1 /*
   2  * sparse/evaluate.c
   3  *
   4  * Copyright (C) 2003 Transmeta Corp.
   5  *               2003-2004 Linus Torvalds
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  *
  25  * Evaluate constant expressions.
  26  */
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29 #include <stddef.h>
  30 #include <stdio.h>
  31 #include <string.h>
  32 #include <ctype.h>
  33 #include <unistd.h>
  34 #include <fcntl.h>
  35 #include <limits.h>
  36 
  37 #include "evaluate.h"
  38 #include "lib.h"
  39 #include "allocate.h"
  40 #include "parse.h"
  41 #include "token.h"
  42 #include "symbol.h"
  43 #include "target.h"
  44 #include "expression.h"
  45 
  46 struct symbol *current_fn;
  47 
  48 struct ident bad_address_space = { .len = 6, .name = "bad AS", };
  49 
  50 static struct symbol *degenerate(struct expression *expr);
  51 static struct symbol *evaluate_symbol(struct symbol *sym);
  52 
  53 static inline int valid_expr_type(struct expression *expr)
  54 {
  55         return expr && valid_type(expr->ctype);
  56 }
  57 
  58 static inline int valid_subexpr_type(struct expression *expr)
  59 {
  60         return valid_expr_type(expr->left)
  61             && valid_expr_type(expr->right);
  62 }
  63 
  64 static struct symbol *evaluate_symbol_expression(struct expression *expr)
  65 {
  66         struct expression *addr;
  67         struct symbol *sym = expr->symbol;
  68         struct symbol *base_type;
  69 
  70         if (!sym) {
  71                 expression_error(expr, "undefined identifier '%s'", show_ident(expr->symbol_name));
  72                 return NULL;
  73         }
  74 
  75         examine_symbol_type(sym);
  76 
  77         base_type = get_base_type(sym);
  78         if (!base_type) {
  79                 expression_error(expr, "identifier '%s' has no type", show_ident(expr->symbol_name));
  80                 return NULL;
  81         }
  82 
  83         addr = alloc_expression(expr->pos, EXPR_SYMBOL);
  84         addr->symbol = sym;
  85         addr->symbol_name = expr->symbol_name;
  86         addr->ctype = &lazy_ptr_ctype;   /* Lazy evaluation: we need to do a proper job if somebody does &sym */
  87         addr->flags = expr->flags;
  88         expr->type = EXPR_PREOP;
  89         expr->op = '*';
  90         expr->unop = addr;
  91         expr->flags = CEF_NONE;
  92 
  93         /* The type of a symbol is the symbol itself! */
  94         expr->ctype = sym;
  95         return sym;
  96 }
  97 
  98 static struct symbol *evaluate_string(struct expression *expr)
  99 {
 100         struct symbol *sym = alloc_symbol(expr->pos, SYM_NODE);
 101         struct symbol *array = alloc_symbol(expr->pos, SYM_ARRAY);
 102         struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
 103         struct expression *initstr = alloc_expression(expr->pos, EXPR_STRING);
 104         unsigned int length = expr->string->length;
 105 
 106         sym->array_size = alloc_const_expression(expr->pos, length);
 107         sym->bit_size = bytes_to_bits(length);
 108         sym->ctype.alignment = 1;
 109         sym->string = 1;
 110         sym->ctype.modifiers = MOD_STATIC;
 111         sym->ctype.base_type = array;
 112         sym->initializer = initstr;
 113 
 114         initstr->ctype = sym;
 115         initstr->string = expr->string;
 116 
 117         array->array_size = sym->array_size;
 118         array->bit_size = bytes_to_bits(length);
 119         array->ctype.alignment = 1;
 120         array->ctype.modifiers = MOD_STATIC;
 121         array->ctype.base_type = &char_ctype;
 122         
 123         addr->symbol = sym;
 124         addr->ctype = &lazy_ptr_ctype;
 125         addr->flags = CEF_ADDR;
 126 
 127         expr->type = EXPR_PREOP;
 128         expr->op = '*';
 129         expr->unop = addr;  
 130         expr->ctype = sym;
 131         return sym;
 132 }
 133 
 134 /* type has come from classify_type and is an integer type */
 135 static inline struct symbol *integer_promotion(struct symbol *type)
 136 {
 137         unsigned long mod =  type->ctype.modifiers;
 138         int width = type->bit_size;
 139 
 140         /*
 141          * Bitfields always promote to the base type,
 142          * even if the bitfield might be bigger than
 143          * an "int".
