1 /*
   2  * sparse/evaluate.c
   3  *
   4  * Copyright (C) 2003 Transmeta Corp.
   5  *               2003-2004 Linus Torvalds
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  *
  25  * Evaluate constant expressions.
  26  */
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29 #include <stddef.h>
  30 #include <stdio.h>
  31 #include <string.h>
  32 #include <ctype.h>
  33 #include <unistd.h>
  34 #include <fcntl.h>
  35 #include <limits.h>
  36 
  37 #include "lib.h"
  38 #include "allocate.h"
  39 #include "parse.h"
  40 #include "token.h"
  41 #include "symbol.h"
  42 #include "target.h"
  43 #include "expression.h"
  44 
  45 struct symbol *current_fn;
  46 
  47 static struct symbol *degenerate(struct expression *expr);
  48 static struct symbol *evaluate_symbol(struct symbol *sym);
  49 
  50 static struct symbol *evaluate_symbol_expression(struct expression *expr)
  51 {
  52         struct expression *addr;
  53         struct symbol *sym = expr->symbol;
  54         struct symbol *base_type;
  55 
  56         if (!sym) {
  57                 expression_error(expr, "undefined identifier '%s'", show_ident(expr->symbol_name));
  58                 return NULL;
  59         }
  60 
  61         examine_symbol_type(sym);
  62 
  63         base_type = get_base_type(sym);
  64         if (!base_type) {
  65                 expression_error(expr, "identifier '%s' has no type", show_ident(expr->symbol_name));
  66                 return NULL;
  67         }
  68 
  69         addr = alloc_expression(expr->pos, EXPR_SYMBOL);
  70         addr->symbol = sym;
  71         addr->symbol_name = expr->symbol_name;
  72         addr->ctype = &lazy_ptr_ctype;   /* Lazy evaluation: we need to do a proper job if somebody does &sym */
  73         addr->flags = expr->flags;
  74         expr->type = EXPR_PREOP;
  75         expr->op = '*';
  76         expr->unop = addr;
  77         expr->flags = CEF_NONE;
  78 
  79         /* The type of a symbol is the symbol itself! */
  80         expr->ctype = sym;
  81         return sym;
  82 }
  83 
  84 static struct symbol *evaluate_string(struct expression *expr)
  85 {
  86         struct symbol *sym = alloc_symbol(expr->pos, SYM_NODE);
  87         struct symbol *array = alloc_symbol(expr->pos, SYM_ARRAY);
  88         struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
  89         struct expression *initstr = alloc_expression(expr->pos, EXPR_STRING);
  90         unsigned int length = expr->string->length;
  91 
  92         sym->array_size = alloc_const_expression(expr->pos, length);
  93         sym->bit_size = bytes_to_bits(length);
  94         sym->ctype.alignment = 1;
  95         sym->string = 1;
  96         sym->ctype.modifiers = MOD_STATIC;
  97         sym->ctype.base_type = array;
  98         sym->initializer = initstr;
  99 
 100         initstr->ctype = sym;
 101         initstr->string = expr->string;
 102 
 103         array->array_size = sym->array_size;
 104         array->bit_size = bytes_to_bits(length);
 105         array->ctype.alignment = 1;
 106         array->ctype.modifiers = MOD_STATIC;
 107         array->ctype.base_type = &char_ctype;
 108         
 109         addr->symbol = sym;
 110         addr->ctype = &lazy_ptr_ctype;
 111         addr->flags = CEF_ADDR;
 112 
 113         expr->type = EXPR_PREOP;
 114         expr->op = '*';
 115         expr->unop = addr;  
 116         expr->ctype = sym;
 117         return sym;
 118 }
 119 
 120 /* type has come from classify_type and is an integer type */
 121 static inline struct symbol *integer_promotion(struct symbol *type)
 122 {
 123         unsigned long mod =  type->ctype.modifiers;
 124         int width = type->bit_size;
 125 
 126         /*
 127          * Bitfields always promote to the base type,
 128          * even if the bitfield might be bigger than
 129          * an "int".
 130          */
 131         if (type->type == SYM_BITFIELD) {
 132                 type = type->ctype.base_type;
 133         }
 134         mod = type->ctype.modifiers;
 135         if (width < bits_in_int)
 136                 return &int_ctype;
 137 
 138         /* If char/short has as many bits as int, it still gets "promoted" */
 139         if (mod & (MOD_CHAR | MOD_SHORT)) {
 140                 if (mod & MOD_UNSIGNED)
 141                         return &uint_ctype;
 142                 return &int_ctype;
 143         }
 144         return type;
 145 }
 146 
 147 /*
 148  * integer part of usual arithmetic conversions:
 149  *      integer promotions are applied
 150  *      if left and right are identical, we are done
 151  *      if signedness is the same, convert one with lower rank
 152  *      unless unsigned argument has rank lower than signed one, convert the
 153  *      signed one.
 154  *      if signed argument is bigger than unsigned one, convert the unsigned.
 155  *      otherwise, convert signed.
 156  *
 157  * Leaving aside the integer promotions, that is equivalent to
 158  *      if identical, don't convert
 159  *      if left is bigger than right, convert right
 160  *      if right is bigger than left, convert right
 161  *      otherwise, if signedness is the same, convert one with lower rank
 162  *      otherwise convert the signed one.
 163  */
 164 static struct symbol *bigger_int_type(struct symbol *left, struct symbol *right)
 165 {
 166         unsigned long lmod, rmod;
 167 
 168         left = integer_promotion(left);
 169         right = integer_promotion(right);
 170 
 171         if (left == right)
 172                 goto left;
 173 
 174         if (left->bit_size > right->bit_size)
 175                 goto left;
 176 
 177         if (right->bit_size > left->bit_size)
 178                 goto right;
 179 
 180         lmod = left->ctype.modifiers;
 181         rmod = right->ctype.modifiers;
 182         if ((lmod ^ rmod) & MOD_UNSIGNED) {
 183                 if (lmod & MOD_UNSIGNED)
 184                         goto left;
 185         } else if ((lmod & ~rmod) & (MOD_LONG_ALL))
 186                 goto left;
 187 right:
 188         left = right;
 189 left:
 190         return left;
 191 }
 192 
 193 static int same_cast_type(struct symbol *orig, struct symbol *new)
 194 {
 195         return orig->bit_size == new->bit_size &&
 196                orig->bit_offset == new->bit_offset;
 197 }
 198 
 199 static struct symbol *base_type(struct symbol *node, unsigned long *modp, unsigned long *asp)
 200 {
 201         unsigned long mod, as;
 202 
 203         mod = 0; as = 0;
 204         while (node) {
 205                 mod |= node->ctype.modifiers;
 206                 as |= node->ctype.as;
 207                 if (node->type == SYM_NODE) {
 208                         node = node->ctype.base_type;
 209                         continue;
 210                 }
 211                 break;
 212         }
 213         *modp = mod & ~MOD_IGNORE;
 214         *asp = as;
 215         return node;
 216 }
 217 
 218 static int is_same_type(struct expression *expr, struct symbol *new)
 219 {
 220         struct symbol *old = expr->ctype;
 221         unsigned long oldmod, newmod, oldas, newas;
 222 
 223         old = base_type(old, &oldmod, &oldas);
 224         new = base_type(new, &newmod, &newas);
 225 
 226         /* Same base type, same address space? */
 227         if (old == new && oldas == newas) {
 228                 unsigned long difmod;
 229 
 230                 /* Check the modifier bits. */
 231                 difmod = (oldmod ^ newmod) & ~MOD_NOCAST;
 232 
 233                 /* Exact same type? */
 234                 if (!difmod)
 235                         return 1;
 236 
 237                 /*
 238                  * Not the same type, but differs only in "const".
 239                  * Don't warn about MOD_NOCAST.
 240                  */
 241                 if (difmod == MOD_CONST)
 242                         return 0;
 243         }
 244         if ((oldmod | newmod) & MOD_NOCAST) {
 245                 const char *tofrom = "to/from";
 246                 if (!(newmod & MOD_NOCAST))
 247                         tofrom = "from";
 248                 if (!(oldmod & MOD_NOCAST))
 249                         tofrom = "to";
 250                 warning(expr->pos, "implicit cast %s nocast type", tofrom);
 251         }
 252         return 0;
 253 }
 254 
 255 static void
 256 warn_for_different_enum_types (struct position pos,
 257                                struct symbol *typea,
 258                                struct symbol *typeb)
 259 {
 260         if (!Wenum_mismatch)
 261                 return;
 262         if (typea->type == SYM_NODE)
 263                 typea = typea->ctype.base_type;
 264         if (typeb->type == SYM_NODE)
 265                 typeb = typeb->ctype.base_type;
 266 
 267         if (typea == typeb)
 268                 return;
 269 
 270         if (typea->type == SYM_ENUM && typeb->type == SYM_ENUM) {
 271                 warning(pos, "mixing different enum types");
 272                 info(pos, "    %s versus", show_typename(typea));
 273                 info(pos, "    %s", show_typename(typeb));
 274         }
 275 }
 276 
 277 static int cast_flags(struct expression *expr, struct expression *target);
 278 static struct symbol *cast_to_bool(struct expression *expr);
 279 
 280 /*
 281  * This gets called for implicit casts in assignments and
 282  * integer promotion. We often want to try to move the
 283  * cast down, because the ops involved may have been
 284  * implicitly cast up, and we can get rid of the casts
 285  * early.
 286  */
 287 static struct expression * cast_to(struct expression *old, struct symbol *type)
 288 {
 289         struct expression *expr;
 290 
 291         warn_for_different_enum_types (old->pos, old->ctype, type);
 292 
 293         if (old->ctype != &null_ctype && is_same_type(old, type))
 294                 return old;
 295 
 296         /*
 297          * See if we can simplify the op. Move the cast down.
 298          */
 299         switch (old->type) {
 300         case EXPR_PREOP:
 301                 if (old->ctype->bit_size < type->bit_size)
 302                         break;
 303                 if (old->op == '~') {
 304                         old->ctype = type;
 305                         old->unop = cast_to(old->unop, type);
 306                         return old;
 307                 }
 308                 break;
 309 
 310         case EXPR_IMPLIED_CAST:
 311                 warn_for_different_enum_types(old->pos, old->ctype, type);
 312 
 313                 if (old->ctype->bit_size >= type->bit_size) {
 314                         struct expression *orig = old->cast_expression;
 315                         if (same_cast_type(orig->ctype, type))
 316                                 return orig;
 317                         if (old->ctype->bit_offset == type->bit_offset) {
 318                                 old->ctype = type;
 319                                 old->cast_type = type;
 320                                 return old;
 321                         }
 322                 }
 323                 break;
 324 
 325         default:
 326                 /* nothing */;
 327         }
 328 
 329         expr = alloc_expression(old->pos, EXPR_IMPLIED_CAST);
 330         expr->ctype = type;
 331         expr->cast_type = type;
 332         expr->cast_expression = old;
 333         expr->flags = cast_flags(expr, old);
 334 
 335         if (is_bool_type(type))
 336                 cast_to_bool(expr);
 337 
 338         return expr;
 339 }
 340 
 341 enum {
 342         TYPE_NUM = 1,
 343         TYPE_BITFIELD = 2,
 344         TYPE_RESTRICT = 4,
 345         TYPE_FLOAT = 8,
 346         TYPE_PTR = 16,
 347         TYPE_COMPOUND = 32,
 348         TYPE_FOULED = 64,
 349         TYPE_FN = 128,
 350 };
 351 
 352 static inline int classify_type(struct symbol *type, struct symbol **base)
 353 {
 354         static int type_class[SYM_BAD + 1] = {
 355                 [SYM_PTR] = TYPE_PTR,
 356                 [SYM_FN] = TYPE_PTR | TYPE_FN,
 357                 [SYM_ARRAY] = TYPE_PTR | TYPE_COMPOUND,
 358                 [SYM_STRUCT] = TYPE_COMPOUND,
 359                 [SYM_UNION] = TYPE_COMPOUND,
 360                 [SYM_BITFIELD] = TYPE_NUM | TYPE_BITFIELD,
 361                 [SYM_RESTRICT] = TYPE_NUM | TYPE_RESTRICT,
 362                 [SYM_FOULED] = TYPE_NUM | TYPE_RESTRICT | TYPE_FOULED,
 363         };
 364         if (type->type == SYM_NODE)
 365                 type = type->ctype.base_type;
 366         if (type->type == SYM_TYPEOF) {
 367                 type = evaluate_expression(type->initializer);
 368                 if (!type)
 369                         type = &bad_ctype;
 370                 else if (type->type == SYM_NODE)
 371                         type = type->ctype.base_type;
 372         }
 373         if (type->type == SYM_ENUM)
 374                 type = type->ctype.base_type;
 375         *base = type;
 376         if (type->type == SYM_BASETYPE) {
 377                 if (type->ctype.base_type == &int_type)
 378                         return TYPE_NUM;
 379                 if (type->ctype.base_type == &fp_type)
 380                         return TYPE_NUM | TYPE_FLOAT;
 381         }
 382         return type_class[type->type];
 383 }
 384 
 385 #define is_int(class) ((class & (TYPE_NUM | TYPE_FLOAT)) == TYPE_NUM)
 386 
 387 static inline int is_string_type(struct symbol *type)
 388 {
 389         if (type->type == SYM_NODE)
 390                 type = type->ctype.base_type;
 391         return type->type == SYM_ARRAY && is_byte_type(type->ctype.base_type);
 392 }
 393 
 394 static struct symbol *bad_expr_type(struct expression *expr)
 395 {
 396         sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
 397         switch (expr->type) {
 398         case EXPR_BINOP:
 399         case EXPR_COMPARE:
 400                 info(expr->pos, "   left side has type %s", show_typename(expr->left->ctype));
 401                 info(expr->pos, "   right side has type %s", show_typename(expr->right->ctype));
 402                 break;
 403         case EXPR_PREOP:
 404         case EXPR_POSTOP:
 405                 info(expr->pos, "   argument has type %s", show_typename(expr->unop->ctype));
 406                 break;
 407         default:
 408                 break;
 409         }
 410 
 411         expr->flags = CEF_NONE;
 412         return expr->ctype = &bad_ctype;
 413 }
 414 
 415 static int restricted_value(struct expression *v, struct symbol *type)
 416 {
 417         if (v->type != EXPR_VALUE)
 418                 return 1;
 419         if (v->value != 0)
 420                 return 1;
 421         return 0;
 422 }
 423 
 424 static int restricted_binop(int op, struct symbol *type)
 425 {
 426         switch (op) {
 427                 case '&':
 428                 case '=':
 429                 case SPECIAL_AND_ASSIGN:
 430                 case SPECIAL_OR_ASSIGN:
 431                 case SPECIAL_XOR_ASSIGN:
 432                         return 1;       /* unfoul */
 433                 case '|':
 434                 case '^':
 435                 case '?':
 436                         return 2;       /* keep fouled */
 437                 case SPECIAL_EQUAL:
 438                 case SPECIAL_NOTEQUAL:
 439                         return 3;       /* warn if fouled */
 440                 default:
 441                         return 0;       /* warn */
 442         }
 443 }
 444 
 445 static int restricted_unop(int op, struct symbol **type)
 446 {
 447         if (op == '~') {
 448                 if ((*type)->bit_size < bits_in_int)
 449                         *type = befoul(*type);
 450                 return 0;
 451         } if (op == '+')
 452                 return 0;
 453         return 1;
 454 }
 455 
 456 /* type should be SYM_FOULED */
 457 static inline struct symbol *unfoul(struct symbol *type)
 458 {
 459         return type->ctype.base_type;
 460 }
 461 
 462 static struct symbol *restricted_binop_type(int op,
 463                                         struct expression *left,
 464                                         struct expression *right,
 465                                         int lclass, int rclass,
 466                                         struct symbol *ltype,
 467                                         struct symbol *rtype)
 468 {
 469         struct symbol *ctype = NULL;
 470         if (lclass & TYPE_RESTRICT) {
 471                 if (rclass & TYPE_RESTRICT) {
 472                         if (ltype == rtype) {
 473                                 ctype = ltype;
 474                         } else if (lclass & TYPE_FOULED) {
 475                                 if (unfoul(ltype) == rtype)
 476                                         ctype = ltype;
 477                         } else if (rclass & TYPE_FOULED) {
 478                                 if (unfoul(rtype) == ltype)
 479                                         ctype = rtype;
 480                         }
 481                 } else {
 482                         if (!restricted_value(right, ltype))
 483                                 ctype = ltype;
 484                 }
 485         } else if (!restricted_value(left, rtype))
 486                 ctype = rtype;
 487 
 488         if (ctype) {
 489                 switch (restricted_binop(op, ctype)) {
 490                 case 1:
 491                         if ((lclass ^ rclass) & TYPE_FOULED)
 492                                 ctype = unfoul(ctype);
 493                         break;
 494                 case 3:
 495                         if (!(lclass & rclass & TYPE_FOULED))
 496                                 break;
 497                 case 0:
 498                         ctype = NULL;
 499                 default:
 500                         break;
 501                 }
 502         }
 503 
 504         return ctype;
 505 }
 506 
 507 static inline void unrestrict(struct expression *expr,
 508                               int class, struct symbol **ctype)
 509 {
 510         if (class & TYPE_RESTRICT) {
 511                 if (class & TYPE_FOULED)
 512                         *ctype = unfoul(*ctype);
 513                 warning(expr->pos, "%s degrades to integer",
 514                         show_typename(*ctype));
 515                 *ctype = (*ctype)->ctype.base_type; /* get to arithmetic type */
 516         }
 517 }
 518 
 519 static struct symbol *usual_conversions(int op,
 520                                         struct expression *left,
 521                                         struct expression *right,
 522                                         int lclass, int rclass,
 523                                         struct symbol *ltype,
 524                                         struct symbol *rtype)
 525 {
 526         struct symbol *ctype;
 527 
 528         warn_for_different_enum_types(right->pos, left->ctype, right->ctype);
 529 
 530         if ((lclass | rclass) & TYPE_RESTRICT)
 531                 goto Restr;
 532 
 533 Normal:
 534         if (!(lclass & TYPE_FLOAT)) {
 535                 if (!(rclass & TYPE_FLOAT))
 536                         return bigger_int_type(ltype, rtype);
 537                 else
 538                         return rtype;
 539         } else if (rclass & TYPE_FLOAT) {
 540                 unsigned long lmod = ltype->ctype.modifiers;
 541                 unsigned long rmod = rtype->ctype.modifiers;
 542                 if (rmod & ~lmod & (MOD_LONG_ALL))
 543                         return rtype;
 544                 else
 545                         return ltype;
 546         } else
 547                 return ltype;
 548 
 549 Restr:
 550         ctype = restricted_binop_type(op, left, right,
 551                                       lclass, rclass, ltype, rtype);
 552         if (ctype)
 553                 return ctype;
 554 
 555         unrestrict(left, lclass, &ltype);
 556         unrestrict(right, rclass, &rtype);
 557 
 558         goto Normal;
 559 }
 560 
 561 static inline int lvalue_expression(struct expression *expr)
 562 {
 563         return expr->type == EXPR_PREOP && expr->op == '*';
 564 }
 565 
 566 static struct symbol *evaluate_ptr_add(struct expression *expr, struct symbol *itype)
 567 {
 568         struct expression *index = expr->right;
 569         struct symbol *ctype, *base;
 570         int multiply;
 571 
 572         classify_type(degenerate(expr->left), &ctype);
 573         base = examine_pointer_target(ctype);
 574 
 575         /*
 576          * An address constant +/- an integer constant expression
 577          * yields an address constant again [6.6(7)].
