xref: /netbsd-src/usr.bin/xlint/lint1/tree.c (revision f56b29a750628a7095c5912a389a6083a9f727f9)
1 /*	$NetBSD: tree.c,v 1.439 2022/04/30 22:31:23 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *      This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID) && !defined(lint)
40 __RCSID("$NetBSD: tree.c,v 1.439 2022/04/30 22:31:23 rillig Exp $");
41 #endif
42 
43 #include <float.h>
44 #include <limits.h>
45 #include <math.h>
46 #include <signal.h>
47 #include <stdlib.h>
48 #include <string.h>
49 
50 #include "lint1.h"
51 #include "cgram.h"
52 
53 static	tnode_t	*build_integer_constant(tspec_t, int64_t);
54 static	void	check_pointer_comparison(op_t,
55 					 const tnode_t *, const tnode_t *);
56 static	bool	check_assign_types_compatible(op_t, int,
57 					      const tnode_t *, const tnode_t *);
58 static	void	check_bad_enum_operation(op_t,
59 					 const tnode_t *, const tnode_t *);
60 static	void	check_enum_type_mismatch(op_t, int,
61 				         const tnode_t *, const tnode_t *);
62 static	void	check_enum_int_mismatch(op_t, int,
63 					const tnode_t *, const tnode_t *);
64 static	tnode_t	*new_tnode(op_t, bool, type_t *, tnode_t *, tnode_t *);
65 static	void	balance(op_t, tnode_t **, tnode_t **);
66 static	void	warn_incompatible_types(op_t, const type_t *, tspec_t,
67 					const type_t *, tspec_t);
68 static	void	warn_incompatible_pointers(const mod_t *,
69 					   const type_t *, const type_t *);
70 static	bool	has_constant_member(const type_t *);
71 static	void	check_prototype_conversion(int, tspec_t, tspec_t, type_t *,
72 					   tnode_t *);
73 static	void	check_integer_conversion(op_t, int, tspec_t, tspec_t, type_t *,
74 					 tnode_t *);
75 static	void	check_pointer_integer_conversion(op_t, tspec_t, type_t *,
76 						 tnode_t *);
77 static	void	check_pointer_conversion(tnode_t *, type_t *);
78 static	tnode_t	*build_struct_access(op_t, bool, tnode_t *, tnode_t *);
79 static	tnode_t	*build_prepost_incdec(op_t, bool, tnode_t *);
80 static	tnode_t	*build_real_imag(op_t, bool, tnode_t *);
81 static	tnode_t	*build_address(bool, tnode_t *, bool);
82 static	tnode_t	*build_plus_minus(op_t, bool, tnode_t *, tnode_t *);
83 static	tnode_t	*build_bit_shift(op_t, bool, tnode_t *, tnode_t *);
84 static	tnode_t	*build_colon(bool, tnode_t *, tnode_t *);
85 static	tnode_t	*build_assignment(op_t, bool, tnode_t *, tnode_t *);
86 static	tnode_t	*plength(type_t *);
87 static	tnode_t	*fold(tnode_t *);
88 static	tnode_t	*fold_bool(tnode_t *);
89 static	tnode_t	*fold_float(tnode_t *);
90 static	tnode_t	*check_function_arguments(type_t *, tnode_t *);
91 static	tnode_t	*check_prototype_argument(int, type_t *, tnode_t *);
92 static	void	check_null_effect(const tnode_t *);
93 static	void	check_array_index(tnode_t *, bool);
94 static	void	check_integer_comparison(op_t, tnode_t *, tnode_t *);
95 static	void	check_precedence_confusion(tnode_t *);
96 
97 extern sig_atomic_t fpe;
98 
99 static const char *
100 op_name(op_t op)
101 {
102 	return modtab[op].m_name;
103 }
104 
105 /* Build 'pointer to tp', 'array of tp' or 'function returning tp'. */
106 type_t *
107 block_derive_type(type_t *tp, tspec_t t)
108 {
109 	type_t	*tp2;
110 
111 	tp2 = block_zero_alloc(sizeof(*tp2));
112 	tp2->t_tspec = t;
113 	tp2->t_subt = tp;
114 	return tp2;
115 }
116 
117 /*
118  * Derive 'pointer to tp' or 'function returning tp'.
119  * The memory is freed at the end of the current expression.
120  */
121 type_t *
122 expr_derive_type(type_t *tp, tspec_t t)
123 {
124 	type_t	*tp2;
125 
126 	tp2 = expr_zero_alloc(sizeof(*tp2));
127 	tp2->t_tspec = t;
128 	tp2->t_subt = tp;
129 	return tp2;
130 }
131 
132 /*
133  * Create a node for a constant.
134  */
135 tnode_t *
136 build_constant(type_t *tp, val_t *v)
137 {
138 	tnode_t	*n;
139 
140 	n = expr_alloc_tnode();
141 	n->tn_op = CON;
142 	n->tn_type = tp;
143 	n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
144 	n->tn_val->v_tspec = tp->t_tspec;
145 	n->tn_val->v_unsigned_since_c90 = v->v_unsigned_since_c90;
146 	n->tn_val->v_u = v->v_u;
147 	free(v);
148 	return n;
149 }
150 
151 static tnode_t *
152 build_integer_constant(tspec_t t, int64_t q)
153 {
154 	tnode_t	*n;
155 
156 	n = expr_alloc_tnode();
157 	n->tn_op = CON;
158 	n->tn_type = gettyp(t);
159 	n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
160 	n->tn_val->v_tspec = t;
161 	n->tn_val->v_quad = q;
162 	return n;
163 }
164 
165 static void
166 fallback_symbol(sym_t *sym)
167 {
168 
169 	if (fallback_symbol_strict_bool(sym))
170 		return;
171 
172 	if (block_level > 0 && (strcmp(sym->s_name, "__FUNCTION__") == 0 ||
173 			   strcmp(sym->s_name, "__PRETTY_FUNCTION__") == 0)) {
174 		/* __FUNCTION__/__PRETTY_FUNCTION__ is a GCC extension */
175 		gnuism(316);
176 		sym->s_type = block_derive_type(gettyp(CHAR), PTR);
177 		sym->s_type->t_const = true;
178 		return;
179 	}
180 
181 	if (block_level > 0 && strcmp(sym->s_name, "__func__") == 0) {
182 		if (!allow_c99)
183 			/* __func__ is a C99 feature */
184 			warning(317);
185 		sym->s_type = block_derive_type(gettyp(CHAR), PTR);
186 		sym->s_type->t_const = true;
187 		return;
188 	}
189 
190 	/* '%s' undefined */
191 	error(99, sym->s_name);
192 }
193 
194 /*
195  * Functions that are predeclared by GCC or other compilers can be called
196  * with arbitrary arguments.  Since lint usually runs after a successful
197  * compilation, it's the compiler's job to catch any errors.
198  */
199 bool
200 is_compiler_builtin(const char *name)
201 {
202 	/* https://gcc.gnu.org/onlinedocs/gcc/C-Extensions.html */
203 	if (allow_gcc) {
204 		if (strncmp(name, "__atomic_", 9) == 0 ||
205 		    strncmp(name, "__builtin_", 10) == 0 ||
206 		    strcmp(name, "alloca") == 0 ||
207 		    /* obsolete but still in use, as of 2021 */
208 		    strncmp(name, "__sync_", 7) == 0)
209 			return true;
210 	}
211 
212 	/* https://software.intel.com/sites/landingpage/IntrinsicsGuide/ */
213 	if (strncmp(name, "_mm_", 4) == 0)
214 		return true;
215 
216 	return false;
217 }
218 
219 static bool
220 str_endswith(const char *haystack, const char *needle)
221 {
222 	size_t hlen = strlen(haystack);
223 	size_t nlen = strlen(needle);
224 
225 	return nlen <= hlen &&
226 	       memcmp(haystack + hlen - nlen, needle, nlen) == 0;
227 }
228 
229 /* https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html */
230 static bool
231 is_gcc_bool_builtin(const char *name)
232 {
233 	return strncmp(name, "__builtin_", 10) == 0 &&
234 	       (str_endswith(name, "_overflow") ||
235 		str_endswith(name, "_overflow_p"));
236 }
237 
238 static void
239 build_name_call(sym_t *sym)
240 {
241 
242 	if (is_compiler_builtin(sym->s_name)) {
243 		/*
244 		 * Do not warn about these, just assume that
245 		 * they are regular functions compatible with
246 		 * non-prototype calling conventions.
247 		 */
248 		if (allow_gcc && is_gcc_bool_builtin(sym->s_name))
249 			sym->s_type = gettyp(BOOL);
250 
251 	} else if (allow_c99) {
252 		/* function '%s' implicitly declared to return int */
253 		error(215, sym->s_name);
254 	} else if (!allow_trad) {
255 		/* function '%s' implicitly declared to return int */
256 		warning(215, sym->s_name);
257 	}
258 
259 	/* XXX if !allow_c90, the symbol should be exported to level 0 */
260 	sym->s_type = block_derive_type(sym->s_type, FUNC);
261 }
262 
263 /* Create a node for a name (symbol table entry). */
264 tnode_t *
265 build_name(sym_t *sym, bool is_funcname)
266 {
267 	tnode_t	*n;
268 
269 	if (sym->s_scl == NOSCL) {
270 		sym->s_scl = EXTERN;
271 		sym->s_def = DECL;
272 		if (is_funcname)
273 			build_name_call(sym);
274 		else
275 			fallback_symbol(sym);
276 	}
277 
278 	lint_assert(sym->s_kind == FVFT || sym->s_kind == FMEMBER);
279 
280 	n = expr_alloc_tnode();
281 	n->tn_type = sym->s_type;
282 	if (sym->s_scl == BOOL_CONST) {
283 		n->tn_op = CON;
284 		n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
285 		n->tn_val->v_tspec = BOOL;
286 		n->tn_val->v_quad = sym->u.s_bool_constant ? 1 : 0;
287 	} else if (sym->s_scl == ENUM_CONST) {
288 		n->tn_op = CON;
289 		n->tn_val = expr_zero_alloc(sizeof(*n->tn_val));
290 		n->tn_val->v_tspec = INT;	/* ENUM is in n->tn_type */
291 		n->tn_val->v_quad = sym->u.s_enum_constant;
292 	} else {
293 		n->tn_op = NAME;
294 		n->tn_sym = sym;
295 		if (sym->s_kind == FVFT && sym->s_type->t_tspec != FUNC)
296 			n->tn_lvalue = true;
297 	}
298 
299 	return n;
300 }
301 
302 tnode_t *
303 build_string(strg_t *strg)
304 {
305 	size_t	len;
306 	tnode_t	*n;
307 	type_t *tp;
308 
309 	len = strg->st_len;
310 
311 	n = expr_alloc_tnode();
312 
313 	tp = expr_zero_alloc(sizeof(*tp));
314 	tp->t_tspec = ARRAY;
315 	tp->t_subt = gettyp(strg->st_char ? CHAR : WCHAR);
316 	tp->t_dim = (int)(len + 1);
317 
318 	n->tn_op = STRING;
319 	n->tn_type = tp;
320 	n->tn_lvalue = true;
321 
322 	n->tn_string = expr_zero_alloc(sizeof(*n->tn_string));
323 	n->tn_string->st_char = strg->st_char;
324 	n->tn_string->st_len = len;
325 
326 	size_t chsize = strg->st_char ? sizeof(char) : sizeof(wchar_t);
327 	size_t size = (len + 1) * chsize;
328 	n->tn_string->st_mem = expr_zero_alloc(size);
329 	(void)memcpy(n->tn_string->st_mem, strg->st_mem, size);
330 	free(strg->st_mem);
331 	free(strg);
332 
333 	return n;
334 }
335 
336 /*
337  * Returns a symbol which has the same name as the msym argument and is a
338  * member of the struct or union specified by the tn argument.
339  */
340 static sym_t *
341 struct_or_union_member(tnode_t *tn, op_t op, sym_t *msym)
342 {
343 	struct_or_union	*str;
344 	type_t	*tp;
345 	sym_t	*sym, *csym;
346 	bool	eq;
347 	tspec_t	t;
348 
349 	/*
350 	 * Remove the member if it was unknown until now, which means
351 	 * that no defined struct or union has a member with the same name.
352 	 */
353 	if (msym->s_scl == NOSCL) {
354 		/* type '%s' does not have member '%s' */
355 		error(101, type_name(tn->tn_type), msym->s_name);
356 		rmsym(msym);
357 		msym->s_kind = FMEMBER;
358 		msym->s_scl = MOS;
359 
360 		struct_or_union *sou = expr_zero_alloc(sizeof(*sou));
361 		sou->sou_tag = expr_zero_alloc(sizeof(*sou->sou_tag));
362 		sou->sou_tag->s_name = unnamed;
363 
364 		msym->u.s_member.sm_sou_type = sou;
365 		/*
366 		 * The member sm_offset_in_bits is not needed here since this
367 		 * symbol can only be used for error reporting.
368 		 */
369 		return msym;
370 	}
371 
372 	/* Set str to the tag of which msym is expected to be a member. */
373 	str = NULL;
374 	t = (tp = tn->tn_type)->t_tspec;
375 	if (op == POINT) {
376 		if (t == STRUCT || t == UNION)
377 			str = tp->t_str;
378 	} else if (op == ARROW && t == PTR) {
379 		t = (tp = tp->t_subt)->t_tspec;
380 		if (t == STRUCT || t == UNION)
381 			str = tp->t_str;
382 	}
383 
384 	/*
385 	 * If this struct/union has a member with the name of msym, return it.
386 	 */
387 	if (str != NULL) {
388 		for (sym = msym; sym != NULL; sym = sym->s_symtab_next) {
389 			if (!is_member(sym))
390 				continue;
391 			if (sym->u.s_member.sm_sou_type != str)
392 				continue;
393 			if (strcmp(sym->s_name, msym->s_name) != 0)
394 				continue;
395 			return sym;
396 		}
397 	}
398 
399 	/*
400 	 * Set eq to false if there are struct/union members with the same
401 	 * name and different types and/or offsets.
402 	 */
403 	eq = true;
404 	for (csym = msym; csym != NULL; csym = csym->s_symtab_next) {
405 		if (csym->s_scl != MOS && csym->s_scl != MOU)
406 			continue;
407 		if (strcmp(msym->s_name, csym->s_name) != 0)
408 			continue;
409 		for (sym = csym->s_symtab_next; sym != NULL;
410 		    sym = sym->s_symtab_next) {
411 			bool w;
412 
413 			if (sym->s_scl != MOS && sym->s_scl != MOU)
414 				continue;
415 			if (strcmp(csym->s_name, sym->s_name) != 0)
416 				continue;
417 			if (csym->u.s_member.sm_offset_in_bits !=
418 			    sym->u.s_member.sm_offset_in_bits) {
419 				eq = false;
420 				break;
421 			}
422 			w = false;
423 			eq = eqtype(csym->s_type, sym->s_type,
424 			    false, false, &w) && !w;
425 			if (!eq)
426 				break;
427 			if (csym->s_bitfield != sym->s_bitfield) {
428 				eq = false;
429 				break;
430 			}
431 			if (csym->s_bitfield) {
432 				type_t	*tp1, *tp2;
433 
434 				tp1 = csym->s_type;
435 				tp2 = sym->s_type;
436 				if (tp1->t_flen != tp2->t_flen) {
437 					eq = false;
438 					break;
439 				}
440 				if (tp1->t_foffs != tp2->t_foffs) {
441 					eq = false;
442 					break;
443 				}
444 			}
445 		}
446 		if (!eq)
447 			break;
448 	}
449 
450 	/*
451 	 * Now handle the case in which the left operand refers really
452 	 * to a struct/union, but the right operand is not member of it.
453 	 */
454 	if (str != NULL) {
455 		if (eq && !allow_c90) {
456 			/* illegal member use: %s */
457 			warning(102, msym->s_name);
458 		} else {
459 			/* illegal member use: %s */
460 			error(102, msym->s_name);
461 		}
462 		return msym;
463 	}
464 
465 	/*
466 	 * Now the left operand of ARROW does not point to a struct/union
467 	 * or the left operand of POINT is no struct/union.
468 	 */
469 	if (eq) {
470 		if (op == POINT) {
471 			if (!allow_c90) {
472 				/* left operand of '.' must be struct ... */
473 				warning(103, type_name(tn->tn_type));
474 			} else {
475 				/* left operand of '.' must be struct ... */
476 				error(103, type_name(tn->tn_type));
477 			}
478 		} else {
479 			if (!allow_c90 && tn->tn_type->t_tspec == PTR) {
480 				/* left operand of '->' must be pointer ... */
481 				warning(104, type_name(tn->tn_type));
482 			} else {
483 				/* left operand of '->' must be pointer ... */
484 				error(104, type_name(tn->tn_type));
485 			}
486 		}
487 	} else {
488 		if (!allow_c90) {
489 			/* non-unique member requires struct/union %s */
490 			error(105, op == POINT ? "object" : "pointer");
491 		} else {
492 			/* unacceptable operand of '%s' */
493 			error(111, op_name(op));
494 		}
495 	}
496 
497 	return msym;
498 }
499 
500 tnode_t *
501 build_generic_selection(const tnode_t *expr,
502 			struct generic_association *sel)
503 {
504 	tnode_t *default_result = NULL;
505 
506 	for (; sel != NULL; sel = sel->ga_prev) {
507 		if (expr != NULL &&
508 		    eqtype(sel->ga_arg, expr->tn_type, false, false, NULL))
509 			return sel->ga_result;
510 		else if (sel->ga_arg == NULL)
511 			default_result = sel->ga_result;
512 	}
513 	return default_result;
514 }
515 
516 /*
517  * Create a tree node for a binary operator and its two operands. Also called
518  * for unary operators; in that case rn is NULL.
519  *
520  * Function calls, sizeof and casts are handled elsewhere.
521  */
522 tnode_t *
523 build_binary(tnode_t *ln, op_t op, bool sys, tnode_t *rn)
524 {
525 	const mod_t *mp;
526 	tnode_t	*ntn;
527 	type_t	*rettp;
528 
529 	mp = &modtab[op];
530 
531 	/* If there was an error in one of the operands, return. */
532 	if (ln == NULL || (mp->m_binary && rn == NULL))
533 		return NULL;
534 
535 	/*
536 	 * Apply class conversions to the left operand, but only if its
537 	 * value is needed or it is compared with zero.
538 	 */
539 	if (mp->m_value_context || mp->m_requires_bool)
540 		ln = cconv(ln);
541 	/*
542 	 * The right operand is almost always in a test or value context,
543 	 * except if it is a struct or union member.
544 	 */
545 	if (mp->m_binary && op != ARROW && op != POINT)
546 		rn = cconv(rn);
547 
548 	/*
549 	 * Print some warnings for comparisons of unsigned values with
550 	 * constants lower than or equal to null. This must be done
551 	 * before promote() because otherwise unsigned char and unsigned
552 	 * short would be promoted to int. Types are also tested to be
553 	 * CHAR, which would also become int.
554 	 */
555 	if (mp->m_comparison)
556 		check_integer_comparison(op, ln, rn);
557 
558 	if (mp->m_value_context || mp->m_requires_bool)
559 		ln = promote(op, false, ln);
560 	if (mp->m_binary && op != ARROW && op != POINT &&
561 	    op != ASSIGN && op != RETURN && op != INIT) {
562 		rn = promote(op, false, rn);
563 	}
564 
565 	/*
566 	 * If the result of the operation is different for signed or
567 	 * unsigned operands and one of the operands is signed only in
568 	 * ANSI C, print a warning.
569 	 */
570 	if (mp->m_warn_if_left_unsigned_in_c90 &&
571 	    ln->tn_op == CON && ln->tn_val->v_unsigned_since_c90) {
572 		/* ANSI C treats constant as unsigned, op %s */
573 		warning(218, mp->m_name);
574 		ln->tn_val->v_unsigned_since_c90 = false;
575 	}
576 	if (mp->m_warn_if_right_unsigned_in_c90 &&
577 	    rn->tn_op == CON && rn->tn_val->v_unsigned_since_c90) {
578 		/* ANSI C treats constant as unsigned, op %s */
579 		warning(218, mp->m_name);
580 		rn->tn_val->v_unsigned_since_c90 = false;
581 	}
582 
583 	/* Make sure both operands are of the same type */
584 	if (mp->m_balance_operands || (!allow_c90 && (op == SHL || op == SHR)))
585 		balance(op, &ln, &rn);
586 
587 	/*
588 	 * Check types for compatibility with the operation and mutual
589 	 * compatibility. Return if there are serious problems.
