		/*
1118 		 * Most errors required by ANSI C are reported in
1119 		 * struct_or_union_member().
1120 		 * Here we only must check for totally wrong things.
1121 		 */
1122 		if (lt == FUNC || lt == VOID || ltp->t_bitfield ||
1123 		    ((lt != STRUCT && lt != UNION) && !ln->tn_lvalue)) {
1124 			/* Without tflag we got already an error */
1125 			if (tflag)
1126 				/* unacceptable operand of '%s' */
1127 				error(111, mp->m_name);
1128 			return false;
1129 		}
1130 		/* Now we have an object we can create a pointer to */
1131 		break;
1132 	case ARROW:
1133 		if (lt != PTR && !(tflag && is_integer(lt))) {
1134 			/* Without tflag we got already an error */
1135 			if (tflag)
1136 				/* unacceptable operand of '%s' */
1137 				error(111, mp->m_name);
1138 			return false;
1139 		}
1140 		break;
1141 	case INCAFT:
1142 	case DECAFT:
1143 	case INCBEF:
1144 	case DECBEF:
1145 		if (!typeok_incdec(op, ln, ltp))
1146 			return false;
1147 		break;
1148 	case ADDR:
1149 		if (!typeok_address(mp, ln, ltp, lt))
1150 			return false;
1151 		break;
1152 	case INDIR:
1153 		if (!typeok_star(lt))
1154 			return false;
1155 		break;
1156 	case PLUS:
1157 		if (!typeok_plus(op, ltp, lt, rtp, rt))
1158 			return false;
1159 		break;
1160 	case MINUS:
1161 		if (!typeok_minus(op, ltp, lt, rtp, rt))
1162 			return false;
1163 		break;
1164 	case SHR:
1165 		typeok_shr(mp, ln, lt, rn, rt);
1166 		goto shift;
1167 	case SHL:
1168 		typeok_shl(mp, lt, rt);
1169 	shift:
1170 		typeok_shift(lt, rn, rt);
1171 		break;
1172 	case EQ:
1173 	case NE:
1174 		/*
1175 		 * Accept some things which are allowed with EQ and NE,
1176 		 * but not with ordered comparisons.
1177 		 */
1178 		if (is_typeok_eq(ln, lt, rn, rt))
1179 			break;
1180 		/* FALLTHROUGH */
1181 	case LT:
1182 	case GT:
1183 	case LE:
1184 	case GE:
1185 		if (!typeok_ordered_comparison(op, ln, ltp, lt, rn, rtp, rt))
1186 			return false;
1187 		break;
1188 	case QUEST:
1189 		if (!typeok_quest(lt, &rn))
1190 			return false;
1191 		break;
1192 	case COLON:
1193 		if (!typeok_colon(mp, ln, ltp, lt, rn, rtp, rt))
1194 			return false;
1195 		break;
1196 	case ASSIGN:
1197 	case INIT:
1198 	case FARG:
1199 	case RETURN:
1200 		if (!check_assign_types_compatible(op, arg, ln, rn))
1201 			return false;
1202 		goto assign;
1203 	case MULASS:
1204 	case DIVASS:
1205 	case MODASS:
1206 		goto assign;
1207 	case ADDASS:
1208 	case SUBASS:
1209 		/* operands have scalar types (checked above) */
1210 		if ((lt == PTR && !is_integer(rt)) || rt == PTR) {
1211 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1212 			return false;
1213 		}
1214 		goto assign;
1215 	case SHLASS:
1216 		goto assign;
1217 	case SHRASS:
1218 		if (pflag && !is_uinteger(lt) && !(tflag && is_uinteger(rt))) {
1219 			/* bitwise '%s' on signed value possibly nonportable */
1220 			warning(117, mp->m_name);
1221 		}
1222 		goto assign;
1223 	case ANDASS:
1224 	case XORASS:
1225 	case ORASS:
1226 		goto assign;
1227 	assign:
1228 		if (!typeok_assign(op, ln, ltp, lt))
1229 			return false;
1230 		break;
1231 	case COMMA:
1232 		if (!modtab[ln->tn_op].m_has_side_effect)
1233 			check_null_effect(ln);
1234 		break;
1235 		/* LINTED206: (enumeration values not handled in switch) */
1236 	case CON:
1237 	case CASE:
1238 	case PUSH:
1239 	case LOAD:
1240 	case ICALL:
1241 	case CVT:
1242 	case CALL:
1243 	case FSEL:
1244 	case STRING:
1245 	case NAME:
1246 	case LOGOR:
1247 	case LOGAND:
1248 	case BITOR:
1249 	case BITXOR:
1250 	case BITAND:
1251 	case MOD:
1252 	case DIV:
1253 	case MULT:
1254 	case UMINUS:
1255 	case UPLUS:
1256 	case DEC:
1257 	case INC:
1258 	case COMPL:
1259 	case NOT:
1260 	case NOOP:
1261 	case REAL:
1262 	case IMAG:
1263 		break;
1264 	}
1265 	return true;
1266 }
1267 
1268 static void
1269 typeok_enum(op_t op, const mod_t *mp, int arg,
1270 	    const tnode_t *ln, const type_t *ltp,
1271 	    const tnode_t *rn, const type_t *rtp)
1272 {
1273 	if (mp->m_bad_on_enum &&
1274 	    (ltp->t_is_enum || (mp->m_binary && rtp->t_is_enum))) {
1275 		check_bad_enum_operation(op, ln, rn);
1276 	} else if (mp->m_valid_on_enum &&
1277 		   (ltp->t_is_enum && rtp != NULL && rtp->t_is_enum)) {
1278 		check_enum_type_mismatch(op, arg, ln, rn);
1279 	} else if (mp->m_valid_on_enum &&
1280 		   (ltp->t_is_enum || (rtp != NULL && rtp->t_is_enum))) {
1281 		check_enum_int_mismatch(op, arg, ln, rn);
1282 	}
1283 }
1284 
1285 /* Perform most type checks. Return whether the types are ok. */
1286 bool
1287 typeok(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1288 {
1289 	const mod_t *mp;
1290 	tspec_t	lt, rt;
1291 	type_t	*ltp, *rtp;
1292 
1293 	mp = &modtab[op];
1294 
1295 	lint_assert((ltp = ln->tn_type) != NULL);
1296 	lt = ltp->t_tspec;
1297 
1298 	if (mp->m_binary) {
1299 		lint_assert((rtp = rn->tn_type) != NULL);
1300 		rt = rtp->t_tspec;
1301 	} else {
1302 		rtp = NULL;
1303 		rt = NOTSPEC;
1304 	}
1305 
1306 	if (Tflag && !typeok_scalar_strict_bool(op, mp, arg, ln, rn))
1307 		return false;
1308 	if (!typeok_scalar(op, mp, ltp, lt, rtp, rt))
1309 		return false;
1310 
1311 	if (!typeok_op(op, mp, arg, ln, ltp, lt, rn, rtp, rt))
1312 		return false;
1313 
1314 	typeok_enum(op, mp, arg, ln, ltp, rn, rtp);
1315 	return true;
1316 }
1317 
1318 static void
1319 check_pointer_comparison(op_t op, const tnode_t *ln, const tnode_t *rn)
1320 {
1321 	type_t	*ltp, *rtp;
1322 	tspec_t	lst, rst;
1323 	const	char *lsts, *rsts;
1324 
1325 	lst = (ltp = ln->tn_type)->t_subt->t_tspec;
1326 	rst = (rtp = rn->tn_type)->t_subt->t_tspec;
1327 
1328 	if (lst == VOID || rst == VOID) {
1329 		if (sflag && (lst == FUNC || rst == FUNC)) {
1330 			/* (void *)0 already handled in typeok() */
1331 			*(lst == FUNC ? &lsts : &rsts) = "function pointer";
1332 			*(lst == VOID ? &lsts : &rsts) = "'void *'";
1333 			/* ANSI C forbids comparison of %s with %s */
1334 			warning(274, lsts, rsts);
1335 		}
1336 		return;
1337 	}
1338 
1339 	if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
1340 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1341 		return;
1342 	}
1343 
1344 	if (lst == FUNC && rst == FUNC) {
1345 		if (sflag && op != EQ && op != NE)
1346 			/* ANSI C forbids ordered comparisons of ... */
1347 			warning(125);
1348 	}
1349 }
1350 
1351 static bool
1352 is_direct_function_call(const tnode_t *tn, const char *name)
1353 {
1354 	return tn->tn_op == CALL &&
1355 	       tn->tn_left->tn_op == ADDR &&
1356 	       tn->tn_left->tn_left->tn_op == NAME &&
1357 	       strcmp(tn->tn_left->tn_left->tn_sym->s_name, name) == 0;
1358 }
1359 
1360 static bool
1361 is_const_char_pointer(const tnode_t *tn)
1362 {
1363 	const type_t *tp;
1364 
1365 	/*
1366 	 * For traditional reasons, C99 6.4.5p5 defines that string literals
1367 	 * have type 'char[]'.  They are often implicitly converted to
1368 	 * 'char *', for example when they are passed as function arguments.
1369 	 *
1370 	 * C99 6.4.5p6 further defines that modifying a string that is
1371 	 * constructed from a string literal invokes undefined behavior.
1372 	 *
1373 	 * Out of these reasons, string literals are treated as 'effectively
1374 	 * const' here.
1375 	 */
1376 	if (tn->tn_op == CVT &&
1377 	    tn->tn_left->tn_op == ADDR &&
1378 	    tn->tn_left->tn_left->tn_op == STRING)
1379 		return true;
1380 
1381 	tp = before_conversion(tn)->tn_type;
1382 	return tp->t_tspec == PTR &&
1383 	       tp->t_subt->t_tspec == CHAR &&
1384 	       tp->t_subt->t_const;
1385 }
1386 
1387 static bool
1388 is_strchr_arg_const(const tnode_t *tn)
1389 {
1390 	return tn->tn_right->tn_op == PUSH &&
1391 	       tn->tn_right->tn_right->tn_op == PUSH &&
1392 	       tn->tn_right->tn_right->tn_right == NULL &&
1393 	       is_const_char_pointer(tn->tn_right->tn_right->tn_left);
1394 }
1395 
1396 static void
1397 check_unconst_strchr(const type_t *lstp,
1398 		     const tnode_t *rn, const type_t *rstp)
1399 {
1400 	if (lstp->t_tspec == CHAR && !lstp->t_const &&
1401 	    is_direct_function_call(rn, "strchr") &&
1402 	    is_strchr_arg_const(rn)) {
1403 		/* call to '%s' effectively discards 'const' from argument */
1404 		warning(346, "strchr");
1405 	}
1406 }
1407 
1408 /*
1409  * Checks type compatibility for ASSIGN, INIT, FARG and RETURN
1410  * and prints warnings/errors if necessary.
1411  * If the types are (almost) compatible, 1 is returned, otherwise 0.
1412  */
1413 static bool
1414 check_assign_types_compatible(op_t op, int arg,
1415 			      const tnode_t *ln, const tnode_t *rn)
1416 {
1417 	tspec_t	lt, rt, lst = NOTSPEC, rst = NOTSPEC;
1418 	type_t	*ltp, *rtp, *lstp = NULL, *rstp = NULL;
1419 	const mod_t *mp;
1420 	const	char *lts, *rts;
1421 
1422 	if ((lt = (ltp = ln->tn_type)->t_tspec) == PTR)
1423 		lst = (lstp = ltp->t_subt)->t_tspec;
1424 	if ((rt = (rtp = rn->tn_type)->t_tspec) == PTR)
1425 		rst = (rstp = rtp->t_subt)->t_tspec;
1426 	mp = &modtab[op];
1427 
1428 	if (lt == BOOL && is_scalar(rt))	/* C99 6.3.1.2 */
1429 		return true;
1430 
1431 	if (is_arithmetic(lt) && (is_arithmetic(rt) || rt == BOOL))
1432 		return true;
1433 
1434 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION))
1435 		/* both are struct or union */
1436 		return ltp->t_str == rtp->t_str;
1437 
1438 	/* a null pointer may be assigned to any pointer */
1439 	if (lt == PTR && is_null_pointer(rn))
1440 		return true;
1441 
1442 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID)) {
1443 		/* two pointers, at least one pointer to void */
1444 		if (sflag && (lst == FUNC || rst == FUNC)) {
1445 			/* comb. of ptr to func and ptr to void */
1446 			*(lst == FUNC ? &lts : &rts) = "function pointer";
1447 			*(lst == VOID ? &lts : &rts) = "'void *'";
1448 			switch (op) {
1449 			case INIT:
1450 			case RETURN:
1451 				/* ANSI C forbids conversion of %s to %s */
1452 				warning(303, rts, lts);
1453 				break;
1454 			case FARG:
1455 				/* ANSI C forbids conv. of %s to %s, arg #%d */
1456 				warning(304, rts, lts, arg);
1457 				break;
1458 			default:
1459 				/* ANSI C forbids conv. of %s to %s, op %s */
1460 				warning(305, rts, lts, mp->m_name);
1461 				break;
1462 			}
1463 		}
1464 	}
1465 
1466 	if (lt == PTR && rt == PTR && (lst == VOID || rst == VOID ||
1467 				       eqtype(lstp, rstp, true, false, NULL))) {
1468 		/* compatible pointer types (qualifiers ignored) */
1469 		if (!tflag &&
1470 		    ((!lstp->t_const && rstp->t_const) ||
1471 		     (!lstp->t_volatile && rstp->t_volatile))) {
1472 			/* left side has not all qualifiers of right */
1473 			switch (op) {
1474 			case INIT:
1475 			case RETURN:
1476 				/* incompatible pointer types (%s != %s) */
1477 				warning(182, type_name(lstp), type_name(rstp));
1478 				break;
1479 			case FARG:
1480 				/* converting '%s' to incompatible '%s' ... */
1481 				warning(153,
1482 				    type_name(rtp), type_name(ltp), arg);
1483 				break;
1484 			default:
1485 				/* operands have incompatible pointer type... */
1486 				warning(128, mp->m_name,
1487 				    type_name(lstp), type_name(rstp));
1488 				break;
1489 			}
1490 		}
1491 
1492 		if (!tflag)
1493 			check_unconst_strchr(lstp, rn, rstp);
1494 
1495 		return true;
1496 	}
1497 
1498 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1499 		const char *lx = lt == PTR ? "pointer" : "integer";
1500 		const char *rx = rt == PTR ? "pointer" : "integer";
1501 
1502 		switch (op) {
1503 		case INIT:
1504 		case RETURN:
1505 			/* illegal combination of %s (%s) and %s (%s) */
1506 			warning(183, lx, type_name(ltp), rx, type_name(rtp));
1507 			break;
1508 		case FARG:
1509 			/* illegal comb. of %s (%s) and %s (%s), arg #%d */
1510 			warning(154,
1511 			    lx, type_name(ltp), rx, type_name(rtp), arg);
1512 			break;
1513 		default:
1514 			/* illegal combination of %s (%s) and %s (%s), op %s */
1515 			warning(123,
1516 			    lx, type_name(ltp), rx, type_name(rtp), mp->m_name);
1517 			break;
1518 		}
1519 		return true;
1520 	}
1521 
1522 	if (lt == PTR && rt == PTR) {
1523 		switch (op) {
1524 		case RETURN:
1525 			warn_incompatible_pointers(NULL, ltp, rtp);
1526 			break;
1527 		case FARG:
1528 			/* converting '%s' to incompatible '%s' for ... */
1529 			warning(153, type_name(rtp), type_name(ltp), arg);
1530 			break;
1531 		default:
1532 			warn_incompatible_pointers(mp, ltp, rtp);
1533 			break;
1534 		}
1535 		return true;
1536 	}
1537 
1538 	switch (op) {
1539 	case INIT:
1540 		/* cannot initialize '%s' from '%s' */
1541 		error(185, type_name(ltp), type_name(rtp));
1542 		break;
1543 	case RETURN:
1544 		/* return value type mismatch (%s) and (%s) */
1545 		error(211, type_name(ltp), type_name(rtp));
1546 		break;
1547 	case FARG:
1548 		/* passing '%s' to incompatible '%s', arg #%d */
1549 		warning(155, type_name(rtp), type_name(ltp), arg);
1550 		break;
1551 	default:
1552 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1553 		break;
1554 	}
1555 
1556 	return false;
1557 }
1558 
1559 /* Prints a warning if a strange operator is used on an enum type. */
1560 static void
1561 check_bad_enum_operation(op_t op, const tnode_t *ln, const tnode_t *rn)
1562 {
1563 
1564 	if (!eflag)
1565 		return;
1566 
1567 	if (!(ln->tn_type->t_is_enum ||
1568 	      (modtab[op].m_binary && rn->tn_type->t_is_enum))) {
1569 		return;
1570 	}
1571 
1572 	/*
1573 	 * Enum as offset to a pointer is an exception (otherwise enums
1574 	 * could not be used as array indices).