 578          */
 579         if ((expr->left->flags & CEF_ADDR) && (expr->right->flags & CEF_ICE))
 580                 expr->flags = CEF_ADDR;
 581 
 582         if (!base) {
 583                 expression_error(expr, "missing type information");
 584                 return NULL;
 585         }
 586         if (is_function(base)) {
 587                 expression_error(expr, "arithmetics on pointers to functions");
 588                 return NULL;
 589         }
 590 
 591         /* Get the size of whatever the pointer points to */
 592         multiply = is_void_type(base) ? 1 : bits_to_bytes(base->bit_size);
 593 
 594         if (ctype == &null_ctype)
 595                 ctype = &ptr_ctype;
 596         expr->ctype = ctype;
 597 
 598         if (multiply == 1 && itype->bit_size >= bits_in_pointer)
 599                 return ctype;
 600 
 601         if (index->type == EXPR_VALUE) {
 602                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 603                 unsigned long long v = index->value, mask;
 604                 mask = 1ULL << (itype->bit_size - 1);
 605                 if (v & mask)
 606                         v |= -mask;
 607                 else
 608                         v &= mask - 1;
 609                 v *= multiply;
 610                 mask = 1ULL << (bits_in_pointer - 1);
 611                 v &= mask | (mask - 1);
 612                 val->value = v;
 613                 val->ctype = ssize_t_ctype;
 614                 expr->right = val;
 615                 return ctype;
 616         }
 617 
 618         if (itype->bit_size < bits_in_pointer)
 619                 index = cast_to(index, ssize_t_ctype);
 620 
 621         if (multiply > 1) {
 622                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 623                 struct expression *mul = alloc_expression(expr->pos, EXPR_BINOP);
 624 
 625                 val->ctype = ssize_t_ctype;
 626                 val->value = multiply;
 627 
 628                 mul->op = '*';
 629                 mul->ctype = ssize_t_ctype;
 630                 mul->left = index;
 631                 mul->right = val;
 632                 index = mul;
 633         }
 634 
 635         expr->right = index;
 636         return ctype;
 637 }
 638 
 639 static void examine_fn_arguments(struct symbol *fn);
 640 
 641 #define MOD_IGN (MOD_VOLATILE | MOD_CONST | MOD_PURE)
 642 
 643 const char *type_difference(struct ctype *c1, struct ctype *c2,
 644         unsigned long mod1, unsigned long mod2)
 645 {
 646         unsigned long as1 = c1->as, as2 = c2->as;
 647         struct symbol *t1 = c1->base_type;
 648         struct symbol *t2 = c2->base_type;
 649         int move1 = 1, move2 = 1;
 650         mod1 |= c1->modifiers;
 651         mod2 |= c2->modifiers;
 652         for (;;) {
 653                 unsigned long diff;
 654                 int type;
 655                 struct symbol *base1 = t1->ctype.base_type;
 656                 struct symbol *base2 = t2->ctype.base_type;
 657 
 658                 /*
 659                  * FIXME! Collect alignment and context too here!
 660                  */
 661                 if (move1) {
 662                         if (t1 && t1->type != SYM_PTR) {
 663                                 mod1 |= t1->ctype.modifiers;
 664                                 as1 |= t1->ctype.as;
 665                         }
 666                         move1 = 0;
 667                 }
 668 
 669                 if (move2) {
 670                         if (t2 && t2->type != SYM_PTR) {
 671                                 mod2 |= t2->ctype.modifiers;
 672                                 as2 |= t2->ctype.as;
 673                         }
 674                         move2 = 0;
 675                 }
 676 
 677                 if (t1 == t2)
 678                         break;
 679                 if (!t1 || !t2)
 680                         return "different types";
 681 
 682                 if (t1->type == SYM_NODE || t1->type == SYM_ENUM) {
 683                         t1 = base1;
 684                         move1 = 1;
 685                         if (!t1)
 686                                 return "bad types";
 687                         continue;
 688                 }
 689 
 690                 if (t2->type == SYM_NODE || t2->type == SYM_ENUM) {
 691                         t2 = base2;
 692                         move2 = 1;
 693                         if (!t2)
 694                                 return "bad types";
 695                         continue;
 696                 }
 697 
 698                 move1 = move2 = 1;
 699                 type = t1->type;
 700                 if (type != t2->type)
 701                         return "different base types";
 702 
 703                 switch (type) {
 704                 default:
 705                         sparse_error(t1->pos,
 706                                      "internal error: bad type in derived(%d)",
 707                                      type);
 708                         return "bad types";
 709                 case SYM_RESTRICT:
 710                         return "different base types";
 711                 case SYM_UNION:
 712                 case SYM_STRUCT:
 713                         /* allow definition of incomplete structs and unions */
 714                         if (t1->ident == t2->ident)
 715                           return NULL;
 716                         return "different base types";
 717                 case SYM_ARRAY:
 718                         /* XXX: we ought to compare sizes */
 719                         break;
 720                 case SYM_PTR:
 721                         if (as1 != as2)
 722                                 return "different address spaces";
 723                         /* MOD_SPECIFIER is due to idiocy in parse.c */
 724                         if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SPECIFIER)
 725                                 return "different modifiers";
 726                         /* we could be lazier here */
 727                         base1 = examine_pointer_target(t1);
 728                         base2 = examine_pointer_target(t2);
 729                         mod1 = t1->ctype.modifiers;
 730                         as1 = t1->ctype.as;
 731                         mod2 = t2->ctype.modifiers;
 732                         as2 = t2->ctype.as;
 733                         break;
 734                 case SYM_FN: {
 735                         struct symbol *arg1, *arg2;
 736                         int i;
 737 
 738                         if (as1 != as2)
 739                                 return "different address spaces";
 740                         if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SIGNEDNESS)
 741                                 return "different modifiers";
 742                         mod1 = t1->ctype.modifiers;
 743                         as1 = t1->ctype.as;
 744                         mod2 = t2->ctype.modifiers;
 745                         as2 = t2->ctype.as;
 746 
 747                         if (t1->variadic != t2->variadic)
 748                                 return "incompatible variadic arguments";
 749                         examine_fn_arguments(t1);
 750                         examine_fn_arguments(t2);
 751                         PREPARE_PTR_LIST(t1->arguments, arg1);
 752                         PREPARE_PTR_LIST(t2->arguments, arg2);
 753                         i = 1;
 754                         for (;;) {
 755                                 const char *diffstr;
 756                                 if (!arg1 && !arg2)
 757                                         break;
 758                                 if (!arg1 || !arg2)
 759                                         return "different argument counts";
 760                                 diffstr = type_difference(&arg1->ctype,
 761                                                           &arg2->ctype,
 762                                                           MOD_IGN, MOD_IGN);
 763                                 if (diffstr) {
 764                                         static char argdiff[80];
 765                                         sprintf(argdiff, "incompatible argument %d (%s)", i, diffstr);
 766                                         return argdiff;
 767                                 }
 768                                 NEXT_PTR_LIST(arg1);
 769                                 NEXT_PTR_LIST(arg2);
 770                                 i++;
 771                         }
 772                         FINISH_PTR_LIST(arg2);
 773                         FINISH_PTR_LIST(arg1);
 774                         break;
 775                 }
 776                 case SYM_BASETYPE:
 777                         if (as1 != as2)
 778                                 return "different address spaces";
 779                         if (base1 != base2)
 780                                 return "different base types";
 781                         diff = (mod1 ^ mod2) & ~MOD_IGNORE;
 782                         if (!diff)
 783                                 return NULL;
 784                         if (diff & MOD_SIZE)
 785                                 return "different type sizes";
 786                         else if (diff & ~MOD_SIGNEDNESS)
 787                                 return "different modifiers";
 788                         else
 789                                 return "different signedness";
 790                 }
 791                 t1 = base1;
 792                 t2 = base2;
 793         }
 794         if (as1 != as2)
 795                 return "different address spaces";
 796         if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SIGNEDNESS)
 797                 return "different modifiers";
 798         return NULL;
 799 }
 800 
 801 static void bad_null(struct expression *expr)
 802 {
 803         if (Wnon_pointer_null)
 804                 warning(expr->pos, "Using plain integer as NULL pointer");
 805 }
 806 
 807 static unsigned long target_qualifiers(struct symbol *type)
 808 {
 809         unsigned long mod = type->ctype.modifiers & MOD_IGN;
 810         if (type->ctype.base_type && type->ctype.base_type->type == SYM_ARRAY)
 811                 mod = 0;
 812         return mod;
 813 }
 814 
 815 static struct symbol *evaluate_ptr_sub(struct expression *expr)
 816 {
 817         const char *typediff;
 818         struct symbol *ltype, *rtype;
 819         struct expression *l = expr->left;
 820         struct expression *r = expr->right;
 821         struct symbol *lbase;
 822 
 823         classify_type(degenerate(l), &ltype);
 824         classify_type(degenerate(r), &rtype);
 825 
 826         lbase = examine_pointer_target(ltype);
 827         examine_pointer_target(rtype);
 828         typediff = type_difference(&ltype->ctype, &rtype->ctype,
 829                                    target_qualifiers(rtype),
 830                                    target_qualifiers(ltype));
 831         if (typediff)
 832                 expression_error(expr, "subtraction of different types can't work (%s)", typediff);
 833 
 834         if (is_function(lbase)) {
 835                 expression_error(expr, "subtraction of functions? Share your drugs");
 836                 return NULL;
 837         }
 838 
 839         expr->ctype = ssize_t_ctype;
 840         if (lbase->bit_size > bits_in_char) {
 841                 struct expression *sub = alloc_expression(expr->pos, EXPR_BINOP);
 842                 struct expression *div = expr;
 843                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 844                 unsigned long value = bits_to_bytes(lbase->bit_size);
 845 
 846                 val->ctype = size_t_ctype;
 847                 val->value = value;
 848 
 849                 if (value & (value-1)) {
 850                         if (Wptr_subtraction_blows)
 851                                 warning(expr->pos, "potentially expensive pointer subtraction");
 852                 }
 853 
 854                 sub->op = '-';
 855                 sub->ctype = ssize_t_ctype;
 856                 sub->left = l;
 857                 sub->right = r;
 858 
 859                 div->op = '/';
 860                 div->left = sub;
 861                 div->right = val;
 862         }
 863                 
 864         return ssize_t_ctype;
 865 }
 866 
 867 #define is_safe_type(type) ((type)->ctype.modifiers & MOD_SAFE)
 868 
 869 static struct symbol *evaluate_conditional(struct expression *expr, int iterator)
 870 {
 871         struct symbol *ctype;
 872 
 873         if (!expr)
 874                 return NULL;
 875 
 876         if (!iterator && expr->type == EXPR_ASSIGNMENT && expr->op == '=')
 877                 warning(expr->pos, "assignment expression in conditional");
 878 
 879         ctype = evaluate_expression(expr);
 880         if (ctype) {
 881                 if (is_safe_type(ctype))
 882                         warning(expr->pos, "testing a 'safe expression'");
 883                 if (is_func_type(ctype)) {
 884                         if (Waddress)
 885                                 warning(expr->pos, "the address of %s will always evaluate as true", "a function");
 886                 } else if (is_array_type(ctype)) {
 887                         if (Waddress)
 888                                 warning(expr->pos, "the address of %s will always evaluate as true", "an array");
 889                 } else if (!is_scalar_type(ctype)) {
 890                         sparse_error(expr->pos, "incorrect type in conditional");
 891                         info(expr->pos, "   got %s", show_typename(ctype));
 892                         ctype = NULL;
 893                 }
 894         }
 895         ctype = degenerate(expr);
 896 
 897         return ctype;
 898 }
 899 
 900 static struct symbol *evaluate_logical(struct expression *expr)
 901 {
 902         if (!evaluate_conditional(expr->left, 0))
 903                 return NULL;
 904         if (!evaluate_conditional(expr->right, 0))
 905                 return NULL;
 906 
 907         /* the result is int [6.5.13(3), 6.5.14(3)] */
 908         expr->ctype = &int_ctype;
 909         expr->flags = expr->left->flags & expr->right->flags;
 910         expr->flags &= ~(CEF_CONST_MASK | CEF_ADDR);
 911         return &int_ctype;
 912 }
 913 
 914 static struct symbol *evaluate_binop(struct expression *expr)
 915 {
 916         struct symbol *ltype, *rtype, *ctype;
 917         int lclass = classify_type(expr->left->ctype, &ltype);
 918         int rclass = classify_type(expr->right->ctype, &rtype);
 919         int op = expr->op;
 920 
 921         /* number op number */
 922         if (lclass & rclass & TYPE_NUM) {
 923                 expr->flags = expr->left->flags & expr->right->flags;
 924                 expr->flags &= ~CEF_CONST_MASK;
 925 
 926                 if ((lclass | rclass) & TYPE_FLOAT) {
 927                         switch (op) {
 928                         case '+': case '-': case '*': case '/':
 929                                 break;
 930                         default:
 931                                 return bad_expr_type(expr);
 932                         }
 933                 }
 934 
 935                 if (op == SPECIAL_LEFTSHIFT || op == SPECIAL_RIGHTSHIFT) {
 936                         // shifts do integer promotions, but that's it.