590 	 */
591 	if (!typeok(op, 0, ln, rn))
592 		return NULL;
593 
594 	/* And now create the node. */
595 	switch (op) {
596 	case POINT:
597 	case ARROW:
598 		ntn = build_struct_access(op, sys, ln, rn);
599 		break;
600 	case INCAFT:
601 	case DECAFT:
602 	case INCBEF:
603 	case DECBEF:
604 		ntn = build_prepost_incdec(op, sys, ln);
605 		break;
606 	case ADDR:
607 		ntn = build_address(sys, ln, false);
608 		break;
609 	case INDIR:
610 		ntn = new_tnode(INDIR, sys, ln->tn_type->t_subt, ln, NULL);
611 		break;
612 	case PLUS:
613 	case MINUS:
614 		ntn = build_plus_minus(op, sys, ln, rn);
615 		break;
616 	case SHL:
617 	case SHR:
618 		ntn = build_bit_shift(op, sys, ln, rn);
619 		break;
620 	case COLON:
621 		ntn = build_colon(sys, ln, rn);
622 		break;
623 	case ASSIGN:
624 	case MULASS:
625 	case DIVASS:
626 	case MODASS:
627 	case ADDASS:
628 	case SUBASS:
629 	case SHLASS:
630 	case SHRASS:
631 	case ANDASS:
632 	case XORASS:
633 	case ORASS:
634 	case RETURN:
635 	case INIT:
636 		ntn = build_assignment(op, sys, ln, rn);
637 		break;
638 	case COMMA:
639 	case QUEST:
640 		ntn = new_tnode(op, sys, rn->tn_type, ln, rn);
641 		break;
642 	case REAL:
643 	case IMAG:
644 		ntn = build_real_imag(op, sys, ln);
645 		break;
646 	default:
647 		rettp = mp->m_returns_bool
648 		    ? gettyp(Tflag ? BOOL : INT) : ln->tn_type;
649 		lint_assert(mp->m_binary == (rn != NULL));
650 		ntn = new_tnode(op, sys, rettp, ln, rn);
651 		break;
652 	}
653 
654 	/* Return if an error occurred. */
655 	if (ntn == NULL)
656 		return NULL;
657 
658 	/* Print a warning if precedence confusion is possible */
659 	if (mp->m_possible_precedence_confusion)
660 		check_precedence_confusion(ntn);
661 
662 	/*
663 	 * Print a warning if one of the operands is in a context where
664 	 * it is compared with zero and if this operand is a constant.
665 	 */
666 	if (hflag && !constcond_flag &&
667 	    mp->m_requires_bool &&
668 	    (ln->tn_op == CON ||
669 	     ((mp->m_binary && op != QUEST) && rn->tn_op == CON)) &&
670 	    /* XXX: rn->tn_system_dependent should be checked as well */
671 	    !ln->tn_system_dependent) {
672 		/* constant in conditional context */
673 		warning(161);
674 	}
675 
676 	/* Fold if the operator requires it */
677 	if (mp->m_fold_constant_operands) {
678 		if (ln->tn_op == CON && (!mp->m_binary || rn->tn_op == CON)) {
679 			if (mp->m_requires_bool) {
680 				ntn = fold_bool(ntn);
681 			} else if (is_floating(ntn->tn_type->t_tspec)) {
682 				ntn = fold_float(ntn);
683 			} else {
684 				ntn = fold(ntn);
685 			}
686 		} else if (op == QUEST && ln->tn_op == CON) {
687 			ntn = ln->tn_val->v_quad != 0
688 			    ? rn->tn_left : rn->tn_right;
689 		}
690 	}
691 
692 	return ntn;
693 }
694 
695 tnode_t *
696 build_unary(op_t op, bool sys, tnode_t *tn)
697 {
698 	return build_binary(tn, op, sys, NULL);
699 }
700 
701 tnode_t *
702 build_member_access(tnode_t *ln, op_t op, bool sys, sbuf_t *member)
703 {
704 	sym_t	*msym;
705 
706 	if (ln == NULL)
707 		return NULL;
708 
709 	if (op == ARROW) {
710 		/* must do this before struct_or_union_member is called */
711 		ln = cconv(ln);
712 	}
713 	msym = struct_or_union_member(ln, op, getsym(member));
714 	return build_binary(ln, op, sys, build_name(msym, false));
715 }
716 
717 /*
718  * Perform class conversions.
719  *
720  * Arrays of type T are converted into pointers to type T.
721  * Functions are converted to pointers to functions.
722  * Lvalues are converted to rvalues.
723  *
724  * C99 6.3 "Conversions"
725  * C99 6.3.2 "Other operands"
726  * C99 6.3.2.1 "Lvalues, arrays, and function designators"
727  */
728 tnode_t *
729 cconv(tnode_t *tn)
730 {
731 	type_t	*tp;
732 
733 	/*
734 	 * Array-lvalue (array of type T) is converted into rvalue
735 	 * (pointer to type T)
736 	 */
737 	if (tn->tn_type->t_tspec == ARRAY) {
738 		if (!tn->tn_lvalue) {
739 			/* XXX print correct operator */
740 			/* %soperand of '%s' must be lvalue */
741 			gnuism(114, "", op_name(ADDR));
742 		}
743 		tn = new_tnode(ADDR, tn->tn_sys,
744 		    expr_derive_type(tn->tn_type->t_subt, PTR), tn, NULL);
745 	}
746 
747 	/*
748 	 * Expression of type function (function with return value of type T)
749 	 * in rvalue-expression (pointer to function with return value
750 	 * of type T)
751 	 */
752 	if (tn->tn_type->t_tspec == FUNC)
753 		tn = build_address(tn->tn_sys, tn, true);
754 
755 	/* lvalue to rvalue */
756 	if (tn->tn_lvalue) {
757 		tp = expr_dup_type(tn->tn_type);
758 		/* C99 6.3.2.1p2 sentence 2 says to remove the qualifiers. */
759 		tp->t_const = tp->t_volatile = false;
760 		tn = new_tnode(LOAD, tn->tn_sys, tp, tn, NULL);
761 	}
762 
763 	return tn;
764 }
765 
766 const tnode_t *
767 before_conversion(const tnode_t *tn)
768 {
769 	while (tn->tn_op == CVT && !tn->tn_cast)
770 		tn = tn->tn_left;
771 	return tn;
772 }
773 
774 static bool
775 is_null_pointer(const tnode_t *tn)
776 {
777 	tspec_t t = tn->tn_type->t_tspec;
778 
779 	return ((t == PTR && tn->tn_type->t_subt->t_tspec == VOID) ||
780 		is_integer(t))
781 	       && (tn->tn_op == CON && tn->tn_val->v_quad == 0);
782 }
783 
784 /*
785  * Most errors required by ANSI C are reported in struct_or_union_member().
786  * Here we only check for totally wrong things.
787  */
788 static bool
789 typeok_point(const tnode_t *ln, const type_t *ltp, tspec_t lt)
790 {
791 	if (lt == FUNC || lt == VOID || ltp->t_bitfield ||
792 	    ((lt != STRUCT && lt != UNION) && !ln->tn_lvalue)) {
793 		/* With allow_c90 we already got an error */
794 		if (!allow_c90)
795 			/* unacceptable operand of '%s' */
796 			error(111, op_name(POINT));
797 		return false;
798 	}
799 	return true;
800 }
801 
802 static bool
803 typeok_arrow(tspec_t lt)
804 {
805 	/*
806 	 * C1978 Appendix A 14.1 says: <quote>In fact, any lvalue is allowed
807 	 * before '.', and that lvalue is then assumed to have the form of
808 	 * the structure of which the name of the right is a member. [...]
809 	 * Such constructions are non-portable.</quote>
810 	 */
811 	if (lt == PTR || (!allow_c90 && is_integer(lt)))
812 		return true;
813 
814 	/* With allow_c90 we already got an error */
815 	if (!allow_c90)
816 		/* unacceptable operand of '%s' */
817 		error(111, op_name(ARROW));
818 	return false;
819 }
820 
821 static bool
822 typeok_incdec(op_t op, const tnode_t *tn, const type_t *tp)
823 {
824 	/* operand has scalar type (checked in typeok) */
825 	if (!tn->tn_lvalue) {
826 		if (tn->tn_op == CVT && tn->tn_cast &&
827 		    tn->tn_left->tn_op == LOAD) {
828 			/* a cast does not yield an lvalue */
829 			error(163);
830 		}
831 		/* %soperand of '%s' must be lvalue */
832 		error(114, "", op_name(op));
833 		return false;
834 	} else if (tp->t_const) {
835 		if (allow_c90)
836 			/* %soperand of '%s' must be modifiable lvalue */
837 			warning(115, "", op_name(op));
838 	}
839 	return true;
840 }
841 
842 static bool
843 typeok_address(const mod_t *mp,
844 	       const tnode_t *tn, const type_t *tp, tspec_t t)
845 {
846 	if (t == ARRAY || t == FUNC) {
847 		/* ok, a warning comes later (in build_address()) */
848 	} else if (!tn->tn_lvalue) {
849 		if (tn->tn_op == CVT && tn->tn_cast &&
850 		    tn->tn_left->tn_op == LOAD) {
851 			/* a cast does not yield an lvalue */
852 			error(163);
853 		}
854 		/* %soperand of '%s' must be lvalue */
855 		error(114, "", mp->m_name);
856 		return false;
857 	} else if (is_scalar(t)) {
858 		if (tp->t_bitfield) {
859 			/* cannot take address of bit-field */
860 			error(112);
861 			return false;
862 		}
863 	} else if (t != STRUCT && t != UNION) {
864 		/* unacceptable operand of '%s' */
865 		error(111, mp->m_name);
866 		return false;
867 	}
868 	if (tn->tn_op == NAME && tn->tn_sym->s_register) {
869 		/* cannot take address of register %s */
870 		error(113, tn->tn_sym->s_name);
871 		return false;
872 	}
873 	return true;
874 }
875 
876 static bool
877 typeok_indir(tspec_t t)
878 {
879 	/* until now there were no type checks for this operator */
880 	if (t != PTR) {
881 		/* cannot dereference non-pointer type */
882 		error(96);
883 		return false;
884 	}
885 	return true;
886 }
887 
888 static bool
889 typeok_plus(op_t op,
890 	    const type_t *ltp, tspec_t lt,
891 	    const type_t *rtp, tspec_t rt)
892 {
893 	/* operands have scalar types (checked above) */
894 	if ((lt == PTR && !is_integer(rt)) || (rt == PTR && !is_integer(lt))) {
895 		warn_incompatible_types(op, ltp, lt, rtp, rt);
896 		return false;
897 	}
898 	return true;
899 }
900 
901 static bool
902 typeok_minus(op_t op,
903 	     const type_t *ltp, tspec_t lt,
904 	     const type_t *rtp, tspec_t rt)
905 {
906 	/* operands have scalar types (checked above) */
907 	if (lt == PTR && (!is_integer(rt) && rt != PTR)) {
908 		warn_incompatible_types(op, ltp, lt, rtp, rt);
909 		return false;
910 	} else if (rt == PTR && lt != PTR) {
911 		warn_incompatible_types(op, ltp, lt, rtp, rt);
912 		return false;
913 	}
914 	if (lt == PTR && rt == PTR) {
915 		if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
916 			/* illegal pointer subtraction */
917 			error(116);
918 		}
919 	}
920 	return true;
921 }
922 
923 static void
924 typeok_shr(const mod_t *mp,
925 	   const tnode_t *ln, tspec_t lt,
926 	   const tnode_t *rn, tspec_t rt)
927 {
928 	tspec_t olt, ort;
929 
930 	olt = before_conversion(ln)->tn_type->t_tspec;
931 	ort = before_conversion(rn)->tn_type->t_tspec;
932 
933 	/* operands have integer types (checked above) */
934 	if (pflag && !is_uinteger(olt)) {
935 		/*
936 		 * The left operand is signed. This means that
937 		 * the operation is (possibly) nonportable.
938 		 */
939 		if (ln->tn_op != CON) {
940 			/* bitwise '%s' on signed value possibly nonportable */
941 			warning(117, mp->m_name);
942 		} else if (ln->tn_val->v_quad < 0) {
943 			/* bitwise '%s' on signed value nonportable */
944 			warning(120, mp->m_name);
945 		}
946 	} else if (allow_trad && allow_c90 &&
947 		   !is_uinteger(olt) && is_uinteger(ort)) {
948 		/*
949 		 * The left operand would become unsigned in
950 		 * traditional C.
951 		 */
952 		if (hflag && (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
953 			/* semantics of '%s' change in ANSI C; use ... */
954 			warning(118, mp->m_name);
955 		}
956 	} else if (allow_trad && allow_c90 &&
957 		   !is_uinteger(olt) && !is_uinteger(ort) &&
958 		   portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
959 		/*
960 		 * In traditional C the left operand would be extended
961 		 * (possibly sign-extended) and then shifted.
962 		 */
963 		if (hflag && (ln->tn_op != CON || ln->tn_val->v_quad < 0)) {
964 			/* semantics of '%s' change in ANSI C; use ... */
965 			warning(118, mp->m_name);
966 		}
967 	}
968 }
969 
970 static void
971 typeok_shl(const mod_t *mp, tspec_t lt, tspec_t rt)
972 {
973 	/*
974 	 * C90 does not perform balancing for shift operations,
975 	 * but traditional C does. If the width of the right operand
976 	 * is greater than the width of the left operand, then in
977 	 * traditional C the left operand would be extended to the
978 	 * width of the right operand. For SHL this may result in
979 	 * different results.
980 	 */
981 	if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
982 		/*
983 		 * XXX If both operands are constant, make sure
984 		 * that there is really a difference between
985 		 * ANSI C and traditional C.
986 		 */
987 		if (hflag && !allow_c99)
988 			/* semantics of '%s' change in ANSI C; use ... */
989 			warning(118, mp->m_name);
990 	}
991 }
992 
993 static void
994 typeok_shift(tspec_t lt, const tnode_t *rn, tspec_t rt)
995 {
996 	if (rn->tn_op != CON)
997 		return;
998 
999 	if (!is_uinteger(rt) && rn->tn_val->v_quad < 0) {
1000 		/* negative shift */
1001 		warning(121);
1002 	} else if ((uint64_t)rn->tn_val->v_quad ==
1003 		   (uint64_t)size_in_bits(lt)) {
1004 		/* shift equal to size of object */
1005 		warning(267);
1006 	} else if ((uint64_t)rn->tn_val->v_quad > (uint64_t)size_in_bits(lt)) {
1007 		/* shift amount %llu is greater than bit-size %llu of '%s' */
1008 		warning(122, (unsigned long long)rn->tn_val->v_quad,
1009 		    (unsigned long long)size_in_bits(lt),
1010 		    tspec_name(lt));
1011 	}
1012 }
1013 
1014 static bool
1015 is_typeok_eq(const tnode_t *ln, tspec_t lt, const tnode_t *rn, tspec_t rt)
1016 {
1017 	if (lt == PTR && is_null_pointer(rn))
1018 		return true;
1019 	if (rt == PTR && is_null_pointer(ln))
1020 		return true;
1021 	return false;
1022 }
1023 
1024 static bool
1025 typeok_compare(op_t op,
1026 	       const tnode_t *ln, const type_t *ltp, tspec_t lt,
1027 	       const tnode_t *rn, const type_t *rtp, tspec_t rt)
1028 {
1029 	const char *lx, *rx;
1030 
1031 	if (lt == PTR && rt == PTR) {
1032 		check_pointer_comparison(op, ln, rn);
1033 		return true;
1034 	}
1035 
1036 	if (lt != PTR && rt != PTR)
1037 		return true;
1038 
1039 	if (!is_integer(lt) && !is_integer(rt)) {
1040 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1041 		return false;
1042 	}
1043 
1044 	lx = lt == PTR ? "pointer" : "integer";
1045 	rx = rt == PTR ? "pointer" : "integer";
1046 	/* illegal combination of %s '%s' and %s '%s', op '%s' */
1047 	warning(123, lx, type_name(ltp), rx, type_name(rtp), op_name(op));
1048 	return true;
1049 }
1050 
1051 static bool
1052 typeok_quest(tspec_t lt, const tnode_t *rn)
1053 {
1054 	if (!is_scalar(lt)) {
1055 		/* first operand must have scalar type, op ? : */
1056 		error(170);
1057 		return false;
1058 	}
1059 	lint_assert(before_conversion(rn)->tn_op == COLON);
1060 	return true;
1061 }
1062 
1063 static void
1064 typeok_colon_pointer(const mod_t *mp, const type_t *ltp, const type_t *rtp)
1065 {
1066 	type_t *lstp = ltp->t_subt;
1067 	type_t *rstp = rtp->t_subt;
1068 	tspec_t lst = lstp->t_tspec;
1069 	tspec_t rst = rstp->t_tspec;
1070 
1071 	if ((lst == VOID && rst == FUNC) || (lst == FUNC && rst == VOID)) {
1072 		/* (void *)0 handled above */
1073 		/* TODO: C99 behaves like C90 here. */
1074 		if (!allow_trad && !allow_c99)
1075 			/* ANSI C forbids conversion of %s to %s, op %s */
1076 			warning(305, "function pointer", "'void *'",
1077 			    mp->m_name);
1078 		return;
1079 	}
1080 
1081 	if (eqptrtype(lstp, rstp, true))
1082 		return;
1083 	if (!eqtype(lstp, rstp, true, false, NULL))
1084 		warn_incompatible_pointers(mp, ltp, rtp);
1085 }
1086 
1087 static bool
1088 typeok_colon(const mod_t *mp,
1089 	     const tnode_t *ln, const type_t *ltp, tspec_t lt,
1090 	     const tnode_t *rn, const type_t *rtp, tspec_t rt)
1091 {
1092 
1093 	if (is_arithmetic(lt) && is_arithmetic(rt))
1094 		return true;
1095 	if (lt == BOOL && rt == BOOL)
1096 		return true;
1097 
1098 	if (lt == STRUCT && rt == STRUCT && ltp->t_str == rtp->t_str)
1099 		return true;
1100 	if (lt == UNION && rt == UNION && ltp->t_str == rtp->t_str)
1101 		return true;
1102 
1103 	if (lt == PTR && is_null_pointer(rn))
1104 		return true;
1105 	if (rt == PTR && is_null_pointer(ln))
1106 		return true;
1107 
1108 	if ((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)) {
1109 		const char *lx = lt == PTR ? "pointer" : "integer";
1110 		const char *rx = rt == PTR ? "pointer" : "integer";
1111 		/* illegal combination of %s '%s' and %s '%s', op '%s' */
1112 		warning(123, lx, type_name(ltp),
1113 		    rx, type_name(rtp), mp->m_name);
1114 		return true;
1115 	}
1116 
1117 	if (lt == VOID || rt == VOID) {
1118 		if (lt != VOID || rt != VOID)
1119 			/* incompatible types '%s' and '%s' in conditional */
1120 			warning(126, type_name(ltp), type_name(rtp));
1121 		return true;
1122 	}
1123 
1124 	if (lt == PTR && rt == PTR) {
1125 		typeok_colon_pointer(mp, ltp, rtp);
1126 		return true;
1127 	}
1128 
1129 	/* incompatible types '%s' and '%s' in conditional */
1130 	error(126, type_name(ltp), type_name(rtp));
1131 	return false;
1132 }
1133 
1134 static bool
1135 typeok_assign(op_t op, const tnode_t *ln, const type_t *ltp, tspec_t lt)
1136 {
1137 	if (op == RETURN || op == INIT || op == FARG)
1138 		return true;
1139 
1140 	if (!ln->tn_lvalue) {
1141 		if (ln->tn_op == CVT && ln->tn_cast &&
1142 		    ln->tn_left->tn_op == LOAD) {
1143 			/* a cast does not yield an lvalue */
1144 			error(163);
1145 		}
1146 		/* %soperand of '%s' must be lvalue */
1147 		error(114, "left ", op_name(op));
1148 		return false;
1149 	} else if (ltp->t_const || ((lt == STRUCT || lt == UNION) &&
1150 				    has_constant_member(ltp))) {
1151 		if (allow_c90)
1152 			/* %soperand of '%s' must be modifiable lvalue */
1153 			warning(115, "left ", op_name(op));
1154 	}
1155 	return true;
1156 }
1157 
1158 /* Check the types using the information from modtab[]. */
1159 static bool
1160 typeok_scalar(op_t op, const mod_t *mp,
1161 	      const type_t *ltp, tspec_t lt,
1162 	      const type_t *rtp, tspec_t rt)
1163 {
1164 	if (mp->m_takes_bool && lt == BOOL && rt == BOOL)
1165 		return true;
1166 	if (mp->m_requires_integer) {
1167 		if (!is_integer(lt) || (mp->m_binary && !is_integer(rt))) {
1168 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1169 			return false;
1170 		}
1171 	} else if (mp->m_requires_integer_or_complex) {
1172 		if ((!is_integer(lt) && !is_complex(lt)) ||
1173 		    (mp->m_binary && (!is_integer(rt) && !is_complex(rt)))) {
1174 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1175 			return false;
1176 		}
1177 	} else if (mp->m_requires_scalar) {
1178 		if (!is_scalar(lt) || (mp->m_binary && !is_scalar(rt))) {
1179 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1180 			return false;
1181 		}
1182 	} else if (mp->m_requires_arith) {
1183 		if (!is_arithmetic(lt) ||
1184 		    (mp->m_binary && !is_arithmetic(rt))) {
1185 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1186 			return false;
1187 		}
1188 	}
1189 	return true;
1190 }
1191 
1192 /*
1193  * Check the types for specific operators and type combinations.
1194  *
1195  * At this point, the operands already conform to the type requirements of
1196  * the operator, such as being integer, floating or scalar.