1575 	 */
1576 	if (op == PLUS &&
1577 	    ((ln->tn_type->t_is_enum && rn->tn_type->t_tspec == PTR) ||
1578 	     (rn->tn_type->t_is_enum && ln->tn_type->t_tspec == PTR))) {
1579 		return;
1580 	}
1581 
1582 	/* dubious operation on enum, op %s */
1583 	warning(241, op_name(op));
1584 
1585 }
1586 
1587 /*
1588  * Prints a warning if an operator is applied to two different enum types.
1589  */
1590 static void
1591 check_enum_type_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1592 {
1593 	const mod_t *mp;
1594 
1595 	mp = &modtab[op];
1596 
1597 	if (ln->tn_type->t_enum != rn->tn_type->t_enum) {
1598 		switch (op) {
1599 		case INIT:
1600 			/* enum type mismatch between '%s' and '%s' in ... */
1601 			warning(210,
1602 			    type_name(ln->tn_type), type_name(rn->tn_type));
1603 			break;
1604 		case FARG:
1605 			/* enum type mismatch, arg #%d (%s != %s) */
1606 			warning(156, arg,
1607 			    type_name(ln->tn_type), type_name(rn->tn_type));
1608 			break;
1609 		case RETURN:
1610 			/* return value type mismatch (%s) and (%s) */
1611 			warning(211,
1612 			    type_name(ln->tn_type), type_name(rn->tn_type));
1613 			break;
1614 		default:
1615 			/* enum type mismatch: '%s' '%s' '%s' */
1616 			warning(130, type_name(ln->tn_type), mp->m_name,
1617 			    type_name(rn->tn_type));
1618 			break;
1619 		}
1620 	} else if (Pflag && mp->m_comparison && op != EQ && op != NE) {
1621 		if (eflag)
1622 			/* dubious comparison of enums, op %s */
1623 			warning(243, mp->m_name);
1624 	}
1625 }
1626 
1627 /* Prints a warning if the operands mix between enum and integer. */
1628 static void
1629 check_enum_int_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1630 {
1631 
1632 	if (!eflag)
1633 		return;
1634 
1635 	switch (op) {
1636 	case INIT:
1637 		/*
1638 		 * Initialization with 0 is allowed. Otherwise, all implicit
1639 		 * initializations would need to be warned upon as well.
1640 		 */
1641 		if (!rn->tn_type->t_is_enum && rn->tn_op == CON &&
1642 		    is_integer(rn->tn_type->t_tspec) &&
1643 		    rn->tn_val->v_quad == 0) {
1644 			return;
1645 		}
1646 		/* initialization of '%s' with '%s' */
1647 		warning(277, type_name(ln->tn_type), type_name(rn->tn_type));
1648 		break;
1649 	case FARG:
1650 		/* combination of '%s' and '%s', arg #%d */
1651 		warning(278,
1652 		    type_name(ln->tn_type), type_name(rn->tn_type), arg);
1653 		break;
1654 	case RETURN:
1655 		/* combination of '%s' and '%s' in return */
1656 		warning(279, type_name(ln->tn_type), type_name(rn->tn_type));
1657 		break;
1658 	default:
1659 		/* combination of '%s' and '%s', op %s */
1660 		warning(242, type_name(ln->tn_type), type_name(rn->tn_type),
1661 		    op_name(op));
1662 		break;
1663 	}
1664 }
1665 
1666 /*
1667  * Build and initialize a new node.
1668  */
1669 static tnode_t *
1670 new_tnode(op_t op, type_t *type, tnode_t *ln, tnode_t *rn)
1671 {
1672 	tnode_t	*ntn;
1673 	tspec_t	t;
1674 #if 0 /* not yet */
1675 	size_t l;
1676 	uint64_t rnum;
1677 #endif
1678 
1679 	ntn = expr_zalloc_tnode();
1680 
1681 	ntn->tn_op = op;
1682 	ntn->tn_type = type;
1683 	ntn->tn_relaxed = ln->tn_relaxed || (rn != NULL && rn->tn_relaxed);
1684 	ntn->tn_left = ln;
1685 	ntn->tn_right = rn;
1686 
1687 	switch (op) {
1688 #if 0 /* not yet */
1689 	case SHR:
1690 		if (rn->tn_op != CON)
1691 			break;
1692 		rnum = rn->tn_val->v_quad;
1693 		l = type_size_in_bits(ln->tn_type) / CHAR_SIZE;
1694 		t = ln->tn_type->t_tspec;
1695 		switch (l) {
1696 		case 8:
1697 			if (rnum >= 56)
1698 				t = UCHAR;
1699 			else if (rnum >= 48)
1700 				t = USHORT;
1701 			else if (rnum >= 32)
1702 				t = UINT;
1703 			break;
1704 		case 4:
1705 			if (rnum >= 24)
1706 				t = UCHAR;
1707 			else if (rnum >= 16)
1708 				t = USHORT;
1709 			break;
1710 		case 2:
1711 			if (rnum >= 8)
1712 				t = UCHAR;
1713 			break;
1714 		default:
1715 			break;
1716 		}
1717 		if (t != ln->tn_type->t_tspec)
1718 			ntn->tn_type->t_tspec = t;
1719 		break;
1720 #endif
1721 	case INDIR:
1722 	case FSEL:
1723 		lint_assert(ln->tn_type->t_tspec == PTR);
1724 		t = ln->tn_type->t_subt->t_tspec;
1725 		if (t != FUNC && t != VOID)
1726 			ntn->tn_lvalue = true;
1727 		break;
1728 	default:
1729 		break;
1730 	}
1731 
1732 	return ntn;
1733 }
1734 
1735 /*
1736  * Performs the "integer promotions" (C99 6.3.1.1p2), which convert small
1737  * integer types to either int or unsigned int.
1738  *
1739  * If tflag is set or the operand is a function argument with no type
1740  * information (no prototype or variable # of args), converts float to double.
1741  */
1742 tnode_t *
1743 promote(op_t op, bool farg, tnode_t *tn)
1744 {
1745 	tspec_t	t;
1746 	type_t	*ntp;
1747 	u_int	len;
1748 
1749 	t = tn->tn_type->t_tspec;
1750 
1751 	if (!is_arithmetic(t))
1752 		return tn;
1753 
1754 	if (!tflag) {
1755 		/*
1756 		 * C99 6.3.1.1p2 requires for types with lower rank than int
1757 		 * that "If an int can represent all the values of the
1758 		 * original type, the value is converted to an int; otherwise
1759 		 * it is converted to an unsigned int", and that "All other
1760 		 * types are unchanged by the integer promotions".
1761 		 */
1762 		if (tn->tn_type->t_bitfield) {
1763 			len = tn->tn_type->t_flen;
1764 			if (len < size_in_bits(INT)) {
1765 				t = INT;
1766 			} else if (len == size_in_bits(INT)) {
1767 				t = is_uinteger(t) ? UINT : INT;
1768 			}
1769 		} else if (t == CHAR || t == UCHAR || t == SCHAR) {
1770 			t = (size_in_bits(CHAR) < size_in_bits(INT)
1771 			     || t != UCHAR) ? INT : UINT;
1772 		} else if (t == SHORT || t == USHORT) {
1773 			t = (size_in_bits(SHORT) < size_in_bits(INT)
1774 			     || t == SHORT) ? INT : UINT;
1775 		} else if (t == ENUM) {
1776 			t = INT;
1777 		} else if (farg && t == FLOAT) {
1778 			t = DOUBLE;
1779 		}
1780 	} else {
1781 		/*
1782 		 * In traditional C, keep unsigned and promote FLOAT
1783 		 * to DOUBLE.
1784 		 */
1785 		if (t == UCHAR || t == USHORT) {
1786 			t = UINT;
1787 		} else if (t == CHAR || t == SCHAR || t == SHORT) {
1788 			t = INT;
1789 		} else if (t == FLOAT) {
1790 			t = DOUBLE;
1791 		} else if (t == ENUM) {
1792 			t = INT;
1793 		}
1794 	}
1795 
1796 	if (t != tn->tn_type->t_tspec) {
1797 		ntp = expr_dup_type(tn->tn_type);
1798 		ntp->t_tspec = t;
1799 		/*
1800 		 * Keep t_is_enum even though t_tspec gets converted from
1801 		 * ENUM to INT, so we are later able to check compatibility
1802 		 * of enum types.
1803 		 */
1804 		tn = convert(op, 0, ntp, tn);
1805 	}
1806 
1807 	return tn;
1808 }
1809 
1810 /*
1811  * Apply the "usual arithmetic conversions" (C99 6.3.1.8).
1812  *
1813  * This gives both operands the same type.
1814  * This is done in different ways for traditional C and C90.
1815  */
1816 static void
1817 balance(op_t op, tnode_t **lnp, tnode_t **rnp)
1818 {
1819 	tspec_t	lt, rt, t;
1820 	int	i;
1821 	bool	u;
1822 	type_t	*ntp;
1823 	static const tspec_t tl[] = {
1824 		LDOUBLE, DOUBLE, FLOAT,
1825 #ifdef INT128_SIZE
1826 		UINT128, INT128,
1827 #endif
1828 		UQUAD, QUAD,
1829 		ULONG, LONG,
1830 		UINT, INT,
1831 	};
1832 
1833 	lt = (*lnp)->tn_type->t_tspec;
1834 	rt = (*rnp)->tn_type->t_tspec;
1835 
1836 	if (!is_arithmetic(lt) || !is_arithmetic(rt))
1837 		return;
1838 
1839 	if (!tflag) {
1840 		if (lt == rt) {
1841 			t = lt;
1842 		} else if (lt == LCOMPLEX || rt == LCOMPLEX) {
1843 			t = LCOMPLEX;
1844 		} else if (lt == DCOMPLEX || rt == DCOMPLEX) {
1845 			t = DCOMPLEX;
1846 		} else if (lt == FCOMPLEX || rt == FCOMPLEX) {
1847 			t = FCOMPLEX;
1848 		} else if (lt == LDOUBLE || rt == LDOUBLE) {
1849 			t = LDOUBLE;
1850 		} else if (lt == DOUBLE || rt == DOUBLE) {
1851 			t = DOUBLE;
1852 		} else if (lt == FLOAT || rt == FLOAT) {
1853 			t = FLOAT;
1854 		} else {
1855 			/*
1856 			 * If type A has more bits than type B it should
1857 			 * be able to hold all possible values of type B.
1858 			 */
1859 			if (size_in_bits(lt) > size_in_bits(rt)) {
1860 				t = lt;
1861 			} else if (size_in_bits(lt) < size_in_bits(rt)) {
1862 				t = rt;
1863 			} else {
1864 				for (i = 3; tl[i] != INT; i++) {
1865 					if (tl[i] == lt || tl[i] == rt)
1866 						break;
1867 				}
1868 				if ((is_uinteger(lt) || is_uinteger(rt)) &&
1869 				    !is_uinteger(tl[i])) {
1870 					i--;
1871 				}
1872 				t = tl[i];
1873 			}
1874 		}
1875 	} else {
1876 		/* Keep unsigned in traditional C */
1877 		u = is_uinteger(lt) || is_uinteger(rt);
1878 		for (i = 0; tl[i] != INT; i++) {
1879 			if (lt == tl[i] || rt == tl[i])
1880 				break;
1881 		}
1882 		t = tl[i];
1883 		if (u && is_integer(t) && !is_uinteger(t))
1884 			t = unsigned_type(t);
1885 	}
1886 
1887 	if (t != lt) {
1888 		ntp = expr_dup_type((*lnp)->tn_type);
1889 		ntp->t_tspec = t;
1890 		*lnp = convert(op, 0, ntp, *lnp);
1891 	}
1892 	if (t != rt) {
1893 		ntp = expr_dup_type((*rnp)->tn_type);
1894 		ntp->t_tspec = t;
1895 		*rnp = convert(op, 0, ntp, *rnp);
1896 	}
1897 }
1898 
1899 /*
1900  * Insert a conversion operator, which converts the type of the node
1901  * to another given type.
1902  * If op is FARG, arg is the number of the argument (used for warnings).