 937                         unrestrict(expr->left, lclass, &ltype);
 938                         unrestrict(expr->right, rclass, &rtype);
 939                         ctype = ltype = integer_promotion(ltype);
 940                         rtype = integer_promotion(rtype);
 941                 } else {
 942                         // The rest do usual conversions
 943                         const unsigned left_not  = expr->left->type == EXPR_PREOP
 944                                                    && expr->left->op == '!';
 945                         const unsigned right_not = expr->right->type == EXPR_PREOP
 946                                                    && expr->right->op == '!';
 947                         if ((op == '&' || op == '|') && (left_not || right_not))
 948                                 warning(expr->pos, "dubious: %sx %c %sy",
 949                                         left_not ? "!" : "",
 950                                         op,
 951                                         right_not ? "!" : "");
 952 
 953                         ltype = usual_conversions(op, expr->left, expr->right,
 954                                                   lclass, rclass, ltype, rtype);
 955                         ctype = rtype = ltype;
 956                 }
 957 
 958                 expr->left = cast_to(expr->left, ltype);
 959                 expr->right = cast_to(expr->right, rtype);
 960                 expr->ctype = ctype;
 961                 return ctype;
 962         }
 963 
 964         /* pointer (+|-) integer */
 965         if (lclass & TYPE_PTR && is_int(rclass) && (op == '+' || op == '-')) {
 966                 unrestrict(expr->right, rclass, &rtype);
 967                 return evaluate_ptr_add(expr, rtype);
 968         }
 969 
 970         /* integer + pointer */
 971         if (rclass & TYPE_PTR && is_int(lclass) && op == '+') {
 972                 struct expression *index = expr->left;
 973                 unrestrict(index, lclass, &ltype);
 974                 expr->left = expr->right;
 975                 expr->right = index;
 976                 return evaluate_ptr_add(expr, ltype);
 977         }
 978 
 979         /* pointer - pointer */
 980         if (lclass & rclass & TYPE_PTR && expr->op == '-')
 981                 return evaluate_ptr_sub(expr);
 982 
 983         return bad_expr_type(expr);
 984 }
 985 
 986 static struct symbol *evaluate_comma(struct expression *expr)
 987 {
 988         expr->ctype = degenerate(expr->right);
 989         if (expr->ctype == &null_ctype)
 990                 expr->ctype = &ptr_ctype;
 991         expr->flags &= expr->left->flags & expr->right->flags;
 992         return expr->ctype;
 993 }
 994 
 995 static int modify_for_unsigned(int op)
 996 {
 997         if (op == '<')
 998                 op = SPECIAL_UNSIGNED_LT;
 999         else if (op == '>')
1000                 op = SPECIAL_UNSIGNED_GT;
1001         else if (op == SPECIAL_LTE)
1002                 op = SPECIAL_UNSIGNED_LTE;
1003         else if (op == SPECIAL_GTE)
1004                 op = SPECIAL_UNSIGNED_GTE;
1005         return op;
1006 }
1007 
1008 static inline int is_null_pointer_constant(struct expression *e)
1009 {
1010         if (e->ctype == &null_ctype)
1011                 return 1;
1012         if (!(e->flags & CEF_ICE))
1013                 return 0;
1014         return is_zero_constant(e) ? 2 : 0;
1015 }
1016 
1017 static struct symbol *evaluate_compare(struct expression *expr)
1018 {
1019         struct expression *left = expr->left, *right = expr->right;
1020         struct symbol *ltype, *rtype, *lbase, *rbase;
1021         int lclass = classify_type(degenerate(left), &ltype);
1022         int rclass = classify_type(degenerate(right), &rtype);
1023         struct symbol *ctype;
1024         const char *typediff;
1025 
1026         /* Type types? */
1027         if (is_type_type(ltype) && is_type_type(rtype)) {
1028                 /*
1029                  * __builtin_types_compatible_p() yields an integer
1030                  * constant expression
1031                  */
1032                 expr->flags = CEF_SET_ICE;
1033                 goto OK;
1034         }
1035 
1036         if (is_safe_type(left->ctype) || is_safe_type(right->ctype))
1037                 warning(expr->pos, "testing a 'safe expression'");
1038 
1039         expr->flags = left->flags & right->flags & ~CEF_CONST_MASK & ~CEF_ADDR;
1040 
1041         /* number on number */
1042         if (lclass & rclass & TYPE_NUM) {
1043                 ctype = usual_conversions(expr->op, expr->left, expr->right,
1044                                           lclass, rclass, ltype, rtype);
1045                 expr->left = cast_to(expr->left, ctype);
1046                 expr->right = cast_to(expr->right, ctype);
1047                 if (ctype->ctype.modifiers & MOD_UNSIGNED)
1048                         expr->op = modify_for_unsigned(expr->op);
1049                 goto OK;
1050         }
1051 
1052         /* at least one must be a pointer */
1053         if (!((lclass | rclass) & TYPE_PTR))
1054                 return bad_expr_type(expr);
1055 
1056         /* equality comparisons can be with null pointer constants */
1057         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1058                 int is_null1 = is_null_pointer_constant(left);
1059                 int is_null2 = is_null_pointer_constant(right);
1060                 if (is_null1 == 2)
1061                         bad_null(left);
1062                 if (is_null2 == 2)
1063                         bad_null(right);
1064                 if (is_null1 && is_null2) {
1065                         int positive = expr->op == SPECIAL_EQUAL;
1066                         expr->type = EXPR_VALUE;
1067                         expr->value = positive;
1068                         goto OK;
1069                 }
1070                 if (is_null1 && (rclass & TYPE_PTR)) {
1071                         left = cast_to(left, rtype);
1072                         goto OK;
1073                 }
1074                 if (is_null2 && (lclass & TYPE_PTR)) {
1075                         right = cast_to(right, ltype);
1076                         goto OK;
1077                 }
1078         }
1079         /* both should be pointers */
1080         if (!(lclass & rclass & TYPE_PTR))
1081                 return bad_expr_type(expr);
1082         expr->op = modify_for_unsigned(expr->op);
1083 
1084         lbase = examine_pointer_target(ltype);
1085         rbase = examine_pointer_target(rtype);
1086 
1087         /* they also have special treatment for pointers to void */
1088         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1089                 if (ltype->ctype.as == rtype->ctype.as) {
1090                         if (lbase == &void_ctype) {
1091                                 right = cast_to(right, ltype);
1092                                 goto OK;
1093                         }
1094                         if (rbase == &void_ctype) {
1095                                 left = cast_to(left, rtype);
1096                                 goto OK;
1097                         }
1098                 }
1099         }
1100 
1101         typediff = type_difference(&ltype->ctype, &rtype->ctype,
1102                                    target_qualifiers(rtype),
1103                                    target_qualifiers(ltype));
1104         if (!typediff)
1105                 goto OK;
1106 
1107         expression_error(expr, "incompatible types in comparison expression (%s)", typediff);
1108         return NULL;
1109 
1110 OK:
1111         /* the result is int [6.5.8(6), 6.5.9(3)]*/
1112         expr->ctype = &int_ctype;
1113         return &int_ctype;
1114 }
1115 
1116 /*
1117  * NOTE! The degenerate case of "x ? : y", where we don't
1118  * have a true case, this will possibly promote "x" to the
1119  * same type as "y", and thus _change_ the conditional
1120  * test in the expression. But since promotion is "safe"
1121  * for testing, that's OK.
1122  */
1123 static struct symbol *evaluate_conditional_expression(struct expression *expr)
1124 {
1125         struct expression **true;
1126         struct symbol *ctype, *ltype, *rtype, *lbase, *rbase;
1127         int lclass, rclass;
1128         const char * typediff;
1129         int qual;
1130 
1131         if (!evaluate_conditional(expr->conditional, 0))
1132                 return NULL;
1133         if (!evaluate_expression(expr->cond_false))
1134                 return NULL;
1135 
1136         ctype = degenerate(expr->conditional);
1137         rtype = degenerate(expr->cond_false);
1138 
1139         true = &expr->conditional;
1140         ltype = ctype;
1141         if (expr->cond_true) {
1142                 if (!evaluate_expression(expr->cond_true))
1143                         return NULL;
1144                 ltype = degenerate(expr->cond_true);
1145                 true = &expr->cond_true;
1146         }
1147 
1148         expr->flags = (expr->conditional->flags & (*true)->flags &
1149                         expr->cond_false->flags & ~CEF_CONST_MASK);
1150         /*
1151          * A conditional operator yields a particular constant
1152          * expression type only if all of its three subexpressions are
1153          * of that type [6.6(6), 6.6(8)].
1154          * As an extension, relax this restriction by allowing any
1155          * constant expression type for the condition expression.
1156          *
1157          * A conditional operator never yields an address constant
1158          * [6.6(9)].
1159          * However, as an extension, if the condition is any constant
1160          * expression, and the true and false expressions are both
1161          * address constants, mark the result as an address constant.
1162          */
1163         if (expr->conditional->flags & (CEF_ACE | CEF_ADDR))
1164                 expr->flags = (*true)->flags & expr->cond_false->flags & ~CEF_CONST_MASK;
1165 
1166         lclass = classify_type(ltype, &ltype);
1167         rclass = classify_type(rtype, &rtype);
1168         if (lclass & rclass & TYPE_NUM) {
1169                 ctype = usual_conversions('?', *true, expr->cond_false,
1170                                           lclass, rclass, ltype, rtype);
1171                 *true = cast_to(*true, ctype);
1172                 expr->cond_false = cast_to(expr->cond_false, ctype);
1173                 goto out;
1174         }
1175 
1176         if ((lclass | rclass) & TYPE_PTR) {
1177                 int is_null1 = is_null_pointer_constant(*true);
1178                 int is_null2 = is_null_pointer_constant(expr->cond_false);
1179 
1180                 if (is_null1 && is_null2) {
1181                         *true = cast_to(*true, &ptr_ctype);
1182                         expr->cond_false = cast_to(expr->cond_false, &ptr_ctype);
1183                         ctype = &ptr_ctype;
1184                         goto out;
1185                 }
1186                 if (is_null1 && (rclass & TYPE_PTR)) {
1187                         if (is_null1 == 2)
1188                                 bad_null(*true);
1189                         *true = cast_to(*true, rtype);
1190                         ctype = rtype;
1191                         goto out;
1192                 }
1193                 if (is_null2 && (lclass & TYPE_PTR)) {
1194                         if (is_null2 == 2)
1195                                 bad_null(expr->cond_false);
1196                         expr->cond_false = cast_to(expr->cond_false, ltype);
1197                         ctype = ltype;
1198                         goto out;
1199                 }
1200                 if (!(lclass & rclass & TYPE_PTR)) {
1201                         typediff = "different types";
1202                         goto Err;
1203                 }
1204                 /* OK, it's pointer on pointer */
1205                 if (ltype->ctype.as != rtype->ctype.as) {
1206                         typediff = "different address spaces";
1207                         goto Err;
1208                 }
1209 
1210                 /* need to be lazier here */
1211                 lbase = examine_pointer_target(ltype);
1212                 rbase = examine_pointer_target(rtype);
1213                 qual = target_qualifiers(ltype) | target_qualifiers(rtype);
1214 
1215                 if (lbase == &void_ctype) {
1216                         /* XXX: pointers to function should warn here */
1217                         ctype = ltype;
1218                         goto Qual;
1219 
1220                 }
1221                 if (rbase == &void_ctype) {
1222                         /* XXX: pointers to function should warn here */
1223                         ctype = rtype;
1224                         goto Qual;
1225                 }
1226                 /* XXX: that should be pointer to composite */
1227                 ctype = ltype;
1228                 typediff = type_difference(&ltype->ctype, &rtype->ctype,
1229                                            qual, qual);
1230                 if (!typediff)
1231                         goto Qual;
1232                 goto Err;
1233         }
1234 
1235         /* void on void, struct on same struct, union on same union */
1236         if (ltype == rtype) {
1237                 ctype = ltype;
1238                 goto out;
1239         }
1240         typediff = "different base types";
1241 
1242 Err:
1243         expression_error(expr, "incompatible types in conditional expression (%s)", typediff);
1244         /*
1245          * if the condition is constant, the type is in fact known
1246          * so use it, as gcc & clang do.
1247          */
1248         switch (expr_truth_value(expr->conditional)) {
1249         case 1: expr->ctype = ltype;
1250                 break;
1251         case 0: expr->ctype = rtype;
1252                 break;
1253         default:
1254                 break;
1255         }
1256         return NULL;
1257 
1258 out:
1259         expr->ctype = ctype;
1260         return ctype;
1261 
1262 Qual:
1263         if (qual & ~ctype->ctype.modifiers) {
1264                 struct symbol *sym = alloc_symbol(ctype->pos, SYM_PTR);
1265                 *sym = *ctype;
1266                 sym->ctype.modifiers |= qual;
1267                 ctype = sym;
1268         }
1269         *true = cast_to(*true, ctype);
1270         expr->cond_false = cast_to(expr->cond_false, ctype);
1271         goto out;
1272 }
1273 
1274 /* FP assignments can not do modulo or bit operations */
1275 static int compatible_float_op(int op)
1276 {
1277         return  op == SPECIAL_ADD_ASSIGN ||
1278                 op == SPECIAL_SUB_ASSIGN ||
1279                 op == SPECIAL_MUL_ASSIGN ||
1280                 op == SPECIAL_DIV_ASSIGN;
1281 }
1282 
1283 static int evaluate_assign_op(struct expression *expr)
1284 {
1285         struct symbol *target = expr->left->ctype;
1286         struct symbol *source = expr->right->ctype;
1287         struct symbol *t, *s;
1288         int tclass = classify_type(target, &t);
1289         int sclass = classify_type(source, &s);
1290         int op = expr->op;
1291 
1292         if (tclass & sclass & TYPE_NUM) {
1293                 if (tclass & TYPE_FLOAT && !compatible_float_op(op)) {
1294                         expression_error(expr, "invalid assignment");
1295                         return 0;
1296                 }
1297                 if (tclass & TYPE_RESTRICT) {
1298                         if (!restricted_binop(op, t)) {
1299                                 warning(expr->pos, "bad assignment (%s) to %s",
1300                                         show_special(op), show_typename(t));
1301                                 expr->right = cast_to(expr->right, target);
1302                                 return 0;
1303                         }
1304                         /* allowed assignments unfoul */
1305                         if (sclass & TYPE_FOULED && unfoul(s) == t)
1306                                 goto Cast;
1307                         if (!restricted_value(expr->right, t))
1308                                 return 1;
1309                 } else if (!(sclass & TYPE_RESTRICT))
1310                         goto usual;
1311                 /* source and target would better be identical restricted */
1312                 if (t == s)
1313                         return 1;
1314                 warning(expr->pos, "invalid assignment: %s", show_special(op));
1315                 info(expr->pos, "   left side has type %s", show_typename(t));
1316                 info(expr->pos, "   right side has type %s", show_typename(s));
1317                 expr->right = cast_to(expr->right, target);
1318                 return 0;
1319         }
1320         if (tclass == TYPE_PTR && is_int(sclass)) {
1321                 if (op == SPECIAL_ADD_ASSIGN || op == SPECIAL_SUB_ASSIGN) {
1322                         unrestrict(expr->right, sclass, &s);
1323                         evaluate_ptr_add(expr, s);
1324                         return 1;
1325                 }
1326                 expression_error(expr, "invalid pointer assignment");
1327                 return 0;
1328         }
1329 
1330         expression_error(expr, "invalid assignment");
1331         return 0;
1332 
1333 usual:
1334         target = usual_conversions(op, expr->left, expr->right,
1335                                 tclass, sclass, target, source);
1336 Cast:
1337         expr->right = cast_to(expr->right, target);
1338         return 1;
1339 }
1340 
1341 static int whitelist_pointers(struct symbol *t1, struct symbol *t2)
1342 {
1343         if (t1 == t2)
1344                 return 0;       /* yes, 0 - we don't want a cast_to here */
1345         if (t1 == &void_ctype)
1346                 return 1;
1347         if (t2 == &void_ctype)
1348                 return 1;
1349         if (classify_type(t1, &t1) != TYPE_NUM)
1350                 return 0;
1351         if (classify_type(t2, &t2) != TYPE_NUM)
1352                 return 0;
1353         if (t1 == t2)
1354                 return 1;
1355         if (t1->ctype.modifiers & t2->ctype.modifiers & MOD_CHAR)
1356                 return 1;
1357         if ((t1->ctype.modifiers ^ t2->ctype.modifiers) & MOD_SIZE)
1358                 return 0;
1359         return !Wtypesign;
1360 }
1361 
1362 static int check_assignment_types(struct symbol *target, struct expression **rp,
1363         const char **typediff)
1364 {
1365         struct symbol *source = degenerate(*rp);
1366         struct symbol *t, *s;
1367         int tclass = classify_type(target, &t);
1368         int sclass = classify_type(source, &s);
1369 
1370         if (tclass & sclass & TYPE_NUM) {
1371                 if (tclass & TYPE_RESTRICT) {
1372                         /* allowed assignments unfoul */
1373                         if (sclass & TYPE_FOULED && unfoul(s) == t)
1374                                 goto Cast;
1375                         if (!restricted_value(*rp, target))
1376                                 return 1;
1377                         if (s == t)
1378                                 return 1;
1379                 } else if (!(sclass & TYPE_RESTRICT))
1380                         goto Cast;
1381                 if (t == &bool_ctype) {
1382                         if (is_fouled_type(s))
1383                                 warning((*rp)->pos, "%s degrades to integer",
1384                                         show_typename(s->ctype.base_type));
1385                         goto Cast;
1386                 }
1387                 *typediff = "different base types";
1388                 return 0;
1389         }
1390 
1391         if (tclass == TYPE_PTR) {
1392                 unsigned long mod1, mod2;
1393                 struct symbol *b1, *b2;
1394                 // NULL pointer is always OK
1395                 int is_null = is_null_pointer_constant(*rp);
1396                 if (is_null) {
1397                         if (is_null == 2)
1398                                 bad_null(*rp);
1399                         goto Cast;
1400                 }
1401                 if (!(sclass & TYPE_PTR)) {
1402                         *typediff = "different base types";
1403                         return 0;
1404                 }
1405                 b1 = examine_pointer_target(t);
1406                 b2 = examine_pointer_target(s);
1407                 mod1 = target_qualifiers(t);
1408                 mod2 = target_qualifiers(s);
1409                 if (whitelist_pointers(b1, b2)) {
1410                         /*
1411                          * assignments to/from void * are OK, provided that
1412                          * we do not remove qualifiers from pointed to [C]
1413                          * or mix address spaces [sparse].