 144          */
 145         if (type->type == SYM_BITFIELD) {
 146                 type = type->ctype.base_type;
 147         }
 148         mod = type->ctype.modifiers;
 149         if (width < bits_in_int)
 150                 return &int_ctype;
 151 
 152         /* If char/short has as many bits as int, it still gets "promoted" */
 153         if (mod & (MOD_CHAR | MOD_SHORT)) {
 154                 if (mod & MOD_UNSIGNED)
 155                         return &uint_ctype;
 156                 return &int_ctype;
 157         }
 158         return type;
 159 }
 160 
 161 /*
 162  * integer part of usual arithmetic conversions:
 163  *      integer promotions are applied
 164  *      if left and right are identical, we are done
 165  *      if signedness is the same, convert one with lower rank
 166  *      unless unsigned argument has rank lower than signed one, convert the
 167  *      signed one.
 168  *      if signed argument is bigger than unsigned one, convert the unsigned.
 169  *      otherwise, convert signed.
 170  *
 171  * Leaving aside the integer promotions, that is equivalent to
 172  *      if identical, don't convert
 173  *      if left is bigger than right, convert right
 174  *      if right is bigger than left, convert right
 175  *      otherwise, if signedness is the same, convert one with lower rank
 176  *      otherwise convert the signed one.
 177  */
 178 static struct symbol *bigger_int_type(struct symbol *left, struct symbol *right)
 179 {
 180         unsigned long lmod, rmod;
 181 
 182         left = integer_promotion(left);
 183         right = integer_promotion(right);
 184 
 185         if (left == right)
 186                 goto left;
 187 
 188         if (left->bit_size > right->bit_size)
 189                 goto left;
 190 
 191         if (right->bit_size > left->bit_size)
 192                 goto right;
 193 
 194         lmod = left->ctype.modifiers;
 195         rmod = right->ctype.modifiers;
 196         if ((lmod ^ rmod) & MOD_UNSIGNED) {
 197                 if (lmod & MOD_UNSIGNED)
 198                         goto left;
 199         } else if ((lmod & ~rmod) & (MOD_LONG_ALL))
 200                 goto left;
 201 right:
 202         left = right;
 203 left:
 204         return left;
 205 }
 206 
 207 static int same_cast_type(struct symbol *orig, struct symbol *new)
 208 {
 209         return orig->bit_size == new->bit_size &&
 210                orig->bit_offset == new->bit_offset;
 211 }
 212 
 213 static struct symbol *base_type(struct symbol *node, unsigned long *modp, struct ident **asp)
 214 {
 215         unsigned long mod = 0;
 216         struct ident *as = NULL;
 217 
 218         while (node) {
 219                 mod |= node->ctype.modifiers;
 220                 combine_address_space(node->pos, &as, node->ctype.as);
 221                 if (node->type == SYM_NODE) {
 222                         node = node->ctype.base_type;
 223                         continue;
 224                 }
 225                 break;
 226         }
 227         *modp = mod & ~MOD_IGNORE;
 228         *asp = as;
 229         return node;
 230 }
 231 
 232 static int is_same_type(struct expression *expr, struct symbol *new)
 233 {
 234         struct symbol *old = expr->ctype;
 235         unsigned long oldmod, newmod;
 236         struct ident *oldas, *newas;
 237 
 238         old = base_type(old, &oldmod, &oldas);
 239         new = base_type(new, &newmod, &newas);
 240 
 241         /* Same base type, same address space? */
 242         if (old == new && oldas == newas) {
 243                 unsigned long difmod;
 244 
 245                 /* Check the modifier bits. */
 246                 difmod = (oldmod ^ newmod) & ~MOD_NOCAST;
 247 
 248                 /* Exact same type? */
 249                 if (!difmod)
 250                         return 1;
 251 
 252                 /*
 253                  * Not the same type, but differs only in "const".