1903  */
1904 tnode_t *
1905 convert(op_t op, int arg, type_t *tp, tnode_t *tn)
1906 {
1907 	tnode_t	*ntn;
1908 	tspec_t	nt, ot;
1909 
1910 	nt = tp->t_tspec;
1911 	ot = tn->tn_type->t_tspec;
1912 
1913 	if (!tflag && !sflag && op == FARG)
1914 		check_prototype_conversion(arg, nt, ot, tp, tn);
1915 	if (is_integer(nt) && is_integer(ot)) {
1916 		check_integer_conversion(op, arg, nt, ot, tp, tn);
1917 	} else if (nt == PTR && is_null_pointer(tn)) {
1918 		/* a null pointer may be assigned to any pointer. */
1919 	} else if (is_integer(nt) && nt != BOOL && ot == PTR) {
1920 		check_pointer_integer_conversion(op, nt, tp, tn);
1921 	} else if (nt == PTR && ot == PTR && op == CVT) {
1922 		check_pointer_conversion(tn, tp);
1923 	}
1924 
1925 	ntn = expr_zalloc_tnode();
1926 	ntn->tn_op = CVT;
1927 	ntn->tn_type = tp;
1928 	ntn->tn_cast = op == CVT;
1929 	ntn->tn_relaxed |= tn->tn_relaxed;
1930 	ntn->tn_right = NULL;
1931 	if (tn->tn_op != CON || nt == VOID) {
1932 		ntn->tn_left = tn;
1933 	} else {
1934 		ntn->tn_op = CON;
1935 		ntn->tn_val = expr_zalloc(sizeof(*ntn->tn_val));
1936 		convert_constant(op, arg, ntn->tn_type, ntn->tn_val,
1937 		    tn->tn_val);
1938 	}
1939 
1940 	return ntn;
1941 }
1942 
1943 /*
1944  * Print a warning if a prototype causes a type conversion that is
1945  * different from what would happen to the same argument in the
1946  * absence of a prototype.
1947  *
1948  * Errors/warnings about illegal type combinations are already printed
1949  * in check_assign_types_compatible().
1950  */
1951 static void
1952 check_prototype_conversion(int arg, tspec_t nt, tspec_t ot, type_t *tp,
1953 			   tnode_t *tn)
1954 {
1955 	tnode_t	*ptn;
1956 
1957 	if (!is_arithmetic(nt) || !is_arithmetic(ot))
1958 		return;
1959 
1960 	/*
1961 	 * If the type of the formal parameter is char/short, a warning
1962 	 * would be useless, because functions declared the old style
1963 	 * can't expect char/short arguments.
1964 	 */
1965 	/* XXX: what about SCHAR? */
1966 	if (nt == CHAR || nt == UCHAR || nt == SHORT || nt == USHORT)
1967 		return;
1968 
1969 	/* get default promotion */
1970 	ptn = promote(NOOP, true, tn);
1971 	ot = ptn->tn_type->t_tspec;
1972 
1973 	/* return if types are the same with and without prototype */
1974 	if (nt == ot || (nt == ENUM && ot == INT))
1975 		return;
1976 
1977 	if (is_floating(nt) != is_floating(ot) ||
1978 	    portable_size_in_bits(nt) != portable_size_in_bits(ot)) {
1979 		/* representation and/or width change */
1980 		if (!is_integer(ot) ||
1981 		    portable_size_in_bits(ot) > portable_size_in_bits(INT)) {
1982 			/* argument #%d is converted from '%s' to '%s' ... */
1983 			warning(259,
1984 			    arg, type_name(tn->tn_type), type_name(tp));
1985 		}
1986 	} else if (hflag) {
1987 		/*
1988 		 * they differ in sign or base type (char, short, int,
1989 		 * long, long long, float, double, long double)
1990 		 *
1991 		 * if they differ only in sign and the argument is a constant
1992 		 * and the msb of the argument is not set, print no warning
1993 		 */
1994 		if (ptn->tn_op == CON && is_integer(nt) &&
1995 		    signed_type(nt) == signed_type(ot) &&
1996 		    msb(ptn->tn_val->v_quad, ot, -1) == 0) {
1997 			/* ok */
1998 		} else {
1999 			/* argument #%d is converted from '%s' to '%s' ... */
2000 			warning(259,
2001 			    arg, type_name(tn->tn_type), type_name(tp));
2002 		}
2003 	}
2004 }
2005 
2006 /*
2007  * Print warnings for conversions of integer types which may cause problems.
2008  */
2009 static void
2010 check_integer_conversion(op_t op, int arg, tspec_t nt, tspec_t ot, type_t *tp,
2011 			 tnode_t *tn)
2012 {
2013 
2014 	if (tn->tn_op == CON)
2015 		return;
2016 
2017 	if (op == CVT)
2018 		return;
2019 
2020 	if (Sflag && nt == BOOL)
2021 		return;		/* See C99 6.3.1.2 */
2022 
2023 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
2024 	    is_uinteger(nt) != is_uinteger(ot)) {
2025 		if (aflag > 0 && pflag) {
2026 			if (op == FARG) {
2027 				/* conversion to '%s' may sign-extend ... */
2028 				warning(297, type_name(tp), arg);
2029 			} else {
2030 				/* conversion to '%s' may sign-extend ... */
2031 				warning(131, type_name(tp));
2032 			}
2033 		}
2034 	}
2035 
2036 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot)) {
2037 		switch (tn->tn_op) {
2038 		case PLUS:
2039 		case MINUS:
2040 		case MULT:
2041 		case SHL:
2042 			/* suggest cast from '%s' to '%s' on op %s to ... */
2043 			warning(324, type_name(gettyp(ot)), type_name(tp),
2044 			    op_name(tn->tn_op));
2045 			break;
2046 		default:
2047 			break;
2048 		}
2049 	}
2050 
2051 	if (portable_size_in_bits(nt) < portable_size_in_bits(ot) &&
2052 	    (ot == LONG || ot == ULONG || ot == QUAD || ot == UQUAD ||
2053 	     aflag > 1)) {
2054 		/* conversion from '%s' may lose accuracy */
2055 		if (aflag > 0) {
2056 			if (op == FARG) {
2057 				/* conv. from '%s' to '%s' may lose ... */
2058 				warning(298,
2059 				    type_name(tn->tn_type), type_name(tp), arg);
2060 			} else {
2061 				/* conv. from '%s' to '%s' may lose accuracy */
2062 				warning(132,
2063 				    type_name(tn->tn_type), type_name(tp));
2064 			}
2065 		}
2066 	}
2067 }
2068 
2069 /*
2070  * Print warnings for dubious conversions of pointer to integer.
2071  */
2072 static void
2073 check_pointer_integer_conversion(op_t op, tspec_t nt, type_t *tp, tnode_t *tn)
2074 {
2075 
2076 	if (tn->tn_op == CON)
2077 		return;
2078 	if (op != CVT)
2079 		return;		/* We got already an error. */
2080 	if (portable_size_in_bits(nt) >= portable_size_in_bits(PTR))
2081 		return;
2082 
2083 	if (pflag && size_in_bits(nt) >= size_in_bits(PTR)) {
2084 		/* conversion of pointer to '%s' may lose bits */
2085 		warning(134, type_name(tp));
2086 	} else {
2087 		/* conversion of pointer to '%s' loses bits */
2088 		warning(133, type_name(tp));
2089 	}
2090 }
2091 
2092 static bool
2093 should_warn_about_pointer_cast(const type_t *nstp, tspec_t nst,
2094 			       const type_t *ostp, tspec_t ost)
2095 {
2096 	/*
2097 	 * Casting a pointer to 'struct S' to a pointer to another struct that
2098 	 * has 'struct S' as its first member is ok, see msg_247.c, 'struct
2099 	 * counter'.
2100 	 */
2101 	if (nst == STRUCT && ost == STRUCT &&
2102 	    nstp->t_str->sou_first_member != NULL &&
2103 	    nstp->t_str->sou_first_member->s_type == ostp)
2104 		return false;
2105 
2106 	if (is_incomplete(nstp) || is_incomplete(ostp))
2107 		return false;
2108 
2109 	if ((nst == STRUCT || nst == UNION) && nstp->t_str != ostp->t_str)
2110 		return true;
2111 
2112 	if (nst == CHAR || nst == UCHAR)
2113 		return false;	/* for the sake of traditional C code */
2114 	if (ost == CHAR || ost == UCHAR)
2115 		return false;	/* for the sake of traditional C code */
2116 
2117 	return portable_size_in_bits(nst) != portable_size_in_bits(ost);
2118 }
2119 
2120 /*
2121  * Warn about questionable pointer conversions.
2122  */
2123 static void
2124 check_pointer_conversion(tnode_t *tn, type_t *ntp)
2125 {
2126 	const type_t *nstp, *otp, *ostp;
2127 	tspec_t nst, ost;
2128 	const char *nts, *ots;
2129 
2130 	nstp = ntp->t_subt;
2131 	otp = tn->tn_type;
2132 	ostp = otp->t_subt;
2133 	nst = nstp->t_tspec;
2134 	ost = ostp->t_tspec;
2135 
2136 	if (nst == VOID || ost == VOID) {
2137 		if (sflag && (nst == FUNC || ost == FUNC)) {
2138 			/* null pointers are already handled in convert() */
2139 			*(nst == FUNC ? &nts : &ots) = "function pointer";
2140 			*(nst == VOID ? &nts : &ots) = "'void *'";
2141 			/* ANSI C forbids conversion of %s to %s */
2142 			warning(303, ots, nts);
2143 		}
2144 		return;
2145 	} else if (nst == FUNC && ost == FUNC) {
2146 		return;
2147 	} else if (nst == FUNC || ost == FUNC) {
2148 		/* converting '%s' to '%s' is questionable */
2149 		warning(229, type_name(otp), type_name(ntp));
2150 		return;
2151 	}
2152 
2153 	if (hflag && alignment_in_bits(nstp) > alignment_in_bits(ostp) &&
2154 	    ost != CHAR && ost != UCHAR &&
2155 	    !is_incomplete(ostp)) {
2156 		/* converting '%s' to '%s' may cause alignment problem */
2157 		warning(135, type_name(otp), type_name(ntp));
2158 	}
2159 
2160 	if (cflag && should_warn_about_pointer_cast(nstp, nst, ostp, ost)) {
2161 		/* pointer cast from '%s' to '%s' may be troublesome */
2162 		warning(247, type_name(otp), type_name(ntp));
2163 	}
2164 }
2165 
2166 static void
2167 convert_constant_floating(op_t op, int arg, tspec_t ot, const type_t *tp,
2168 			  tspec_t nt, val_t *v, val_t *nv)
2169 {
2170 	ldbl_t	max = 0.0, min = 0.0;
2171 
2172 	switch (nt) {
2173 	case CHAR:
2174 		max = TARG_CHAR_MAX;	min = TARG_CHAR_MIN;	break;
2175 	case UCHAR:
2176 		max = TARG_UCHAR_MAX;	min = 0;		break;
2177 	case SCHAR:
2178 		max = TARG_SCHAR_MAX;	min = TARG_SCHAR_MIN;	break;
2179 	case SHORT:
2180 		max = TARG_SHRT_MAX;	min = TARG_SHRT_MIN;	break;
2181 	case USHORT:
2182 		max = TARG_USHRT_MAX;	min = 0;		break;
2183 	case ENUM:
2184 	case INT:
2185 		max = TARG_INT_MAX;	min = TARG_INT_MIN;	break;
2186 	case UINT:
2187 		max = (u_int)TARG_UINT_MAX;min = 0;		break;
2188 	case LONG:
2189 		max = TARG_LONG_MAX;	min = TARG_LONG_MIN;	break;
2190 	case ULONG:
2191 		max = (u_long)TARG_ULONG_MAX; min = 0;		break;
2192 	case QUAD:
2193 		max = QUAD_MAX;		min = QUAD_MIN;		break;
2194 	case UQUAD:
2195 		max = (uint64_t)UQUAD_MAX; min = 0;		break;
2196 	case FLOAT:
2197 	case FCOMPLEX:
2198 		max = FLT_MAX;		min = -FLT_MAX;		break;
2199 	case DOUBLE:
2200 	case DCOMPLEX:
2201 		max = DBL_MAX;		min = -DBL_MAX;		break;
2202 	case PTR:
2203 		/* Got already an error because of float --> ptr */
2204 	case LDOUBLE:
2205 	case LCOMPLEX:
2206 		max = LDBL_MAX;		min = -LDBL_MAX;	break;
2207 	default:
2208 		lint_assert(/*CONSTCOND*/false);
2209 	}
2210 	if (v->v_ldbl > max || v->v_ldbl < min) {
2211 		lint_assert(nt != LDOUBLE);
2212 		if (op == FARG) {
2213 			/* conv. of '%s' to '%s' is out of range, ... */
2214 			warning(295,
2215 			    type_name(gettyp(ot)), type_name(tp), arg);
2216 		} else {
2217 			/* conversion of '%s' to '%s' is out of range */
2218 			warning(119,
2219 			    type_name(gettyp(ot)), type_name(tp));
2220 		}
2221 		v->v_ldbl = v->v_ldbl > 0 ? max : min;
2222 	}
2223 	if (nt == FLOAT) {
2224 		nv->v_ldbl = (float)v->v_ldbl;
2225 	} else if (nt == DOUBLE) {
2226 		nv->v_ldbl = (double)v->v_ldbl;
2227 	} else if (nt == LDOUBLE) {
2228 		nv->v_ldbl = v->v_ldbl;
2229 	} else {
2230 		nv->v_quad = (nt == PTR || is_uinteger(nt)) ?
2231 		    (int64_t)v->v_ldbl : (int64_t)v->v_ldbl;
2232 	}
2233 }
2234 
2235 static bool
2236 convert_constant_to_floating(tspec_t nt, val_t *nv,
2237 			     tspec_t ot, const val_t *v)
2238 {
2239 	if (nt == FLOAT) {
2240 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2241 		    (float)(uint64_t)v->v_quad : (float)v->v_quad;
2242 	} else if (nt == DOUBLE) {
2243 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2244 		    (double)(uint64_t)v->v_quad : (double)v->v_quad;
2245 	} else if (nt == LDOUBLE) {
2246 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2247 		    (ldbl_t)(uint64_t)v->v_quad : (ldbl_t)v->v_quad;
2248 	} else
2249 		return false;
2250 	return true;
2251 }
2252 
2253 /*
2254  * Print a warning if bits which were set are lost due to the conversion.
2255  * This can happen with operator ORASS only.
2256  */
2257 static void
2258 convert_constant_check_range_bitor(size_t nsz, size_t osz, const val_t *v,
2259 				   uint64_t xmask, op_t op)
2260 {
2261 	if (nsz < osz && (v->v_quad & xmask) != 0) {
2262 		/* constant truncated by conv., op %s */
2263 		warning(306, op_name(op));
2264 	}
2265 }
2266 
2267 /*
2268  * Print a warning if additional bits are not all 1
2269  * and the most significant bit of the old value is 1,
2270  * or if at least one (but not all) removed bit was 0.