1414                          */
1415                         if (t->ctype.as != s->ctype.as) {
1416                                 *typediff = "different address spaces";
1417                                 return 0;
1418                         }
1419                         /*
1420                          * If this is a function pointer assignment, it is
1421                          * actually fine to assign a pointer to const data to
1422                          * it, as a function pointer points to const data
1423                          * implicitly, i.e., dereferencing it does not produce
1424                          * an lvalue.
1425                          */
1426                         if (b1->type == SYM_FN)
1427                                 mod1 |= MOD_CONST;
1428                         if (mod2 & ~mod1) {
1429                                 *typediff = "different modifiers";
1430                                 return 0;
1431                         }
1432                         goto Cast;
1433                 }
1434                 /* It's OK if the target is more volatile or const than the source */
1435                 *typediff = type_difference(&t->ctype, &s->ctype, 0, mod1);
1436                 if (*typediff)
1437                         return 0;
1438                 return 1;
1439         }
1440 
1441         if ((tclass & TYPE_COMPOUND) && s == t)
1442                 return 1;
1443 
1444         if (tclass & TYPE_NUM) {
1445                 /* XXX: need to turn into comparison with NULL */
1446                 if (t == &bool_ctype && (sclass & TYPE_PTR))
1447                         goto Cast;
1448                 *typediff = "different base types";
1449                 return 0;
1450         }
1451         *typediff = "invalid types";
1452         return 0;
1453 
1454 Cast:
1455         *rp = cast_to(*rp, target);
1456         return 1;
1457 }
1458 
1459 static int compatible_assignment_types(struct expression *expr, struct symbol *target,
1460         struct expression **rp, const char *where)
1461 {
1462         const char *typediff;
1463         struct symbol *source = degenerate(*rp);
1464 
1465         if (!check_assignment_types(target, rp, &typediff)) {
1466                 warning(expr->pos, "incorrect type in %s (%s)", where, typediff);
1467                 info(expr->pos, "   expected %s", show_typename(target));
1468                 info(expr->pos, "   got %s", show_typename(source));
1469                 *rp = cast_to(*rp, target);
1470                 return 0;
1471         }
1472 
1473         return 1;
1474 }
1475 
1476 static int compatible_transparent_union(struct symbol *target,
1477         struct expression **rp)
1478 {
1479         struct symbol *t, *member;
1480         classify_type(target, &t);
1481         if (t->type != SYM_UNION || !t->transparent_union)
1482                 return 0;
1483 
1484         FOR_EACH_PTR(t->symbol_list, member) {
1485                 const char *typediff;
1486                 if (check_assignment_types(member, rp, &typediff))
1487                         return 1;
1488         } END_FOR_EACH_PTR(member);
1489 
1490         return 0;
1491 }
1492 
1493 static int compatible_argument_type(struct expression *expr, struct symbol *target,
1494         struct expression **rp, const char *where)
1495 {
1496         if (compatible_transparent_union(target, rp))
1497                 return 1;
1498 
1499         return compatible_assignment_types(expr, target, rp, where);
1500 }
1501 
1502 static void mark_assigned(struct expression *expr)
1503 {
1504         struct symbol *sym;
1505 
1506         if (!expr)
1507                 return;
1508         switch (expr->type) {
1509         case EXPR_SYMBOL:
1510                 sym = expr->symbol;
1511                 if (!sym)
1512                         return;
1513                 if (sym->type != SYM_NODE)
1514                         return;
1515                 sym->ctype.modifiers |= MOD_ASSIGNED;
1516                 return;
1517 
1518         case EXPR_BINOP:
1519                 mark_assigned(expr->left);
1520                 mark_assigned(expr->right);
1521                 return;
1522         case EXPR_CAST:
1523         case EXPR_FORCE_CAST:
1524                 mark_assigned(expr->cast_expression);
1525                 return;
1526         case EXPR_SLICE:
1527                 mark_assigned(expr->base);
1528                 return;
1529         default:
1530                 /* Hmm? */
1531                 return;
1532         }
1533 }
1534 
1535 static void evaluate_assign_to(struct expression *left, struct symbol *type)
1536 {
1537         if (type->ctype.modifiers & MOD_CONST)
1538                 expression_error(left, "assignment to const expression");
1539 
1540         /* We know left is an lvalue, so it's a "preop-*" */
1541         mark_assigned(left->unop);
1542 }
1543 
1544 static struct symbol *evaluate_assignment(struct expression *expr)
1545 {
1546         struct expression *left = expr->left;
1547         struct expression *where = expr;
1548         struct symbol *ltype;
1549 
1550         if (!lvalue_expression(left)) {
1551                 expression_error(expr, "not an lvalue");
1552                 return NULL;
1553         }
1554 
1555         ltype = left->ctype;
1556 
1557         if (expr->op != '=') {
1558                 if (!evaluate_assign_op(expr))
1559                         return NULL;
1560         } else {
1561                 if (!compatible_assignment_types(where, ltype, &expr->right, "assignment"))
1562                         return NULL;
1563         }
1564 
1565         evaluate_assign_to(left, ltype);
1566 
1567         expr->ctype = ltype;
1568         return ltype;
1569 }
1570 
1571 static void examine_fn_arguments(struct symbol *fn)
1572 {
1573         struct symbol *s;
1574 
1575         FOR_EACH_PTR(fn->arguments, s) {
1576                 struct symbol *arg = evaluate_symbol(s);
1577                 /* Array/function arguments silently degenerate into pointers */
1578                 if (arg) {
1579                         struct symbol *ptr;
1580                         switch(arg->type) {
1581                         case SYM_ARRAY:
1582                         case SYM_FN:
1583                                 ptr = alloc_symbol(s->pos, SYM_PTR);
1584                                 if (arg->type == SYM_ARRAY)
1585                                         ptr->ctype = arg->ctype;
1586                                 else
1587                                         ptr->ctype.base_type = arg;
1588                                 ptr->ctype.as |= s->ctype.as;
1589                                 ptr->ctype.modifiers |= s->ctype.modifiers & MOD_PTRINHERIT;
1590 
1591                                 s->ctype.base_type = ptr;
1592                                 s->ctype.as = 0;
1593                                 s->ctype.modifiers &= ~MOD_PTRINHERIT;
1594                                 s->bit_size = 0;
1595                                 s->examined = 0;
1596                                 examine_symbol_type(s);
1597                                 break;
1598                         default:
1599                                 /* nothing */
1600                                 break;
1601                         }
1602                 }
1603         } END_FOR_EACH_PTR(s);
1604 }
1605 
1606 static struct symbol *convert_to_as_mod(struct symbol *sym, int as, int mod)
1607 {
1608         /* Take the modifiers of the pointer, and apply them to the member */
1609         mod |= sym->ctype.modifiers;
1610         if (sym->ctype.as != as || sym->ctype.modifiers != mod) {
1611                 struct symbol *newsym = alloc_symbol(sym->pos, SYM_NODE);
1612                 *newsym = *sym;
1613                 newsym->ctype.as = as;
1614                 newsym->ctype.modifiers = mod;
1615                 sym = newsym;
1616         }
1617         return sym;
1618 }
1619 
1620 static struct symbol *create_pointer(struct expression *expr, struct symbol *sym, int degenerate)
1621 {
1622         struct symbol *node = alloc_symbol(expr->pos, SYM_NODE);
1623         struct symbol *ptr = alloc_symbol(expr->pos, SYM_PTR);
1624 
1625         node->ctype.base_type = ptr;
1626         ptr->bit_size = bits_in_pointer;
1627         ptr->ctype.alignment = pointer_alignment;
1628 
1629         node->bit_size = bits_in_pointer;
1630         node->ctype.alignment = pointer_alignment;
1631 
1632         access_symbol(sym);
1633         if (sym->ctype.modifiers & MOD_REGISTER) {
1634                 warning(expr->pos, "taking address of 'register' variable '%s'", show_ident(sym->ident));
1635                 sym->ctype.modifiers &= ~MOD_REGISTER;
1636         }
1637         if (sym->type == SYM_NODE) {
1638                 ptr->ctype.as |= sym->ctype.as;
1639                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1640                 sym = sym->ctype.base_type;
1641         }
1642         if (degenerate && sym->type == SYM_ARRAY) {
1643                 ptr->ctype.as |= sym->ctype.as;
1644                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1645                 sym = sym->ctype.base_type;
1646         }
1647         ptr->ctype.base_type = sym;
1648 
1649         return node;
1650 }
1651 
1652 /* Arrays degenerate into pointers on pointer arithmetic */
1653 static struct symbol *degenerate(struct expression *expr)
1654 {
1655         struct symbol *ctype, *base;
1656 
1657         if (!expr)
1658                 return NULL;
1659         ctype = expr->ctype;
1660         if (!ctype)
1661                 return NULL;
1662         base = examine_symbol_type(ctype);
1663         if (ctype->type == SYM_NODE)
1664                 base = ctype->ctype.base_type;
1665         /*
1666          * Arrays degenerate into pointers to the entries, while
1667          * functions degenerate into pointers to themselves.
1668          * If array was part of non-lvalue compound, we create a copy
1669          * of that compound first and then act as if we were dealing with
1670          * the corresponding field in there.
1671          */
1672         switch (base->type) {
1673         case SYM_ARRAY:
1674                 if (expr->type == EXPR_SLICE) {
1675                         struct symbol *a = alloc_symbol(expr->pos, SYM_NODE);
1676                         struct expression *e0, *e1, *e2, *e3, *e4;
1677 
1678                         a->ctype.base_type = expr->base->ctype;
1679                         a->bit_size = expr->base->ctype->bit_size;
1680                         a->array_size = expr->base->ctype->array_size;
1681 
1682                         e0 = alloc_expression(expr->pos, EXPR_SYMBOL);
1683                         e0->symbol = a;
1684                         e0->ctype = &lazy_ptr_ctype;
1685 
1686                         e1 = alloc_expression(expr->pos, EXPR_PREOP);
1687                         e1->unop = e0;
1688                         e1->op = '*';
1689                         e1->ctype = expr->base->ctype; /* XXX */
1690 
1691                         e2 = alloc_expression(expr->pos, EXPR_ASSIGNMENT);
1692                         e2->left = e1;
1693                         e2->right = expr->base;
1694                         e2->op = '=';
1695                         e2->ctype = expr->base->ctype;
1696 
1697                         if (expr->r_bitpos) {
1698                                 e3 = alloc_expression(expr->pos, EXPR_BINOP);
1699                                 e3->op = '+';
1700                                 e3->left = e0;
1701                                 e3->right = alloc_const_expression(expr->pos,
1702                                                         bits_to_bytes(expr->r_bitpos));
1703                                 e3->ctype = &lazy_ptr_ctype;
1704                         } else {
1705                                 e3 = e0;
1706                         }
1707 
1708                         e4 = alloc_expression(expr->pos, EXPR_COMMA);
1709                         e4->left = e2;
1710                         e4->right = e3;
1711                         e4->ctype = &lazy_ptr_ctype;
1712 
1713                         expr->unop = e4;
1714                         expr->type = EXPR_PREOP;
1715                         expr->op = '*';
1716                 }
1717         case SYM_FN:
1718                 if (expr->op != '*' || expr->type != EXPR_PREOP) {
1719                         expression_error(expr, "strange non-value function or array");
1720                         return &bad_ctype;
1721                 }
1722                 *expr = *expr->unop;
1723                 ctype = create_pointer(expr, ctype, 1);
1724                 expr->ctype = ctype;
1725         default:
1726                 /* nothing */;
1727         }
1728         return ctype;
1729 }
1730 
1731 static struct symbol *evaluate_addressof(struct expression *expr)
1732 {
1733         struct expression *op = expr->unop;
1734         struct symbol *ctype;
1735 
1736         if (op->op != '*' || op->type != EXPR_PREOP) {
1737                 expression_error(expr, "not addressable");
1738                 return NULL;
1739         }
1740         ctype = op->ctype;
1741         *expr = *op->unop;
1742 
1743         if (expr->type == EXPR_SYMBOL) {
1744                 struct symbol *sym = expr->symbol;
1745                 sym->ctype.modifiers |= MOD_ADDRESSABLE;
1746         }
1747 
1748         /*
1749          * symbol expression evaluation is lazy about the type
1750          * of the sub-expression, so we may have to generate
1751          * the type here if so..
1752          */
1753         if (expr->ctype == &lazy_ptr_ctype) {
1754                 ctype = create_pointer(expr, ctype, 0);
1755                 expr->ctype = ctype;
1756         }
1757         return expr->ctype;
1758 }
1759 
1760 
1761 static struct symbol *evaluate_dereference(struct expression *expr)
1762 {
1763         struct expression *op = expr->unop;
1764         struct symbol *ctype = op->ctype, *node, *target;
1765 
1766         /* Simplify: *&(expr) => (expr) */
1767         if (op->type == EXPR_PREOP && op->op == '&') {
1768                 *expr = *op->unop;
1769                 expr->flags = CEF_NONE;
1770                 return expr->ctype;
1771         }
1772 
1773         examine_symbol_type(ctype);
1774 
1775         /* Dereferencing a node drops all the node information. */
1776         if (ctype->type == SYM_NODE)
1777                 ctype = ctype->ctype.base_type;
1778 
1779         node = alloc_symbol(expr->pos, SYM_NODE);
1780         target = ctype->ctype.base_type;
1781 
1782         switch (ctype->type) {
1783         default:
1784                 expression_error(expr, "cannot dereference this type");
1785                 return NULL;
1786         case SYM_PTR:
1787                 node->ctype.modifiers = target->ctype.modifiers & MOD_SPECIFIER;
1788                 merge_type(node, ctype);
1789                 break;
1790 
1791         case SYM_ARRAY:
1792                 if (!lvalue_expression(op)) {
1793                         expression_error(op, "non-lvalue array??");
1794                         return NULL;
1795                 }
1796 
1797                 /* Do the implied "addressof" on the array */
1798                 *op = *op->unop;
1799 
1800                 /*
1801                  * When an array is dereferenced, we need to pick
1802                  * up the attributes of the original node too..