1197  */
1198 static bool
1199 typeok_op(op_t op, const mod_t *mp, int arg,
1200 	  const tnode_t *ln, const type_t *ltp, tspec_t lt,
1201 	  const tnode_t *rn, const type_t *rtp, tspec_t rt)
1202 {
1203 	switch (op) {
1204 	case ARROW:
1205 		return typeok_arrow(lt);
1206 	case POINT:
1207 		return typeok_point(ln, ltp, lt);
1208 	case INCBEF:
1209 	case DECBEF:
1210 	case INCAFT:
1211 	case DECAFT:
1212 		return typeok_incdec(op, ln, ltp);
1213 	case INDIR:
1214 		return typeok_indir(lt);
1215 	case ADDR:
1216 		return typeok_address(mp, ln, ltp, lt);
1217 	case PLUS:
1218 		return typeok_plus(op, ltp, lt, rtp, rt);
1219 	case MINUS:
1220 		return typeok_minus(op, ltp, lt, rtp, rt);
1221 	case SHL:
1222 		typeok_shl(mp, lt, rt);
1223 		goto shift;
1224 	case SHR:
1225 		typeok_shr(mp, ln, lt, rn, rt);
1226 	shift:
1227 		typeok_shift(lt, rn, rt);
1228 		break;
1229 	case LT:
1230 	case LE:
1231 	case GT:
1232 	case GE:
1233 	compare:
1234 		return typeok_compare(op, ln, ltp, lt, rn, rtp, rt);
1235 	case EQ:
1236 	case NE:
1237 		if (is_typeok_eq(ln, lt, rn, rt))
1238 			break;
1239 		goto compare;
1240 	case QUEST:
1241 		return typeok_quest(lt, rn);
1242 	case COLON:
1243 		return typeok_colon(mp, ln, ltp, lt, rn, rtp, rt);
1244 	case ASSIGN:
1245 	case INIT:
1246 	case FARG:
1247 	case RETURN:
1248 		if (!check_assign_types_compatible(op, arg, ln, rn))
1249 			return false;
1250 		goto assign;
1251 	case MULASS:
1252 	case DIVASS:
1253 	case MODASS:
1254 		goto assign;
1255 	case ADDASS:
1256 	case SUBASS:
1257 		if ((lt == PTR && !is_integer(rt)) || rt == PTR) {
1258 			warn_incompatible_types(op, ltp, lt, rtp, rt);
1259 			return false;
1260 		}
1261 		goto assign;
1262 	case SHLASS:
1263 		goto assign;
1264 	case SHRASS:
1265 		if (pflag && !is_uinteger(lt) &&
1266 		    !(!allow_c90 && is_uinteger(rt))) {
1267 			/* bitwise '%s' on signed value possibly nonportable */
1268 			warning(117, mp->m_name);
1269 		}
1270 		goto assign;
1271 	case ANDASS:
1272 	case XORASS:
1273 	case ORASS:
1274 	assign:
1275 		return typeok_assign(op, ln, ltp, lt);
1276 	case COMMA:
1277 		if (!modtab[ln->tn_op].m_has_side_effect)
1278 			check_null_effect(ln);
1279 		break;
1280 	default:
1281 		break;
1282 	}
1283 	return true;
1284 }
1285 
1286 static void
1287 typeok_enum(op_t op, const mod_t *mp, int arg,
1288 	    const tnode_t *ln, const type_t *ltp,
1289 	    const tnode_t *rn, const type_t *rtp)
1290 {
1291 	if (mp->m_bad_on_enum &&
1292 	    (ltp->t_is_enum || (mp->m_binary && rtp->t_is_enum))) {
1293 		check_bad_enum_operation(op, ln, rn);
1294 	} else if (mp->m_valid_on_enum &&
1295 		   (ltp->t_is_enum && rtp != NULL && rtp->t_is_enum)) {
1296 		check_enum_type_mismatch(op, arg, ln, rn);
1297 	} else if (mp->m_valid_on_enum &&
1298 		   (ltp->t_is_enum || (rtp != NULL && rtp->t_is_enum))) {
1299 		check_enum_int_mismatch(op, arg, ln, rn);
1300 	}
1301 }
1302 
1303 /* Perform most type checks. Return whether the types are ok. */
1304 bool
1305 typeok(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1306 {
1307 	const mod_t *mp;
1308 	tspec_t	lt, rt;
1309 	type_t	*ltp, *rtp;
1310 
1311 	mp = &modtab[op];
1312 
1313 	lint_assert((ltp = ln->tn_type) != NULL);
1314 	lt = ltp->t_tspec;
1315 
1316 	if (mp->m_binary) {
1317 		lint_assert((rtp = rn->tn_type) != NULL);
1318 		rt = rtp->t_tspec;
1319 	} else {
1320 		rtp = NULL;
1321 		rt = NOTSPEC;
1322 	}
1323 
1324 	if (Tflag && !typeok_scalar_strict_bool(op, mp, arg, ln, rn))
1325 		return false;
1326 	if (!typeok_scalar(op, mp, ltp, lt, rtp, rt))
1327 		return false;
1328 
1329 	if (!typeok_op(op, mp, arg, ln, ltp, lt, rn, rtp, rt))
1330 		return false;
1331 
1332 	typeok_enum(op, mp, arg, ln, ltp, rn, rtp);
1333 	return true;
1334 }
1335 
1336 static void
1337 check_pointer_comparison(op_t op, const tnode_t *ln, const tnode_t *rn)
1338 {
1339 	type_t	*ltp, *rtp;
1340 	tspec_t	lst, rst;
1341 	const	char *lsts, *rsts;
1342 
1343 	lst = (ltp = ln->tn_type)->t_subt->t_tspec;
1344 	rst = (rtp = rn->tn_type)->t_subt->t_tspec;
1345 
1346 	if (lst == VOID || rst == VOID) {
1347 		/* TODO: C99 behaves like C90 here. */
1348 		if ((!allow_trad && !allow_c99) &&
1349 		    (lst == FUNC || rst == FUNC)) {
1350 			/* (void *)0 already handled in typeok() */
1351 			*(lst == FUNC ? &lsts : &rsts) = "function pointer";
1352 			*(lst == VOID ? &lsts : &rsts) = "'void *'";
1353 			/* ANSI C forbids comparison of %s with %s */
1354 			warning(274, lsts, rsts);
1355 		}
1356 		return;
1357 	}
1358 
1359 	if (!eqtype(ltp->t_subt, rtp->t_subt, true, false, NULL)) {
1360 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1361 		return;
1362 	}
1363 
1364 	if (lst == FUNC && rst == FUNC) {
1365 		/* TODO: C99 behaves like C90 here, see C99 6.5.8p2. */
1366 		if ((!allow_trad && !allow_c99) && op != EQ && op != NE)
1367 			/* ANSI C forbids ordered comparisons of ... */
1368 			warning(125);
1369 	}
1370 }
1371 
1372 static bool
1373 is_direct_function_call(const tnode_t *tn, const char **out_name)
1374 {
1375 
1376 	if (!(tn->tn_op == CALL &&
1377 	      tn->tn_left->tn_op == ADDR &&
1378 	      tn->tn_left->tn_left->tn_op == NAME))
1379 		return false;
1380 
1381 	*out_name = tn->tn_left->tn_left->tn_sym->s_name;
1382 	return true;
1383 }
1384 
1385 static bool
1386 is_unconst_function(const char *name)
1387 {
1388 
1389 	return strcmp(name, "memchr") == 0 ||
1390 	       strcmp(name, "strchr") == 0 ||
1391 	       strcmp(name, "strpbrk") == 0 ||
1392 	       strcmp(name, "strrchr") == 0 ||
1393 	       strcmp(name, "strstr") == 0;
1394 }
1395 
1396 static bool
1397 is_const_char_pointer(const tnode_t *tn)
1398 {
1399 	const type_t *tp;
1400 
1401 	/*
1402 	 * For traditional reasons, C99 6.4.5p5 defines that string literals
1403 	 * have type 'char[]'.  They are often implicitly converted to
1404 	 * 'char *', for example when they are passed as function arguments.
1405 	 *
1406 	 * C99 6.4.5p6 further defines that modifying a string that is
1407 	 * constructed from a string literal invokes undefined behavior.
1408 	 *
1409 	 * Out of these reasons, string literals are treated as 'effectively
1410 	 * const' here.
1411 	 */
1412 	if (tn->tn_op == CVT &&
1413 	    tn->tn_left->tn_op == ADDR &&
1414 	    tn->tn_left->tn_left->tn_op == STRING)
1415 		return true;
1416 
1417 	tp = before_conversion(tn)->tn_type;
1418 	return tp->t_tspec == PTR &&
1419 	       tp->t_subt->t_tspec == CHAR &&
1420 	       tp->t_subt->t_const;
1421 }
1422 
1423 static bool
1424 is_const_pointer(const tnode_t *tn)
1425 {
1426 	const type_t *tp;
1427 
1428 	tp = before_conversion(tn)->tn_type;
1429 	return tp->t_tspec == PTR && tp->t_subt->t_const;
1430 }
1431 
1432 static bool
1433 is_first_arg_const_char_pointer(const tnode_t *tn)
1434 {
1435 	const tnode_t *an;
1436 
1437 	an = tn->tn_right;
1438 	if (an == NULL)
1439 		return false;
1440 
1441 	while (an->tn_right != NULL)
1442 		an = an->tn_right;
1443 	return is_const_char_pointer(an->tn_left);
1444 }
1445 
1446 static bool
1447 is_second_arg_const_pointer(const tnode_t *tn)
1448 {
1449 	const tnode_t *an;
1450 
1451 	an = tn->tn_right;
1452 	if (an == NULL || an->tn_right == NULL)
1453 		return false;
1454 
1455 	while (an->tn_right->tn_right != NULL)
1456 		an = an->tn_right;
1457 	return is_const_pointer(an->tn_left);
1458 }
1459 
1460 static void
1461 check_unconst_function(const type_t *lstp, const tnode_t *rn)
1462 {
1463 	const char *function_name;
1464 
1465 	if (lstp->t_tspec == CHAR && !lstp->t_const &&
1466 	    is_direct_function_call(rn, &function_name) &&
1467 	    is_unconst_function(function_name) &&
1468 	    is_first_arg_const_char_pointer(rn)) {
1469 		/* call to '%s' effectively discards 'const' from argument */
1470 		warning(346, function_name);
1471 	}
1472 
1473 	if (!lstp->t_const &&
1474 	    is_direct_function_call(rn, &function_name) &&
1475 	    strcmp(function_name, "bsearch") == 0 &&
1476 	    is_second_arg_const_pointer(rn)) {
1477 		/* call to '%s' effectively discards 'const' from argument */
1478 		warning(346, function_name);
1479 	}
1480 }
1481 
1482 static void
1483 check_assign_void_pointer(op_t op, int arg,
1484 			  tspec_t lt, tspec_t lst,
1485 			  tspec_t rt, tspec_t rst)
1486 {
1487 	const char *lts, *rts;
1488 
1489 	if (!(lt == PTR && rt == PTR && (lst == VOID || rst == VOID)))
1490 		return;
1491 	/* two pointers, at least one pointer to void */
1492 
1493 	/* TODO: C99 behaves like C90 here. */
1494 	if (!((!allow_trad && !allow_c99) && (lst == FUNC || rst == FUNC)))
1495 		return;
1496 	/* comb. of ptr to func and ptr to void */
1497 
1498 	*(lst == FUNC ? &lts : &rts) = "function pointer";
1499 	*(lst == VOID ? &lts : &rts) = "'void *'";
1500 
1501 	switch (op) {
1502 	case INIT:
1503 	case RETURN:
1504 		/* ANSI C forbids conversion of %s to %s */
1505 		warning(303, rts, lts);
1506 		break;
1507 	case FARG:
1508 		/* ANSI C forbids conversion of %s to %s, arg #%d */
1509 		warning(304, rts, lts, arg);
1510 		break;
1511 	default:
1512 		/* ANSI C forbids conversion of %s to %s, op %s */
1513 		warning(305, rts, lts, op_name(op));
1514 		break;
1515 	}
1516 }
1517 
1518 static bool
1519 check_assign_void_pointer_compat(op_t op, int arg,
1520 				 const type_t *const ltp, tspec_t const lt,
1521 				 const type_t *const lstp, tspec_t const lst,
1522 				 const tnode_t *const rn,
1523 				 const type_t *const rtp, tspec_t const rt,
1524 				 const type_t *const rstp, tspec_t const rst)
1525 {
1526 	if (!(lt == PTR && rt == PTR && (lst == VOID || rst == VOID ||
1527 					 eqtype(lstp, rstp, true, false, NULL))))
1528 		return false;
1529 
1530 	/* compatible pointer types (qualifiers ignored) */
1531 	if (allow_c90 &&
1532 	    ((!lstp->t_const && rstp->t_const) ||
1533 	     (!lstp->t_volatile && rstp->t_volatile))) {
1534 		/* left side has not all qualifiers of right */
1535 		switch (op) {
1536 		case INIT:
1537 		case RETURN:
1538 			/* incompatible pointer types (%s != %s) */
1539 			warning(182, type_name(lstp), type_name(rstp));
1540 			break;
1541 		case FARG:
1542 			/* converting '%s' to incompatible '%s' ... */
1543 			warning(153,
1544 			    type_name(rtp), type_name(ltp), arg);
1545 			break;
1546 		default:
1547 			/* operands have incompatible pointer type... */
1548 			warning(128, op_name(op),
1549 			    type_name(lstp), type_name(rstp));
1550 			break;
1551 		}
1552 	}
1553 
1554 	if (allow_c90)
1555 		check_unconst_function(lstp, rn);
1556 
1557 	return true;
1558 }
1559 
1560 static bool
1561 check_assign_pointer_integer(op_t op, int arg,
1562 			     const type_t *const ltp, tspec_t const lt,
1563 			     const type_t *const rtp, tspec_t const rt)
1564 {
1565 	const char *lx, *rx;
1566 
1567 	if (!((lt == PTR && is_integer(rt)) || (is_integer(lt) && rt == PTR)))
1568 		return false;
1569 
1570 	lx = lt == PTR ? "pointer" : "integer";
1571 	rx = rt == PTR ? "pointer" : "integer";
1572 
1573 	switch (op) {
1574 	case INIT:
1575 	case RETURN:
1576 		/* illegal combination of %s (%s) and %s (%s) */
1577 		warning(183, lx, type_name(ltp), rx, type_name(rtp));
1578 		break;
1579 	case FARG:
1580 		/* illegal combination of %s (%s) and %s (%s), arg #%d */
1581 		warning(154,
1582 		    lx, type_name(ltp), rx, type_name(rtp), arg);
1583 		break;
1584 	default:
1585 		/* illegal combination of %s '%s' and %s '%s', op '%s' */
1586 		warning(123,
1587 		    lx, type_name(ltp), rx, type_name(rtp), op_name(op));
1588 		break;
1589 	}
1590 	return true;
1591 }
1592 
1593 static bool
1594 check_assign_pointer(op_t op, int arg,
1595 		     const type_t *ltp, tspec_t lt,
1596 		     const type_t *rtp, tspec_t rt)
1597 {
1598 	if (!(lt == PTR && rt == PTR))
1599 		return false;
1600 
1601 	switch (op) {
1602 	case RETURN:
1603 		warn_incompatible_pointers(NULL, ltp, rtp);
1604 		break;
1605 	case FARG:
1606 		/* converting '%s' to incompatible '%s' for ... */
1607 		warning(153, type_name(rtp), type_name(ltp), arg);
1608 		break;
1609 	default:
1610 		warn_incompatible_pointers(&modtab[op], ltp, rtp);
1611 		break;
1612 	}
1613 	return true;
1614 }
1615 
1616 static void
1617 warn_assign(op_t op, int arg,
1618 	    const type_t *ltp, tspec_t lt,
1619 	    const type_t *rtp, tspec_t rt)
1620 {
1621 	switch (op) {
1622 	case INIT:
1623 		/* cannot initialize '%s' from '%s' */
1624 		error(185, type_name(ltp), type_name(rtp));
1625 		break;
1626 	case RETURN:
1627 		/* return value type mismatch (%s) and (%s) */
1628 		error(211, type_name(ltp), type_name(rtp));
1629 		break;
1630 	case FARG:
1631 		/* passing '%s' to incompatible '%s', arg #%d */
1632 		warning(155, type_name(rtp), type_name(ltp), arg);
1633 		break;
1634 	default:
1635 		warn_incompatible_types(op, ltp, lt, rtp, rt);
1636 		break;
1637 	}
1638 }
1639 
1640 /*
1641  * Checks type compatibility for ASSIGN, INIT, FARG and RETURN
1642  * and prints warnings/errors if necessary.
1643  * Returns whether the types are (almost) compatible.
1644  */
1645 static bool
1646 check_assign_types_compatible(op_t op, int arg,
1647 			      const tnode_t *ln, const tnode_t *rn)
1648 {
1649 	tspec_t	lt, rt, lst = NOTSPEC, rst = NOTSPEC;
1650 	type_t	*ltp, *rtp, *lstp = NULL, *rstp = NULL;
1651 
1652 	if ((lt = (ltp = ln->tn_type)->t_tspec) == PTR)
1653 		lst = (lstp = ltp->t_subt)->t_tspec;
1654 	if ((rt = (rtp = rn->tn_type)->t_tspec) == PTR)
1655 		rst = (rstp = rtp->t_subt)->t_tspec;
1656 
1657 	if (lt == BOOL && is_scalar(rt))	/* C99 6.3.1.2 */
1658 		return true;
1659 
1660 	if (is_arithmetic(lt) && (is_arithmetic(rt) || rt == BOOL))
1661 		return true;
1662 
1663 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION))
1664 		/* both are struct or union */
1665 		return ltp->t_str == rtp->t_str;
1666 
1667 	/* a null pointer may be assigned to any pointer */
1668 	if (lt == PTR && is_null_pointer(rn))
1669 		return true;
1670 
1671 	check_assign_void_pointer(op, arg, lt, lst, rt, rst);
1672 
1673 	if (check_assign_void_pointer_compat(op, arg,
1674 	    ltp, lt, lstp, lst, rn, rtp, rt, rstp, rst))
1675 		return true;
1676 
1677 	if (check_assign_pointer_integer(op, arg, ltp, lt, rtp, rt))
1678 		return true;
1679 
1680 	if (check_assign_pointer(op, arg, ltp, lt, rtp, rt))
1681 		return true;
1682 
1683 	warn_assign(op, arg, ltp, lt, rtp, rt);
1684 	return false;
1685 }
1686 
1687 /* Prints a warning if a strange operator is used on an enum type. */
1688 static void
1689 check_bad_enum_operation(op_t op, const tnode_t *ln, const tnode_t *rn)
1690 {
1691 
1692 	if (!eflag)
1693 		return;
1694 
1695 	/*
1696 	 * Enum as offset to a pointer is an exception (otherwise enums
1697 	 * could not be used as array indices).
1698 	 */
1699 	if (op == PLUS &&
1700 	    ((ln->tn_type->t_is_enum && rn->tn_type->t_tspec == PTR) ||
1701 	     (rn->tn_type->t_is_enum && ln->tn_type->t_tspec == PTR))) {
1702 		return;
1703 	}
1704 
1705 	/* dubious operation on enum, op %s */
1706 	warning(241, op_name(op));
1707 }
1708 
1709 /*
1710  * Prints a warning if an operator is applied to two different enum types.
1711  */
1712 static void
1713 check_enum_type_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1714 {
1715 	const mod_t *mp;
1716 
1717 	mp = &modtab[op];
1718 
1719 	if (ln->tn_type->t_enum != rn->tn_type->t_enum) {
1720 		switch (op) {
1721 		case INIT:
1722 			/* enum type mismatch between '%s' and '%s' in ... */
1723 			warning(210,
1724 			    type_name(ln->tn_type), type_name(rn->tn_type));
1725 			break;
1726 		case FARG:
1727 			/* enum type mismatch, arg #%d (%s != %s) */
1728 			warning(156, arg,
1729 			    type_name(ln->tn_type), type_name(rn->tn_type));
1730 			break;
1731 		case RETURN:
1732 			/* return value type mismatch (%s) and (%s) */
1733 			warning(211,
1734 			    type_name(ln->tn_type), type_name(rn->tn_type));
1735 			break;
1736 		default:
1737 			/* enum type mismatch: '%s' '%s' '%s' */
1738 			warning(130, type_name(ln->tn_type), mp->m_name,
1739 			    type_name(rn->tn_type));
1740 			break;
1741 		}
1742 	} else if (Pflag && mp->m_comparison && op != EQ && op != NE) {
1743 		if (eflag)
1744 			/* dubious comparison of enums, op %s */
1745 			warning(243, mp->m_name);
1746 	}
1747 }
1748 
1749 /* Prints a warning if the operands mix between enum and integer. */
1750 static void
1751 check_enum_int_mismatch(op_t op, int arg, const tnode_t *ln, const tnode_t *rn)
1752 {
1753 
1754 	if (!eflag)
1755 		return;
1756 
1757 	switch (op) {
1758 	case INIT:
1759 		/*
1760 		 * Initialization with 0 is allowed. Otherwise, all implicit
1761 		 * initializations would need to be warned upon as well.