2271  */
2272 static void
2273 convert_constant_check_range_bitand(size_t nsz, size_t osz,
2274 				    uint64_t xmask, const val_t *nv,
2275 				    tspec_t ot, const val_t *v,
2276 				    const type_t *tp, op_t op)
2277 {
2278 	if (nsz > osz &&
2279 	    (nv->v_quad & bit(osz - 1)) != 0 &&
2280 	    (nv->v_quad & xmask) != xmask) {
2281 		/* extra bits set to 0 in conversion of '%s' to '%s', ... */
2282 		warning(309, type_name(gettyp(ot)),
2283 		    type_name(tp), op_name(op));
2284 	} else if (nsz < osz &&
2285 		   (v->v_quad & xmask) != xmask &&
2286 		   (v->v_quad & xmask) != 0) {
2287 		/* constant truncated by conversion, op %s */
2288 		warning(306, op_name(op));
2289 	}
2290 }
2291 
2292 static void
2293 convert_constant_check_range_signed(op_t op, int arg)
2294 {
2295 	if (op == ASSIGN) {
2296 		/* assignment of negative constant to unsigned type */
2297 		warning(164);
2298 	} else if (op == INIT) {
2299 		/* initialization of unsigned with negative constant */
2300 		warning(221);
2301 	} else if (op == FARG) {
2302 		/* conversion of negative constant to unsigned type, ... */
2303 		warning(296, arg);
2304 	} else if (modtab[op].m_comparison) {
2305 		/* handled by check_integer_comparison() */
2306 	} else {
2307 		/* conversion of negative constant to unsigned type */
2308 		warning(222);
2309 	}
2310 }
2311 
2312 /*
2313  * Loss of significant bit(s). All truncated bits
2314  * of unsigned types or all truncated bits plus the
2315  * msb of the target for signed types are considered
2316  * to be significant bits. Loss of significant bits
2317  * means that at least one of the bits was set in an
2318  * unsigned type or that at least one but not all of
2319  * the bits was set in a signed type.
2320  * Loss of significant bits means that it is not
2321  * possible, also not with necessary casts, to convert
2322  * back to the original type. A example for a
2323  * necessary cast is:
2324  *	char c;	int	i; c = 128;
2325  *	i = c;			** yields -128 **
2326  *	i = (unsigned char)c;	** yields 128 **
2327  */
2328 static void
2329 convert_constant_check_range_truncated(op_t op, int arg, const type_t *tp,
2330 				       tspec_t ot)
2331 {
2332 	if (op == ASSIGN && tp->t_bitfield) {
2333 		/* precision lost in bit-field assignment */
2334 		warning(166);
2335 	} else if (op == ASSIGN) {
2336 		/* constant truncated by assignment */
2337 		warning(165);
2338 	} else if (op == INIT && tp->t_bitfield) {
2339 		/* bit-field initializer does not fit */
2340 		warning(180);
2341 	} else if (op == INIT) {
2342 		/* initializer does not fit */
2343 		warning(178);
2344 	} else if (op == CASE) {
2345 		/* case label affected by conversion */
2346 		warning(196);
2347 	} else if (op == FARG) {
2348 		/* conversion of '%s' to '%s' is out of range, arg #%d */
2349 		warning(295,
2350 		    type_name(gettyp(ot)), type_name(tp), arg);
2351 	} else {
2352 		/* conversion of '%s' to '%s' is out of range */
2353 		warning(119,
2354 		    type_name(gettyp(ot)), type_name(tp));
2355 	}
2356 }
2357 
2358 static void
2359 convert_constant_check_range_loss(op_t op, int arg, const type_t *tp,
2360 				  tspec_t ot)
2361 {
2362 	if (op == ASSIGN && tp->t_bitfield) {
2363 		/* precision lost in bit-field assignment */
2364 		warning(166);
2365 	} else if (op == INIT && tp->t_bitfield) {
2366 		/* bit-field initializer out of range */
2367 		warning(11);
2368 	} else if (op == CASE) {
2369 		/* case label affected by conversion */
2370 		warning(196);
2371 	} else if (op == FARG) {
2372 		/* conversion of '%s' to '%s' is out of range, arg #%d */
2373 		warning(295,
2374 		    type_name(gettyp(ot)), type_name(tp), arg);
2375 	} else {
2376 		/* conversion of '%s' to '%s' is out of range */
2377 		warning(119,
2378 		    type_name(gettyp(ot)), type_name(tp));
2379 	}
2380 }
2381 
2382 static void
2383 convert_constant_check_range(tspec_t ot, const type_t *tp, tspec_t nt,
2384 			     op_t op, int arg, const val_t *v, val_t *nv)
2385 {
2386 	int	osz, nsz;
2387 	int64_t	xmask, xmsk1;
2388 
2389 	osz = size_in_bits(ot);
2390 	nsz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2391 	xmask = value_bits(nsz) ^ value_bits(osz);
2392 	xmsk1 = value_bits(nsz) ^ value_bits(osz - 1);
2393 	/*
2394 	 * For bitwise operations we are not interested in the
2395 	 * value, but in the bits itself.
2396 	 */
2397 	if (op == ORASS || op == BITOR || op == BITXOR) {
2398 		convert_constant_check_range_bitor(nsz, osz, v, xmask, op);
2399 	} else if (op == ANDASS || op == BITAND) {
2400 		convert_constant_check_range_bitand(nsz, osz, xmask, nv, ot,
2401 		    v, tp, op);
2402 	} else if ((nt != PTR && is_uinteger(nt)) &&
2403 		   (ot != PTR && !is_uinteger(ot)) &&
2404 		   v->v_quad < 0) {
2405 		convert_constant_check_range_signed(op, arg);
2406 	} else if (nv->v_quad != v->v_quad && nsz <= osz &&
2407 		   (v->v_quad & xmask) != 0 &&
2408 		   (is_uinteger(ot) || (v->v_quad & xmsk1) != xmsk1)) {
2409 		convert_constant_check_range_truncated(op, arg, tp, ot);
2410 	} else if (nv->v_quad != v->v_quad) {
2411 		convert_constant_check_range_loss(op, arg, tp, ot);
2412 	}
2413 }
2414 
2415 /*
2416  * Converts a typed constant to a constant of another type.
2417  *
2418  * op		operator which requires conversion
2419  * arg		if op is FARG, # of argument
2420  * tp		type in which to convert the constant
2421  * nv		new constant
2422  * v		old constant
2423  */
2424 void
2425 convert_constant(op_t op, int arg, const type_t *tp, val_t *nv, val_t *v)
2426 {
2427 	tspec_t	ot, nt;
2428 	int	sz;
2429 	bool	range_check;
2430 
2431 	/*
2432 	 * TODO: make 'v' const; the name of this function does not suggest
2433 	 *  that it modifies 'v'.
2434 	 */
2435 	ot = v->v_tspec;
2436 	nt = nv->v_tspec = tp->t_tspec;
2437 	range_check = false;
2438 
2439 	if (nt == BOOL) {	/* C99 6.3.1.2 */
2440 		nv->v_unsigned_since_c90 = false;
2441 		nv->v_quad = is_nonzero_val(v) ? 1 : 0;
2442 		return;
2443 	}
2444 
2445 	if (ot == FLOAT || ot == DOUBLE || ot == LDOUBLE) {
2446 		convert_constant_floating(op, arg, ot, tp, nt, v, nv);
2447 	} else if (!convert_constant_to_floating(nt, nv, ot, v)) {
2448 		range_check = true;	/* Check for lost precision. */
2449 		nv->v_quad = v->v_quad;
2450 	}
2451 
2452 	if ((v->v_unsigned_since_c90 && is_floating(nt)) ||
2453 	    (v->v_unsigned_since_c90 && (is_integer(nt) && !is_uinteger(nt) &&
2454 			    portable_size_in_bits(nt) >
2455 			    portable_size_in_bits(ot)))) {
2456 		/* ANSI C treats constant as unsigned */
2457 		warning(157);
2458 		v->v_unsigned_since_c90 = false;
2459 	}
2460 
2461 	if (is_integer(nt)) {
2462 		sz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2463 		nv->v_quad = convert_integer(nv->v_quad, nt, sz);
2464 	}
2465 
2466 	if (range_check && op != CVT)
2467 		convert_constant_check_range(ot, tp, nt, op, arg, v, nv);
2468 }
2469 
2470 /*
2471  * Called if incompatible types were detected.
2472  * Prints a appropriate warning.
2473  */
2474 static void
2475 warn_incompatible_types(op_t op,
2476 			const type_t *ltp, tspec_t lt,
2477 			const type_t *rtp, tspec_t rt)
2478 {
2479 	const mod_t *mp;
2480 
2481 	mp = &modtab[op];
2482 
2483 	if (lt == VOID || (mp->m_binary && rt == VOID)) {
2484 		/* void type illegal in expression */
2485 		error(109);
2486 	} else if (op == ASSIGN) {
2487 		if ((lt == STRUCT || lt == UNION) &&
2488 		    (rt == STRUCT || rt == UNION)) {
2489 			/* assignment of different structures (%s != %s) */
2490 			error(240, tspec_name(lt), tspec_name(rt));
2491 		} else {
2492 			/* cannot assign to '%s' from '%s' */
2493 			error(171, type_name(ltp), type_name(rtp));
2494 		}
2495 	} else if (mp->m_binary) {
2496 		/* operands of '%s' have incompatible types (%s != %s) */
2497 		error(107, mp->m_name, tspec_name(lt), tspec_name(rt));
2498 	} else {
2499 		lint_assert(rt == NOTSPEC);
2500 		/* operand of '%s' has invalid type (%s) */
2501 		error(108, mp->m_name, tspec_name(lt));
2502 	}
2503 }
2504 
2505 /*
2506  * Called if incompatible pointer types are detected.
2507  * Print an appropriate warning.
2508  */
2509 static void
2510 warn_incompatible_pointers(const mod_t *mp,
2511 			   const type_t *ltp, const type_t *rtp)
2512 {
2513 	tspec_t	lt, rt;
2514 
2515 	lint_assert(ltp->t_tspec == PTR);
2516 	lint_assert(rtp->t_tspec == PTR);
2517 
2518 	lt = ltp->t_subt->t_tspec;
2519 	rt = rtp->t_subt->t_tspec;
2520 
2521 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION)) {
2522 		if (mp == NULL) {
2523 			/* illegal structure pointer combination */
2524 			warning(244);
2525 		} else {
2526 			/* incompatible structure pointers: '%s' '%s' '%s' */
2527 			warning(245, type_name(ltp), mp->m_name, type_name(rtp));
2528 		}
2529 	} else {
2530 		if (mp == NULL) {
2531 			/* illegal combination of '%s' and '%s' */
2532 			warning(184, type_name(ltp), type_name(rtp));
2533 		} else {
2534 			/* illegal combination of '%s' and '%s', op '%s' */
2535 			warning(124,
2536 			    type_name(ltp), type_name(rtp), mp->m_name);
2537 		}
2538 	}
2539 }
2540 
2541 /* Return a type based on tp1, with added qualifiers from tp2. */
2542 static type_t *
2543 merge_qualifiers(type_t *tp1, const type_t *tp2)
2544 {
2545 	type_t *ntp, *nstp;
2546 
2547 	lint_assert(tp1->t_tspec == PTR);
2548 	lint_assert(tp2->t_tspec == PTR);
2549 
2550 	bool c1 = tp1->t_subt->t_const;
2551 	bool c2 = tp2->t_subt->t_const;
2552 	bool v1 = tp1->t_subt->t_volatile;
2553 	bool v2 = tp2->t_subt->t_volatile;
2554 
2555 	if (c1 == (c1 | c2) && v1 == (v1 | v2))
2556 		return tp1;
2557 
2558 	nstp = expr_dup_type(tp1->t_subt);
2559 	nstp->t_const |= c2;
2560 	nstp->t_volatile |= v2;
2561 
2562 	ntp = expr_dup_type(tp1);
2563 	ntp->t_subt = nstp;
2564 	return ntp;
2565 }
2566 
2567 /*
2568  * Returns true if the given structure or union has a constant member
2569  * (maybe recursively).
2570  */
2571 static bool
2572 has_constant_member(const type_t *tp)
2573 {
2574 	sym_t *m;
2575 
2576 	lint_assert(is_struct_or_union(tp->t_tspec));
2577 
2578 	for (m = tp->t_str->sou_first_member; m != NULL; m = m->s_next) {
2579 		const type_t *mtp = m->s_type;
2580 		if (mtp->t_const)
2581 			return true;
2582 		if (is_struct_or_union(mtp->t_tspec) &&
2583 		    has_constant_member(mtp))
2584 			return true;
2585 	}
2586 	return false;
2587 }
2588 
2589 /*
2590  * Create a new node for one of the operators POINT and ARROW.
2591  */
2592 static tnode_t *
2593 build_struct_access(op_t op, tnode_t *ln, tnode_t *rn)
2594 {
2595 	tnode_t	*ntn, *ctn;
2596 	bool	nolval;
2597 
2598 	lint_assert(rn->tn_op == NAME);
2599 	lint_assert(rn->tn_sym->s_value.v_tspec == INT);
2600 	lint_assert(rn->tn_sym->s_scl == MOS || rn->tn_sym->s_scl == MOU);
2601 
2602 	/*
2603 	 * Remember if the left operand is an lvalue (structure members
2604 	 * are lvalues if and only if the structure itself is an lvalue).
2605 	 */
2606 	nolval = op == POINT && !ln->tn_lvalue;
2607 
2608 	if (op == POINT) {
2609 		ln = build_address(ln, true);
2610 	} else if (ln->tn_type->t_tspec != PTR) {
2611 		lint_assert(tflag);
2612 		lint_assert(is_integer(ln->tn_type->t_tspec));
2613 		ln = convert(NOOP, 0, expr_derive_type(gettyp(VOID), PTR), ln);
2614 	}
2615 
2616 	ctn = build_integer_constant(PTRDIFF_TSPEC,
2617 	    rn->tn_sym->s_value.v_quad / CHAR_SIZE);
2618 
2619 	ntn = new_tnode(PLUS, expr_derive_type(rn->tn_type, PTR), ln, ctn);
2620 	if (ln->tn_op == CON)
2621 		ntn = fold(ntn);
2622 
2623 	if (rn->tn_type->t_bitfield) {
2624 		ntn = new_tnode(FSEL, ntn->tn_type->t_subt, ntn, NULL);
2625 	} else {
2626 		ntn = new_tnode(INDIR, ntn->tn_type->t_subt, ntn, NULL);
2627 	}
2628 
2629 	if (nolval)
2630 		ntn->tn_lvalue = false;
2631 
2632 	return ntn;
2633 }
2634 
2635 /*
2636  * Create a node for INCAFT, INCBEF, DECAFT and DECBEF.