 254                  * Don't warn about MOD_NOCAST.
 255                  */
 256                 if (difmod == MOD_CONST)
 257                         return 0;
 258         }
 259         if ((oldmod | newmod) & MOD_NOCAST) {
 260                 const char *tofrom = "to/from";
 261                 if (!(newmod & MOD_NOCAST))
 262                         tofrom = "from";
 263                 if (!(oldmod & MOD_NOCAST))
 264                         tofrom = "to";
 265                 warning(expr->pos, "implicit cast %s nocast type", tofrom);
 266         }
 267         return 0;
 268 }
 269 
 270 static void
 271 warn_for_different_enum_types (struct position pos,
 272                                struct symbol *typea,
 273                                struct symbol *typeb)
 274 {
 275         if (!Wenum_mismatch)
 276                 return;
 277         if (typea->type == SYM_NODE)
 278                 typea = typea->ctype.base_type;
 279         if (typeb->type == SYM_NODE)
 280                 typeb = typeb->ctype.base_type;
 281 
 282         if (typea == typeb)
 283                 return;
 284 
 285         if (typea->type == SYM_ENUM && typeb->type == SYM_ENUM) {
 286                 warning(pos, "mixing different enum types");
 287                 info(pos, "    %s versus", show_typename(typea));
 288                 info(pos, "    %s", show_typename(typeb));
 289         }
 290 }
 291 
 292 static int cast_flags(struct expression *expr, struct expression *target);
 293 static struct symbol *cast_to_bool(struct expression *expr);
 294 
 295 /*
 296  * This gets called for implicit casts in assignments and
 297  * integer promotion. We often want to try to move the
 298  * cast down, because the ops involved may have been
 299  * implicitly cast up, and we can get rid of the casts
 300  * early.
 301  */
 302 static struct expression * cast_to(struct expression *old, struct symbol *type)
 303 {
 304         struct expression *expr;
 305 
 306         warn_for_different_enum_types (old->pos, old->ctype, type);
 307 
 308         if (old->ctype != &null_ctype && is_same_type(old, type))
 309                 return old;
 310 
 311         /*
 312          * See if we can simplify the op. Move the cast down.