1762 		 */
1763 		if (!rn->tn_type->t_is_enum && rn->tn_op == CON &&
1764 		    is_integer(rn->tn_type->t_tspec) &&
1765 		    rn->tn_val->v_quad == 0) {
1766 			return;
1767 		}
1768 		/* initialization of '%s' with '%s' */
1769 		warning(277, type_name(ln->tn_type), type_name(rn->tn_type));
1770 		break;
1771 	case FARG:
1772 		/* combination of '%s' and '%s', arg #%d */
1773 		warning(278,
1774 		    type_name(ln->tn_type), type_name(rn->tn_type), arg);
1775 		break;
1776 	case RETURN:
1777 		/* combination of '%s' and '%s' in return */
1778 		warning(279, type_name(ln->tn_type), type_name(rn->tn_type));
1779 		break;
1780 	default:
1781 		/* combination of '%s' and '%s', op %s */
1782 		warning(242, type_name(ln->tn_type), type_name(rn->tn_type),
1783 		    op_name(op));
1784 		break;
1785 	}
1786 }
1787 
1788 static void
1789 check_enum_array_index(const tnode_t *ln, const tnode_t *rn)
1790 {
1791 	int max_array_index;
1792 	int64_t max_enum_value;
1793 	const struct sym *ec, *max_ec;
1794 	const type_t *lt, *rt;
1795 
1796 	if (ln->tn_op != ADDR || ln->tn_left->tn_op != NAME)
1797 		return;
1798 
1799 	lt = ln->tn_left->tn_type;
1800 	if (lt->t_tspec != ARRAY || lt->t_incomplete_array)
1801 		return;
1802 
1803 	if (rn->tn_op != CVT || !rn->tn_type->t_is_enum)
1804 		return;
1805 	if (rn->tn_left->tn_op != LOAD)
1806 		return;
1807 
1808 	rt = rn->tn_left->tn_type;
1809 	ec = rt->t_enum->en_first_enumerator;
1810 	max_ec = ec;
1811 	lint_assert(ec != NULL);
1812 	for (ec = ec->s_next; ec != NULL; ec = ec->s_next)
1813 		if (ec->u.s_enum_constant > max_ec->u.s_enum_constant)
1814 			max_ec = ec;
1815 
1816 	max_enum_value = max_ec->u.s_enum_constant;
1817 	lint_assert(INT_MIN <= max_enum_value && max_enum_value <= INT_MAX);
1818 
1819 	max_array_index = lt->t_dim - 1;
1820 	if (max_enum_value == max_array_index)
1821 		return;
1822 
1823 	/*
1824 	 * If the largest enum constant is named '*_NUM_*', it is typically
1825 	 * not part of the allowed enum values but a marker for the number
1826 	 * of actual enum values.
1827 	 */
1828 	if (max_enum_value == max_array_index + 1 &&
1829 	    (strstr(max_ec->s_name, "NUM") != NULL ||
1830 	     strstr(max_ec->s_name, "num") != NULL))
1831 		return;
1832 
1833 	/* maximum value %d of '%s' does not match maximum array index %d */
1834 	warning(348, (int)max_enum_value, type_name(rt), max_array_index);
1835 	print_previous_declaration(-1, max_ec);
1836 }
1837 
1838 /*
1839  * Build and initialize a new node.
1840  */
1841 static tnode_t *
1842 new_tnode(op_t op, bool sys, type_t *type, tnode_t *ln, tnode_t *rn)
1843 {
1844 	tnode_t	*ntn;
1845 	tspec_t	t;
1846 #if 0 /* not yet */
1847 	size_t l;
1848 	uint64_t rnum;
1849 #endif
1850 
1851 	ntn = expr_alloc_tnode();
1852 
1853 	ntn->tn_op = op;
1854 	ntn->tn_type = type;
1855 	ntn->tn_sys = sys;
1856 	ntn->tn_left = ln;
1857 	ntn->tn_right = rn;
1858 
1859 	switch (op) {
1860 #if 0 /* not yet */
1861 	case SHR:
1862 		if (rn->tn_op != CON)
1863 			break;
1864 		rnum = rn->tn_val->v_quad;
1865 		l = type_size_in_bits(ln->tn_type) / CHAR_SIZE;
1866 		t = ln->tn_type->t_tspec;
1867 		switch (l) {
1868 		case 8:
1869 			if (rnum >= 56)
1870 				t = UCHAR;
1871 			else if (rnum >= 48)
1872 				t = USHORT;
1873 			else if (rnum >= 32)
1874 				t = UINT;
1875 			break;
1876 		case 4:
1877 			if (rnum >= 24)
1878 				t = UCHAR;
1879 			else if (rnum >= 16)
1880 				t = USHORT;
1881 			break;
1882 		case 2:
1883 			if (rnum >= 8)
1884 				t = UCHAR;
1885 			break;
1886 		default:
1887 			break;
1888 		}
1889 		if (t != ln->tn_type->t_tspec)
1890 			ntn->tn_type->t_tspec = t;
1891 		break;
1892 #endif
1893 	case INDIR:
1894 	case FSEL:
1895 		lint_assert(ln->tn_type->t_tspec == PTR);
1896 		t = ln->tn_type->t_subt->t_tspec;
1897 		if (t != FUNC && t != VOID)
1898 			ntn->tn_lvalue = true;
1899 		break;
1900 	default:
1901 		break;
1902 	}
1903 
1904 	return ntn;
1905 }
1906 
1907 /*
1908  * Performs the "integer promotions" (C99 6.3.1.1p2), which convert small
1909  * integer types to either int or unsigned int.
1910  *
1911  * If allow_c90 is unset or the operand is a function argument with no type
1912  * information (no prototype or variable # of args), converts float to double.
1913  */
1914 tnode_t *
1915 promote(op_t op, bool farg, tnode_t *tn)
1916 {
1917 	tspec_t	t;
1918 	type_t	*ntp;
1919 	unsigned int len;
1920 
1921 	t = tn->tn_type->t_tspec;
1922 
1923 	if (!is_arithmetic(t))
1924 		return tn;
1925 
1926 	if (allow_c90) {
1927 		/*
1928 		 * C99 6.3.1.1p2 requires for types with lower rank than int
1929 		 * that "If an int can represent all the values of the
1930 		 * original type, the value is converted to an int; otherwise
1931 		 * it is converted to an unsigned int", and that "All other
1932 		 * types are unchanged by the integer promotions".
1933 		 */
1934 		if (tn->tn_type->t_bitfield) {
1935 			len = tn->tn_type->t_flen;
1936 			if (len < size_in_bits(INT)) {
1937 				t = INT;
1938 			} else if (len == size_in_bits(INT)) {
1939 				t = is_uinteger(t) ? UINT : INT;
1940 			}
1941 		} else if (t == CHAR || t == UCHAR || t == SCHAR) {
1942 			t = (size_in_bits(CHAR) < size_in_bits(INT)
1943 			     || t != UCHAR) ? INT : UINT;
1944 		} else if (t == SHORT || t == USHORT) {
1945 			t = (size_in_bits(SHORT) < size_in_bits(INT)
1946 			     || t == SHORT) ? INT : UINT;
1947 		} else if (t == ENUM) {
1948 			t = INT;
1949 		} else if (farg && t == FLOAT) {
1950 			t = DOUBLE;
1951 		}
1952 	} else {
1953 		/*
1954 		 * In traditional C, keep unsigned and promote FLOAT
1955 		 * to DOUBLE.
1956 		 */
1957 		if (t == UCHAR || t == USHORT) {
1958 			t = UINT;
1959 		} else if (t == CHAR || t == SCHAR || t == SHORT) {
1960 			t = INT;
1961 		} else if (t == FLOAT) {
1962 			t = DOUBLE;
1963 		} else if (t == ENUM) {
1964 			t = INT;
1965 		}
1966 	}
1967 
1968 	if (t != tn->tn_type->t_tspec) {
1969 		ntp = expr_dup_type(tn->tn_type);
1970 		ntp->t_tspec = t;
1971 		/*
1972 		 * Keep t_is_enum even though t_tspec gets converted from
1973 		 * ENUM to INT, so we are later able to check compatibility
1974 		 * of enum types.
1975 		 */
1976 		tn = convert(op, 0, ntp, tn);
1977 	}
1978 
1979 	return tn;
1980 }
1981 
1982 /*
1983  * Apply the "usual arithmetic conversions" (C99 6.3.1.8).
1984  *
1985  * This gives both operands the same type.
1986  * This is done in different ways for traditional C and C90.
1987  */
1988 static void
1989 balance(op_t op, tnode_t **lnp, tnode_t **rnp)
1990 {
1991 	tspec_t	lt, rt, t;
1992 	int	i;
1993 	bool	u;
1994 	type_t	*ntp;
1995 	static const tspec_t tl[] = {
1996 		LDOUBLE, DOUBLE, FLOAT,
1997 #ifdef INT128_SIZE
1998 		UINT128, INT128,
1999 #endif
2000 		UQUAD, QUAD,
2001 		ULONG, LONG,
2002 		UINT, INT,
2003 	};
2004 
2005 	lt = (*lnp)->tn_type->t_tspec;
2006 	rt = (*rnp)->tn_type->t_tspec;
2007 
2008 	if (!is_arithmetic(lt) || !is_arithmetic(rt))
2009 		return;
2010 
2011 	if (allow_c90) {
2012 		if (lt == rt) {
2013 			t = lt;
2014 		} else if (lt == LCOMPLEX || rt == LCOMPLEX) {
2015 			t = LCOMPLEX;
2016 		} else if (lt == DCOMPLEX || rt == DCOMPLEX) {
2017 			t = DCOMPLEX;
2018 		} else if (lt == FCOMPLEX || rt == FCOMPLEX) {
2019 			t = FCOMPLEX;
2020 		} else if (lt == LDOUBLE || rt == LDOUBLE) {
2021 			t = LDOUBLE;
2022 		} else if (lt == DOUBLE || rt == DOUBLE) {
2023 			t = DOUBLE;
2024 		} else if (lt == FLOAT || rt == FLOAT) {
2025 			t = FLOAT;
2026 		} else {
2027 			/*
2028 			 * If type A has more bits than type B it should
2029 			 * be able to hold all possible values of type B.
2030 			 */
2031 			if (size_in_bits(lt) > size_in_bits(rt)) {
2032 				t = lt;
2033 			} else if (size_in_bits(lt) < size_in_bits(rt)) {
2034 				t = rt;
2035 			} else {
2036 				for (i = 3; tl[i] != INT; i++) {
2037 					if (tl[i] == lt || tl[i] == rt)
2038 						break;
2039 				}
2040 				if ((is_uinteger(lt) || is_uinteger(rt)) &&
2041 				    !is_uinteger(tl[i])) {
2042 					i--;
2043 				}
2044 				t = tl[i];
2045 			}
2046 		}
2047 	} else {
2048 		/* Keep unsigned in traditional C */
2049 		u = is_uinteger(lt) || is_uinteger(rt);
2050 		for (i = 0; tl[i] != INT; i++) {
2051 			if (lt == tl[i] || rt == tl[i])
2052 				break;
2053 		}
2054 		t = tl[i];
2055 		if (u && is_integer(t) && !is_uinteger(t))
2056 			t = unsigned_type(t);
2057 	}
2058 
2059 	if (t != lt) {
2060 		ntp = expr_dup_type((*lnp)->tn_type);
2061 		ntp->t_tspec = t;
2062 		*lnp = convert(op, 0, ntp, *lnp);
2063 	}
2064 	if (t != rt) {
2065 		ntp = expr_dup_type((*rnp)->tn_type);
2066 		ntp->t_tspec = t;
2067 		*rnp = convert(op, 0, ntp, *rnp);
2068 	}
2069 }
2070 
2071 /*
2072  * Insert a conversion operator, which converts the type of the node
2073  * to another given type.
2074  * If op is FARG, arg is the number of the argument (used for warnings).
2075  */
2076 tnode_t *
2077 convert(op_t op, int arg, type_t *tp, tnode_t *tn)
2078 {
2079 	tnode_t	*ntn;
2080 	tspec_t	nt, ot;
2081 
2082 	nt = tp->t_tspec;
2083 	ot = tn->tn_type->t_tspec;
2084 
2085 	if (allow_trad && allow_c90 && op == FARG)
2086 		check_prototype_conversion(arg, nt, ot, tp, tn);
2087 
2088 	if (is_integer(nt) && is_integer(ot)) {
2089 		check_integer_conversion(op, arg, nt, ot, tp, tn);
2090 	} else if (nt == PTR && is_null_pointer(tn)) {
2091 		/* a null pointer may be assigned to any pointer. */
2092 	} else if (is_integer(nt) && nt != BOOL && ot == PTR) {
2093 		check_pointer_integer_conversion(op, nt, tp, tn);
2094 	} else if (nt == PTR && ot == PTR && op == CVT) {
2095 		check_pointer_conversion(tn, tp);
2096 	}
2097 
2098 	ntn = expr_alloc_tnode();
2099 	ntn->tn_op = CVT;
2100 	ntn->tn_type = tp;
2101 	ntn->tn_cast = op == CVT;
2102 	ntn->tn_sys |= tn->tn_sys;
2103 	ntn->tn_right = NULL;
2104 	if (tn->tn_op != CON || nt == VOID) {
2105 		ntn->tn_left = tn;
2106 	} else {
2107 		ntn->tn_op = CON;
2108 		ntn->tn_val = expr_zero_alloc(sizeof(*ntn->tn_val));
2109 		convert_constant(op, arg, ntn->tn_type, ntn->tn_val,
2110 		    tn->tn_val);
2111 	}
2112 
2113 	return ntn;
2114 }
2115 
2116 static bool
2117 should_warn_about_prototype_conversion(tspec_t nt,
2118 				       tspec_t ot, const tnode_t *ptn)
2119 {
2120 
2121 	if (nt == ot)
2122 		return false;
2123 
2124 	if (nt == ENUM && ot == INT)
2125 		return false;
2126 
2127 	if (is_floating(nt) != is_floating(ot) ||
2128 	    portable_size_in_bits(nt) != portable_size_in_bits(ot)) {
2129 		/* representation and/or width change */
2130 		if (!is_integer(ot))
2131 			return true;
2132 		/*
2133 		 * XXX: Investigate whether this rule makes sense; see
2134 		 * tests/usr.bin/xlint/lint1/platform_long.c.
2135 		 */
2136 		return portable_size_in_bits(ot) > portable_size_in_bits(INT);
2137 	}
2138 
2139 	if (!hflag)
2140 		return false;
2141 
2142 	/*
2143 	 * If the types differ only in sign and the argument has the same
2144 	 * representation in both types, print no warning.
2145 	 */
2146 	if (ptn->tn_op == CON && is_integer(nt) &&
2147 	    signed_type(nt) == signed_type(ot) &&
2148 	    !msb(ptn->tn_val->v_quad, ot))
2149 		return false;
2150 
2151 	return true;
2152 }
2153 
2154 /*
2155  * Warn if a prototype causes a type conversion that is different from what
2156  * would happen to the same argument in the absence of a prototype.  This
2157  * check is intended for code that needs to stay compatible with pre-C90 C.
2158  *
2159  * Errors/warnings about illegal type combinations are already printed
2160  * in check_assign_types_compatible().
2161  */
2162 static void
2163 check_prototype_conversion(int arg, tspec_t nt, tspec_t ot, type_t *tp,
2164 			   tnode_t *tn)
2165 {
2166 	tnode_t	*ptn;
2167 
2168 	if (!is_arithmetic(nt) || !is_arithmetic(ot))
2169 		return;
2170 
2171 	/*
2172 	 * If the type of the formal parameter is char/short, a warning
2173 	 * would be useless, because functions declared the old style
2174 	 * can't expect char/short arguments.
2175 	 */
2176 	if (nt == CHAR || nt == SCHAR || nt == UCHAR ||
2177 	    nt == SHORT || nt == USHORT)
2178 		return;
2179 
2180 	/* apply the default promotion */
2181 	ptn = promote(NOOP, true, tn);
2182 	ot = ptn->tn_type->t_tspec;
2183 
2184 	if (should_warn_about_prototype_conversion(nt, ot, ptn)) {
2185 		/* argument #%d is converted from '%s' to '%s' ... */
2186 		warning(259, arg, type_name(tn->tn_type), type_name(tp));
2187 	}
2188 }
2189 
2190 /*
2191  * When converting a large integer type to a small integer type, in some
2192  * cases the value of the actual expression is further restricted than the
2193  * type bounds, such as in (expr & 0xFF) or (expr % 100) or (expr >> 24).
2194  *
2195  * See new_tnode, the '#if 0' code for SHR.
2196  */
2197 static bool
2198 can_represent(const type_t *tp, const tnode_t *tn)
2199 {
2200 
2201 	if (tn->tn_op == BITAND) {
2202 		const tnode_t *rn = tn->tn_right;
2203 		tspec_t nt;
2204 
2205 		if (!(rn != NULL && rn->tn_op == CON &&
2206 		      is_integer(rn->tn_type->t_tspec)))
2207 			return false;
2208 
2209 		uint64_t nmask = value_bits(size_in_bits(nt = tp->t_tspec));
2210 		if (!is_uinteger(nt))
2211 			nmask >>= 1;
2212 
2213 		uint64_t omask = (uint64_t)rn->tn_val->v_quad;
2214 		if ((omask & ~nmask) == 0)
2215 			return true;
2216 	}
2217 
2218 	return false;
2219 }
2220 
2221 /*
2222  * Print warnings for conversions of integer types which may cause problems.
2223  */
2224 static void
2225 check_integer_conversion(op_t op, int arg, tspec_t nt, tspec_t ot, type_t *tp,
2226 			 tnode_t *tn)
2227 {
2228 
2229 	if (tn->tn_op == CON)
2230 		return;
2231 
2232 	if (op == CVT)
2233 		return;
2234 
2235 	if (allow_c99 && nt == BOOL)
2236 		return;		/* See C99 6.3.1.2 */
2237 
2238 	if (Pflag && pflag && aflag > 0 &&
2239 	    portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
2240 	    is_uinteger(nt) != is_uinteger(ot)) {
2241 		if (op == FARG) {
2242 			/* conversion to '%s' may sign-extend ... */
2243 			warning(297, type_name(tp), arg);
2244 		} else {
2245 			/* conversion to '%s' may sign-extend ... */
2246 			warning(131, type_name(tp));
2247 		}
2248 	}
2249 
2250 	if (Pflag && portable_size_in_bits(nt) > portable_size_in_bits(ot) &&
2251 	    (tn->tn_op == PLUS || tn->tn_op == MINUS || tn->tn_op == MULT ||
2252 	     tn->tn_op == SHL)) {
2253 		/* suggest cast from '%s' to '%s' on op %s to ... */
2254 		warning(324, type_name(gettyp(ot)), type_name(tp),
2255 		    op_name(tn->tn_op));
2256 	}
2257 
2258 	if (aflag > 0 &&
2259 	    portable_size_in_bits(nt) < portable_size_in_bits(ot) &&
2260 	    !can_represent(tp, tn) &&
2261 	    (ot == LONG || ot == ULONG || ot == QUAD || ot == UQUAD ||
2262 	     aflag > 1)) {
2263 		if (op == FARG) {
2264 			/* conversion from '%s' to '%s' may lose ... */
2265 			warning(298,
2266 			    type_name(tn->tn_type), type_name(tp), arg);
2267 		} else {
2268 			/* conversion from '%s' to '%s' may lose accuracy */
2269 			warning(132,
2270 			    type_name(tn->tn_type), type_name(tp));
2271 		}
2272 	}
2273 }
2274 
2275 /*
2276  * Print warnings for dubious conversions of pointer to integer.
2277  */
2278 static void
2279 check_pointer_integer_conversion(op_t op, tspec_t nt, type_t *tp, tnode_t *tn)
2280 {
2281 
2282 	if (tn->tn_op == CON)
2283 		return;
2284 	if (op != CVT)
2285 		return;		/* We got already an error. */
2286 	if (portable_size_in_bits(nt) >= portable_size_in_bits(PTR))
2287 		return;
2288 
2289 	if (pflag && size_in_bits(nt) >= size_in_bits(PTR)) {
2290 		/* conversion of pointer to '%s' may lose bits */
2291 		warning(134, type_name(tp));
2292 	} else {
2293 		/* conversion of pointer to '%s' loses bits */
2294 		warning(133, type_name(tp));
2295 	}
2296 }
2297 
2298 static bool
2299 should_warn_about_pointer_cast(const type_t *nstp, tspec_t nst,
2300 			       const type_t *ostp, tspec_t ost)
2301 {
2302 	/*
2303 	 * Casting a pointer to 'struct S' to a pointer to another struct that
2304 	 * has 'struct S' as its first member is ok, see msg_247.c, 'struct
2305 	 * counter'.
2306 	 */
2307 	if (nst == STRUCT && ost == STRUCT &&
2308 	    nstp->t_str->sou_first_member != NULL &&
2309 	    nstp->t_str->sou_first_member->s_type == ostp)
2310 		return false;
2311 
2312 	if (is_incomplete(nstp) || is_incomplete(ostp))
2313 		return false;
2314 
2315 	if ((nst == STRUCT || nst == UNION) && nstp->t_str != ostp->t_str)
2316 		return true;
2317 
2318 	if (nst == CHAR || nst == UCHAR)
2319 		return false;	/* for the sake of traditional C code */
2320 	if (ost == CHAR || ost == UCHAR)
2321 		return false;	/* for the sake of traditional C code */
2322 
2323 	return portable_size_in_bits(nst) != portable_size_in_bits(ost);
2324 }
2325 
2326 /*
2327  * Warn about questionable pointer conversions.