2637  */
2638 static tnode_t *
2639 build_prepost_incdec(op_t op, tnode_t *ln)
2640 {
2641 	tnode_t	*cn, *ntn;
2642 
2643 	lint_assert(ln != NULL);
2644 
2645 	if (ln->tn_type->t_tspec == PTR) {
2646 		cn = plength(ln->tn_type);
2647 	} else {
2648 		cn = build_integer_constant(INT, (int64_t)1);
2649 	}
2650 	ntn = new_tnode(op, ln->tn_type, ln, cn);
2651 
2652 	return ntn;
2653 }
2654 
2655 /*
2656  * Create a node for REAL, IMAG
2657  */
2658 static tnode_t *
2659 build_real_imag(op_t op, tnode_t *ln)
2660 {
2661 	tnode_t	*cn, *ntn;
2662 
2663 	lint_assert(ln != NULL);
2664 
2665 	if (ln->tn_op == NAME) {
2666 		/*
2667 		 * This may be too much, but it avoids wrong warnings.
2668 		 * See d_c99_complex_split.c.
2669 		 */
2670 		mark_as_used(ln->tn_sym, false, false);
2671 		mark_as_set(ln->tn_sym);
2672 	}
2673 
2674 	switch (ln->tn_type->t_tspec) {
2675 	case LCOMPLEX:
2676 		/* XXX: integer and LDOUBLE don't match. */
2677 		cn = build_integer_constant(LDOUBLE, (int64_t)1);
2678 		break;
2679 	case DCOMPLEX:
2680 		/* XXX: integer and DOUBLE don't match. */
2681 		cn = build_integer_constant(DOUBLE, (int64_t)1);
2682 		break;
2683 	case FCOMPLEX:
2684 		/* XXX: integer and FLOAT don't match. */
2685 		cn = build_integer_constant(FLOAT, (int64_t)1);
2686 		break;
2687 	default:
2688 		/* __%s__ is illegal for type %s */
2689 		error(276, op == REAL ? "real" : "imag",
2690 		    type_name(ln->tn_type));
2691 		return NULL;
2692 	}
2693 	ntn = new_tnode(op, cn->tn_type, ln, cn);
2694 	ntn->tn_lvalue = true;
2695 
2696 	return ntn;
2697 }
2698 /*
2699  * Create a tree node for the unary & operator
2700  */
2701 static tnode_t *
2702 build_address(tnode_t *tn, bool noign)
2703 {
2704 	tspec_t	t;
2705 
2706 	if (!noign && ((t = tn->tn_type->t_tspec) == ARRAY || t == FUNC)) {
2707 		if (tflag)
2708 			/* '&' before array or function: ignored */
2709 			warning(127);
2710 		return tn;
2711 	}
2712 
2713 	/* eliminate &* */
2714 	if (tn->tn_op == INDIR &&
2715 	    tn->tn_left->tn_type->t_tspec == PTR &&
2716 	    tn->tn_left->tn_type->t_subt == tn->tn_type) {
2717 		return tn->tn_left;
2718 	}
2719 
2720 	return new_tnode(ADDR, expr_derive_type(tn->tn_type, PTR), tn, NULL);
2721 }
2722 
2723 /*
2724  * Create a node for operators PLUS and MINUS.
2725  */
2726 static tnode_t *
2727 build_plus_minus(op_t op, tnode_t *ln, tnode_t *rn)
2728 {
2729 	tnode_t	*ntn, *ctn;
2730 	type_t	*tp;
2731 
2732 	/* If pointer and integer, then pointer to the lhs. */
2733 	if (rn->tn_type->t_tspec == PTR && is_integer(ln->tn_type->t_tspec)) {
2734 		ntn = ln;
2735 		ln = rn;
2736 		rn = ntn;
2737 	}
2738 
2739 	if (ln->tn_type->t_tspec == PTR && rn->tn_type->t_tspec != PTR) {
2740 
2741 		/* XXX: this assertion should be easy to trigger */
2742 		lint_assert(is_integer(rn->tn_type->t_tspec));
2743 
2744 		check_ctype_macro_invocation(ln, rn);
2745 
2746 		ctn = plength(ln->tn_type);
2747 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2748 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2749 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2750 		if (rn->tn_left->tn_op == CON)
2751 			rn = fold(rn);
2752 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2753 
2754 	} else if (rn->tn_type->t_tspec == PTR) {
2755 
2756 		lint_assert(ln->tn_type->t_tspec == PTR);
2757 		lint_assert(op == MINUS);
2758 		tp = gettyp(PTRDIFF_TSPEC);
2759 		ntn = new_tnode(op, tp, ln, rn);
2760 		if (ln->tn_op == CON && rn->tn_op == CON)
2761 			ntn = fold(ntn);
2762 		ctn = plength(ln->tn_type);
2763 		balance(NOOP, &ntn, &ctn);
2764 		ntn = new_tnode(DIV, tp, ntn, ctn);
2765 
2766 	} else {
2767 
2768 		ntn = new_tnode(op, ln->tn_type, ln, rn);
2769 
2770 	}
2771 	return ntn;
2772 }
2773 
2774 /*
2775  * Create a node for operators SHL and SHR.
2776  */
2777 static tnode_t *
2778 build_bit_shift(op_t op, tnode_t *ln, tnode_t *rn)
2779 {
2780 	tspec_t	t;
2781 	tnode_t	*ntn;
2782 
2783 	if ((t = rn->tn_type->t_tspec) != INT && t != UINT)
2784 		rn = convert(CVT, 0, gettyp(INT), rn);
2785 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2786 	return ntn;
2787 }
2788 
2789 /*
2790  * Create a node for COLON.
2791  */
2792 static tnode_t *
2793 build_colon(tnode_t *ln, tnode_t *rn)
2794 {
2795 	tspec_t	lt, rt, pdt;
2796 	type_t	*tp;
2797 	tnode_t	*ntn;
2798 
2799 	lt = ln->tn_type->t_tspec;
2800 	rt = rn->tn_type->t_tspec;
2801 	pdt = PTRDIFF_TSPEC;
2802 
2803 	/*
2804 	 * Arithmetic types are balanced, all other type combinations
2805 	 * still need to be handled.
2806 	 */
2807 	if (is_arithmetic(lt) && is_arithmetic(rt)) {
2808 		tp = ln->tn_type;
2809 	} else if (lt == BOOL && rt == BOOL) {
2810 		tp = ln->tn_type;
2811 	} else if (lt == VOID || rt == VOID) {
2812 		tp = gettyp(VOID);
2813 	} else if (lt == STRUCT || lt == UNION) {
2814 		/* Both types must be identical. */
2815 		lint_assert(rt == STRUCT || rt == UNION);
2816 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2817 		if (is_incomplete(ln->tn_type)) {
2818 			/* unknown operand size, op %s */
2819 			error(138, op_name(COLON));
2820 			return NULL;
2821 		}
2822 		tp = ln->tn_type;
2823 	} else if (lt == PTR && is_integer(rt)) {
2824 		if (rt != pdt) {
2825 			rn = convert(NOOP, 0, gettyp(pdt), rn);
2826 			rt = pdt;
2827 		}
2828 		tp = ln->tn_type;
2829 	} else if (rt == PTR && is_integer(lt)) {
2830 		if (lt != pdt) {
2831 			ln = convert(NOOP, 0, gettyp(pdt), ln);
2832 			lt = pdt;
2833 		}
2834 		tp = rn->tn_type;
2835 	} else if (lt == PTR && ln->tn_type->t_subt->t_tspec == VOID) {
2836 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
2837 	} else if (rt == PTR && rn->tn_type->t_subt->t_tspec == VOID) {
2838 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2839 	} else {
2840 		/*
2841 		 * XXX For now we simply take the left type. This is
2842 		 * probably wrong, if one type contains a function prototype
2843 		 * and the other one, at the same place, only an old style
2844 		 * declaration.
2845 		 */
2846 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
2847 	}
2848 
2849 	ntn = new_tnode(COLON, tp, ln, rn);
2850 
2851 	return ntn;
2852 }
2853 
2854 /*
2855  * Create a node for an assignment operator (both = and op= ).
2856  */
2857 static tnode_t *
2858 build_assignment(op_t op, tnode_t *ln, tnode_t *rn)
2859 {
2860 	tspec_t	lt, rt;
2861 	tnode_t	*ntn, *ctn;
2862 
2863 	lint_assert(ln != NULL);
2864 	lint_assert(rn != NULL);
2865 
2866 	lt = ln->tn_type->t_tspec;
2867 	rt = rn->tn_type->t_tspec;
2868 
2869 	if ((op == ADDASS || op == SUBASS) && lt == PTR) {
2870 		lint_assert(is_integer(rt));
2871 		ctn = plength(ln->tn_type);
2872 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2873 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2874 		rn = new_tnode(MULT, rn->tn_type, rn, ctn);
2875 		if (rn->tn_left->tn_op == CON)
2876 			rn = fold(rn);
2877 	}
2878 
2879 	if ((op == ASSIGN || op == RETURN || op == INIT) &&
2880 	    (lt == STRUCT || rt == STRUCT)) {
2881 		lint_assert(lt == rt);
2882 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
2883 		if (is_incomplete(ln->tn_type)) {
2884 			if (op == RETURN) {
2885 				/* cannot return incomplete type */
2886 				error(212);
2887 			} else {
2888 				/* unknown operand size, op %s */
2889 				error(138, op_name(op));
2890 			}
2891 			return NULL;
2892 		}
2893 	}
2894 
2895 	if (op == SHLASS) {
2896 		if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
2897 			if (hflag)
2898 				/* semantics of '%s' change in ANSI C; ... */
2899 				warning(118, "<<=");
2900 		}
2901 	} else if (op != SHRASS) {
2902 		if (op == ASSIGN || lt != PTR) {
2903 			if (lt != rt ||
2904 			    (ln->tn_type->t_bitfield && rn->tn_op == CON)) {
2905 				rn = convert(op, 0, ln->tn_type, rn);
2906 				rt = lt;
2907 			}
2908 		}
2909 	}
2910 
2911 	ntn = new_tnode(op, ln->tn_type, ln, rn);
2912 
2913 	return ntn;
2914 }
2915 
2916 /*
2917  * Get length of type tp->t_subt.
2918  */
2919 static tnode_t *
2920 plength(type_t *tp)
2921 {
2922 	int	elem, elsz;
2923 
2924 	lint_assert(tp->t_tspec == PTR);
2925 	tp = tp->t_subt;
2926 
2927 	elem = 1;
2928 	elsz = 0;
2929 
2930 	while (tp->t_tspec == ARRAY) {
2931 		elem *= tp->t_dim;
2932 		tp = tp->t_subt;
2933 	}
2934 
2935 	switch (tp->t_tspec) {
2936 	case FUNC:
2937 		/* pointer to function is not allowed here */
2938 		error(110);
2939 		break;
2940 	case VOID:
2941 		/* cannot do pointer arithmetic on operand of unknown size */
2942 		gnuism(136);
2943 		break;
2944 	case STRUCT:
2945 	case UNION:
2946 		if ((elsz = tp->t_str->sou_size_in_bits) == 0)
2947 			/* cannot do pointer arithmetic on operand of ... */
2948 			error(136);
2949 		break;
2950 	case ENUM:
2951 		if (is_incomplete(tp)) {
2952 			/* cannot do pointer arithmetic on operand of ... */
2953 			warning(136);
2954 		}
2955 		/* FALLTHROUGH */
2956 	default:
2957 		if ((elsz = size_in_bits(tp->t_tspec)) == 0) {
2958 			/* cannot do pointer arithmetic on operand of ... */
2959 			error(136);
2960 		} else {
2961 			lint_assert(elsz != -1);
2962 		}
2963 		break;
2964 	}
2965 
2966 	if (elem == 0 && elsz != 0) {
2967 		/* cannot do pointer arithmetic on operand of unknown size */
2968 		error(136);
2969 	}
2970 
2971 	if (elsz == 0)
2972 		elsz = CHAR_SIZE;
2973 
2974 	return build_integer_constant(PTRDIFF_TSPEC,
2975 	    (int64_t)(elem * elsz / CHAR_SIZE));
2976 }
2977 
2978 /*
2979  * XXX
2980  * Note: There appear to be a number of bugs in detecting overflow in
2981  * this function. An audit and a set of proper regression tests are needed.
2982  *     --Perry Metzger, Nov. 16, 2001
2983  */
2984 /*
2985  * Do only as much as necessary to compute constant expressions.
2986  * Called only if the operator allows folding and all operands are constants.
2987  */
2988 static tnode_t *
2989 fold(tnode_t *tn)
2990 {
2991 	val_t	*v;
2992 	tspec_t	t;
2993 	bool	utyp, ovfl;
2994 	int64_t	sl, sr = 0, q = 0, mask;
2995 	uint64_t ul, ur = 0;
2996 	tnode_t	*cn;
2997 
2998 	v = xcalloc(1, sizeof(*v));
2999 	v->v_tspec = t = tn->tn_type->t_tspec;
3000 
3001 	utyp = t == PTR || is_uinteger(t);
3002 	ul = sl = tn->tn_left->tn_val->v_quad;
3003 	if (modtab[tn->tn_op].m_binary)
3004 		ur = sr = tn->tn_right->tn_val->v_quad;
3005 
3006 	mask = value_bits(size_in_bits(t));
3007 	ovfl = false;
3008 
3009 	switch (tn->tn_op) {
3010 	case UPLUS:
3011 		q = sl;
3012 		break;
3013 	case UMINUS:
3014 		q = -sl;
3015 		if (sl != 0 && msb(q, t, -1) == msb(sl, t, -1))
3016 			ovfl = true;
3017 		break;
3018 	case COMPL:
3019 		q = ~sl;
3020 		break;
3021 	case MULT:
3022 		if (utyp) {
3023 			q = ul * ur;
3024 			if (q != (q & mask))
3025 				ovfl = true;
3026 			else if ((ul != 0) && ((q / ul) != ur))
3027 				ovfl = true;
3028 		} else {
3029 			q = sl * sr;
3030 			if (msb(q, t, -1) != (msb(sl, t, -1) ^ msb(sr, t, -1)))
3031 				ovfl = true;
3032 		}
3033 		break;
3034 	case DIV:
3035 		if (sr == 0) {
3036 			/* division by 0 */
3037 			error(139);
3038 			q = utyp ? UQUAD_MAX : QUAD_MAX;
3039 		} else {
3040 			q = utyp ? (int64_t)(ul / ur) : sl / sr;
3041 		}
3042 		break;
3043 	case MOD:
3044 		if (sr == 0) {
3045 			/* modulus by 0 */
3046 			error(140);
3047 			q = 0;
3048 		} else {
3049 			q = utyp ? (int64_t)(ul % ur) : sl % sr;
3050 		}
3051 		break;
3052 	case PLUS:
3053 		q = utyp ? (int64_t)(ul + ur) : sl + sr;
3054 		if (msb(sl, t, -1)  != 0 && msb(sr, t, -1) != 0) {
3055 			if (msb(q, t, -1) == 0)
3056 				ovfl = true;
3057 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) == 0) {
3058 			if (msb(q, t, -1) != 0)
3059 				ovfl = true;
3060 		}
3061 		break;
3062 	case MINUS:
3063 		q = utyp ? (int64_t)(ul - ur) : sl - sr;
3064 		if (msb(sl, t, -1) != 0 && msb(sr, t, -1) == 0) {
3065 			if (msb(q, t, -1) == 0)
3066 				ovfl = true;
3067 		} else if (msb(sl, t, -1) == 0 && msb(sr, t, -1) != 0) {
3068 			if (msb(q, t, -1) != 0)
3069 				ovfl = true;
3070 		}
3071 		break;
3072 	case SHL:
3073 		q = utyp ? (int64_t)(ul << sr) : sl << sr;
3074 		break;
3075 	case SHR:
3076 		/*
3077 		 * The sign must be explicitly extended because
3078 		 * shifts of signed values are implementation dependent.