1803                  */
1804                 merge_type(node, op->ctype);
1805                 merge_type(node, ctype);
1806                 break;
1807         }
1808 
1809         node->bit_size = target->bit_size;
1810         node->array_size = target->array_size;
1811 
1812         expr->ctype = node;
1813         return node;
1814 }
1815 
1816 /*
1817  * Unary post-ops: x++ and x--
1818  */
1819 static struct symbol *evaluate_postop(struct expression *expr)
1820 {
1821         struct expression *op = expr->unop;
1822         struct symbol *ctype = op->ctype;
1823         int class = classify_type(ctype, &ctype);
1824         int multiply = 0;
1825 
1826         if (!class || class & TYPE_COMPOUND) {
1827                 expression_error(expr, "need scalar for ++/--");
1828                 return NULL;
1829         }
1830         if (!lvalue_expression(expr->unop)) {
1831                 expression_error(expr, "need lvalue expression for ++/--");
1832                 return NULL;
1833         }
1834 
1835         if ((class & TYPE_RESTRICT) && restricted_unop(expr->op, &ctype))
1836                 unrestrict(expr, class, &ctype);
1837 
1838         if (class & TYPE_NUM) {
1839                 multiply = 1;
1840         } else if (class == TYPE_PTR) {
1841                 struct symbol *target = examine_pointer_target(ctype);
1842                 if (!is_function(target))
1843                         multiply = bits_to_bytes(target->bit_size);
1844         }
1845 
1846         if (multiply) {
1847                 evaluate_assign_to(op, op->ctype);
1848                 expr->op_value = multiply;
1849                 expr->ctype = ctype;
1850                 return ctype;
1851         }
1852 
1853         expression_error(expr, "bad argument type for ++/--");
1854         return NULL;
1855 }
1856 
1857 static struct symbol *evaluate_sign(struct expression *expr)
1858 {
1859         struct symbol *ctype = expr->unop->ctype;
1860         int class = classify_type(ctype, &ctype);
1861         unsigned char flags = expr->unop->flags & ~CEF_CONST_MASK;
1862 
1863         /* should be an arithmetic type */
1864         if (!(class & TYPE_NUM))
1865                 return bad_expr_type(expr);
1866         if (class & TYPE_RESTRICT)
1867                 goto Restr;
1868 Normal:
1869         if (!(class & TYPE_FLOAT)) {
1870                 ctype = integer_promotion(ctype);
1871                 expr->unop = cast_to(expr->unop, ctype);
1872         } else if (expr->op != '~') {
1873                 /* no conversions needed */
1874         } else {
1875                 return bad_expr_type(expr);
1876         }
1877         if (expr->op == '+')
1878                 *expr = *expr->unop;
1879         expr->flags = flags;
1880         expr->ctype = ctype;
1881         return ctype;
1882 Restr:
1883         if (restricted_unop(expr->op, &ctype))
1884                 unrestrict(expr, class, &ctype);
1885         goto Normal;
1886 }
1887 
1888 static struct symbol *evaluate_preop(struct expression *expr)
1889 {
1890         struct symbol *ctype = expr->unop->ctype;
1891 
1892         switch (expr->op) {
1893         case '(':
1894                 *expr = *expr->unop;
1895                 return ctype;
1896 
1897         case '+':
1898         case '-':
1899         case '~':
1900                 return evaluate_sign(expr);
1901 
1902         case '*':
1903                 return evaluate_dereference(expr);
1904 
1905         case '&':
1906                 return evaluate_addressof(expr);
1907 
1908         case SPECIAL_INCREMENT:
1909         case SPECIAL_DECREMENT:
1910                 /*
1911                  * From a type evaluation standpoint the preops are
1912                  * the same as the postops
1913                  */
1914                 return evaluate_postop(expr);
1915 
1916         case '!':
1917                 expr->flags = expr->unop->flags & ~CEF_CONST_MASK;
1918                 /*
1919                  * A logical negation never yields an address constant
1920                  * [6.6(9)].
1921                  */
1922                 expr->flags &= ~CEF_ADDR;
1923 
1924                 if (is_safe_type(ctype))
1925                         warning(expr->pos, "testing a 'safe expression'");
1926                 if (is_float_type(ctype)) {
1927                         struct expression *arg = expr->unop;
1928                         expr->type = EXPR_COMPARE;
1929                         expr->op = SPECIAL_EQUAL;
1930                         expr->left = arg;
1931                         expr->right = alloc_expression(expr->pos, EXPR_FVALUE);
1932                         expr->right->ctype = ctype;
1933                         expr->right->fvalue = 0;
1934                 } else if (is_fouled_type(ctype)) {
1935                         warning(expr->pos, "%s degrades to integer",
1936                                 show_typename(ctype->ctype.base_type));
1937                 }
1938                 /* the result is int [6.5.3.3(5)]*/
1939                 ctype = &int_ctype;
1940                 break;
1941 
1942         default:
1943                 break;
1944         }
1945         expr->ctype = ctype;
1946         return ctype;
1947 }
1948 
1949 struct symbol *find_identifier(struct ident *ident, struct symbol_list *_list, int *offset)
1950 {
1951         struct ptr_list *head = (struct ptr_list *)_list;
1952         struct ptr_list *list = head;
1953 
1954         if (!head)
1955                 return NULL;
1956         do {
1957                 int i;
1958                 for (i = 0; i < list->nr; i++) {
1959                         struct symbol *sym = (struct symbol *) list->list[i];
1960                         if (sym->ident) {
1961                                 if (sym->ident != ident)
1962                                         continue;
1963                                 *offset = sym->offset;
1964                                 return sym;
1965                         } else {
1966                                 struct symbol *ctype = sym->ctype.base_type;
1967                                 struct symbol *sub;
1968                                 if (!ctype)
1969                                         continue;
1970                                 if (ctype->type != SYM_UNION && ctype->type != SYM_STRUCT)
1971                                         continue;
1972                                 sub = find_identifier(ident, ctype->symbol_list, offset);
1973                                 if (!sub)
1974                                         continue;
1975                                 *offset += sym->offset;
1976                                 return sub;
1977                         }       
1978                 }
1979         } while ((list = list->next) != head);
1980         return NULL;
1981 }
1982 
1983 static struct expression *evaluate_offset(struct expression *expr, unsigned long offset)
1984 {
1985         struct expression *add;
1986 
1987         /*
1988          * Create a new add-expression
1989          *
1990          * NOTE! Even if we just add zero, we need a new node
1991          * for the member pointer, since it has a different
1992          * type than the original pointer. We could make that
1993          * be just a cast, but the fact is, a node is a node,
1994          * so we might as well just do the "add zero" here.
1995          */
1996         add = alloc_expression(expr->pos, EXPR_BINOP);
1997         add->op = '+';
1998         add->left = expr;
1999         add->right = alloc_expression(expr->pos, EXPR_VALUE);
2000         add->right->ctype = &int_ctype;
2001         add->right->value = offset;
2002 
2003         /*
2004          * The ctype of the pointer will be lazily evaluated if
2005          * we ever take the address of this member dereference..
2006          */
2007         add->ctype = &lazy_ptr_ctype;
2008         /*
2009          * The resulting address of a member access through an address
2010          * constant is an address constant again [6.6(9)].
2011          */
2012         add->flags = expr->flags;
2013 
2014         return add;
2015 }
2016 
2017 /* structure/union dereference */
2018 static struct symbol *evaluate_member_dereference(struct expression *expr)
2019 {
2020         int offset;
2021         struct symbol *ctype, *member;
2022         struct expression *deref = expr->deref, *add;
2023         struct ident *ident = expr->member;
2024         unsigned int mod;
2025         int address_space;
2026 
2027         if (!evaluate_expression(deref))
2028                 return NULL;
2029         if (!ident) {
2030                 expression_error(expr, "bad member name");
2031                 return NULL;
2032         }
2033 
2034         ctype = deref->ctype;
2035         examine_symbol_type(ctype);
2036         address_space = ctype->ctype.as;
2037         mod = ctype->ctype.modifiers;
2038         if (ctype->type == SYM_NODE) {
2039                 ctype = ctype->ctype.base_type;
2040                 address_space |= ctype->ctype.as;
2041                 mod |= ctype->ctype.modifiers;
2042         }
2043         if (!ctype || (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION)) {
2044                 expression_error(expr, "expected structure or union");
2045                 return NULL;
2046         }
2047         offset = 0;
2048         member = find_identifier(ident, ctype->symbol_list, &offset);
2049         if (!member) {
2050                 const char *type = ctype->type == SYM_STRUCT ? "struct" : "union";
2051                 const char *name = "<unnamed>";
2052                 int namelen = 9;
2053                 if (ctype->ident) {
2054                         name = ctype->ident->name;
2055                         namelen = ctype->ident->len;
2056                 }
2057                 if (ctype->symbol_list)
2058                         expression_error(expr, "no member '%s' in %s %.*s",
2059                                 show_ident(ident), type, namelen, name);
2060                 else
2061                         expression_error(expr, "using member '%s' in "
2062                                 "incomplete %s %.*s", show_ident(ident),
2063                                 type, namelen, name);
2064                 return NULL;
2065         }
2066 
2067         /*
2068          * The member needs to take on the address space and modifiers of
2069          * the "parent" type.
2070          */
2071         member = convert_to_as_mod(member, address_space, mod);
2072         ctype = get_base_type(member);
2073 
2074         if (!lvalue_expression(deref)) {
2075                 if (deref->type != EXPR_SLICE) {
2076                         expr->base = deref;
2077                         expr->r_bitpos = 0;
2078                 } else {
2079                         expr->base = deref->base;
2080                         expr->r_bitpos = deref->r_bitpos;
2081                 }
2082                 expr->r_bitpos += bytes_to_bits(offset);
2083                 expr->type = EXPR_SLICE;
2084                 expr->r_nrbits = member->bit_size;
2085                 expr->r_bitpos += member->bit_offset;
2086                 expr->ctype = member;
2087                 return member;
2088         }
2089 
2090         deref = deref->unop;
2091         expr->deref = deref;
2092 
2093         add = evaluate_offset(deref, offset);
2094         expr->type = EXPR_PREOP;
2095         expr->op = '*';
2096         expr->unop = add;
2097 
2098         expr->ctype = member;
2099         return member;
2100 }
2101 
2102 static int is_promoted(struct expression *expr)
2103 {
2104         while (1) {
2105                 switch (expr->type) {
2106                 case EXPR_BINOP:
2107                 case EXPR_SELECT:
2108                 case EXPR_CONDITIONAL:
2109                         return 1;
2110                 case EXPR_COMMA:
2111                         expr = expr->right;
2112                         continue;
2113                 case EXPR_PREOP:
2114                         switch (expr->op) {
2115                         case '(':
2116                                 expr = expr->unop;
2117                                 continue;
2118                         case '+':
2119                         case '-':
2120                         case '~':
2121                                 return 1;
2122                         default:
2123                                 return 0;
2124                         }
2125                 default:
2126                         return 0;
2127                 }
2128         }
2129 }
2130 
2131 
2132 static struct symbol *evaluate_cast(struct expression *);
2133 
2134 static struct symbol *evaluate_type_information(struct expression *expr)
2135 {
2136         struct symbol *sym = expr->cast_type;
2137         if (!sym) {
2138                 sym = evaluate_expression(expr->cast_expression);
2139                 if (!sym)
2140                         return NULL;
2141                 /*
2142                  * Expressions of restricted types will possibly get
2143                  * promoted - check that here
2144                  */
2145                 if (is_restricted_type(sym)) {
2146                         if (sym->bit_size < bits_in_int && is_promoted(expr))
2147                                 sym = &int_ctype;
2148                 } else if (is_fouled_type(sym)) {
2149                         sym = &int_ctype;
2150                 }
2151         }
2152         examine_symbol_type(sym);
2153         if (is_bitfield_type(sym)) {
2154                 expression_error(expr, "trying to examine bitfield type");
2155                 return NULL;
2156         }
2157         return sym;
2158 }
2159 
2160 static struct symbol *evaluate_sizeof(struct expression *expr)
2161 {
2162         struct symbol *type;
2163         int size;
2164 
2165         type = evaluate_type_information(expr);
2166         if (!type)
2167                 return NULL;
2168 
2169         size = type->bit_size;
2170 
2171         if (size < 0 && is_void_type(type)) {
2172                 if (Wpointer_arith)
2173                         warning(expr->pos, "expression using sizeof(void)");
2174                 size = bits_in_char;
2175         }
2176 
2177         if (size == 1 && is_bool_type(type)) {
2178                 if (Wsizeof_bool)
2179                         warning(expr->pos, "expression using sizeof bool");
2180                 size = bits_in_char;
2181         }
2182 
2183         if (is_function(type->ctype.base_type)) {
2184                 if (Wpointer_arith)
2185                         warning(expr->pos, "expression using sizeof on a function");
2186                 size = bits_in_char;
2187         }
2188 
2189         if ((size < 0) || (size & (bits_in_char - 1)))
2190                 expression_error(expr, "cannot size expression");
2191 
2192         expr->type = EXPR_VALUE;
2193         expr->value = bits_to_bytes(size);
2194         expr->taint = 0;
2195         expr->ctype = size_t_ctype;
2196         return size_t_ctype;
2197 }
2198 
2199 static struct symbol *evaluate_ptrsizeof(struct expression *expr)
2200 {
2201         struct symbol *type;
2202         int size;
2203 
2204         type = evaluate_type_information(expr);
2205         if (!type)
2206                 return NULL;
2207 
2208         if (type->type == SYM_NODE)
2209                 type = type->ctype.base_type;
2210         if (!type)
2211                 return NULL;
2212         switch (type->type) {
2213         case SYM_ARRAY:
2214                 break;
2215         case SYM_PTR:
2216                 type = get_base_type(type);
2217                 if (type)
2218                         break;
2219         default:
2220                 expression_error(expr, "expected pointer expression");
2221                 return NULL;
2222         }
2223         size = type->bit_size;
2224         if (size & (bits_in_char-1))
2225                 size = 0;
2226         expr->type = EXPR_VALUE;
2227         expr->value = bits_to_bytes(size);
2228         expr->taint = 0;
2229         expr->ctype = size_t_ctype;
2230         return size_t_ctype;
2231 }
2232 
2233 static struct symbol *evaluate_alignof(struct expression *expr)
2234 {
2235         struct symbol *type;
2236 
2237         type = evaluate_type_information(expr);
2238         if (!type)
2239                 return NULL;
2240 
2241         expr->type = EXPR_VALUE;
2242         expr->value = type->ctype.alignment;
2243         expr->taint = 0;
2244         expr->ctype = size_t_ctype;
2245         return size_t_ctype;
2246 }
2247 
2248 static int evaluate_arguments(struct symbol *fn, struct expression_list *head)
2249 {
2250         struct expression *expr;
2251         struct symbol_list *argument_types = fn->arguments;
2252         struct symbol *argtype;
2253         int i = 1;
2254 
2255         PREPARE_PTR_LIST(argument_types, argtype);
2256         FOR_EACH_PTR (head, expr) {
2257                 struct expression **p = THIS_ADDRESS(expr);
2258                 struct symbol *ctype, *target;
2259                 ctype = evaluate_expression(expr);
2260 
2261                 if (!ctype)
2262                         return 0;
2263 
2264                 target = argtype;
2265                 if (!target) {
2266                         struct symbol *type;
2267                         int class = classify_type(ctype, &type);
2268                         if (is_int(class)) {
2269                                 *p = cast_to(expr, integer_promotion(type));
2270                         } else if (class & TYPE_FLOAT) {
2271                                 unsigned long mod = type->ctype.modifiers;
2272                                 if (!(mod & (MOD_LONG_ALL)))
2273                                         *p = cast_to(expr, &double_ctype);
2274                         } else if (class & TYPE_PTR) {
2275                                 if (expr->ctype == &null_ctype)
2276                                         *p = cast_to(expr, &ptr_ctype);
2277                                 else
2278                                         degenerate(expr);
2279                         }
2280                 } else if (!target->forced_arg){
2281                         static char where[30];
2282                         examine_symbol_type(target);
2283                         sprintf(where, "argument %d", i);
2284                         compatible_argument_type(expr, target, p, where);
2285                 }
2286 
2287                 i++;
2288                 NEXT_PTR_LIST(argtype);
2289         } END_FOR_EACH_PTR(expr);
2290         FINISH_PTR_LIST(argtype);
2291         return 1;
2292 }
2293 
2294 static void convert_index(struct expression *e)
2295 {
2296         struct expression *child = e->idx_expression;
2297         unsigned from = e->idx_from;
2298         unsigned to = e->idx_to + 1;
2299         e->type = EXPR_POS;
2300         e->init_offset = from * bits_to_bytes(e->ctype->bit_size);
2301         e->init_nr = to - from;
2302         e->init_expr = child;
2303 }
2304 
2305 static void convert_ident(struct expression *e)
2306 {
2307         struct expression *child = e->ident_expression;
2308         int offset = e->offset;
2309 
2310         e->type = EXPR_POS;
2311         e->init_offset = offset;
2312         e->init_nr = 1;
2313         e->init_expr = child;
2314 }
2315 
2316 static void convert_designators(struct expression *e)
2317 {
2318         while (e) {
2319                 if (e->type == EXPR_INDEX)
2320                         convert_index(e);
2321                 else if (e->type == EXPR_IDENTIFIER)
2322                         convert_ident(e);
2323                 else
2324                         break;
2325                 e = e->init_expr;
2326         }
2327 }
2328 
2329 static void excess(struct expression *e, const char *s)
2330 {
2331         warning(e->pos, "excessive elements in %s initializer", s);
2332 }
2333 
2334 /*
2335  * implicit designator for the first element
2336  */
2337 static struct expression *first_subobject(struct symbol *ctype, int class,
2338                                           struct expression **v)
2339 {
2340         struct expression *e = *v, *new;
2341 
2342         if (ctype->type == SYM_NODE)
2343                 ctype = ctype->ctype.base_type;
2344 
2345         if (class & TYPE_PTR) { /* array */
2346                 if (!ctype->bit_size)
2347                         return NULL;
2348                 new = alloc_expression(e->pos, EXPR_INDEX);
2349                 new->idx_expression = e;
2350                 new->ctype = ctype->ctype.base_type;
2351         } else  {
2352                 struct symbol *field, *p;
2353                 PREPARE_PTR_LIST(ctype->symbol_list, p);
2354                 while (p && !p->ident && is_bitfield_type(p))
2355                         NEXT_PTR_LIST(p);
2356                 field = p;
2357                 FINISH_PTR_LIST(p);
2358                 if (!field)
2359                         return NULL;
2360                 new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2361                 new->ident_expression = e;
2362                 new->field = new->ctype = field;
2363                 new->offset = field->offset;
2364         }
2365         *v = new;
2366         return new;
2367 }
2368 
2369 /*
2370  * sanity-check explicit designators; return the innermost one or NULL
2371  * in case of error.  Assign types.