 313          */
 314         switch (old->type) {
 315         case EXPR_PREOP:
 316                 if (old->ctype->bit_size < type->bit_size)
 317                         break;
 318                 if (old->op == '~') {
 319                         old->ctype = type;
 320                         old->unop = cast_to(old->unop, type);
 321                         return old;
 322                 }
 323                 break;
 324 
 325         case EXPR_IMPLIED_CAST:
 326                 warn_for_different_enum_types(old->pos, old->ctype, type);
 327 
 328                 if (old->ctype->bit_size >= type->bit_size) {
 329                         struct expression *orig = old->cast_expression;
 330                         if (same_cast_type(orig->ctype, type))
 331                                 return orig;
 332                         if (old->ctype->bit_offset == type->bit_offset) {
 333                                 old->ctype = type;
 334                                 old->cast_type = type;
 335                                 return old;
 336                         }
 337                 }
 338                 break;
 339 
 340         default:
 341                 /* nothing */;
 342         }
 343 
 344         expr = alloc_expression(old->pos, EXPR_IMPLIED_CAST);
 345         expr->ctype = type;
 346         expr->cast_type = type;
 347         expr->cast_expression = old;
 348         expr->flags = cast_flags(expr, old);
 349 
 350         if (is_bool_type(type))
 351                 cast_to_bool(expr);
 352 
 353         return expr;
 354 }
 355 
 356 enum {
 357         TYPE_NUM = 1,
 358         TYPE_BITFIELD = 2,
 359         TYPE_RESTRICT = 4,
 360         TYPE_FLOAT = 8,
 361         TYPE_PTR = 16,
 362         TYPE_COMPOUND = 32,
 363         TYPE_FOULED = 64,
 364         TYPE_FN = 128,
 365 };
 366 
 367 static inline int classify_type(struct symbol *type, struct symbol **base)
 368 {
 369         static int type_class[SYM_BAD + 1] = {
 370                 [SYM_PTR] = TYPE_PTR,
 371                 [SYM_FN] = TYPE_PTR | TYPE_FN,
 372                 [SYM_ARRAY] = TYPE_PTR | TYPE_COMPOUND,
 373                 [SYM_STRUCT] = TYPE_COMPOUND,
 374                 [SYM_UNION] = TYPE_COMPOUND,
 375                 [SYM_BITFIELD] = TYPE_NUM | TYPE_BITFIELD,
 376                 [SYM_RESTRICT] = TYPE_NUM | TYPE_RESTRICT,
 377                 [SYM_FOULED] = TYPE_NUM | TYPE_RESTRICT | TYPE_FOULED,
 378         };
 379         if (type->type == SYM_NODE)
 380                 type = type->ctype.base_type;
 381         if (type->type == SYM_TYPEOF) {
 382                 type = evaluate_expression(type->initializer);
 383                 if (!type)
 384                         type = &bad_ctype;
 385                 else if (type->type == SYM_NODE)
 386                         type = type->ctype.base_type;
 387         }
 388         if (type->type == SYM_ENUM)
 389                 type = type->ctype.base_type;
 390         *base = type;
 391         if (type->type == SYM_BASETYPE) {
 392                 if (type->ctype.base_type == &int_type)
 393                         return TYPE_NUM;
 394                 if (type->ctype.base_type == &fp_type)
 395                         return TYPE_NUM | TYPE_FLOAT;
 396         }
 397         return type_class[type->type];
 398 }
 399 
 400 #define is_int(class) ((class & (TYPE_NUM | TYPE_FLOAT)) == TYPE_NUM)
 401 
 402 static inline int is_string_type(struct symbol *type)
 403 {
 404         if (type->type == SYM_NODE)
 405                 type = type->ctype.base_type;
 406         return type->type == SYM_ARRAY && is_byte_type(type->ctype.base_type);
 407 }
 408 
 409 static struct symbol *bad_expr_type(struct expression *expr)
 410 {
 411         switch (expr->type) {
 412         case EXPR_BINOP:
 413         case EXPR_COMPARE:
 414                 if (!valid_subexpr_type(expr))
 415                         break;
 416                 sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
 417                 info(expr->pos, "   left side has type %s", show_typename(expr->left->ctype));
 418                 info(expr->pos, "   right side has type %s", show_typename(expr->right->ctype));
 419                 break;
 420         case EXPR_PREOP:
 421         case EXPR_POSTOP:
 422                 if (!valid_expr_type(expr->unop))
 423                         break;
 424                 sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
 425                 info(expr->pos, "   argument has type %s", show_typename(expr->unop->ctype));
 426                 break;
 427         default:
 428                 break;
 429         }
 430 
 431         expr->flags = CEF_NONE;
 432         return expr->ctype = &bad_ctype;