3079 		 */
3080 		q = ul >> sr;
3081 		q = convert_integer(q, t, size_in_bits(t) - (int)sr);
3082 		break;
3083 	case LT:
3084 		q = (utyp ? ul < ur : sl < sr) ? 1 : 0;
3085 		break;
3086 	case LE:
3087 		q = (utyp ? ul <= ur : sl <= sr) ? 1 : 0;
3088 		break;
3089 	case GE:
3090 		q = (utyp ? ul >= ur : sl >= sr) ? 1 : 0;
3091 		break;
3092 	case GT:
3093 		q = (utyp ? ul > ur : sl > sr) ? 1 : 0;
3094 		break;
3095 	case EQ:
3096 		q = (utyp ? ul == ur : sl == sr) ? 1 : 0;
3097 		break;
3098 	case NE:
3099 		q = (utyp ? ul != ur : sl != sr) ? 1 : 0;
3100 		break;
3101 	case BITAND:
3102 		q = utyp ? (int64_t)(ul & ur) : sl & sr;
3103 		break;
3104 	case BITXOR:
3105 		q = utyp ? (int64_t)(ul ^ ur) : sl ^ sr;
3106 		break;
3107 	case BITOR:
3108 		q = utyp ? (int64_t)(ul | ur) : sl | sr;
3109 		break;
3110 	default:
3111 		lint_assert(/*CONSTCOND*/false);
3112 	}
3113 
3114 	/* XXX does not work for quads. */
3115 	if (ovfl || ((uint64_t)(q | mask) != ~(uint64_t)0 &&
3116 	    (q & ~mask) != 0)) {
3117 		if (hflag)
3118 			/* integer overflow detected, op %s */
3119 			warning(141, op_name(tn->tn_op));
3120 	}
3121 
3122 	v->v_quad = convert_integer(q, t, -1);
3123 
3124 	cn = build_constant(tn->tn_type, v);
3125 	if (tn->tn_left->tn_system_dependent)
3126 		cn->tn_system_dependent = true;
3127 	if (modtab[tn->tn_op].m_binary && tn->tn_right->tn_system_dependent)
3128 		cn->tn_system_dependent = true;
3129 
3130 	return cn;
3131 }
3132 
3133 /*
3134  * Fold constant nodes, as much as is needed for comparing the value with 0
3135  * (test context, for controlling expressions).
3136  */
3137 static tnode_t *
3138 fold_test(tnode_t *tn)
3139 {
3140 	bool	l, r;
3141 	val_t	*v;
3142 
3143 	v = xcalloc(1, sizeof(*v));
3144 	v->v_tspec = tn->tn_type->t_tspec;
3145 	lint_assert(v->v_tspec == INT || (Tflag && v->v_tspec == BOOL));
3146 
3147 	l = constant_is_nonzero(tn->tn_left);
3148 	r = modtab[tn->tn_op].m_binary && constant_is_nonzero(tn->tn_right);
3149 
3150 	switch (tn->tn_op) {
3151 	case NOT:
3152 		if (hflag && !constcond_flag)
3153 			/* constant argument to '!' */
3154 			warning(239);
3155 		v->v_quad = !l ? 1 : 0;
3156 		break;
3157 	case LOGAND:
3158 		v->v_quad = l && r ? 1 : 0;
3159 		break;
3160 	case LOGOR:
3161 		v->v_quad = l || r ? 1 : 0;
3162 		break;
3163 	default:
3164 		lint_assert(/*CONSTCOND*/false);
3165 	}
3166 
3167 	return build_constant(tn->tn_type, v);
3168 }
3169 
3170 /*
3171  * Fold constant nodes having operands with floating point type.
3172  */
3173 static tnode_t *
3174 fold_float(tnode_t *tn)
3175 {
3176 	val_t	*v;
3177 	tspec_t	t;
3178 	ldbl_t	l, r = 0;
3179 
3180 	fpe = 0;
3181 	v = xcalloc(1, sizeof(*v));
3182 	v->v_tspec = t = tn->tn_type->t_tspec;
3183 
3184 	lint_assert(is_floating(t));
3185 	lint_assert(t == tn->tn_left->tn_type->t_tspec);
3186 	lint_assert(!modtab[tn->tn_op].m_binary ||
3187 	    t == tn->tn_right->tn_type->t_tspec);
3188 
3189 	l = tn->tn_left->tn_val->v_ldbl;
3190 	if (modtab[tn->tn_op].m_binary)
3191 		r = tn->tn_right->tn_val->v_ldbl;
3192 
3193 	switch (tn->tn_op) {
3194 	case UPLUS:
3195 		v->v_ldbl = l;
3196 		break;
3197 	case UMINUS:
3198 		v->v_ldbl = -l;
3199 		break;
3200 	case MULT:
3201 		v->v_ldbl = l * r;
3202 		break;
3203 	case DIV:
3204 		if (r == 0.0) {
3205 			/* division by 0 */
3206 			error(139);
3207 			if (t == FLOAT) {
3208 				v->v_ldbl = l < 0 ? -FLT_MAX : FLT_MAX;
3209 			} else if (t == DOUBLE) {
3210 				v->v_ldbl = l < 0 ? -DBL_MAX : DBL_MAX;
3211 			} else {
3212 				v->v_ldbl = l < 0 ? -LDBL_MAX : LDBL_MAX;
3213 			}
3214 		} else {
3215 			v->v_ldbl = l / r;
3216 		}
3217 		break;
3218 	case PLUS:
3219 		v->v_ldbl = l + r;
3220 		break;
3221 	case MINUS:
3222 		v->v_ldbl = l - r;
3223 		break;
3224 	case LT:
3225 		v->v_quad = l < r ? 1 : 0;
3226 		break;
3227 	case LE:
3228 		v->v_quad = l <= r ? 1 : 0;
3229 		break;
3230 	case GE:
3231 		v->v_quad = l >= r ? 1 : 0;
3232 		break;
3233 	case GT:
3234 		v->v_quad = l > r ? 1 : 0;
3235 		break;
3236 	case EQ:
3237 		v->v_quad = l == r ? 1 : 0;
3238 		break;
3239 	case NE:
3240 		v->v_quad = l != r ? 1 : 0;
3241 		break;
3242 	default:
3243 		lint_assert(/*CONSTCOND*/false);
3244 	}
3245 
3246 	lint_assert(fpe != 0 || isnan((double)v->v_ldbl) == 0);
3247 	if (fpe != 0 || finite((double)v->v_ldbl) == 0 ||
3248 	    (t == FLOAT &&
3249 	     (v->v_ldbl > FLT_MAX || v->v_ldbl < -FLT_MAX)) ||
3250 	    (t == DOUBLE &&
3251 	     (v->v_ldbl > DBL_MAX || v->v_ldbl < -DBL_MAX))) {
3252 		/* floating point overflow detected, op %s */
3253 		warning(142, op_name(tn->tn_op));
3254 		if (t == FLOAT) {
3255 			v->v_ldbl = v->v_ldbl < 0 ? -FLT_MAX : FLT_MAX;
3256 		} else if (t == DOUBLE) {
3257 			v->v_ldbl = v->v_ldbl < 0 ? -DBL_MAX : DBL_MAX;
3258 		} else {
3259 			v->v_ldbl = v->v_ldbl < 0 ? -LDBL_MAX: LDBL_MAX;
3260 		}
3261 	    fpe = 0;
3262 	}
3263 
3264 	return build_constant(tn->tn_type, v);
3265 }
3266 
3267 
3268 /*
3269  * Create a constant node for sizeof.
3270  */
3271 tnode_t *
3272 build_sizeof(const type_t *tp)
3273 {
3274 	int64_t size_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3275 	tnode_t *tn = build_integer_constant(SIZEOF_TSPEC, size_in_bytes);
3276 	tn->tn_system_dependent = true;
3277 	return tn;
3278 }
3279 
3280 /*
3281  * Create a constant node for offsetof.
3282  */
3283 tnode_t *
3284 build_offsetof(const type_t *tp, const sym_t *sym)
3285 {
3286 	tspec_t t = tp->t_tspec;
3287 	if (t != STRUCT && t != UNION)
3288 		/* unacceptable operand of '%s' */
3289 		error(111, "offsetof");
3290 
3291 	// XXX: wrong size, no checking for sym fixme
3292 	int64_t offset_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3293 	tnode_t *tn = build_integer_constant(SIZEOF_TSPEC, offset_in_bytes);
3294 	tn->tn_system_dependent = true;
3295 	return tn;
3296 }
3297 
3298 int64_t
3299 type_size_in_bits(const type_t *tp)
3300 {
3301 	int	elem, elsz;
3302 	bool	flex;
3303 
3304 	elem = 1;
3305 	flex = false;
3306 	while (tp->t_tspec == ARRAY) {
3307 		flex = true;	/* allow c99 flex arrays [] [0] */
3308 		elem *= tp->t_dim;
3309 		tp = tp->t_subt;
3310 	}
3311 	if (elem == 0) {
3312 		if (!flex) {
3313 			/* cannot take size/alignment of incomplete type */
3314 			error(143);
3315 			elem = 1;
3316 		}
3317 	}
3318 	switch (tp->t_tspec) {
3319 	case FUNC:
3320 		/* cannot take size/alignment of function */
3321 		error(144);
3322 		elsz = 1;
3323 		break;
3324 	case STRUCT:
3325 	case UNION:
3326 		if (is_incomplete(tp)) {
3327 			/* cannot take size/alignment of incomplete type */
3328 			error(143);
3329 			elsz = 1;
3330 		} else {
3331 			elsz = tp->t_str->sou_size_in_bits;
3332 		}
3333 		break;
3334 	case ENUM:
3335 		if (is_incomplete(tp)) {
3336 			/* cannot take size/alignment of incomplete type */
3337 			warning(143);
3338 		}
3339 		/* FALLTHROUGH */
3340 	default:
3341 		if (tp->t_bitfield) {
3342 			/* cannot take size/alignment of bit-field */
3343 			error(145);
3344 		}
3345 		if (tp->t_tspec == VOID) {
3346 			/* cannot take size/alignment of void */
3347 			error(146);
3348 			elsz = 1;
3349 		} else {
3350 			elsz = size_in_bits(tp->t_tspec);
3351 			lint_assert(elsz > 0);
3352 		}
3353 		break;
3354 	}
3355 
3356 	return (int64_t)elem * elsz;
3357 }
3358 
3359 tnode_t *
3360 build_alignof(const type_t *tp)
3361 {
3362 	switch (tp->t_tspec) {
3363 	case ARRAY:
3364 		break;
3365 
3366 	case FUNC:
3367 		/* cannot take size/alignment of function */
3368 		error(144);
3369 		return 0;
3370 
3371 	case STRUCT:
3372 	case UNION:
3373 		if (is_incomplete(tp)) {
3374 			/* cannot take size/alignment of incomplete type */
3375 			error(143);
3376 			return 0;
3377 		}
3378 		break;
3379 	case ENUM:
3380 		break;
3381 	default:
3382 		if (tp->t_bitfield) {
3383 			/* cannot take size/alignment of bit-field */
3384 			error(145);
3385 			return 0;
3386 		}
3387 		if (tp->t_tspec == VOID) {
3388 			/* cannot take size/alignment of void */
3389 			error(146);
3390 			return 0;
3391 		}
3392 		break;
3393 	}
3394 
3395 	return build_integer_constant(SIZEOF_TSPEC,
3396 	    (int64_t)alignment_in_bits(tp) / CHAR_SIZE);
3397 }
3398 
3399 /*
3400  * Type casts.
3401  */
3402 tnode_t *
3403 cast(tnode_t *tn, type_t *tp)
3404 {
3405 	tspec_t	nt, ot;
3406 
3407 	if (tn == NULL)
3408 		return NULL;
3409 
3410 	/*
3411 	 * XXX: checking for tp == NULL is only a quick fix for PR 22119.
3412 	 *  The proper fix needs to be investigated properly.
3413 	 *  See d_pr_22119.c for how to get here.
3414 	 */
3415 	if (tp == NULL)
3416 		return NULL;
3417 
3418 	tn = cconv(tn);
3419 
3420 	nt = tp->t_tspec;
3421 	ot = tn->tn_type->t_tspec;
3422 
3423 	if (nt == VOID) {
3424 		/*
3425 		 * XXX ANSI C requires scalar types or void (Plauger & Brodie).
3426 		 * But this seems really questionable.
3427 		 */
3428 	} else if (nt == UNION) {
3429 		sym_t *m;
3430 		struct_or_union *str = tp->t_str;
3431 		if (!gflag) {
3432 			/* union cast is a GCC extension */
3433 			error(328);
3434 			return NULL;
3435 		}
3436 		for (m = str->sou_first_member; m != NULL; m = m->s_next) {
3437 			if (eqtype(m->s_type, tn->tn_type,
3438 			    false, false, NULL)) {
3439 				tn = expr_zalloc_tnode();
3440 				tn->tn_op = CVT;
3441 				tn->tn_type = tp;
3442 				tn->tn_cast = true;
3443 				tn->tn_right = NULL;
3444 				return tn;
3445 			}
3446 		}
3447 		/* type '%s' is not a member of '%s' */
3448 		error(329, type_name(tn->tn_type), type_name(tp));
3449 		return NULL;
3450 	} else if (nt == STRUCT || nt == ARRAY || nt == FUNC) {
3451 		/* Casting to a struct is an undocumented GCC extension. */
3452 		if (!(gflag && nt == STRUCT))
3453 			goto invalid_cast;
3454 	} else if (ot == STRUCT || ot == UNION) {
3455 		goto invalid_cast;
3456 	} else if (ot == VOID) {
3457 		/* improper cast of void expression */
3458 		error(148);
3459 		return NULL;
3460 	} else if (is_integer(nt) && is_scalar(ot)) {
3461 		/* ok */
3462 	} else if (is_floating(nt) && is_arithmetic(ot)) {
3463 		/* ok */
3464 	} else if (nt == PTR && is_integer(ot)) {
3465 		/* ok */
3466 	} else if (nt == PTR && ot == PTR) {
3467 		if (!tp->t_subt->t_const && tn->tn_type->t_subt->t_const) {
3468 			if (hflag)
3469 				/* cast discards 'const' from type '%s' */
3470 				warning(275, type_name(tn->tn_type));
3471 		}
3472 	} else
3473 		goto invalid_cast;
3474 
3475 	tn = convert(CVT, 0, tp, tn);
3476 	tn->tn_cast = true;
3477 
3478 	return tn;
3479 
3480 invalid_cast:
3481 	/* invalid cast from '%s' to '%s' */
3482 	error(147, type_name(tn->tn_type), type_name(tp));
3483 	return NULL;
3484 }
3485 
3486 /*
3487  * Create the node for a function argument.