2372  */
2373 static struct expression *check_designators(struct expression *e,
2374                                             struct symbol *ctype)
2375 {
2376         struct expression *last = NULL;
2377         const char *err;
2378         while (1) {
2379                 if (ctype->type == SYM_NODE)
2380                         ctype = ctype->ctype.base_type;
2381                 if (e->type == EXPR_INDEX) {
2382                         struct symbol *type;
2383                         if (ctype->type != SYM_ARRAY) {
2384                                 err = "array index in non-array";
2385                                 break;
2386                         }
2387                         type = ctype->ctype.base_type;
2388                         if (ctype->bit_size >= 0 && type->bit_size >= 0) {
2389                                 unsigned offset = array_element_offset(type->bit_size, e->idx_to);
2390                                 if (offset >= ctype->bit_size) {
2391                                         err = "index out of bounds in";
2392                                         break;
2393                                 }
2394                         }
2395                         e->ctype = ctype = type;
2396                         ctype = type;
2397                         last = e;
2398                         if (!e->idx_expression) {
2399                                 err = "invalid";
2400                                 break;
2401                         }
2402                         e = e->idx_expression;
2403                 } else if (e->type == EXPR_IDENTIFIER) {
2404                         int offset = 0;
2405                         if (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION) {
2406                                 err = "field name not in struct or union";
2407                                 break;
2408                         }
2409                         ctype = find_identifier(e->expr_ident, ctype->symbol_list, &offset);
2410                         if (!ctype) {
2411                                 err = "unknown field name in";
2412                                 break;
2413                         }
2414                         e->offset = offset;
2415                         e->field = e->ctype = ctype;
2416                         last = e;
2417                         if (!e->ident_expression) {
2418                                 err = "invalid";
2419                                 break;
2420                         }
2421                         e = e->ident_expression;
2422                 } else if (e->type == EXPR_POS) {
2423                         err = "internal front-end error: EXPR_POS in";
2424                         break;
2425                 } else
2426                         return last;
2427         }
2428         expression_error(e, "%s initializer", err);
2429         return NULL;
2430 }
2431 
2432 /*
2433  * choose the next subobject to initialize.
2434  *
2435  * Get designators for next element, switch old ones to EXPR_POS.
2436  * Return the resulting expression or NULL if we'd run out of subobjects.
2437  * The innermost designator is returned in *v.  Designators in old
2438  * are assumed to be already sanity-checked.
2439  */
2440 static struct expression *next_designators(struct expression *old,
2441                              struct symbol *ctype,
2442                              struct expression *e, struct expression **v)
2443 {
2444         struct expression *new = NULL;
2445 
2446         if (!old)
2447                 return NULL;
2448         if (old->type == EXPR_INDEX) {
2449                 struct expression *copy;
2450                 unsigned n;
2451 
2452                 copy = next_designators(old->idx_expression,
2453                                         old->ctype, e, v);
2454                 if (!copy) {
2455                         n = old->idx_to + 1;
2456                         if (array_element_offset(old->ctype->bit_size, n) == ctype->bit_size) {
2457                                 convert_index(old);
2458                                 return NULL;
2459                         }
2460                         copy = e;
2461                         *v = new = alloc_expression(e->pos, EXPR_INDEX);
2462                 } else {
2463                         n = old->idx_to;
2464                         new = alloc_expression(e->pos, EXPR_INDEX);
2465                 }
2466 
2467                 new->idx_from = new->idx_to = n;
2468                 new->idx_expression = copy;
2469                 new->ctype = old->ctype;
2470                 convert_index(old);
2471         } else if (old->type == EXPR_IDENTIFIER) {
2472                 struct expression *copy;
2473                 struct symbol *field;
2474                 int offset = 0;
2475 
2476                 copy = next_designators(old->ident_expression,
2477                                         old->ctype, e, v);
2478                 if (!copy) {
2479                         field = old->field->next_subobject;
2480                         if (!field) {
2481                                 convert_ident(old);
2482                                 return NULL;
2483                         }
2484                         copy = e;
2485                         *v = new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2486                         /*
2487                          * We can't necessarily trust "field->offset",
2488                          * because the field might be in an anonymous
2489                          * union, and the field offset is then the offset
2490                          * within that union.
2491                          *
2492                          * The "old->offset - old->field->offset"
2493                          * would be the offset of such an anonymous
2494                          * union.
2495                          */
2496                         offset = old->offset - old->field->offset;
2497                 } else {
2498                         field = old->field;
2499                         new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2500                 }
2501 
2502                 new->field = field;
2503                 new->expr_ident = field->ident;
2504                 new->ident_expression = copy;
2505                 new->ctype = field;
2506                 new->offset = field->offset + offset;
2507                 convert_ident(old);
2508         }
2509         return new;
2510 }
2511 
2512 static int handle_initializer(struct expression **ep, int nested,
2513                 int class, struct symbol *ctype, unsigned long mods);
2514 
2515 /*
2516  * deal with traversing subobjects [6.7.8(17,18,20)]
2517  */
2518 static void handle_list_initializer(struct expression *expr,
2519                 int class, struct symbol *ctype, unsigned long mods)
2520 {
2521         struct expression *e, *last = NULL, *top = NULL, *next;
2522         int jumped = 0;
2523 
2524         FOR_EACH_PTR(expr->expr_list, e) {
2525                 struct expression **v;
2526                 struct symbol *type;
2527                 int lclass;
2528 
2529                 if (e->type != EXPR_INDEX && e->type != EXPR_IDENTIFIER) {
2530                         struct symbol *struct_sym;
2531                         if (!top) {
2532                                 top = e;
2533                                 last = first_subobject(ctype, class, &top);
2534                         } else {
2535                                 last = next_designators(last, ctype, e, &top);
2536                         }
2537                         if (!last) {
2538                                 excess(e, class & TYPE_PTR ? "array" :
2539                                                         "struct or union");
2540                                 DELETE_CURRENT_PTR(e);
2541                                 continue;
2542                         }
2543                         struct_sym = ctype->type == SYM_NODE ? ctype->ctype.base_type : ctype;
2544                         if (Wdesignated_init && struct_sym->designated_init)
2545                                 warning(e->pos, "%s%.*s%spositional init of field in %s %s, declared with attribute designated_init",
2546                                         ctype->ident ? "in initializer for " : "",
2547                                         ctype->ident ? ctype->ident->len : 0,
2548                                         ctype->ident ? ctype->ident->name : "",
2549                                         ctype->ident ? ": " : "",
2550                                         get_type_name(struct_sym->type),
2551                                         show_ident(struct_sym->ident));
2552                         if (jumped) {
2553                                 warning(e->pos, "advancing past deep designator");
2554                                 jumped = 0;
2555                         }
2556                         REPLACE_CURRENT_PTR(e, last);
2557                 } else {
2558                         next = check_designators(e, ctype);
2559                         if (!next) {
2560                                 DELETE_CURRENT_PTR(e);
2561                                 continue;
2562                         }
2563                         top = next;
2564                         /* deeper than one designator? */
2565                         jumped = top != e;
2566                         convert_designators(last);
2567                         last = e;
2568                 }
2569 
2570 found:
2571                 lclass = classify_type(top->ctype, &type);
2572                 if (top->type == EXPR_INDEX)
2573                         v = &top->idx_expression;
2574                 else
2575                         v = &top->ident_expression;
2576 
2577                 mods |= ctype->ctype.modifiers & MOD_STORAGE;
2578                 if (handle_initializer(v, 1, lclass, top->ctype, mods))
2579                         continue;
2580 
2581                 if (!(lclass & TYPE_COMPOUND)) {
2582                         warning(e->pos, "bogus scalar initializer");
2583                         DELETE_CURRENT_PTR(e);
2584                         continue;
2585                 }
2586 
2587                 next = first_subobject(type, lclass, v);
2588                 if (next) {
2589                         warning(e->pos, "missing braces around initializer");
2590                         top = next;
2591                         goto found;
2592                 }
2593 
2594                 DELETE_CURRENT_PTR(e);
2595                 excess(e, lclass & TYPE_PTR ? "array" : "struct or union");
2596 
2597         } END_FOR_EACH_PTR(e);
2598 
2599         convert_designators(last);
2600         expr->ctype = ctype;
2601 }
2602 
2603 static int is_string_literal(struct expression **v)
2604 {
2605         struct expression *e = *v;
2606         while (e && e->type == EXPR_PREOP && e->op == '(')
2607                 e = e->unop;
2608         if (!e || e->type != EXPR_STRING)
2609                 return 0;
2610         if (e != *v && Wparen_string)
2611                 warning(e->pos,
2612                         "array initialized from parenthesized string constant");
2613         *v = e;
2614         return 1;
2615 }
2616 
2617 /*
2618  * We want a normal expression, possibly in one layer of braces.  Warn
2619  * if the latter happens inside a list (it's legal, but likely to be
2620  * an effect of screwup).  In case of anything not legal, we are definitely
2621  * having an effect of screwup, so just fail and let the caller warn.
2622  */
2623 static struct expression *handle_scalar(struct expression *e, int nested)
2624 {
2625         struct expression *v = NULL, *p;
2626         int count = 0;
2627 
2628         /* normal case */
2629         if (e->type != EXPR_INITIALIZER)
2630                 return e;
2631 
2632         FOR_EACH_PTR(e->expr_list, p) {
2633                 if (!v)
2634                         v = p;
2635                 count++;
2636         } END_FOR_EACH_PTR(p);
2637         if (count != 1)
2638                 return NULL;
2639         switch(v->type) {
2640         case EXPR_INITIALIZER:
2641         case EXPR_INDEX:
2642         case EXPR_IDENTIFIER:
2643                 return NULL;
2644         default:
2645                 break;
2646         }
2647         if (nested)
2648                 warning(e->pos, "braces around scalar initializer");
2649         return v;
2650 }
2651 
2652 /*
2653  * deal with the cases that don't care about subobjects:
2654  * scalar <- assignment expression, possibly in braces [6.7.8(11)]
2655  * character array <- string literal, possibly in braces [6.7.8(14)]
2656  * struct or union <- assignment expression of compatible type [6.7.8(13)]
2657  * compound type <- initializer list in braces [6.7.8(16)]
2658  * The last one punts to handle_list_initializer() which, in turn will call
2659  * us for individual elements of the list.
2660  *
2661  * We do not handle 6.7.8(15) (wide char array <- wide string literal) for
2662  * the lack of support of wide char stuff in general.
2663  *
2664  * One note: we need to take care not to evaluate a string literal until
2665  * we know that we *will* handle it right here.  Otherwise we would screw
2666  * the cases like struct { struct {char s[10]; ...} ...} initialized with
2667  * { "string", ...} - we need to preserve that string literal recognizable
2668  * until we dig into the inner struct.
2669  */
2670 static int handle_initializer(struct expression **ep, int nested,
2671                 int class, struct symbol *ctype, unsigned long mods)
2672 {
2673         int is_string = is_string_type(ctype);
2674         struct expression *e = *ep, *p;
2675         struct symbol *type;
2676 
2677         if (!e)
2678                 return 0;
2679 
2680         /* scalar */
2681         if (!(class & TYPE_COMPOUND)) {
2682                 e = handle_scalar(e, nested);
2683                 if (!e)
2684                         return 0;
2685                 *ep = e;
2686                 if (!evaluate_expression(e))
2687                         return 1;
2688                 compatible_assignment_types(e, ctype, ep, "initializer");
2689                 /*
2690                  * Initializers for static storage duration objects
2691                  * shall be constant expressions or a string literal [6.7.8(4)].
2692                  */
2693                 mods |= ctype->ctype.modifiers;
2694                 mods &= (MOD_TOPLEVEL | MOD_STATIC);
2695                 if (mods && !(e->flags & (CEF_ACE | CEF_ADDR)))
2696                         if (Wconstexpr_not_const)
2697                                 warning(e->pos, "non-constant initializer for static object");
2698 
2699                 return 1;
2700         }
2701 
2702         /*
2703          * sublist; either a string, or we dig in; the latter will deal with
2704          * pathologies, so we don't need anything fancy here.
2705          */
2706         if (e->type == EXPR_INITIALIZER) {
2707                 if (is_string) {
2708                         struct expression *v = NULL;
2709                         int count = 0;
2710 
2711                         FOR_EACH_PTR(e->expr_list, p) {
2712                                 if (!v)
2713                                         v = p;
2714                                 count++;
2715                         } END_FOR_EACH_PTR(p);
2716                         if (count == 1 && is_string_literal(&v)) {
2717                                 *ep = e = v;
2718                                 goto String;
2719                         }
2720                 }
2721                 handle_list_initializer(e, class, ctype, mods);
2722                 return 1;
2723         }
2724 
2725         /* string */
2726         if (is_string_literal(&e)) {
2727                 /* either we are doing array of char, or we'll have to dig in */
2728                 if (is_string) {
2729                         *ep = e;
2730                         goto String;
2731                 }
2732                 return 0;
2733         }
2734         /* struct or union can be initialized by compatible */
2735         if (class != TYPE_COMPOUND)
2736                 return 0;
2737         type = evaluate_expression(e);
2738         if (!type)
2739                 return 0;
2740         if (ctype->type == SYM_NODE)
2741                 ctype = ctype->ctype.base_type;
2742         if (type->type == SYM_NODE)
2743                 type = type->ctype.base_type;
2744         if (ctype == type)
2745                 return 1;
2746         return 0;
2747 
2748 String:
2749         p = alloc_expression(e->pos, EXPR_STRING);
2750         *p = *e;
2751         type = evaluate_expression(p);
2752         if (ctype->bit_size != -1) {
2753                 if (ctype->bit_size + bits_in_char < type->bit_size)
2754                         warning(e->pos,
2755                                 "too long initializer-string for array of char");
2756                 else if (Winit_cstring && ctype->bit_size + bits_in_char == type->bit_size) {
2757                         warning(e->pos,
2758                                 "too long initializer-string for array of char(no space for nul char)");
2759                 }
2760         }
2761         *ep = p;
2762         return 1;
2763 }
2764 
2765 static void evaluate_initializer(struct symbol *ctype, struct expression **ep)
2766 {
2767         struct symbol *type;
2768         int class = classify_type(ctype, &type);
2769         if (!handle_initializer(ep, 0, class, ctype, 0))
2770                 expression_error(*ep, "invalid initializer");
2771 }
2772 
2773 static struct symbol *cast_to_bool(struct expression *expr)
2774 {
2775         struct expression *old = expr->cast_expression;
2776         struct expression *zero;
2777         struct symbol *otype;
2778         int oclass = classify_type(degenerate(old), &otype);
2779         struct symbol *ctype;
2780 
2781         if (oclass & TYPE_COMPOUND)
2782                 return NULL;
2783 
2784         zero = alloc_const_expression(expr->pos, 0);
2785         expr->op = SPECIAL_NOTEQUAL;
2786         ctype = usual_conversions(expr->op, old, zero,
2787                         oclass, TYPE_NUM, otype, zero->ctype);
2788         expr->type = EXPR_COMPARE;
2789         expr->left = cast_to(old, ctype);
2790         expr->right = cast_to(zero, ctype);
2791 
2792         return expr->ctype;
2793 }
2794 
2795 static int cast_flags(struct expression *expr, struct expression *old)
2796 {
2797         struct symbol *t;
2798         int class;
2799         int flags = CEF_NONE;
2800 
2801         class = classify_type(expr->ctype, &t);
2802         if (class & TYPE_NUM) {
2803                 flags = old->flags & ~CEF_CONST_MASK;
2804                 /*
2805                  * Casts to numeric types never result in address
2806                  * constants [6.6(9)].