2328  */
2329 static void
2330 check_pointer_conversion(tnode_t *tn, type_t *ntp)
2331 {
2332 	const type_t *nstp, *otp, *ostp;
2333 	tspec_t nst, ost;
2334 	const char *nts, *ots;
2335 
2336 	nstp = ntp->t_subt;
2337 	otp = tn->tn_type;
2338 	ostp = otp->t_subt;
2339 	nst = nstp->t_tspec;
2340 	ost = ostp->t_tspec;
2341 
2342 	if (nst == VOID || ost == VOID) {
2343 		/* TODO: C99 behaves like C90 here. */
2344 		if ((!allow_trad && !allow_c99) && (nst == FUNC || ost == FUNC)) {
2345 			/* null pointers are already handled in convert() */
2346 			*(nst == FUNC ? &nts : &ots) = "function pointer";
2347 			*(nst == VOID ? &nts : &ots) = "'void *'";
2348 			/* ANSI C forbids conversion of %s to %s */
2349 			warning(303, ots, nts);
2350 		}
2351 		return;
2352 	} else if (nst == FUNC && ost == FUNC) {
2353 		return;
2354 	} else if (nst == FUNC || ost == FUNC) {
2355 		/* converting '%s' to '%s' is questionable */
2356 		warning(229, type_name(otp), type_name(ntp));
2357 		return;
2358 	}
2359 
2360 	if (hflag && alignment_in_bits(nstp) > alignment_in_bits(ostp) &&
2361 	    ost != CHAR && ost != UCHAR &&
2362 	    !is_incomplete(ostp)) {
2363 		/* converting '%s' to '%s' may cause alignment problem */
2364 		warning(135, type_name(otp), type_name(ntp));
2365 	}
2366 
2367 	if (cflag && should_warn_about_pointer_cast(nstp, nst, ostp, ost)) {
2368 		/* pointer cast from '%s' to '%s' may be troublesome */
2369 		warning(247, type_name(otp), type_name(ntp));
2370 	}
2371 }
2372 
2373 static void
2374 convert_constant_floating(op_t op, int arg, tspec_t ot, const type_t *tp,
2375 			  tspec_t nt, val_t *v, val_t *nv)
2376 {
2377 	ldbl_t	max = 0.0, min = 0.0;
2378 
2379 	switch (nt) {
2380 	case CHAR:
2381 		max = TARG_CHAR_MAX;	min = TARG_CHAR_MIN;	break;
2382 	case UCHAR:
2383 		max = TARG_UCHAR_MAX;	min = 0;		break;
2384 	case SCHAR:
2385 		max = TARG_SCHAR_MAX;	min = TARG_SCHAR_MIN;	break;
2386 	case SHORT:
2387 		max = TARG_SHRT_MAX;	min = TARG_SHRT_MIN;	break;
2388 	case USHORT:
2389 		max = TARG_USHRT_MAX;	min = 0;		break;
2390 	case ENUM:
2391 	case INT:
2392 		max = TARG_INT_MAX;	min = TARG_INT_MIN;	break;
2393 	case UINT:
2394 		max = TARG_UINT_MAX;	min = 0;		break;
2395 	case LONG:
2396 		max = TARG_LONG_MAX;	min = TARG_LONG_MIN;	break;
2397 	case ULONG:
2398 		max = TARG_ULONG_MAX;	min = 0;		break;
2399 	case QUAD:
2400 		max = QUAD_MAX;		min = QUAD_MIN;		break;
2401 	case UQUAD:
2402 		max = UQUAD_MAX;	min = 0;		break;
2403 	case FLOAT:
2404 	case FCOMPLEX:
2405 		max = FLT_MAX;		min = -FLT_MAX;		break;
2406 	case DOUBLE:
2407 	case DCOMPLEX:
2408 		max = DBL_MAX;		min = -DBL_MAX;		break;
2409 	case PTR:
2410 		/* Got already an error because of float --> ptr */
2411 	case LDOUBLE:
2412 	case LCOMPLEX:
2413 		/* LINTED 248 */
2414 		max = LDBL_MAX;		min = -max;		break;
2415 	default:
2416 		lint_assert(/*CONSTCOND*/false);
2417 	}
2418 	if (v->v_ldbl > max || v->v_ldbl < min) {
2419 		lint_assert(nt != LDOUBLE);
2420 		if (op == FARG) {
2421 			/* conversion of '%s' to '%s' is out of range, ... */
2422 			warning(295,
2423 			    type_name(gettyp(ot)), type_name(tp), arg);
2424 		} else {
2425 			/* conversion of '%s' to '%s' is out of range */
2426 			warning(119,
2427 			    type_name(gettyp(ot)), type_name(tp));
2428 		}
2429 		v->v_ldbl = v->v_ldbl > 0 ? max : min;
2430 	}
2431 
2432 	if (nt == FLOAT) {
2433 		nv->v_ldbl = (float)v->v_ldbl;
2434 	} else if (nt == DOUBLE) {
2435 		nv->v_ldbl = (double)v->v_ldbl;
2436 	} else if (nt == LDOUBLE) {
2437 		nv->v_ldbl = v->v_ldbl;
2438 	} else {
2439 		nv->v_quad = (int64_t)v->v_ldbl;
2440 	}
2441 }
2442 
2443 static bool
2444 convert_constant_to_floating(tspec_t nt, val_t *nv,
2445 			     tspec_t ot, const val_t *v)
2446 {
2447 	if (nt == FLOAT) {
2448 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2449 		    (float)(uint64_t)v->v_quad : (float)v->v_quad;
2450 	} else if (nt == DOUBLE) {
2451 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2452 		    (double)(uint64_t)v->v_quad : (double)v->v_quad;
2453 	} else if (nt == LDOUBLE) {
2454 		nv->v_ldbl = (ot == PTR || is_uinteger(ot)) ?
2455 		    (ldbl_t)(uint64_t)v->v_quad : (ldbl_t)v->v_quad;
2456 	} else
2457 		return false;
2458 	return true;
2459 }
2460 
2461 /*
2462  * Print a warning if bits which were set are lost due to the conversion.
2463  * This can happen with operator ORASS only.
2464  */
2465 static void
2466 convert_constant_check_range_bitor(size_t nsz, size_t osz, const val_t *v,
2467 				   uint64_t xmask, op_t op)
2468 {
2469 	if (nsz < osz && (v->v_quad & xmask) != 0) {
2470 		/* constant truncated by conversion, op %s */
2471 		warning(306, op_name(op));
2472 	}
2473 }
2474 
2475 /*
2476  * Print a warning if additional bits are not all 1
2477  * and the most significant bit of the old value is 1,
2478  * or if at least one (but not all) removed bit was 0.
2479  */
2480 static void
2481 convert_constant_check_range_bitand(size_t nsz, size_t osz,
2482 				    uint64_t xmask, const val_t *nv,
2483 				    tspec_t ot, const val_t *v,
2484 				    const type_t *tp, op_t op)
2485 {
2486 	if (nsz > osz &&
2487 	    (nv->v_quad & bit((unsigned int)(osz - 1))) != 0 &&
2488 	    (nv->v_quad & xmask) != xmask) {
2489 		/* extra bits set to 0 in conversion of '%s' to '%s', ... */
2490 		warning(309, type_name(gettyp(ot)),
2491 		    type_name(tp), op_name(op));
2492 	} else if (nsz < osz &&
2493 		   (v->v_quad & xmask) != xmask &&
2494 		   (v->v_quad & xmask) != 0) {
2495 		/* constant truncated by conversion, op %s */
2496 		warning(306, op_name(op));
2497 	}
2498 }
2499 
2500 static void
2501 convert_constant_check_range_signed(op_t op, int arg)
2502 {
2503 	if (op == ASSIGN) {
2504 		/* assignment of negative constant to unsigned type */
2505 		warning(164);
2506 	} else if (op == INIT) {
2507 		/* initialization of unsigned with negative constant */
2508 		warning(221);
2509 	} else if (op == FARG) {
2510 		/* conversion of negative constant to unsigned type, ... */
2511 		warning(296, arg);
2512 	} else if (modtab[op].m_comparison) {
2513 		/* handled by check_integer_comparison() */
2514 	} else {
2515 		/* conversion of negative constant to unsigned type */
2516 		warning(222);
2517 	}
2518 }
2519 
2520 /*
2521  * Loss of significant bit(s). All truncated bits
2522  * of unsigned types or all truncated bits plus the
2523  * msb of the target for signed types are considered
2524  * to be significant bits. Loss of significant bits
2525  * means that at least one of the bits was set in an
2526  * unsigned type or that at least one but not all of
2527  * the bits was set in a signed type.
2528  * Loss of significant bits means that it is not
2529  * possible, also not with necessary casts, to convert
2530  * back to the original type. A example for a
2531  * necessary cast is:
2532  *	char c;	int	i; c = 128;
2533  *	i = c;			** yields -128 **
2534  *	i = (unsigned char)c;	** yields 128 **
2535  */
2536 static void
2537 convert_constant_check_range_truncated(op_t op, int arg, const type_t *tp,
2538 				       tspec_t ot)
2539 {
2540 	if (op == ASSIGN && tp->t_bitfield) {
2541 		/* precision lost in bit-field assignment */
2542 		warning(166);
2543 	} else if (op == ASSIGN) {
2544 		/* constant truncated by assignment */
2545 		warning(165);
2546 	} else if (op == INIT && tp->t_bitfield) {
2547 		/* bit-field initializer does not fit */
2548 		warning(180);
2549 	} else if (op == INIT) {
2550 		/* initializer does not fit */
2551 		warning(178);
2552 	} else if (op == CASE) {
2553 		/* case label affected by conversion */
2554 		warning(196);
2555 	} else if (op == FARG) {
2556 		/* conversion of '%s' to '%s' is out of range, arg #%d */
2557 		warning(295,
2558 		    type_name(gettyp(ot)), type_name(tp), arg);
2559 	} else {
2560 		/* conversion of '%s' to '%s' is out of range */
2561 		warning(119,
2562 		    type_name(gettyp(ot)), type_name(tp));
2563 	}
2564 }
2565 
2566 static void
2567 convert_constant_check_range_loss(op_t op, int arg, const type_t *tp,
2568 				  tspec_t ot)
2569 {
2570 	if (op == ASSIGN && tp->t_bitfield) {
2571 		/* precision lost in bit-field assignment */
2572 		warning(166);
2573 	} else if (op == INIT && tp->t_bitfield) {
2574 		/* bit-field initializer out of range */
2575 		warning(11);
2576 	} else if (op == CASE) {
2577 		/* case label affected by conversion */
2578 		warning(196);
2579 	} else if (op == FARG) {
2580 		/* conversion of '%s' to '%s' is out of range, arg #%d */
2581 		warning(295,
2582 		    type_name(gettyp(ot)), type_name(tp), arg);
2583 	} else {
2584 		/* conversion of '%s' to '%s' is out of range */
2585 		warning(119,
2586 		    type_name(gettyp(ot)), type_name(tp));
2587 	}
2588 }
2589 
2590 static void
2591 convert_constant_check_range(tspec_t ot, const type_t *tp, tspec_t nt,
2592 			     op_t op, int arg, const val_t *v, val_t *nv)
2593 {
2594 	unsigned int osz, nsz;
2595 	uint64_t xmask, xmsk1;
2596 
2597 	osz = size_in_bits(ot);
2598 	nsz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2599 	xmask = value_bits(nsz) ^ value_bits(osz);
2600 	xmsk1 = value_bits(nsz) ^ value_bits(osz - 1);
2601 	/*
2602 	 * For bitwise operations we are not interested in the
2603 	 * value, but in the bits itself.
2604 	 */
2605 	if (op == ORASS || op == BITOR || op == BITXOR) {
2606 		convert_constant_check_range_bitor(nsz, osz, v, xmask, op);
2607 	} else if (op == ANDASS || op == BITAND) {
2608 		convert_constant_check_range_bitand(nsz, osz, xmask, nv, ot,
2609 		    v, tp, op);
2610 	} else if ((nt != PTR && is_uinteger(nt)) &&
2611 		   (ot != PTR && !is_uinteger(ot)) &&
2612 		   v->v_quad < 0) {
2613 		convert_constant_check_range_signed(op, arg);
2614 	} else if (nv->v_quad != v->v_quad && nsz <= osz &&
2615 		   (v->v_quad & xmask) != 0 &&
2616 		   (is_uinteger(ot) || (v->v_quad & xmsk1) != xmsk1)) {
2617 		convert_constant_check_range_truncated(op, arg, tp, ot);
2618 	} else if (nv->v_quad != v->v_quad) {
2619 		convert_constant_check_range_loss(op, arg, tp, ot);
2620 	}
2621 }
2622 
2623 /*
2624  * Converts a typed constant to a constant of another type.
2625  *
2626  * op		operator which requires conversion
2627  * arg		if op is FARG, # of argument
2628  * tp		type in which to convert the constant
2629  * nv		new constant
2630  * v		old constant
2631  */
2632 void
2633 convert_constant(op_t op, int arg, const type_t *tp, val_t *nv, val_t *v)
2634 {
2635 	tspec_t ot, nt;
2636 	unsigned int sz;
2637 	bool range_check;
2638 
2639 	/*
2640 	 * TODO: make 'v' const; the name of this function does not suggest
2641 	 *  that it modifies 'v'.
2642 	 */
2643 	ot = v->v_tspec;
2644 	nt = nv->v_tspec = tp->t_tspec;
2645 	range_check = false;
2646 
2647 	if (nt == BOOL) {	/* C99 6.3.1.2 */
2648 		nv->v_unsigned_since_c90 = false;
2649 		nv->v_quad = is_nonzero_val(v) ? 1 : 0;
2650 		return;
2651 	}
2652 
2653 	if (ot == FLOAT || ot == DOUBLE || ot == LDOUBLE) {
2654 		convert_constant_floating(op, arg, ot, tp, nt, v, nv);
2655 	} else if (!convert_constant_to_floating(nt, nv, ot, v)) {
2656 		range_check = true;	/* Check for lost precision. */
2657 		nv->v_quad = v->v_quad;
2658 	}
2659 
2660 	if (allow_trad && allow_c90 && v->v_unsigned_since_c90 &&
2661 	    (is_floating(nt) || (
2662 		(is_integer(nt) && !is_uinteger(nt) &&
2663 		 portable_size_in_bits(nt) > portable_size_in_bits(ot))))) {
2664 		/* ANSI C treats constant as unsigned */
2665 		warning(157);
2666 		v->v_unsigned_since_c90 = false;
2667 	}
2668 
2669 	if (is_integer(nt)) {
2670 		sz = tp->t_bitfield ? tp->t_flen : size_in_bits(nt);
2671 		nv->v_quad = convert_integer(nv->v_quad, nt, sz);
2672 	}
2673 
2674 	if (range_check && op != CVT)
2675 		convert_constant_check_range(ot, tp, nt, op, arg, v, nv);
2676 }
2677 
2678 /*
2679  * Called if incompatible types were detected.
2680  * Prints a appropriate warning.
2681  */
2682 static void
2683 warn_incompatible_types(op_t op,
2684 			const type_t *ltp, tspec_t lt,
2685 			const type_t *rtp, tspec_t rt)
2686 {
2687 	const mod_t *mp;
2688 
2689 	mp = &modtab[op];
2690 
2691 	if (lt == VOID || (mp->m_binary && rt == VOID)) {
2692 		/* void type illegal in expression */
2693 		error(109);
2694 	} else if (op == ASSIGN) {
2695 		if ((lt == STRUCT || lt == UNION) &&
2696 		    (rt == STRUCT || rt == UNION)) {
2697 			/* assignment of different structures (%s != %s) */
2698 			error(240, tspec_name(lt), tspec_name(rt));
2699 		} else {
2700 			/* cannot assign to '%s' from '%s' */
2701 			error(171, type_name(ltp), type_name(rtp));
2702 		}
2703 	} else if (mp->m_binary) {
2704 		/* operands of '%s' have incompatible types (%s != %s) */
2705 		error(107, mp->m_name, tspec_name(lt), tspec_name(rt));
2706 	} else {
2707 		lint_assert(rt == NOTSPEC);
2708 		/* operand of '%s' has invalid type (%s) */
2709 		error(108, mp->m_name, tspec_name(lt));
2710 	}
2711 }
2712 
2713 /*
2714  * Called if incompatible pointer types are detected.
2715  * Print an appropriate warning.
2716  */
2717 static void
2718 warn_incompatible_pointers(const mod_t *mp,
2719 			   const type_t *ltp, const type_t *rtp)
2720 {
2721 	tspec_t	lt, rt;
2722 
2723 	lint_assert(ltp->t_tspec == PTR);
2724 	lint_assert(rtp->t_tspec == PTR);
2725 
2726 	lt = ltp->t_subt->t_tspec;
2727 	rt = rtp->t_subt->t_tspec;
2728 
2729 	if ((lt == STRUCT || lt == UNION) && (rt == STRUCT || rt == UNION)) {
2730 		if (mp == NULL) {
2731 			/* illegal structure pointer combination */
2732 			warning(244);
2733 		} else {
2734 			/* incompatible structure pointers: '%s' '%s' '%s' */
2735 			warning(245, type_name(ltp), mp->m_name, type_name(rtp));
2736 		}
2737 	} else {
2738 		if (mp == NULL) {
2739 			/* illegal combination of '%s' and '%s' */
2740 			warning(184, type_name(ltp), type_name(rtp));
2741 		} else {
2742 			/* illegal combination of '%s' and '%s', op '%s' */
2743 			warning(124,
2744 			    type_name(ltp), type_name(rtp), mp->m_name);
2745 		}
2746 	}
2747 }
2748 
2749 /* Return a type based on tp1, with added qualifiers from tp2. */
2750 static type_t *
2751 merge_qualifiers(type_t *tp1, const type_t *tp2)
2752 {
2753 	type_t *ntp, *nstp;
2754 	bool c1, c2, v1, v2;
2755 
2756 	lint_assert(tp1->t_tspec == PTR);
2757 	lint_assert(tp2->t_tspec == PTR);
2758 
2759 	c1 = tp1->t_subt->t_const;
2760 	c2 = tp2->t_subt->t_const;
2761 	v1 = tp1->t_subt->t_volatile;
2762 	v2 = tp2->t_subt->t_volatile;
2763 
2764 	if (c1 == (c1 | c2) && v1 == (v1 | v2))
2765 		return tp1;
2766 
2767 	nstp = expr_dup_type(tp1->t_subt);
2768 	nstp->t_const |= c2;
2769 	nstp->t_volatile |= v2;
2770 
2771 	ntp = expr_dup_type(tp1);
2772 	ntp->t_subt = nstp;
2773 	return ntp;
2774 }
2775 
2776 /*
2777  * Returns true if the given structure or union has a constant member
2778  * (maybe recursively).
2779  */
2780 static bool
2781 has_constant_member(const type_t *tp)
2782 {
2783 	sym_t *m;
2784 
2785 	lint_assert(is_struct_or_union(tp->t_tspec));
2786 
2787 	for (m = tp->t_str->sou_first_member; m != NULL; m = m->s_next) {
2788 		const type_t *mtp = m->s_type;
2789 		if (mtp->t_const)
2790 			return true;
2791 		if (is_struct_or_union(mtp->t_tspec) &&
2792 		    has_constant_member(mtp))
2793 			return true;
2794 	}
2795 	return false;
2796 }
2797 
2798 /*
2799  * Create a new node for one of the operators POINT and ARROW.
2800  */
2801 static tnode_t *
2802 build_struct_access(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
2803 {
2804 	tnode_t	*ntn, *ctn;
2805 	bool	nolval;
2806 
2807 	lint_assert(rn->tn_op == NAME);
2808 	lint_assert(is_member(rn->tn_sym));
2809 
2810 	/*
2811 	 * Remember if the left operand is an lvalue (structure members
2812 	 * are lvalues if and only if the structure itself is an lvalue).
2813 	 */
2814 	nolval = op == POINT && !ln->tn_lvalue;
2815 
2816 	if (op == POINT) {
2817 		ln = build_address(sys, ln, true);
2818 	} else if (ln->tn_type->t_tspec != PTR) {
2819 		lint_assert(!allow_c90);
2820 		lint_assert(is_integer(ln->tn_type->t_tspec));
2821 		ln = convert(NOOP, 0, expr_derive_type(gettyp(VOID), PTR), ln);
2822 	}
2823 
2824 	ctn = build_integer_constant(PTRDIFF_TSPEC,
2825 	    rn->tn_sym->u.s_member.sm_offset_in_bits / CHAR_SIZE);
2826 
2827 	ntn = new_tnode(PLUS, sys, expr_derive_type(rn->tn_type, PTR),
2828 	    ln, ctn);
2829 	if (ln->tn_op == CON)
2830 		ntn = fold(ntn);
2831 
2832 	if (rn->tn_type->t_bitfield) {
2833 		ntn = new_tnode(FSEL, sys, ntn->tn_type->t_subt, ntn, NULL);
2834 	} else {
2835 		ntn = new_tnode(INDIR, sys, ntn->tn_type->t_subt, ntn, NULL);
2836 	}
2837 
2838 	if (nolval)
2839 		ntn->tn_lvalue = false;
2840 
2841 	return ntn;
2842 }
2843 
2844 /*
2845  * Create a node for INCAFT, INCBEF, DECAFT and DECBEF.