3488  * All necessary conversions and type checks are done in
3489  * build_function_call because build_function_argument has no
3490  * information about expected argument types.
3491  */
3492 tnode_t *
3493 build_function_argument(tnode_t *args, tnode_t *arg)
3494 {
3495 	tnode_t	*ntn;
3496 
3497 	/*
3498 	 * If there was a serious error in the expression for the argument,
3499 	 * create a dummy argument so the positions of the remaining arguments
3500 	 * will not change.
3501 	 */
3502 	if (arg == NULL)
3503 		arg = build_integer_constant(INT, 0);
3504 
3505 	ntn = new_tnode(PUSH, arg->tn_type, arg, args);
3506 
3507 	return ntn;
3508 }
3509 
3510 /*
3511  * Create the node for a function call. Also check types of
3512  * function arguments and insert conversions, if necessary.
3513  */
3514 tnode_t *
3515 build_function_call(tnode_t *func, tnode_t *args)
3516 {
3517 	tnode_t	*ntn;
3518 	op_t	fcop;
3519 
3520 	if (func == NULL)
3521 		return NULL;
3522 
3523 	if (func->tn_op == NAME && func->tn_type->t_tspec == FUNC) {
3524 		fcop = CALL;
3525 	} else {
3526 		fcop = ICALL;
3527 	}
3528 
3529 	check_ctype_function_call(func, args);
3530 
3531 	/*
3532 	 * after cconv() func will always be a pointer to a function
3533 	 * if it is a valid function designator.
3534 	 */
3535 	func = cconv(func);
3536 
3537 	if (func->tn_type->t_tspec != PTR ||
3538 	    func->tn_type->t_subt->t_tspec != FUNC) {
3539 		/* illegal function (type %s) */
3540 		error(149, type_name(func->tn_type));
3541 		return NULL;
3542 	}
3543 
3544 	args = check_function_arguments(func->tn_type->t_subt, args);
3545 
3546 	ntn = new_tnode(fcop, func->tn_type->t_subt->t_subt, func, args);
3547 
3548 	return ntn;
3549 }
3550 
3551 /*
3552  * Check types of all function arguments and insert conversions,
3553  * if necessary.
3554  */
3555 static tnode_t *
3556 check_function_arguments(type_t *ftp, tnode_t *args)
3557 {
3558 	tnode_t	*arg;
3559 	sym_t	*asym;
3560 	tspec_t	at;
3561 	int	narg, npar, n, i;
3562 
3563 	/* get # of args in the prototype */
3564 	npar = 0;
3565 	for (asym = ftp->t_args; asym != NULL; asym = asym->s_next)
3566 		npar++;
3567 
3568 	/* get # of args in function call */
3569 	narg = 0;
3570 	for (arg = args; arg != NULL; arg = arg->tn_right)
3571 		narg++;
3572 
3573 	asym = ftp->t_args;
3574 	if (ftp->t_proto && npar != narg && !(ftp->t_vararg && npar < narg)) {
3575 		/* argument mismatch: %d arg%s passed, %d expected */
3576 		error(150, narg, narg > 1 ? "s" : "", npar);
3577 		asym = NULL;
3578 	}
3579 
3580 	for (n = 1; n <= narg; n++) {
3581 
3582 		/*
3583 		 * The rightmost argument is at the top of the argument
3584 		 * subtree.
3585 		 */
3586 		for (i = narg, arg = args; i > n; i--, arg = arg->tn_right)
3587 			continue;
3588 
3589 		/* some things which are always not allowed */
3590 		if ((at = arg->tn_left->tn_type->t_tspec) == VOID) {
3591 			/* void expressions may not be arguments, arg #%d */
3592 			error(151, n);
3593 			return NULL;
3594 		} else if ((at == STRUCT || at == UNION) &&
3595 			   is_incomplete(arg->tn_left->tn_type)) {
3596 			/* argument cannot have unknown size, arg #%d */
3597 			error(152, n);
3598 			return NULL;
3599 		} else if (is_integer(at) &&
3600 			   arg->tn_left->tn_type->t_is_enum &&
3601 			   is_incomplete(arg->tn_left->tn_type)) {
3602 			/* argument cannot have unknown size, arg #%d */
3603 			warning(152, n);
3604 		}
3605 
3606 		/* class conversions (arg in value context) */
3607 		arg->tn_left = cconv(arg->tn_left);
3608 
3609 		if (asym != NULL) {
3610 			arg->tn_left = check_prototype_argument(
3611 			    n, asym->s_type, arg->tn_left);
3612 		} else {
3613 			arg->tn_left = promote(NOOP, true, arg->tn_left);
3614 		}
3615 		arg->tn_type = arg->tn_left->tn_type;
3616 
3617 		if (asym != NULL)
3618 			asym = asym->s_next;
3619 	}
3620 
3621 	return args;
3622 }
3623 
3624 /*
3625  * Compare the type of an argument with the corresponding type of a
3626  * prototype parameter. If it is a valid combination, but both types
3627  * are not the same, insert a conversion to convert the argument into
3628  * the type of the parameter.
3629  */
3630 static tnode_t *
3631 check_prototype_argument(
3632 	int	n,		/* pos of arg */
3633 	type_t	*tp,		/* expected type (from prototype) */
3634 	tnode_t	*tn)		/* argument */
3635 {
3636 	tnode_t	*ln;
3637 	bool	dowarn;
3638 
3639 	ln = xcalloc(1, sizeof(*ln));
3640 	ln->tn_type = expr_unqualified_type(tp);
3641 	ln->tn_lvalue = true;
3642 	if (typeok(FARG, n, ln, tn)) {
3643 		if (!eqtype(tp, tn->tn_type,
3644 		    true, false, (dowarn = false, &dowarn)) || dowarn)
3645 			tn = convert(FARG, n, tp, tn);
3646 	}
3647 	free(ln);
3648 	return tn;
3649 }
3650 
3651 /*
3652  * Return the value of an integral constant expression.
3653  * If the expression is not constant or its type is not an integer
3654  * type, an error message is printed.
3655  */
3656 val_t *
3657 constant(tnode_t *tn, bool required)
3658 {
3659 	val_t	*v;
3660 
3661 	if (tn != NULL)
3662 		tn = cconv(tn);
3663 	if (tn != NULL)
3664 		tn = promote(NOOP, false, tn);
3665 
3666 	v = xcalloc(1, sizeof(*v));
3667 
3668 	if (tn == NULL) {
3669 		lint_assert(nerr != 0);
3670 		debug_step("constant node is null; returning 1 instead");
3671 		v->v_tspec = INT;
3672 		v->v_quad = 1;
3673 		return v;
3674 	}
3675 
3676 	v->v_tspec = tn->tn_type->t_tspec;
3677 
3678 	if (tn->tn_op == CON) {
3679 		lint_assert(tn->tn_type->t_tspec == tn->tn_val->v_tspec);
3680 		if (is_integer(tn->tn_val->v_tspec)) {
3681 			v->v_unsigned_since_c90 =
3682 			    tn->tn_val->v_unsigned_since_c90;
3683 			v->v_quad = tn->tn_val->v_quad;
3684 			return v;
3685 		}
3686 		v->v_quad = tn->tn_val->v_ldbl;
3687 	} else {
3688 		v->v_quad = 1;
3689 	}
3690 
3691 	if (required)
3692 		/* integral constant expression expected */
3693 		error(55);
3694 	else
3695 		/* variable array dimension is a C99/GCC extension */
3696 		c99ism(318);
3697 
3698 	if (!is_integer(v->v_tspec))
3699 		v->v_tspec = INT;
3700 
3701 	return v;
3702 }
3703 
3704 static bool
3705 is_constcond_false(const tnode_t *tn, tspec_t t)
3706 {
3707 	return (t == BOOL || t == INT) &&
3708 	       tn->tn_op == CON && tn->tn_val->v_quad == 0;
3709 }
3710 
3711 /*
3712  * Perform some tests on expressions which can't be done in build_binary()
3713  * and functions called by build_binary(). These tests must be done here
3714  * because we need some information about the context in which the operations
3715  * are performed.
3716  * After all tests are performed and dofreeblk is true, expr() frees the
3717  * memory which is used for the expression.
3718  */
3719 void
3720 expr(tnode_t *tn, bool vctx, bool tctx, bool dofreeblk, bool is_do_while)
3721 {
3722 
3723 	if (tn == NULL) {	/* in case of errors */
3724 		expr_free_all();
3725 		return;
3726 	}
3727 
3728 	/* expr() is also called in global initializations */
3729 	if (dcs->d_ctx != EXTERN && !is_do_while)
3730 		check_statement_reachable();
3731 
3732 	check_expr_misc(tn, vctx, tctx, !tctx, false, false, false);
3733 	if (tn->tn_op == ASSIGN) {
3734 		if (hflag && tctx)
3735 			/* assignment in conditional context */
3736 			warning(159);
3737 	} else if (tn->tn_op == CON) {
3738 		if (hflag && tctx && !constcond_flag &&
3739 		    !tn->tn_system_dependent &&
3740 		    !(is_do_while &&
3741 		      is_constcond_false(tn, tn->tn_type->t_tspec)))
3742 			/* constant in conditional context */
3743 			warning(161);
3744 	}
3745 	if (!modtab[tn->tn_op].m_has_side_effect) {
3746 		/*
3747 		 * for left operands of COMMA this warning is already
3748 		 * printed
3749 		 */
3750 		if (tn->tn_op != COMMA && !vctx && !tctx)
3751 			check_null_effect(tn);
3752 	}
3753 	debug_node(tn);
3754 
3755 	/* free the tree memory */
3756 	if (dofreeblk)
3757 		expr_free_all();
3758 }
3759 
3760 static bool
3761 has_side_effect(const tnode_t *tn) // NOLINT(misc-no-recursion)
3762 {
3763 	op_t op = tn->tn_op;
3764 
3765 	if (modtab[op].m_has_side_effect)
3766 		return true;
3767 
3768 	if (op == CVT && tn->tn_type->t_tspec == VOID)
3769 		return has_side_effect(tn->tn_left);
3770 
3771 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3772 	if (op == LOGAND || op == LOGOR)
3773 		return has_side_effect(tn->tn_right);
3774 
3775 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3776 	if (op == QUEST)
3777 		return has_side_effect(tn->tn_right);
3778 
3779 	if (op == COLON || op == COMMA) {
3780 		return has_side_effect(tn->tn_left) ||
3781 		       has_side_effect(tn->tn_right);
3782 	}
3783 
3784 	return false;
3785 }
3786 
3787 static void
3788 check_null_effect(const tnode_t *tn)
3789 {
3790 
3791 	if (hflag && !has_side_effect(tn)) {
3792 		/* expression has null effect */
3793 		warning(129);
3794 	}
3795 }
3796 
3797 /* ARGSUSED */
3798 void
3799 check_expr_misc(const tnode_t *tn, bool vctx, bool tctx,
3800 		bool eqwarn, bool fcall, bool rvdisc, bool szof)
3801 {
3802 	tnode_t	*ln, *rn;
3803 	const mod_t *mp;
3804 	op_t	op;
3805 	scl_t	sc;
3806 	dinfo_t	*di;
3807 
3808 	if (tn == NULL)
3809 		return;
3810 
3811 	ln = tn->tn_left;
3812 	rn = tn->tn_right;
3813 	mp = &modtab[op = tn->tn_op];
3814 
3815 	switch (op) {
3816 	case ADDR:
3817 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3818 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3819 			if (!szof)
3820 				mark_as_set(ln->tn_sym);
3821 			mark_as_used(ln->tn_sym, fcall, szof);
3822 		}
3823 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3824 			/* check the range of array indices */
3825 			check_array_index(ln->tn_left, true);
3826 		break;
3827 	case LOAD:
3828 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3829 			/* check the range of array indices */
3830 			check_array_index(ln->tn_left, false);
3831 		/* FALLTHROUGH */
3832 	case PUSH:
3833 	case INCBEF:
3834 	case DECBEF:
3835 	case INCAFT:
3836 	case DECAFT:
3837 	case ADDASS:
3838 	case SUBASS:
3839 	case MULASS:
3840 	case DIVASS:
3841 	case MODASS:
3842 	case ANDASS:
3843 	case ORASS:
3844 	case XORASS:
3845 	case SHLASS:
3846 	case SHRASS:
3847 	case REAL:
3848 	case IMAG:
3849 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3850 		if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
3851 			sc = ln->tn_sym->s_scl;
3852 			/*
3853 			 * Look if there was a asm statement in one of the
3854 			 * compound statements we are in. If not, we don't
3855 			 * print a warning.