2807                  */
2808                 flags &= ~CEF_ADDR;
2809 
2810                 /*
2811                  * As an extension, treat address constants cast to
2812                  * integer type as an arithmetic constant.
2813                  */
2814                 if (old->flags & CEF_ADDR)
2815                         flags = CEF_ACE;
2816 
2817                 /*
2818                  * Cast to float type -> not an integer constant
2819                  * expression [6.6(6)].
2820                  */
2821                 if (class & TYPE_FLOAT)
2822                         flags &= ~CEF_CLR_ICE;
2823                 /*
2824                  * Casts of float literals to integer type results in
2825                  * a constant integer expression [6.6(6)].
2826                  */
2827                 else if (old->flags & CEF_FLOAT)
2828                         flags = CEF_SET_ICE;
2829         } else if (class & TYPE_PTR) {
2830                 /*
2831                  * Casts of integer literals to pointer type yield
2832                  * address constants [6.6(9)].
2833                  *
2834                  * As an extension, treat address constants cast to a
2835                  * different pointer type as address constants again.
2836                  *
2837                  * As another extension, treat integer constant
2838                  * expressions (in contrast to literals) cast to
2839                  * pointer type as address constants.
2840                  */
2841                 if (old->flags & (CEF_ICE | CEF_ADDR))
2842                         flags = CEF_ADDR;
2843         }
2844 
2845         return flags;
2846 }
2847 
2848 static struct symbol *evaluate_cast(struct expression *expr)
2849 {
2850         struct expression *target = expr->cast_expression;
2851         struct symbol *ctype;
2852         struct symbol *t1, *t2;
2853         int class1, class2;
2854         int as1 = 0, as2 = 0;
2855 
2856         if (!target)
2857                 return NULL;
2858 
2859         /*
2860          * Special case: a cast can be followed by an
2861          * initializer, in which case we need to pass
2862          * the type value down to that initializer rather
2863          * than trying to evaluate it as an expression
2864          *
2865          * A more complex case is when the initializer is
2866          * dereferenced as part of a post-fix expression.
2867          * We need to produce an expression that can be dereferenced.
2868          */
2869         if (target->type == EXPR_INITIALIZER) {
2870                 struct symbol *sym = expr->cast_type;
2871                 struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
2872 
2873                 sym->initializer = target;
2874                 evaluate_symbol(sym);
2875 
2876                 addr->ctype = &lazy_ptr_ctype;   /* Lazy eval */
2877                 addr->symbol = sym;
2878                 if (sym->ctype.modifiers & MOD_TOPLEVEL)
2879                         addr->flags |= CEF_ADDR;
2880 
2881                 expr->type = EXPR_PREOP;
2882                 expr->op = '*';
2883                 expr->unop = addr;
2884                 expr->ctype = sym;
2885 
2886                 return sym;
2887         }
2888 
2889         ctype = examine_symbol_type(expr->cast_type);
2890         expr->ctype = ctype;
2891         expr->cast_type = ctype;
2892 
2893         evaluate_expression(target);
2894         degenerate(target);
2895 
2896         class1 = classify_type(ctype, &t1);
2897 
2898         expr->flags = cast_flags(expr, target);
2899 
2900         /*
2901          * You can always throw a value away by casting to
2902          * "void" - that's an implicit "force". Note that
2903          * the same is _not_ true of "void *".
2904          */
2905         if (t1 == &void_ctype)
2906                 goto out;
2907 
2908         if (class1 & (TYPE_COMPOUND | TYPE_FN))
2909                 warning(expr->pos, "cast to non-scalar");
2910 
2911         t2 = target->ctype;
2912         if (!t2) {
2913                 expression_error(expr, "cast from unknown type");
2914                 goto out;
2915         }
2916         class2 = classify_type(t2, &t2);
2917 
2918         if (class2 & TYPE_COMPOUND)
2919                 warning(expr->pos, "cast from non-scalar");
2920 
2921         if (expr->type == EXPR_FORCE_CAST)
2922                 goto out;
2923 
2924         /* allowed cast unfouls */
2925         if (class2 & TYPE_FOULED)
2926                 t2 = unfoul(t2);
2927 
2928         if (t1 != t2) {
2929                 if ((class1 & TYPE_RESTRICT) && restricted_value(target, t1))
2930                         warning(expr->pos, "cast to %s",
2931                                 show_typename(t1));
2932                 if (class2 & TYPE_RESTRICT) {
2933                         if (t1 == &bool_ctype) {
2934                                 if (class2 & TYPE_FOULED)
2935                                         warning(expr->pos, "%s degrades to integer",
2936                                                 show_typename(t2));
2937                         } else {
2938                                 warning(expr->pos, "cast from %s",
2939                                         show_typename(t2));
2940                         }
2941                 }
2942         }
2943 
2944         if (t1 == &ulong_ctype)
2945                 as1 = -1;
2946         else if (class1 == TYPE_PTR) {
2947                 examine_pointer_target(t1);
2948                 as1 = t1->ctype.as;
2949         }
2950 
2951         if (t2 == &ulong_ctype)
2952                 as2 = -1;
2953         else if (class2 == TYPE_PTR) {
2954                 examine_pointer_target(t2);
2955                 as2 = t2->ctype.as;
2956         }
2957 
2958         if (!as1 && as2 > 0)
2959                 warning(expr->pos, "cast removes address space of expression");
2960         if (as1 > 0 && as2 > 0 && as1 != as2)
2961                 warning(expr->pos, "cast between address spaces (<asn:%d>-><asn:%d>)", as2, as1);
2962         if (as1 > 0 && !as2 &&
2963             !is_null_pointer_constant(target) && Wcast_to_as)
2964                 warning(expr->pos,
2965                         "cast adds address space to expression (<asn:%d>)", as1);
2966 
2967         if (!(t1->ctype.modifiers & MOD_PTRINHERIT) && class1 == TYPE_PTR &&
2968             !as1 && (target->flags & CEF_ICE)) {
2969                 if (t1->ctype.base_type == &void_ctype) {
2970                         if (is_zero_constant(target)) {
2971                                 /* NULL */
2972                                 expr->type = EXPR_VALUE;
2973                                 expr->ctype = &null_ctype;
2974                                 expr->value = 0;
2975                                 return expr->ctype;
2976                         }
2977                 }
2978         }
2979 
2980         if (t1 == &bool_ctype)
2981                 cast_to_bool(expr);
2982 
2983 out:
2984         return ctype;
2985 }
2986 
2987 /*
2988  * Evaluate a call expression with a symbol. This
2989  * should expand inline functions, and evaluate
2990  * builtins.
2991  */
2992 static int evaluate_symbol_call(struct expression *expr)
2993 {
2994         struct expression *fn = expr->fn;
2995         struct symbol *ctype = fn->ctype;
2996 
2997         if (fn->type != EXPR_PREOP)
2998                 return 0;
2999 
3000         if (ctype->op && ctype->op->evaluate)
3001                 return ctype->op->evaluate(expr);
3002 
3003         if (ctype->ctype.modifiers & MOD_INLINE) {
3004                 int ret;
3005                 struct symbol *curr = current_fn;
3006 
3007                 if (ctype->definition)
3008                         ctype = ctype->definition;
3009 
3010                 current_fn = ctype->ctype.base_type;
3011 
3012                 ret = inline_function(expr, ctype);
3013 
3014                 /* restore the old function */
3015                 current_fn = curr;
3016                 return ret;
3017         }
3018 
3019         return 0;
3020 }
3021 
3022 static struct symbol *evaluate_call(struct expression *expr)
3023 {
3024         int args, fnargs;
3025         struct symbol *ctype, *sym;
3026         struct expression *fn = expr->fn;
3027         struct expression_list *arglist = expr->args;
3028 
3029         if (!evaluate_expression(fn))
3030                 return NULL;
3031         sym = ctype = fn->ctype;
3032         if (ctype->type == SYM_NODE)
3033                 ctype = ctype->ctype.base_type;
3034         if (ctype->type == SYM_PTR)
3035                 ctype = get_base_type(ctype);
3036 
3037         if (ctype->type != SYM_FN) {
3038                 struct expression *arg;
3039                 expression_error(expr, "not a function %s",
3040                              show_ident(sym->ident));
3041                 /* do typechecking in arguments */
3042                 FOR_EACH_PTR (arglist, arg) {
3043                         evaluate_expression(arg);
3044                 } END_FOR_EACH_PTR(arg);
3045                 return NULL;
3046         }
3047 
3048         examine_fn_arguments(ctype);
3049         if (sym->type == SYM_NODE && fn->type == EXPR_PREOP &&
3050             sym->op && sym->op->args) {
3051                 if (!sym->op->args(expr))
3052                         return NULL;
3053         } else {
3054                 if (!evaluate_arguments(ctype, arglist))
3055                         return NULL;
3056                 args = expression_list_size(expr->args);
3057                 fnargs = symbol_list_size(ctype->arguments);
3058                 if (args < fnargs) {
3059                         expression_error(expr,
3060                                      "not enough arguments for function %s",
3061                                      show_ident(sym->ident));
3062                         return NULL;
3063                 }
3064                 if (args > fnargs && !ctype->variadic)
3065                         expression_error(expr,
3066                                      "too many arguments for function %s",
3067                                      show_ident(sym->ident));
3068         }
3069         expr->ctype = ctype->ctype.base_type;
3070         if (sym->type == SYM_NODE) {
3071                 if (evaluate_symbol_call(expr))
3072                         return expr->ctype;
3073         }
3074         return expr->ctype;
3075 }
3076 
3077 static struct symbol *evaluate_offsetof(struct expression *expr)
3078 {
3079         struct expression *e = expr->down;
3080         struct symbol *ctype = expr->in;
3081         int class;
3082 
3083         if (expr->op == '.') {
3084                 struct symbol *field;
3085                 int offset = 0;
3086                 if (!ctype) {
3087                         expression_error(expr, "expected structure or union");
3088                         return NULL;
3089                 }
3090                 examine_symbol_type(ctype);
3091                 class = classify_type(ctype, &ctype);
3092                 if (class != TYPE_COMPOUND) {
3093                         expression_error(expr, "expected structure or union");
3094                         return NULL;
3095                 }
3096 
3097                 field = find_identifier(expr->ident, ctype->symbol_list, &offset);
3098                 if (!field) {
3099                         expression_error(expr, "unknown member");
3100                         return NULL;
3101                 }
3102                 ctype = field;
3103                 expr->type = EXPR_VALUE;
3104                 expr->flags = CEF_SET_ICE;
3105                 expr->value = offset;
3106                 expr->taint = 0;
3107                 expr->ctype = size_t_ctype;
3108         } else {
3109                 if (!ctype) {
3110                         expression_error(expr, "expected structure or union");
3111                         return NULL;
3112                 }
3113                 examine_symbol_type(ctype);
3114                 class = classify_type(ctype, &ctype);
3115                 if (class != (TYPE_COMPOUND | TYPE_PTR)) {
3116                         expression_error(expr, "expected array");
3117                         return NULL;
3118                 }
3119                 ctype = ctype->ctype.base_type;
3120                 if (!expr->index) {
3121                         expr->type = EXPR_VALUE;
3122                         expr->flags = CEF_SET_ICE;
3123                         expr->value = 0;
3124                         expr->taint = 0;
3125                         expr->ctype = size_t_ctype;
3126                 } else {
3127                         struct expression *idx = expr->index, *m;
3128                         struct symbol *i_type = evaluate_expression(idx);
3129                         unsigned old_idx_flags;
3130                         int i_class = classify_type(i_type, &i_type);
3131 
3132                         if (!is_int(i_class)) {
3133                                 expression_error(expr, "non-integer index");
3134                                 return NULL;
3135                         }
3136                         unrestrict(idx, i_class, &i_type);
3137                         old_idx_flags = idx->flags;
3138                         idx = cast_to(idx, size_t_ctype);
3139                         idx->flags = old_idx_flags;
3140                         m = alloc_const_expression(expr->pos,
3141                                                    bits_to_bytes(ctype->bit_size));
3142                         m->ctype = size_t_ctype;
3143                         m->flags = CEF_SET_INT;
3144                         expr->type = EXPR_BINOP;
3145                         expr->left = idx;
3146                         expr->right = m;
3147                         expr->op = '*';
3148                         expr->ctype = size_t_ctype;
3149                         expr->flags = m->flags & idx->flags & ~CEF_CONST_MASK;
3150                 }
3151         }
3152         if (e) {
3153                 struct expression *copy = __alloc_expression(0);
3154                 *copy = *expr;
3155                 if (e->type == EXPR_OFFSETOF)
3156                         e->in = ctype;
3157                 if (!evaluate_expression(e))
3158                         return NULL;
3159                 expr->type = EXPR_BINOP;
3160                 expr->flags = e->flags & copy->flags & ~CEF_CONST_MASK;
3161                 expr->op = '+';
3162                 expr->ctype = size_t_ctype;
3163                 expr->left = copy;
3164                 expr->right = e;
3165         }
3166         return size_t_ctype;
3167 }
3168 
3169 struct symbol *evaluate_expression(struct expression *expr)
3170 {
3171         if (!expr)
3172                 return NULL;
3173         if (expr->ctype)
3174                 return expr->ctype;
3175 
3176         switch (expr->type) {
3177         case EXPR_VALUE:
3178         case EXPR_FVALUE:
3179                 expression_error(expr, "value expression without a type");
3180                 return NULL;
3181         case EXPR_STRING:
3182                 return evaluate_string(expr);
3183         case EXPR_SYMBOL:
3184                 return evaluate_symbol_expression(expr);
3185         case EXPR_BINOP:
3186                 if (!evaluate_expression(expr->left))
3187                         return NULL;
3188                 if (!evaluate_expression(expr->right))
3189                         return NULL;
3190                 return evaluate_binop(expr);
3191         case EXPR_LOGICAL:
3192                 return evaluate_logical(expr);
3193         case EXPR_COMMA:
3194                 evaluate_expression(expr->left);
3195                 if (!evaluate_expression(expr->right))
3196                         return NULL;
3197                 return evaluate_comma(expr);
3198         case EXPR_COMPARE:
3199                 if (!evaluate_expression(expr->left))
3200                         return NULL;
3201                 if (!evaluate_expression(expr->right))
3202                         return NULL;
3203                 return evaluate_compare(expr);
3204         case EXPR_ASSIGNMENT:
3205                 if (!evaluate_expression(expr->left))
3206                         return NULL;
3207                 if (!evaluate_expression(expr->right))
3208                         return NULL;
3209                 return evaluate_assignment(expr);
3210         case EXPR_PREOP:
3211                 if (!evaluate_expression(expr->unop))
3212                         return NULL;
3213                 return evaluate_preop(expr);
3214         case EXPR_POSTOP:
3215                 if (!evaluate_expression(expr->unop))
3216                         return NULL;
3217                 return evaluate_postop(expr);
3218         case EXPR_CAST:
3219         case EXPR_FORCE_CAST:
3220         case EXPR_IMPLIED_CAST:
3221                 return evaluate_cast(expr);
3222         case EXPR_SIZEOF:
3223                 return evaluate_sizeof(expr);
3224         case EXPR_PTRSIZEOF:
3225                 return evaluate_ptrsizeof(expr);
3226         case EXPR_ALIGNOF:
3227                 return evaluate_alignof(expr);
3228         case EXPR_DEREF:
3229                 return evaluate_member_dereference(expr);
3230         case EXPR_CALL:
3231                 return evaluate_call(expr);
3232         case EXPR_SELECT:
3233         case EXPR_CONDITIONAL:
3234                 return evaluate_conditional_expression(expr);
3235         case EXPR_STATEMENT:
3236                 expr->ctype = evaluate_statement(expr->statement);
3237                 return expr->ctype;
3238 
3239         case EXPR_LABEL:
3240                 expr->ctype = &ptr_ctype;
3241                 return &ptr_ctype;
3242 
3243         case EXPR_TYPE:
3244                 /* Evaluate the type of the symbol .. */
3245                 evaluate_symbol(expr->symbol);
3246                 /* .. but the type of the _expression_ is a "type" */
3247                 expr->ctype = &type_ctype;
3248                 return &type_ctype;
3249 
3250         case EXPR_OFFSETOF:
3251                 return evaluate_offsetof(expr);
3252 
3253         /* These can not exist as stand-alone expressions */
3254         case EXPR_INITIALIZER:
3255         case EXPR_IDENTIFIER:
3256         case EXPR_INDEX:
3257         case EXPR_POS:
3258                 expression_error(expr, "internal front-end error: initializer in expression");
3259                 return NULL;
3260         case EXPR_SLICE:
3261                 expression_error(expr, "internal front-end error: SLICE re-evaluated");
3262                 return NULL;
3263         }
3264         return NULL;
3265 }
3266 
3267 static void check_duplicates(struct symbol *sym)
3268 {
3269         int declared = 0;
3270         struct symbol *next = sym;
3271         int initialized = sym->initializer != NULL;
3272 
3273         while ((next = next->same_symbol) != NULL) {
3274                 const char *typediff;
3275                 evaluate_symbol(next);
3276                 if (initialized && next->initializer) {
3277                         sparse_error(sym->pos, "symbol '%s' has multiple initializers (originally initialized at %s:%d)",
3278                                 show_ident(sym->ident),
3279                                 stream_name(next->pos.stream), next->pos.line);
3280                         /* Only warn once */
3281                         initialized = 0;
3282                 }
3283                 declared++;
3284                 typediff = type_difference(&sym->ctype, &next->ctype, 0, 0);
3285                 if (typediff) {
3286                         sparse_error(sym->pos, "symbol '%s' redeclared with different type (originally declared at %s:%d) - %s",
3287                                 show_ident(sym->ident),
3288                                 stream_name(next->pos.stream), next->pos.line, typediff);
3289                         return;
3290                 }
3291         }
3292         if (!declared) {
3293                 unsigned long mod = sym->ctype.modifiers;
3294                 if (mod & (MOD_STATIC | MOD_REGISTER))
3295                         return;
3296                 if (!(mod & MOD_TOPLEVEL))
3297                         return;
3298                 if (!Wdecl)
3299                         return;
3300                 if (sym->ident == &main_ident)
3301                         return;
3302                 warning(sym->pos, "symbol '%s' was not declared. Should it be static?", show_ident(sym->ident));
3303         }
3304 }
3305 
3306 static struct symbol *evaluate_symbol(struct symbol *sym)
3307 {
3308         struct symbol *base_type;
3309 
3310         if (!sym)
3311                 return sym;
3312         if (sym->evaluated)
3313                 return sym;
3314         sym->evaluated = 1;
3315 
3316         sym = examine_symbol_type(sym);
3317         base_type = get_base_type(sym);
3318         if (!base_type)
3319                 return NULL;
3320 
3321         /* Evaluate the initializers */
3322         if (sym->initializer)
3323                 evaluate_initializer(sym, &sym->initializer);
3324 
3325         /* And finally, evaluate the body of the symbol too */
3326         if (base_type->type == SYM_FN) {
3327                 struct symbol *curr = current_fn;
3328 
3329                 if (sym->definition && sym->definition != sym)
3330                         return evaluate_symbol(sym->definition);
3331 
3332                 current_fn = base_type;
3333 
3334                 examine_fn_arguments(base_type);
3335                 if (!base_type->stmt && base_type->inline_stmt)
3336                         uninline(sym);
3337                 if (base_type->stmt)
3338                         evaluate_statement(base_type->stmt);
3339 
3340                 current_fn = curr;
3341         }
3342 
3343         return base_type;
3344 }
3345 
3346 void evaluate_symbol_list(struct symbol_list *list)
3347 {
3348         struct symbol *sym;
3349 
3350         FOR_EACH_PTR(list, sym) {
3351                 has_error &= ~ERROR_CURR_PHASE;
3352                 evaluate_symbol(sym);
3353                 check_duplicates(sym);
3354         } END_FOR_EACH_PTR(sym);
3355 }
3356 
3357 static struct symbol *evaluate_return_expression(struct statement *stmt)
3358 {
3359         struct expression *expr = stmt->expression;
3360         struct symbol *fntype;
3361 
3362         evaluate_expression(expr);
3363         fntype = current_fn->ctype.base_type;
3364         if (!fntype || fntype == &void_ctype) {
3365                 if (expr && expr->ctype != &void_ctype)
3366                         expression_error(expr, "return expression in %s function", fntype?"void":"typeless");
3367                 if (expr && Wreturn_void)
3368                         warning(stmt->pos, "returning void-valued expression");
3369                 return NULL;
3370         }
3371 
3372         if (!expr) {
3373                 sparse_error(stmt->pos, "return with no return value");
3374                 return NULL;
3375         }
3376         if (!expr->ctype)
3377                 return NULL;
3378         compatible_assignment_types(expr, fntype, &stmt->expression, "return expression");
3379         return NULL;
3380 }
3381 
3382 static void evaluate_if_statement(struct statement *stmt)
3383 {
3384         if (!stmt->if_conditional)
3385                 return;
3386 
3387         evaluate_conditional(stmt->if_conditional, 0);
3388         evaluate_statement(stmt->if_true);
3389         evaluate_statement(stmt->if_false);
3390 }
3391 
3392 static void evaluate_iterator(struct statement *stmt)
3393 {
3394         evaluate_symbol_list(stmt->iterator_syms);
3395         evaluate_conditional(stmt->iterator_pre_condition, 1);
3396         evaluate_conditional(stmt->iterator_post_condition,1);
3397         evaluate_statement(stmt->iterator_pre_statement);
3398         evaluate_statement(stmt->iterator_statement);
3399         evaluate_statement(stmt->iterator_post_statement);
3400 }
3401 
3402 static void verify_output_constraint(struct expression *expr, const char *constraint)
3403 {
3404         switch (*constraint) {
3405         case '=':       /* Assignment */
3406         case '+':       /* Update */
3407                 break;
3408         default:
3409                 expression_error(expr, "output constraint is not an assignment constraint (\"%s\")", constraint);
3410         }
3411 }
3412 
3413 static void verify_input_constraint(struct expression *expr, const char *constraint)
3414 {
3415         switch (*constraint) {
3416         case '=':       /* Assignment */
3417         case '+':       /* Update */
3418                 expression_error(expr, "input constraint with assignment (\"%s\")", constraint);
3419         }
3420 }
3421 
3422 static void evaluate_asm_statement(struct statement *stmt)
3423 {
3424         struct expression *expr;
3425         struct symbol *sym;
3426         int state;
3427 
3428         expr = stmt->asm_string;
3429         if (!expr || expr->type != EXPR_STRING) {
3430                 sparse_error(stmt->pos, "need constant string for inline asm");
3431                 return;
3432         }
3433 
3434         state = 0;
3435         FOR_EACH_PTR(stmt->asm_outputs, expr) {
3436                 switch (state) {
3437                 case 0: /* Identifier */
3438                         state = 1;
3439                         continue;
3440 
3441                 case 1: /* Constraint */
3442                         state = 2;
3443                         if (!expr || expr->type != EXPR_STRING) {
3444                                 sparse_error(expr ? expr->pos : stmt->pos, "asm output constraint is not a string");
3445                                 *THIS_ADDRESS(expr) = NULL;
3446                                 continue;
3447                         }
3448                         verify_output_constraint(expr, expr->string->data);
3449                         continue;
3450 
3451                 case 2: /* Expression */
3452                         state = 0;
3453                         if (!evaluate_expression(expr))
3454                                 return;
3455                         if (!lvalue_expression(expr))
3456                                 warning(expr->pos, "asm output is not an lvalue");
3457                         evaluate_assign_to(expr, expr->ctype);
3458                         continue;
3459                 }
3460         } END_FOR_EACH_PTR(expr);
3461 
3462         state = 0;
3463         FOR_EACH_PTR(stmt->asm_inputs, expr) {
3464                 switch (state) {
3465                 case 0: /* Identifier */
3466                         state = 1;
3467                         continue;
3468 
3469                 case 1: /* Constraint */
3470                         state = 2;
3471                         if (!expr || expr->type != EXPR_STRING) {
3472                                 sparse_error(expr ? expr->pos : stmt->pos, "asm input constraint is not a string");
3473                                 *THIS_ADDRESS(expr) = NULL;
3474                                 continue;
3475                         }
3476                         verify_input_constraint(expr, expr->string->data);
3477                         continue;
3478 
3479                 case 2: /* Expression */
3480                         state = 0;
3481                         if (!evaluate_expression(expr))
3482                                 return;
3483                         continue;
3484                 }
3485         } END_FOR_EACH_PTR(expr);
3486 
3487         FOR_EACH_PTR(stmt->asm_clobbers, expr) {
3488                 if (!expr) {
3489                         sparse_error(stmt->pos, "bad asm clobbers");
3490                         return;
3491                 }
3492                 if (expr->type == EXPR_STRING)
3493                         continue;
3494                 expression_error(expr, "asm clobber is not a string");
3495         } END_FOR_EACH_PTR(expr);
3496 
3497         FOR_EACH_PTR(stmt->asm_labels, sym) {
3498                 if (!sym || sym->type != SYM_LABEL) {
3499                         sparse_error(stmt->pos, "bad asm label");
3500                         return;
3501                 }
3502         } END_FOR_EACH_PTR(sym);
3503 }
3504 
3505 static void evaluate_case_statement(struct statement *stmt)
3506 {
3507         evaluate_expression(stmt->case_expression);
3508         evaluate_expression(stmt->case_to);
3509         evaluate_statement(stmt->case_statement);
3510 }
3511 
3512 static void check_case_type(struct expression *switch_expr,
3513                             struct expression *case_expr,
3514                             struct expression **enumcase)
3515 {
3516         struct symbol *switch_type, *case_type;
3517         int sclass, cclass;
3518 
3519         if (!case_expr)
3520                 return;
3521 
3522         switch_type = switch_expr->ctype;
3523         case_type = evaluate_expression(case_expr);
3524 
3525         if (!switch_type || !case_type)
3526                 goto Bad;
3527         if (enumcase) {
3528                 if (*enumcase)
3529                         warn_for_different_enum_types(case_expr->pos, case_type, (*enumcase)->ctype);
3530                 else if (is_enum_type(case_type))
3531                         *enumcase = case_expr;
3532         }
3533 
3534         sclass = classify_type(switch_type, &switch_type);
3535         cclass = classify_type(case_type, &case_type);
3536 
3537         /* both should be arithmetic */
3538         if (!(sclass & cclass & TYPE_NUM))
3539                 goto Bad;
3540 
3541         /* neither should be floating */
3542         if ((sclass | cclass) & TYPE_FLOAT)
3543                 goto Bad;
3544 
3545         /* if neither is restricted, we are OK */
3546         if (!((sclass | cclass) & TYPE_RESTRICT))
3547                 return;
3548 
3549         if (!restricted_binop_type(SPECIAL_EQUAL, case_expr, switch_expr,
3550                                    cclass, sclass, case_type, switch_type)) {
3551                 unrestrict(case_expr, cclass, &case_type);
3552                 unrestrict(switch_expr, sclass, &switch_type);
3553         }
3554         return;
3555 
3556 Bad:
3557         expression_error(case_expr, "incompatible types for 'case' statement");
3558 }
3559 
3560 static void evaluate_switch_statement(struct statement *stmt)
3561 {
3562         struct symbol *sym;
3563         struct expression *enumcase = NULL;
3564         struct expression **enumcase_holder = &enumcase;
3565         struct expression *sel = stmt->switch_expression;
3566 
3567         evaluate_expression(sel);
3568         evaluate_statement(stmt->switch_statement);
3569         if (!sel)
3570                 return;
3571         if (sel->ctype && is_enum_type(sel->ctype))
3572                 enumcase_holder = NULL; /* Only check cases against switch */
3573 
3574         FOR_EACH_PTR(stmt->switch_case->symbol_list, sym) {
3575                 struct statement *case_stmt = sym->stmt;
3576                 check_case_type(sel, case_stmt->case_expression, enumcase_holder);
3577                 check_case_type(sel, case_stmt->case_to, enumcase_holder);
3578         } END_FOR_EACH_PTR(sym);
3579 }
3580 
3581 static void evaluate_goto_statement(struct statement *stmt)
3582 {
3583         struct symbol *label = stmt->goto_label;
3584 
3585         if (label && !label->stmt && !lookup_keyword(label->ident, NS_KEYWORD))
3586                 sparse_error(stmt->pos, "label '%s' was not declared", show_ident(label->ident));
3587 
3588         evaluate_expression(stmt->goto_expression);
3589 }
3590 
3591 struct symbol *evaluate_statement(struct statement *stmt)
3592 {
3593         if (!stmt)
3594                 return NULL;
3595 
3596         switch (stmt->type) {
3597         case STMT_DECLARATION: {
3598                 struct symbol *s;
3599                 FOR_EACH_PTR(stmt->declaration, s) {
3600                         evaluate_symbol(s);
3601                 } END_FOR_EACH_PTR(s);
3602                 return NULL;
3603         }
3604 
3605         case STMT_RETURN:
3606                 return evaluate_return_expression(stmt);
3607 
3608         case STMT_EXPRESSION:
3609                 if (!evaluate_expression(stmt->expression))
3610                         return NULL;
3611                 if (stmt->expression->ctype == &null_ctype)
3612                         stmt->expression = cast_to(stmt->expression, &ptr_ctype);
3613                 return degenerate(stmt->expression);
3614 
3615         case STMT_COMPOUND: {
3616                 struct statement *s;
3617                 struct symbol *type = NULL;
3618 
3619                 /* Evaluate the return symbol in the compound statement */
3620                 evaluate_symbol(stmt->ret);
3621 
3622                 /*
3623                  * Then, evaluate each statement, making the type of the
3624                  * compound statement be the type of the last statement
3625                  */
3626                 type = evaluate_statement(stmt->args);
3627                 FOR_EACH_PTR(stmt->stmts, s) {
3628                         type = evaluate_statement(s);
3629                 } END_FOR_EACH_PTR(s);
3630                 if (!type)
3631                         type = &void_ctype;
3632                 return type;
3633         }
3634         case STMT_IF:
3635                 evaluate_if_statement(stmt);
3636                 return NULL;
3637         case STMT_ITERATOR:
3638                 evaluate_iterator(stmt);
3639                 return NULL;
3640         case STMT_SWITCH:
3641                 evaluate_switch_statement(stmt);
3642                 return NULL;
3643         case STMT_CASE:
3644                 evaluate_case_statement(stmt);
3645                 return NULL;
3646         case STMT_LABEL:
3647                 return evaluate_statement(stmt->label_statement);
3648         case STMT_GOTO:
3649                 evaluate_goto_statement(stmt);
3650                 return NULL;
3651         case STMT_NONE:
3652                 break;
3653         case STMT_ASM:
3654                 evaluate_asm_statement(stmt);
3655                 return NULL;
3656         case STMT_CONTEXT:
3657                 evaluate_expression(stmt->expression);
3658                 return NULL;
3659         case STMT_RANGE:
3660                 evaluate_expression(stmt->range_expression);
3661                 evaluate_expression(stmt->range_low);
3662                 evaluate_expression(stmt->range_high);
3663                 return NULL;
3664         }
3665         return NULL;
3666 }