2846  */
2847 static tnode_t *
2848 build_prepost_incdec(op_t op, bool sys, tnode_t *ln)
2849 {
2850 	tnode_t	*cn, *ntn;
2851 
2852 	lint_assert(ln != NULL);
2853 
2854 	if (ln->tn_type->t_tspec == PTR) {
2855 		cn = plength(ln->tn_type);
2856 	} else {
2857 		cn = build_integer_constant(INT, (int64_t)1);
2858 	}
2859 	ntn = new_tnode(op, sys, ln->tn_type, ln, cn);
2860 
2861 	return ntn;
2862 }
2863 
2864 /*
2865  * Create a node for REAL, IMAG
2866  */
2867 static tnode_t *
2868 build_real_imag(op_t op, bool sys, tnode_t *ln)
2869 {
2870 	tnode_t	*cn, *ntn;
2871 
2872 	lint_assert(ln != NULL);
2873 
2874 	if (ln->tn_op == NAME) {
2875 		/*
2876 		 * This may be too much, but it avoids wrong warnings.
2877 		 * See d_c99_complex_split.c.
2878 		 */
2879 		mark_as_used(ln->tn_sym, false, false);
2880 		mark_as_set(ln->tn_sym);
2881 	}
2882 
2883 	switch (ln->tn_type->t_tspec) {
2884 	case LCOMPLEX:
2885 		/* XXX: integer and LDOUBLE don't match. */
2886 		cn = build_integer_constant(LDOUBLE, (int64_t)1);
2887 		break;
2888 	case DCOMPLEX:
2889 		/* XXX: integer and DOUBLE don't match. */
2890 		cn = build_integer_constant(DOUBLE, (int64_t)1);
2891 		break;
2892 	case FCOMPLEX:
2893 		/* XXX: integer and FLOAT don't match. */
2894 		cn = build_integer_constant(FLOAT, (int64_t)1);
2895 		break;
2896 	default:
2897 		/* __%s__ is illegal for type %s */
2898 		error(276, op == REAL ? "real" : "imag",
2899 		    type_name(ln->tn_type));
2900 		return NULL;
2901 	}
2902 	ntn = new_tnode(op, sys, cn->tn_type, ln, cn);
2903 	ntn->tn_lvalue = true;
2904 
2905 	return ntn;
2906 }
2907 
2908 /*
2909  * Create a tree node for the unary & operator
2910  */
2911 static tnode_t *
2912 build_address(bool sys, tnode_t *tn, bool noign)
2913 {
2914 	tspec_t	t;
2915 
2916 	if (!noign && ((t = tn->tn_type->t_tspec) == ARRAY || t == FUNC)) {
2917 		if (!allow_c90)
2918 			/* '&' before array or function: ignored */
2919 			warning(127);
2920 		return tn;
2921 	}
2922 
2923 	/* eliminate &* */
2924 	if (tn->tn_op == INDIR &&
2925 	    tn->tn_left->tn_type->t_tspec == PTR &&
2926 	    tn->tn_left->tn_type->t_subt == tn->tn_type) {
2927 		return tn->tn_left;
2928 	}
2929 
2930 	return new_tnode(ADDR, sys, expr_derive_type(tn->tn_type, PTR),
2931 	    tn, NULL);
2932 }
2933 
2934 /*
2935  * Create a node for operators PLUS and MINUS.
2936  */
2937 static tnode_t *
2938 build_plus_minus(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
2939 {
2940 	tnode_t	*ntn, *ctn;
2941 	type_t	*tp;
2942 
2943 	/* If pointer and integer, then pointer to the lhs. */
2944 	if (rn->tn_type->t_tspec == PTR && is_integer(ln->tn_type->t_tspec)) {
2945 		ntn = ln;
2946 		ln = rn;
2947 		rn = ntn;
2948 	}
2949 
2950 	if (ln->tn_type->t_tspec == PTR && rn->tn_type->t_tspec != PTR) {
2951 		lint_assert(is_integer(rn->tn_type->t_tspec));
2952 
2953 		check_ctype_macro_invocation(ln, rn);
2954 		check_enum_array_index(ln, rn);
2955 
2956 		ctn = plength(ln->tn_type);
2957 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
2958 			rn = convert(NOOP, 0, ctn->tn_type, rn);
2959 		rn = new_tnode(MULT, sys, rn->tn_type, rn, ctn);
2960 		if (rn->tn_left->tn_op == CON)
2961 			rn = fold(rn);
2962 		ntn = new_tnode(op, sys, ln->tn_type, ln, rn);
2963 
2964 	} else if (rn->tn_type->t_tspec == PTR) {
2965 
2966 		lint_assert(ln->tn_type->t_tspec == PTR);
2967 		lint_assert(op == MINUS);
2968 		tp = gettyp(PTRDIFF_TSPEC);
2969 		ntn = new_tnode(op, sys, tp, ln, rn);
2970 		if (ln->tn_op == CON && rn->tn_op == CON)
2971 			ntn = fold(ntn);
2972 		ctn = plength(ln->tn_type);
2973 		balance(NOOP, &ntn, &ctn);
2974 		ntn = new_tnode(DIV, sys, tp, ntn, ctn);
2975 
2976 	} else {
2977 
2978 		ntn = new_tnode(op, sys, ln->tn_type, ln, rn);
2979 
2980 	}
2981 	return ntn;
2982 }
2983 
2984 /*
2985  * Create a node for operators SHL and SHR.
2986  */
2987 static tnode_t *
2988 build_bit_shift(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
2989 {
2990 	tspec_t	t;
2991 	tnode_t	*ntn;
2992 
2993 	if ((t = rn->tn_type->t_tspec) != INT && t != UINT)
2994 		rn = convert(CVT, 0, gettyp(INT), rn);
2995 	ntn = new_tnode(op, sys, ln->tn_type, ln, rn);
2996 	return ntn;
2997 }
2998 
2999 /*
3000  * Create a node for COLON.
3001  */
3002 static tnode_t *
3003 build_colon(bool sys, tnode_t *ln, tnode_t *rn)
3004 {
3005 	tspec_t	lt, rt, pdt;
3006 	type_t	*tp;
3007 	tnode_t	*ntn;
3008 
3009 	lt = ln->tn_type->t_tspec;
3010 	rt = rn->tn_type->t_tspec;
3011 	pdt = PTRDIFF_TSPEC;
3012 
3013 	/*
3014 	 * Arithmetic types are balanced, all other type combinations
3015 	 * still need to be handled.
3016 	 */
3017 	if (is_arithmetic(lt) && is_arithmetic(rt)) {
3018 		tp = ln->tn_type;
3019 	} else if (lt == BOOL && rt == BOOL) {
3020 		tp = ln->tn_type;
3021 	} else if (lt == VOID || rt == VOID) {
3022 		tp = gettyp(VOID);
3023 	} else if (lt == STRUCT || lt == UNION) {
3024 		/* Both types must be identical. */
3025 		lint_assert(rt == STRUCT || rt == UNION);
3026 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
3027 		if (is_incomplete(ln->tn_type)) {
3028 			/* unknown operand size, op %s */
3029 			error(138, op_name(COLON));
3030 			return NULL;
3031 		}
3032 		tp = ln->tn_type;
3033 	} else if (lt == PTR && is_integer(rt)) {
3034 		if (rt != pdt) {
3035 			rn = convert(NOOP, 0, gettyp(pdt), rn);
3036 			rt = pdt;
3037 		}
3038 		tp = ln->tn_type;
3039 	} else if (rt == PTR && is_integer(lt)) {
3040 		if (lt != pdt) {
3041 			ln = convert(NOOP, 0, gettyp(pdt), ln);
3042 			lt = pdt;
3043 		}
3044 		tp = rn->tn_type;
3045 	} else if (lt == PTR && ln->tn_type->t_subt->t_tspec == VOID) {
3046 		tp = merge_qualifiers(rn->tn_type, ln->tn_type);
3047 	} else if (rt == PTR && rn->tn_type->t_subt->t_tspec == VOID) {
3048 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
3049 	} else {
3050 		/*
3051 		 * XXX For now we simply take the left type. This is
3052 		 * probably wrong, if one type contains a function prototype
3053 		 * and the other one, at the same place, only an old style
3054 		 * declaration.
3055 		 */
3056 		tp = merge_qualifiers(ln->tn_type, rn->tn_type);
3057 	}
3058 
3059 	ntn = new_tnode(COLON, sys, tp, ln, rn);
3060 
3061 	return ntn;
3062 }
3063 
3064 /*
3065  * Create a node for an assignment operator (both = and op= ).
3066  */
3067 static tnode_t *
3068 build_assignment(op_t op, bool sys, tnode_t *ln, tnode_t *rn)
3069 {
3070 	tspec_t	lt, rt;
3071 	tnode_t	*ntn, *ctn;
3072 
3073 	lint_assert(ln != NULL);
3074 	lint_assert(rn != NULL);
3075 
3076 	lt = ln->tn_type->t_tspec;
3077 	rt = rn->tn_type->t_tspec;
3078 
3079 	if ((op == ADDASS || op == SUBASS) && lt == PTR) {
3080 		lint_assert(is_integer(rt));
3081 		ctn = plength(ln->tn_type);
3082 		if (rn->tn_type->t_tspec != ctn->tn_type->t_tspec)
3083 			rn = convert(NOOP, 0, ctn->tn_type, rn);
3084 		rn = new_tnode(MULT, sys, rn->tn_type, rn, ctn);
3085 		if (rn->tn_left->tn_op == CON)
3086 			rn = fold(rn);
3087 	}
3088 
3089 	if ((op == ASSIGN || op == RETURN || op == INIT) &&
3090 	    (lt == STRUCT || rt == STRUCT)) {
3091 		lint_assert(lt == rt);
3092 		lint_assert(ln->tn_type->t_str == rn->tn_type->t_str);
3093 		if (is_incomplete(ln->tn_type)) {
3094 			if (op == RETURN) {
3095 				/* cannot return incomplete type */
3096 				error(212);
3097 			} else {
3098 				/* unknown operand size, op %s */
3099 				error(138, op_name(op));
3100 			}
3101 			return NULL;
3102 		}
3103 	}
3104 
3105 	if (op == SHLASS) {
3106 		if (portable_size_in_bits(lt) < portable_size_in_bits(rt)) {
3107 			if (hflag)
3108 				/* semantics of '%s' change in ANSI C; ... */
3109 				warning(118, "<<=");
3110 		}
3111 	} else if (op != SHRASS) {
3112 		if (op == ASSIGN || lt != PTR) {
3113 			if (lt != rt ||
3114 			    (ln->tn_type->t_bitfield && rn->tn_op == CON)) {
3115 				rn = convert(op, 0, ln->tn_type, rn);
3116 				rt = lt;
3117 			}
3118 		}
3119 	}
3120 
3121 	ntn = new_tnode(op, sys, ln->tn_type, ln, rn);
3122 
3123 	return ntn;
3124 }
3125 
3126 /*
3127  * Get length_in_bits of type tp->t_subt, as a constant expression of type
3128  * ptrdiff_t as seen from the target platform.
3129  */
3130 static tnode_t *
3131 plength(type_t *tp)
3132 {
3133 	int elem, elsz_in_bits;
3134 
3135 	lint_assert(tp->t_tspec == PTR);
3136 	tp = tp->t_subt;
3137 
3138 	elem = 1;
3139 	elsz_in_bits = 0;
3140 
3141 	while (tp->t_tspec == ARRAY) {
3142 		elem *= tp->t_dim;
3143 		tp = tp->t_subt;
3144 	}
3145 
3146 	switch (tp->t_tspec) {
3147 	case FUNC:
3148 		/* pointer to function is not allowed here */
3149 		error(110);
3150 		break;
3151 	case VOID:
3152 		/* cannot do pointer arithmetic on operand of unknown size */
3153 		gnuism(136);
3154 		break;
3155 	case STRUCT:
3156 	case UNION:
3157 		if ((elsz_in_bits = tp->t_str->sou_size_in_bits) == 0)
3158 			/* cannot do pointer arithmetic on operand of ... */
3159 			error(136);
3160 		break;
3161 	case ENUM:
3162 		if (is_incomplete(tp)) {
3163 			/* cannot do pointer arithmetic on operand of ... */
3164 			warning(136);
3165 		}
3166 		/* FALLTHROUGH */
3167 	default:
3168 		if ((elsz_in_bits = size_in_bits(tp->t_tspec)) == 0) {
3169 			/* cannot do pointer arithmetic on operand of ... */
3170 			error(136);
3171 		} else {
3172 			lint_assert(elsz_in_bits != -1);
3173 		}
3174 		break;
3175 	}
3176 
3177 	if (elem == 0 && elsz_in_bits != 0) {
3178 		/* cannot do pointer arithmetic on operand of unknown size */
3179 		error(136);
3180 	}
3181 
3182 	if (elsz_in_bits == 0)
3183 		elsz_in_bits = CHAR_SIZE;
3184 
3185 	return build_integer_constant(PTRDIFF_TSPEC,
3186 	    (int64_t)(elem * elsz_in_bits / CHAR_SIZE));
3187 }
3188 
3189 /*
3190  * XXX
3191  * Note: There appear to be a number of bugs in detecting overflow in
3192  * this function. An audit and a set of proper regression tests are needed.
3193  *     --Perry Metzger, Nov. 16, 2001
3194  */
3195 /*
3196  * Do only as much as necessary to compute constant expressions.
3197  * Called only if the operator allows folding and all operands are constants.
3198  */
3199 static tnode_t *
3200 fold(tnode_t *tn)
3201 {
3202 	val_t *v;
3203 	tspec_t t;
3204 	bool utyp, ovfl;
3205 	int64_t sl, sr = 0, q = 0, mask;
3206 	uint64_t ul, ur = 0;
3207 	tnode_t *cn;
3208 
3209 	v = xcalloc(1, sizeof(*v));
3210 	v->v_tspec = tn->tn_type->t_tspec;
3211 
3212 	t = tn->tn_left->tn_type->t_tspec;
3213 	utyp = !is_integer(t) || is_uinteger(t);
3214 	ul = sl = tn->tn_left->tn_val->v_quad;
3215 	if (is_binary(tn))
3216 		ur = sr = tn->tn_right->tn_val->v_quad;
3217 
3218 	mask = value_bits(size_in_bits(t));
3219 	ovfl = false;
3220 
3221 	switch (tn->tn_op) {
3222 	case UPLUS:
3223 		q = sl;
3224 		break;
3225 	case UMINUS:
3226 		q = sl == INT64_MIN ? sl : -sl;
3227 		if (sl != 0 && msb(q, t) == msb(sl, t))
3228 			ovfl = true;
3229 		break;
3230 	case COMPL:
3231 		q = ~sl;
3232 		break;
3233 	case MULT:
3234 		if (utyp) {
3235 			q = ul * ur;
3236 			if (q != (q & mask))
3237 				ovfl = true;
3238 			else if ((ul != 0) && ((q / ul) != ur))
3239 				ovfl = true;
3240 		} else {
3241 			q = sl * sr;
3242 			if (msb(q, t) != (msb(sl, t) ^ msb(sr, t)))
3243 				ovfl = true;
3244 		}
3245 		break;
3246 	case DIV:
3247 		if (sr == 0) {
3248 			/* division by 0 */
3249 			error(139);
3250 			q = utyp ? -1 : INT64_MAX;
3251 		} else {
3252 			q = utyp ? (int64_t)(ul / ur) : sl / sr;
3253 		}
3254 		break;
3255 	case MOD:
3256 		if (sr == 0) {
3257 			/* modulus by 0 */
3258 			error(140);
3259 			q = 0;
3260 		} else {
3261 			q = utyp ? (int64_t)(ul % ur) : sl % sr;
3262 		}
3263 		break;
3264 	case PLUS:
3265 		q = utyp ? (int64_t)(ul + ur) : sl + sr;
3266 		if (msb(sl, t) && msb(sr, t) && !msb(q, t))
3267 			ovfl = true;
3268 		if (!utyp && !msb(sl, t) && !msb(sr, t) && msb(q, t))
3269 			ovfl = true;
3270 		break;
3271 	case MINUS:
3272 		q = utyp ? (int64_t)(ul - ur) : sl - sr;
3273 		if (!utyp && msb(sl, t) && !msb(sr, t) && !msb(q, t))
3274 			ovfl = true;
3275 		if (!msb(sl, t) && msb(sr, t) && msb(q, t))
3276 			ovfl = true;
3277 		break;
3278 	case SHL:
3279 		q = utyp ? (int64_t)(ul << sr) : sl << sr;
3280 		break;
3281 	case SHR:
3282 		/*
3283 		 * The sign must be explicitly extended because
3284 		 * shifts of signed values are implementation dependent.
3285 		 */
3286 		q = ul >> sr;
3287 		q = convert_integer(q, t, size_in_bits(t) - (int)sr);
3288 		break;
3289 	case LT:
3290 		q = (utyp ? ul < ur : sl < sr) ? 1 : 0;
3291 		break;
3292 	case LE:
3293 		q = (utyp ? ul <= ur : sl <= sr) ? 1 : 0;
3294 		break;
3295 	case GE:
3296 		q = (utyp ? ul >= ur : sl >= sr) ? 1 : 0;
3297 		break;
3298 	case GT:
3299 		q = (utyp ? ul > ur : sl > sr) ? 1 : 0;
3300 		break;
3301 	case EQ:
3302 		q = (utyp ? ul == ur : sl == sr) ? 1 : 0;
3303 		break;
3304 	case NE:
3305 		q = (utyp ? ul != ur : sl != sr) ? 1 : 0;
3306 		break;
3307 	case BITAND:
3308 		q = utyp ? (int64_t)(ul & ur) : sl & sr;
3309 		break;
3310 	case BITXOR:
3311 		q = utyp ? (int64_t)(ul ^ ur) : sl ^ sr;
3312 		break;
3313 	case BITOR:
3314 		q = utyp ? (int64_t)(ul | ur) : sl | sr;
3315 		break;
3316 	default:
3317 		lint_assert(/*CONSTCOND*/false);
3318 	}
3319 
3320 	/* XXX does not work for quads. */
3321 	if (ovfl ||
3322 	    ((uint64_t)(q | mask) != ~(uint64_t)0 && (q & ~mask) != 0)) {
3323 		if (hflag)
3324 			/* integer overflow detected, op '%s' */
3325 			warning(141, op_name(tn->tn_op));
3326 	}
3327 
3328 	v->v_quad = convert_integer(q, t, 0);
3329 
3330 	cn = build_constant(tn->tn_type, v);
3331 	if (tn->tn_left->tn_system_dependent)
3332 		cn->tn_system_dependent = true;
3333 	if (is_binary(tn) && tn->tn_right->tn_system_dependent)
3334 		cn->tn_system_dependent = true;
3335 
3336 	return cn;
3337 }
3338 
3339 /*
3340  * Fold constant nodes, as much as is needed for comparing the value with 0.
3341  */
3342 static tnode_t *
3343 fold_bool(tnode_t *tn)
3344 {
3345 	bool	l, r;
3346 	val_t	*v;
3347 
3348 	v = xcalloc(1, sizeof(*v));
3349 	v->v_tspec = tn->tn_type->t_tspec;
3350 	lint_assert(v->v_tspec == INT || (Tflag && v->v_tspec == BOOL));
3351 
3352 	l = constant_is_nonzero(tn->tn_left);
3353 	r = is_binary(tn) && constant_is_nonzero(tn->tn_right);
3354 
3355 	switch (tn->tn_op) {
3356 	case NOT:
3357 		if (hflag && !constcond_flag)
3358 			/* constant argument to '!' */
3359 			warning(239);
3360 		v->v_quad = !l ? 1 : 0;
3361 		break;
3362 	case LOGAND:
3363 		v->v_quad = l && r ? 1 : 0;
3364 		break;
3365 	case LOGOR:
3366 		v->v_quad = l || r ? 1 : 0;
3367 		break;
3368 	default:
3369 		lint_assert(/*CONSTCOND*/false);
3370 	}
3371 
3372 	return build_constant(tn->tn_type, v);
3373 }
3374 
3375 static ldbl_t
3376 floating_error_value(tspec_t t, ldbl_t lv)
3377 {
3378 	if (t == FLOAT) {
3379 		return lv < 0 ? -FLT_MAX : FLT_MAX;
3380 	} else if (t == DOUBLE) {
3381 		return lv < 0 ? -DBL_MAX : DBL_MAX;
3382 	} else {
3383 		/* LINTED 248: floating-point constant out of range */
3384 		ldbl_t max = LDBL_MAX;
3385 		return lv < 0 ? -max : max;
3386 	}
3387 }
3388 
3389 /*
3390  * Fold constant nodes having operands with floating point type.