3856 			 */
3857 			for (di = dcs; di != NULL; di = di->d_next) {
3858 				if (di->d_asm)
3859 					break;
3860 			}
3861 			if (sc != EXTERN && sc != STATIC &&
3862 			    !ln->tn_sym->s_set && !szof && di == NULL) {
3863 				/* %s may be used before set */
3864 				warning(158, ln->tn_sym->s_name);
3865 				mark_as_set(ln->tn_sym);
3866 			}
3867 			mark_as_used(ln->tn_sym, false, false);
3868 		}
3869 		break;
3870 	case ASSIGN:
3871 		/* XXX: Taking warn_about_unreachable into account here feels wrong. */
3872 		if (ln->tn_op == NAME && !szof && (reached || !warn_about_unreachable)) {
3873 			mark_as_set(ln->tn_sym);
3874 			if (ln->tn_sym->s_scl == EXTERN)
3875 				outusg(ln->tn_sym);
3876 		}
3877 		if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
3878 			/* check the range of array indices */
3879 			check_array_index(ln->tn_left, false);
3880 		break;
3881 	case CALL:
3882 		lint_assert(ln->tn_op == ADDR);
3883 		lint_assert(ln->tn_left->tn_op == NAME);
3884 		if (!szof)
3885 			outcall(tn, vctx || tctx, rvdisc);
3886 		break;
3887 	case EQ:
3888 		if (hflag && eqwarn)
3889 			/* operator '==' found where '=' was expected */
3890 			warning(160);
3891 		break;
3892 	case CON:
3893 	case NAME:
3894 	case STRING:
3895 		return;
3896 		/* LINTED206: (enumeration values not handled in switch) */
3897 	case BITOR:
3898 	case BITXOR:
3899 	case NE:
3900 	case GE:
3901 	case GT:
3902 	case LE:
3903 	case LT:
3904 	case SHR:
3905 	case SHL:
3906 	case MINUS:
3907 	case PLUS:
3908 	case MOD:
3909 	case DIV:
3910 	case MULT:
3911 	case INDIR:
3912 	case UMINUS:
3913 	case UPLUS:
3914 	case DEC:
3915 	case INC:
3916 	case COMPL:
3917 	case NOT:
3918 	case POINT:
3919 	case ARROW:
3920 	case NOOP:
3921 	case BITAND:
3922 	case FARG:
3923 	case CASE:
3924 	case INIT:
3925 	case RETURN:
3926 	case ICALL:
3927 	case CVT:
3928 	case COMMA:
3929 	case FSEL:
3930 	case COLON:
3931 	case QUEST:
3932 	case LOGOR:
3933 	case LOGAND:
3934 		break;
3935 	}
3936 
3937 	bool cvctx = mp->m_left_value_context;
3938 	bool ctctx = mp->m_left_test_context;
3939 	bool eq = mp->m_warn_if_operand_eq &&
3940 		  !ln->tn_parenthesized &&
3941 		  rn != NULL && !rn->tn_parenthesized;
3942 
3943 	/*
3944 	 * values of operands of ':' are not used if the type of at least
3945 	 * one of the operands (for gcc compatibility) is void
3946 	 * XXX test/value context of QUEST should probably be used as
3947 	 * context for both operands of COLON
3948 	 */
3949 	if (op == COLON && tn->tn_type->t_tspec == VOID)
3950 		cvctx = ctctx = false;
3951 	bool discard = op == CVT && tn->tn_type->t_tspec == VOID;
3952 	check_expr_misc(ln, cvctx, ctctx, eq, op == CALL, discard, szof);
3953 
3954 	switch (op) {
3955 	case PUSH:
3956 		if (rn != NULL)
3957 			check_expr_misc(rn, false, false, eq, false, false,
3958 			    szof);
3959 		break;
3960 	case LOGAND:
3961 	case LOGOR:
3962 		check_expr_misc(rn, false, true, eq, false, false, szof);
3963 		break;
3964 	case COLON:
3965 		check_expr_misc(rn, cvctx, ctctx, eq, false, false, szof);
3966 		break;
3967 	case COMMA:
3968 		check_expr_misc(rn, vctx, tctx, eq, false, false, szof);
3969 		break;
3970 	default:
3971 		if (mp->m_binary)
3972 			check_expr_misc(rn, true, false, eq, false, false,
3973 			    szof);
3974 		break;
3975 	}
3976 }
3977 
3978 /*
3979  * Checks the range of array indices, if possible.
3980  * amper is set if only the address of the element is used. This
3981  * means that the index is allowed to refer to the first element
3982  * after the array.
3983  */
3984 static void
3985 check_array_index(tnode_t *tn, bool amper)
3986 {
3987 	int	dim;
3988 	tnode_t	*ln, *rn;
3989 	int	elsz;
3990 	int64_t	con;
3991 
3992 	ln = tn->tn_left;
3993 	rn = tn->tn_right;
3994 
3995 	/* We can only check constant indices. */
3996 	if (rn->tn_op != CON)
3997 		return;
3998 
3999 	/* Return if the left node does not stem from an array. */
4000 	if (ln->tn_op != ADDR)
4001 		return;
4002 	if (ln->tn_left->tn_op != STRING && ln->tn_left->tn_op != NAME)
4003 		return;
4004 	if (ln->tn_left->tn_type->t_tspec != ARRAY)
4005 		return;
4006 
4007 	/*
4008 	 * For incomplete array types, we can print a warning only if
4009 	 * the index is negative.
4010 	 */
4011 	if (is_incomplete(ln->tn_left->tn_type) && rn->tn_val->v_quad >= 0)
4012 		return;
4013 
4014 	/* Get the size of one array element */
4015 	if ((elsz = length(ln->tn_type->t_subt, NULL)) == 0)
4016 		return;
4017 	elsz /= CHAR_SIZE;
4018 
4019 	/* Change the unit of the index from bytes to element size. */
4020 	if (is_uinteger(rn->tn_type->t_tspec)) {
4021 		con = (uint64_t)rn->tn_val->v_quad / elsz;
4022 	} else {
4023 		con = rn->tn_val->v_quad / elsz;
4024 	}
4025 
4026 	dim = ln->tn_left->tn_type->t_dim + (amper ? 1 : 0);
4027 
4028 	if (!is_uinteger(rn->tn_type->t_tspec) && con < 0) {
4029 		/* array subscript cannot be negative: %ld */
4030 		warning(167, (long)con);
4031 	} else if (dim > 0 && (uint64_t)con >= (uint64_t)dim) {
4032 		/* array subscript cannot be > %d: %ld */
4033 		warning(168, dim - 1, (long)con);
4034 	}
4035 }
4036 
4037 /*
4038  * Check for ordered comparisons of unsigned values with 0.
4039  */
4040 static void
4041 check_integer_comparison(op_t op, tnode_t *ln, tnode_t *rn)
4042 {
4043 	tspec_t	lt, rt;
4044 
4045 	lt = ln->tn_type->t_tspec;
4046 	rt = rn->tn_type->t_tspec;
4047 
4048 	if (ln->tn_op != CON && rn->tn_op != CON)
4049 		return;
4050 
4051 	if (!is_integer(lt) || !is_integer(rt))
4052 		return;
4053 
4054 	if ((hflag || pflag) && lt == CHAR && rn->tn_op == CON &&
4055 	    (rn->tn_val->v_quad < 0 ||
4056 	     rn->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
4057 		/* nonportable character comparison, op %s */
4058 		warning(230, op_name(op));
4059 		return;
4060 	}
4061 	if ((hflag || pflag) && rt == CHAR && ln->tn_op == CON &&
4062 	    (ln->tn_val->v_quad < 0 ||
4063 	     ln->tn_val->v_quad > (int)~(~0U << (CHAR_SIZE - 1)))) {
4064 		/* nonportable character comparison, op %s */
4065 		warning(230, op_name(op));
4066 		return;
4067 	}
4068 	if (is_uinteger(lt) && !is_uinteger(rt) &&
4069 	    rn->tn_op == CON && rn->tn_val->v_quad <= 0) {
4070 		if (rn->tn_val->v_quad < 0) {
4071 			/* comparison of %s with %s, op %s */
4072 			warning(162, type_name(ln->tn_type),
4073 			    "negative constant", op_name(op));
4074 		} else if (op == LT || op == GE || (hflag && op == LE)) {
4075 			/* comparison of %s with %s, op %s */
4076 			warning(162, type_name(ln->tn_type), "0", op_name(op));
4077 		}
4078 		return;
4079 	}
4080 	if (is_uinteger(rt) && !is_uinteger(lt) &&
4081 	    ln->tn_op == CON && ln->tn_val->v_quad <= 0) {
4082 		if (ln->tn_val->v_quad < 0) {
4083 			/* comparison of %s with %s, op %s */
4084 			warning(162, "negative constant",
4085 			    type_name(rn->tn_type), op_name(op));
4086 		} else if (op == GT || op == LE || (hflag && op == GE)) {
4087 			/* comparison of %s with %s, op %s */
4088 			warning(162, "0", type_name(rn->tn_type), op_name(op));
4089 		}
4090 		return;
4091 	}
4092 }
4093 
4094 /*
4095  * Return whether the expression can be used for static initialization.
4096  *
4097  * Constant initialization expressions must be constant or an address
4098  * of a static object with an optional offset. In the first case,
4099  * the result is returned in *offsp. In the second case, the static
4100  * object is returned in *symp and the offset in *offsp.
4101  *
4102  * The expression can consist of PLUS, MINUS, ADDR, NAME, STRING and
4103  * CON. Type conversions are allowed if they do not change binary
4104  * representation (including width).
4105  *
4106  * C99 6.6 "Constant expressions"
4107  * C99 6.7.8p4 restricts initializers for static storage duration
4108  */
4109 bool
4110 constant_addr(const tnode_t *tn, const sym_t **symp, ptrdiff_t *offsp)
4111 {
4112 	const sym_t *sym;
4113 	ptrdiff_t offs1, offs2;
4114 	tspec_t	t, ot;
4115 
4116 	switch (tn->tn_op) {
4117 	case MINUS:
4118 		if (tn->tn_right->tn_op == CVT)
4119 			return constant_addr(tn->tn_right, symp, offsp);
4120 		else if (tn->tn_right->tn_op != CON)
4121 			return false;
4122 		/* FALLTHROUGH */
4123 	case PLUS:
4124 		offs1 = offs2 = 0;
4125 		if (tn->tn_left->tn_op == CON) {
4126 			offs1 = (ptrdiff_t)tn->tn_left->tn_val->v_quad;
4127 			if (!constant_addr(tn->tn_right, &sym, &offs2))
4128 				return false;
4129 		} else if (tn->tn_right->tn_op == CON) {
4130 			offs2 = (ptrdiff_t)tn->tn_right->tn_val->v_quad;
4131 			if (tn->tn_op == MINUS)
4132 				offs2 = -offs2;
4133 			if (!constant_addr(tn->tn_left, &sym, &offs1))
4134 				return false;
4135 		} else {
4136 			return false;
4137 		}
4138 		*symp = sym;
4139 		*offsp = offs1 + offs2;
4140 		return true;
4141 	case ADDR:
4142 		if (tn->tn_left->tn_op == NAME) {
4143 			*symp = tn->tn_left->tn_sym;
4144 			*offsp = 0;
4145 			return true;
4146 		} else {
4147 			/*
4148 			 * If this would be the front end of a compiler we
4149 			 * would return a label instead of 0, at least if
4150 			 * 'tn->tn_left->tn_op == STRING'.
4151 			 */
4152 			*symp = NULL;
4153 			*offsp = 0;
4154 			return true;
4155 		}
4156 	case CVT:
4157 		t = tn->tn_type->t_tspec;
4158 		ot = tn->tn_left->tn_type->t_tspec;
4159 		if ((!is_integer(t) && t != PTR) ||
4160 		    (!is_integer(ot) && ot != PTR)) {
4161 			return false;
4162 		}
4163 #ifdef notdef
4164 		/*
4165 		 * consider:
4166 		 *	struct foo {
4167 		 *		unsigned char a;
4168 		 *	} f = {
4169 		 *		(u_char)(u_long)(&(((struct foo *)0)->a))
4170 		 *	};
4171 		 * since psize(u_long) != psize(u_char) this fails.
4172 		 */
4173 		else if (psize(t) != psize(ot))
4174 			return -1;
4175 #endif
4176 		return constant_addr(tn->tn_left, symp, offsp);
4177 	default:
4178 		return false;
4179 	}
4180 }
4181 
4182 /*
4183  * Concatenate two string constants.
4184  */
4185 strg_t *
4186 cat_strings(strg_t *strg1, strg_t *strg2)
4187 {
4188 	size_t	len1, len2, len;
4189 
4190 	if (strg1->st_tspec != strg2->st_tspec) {
4191 		/* cannot concatenate wide and regular string literals */
4192 		error(292);
4193 		return strg1;
4194 	}
4195 
4196 	len1 = strg1->st_len;
4197 	len2 = strg2->st_len + 1;	/* + NUL */
4198 	len = len1 + len2;
4199 
4200 #define COPY(F) \
4201     do { \
4202 	strg1->F = xrealloc(strg1->F, len * sizeof(*strg1->F)); \
4203 	(void)memcpy(strg1->F + len1, strg2->F, len2 * sizeof(*strg1->F)); \
4204 	free(strg2->F); \
4205     } while (false)
4206 
4207 	if (strg1->st_tspec == CHAR)
4208 		COPY(st_cp);
4209 	else
4210 		COPY(st_wcp);
4211 
4212 	strg1->st_len = len - 1; /* - NUL */
4213 	free(strg2);
4214 
4215 	return strg1;
4216 }
4217 
4218 static bool
4219 is_confusing_precedence(op_t op, op_t lop, bool lparen, op_t rop, bool rparen)
4220 {
4221 
4222 	if (op == SHL || op == SHR) {
4223 		if (!lparen && (lop == PLUS || lop == MINUS))
4224 			return true;
4225 		if (!rparen && (rop == PLUS || rop == MINUS))
4226 			return true;
4227 		return false;
4228 	}
4229 
4230 	if (op == LOGOR) {
4231 		if (!lparen && lop == LOGAND)
4232 			return true;
4233 		if (!rparen && rop == LOGAND)
4234 			return true;
4235 		return false;
4236 	}
4237 
4238 	lint_assert(op == BITAND || op == BITXOR || op == BITOR);
4239 	if (!lparen && lop != op) {
4240 		if (lop == PLUS || lop == MINUS)
4241 			return true;
4242 		if (lop == BITAND || lop == BITXOR)
4243 			return true;
4244 	}
4245 	if (!rparen && rop != op) {
4246 		if (rop == PLUS || rop == MINUS)
4247 			return true;
4248 		if (rop == BITAND || rop == BITXOR)
4249 			return true;
4250 	}
4251 	return false;
4252 }
4253 
4254 /*
4255  * Print a warning if the given node has operands which should be
4256  * parenthesized.
4257  *
4258  * XXX Does not work if an operand is a constant expression. Constant
4259  * expressions are already folded.
4260  */
4261 static void
4262 check_precedence_confusion(tnode_t *tn)
4263 {
4264 	tnode_t *ln, *rn;
4265 
4266 	if (!hflag)
4267 		return;
4268 
4269 	debug_node(tn);
4270 
4271 	lint_assert(modtab[tn->tn_op].m_binary);
4272 	for (ln = tn->tn_left; ln->tn_op == CVT; ln = ln->tn_left)
4273 		continue;
4274 	for (rn = tn->tn_right; rn->tn_op == CVT; rn = rn->tn_left)
4275 		continue;
4276 
4277 	if (is_confusing_precedence(tn->tn_op,
4278 	    ln->tn_op, ln->tn_parenthesized,
4279 	    rn->tn_op, rn->tn_parenthesized)) {
4280 		/* precedence confusion possible: parenthesize! */
4281 		warning(169);
4282 	}
4283 }
4284