3391  */
3392 static tnode_t *
3393 fold_float(tnode_t *tn)
3394 {
3395 	val_t	*v;
3396 	tspec_t	t;
3397 	ldbl_t	lv, rv = 0;
3398 
3399 	fpe = 0;
3400 	v = xcalloc(1, sizeof(*v));
3401 	v->v_tspec = t = tn->tn_type->t_tspec;
3402 
3403 	lint_assert(is_floating(t));
3404 	lint_assert(t == tn->tn_left->tn_type->t_tspec);
3405 	lint_assert(!is_binary(tn) || t == tn->tn_right->tn_type->t_tspec);
3406 
3407 	lv = tn->tn_left->tn_val->v_ldbl;
3408 	if (is_binary(tn))
3409 		rv = tn->tn_right->tn_val->v_ldbl;
3410 
3411 	switch (tn->tn_op) {
3412 	case UPLUS:
3413 		v->v_ldbl = lv;
3414 		break;
3415 	case UMINUS:
3416 		v->v_ldbl = -lv;
3417 		break;
3418 	case MULT:
3419 		v->v_ldbl = lv * rv;
3420 		break;
3421 	case DIV:
3422 		if (rv == 0.0) {
3423 			/* division by 0 */
3424 			error(139);
3425 			v->v_ldbl = floating_error_value(t, lv);
3426 		} else {
3427 			v->v_ldbl = lv / rv;
3428 		}
3429 		break;
3430 	case PLUS:
3431 		v->v_ldbl = lv + rv;
3432 		break;
3433 	case MINUS:
3434 		v->v_ldbl = lv - rv;
3435 		break;
3436 	case LT:
3437 		v->v_quad = lv < rv ? 1 : 0;
3438 		break;
3439 	case LE:
3440 		v->v_quad = lv <= rv ? 1 : 0;
3441 		break;
3442 	case GE:
3443 		v->v_quad = lv >= rv ? 1 : 0;
3444 		break;
3445 	case GT:
3446 		v->v_quad = lv > rv ? 1 : 0;
3447 		break;
3448 	case EQ:
3449 		v->v_quad = lv == rv ? 1 : 0;
3450 		break;
3451 	case NE:
3452 		v->v_quad = lv != rv ? 1 : 0;
3453 		break;
3454 	default:
3455 		lint_assert(/*CONSTCOND*/false);
3456 	}
3457 
3458 	lint_assert(fpe != 0 || isnan((double)v->v_ldbl) == 0);
3459 	if (fpe != 0 || isfinite((double)v->v_ldbl) == 0 ||
3460 	    (t == FLOAT &&
3461 	     (v->v_ldbl > FLT_MAX || v->v_ldbl < -FLT_MAX)) ||
3462 	    (t == DOUBLE &&
3463 	     (v->v_ldbl > DBL_MAX || v->v_ldbl < -DBL_MAX))) {
3464 		/* floating point overflow detected, op %s */
3465 		warning(142, op_name(tn->tn_op));
3466 		v->v_ldbl = floating_error_value(t, v->v_ldbl);
3467 		fpe = 0;
3468 	}
3469 
3470 	return build_constant(tn->tn_type, v);
3471 }
3472 
3473 
3474 /*
3475  * Create a constant node for sizeof.
3476  */
3477 tnode_t *
3478 build_sizeof(const type_t *tp)
3479 {
3480 	unsigned int size_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3481 	tnode_t *tn = build_integer_constant(SIZEOF_TSPEC, size_in_bytes);
3482 	tn->tn_system_dependent = true;
3483 	debug_step("build_sizeof '%s' = %u", type_name(tp), size_in_bytes);
3484 	return tn;
3485 }
3486 
3487 /*
3488  * Create a constant node for offsetof.
3489  */
3490 /* ARGSUSED */ /* See implementation comments. */
3491 tnode_t *
3492 build_offsetof(const type_t *tp, const sym_t *sym)
3493 {
3494 	unsigned int offset_in_bytes;
3495 	tnode_t *tn;
3496 
3497 	if (!is_struct_or_union(tp->t_tspec))
3498 		/* unacceptable operand of '%s' */
3499 		error(111, "offsetof");
3500 
3501 	/* XXX: wrong size, no checking for sym fixme */
3502 	offset_in_bytes = type_size_in_bits(tp) / CHAR_SIZE;
3503 	tn = build_integer_constant(SIZEOF_TSPEC, offset_in_bytes);
3504 	tn->tn_system_dependent = true;
3505 	return tn;
3506 }
3507 
3508 unsigned int
3509 type_size_in_bits(const type_t *tp)
3510 {
3511 	unsigned int elem, elsz;
3512 	bool	flex;
3513 
3514 	elem = 1;
3515 	flex = false;
3516 	lint_assert(tp != NULL);
3517 	while (tp->t_tspec == ARRAY) {
3518 		flex = true;	/* allow c99 flex arrays [] [0] */
3519 		elem *= tp->t_dim;
3520 		tp = tp->t_subt;
3521 	}
3522 	if (elem == 0) {
3523 		if (!flex) {
3524 			/* cannot take size/alignment of incomplete type */
3525 			error(143);
3526 			elem = 1;
3527 		}
3528 	}
3529 	switch (tp->t_tspec) {
3530 	case FUNC:
3531 		/* cannot take size/alignment of function type '%s' */
3532 		error(144, type_name(tp));
3533 		elsz = 1;
3534 		break;
3535 	case STRUCT:
3536 	case UNION:
3537 		if (is_incomplete(tp)) {
3538 			/* cannot take size/alignment of incomplete type */
3539 			error(143);
3540 			elsz = 1;
3541 		} else {
3542 			elsz = tp->t_str->sou_size_in_bits;
3543 		}
3544 		break;
3545 	case ENUM:
3546 		if (is_incomplete(tp)) {
3547 			/* cannot take size/alignment of incomplete type */
3548 			warning(143);
3549 		}
3550 		/* FALLTHROUGH */
3551 	default:
3552 		if (tp->t_bitfield) {
3553 			/* cannot take size/alignment of bit-field */
3554 			error(145);
3555 		}
3556 		if (tp->t_tspec == VOID) {
3557 			/* cannot take size/alignment of void */
3558 			error(146);
3559 			elsz = 1;
3560 		} else {
3561 			elsz = size_in_bits(tp->t_tspec);
3562 			lint_assert(elsz > 0);
3563 		}
3564 		break;
3565 	}
3566 
3567 	return elem * elsz;
3568 }
3569 
3570 tnode_t *
3571 build_alignof(const type_t *tp)
3572 {
3573 	switch (tp->t_tspec) {
3574 	case ARRAY:
3575 		break;
3576 
3577 	case FUNC:
3578 		/* cannot take size/alignment of function type '%s' */
3579 		error(144, type_name(tp));
3580 		return 0;
3581 
3582 	case STRUCT:
3583 	case UNION:
3584 		if (is_incomplete(tp)) {
3585 			/* cannot take size/alignment of incomplete type */
3586 			error(143);
3587 			return 0;
3588 		}
3589 		break;
3590 	case ENUM:
3591 		break;
3592 	default:
3593 		if (tp->t_bitfield) {
3594 			/* cannot take size/alignment of bit-field */
3595 			error(145);
3596 			return 0;
3597 		}
3598 		if (tp->t_tspec == VOID) {
3599 			/* cannot take size/alignment of void */
3600 			error(146);
3601 			return 0;
3602 		}
3603 		break;
3604 	}
3605 
3606 	return build_integer_constant(SIZEOF_TSPEC,
3607 	    (int64_t)alignment_in_bits(tp) / CHAR_SIZE);
3608 }
3609 
3610 /*
3611  * Type casts.
3612  */
3613 tnode_t *
3614 cast(tnode_t *tn, type_t *tp)
3615 {
3616 	tspec_t	nt, ot;
3617 
3618 	if (tn == NULL)
3619 		return NULL;
3620 
3621 	tn = cconv(tn);
3622 
3623 	lint_assert(tp != NULL);
3624 	nt = tp->t_tspec;
3625 	ot = tn->tn_type->t_tspec;
3626 
3627 	if (nt == VOID) {
3628 		/*
3629 		 * C90 6.3.4, C99 6.5.4p2 and C11 6.5.4p2 allow any type to
3630 		 * be cast to void.  The only other allowed casts are from a
3631 		 * scalar type to a scalar type.
3632 		 */
3633 	} else if (nt == UNION) {
3634 		sym_t *m;
3635 		struct_or_union *str = tp->t_str;
3636 		if (!allow_gcc) {
3637 			/* union cast is a GCC extension */
3638 			error(328);
3639 			return NULL;
3640 		}
3641 		for (m = str->sou_first_member; m != NULL; m = m->s_next) {
3642 			if (eqtype(m->s_type, tn->tn_type,
3643 			    false, false, NULL)) {
3644 				tn = expr_alloc_tnode();
3645 				tn->tn_op = CVT;
3646 				tn->tn_type = tp;
3647 				tn->tn_cast = true;
3648 				tn->tn_right = NULL;
3649 				return tn;
3650 			}
3651 		}
3652 		/* type '%s' is not a member of '%s' */
3653 		error(329, type_name(tn->tn_type), type_name(tp));
3654 		return NULL;
3655 	} else if (nt == STRUCT || nt == ARRAY || nt == FUNC) {
3656 		/* Casting to a struct is an undocumented GCC extension. */
3657 		if (!(allow_gcc && nt == STRUCT))
3658 			goto invalid_cast;
3659 	} else if (ot == STRUCT || ot == UNION) {
3660 		goto invalid_cast;
3661 	} else if (ot == VOID) {
3662 		/* improper cast of void expression */
3663 		error(148);
3664 		return NULL;
3665 	} else if (is_integer(nt) && is_scalar(ot)) {
3666 		/* ok */
3667 	} else if (is_floating(nt) && is_arithmetic(ot)) {
3668 		/* ok */
3669 	} else if (nt == PTR && is_integer(ot)) {
3670 		/* ok */
3671 	} else if (nt == PTR && ot == PTR) {
3672 		if (!tp->t_subt->t_const && tn->tn_type->t_subt->t_const) {
3673 			if (hflag)
3674 				/* cast discards 'const' from type '%s' */
3675 				warning(275, type_name(tn->tn_type));
3676 		}
3677 	} else
3678 		goto invalid_cast;
3679 
3680 	tn = convert(CVT, 0, tp, tn);
3681 	tn->tn_cast = true;
3682 
3683 	return tn;
3684 
3685 invalid_cast:
3686 	/* invalid cast from '%s' to '%s' */
3687 	error(147, type_name(tn->tn_type), type_name(tp));
3688 	return NULL;
3689 }
3690 
3691 /*
3692  * Create the node for a function argument.
3693  * All necessary conversions and type checks are done in
3694  * build_function_call because build_function_argument has no
3695  * information about expected argument types.
3696  */
3697 tnode_t *
3698 build_function_argument(tnode_t *args, tnode_t *arg)
3699 {
3700 	tnode_t	*ntn;
3701 
3702 	/*
3703 	 * If there was a serious error in the expression for the argument,
3704 	 * create a dummy argument so the positions of the remaining arguments
3705 	 * will not change.
3706 	 */
3707 	if (arg == NULL)
3708 		arg = build_integer_constant(INT, 0);
3709 
3710 	ntn = new_tnode(PUSH, arg->tn_sys, arg->tn_type, arg, args);
3711 
3712 	return ntn;
3713 }
3714 
3715 /*
3716  * Create the node for a function call. Also check types of
3717  * function arguments and insert conversions, if necessary.
3718  */
3719 tnode_t *
3720 build_function_call(tnode_t *func, bool sys, tnode_t *args)
3721 {
3722 	tnode_t	*ntn;
3723 	op_t	fcop;
3724 
3725 	if (func == NULL)
3726 		return NULL;
3727 
3728 	if (func->tn_op == NAME && func->tn_type->t_tspec == FUNC) {
3729 		fcop = CALL;
3730 	} else {
3731 		fcop = ICALL;
3732 	}
3733 
3734 	check_ctype_function_call(func, args);
3735 
3736 	/*
3737 	 * after cconv() func will always be a pointer to a function
3738 	 * if it is a valid function designator.
3739 	 */
3740 	func = cconv(func);
3741 
3742 	if (func->tn_type->t_tspec != PTR ||
3743 	    func->tn_type->t_subt->t_tspec != FUNC) {
3744 		/* illegal function (type %s) */
3745 		error(149, type_name(func->tn_type));
3746 		return NULL;
3747 	}
3748 
3749 	args = check_function_arguments(func->tn_type->t_subt, args);
3750 
3751 	ntn = new_tnode(fcop, sys, func->tn_type->t_subt->t_subt, func, args);
3752 
3753 	return ntn;
3754 }
3755 
3756 /*
3757  * Check types of all function arguments and insert conversions,
3758  * if necessary.
3759  */
3760 static tnode_t *
3761 check_function_arguments(type_t *ftp, tnode_t *args)
3762 {
3763 	tnode_t	*arg;
3764 	sym_t	*asym;
3765 	tspec_t	at;
3766 	int	narg, npar, n, i;
3767 
3768 	/* get # of args in the prototype */
3769 	npar = 0;
3770 	for (asym = ftp->t_args; asym != NULL; asym = asym->s_next)
3771 		npar++;
3772 
3773 	/* get # of args in function call */
3774 	narg = 0;
3775 	for (arg = args; arg != NULL; arg = arg->tn_right)
3776 		narg++;
3777 
3778 	asym = ftp->t_args;
3779 	if (ftp->t_proto && npar != narg && !(ftp->t_vararg && npar < narg)) {
3780 		/* argument mismatch: %d arg%s passed, %d expected */
3781 		error(150, narg, narg > 1 ? "s" : "", npar);
3782 		asym = NULL;
3783 	}
3784 
3785 	for (n = 1; n <= narg; n++) {
3786 
3787 		/*
3788 		 * The rightmost argument is at the top of the argument
3789 		 * subtree.
3790 		 */
3791 		for (i = narg, arg = args; i > n; i--, arg = arg->tn_right)
3792 			continue;
3793 
3794 		/* some things which are always not allowed */
3795 		if ((at = arg->tn_left->tn_type->t_tspec) == VOID) {
3796 			/* void expressions may not be arguments, arg #%d */
3797 			error(151, n);
3798 			return NULL;
3799 		} else if ((at == STRUCT || at == UNION) &&
3800 			   is_incomplete(arg->tn_left->tn_type)) {
3801 			/* argument cannot have unknown size, arg #%d */
3802 			error(152, n);
3803 			return NULL;
3804 		} else if (is_integer(at) &&
3805 			   arg->tn_left->tn_type->t_is_enum &&
3806 			   is_incomplete(arg->tn_left->tn_type)) {
3807 			/* argument cannot have unknown size, arg #%d */
3808 			warning(152, n);
3809 		}
3810 
3811 		/* class conversions (arg in value context) */
3812 		arg->tn_left = cconv(arg->tn_left);
3813 
3814 		if (asym != NULL) {
3815 			arg->tn_left = check_prototype_argument(
3816 			    n, asym->s_type, arg->tn_left);
3817 		} else {
3818 			arg->tn_left = promote(NOOP, true, arg->tn_left);
3819 		}
3820 		arg->tn_type = arg->tn_left->tn_type;
3821 
3822 		if (asym != NULL)
3823 			asym = asym->s_next;
3824 	}
3825 
3826 	return args;
3827 }
3828 
3829 /*
3830  * Compare the type of an argument with the corresponding type of a
3831  * prototype parameter. If it is a valid combination, but both types
3832  * are not the same, insert a conversion to convert the argument into
3833  * the type of the parameter.
3834  */
3835 static tnode_t *
3836 check_prototype_argument(
3837 	int	n,		/* pos of arg */
3838 	type_t	*tp,		/* expected type (from prototype) */
3839 	tnode_t	*tn)		/* argument */
3840 {
3841 	tnode_t	*ln;
3842 	bool	dowarn;
3843 
3844 	ln = xcalloc(1, sizeof(*ln));
3845 	ln->tn_type = expr_unqualified_type(tp);
3846 	ln->tn_lvalue = true;
3847 	if (typeok(FARG, n, ln, tn)) {
3848 		if (!eqtype(tp, tn->tn_type,
3849 		    true, false, (dowarn = false, &dowarn)) || dowarn)
3850 			tn = convert(FARG, n, tp, tn);
3851 	}
3852 	free(ln);
3853 	return tn;
3854 }
3855 
3856 /*
3857  * Return the value of an integral constant expression.
3858  * If the expression is not constant or its type is not an integer
3859  * type, an error message is printed.
3860  */
3861 val_t *
3862 constant(tnode_t *tn, bool required)
3863 {
3864 	val_t	*v;
3865 
3866 	if (tn != NULL)
3867 		tn = cconv(tn);
3868 	if (tn != NULL)
3869 		tn = promote(NOOP, false, tn);
3870 
3871 	v = xcalloc(1, sizeof(*v));
3872 
3873 	if (tn == NULL) {
3874 		lint_assert(nerr != 0);
3875 		debug_step("constant node is null; returning 1 instead");
3876 		v->v_tspec = INT;
3877 		v->v_quad = 1;
3878 		return v;
3879 	}
3880 
3881 	v->v_tspec = tn->tn_type->t_tspec;
3882 
3883 	if (tn->tn_op == CON) {
3884 		lint_assert(tn->tn_type->t_tspec == tn->tn_val->v_tspec);
3885 		if (is_integer(tn->tn_val->v_tspec)) {
3886 			v->v_unsigned_since_c90 =
3887 			    tn->tn_val->v_unsigned_since_c90;
3888 			v->v_quad = tn->tn_val->v_quad;
3889 			return v;
3890 		}
3891 		v->v_quad = tn->tn_val->v_ldbl;
3892 	} else {
3893 		v->v_quad = 1;
3894 	}
3895 
3896 	if (required)
3897 		/* integral constant expression expected */
3898 		error(55);
3899 	else
3900 		/* variable array dimension is a C99/GCC extension */
3901 		c99ism(318);
3902 
3903 	if (!is_integer(v->v_tspec))
3904 		v->v_tspec = INT;
3905 
3906 	return v;
3907 }
3908 
3909 static bool
3910 is_constcond_false(const tnode_t *tn, tspec_t t)
3911 {
3912 	return (t == BOOL || t == INT) &&
3913 	       tn->tn_op == CON && tn->tn_val->v_quad == 0;
3914 }
3915 
3916 /*
3917  * Perform some tests on expressions which can't be done in build_binary()
3918  * and functions called by build_binary(). These tests must be done here
3919  * because we need some information about the context in which the operations
3920  * are performed.
3921  * After all tests are performed and dofreeblk is true, expr() frees the
3922  * memory which is used for the expression.
3923  */
3924 void
3925 expr(tnode_t *tn, bool vctx, bool cond, bool dofreeblk, bool is_do_while)
3926 {
3927 
3928 	if (tn == NULL) {	/* in case of errors */
3929 		expr_free_all();
3930 		return;
3931 	}
3932 
3933 	/* expr() is also called in global initializations */
3934 	if (dcs->d_kind != DK_EXTERN && !is_do_while)
3935 		check_statement_reachable();
3936 
3937 	check_expr_misc(tn, vctx, cond, !cond, false, false, false);
3938 	if (tn->tn_op == ASSIGN) {
3939 		if (hflag && cond)
3940 			/* assignment in conditional context */
3941 			warning(159);
3942 	} else if (tn->tn_op == CON) {
3943 		if (hflag && cond && !constcond_flag &&
3944 		    !tn->tn_system_dependent &&
3945 		    !(is_do_while &&
3946 		      is_constcond_false(tn, tn->tn_type->t_tspec)))
3947 			/* constant in conditional context */
3948 			warning(161);
3949 	}
3950 	if (!modtab[tn->tn_op].m_has_side_effect) {
3951 		/*
3952 		 * for left operands of COMMA this warning is already
3953 		 * printed
3954 		 */
3955 		if (tn->tn_op != COMMA && !vctx && !cond)
3956 			check_null_effect(tn);
3957 	}
3958 	debug_node(tn);
3959 
3960 	/* free the tree memory */
3961 	if (dofreeblk)
3962 		expr_free_all();
3963 }
3964 
3965 static bool
3966 has_side_effect(const tnode_t *tn) /* NOLINT(misc-no-recursion) */
3967 {
3968 	op_t op = tn->tn_op;
3969 
3970 	if (modtab[op].m_has_side_effect)
3971 		return true;
3972 
3973 	if (op == CVT && tn->tn_type->t_tspec == VOID)
3974 		return has_side_effect(tn->tn_left);
3975 
3976 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3977 	if (op == LOGAND || op == LOGOR)
3978 		return has_side_effect(tn->tn_right);
3979 
3980 	/* XXX: Why not has_side_effect(tn->tn_left) as well? */
3981 	if (op == QUEST)
3982 		return has_side_effect(tn->tn_right);
3983 
3984 	if (op == COLON || op == COMMA) {
3985 		return has_side_effect(tn->tn_left) ||
3986 		       has_side_effect(tn->tn_right);
3987 	}
3988 
3989 	return false;
3990 }
3991 
3992 static bool
3993 is_void_cast(const tnode_t *tn)
3994 {
3995 
3996 	return tn->tn_op == CVT && tn->tn_cast &&
3997 	       tn->tn_type->t_tspec == VOID;
3998 }
3999 
4000 static bool
4001 is_local_symbol(const tnode_t *tn)
4002 {
4003 
4004 	return tn->tn_op == LOAD &&
4005 	       tn->tn_left->tn_op == NAME &&
4006 	       tn->tn_left->tn_sym->s_scl == AUTO;
4007 }
4008 
4009 static bool
4010 is_int_constant_zero(const tnode_t *tn)
4011 {
4012 
4013 	return tn->tn_op == CON &&
4014 	       tn->tn_type->t_tspec == INT &&
4015 	       tn->tn_val->v_quad == 0;
4016 }
4017 
4018 static void
4019 check_null_effect(const tnode_t *tn)
4020 {
4021 
4022 	if (!hflag)
4023 		return;
4024 	if (has_side_effect(tn))
4025 		return;
4026 	if (is_void_cast(tn) && is_local_symbol(tn->tn_left))
4027 		return;
4028 	if (is_void_cast(tn) && is_int_constant_zero(tn->tn_left))
4029 		return;
4030 
4031 	/* expression has null effect */
4032 	warning(129);
4033 }
4034 
4035 static void
4036 check_expr_addr(const tnode_t *ln, bool szof, bool fcall)
4037 {
4038 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4039 	if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
4040 		if (!szof)
4041 			mark_as_set(ln->tn_sym);
4042 		mark_as_used(ln->tn_sym, fcall, szof);
4043 	}
4044 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4045 		/* check the range of array indices */
4046 		check_array_index(ln->tn_left, true);
4047 }
4048 
4049 static void
4050 check_expr_load(const tnode_t *ln)
4051 {
4052 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4053 		/* check the range of array indices */
4054 		check_array_index(ln->tn_left, false);
4055 }
4056 
4057 static void
4058 check_expr_side_effect(const tnode_t *ln, bool szof)
4059 {
4060 	scl_t sc;
4061 	dinfo_t *di;
4062 
4063 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4064 	if (ln->tn_op == NAME && (reached || !warn_about_unreachable)) {
4065 		sc = ln->tn_sym->s_scl;
4066 		/*
4067 		 * Look if there was a asm statement in one of the
4068 		 * compound statements we are in. If not, we don't
4069 		 * print a warning.
4070 		 */
4071 		for (di = dcs; di != NULL; di = di->d_enclosing) {
4072 			if (di->d_asm)
4073 				break;
4074 		}
4075 		if (sc != EXTERN && sc != STATIC &&
4076 		    !ln->tn_sym->s_set && !szof && di == NULL) {
4077 			/* %s may be used before set */
4078 			warning(158, ln->tn_sym->s_name);
4079 			mark_as_set(ln->tn_sym);
4080 		}
4081 		mark_as_used(ln->tn_sym, false, false);
4082 	}
4083 }
4084 
4085 static void
4086 check_expr_assign(const tnode_t *ln, bool szof)
4087 {
4088 	/* XXX: Taking warn_about_unreachable into account here feels wrong. */
4089 	if (ln->tn_op == NAME && !szof && (reached || !warn_about_unreachable)) {
4090 		mark_as_set(ln->tn_sym);
4091 		if (ln->tn_sym->s_scl == EXTERN)
4092 			outusg(ln->tn_sym);
4093 	}
4094 	if (ln->tn_op == INDIR && ln->tn_left->tn_op == PLUS)
4095 		/* check the range of array indices */
4096 		check_array_index(ln->tn_left, false);
4097 }
4098 
4099 static void
4100 check_expr_call(const tnode_t *tn, const tnode_t *ln,
4101 		bool szof, bool vctx, bool cond, bool retval_discarded)
4102 {
4103 	lint_assert(ln->tn_op == ADDR);
4104 	lint_assert(ln->tn_left->tn_op == NAME);
4105 	if (!szof &&
4106 	    !is_compiler_builtin(ln->tn_left->tn_sym->s_name))
4107 		outcall(tn, vctx || cond, retval_discarded);
4108 }
4109 
4110 static bool
4111 check_expr_op(const tnode_t *tn, op_t op, const tnode_t *ln,
4112 	      bool szof, bool fcall, bool vctx, bool cond,
4113 	      bool retval_discarded, bool eqwarn)
4114 {
4115 	switch (op) {
4116 	case ADDR:
4117 		check_expr_addr(ln, szof, fcall);
4118 		break;
4119 	case LOAD:
4120 		check_expr_load(ln);
4121 		/* FALLTHROUGH */
4122 	case PUSH:
4123 	case INCBEF:
4124 	case DECBEF:
4125 	case INCAFT:
4126 	case DECAFT:
4127 	case ADDASS:
4128 	case SUBASS:
4129 	case MULASS:
4130 	case DIVASS:
4131 	case MODASS:
4132 	case ANDASS:
4133 	case ORASS:
4134 	case XORASS:
4135 	case SHLASS:
4136 	case SHRASS:
4137 	case REAL:
4138 	case IMAG:
4139 		check_expr_side_effect(ln, szof);
4140 		break;
4141 	case ASSIGN:
4142 		check_expr_assign(ln, szof);
4143 		break;
4144 	case CALL:
4145 		check_expr_call(tn, ln, szof, vctx, cond, retval_discarded);
4146 		break;
4147 	case EQ:
4148 		if (hflag && eqwarn)
4149 			/* operator '==' found where '=' was expected */
4150 			warning(160);
4151 		break;
4152 	case CON:
4153 	case NAME:
4154 	case STRING:
4155 		return false;
4156 		/* LINTED206: (enumeration values not handled in switch) */
4157 	case BITOR:
4158 	case BITXOR:
4159 	case NE:
4160 	case GE:
4161 	case GT:
4162 	case LE:
4163 	case LT:
4164 	case SHR:
4165 	case SHL:
4166 	case MINUS:
4167 	case PLUS:
4168 	case MOD:
4169 	case DIV:
4170 	case MULT:
4171 	case INDIR:
4172 	case UMINUS:
4173 	case UPLUS:
4174 	case DEC:
4175 	case INC:
4176 	case COMPL:
4177 	case NOT:
4178 	case POINT:
4179 	case ARROW:
4180 	case NOOP:
4181 	case BITAND:
4182 	case FARG:
4183 	case CASE:
4184 	case INIT:
4185 	case RETURN:
4186 	case ICALL:
4187 	case CVT:
4188 	case COMMA:
4189 	case FSEL:
4190 	case COLON:
4191 	case QUEST:
4192 	case LOGOR:
4193 	case LOGAND:
4194 		break;
4195 	}
4196 	return true;
4197 }
4198 
4199 void
4200 check_expr_misc(const tnode_t *tn, bool vctx, bool cond,
4201 		bool eqwarn, bool fcall, bool retval_discarded, bool szof)
4202 {
4203 	tnode_t *ln, *rn;
4204 	const mod_t *mp;
4205 	op_t op;
4206 	bool cvctx, ccond, eq, discard;
4207 
4208 	if (tn == NULL)
4209 		return;
4210 
4211 	ln = tn->tn_left;
4212 	rn = tn->tn_right;
4213 	mp = &modtab[op = tn->tn_op];
4214 
4215 	if (!check_expr_op(tn, op, ln,
4216 	    szof, fcall, vctx, cond, retval_discarded, eqwarn))
4217 		return;
4218 
4219 	cvctx = mp->m_value_context;
4220 	ccond = mp->m_requires_bool;
4221 	eq = mp->m_warn_if_operand_eq &&
4222 	     !ln->tn_parenthesized &&
4223 	     rn != NULL && !rn->tn_parenthesized;
4224 
4225 	/*
4226 	 * values of operands of ':' are not used if the type of at least
4227 	 * one of the operands (for gcc compatibility) is void
4228 	 * XXX test/value context of QUEST should probably be used as
4229 	 * context for both operands of COLON
4230 	 */
4231 	if (op == COLON && tn->tn_type->t_tspec == VOID)
4232 		cvctx = ccond = false;
4233 	discard = op == CVT && tn->tn_type->t_tspec == VOID;
4234 	check_expr_misc(ln, cvctx, ccond, eq, op == CALL, discard, szof);
4235 
4236 	switch (op) {
4237 	case PUSH:
4238 		if (rn != NULL)
4239 			check_expr_misc(rn, false, false, eq, false, false,
4240 			    szof);
4241 		break;
4242 	case LOGAND:
4243 	case LOGOR:
4244 		check_expr_misc(rn, false, true, eq, false, false, szof);
4245 		break;
4246 	case COLON:
4247 		check_expr_misc(rn, cvctx, ccond, eq, false, false, szof);
4248 		break;
4249 	case COMMA:
4250 		check_expr_misc(rn, vctx, cond, eq, false, false, szof);
4251 		break;
4252 	default:
4253 		if (mp->m_binary)
4254 			check_expr_misc(rn, true, false, eq, false, false,
4255 			    szof);
4256 		break;
4257 	}
4258 }
4259 
4260 /*
4261  * Checks the range of array indices, if possible.
4262  * amper is set if only the address of the element is used. This
4263  * means that the index is allowed to refer to the first element
4264  * after the array.
4265  */
4266 static void
4267 check_array_index(tnode_t *tn, bool amper)
4268 {
4269 	int	dim;
4270 	tnode_t	*ln, *rn;
4271 	int	elsz;
4272 	int64_t	con;
4273 
4274 	ln = tn->tn_left;
4275 	rn = tn->tn_right;
4276 
4277 	/* We can only check constant indices. */
4278 	if (rn->tn_op != CON)
4279 		return;
4280 
4281 	/* Return if the left node does not stem from an array. */
4282 	if (ln->tn_op != ADDR)
4283 		return;
4284 	if (ln->tn_left->tn_op != STRING && ln->tn_left->tn_op != NAME)
4285 		return;
4286 	if (ln->tn_left->tn_type->t_tspec != ARRAY)
4287 		return;
4288 
4289 	/*
4290 	 * For incomplete array types, we can print a warning only if
4291 	 * the index is negative.
4292 	 */
4293 	if (is_incomplete(ln->tn_left->tn_type) && rn->tn_val->v_quad >= 0)
4294 		return;
4295 
4296 	/* Get the size of one array element */
4297 	if ((elsz = length_in_bits(ln->tn_type->t_subt, NULL)) == 0)
4298 		return;
4299 	elsz /= CHAR_SIZE;
4300 
4301 	/* Change the unit of the index from bytes to element size. */
4302 	if (is_uinteger(rn->tn_type->t_tspec)) {
4303 		con = (uint64_t)rn->tn_val->v_quad / elsz;
4304 	} else {
4305 		con = rn->tn_val->v_quad / elsz;
4306 	}
4307 
4308 	dim = ln->tn_left->tn_type->t_dim + (amper ? 1 : 0);
4309 
4310 	if (!is_uinteger(rn->tn_type->t_tspec) && con < 0) {
4311 		/* array subscript cannot be negative: %ld */
4312 		warning(167, (long)con);
4313 	} else if (dim > 0 && (uint64_t)con >= (uint64_t)dim) {
4314 		/* array subscript cannot be > %d: %ld */
4315 		warning(168, dim - 1, (long)con);
4316 	}
4317 }
4318 
4319 static bool
4320 is_out_of_char_range(const tnode_t *tn)
4321 {
4322 	return tn->tn_op == CON &&
4323 	       !(0 <= tn->tn_val->v_quad &&
4324 		 tn->tn_val->v_quad < 1 << (CHAR_SIZE - 1));
4325 }
4326 
4327 /*
4328  * Check for ordered comparisons of unsigned values with 0.
4329  */
4330 static void
4331 check_integer_comparison(op_t op, tnode_t *ln, tnode_t *rn)
4332 {
4333 	tspec_t	lt, rt;
4334 
4335 	lt = ln->tn_type->t_tspec;
4336 	rt = rn->tn_type->t_tspec;
4337 
4338 	if (ln->tn_op != CON && rn->tn_op != CON)
4339 		return;
4340 
4341 	if (!is_integer(lt) || !is_integer(rt))
4342 		return;
4343 
4344 	if (hflag || pflag) {
4345 		if (lt == CHAR && is_out_of_char_range(rn)) {
4346 			/* nonportable character comparison '%s %d' */
4347 			warning(230, op_name(op), (int)rn->tn_val->v_quad);
4348 			return;
4349 		}
4350 		if (rt == CHAR && is_out_of_char_range(ln)) {
4351 			/* nonportable character comparison '%s %d' */
4352 			warning(230, op_name(op), (int)ln->tn_val->v_quad);
4353 			return;
4354 		}
4355 	}
4356 
4357 	if (is_uinteger(lt) && !is_uinteger(rt) &&
4358 	    rn->tn_op == CON && rn->tn_val->v_quad <= 0) {
4359 		if (rn->tn_val->v_quad < 0) {
4360 			/* comparison of %s with %s, op %s */
4361 			warning(162, type_name(ln->tn_type),
4362 			    "negative constant", op_name(op));
4363 		} else if (op == LT || op == GE) {
4364 			/* comparison of %s with %s, op %s */
4365 			warning(162, type_name(ln->tn_type), "0", op_name(op));
4366 		}
4367 		return;
4368 	}
4369 	if (is_uinteger(rt) && !is_uinteger(lt) &&
4370 	    ln->tn_op == CON && ln->tn_val->v_quad <= 0) {
4371 		if (ln->tn_val->v_quad < 0) {
4372 			/* comparison of %s with %s, op %s */
4373 			warning(162, "negative constant",
4374 			    type_name(rn->tn_type), op_name(op));
4375 		} else if (op == GT || op == LE) {
4376 			/* comparison of %s with %s, op %s */
4377 			warning(162, "0", type_name(rn->tn_type), op_name(op));
4378 		}
4379 		return;
4380 	}
4381 }
4382 
4383 /*
4384  * Return whether the expression can be used for static initialization.
4385  *
4386  * Constant initialization expressions must be constant or an address
4387  * of a static object with an optional offset. In the first case,
4388  * the result is returned in *offsp. In the second case, the static
4389  * object is returned in *symp and the offset in *offsp.
4390  *
4391  * The expression can consist of PLUS, MINUS, ADDR, NAME, STRING and
4392  * CON. Type conversions are allowed if they do not change binary
4393  * representation (including width).
4394  *
4395  * C99 6.6 "Constant expressions"
4396  * C99 6.7.8p4 restricts initializers for static storage duration
4397  */
4398 bool
4399 constant_addr(const tnode_t *tn, const sym_t **symp, ptrdiff_t *offsp)
4400 {
4401 	const sym_t *sym;
4402 	ptrdiff_t offs1, offs2;
4403 	tspec_t	t, ot;
4404 
4405 	switch (tn->tn_op) {
4406 	case MINUS:
4407 		if (tn->tn_right->tn_op == CVT)
4408 			return constant_addr(tn->tn_right, symp, offsp);
4409 		else if (tn->tn_right->tn_op != CON)
4410 			return false;
4411 		/* FALLTHROUGH */
4412 	case PLUS:
4413 		offs1 = offs2 = 0;
4414 		if (tn->tn_left->tn_op == CON) {
4415 			offs1 = (ptrdiff_t)tn->tn_left->tn_val->v_quad;
4416 			if (!constant_addr(tn->tn_right, &sym, &offs2))
4417 				return false;
4418 		} else if (tn->tn_right->tn_op == CON) {
4419 			offs2 = (ptrdiff_t)tn->tn_right->tn_val->v_quad;
4420 			if (tn->tn_op == MINUS)
4421 				offs2 = -offs2;
4422 			if (!constant_addr(tn->tn_left, &sym, &offs1))
4423 				return false;
4424 		} else {
4425 			return false;
4426 		}
4427 		*symp = sym;
4428 		*offsp = offs1 + offs2;
4429 		return true;
4430 	case ADDR:
4431 		if (tn->tn_left->tn_op == NAME) {
4432 			*symp = tn->tn_left->tn_sym;
4433 			*offsp = 0;
4434 			return true;
4435 		} else {
4436 			/*
4437 			 * If this would be the front end of a compiler we
4438 			 * would return a label instead of 0, at least if
4439 			 * 'tn->tn_left->tn_op == STRING'.
4440 			 */
4441 			*symp = NULL;
4442 			*offsp = 0;
4443 			return true;
4444 		}
4445 	case CVT:
4446 		t = tn->tn_type->t_tspec;
4447 		ot = tn->tn_left->tn_type->t_tspec;
4448 		if ((!is_integer(t) && t != PTR) ||
4449 		    (!is_integer(ot) && ot != PTR)) {
4450 			return false;
4451 		}
4452 #if 0
4453 		/*
4454 		 * consider:
4455 		 *	struct foo {
4456 		 *		unsigned char a;
4457 		 *	} f = {
4458 		 *		(unsigned char)(unsigned long)
4459 		 *		    (&(((struct foo *)0)->a))
4460 		 *	};
4461 		 * since psize(unsigned long) != psize(unsigned char),
4462 		 * this fails.
4463 		 */
4464 		else if (psize(t) != psize(ot))
4465 			return -1;
4466 #endif
4467 		return constant_addr(tn->tn_left, symp, offsp);
4468 	default:
4469 		return false;
4470 	}
4471 }
4472 
4473 /* Append s2 to s1, then free s2. */
4474 strg_t *
4475 cat_strings(strg_t *s1, strg_t *s2)
4476 {
4477 
4478 	if (s1->st_char != s2->st_char) {
4479 		/* cannot concatenate wide and regular string literals */
4480 		error(292);
4481 		return s1;
4482 	}
4483 
4484 	size_t len1 = s1->st_len;
4485 	size_t len2 = s2->st_len;
4486 	size_t chsize = s1->st_char ? sizeof(char) : sizeof(wchar_t);
4487 	size_t size1 = len1 * chsize;
4488 	size_t size2 = (len2 + 1) * chsize;
4489 	s1->st_mem = xrealloc(s1->st_mem, size1 + size2);
4490 	memcpy((char *)s1->st_mem + size1, s2->st_mem, size2);
4491 	free(s2->st_mem);
4492 
4493 	s1->st_len = len1 + len2;
4494 	free(s2);
4495 
4496 	return s1;
4497 }
4498 
4499 static bool
4500 is_confusing_precedence(op_t op, op_t lop, bool lparen, op_t rop, bool rparen)
4501 {
4502 
4503 	if (op == SHL || op == SHR) {
4504 		if (!lparen && (lop == PLUS || lop == MINUS))
4505 			return true;
4506 		if (!rparen && (rop == PLUS || rop == MINUS))
4507 			return true;
4508 		return false;
4509 	}
4510 
4511 	if (op == LOGOR) {
4512 		if (!lparen && lop == LOGAND)
4513 			return true;
4514 		if (!rparen && rop == LOGAND)
4515 			return true;
4516 		return false;
4517 	}
4518 
4519 	lint_assert(op == BITAND || op == BITXOR || op == BITOR);
4520 	if (!lparen && lop != op) {
4521 		if (lop == PLUS || lop == MINUS)
4522 			return true;
4523 		if (lop == BITAND || lop == BITXOR)
4524 			return true;
4525 	}
4526 	if (!rparen && rop != op) {
4527 		if (rop == PLUS || rop == MINUS)
4528 			return true;
4529 		if (rop == BITAND || rop == BITXOR)
4530 			return true;
4531 	}
4532 	return false;
4533 }
4534 
4535 /*
4536  * Print a warning if the given node has operands which should be
4537  * parenthesized.
4538  *
4539  * XXX Does not work if an operand is a constant expression. Constant
4540  * expressions are already folded.
4541  */
4542 static void
4543 check_precedence_confusion(tnode_t *tn)
4544 {
4545 	tnode_t *ln, *rn;
4546 
4547 	if (!hflag)
4548 		return;
4549 
4550 	debug_node(tn);
4551 
4552 	lint_assert(is_binary(tn));
4553 	for (ln = tn->tn_left; ln->tn_op == CVT; ln = ln->tn_left)
4554 		continue;
4555 	for (rn = tn->tn_right; rn->tn_op == CVT; rn = rn->tn_left)
4556 		continue;
4557 
4558 	if (is_confusing_precedence(tn->tn_op,
4559 	    ln->tn_op, ln->tn_parenthesized,
4560 	    rn->tn_op, rn->tn_parenthesized)) {
4561 		/* precedence confusion possible: parenthesize! */
4562 		warning(169);
4563 	}
4564 }
4565 
4566 typedef struct stmt_expr {
4567 	struct memory_block *se_mem;
4568 	sym_t *se_sym;
4569 	struct stmt_expr *se_enclosing;
4570 } stmt_expr;
4571 
4572 static stmt_expr *stmt_exprs;
4573 
4574 void
4575 begin_statement_expr(void)
4576 {
4577 	stmt_expr *se = xmalloc(sizeof(*se));
4578 	se->se_mem = expr_save_memory();
4579 	se->se_sym = NULL;
4580 	se->se_enclosing = stmt_exprs;
4581 	stmt_exprs = se;
4582 }
4583 
4584 void
4585 do_statement_expr(tnode_t *tn)
4586 {
4587 	block_level--;
4588 	mem_block_level--;
4589 	stmt_exprs->se_sym = tn != NULL
4590 	    ? mktempsym(block_dup_type(tn->tn_type))
4591 	    : NULL;		/* after a syntax error */
4592 	mem_block_level++;
4593 	block_level++;
4594 	/* ({ }) is a GCC extension */
4595 	gnuism(320);
4596 }
4597 
4598 tnode_t *
4599 end_statement_expr(void)
4600 {
4601 	stmt_expr *se = stmt_exprs;
4602 	if (se->se_sym == NULL)
4603 		return NULL;	/* after a syntax error */
4604 	tnode_t *tn = build_name(se->se_sym, false);
4605 	(void)expr_save_memory();	/* leak */
4606 	expr_restore_memory(se->se_mem);
4607 	stmt_exprs = se->se_enclosing;
4608 	free(se);
4609 	return tn;
4610 }
4611