 433 }
 434 
 435 static int restricted_value(struct expression *v, struct symbol *type)
 436 {
 437         if (v->type != EXPR_VALUE)
 438                 return 1;
 439         if (v->value != 0)
 440                 return 1;
 441         return 0;
 442 }
 443 
 444 static int restricted_binop(int op, struct symbol *type)
 445 {
 446         switch (op) {
 447                 case '&':
 448                 case '=':
 449                 case SPECIAL_AND_ASSIGN:
 450                 case SPECIAL_OR_ASSIGN:
 451                 case SPECIAL_XOR_ASSIGN:
 452                         return 1;       /* unfoul */
 453                 case '|':
 454                 case '^':
 455                 case '?':
 456                         return 2;       /* keep fouled */
 457                 case SPECIAL_EQUAL:
 458                 case SPECIAL_NOTEQUAL:
 459                         return 3;       /* warn if fouled */
 460                 default:
 461                         return 0;       /* warn */
 462         }
 463 }
 464 
 465 static int restricted_unop(int op, struct symbol **type)
 466 {
 467         if (op == '~') {
 468                 if ((*type)->bit_size < bits_in_int)
 469                         *type = befoul(*type);
 470                 return 0;
 471         } if (op == '+')
 472                 return 0;
 473         return 1;
 474 }
 475 
 476 /* type should be SYM_FOULED */
 477 static inline struct symbol *unfoul(struct symbol *type)
 478 {
 479         return type->ctype.base_type;
 480 }
 481 
 482 static struct symbol *restricted_binop_type(int op,
 483                                         struct expression *left,
 484                                         struct expression *right,
 485                                         int lclass, int rclass,
 486                                         struct symbol *ltype,
 487                                         struct symbol *rtype)
 488 {
 489         struct symbol *ctype = NULL;
 490         if (lclass & TYPE_RESTRICT) {
 491                 if (rclass & TYPE_RESTRICT) {
 492                         if (ltype == rtype) {
 493                                 ctype = ltype;
 494                         } else if (lclass & TYPE_FOULED) {
 495                                 if (unfoul(ltype) == rtype)
 496                                         ctype = ltype;
 497                         } else if (rclass & TYPE_FOULED) {
 498                                 if (unfoul(rtype) == ltype)
 499                                         ctype = rtype;
 500                         }
 501                 } else {
 502                         if (!restricted_value(right, ltype))
 503                                 ctype = ltype;
 504                 }
 505         } else if (!restricted_value(left, rtype))
 506                 ctype = rtype;
 507 
 508         if (ctype) {
 509                 switch (restricted_binop(op, ctype)) {
 510                 case 1:
 511                         if ((lclass ^ rclass) & TYPE_FOULED)
 512                                 ctype = unfoul(ctype);
 513                         break;
 514                 case 3:
 515                         if (!(lclass & rclass & TYPE_FOULED))
 516                                 break;
 517                 case 0:
 518                         ctype = NULL;
 519                 default:
 520                         break;
 521                 }
 522         }
 523 
 524         return ctype;
 525 }
 526 
 527 static inline void unrestrict(struct expression *expr,
 528                               int class, struct symbol **ctype)
 529 {
 530         if (class & TYPE_RESTRICT) {
 531                 if (class & TYPE_FOULED)
 532                         *ctype = unfoul(*ctype);
 533                 warning(expr->pos, "%s degrades to integer",
 534                         show_typename(*ctype));
 535                 *ctype = (*ctype)->ctype.base_type; /* get to arithmetic type */
 536         }
 537 }
 538 
 539 static struct symbol *usual_conversions(int op,
 540                                         struct expression *left,
 541                                         struct expression *right,
 542                                         int lclass, int rclass,
 543                                         struct symbol *ltype,
 544                                         struct symbol *rtype)
 545 {
 546         struct symbol *ctype;
 547 
 548         warn_for_different_enum_types(right->pos, left->ctype, right->ctype);
 549 
 550         if ((lclass | rclass) & TYPE_RESTRICT)
 551                 goto Restr;
 552 
 553 Normal:
 554         if (!(lclass & TYPE_FLOAT)) {
 555                 if (!(rclass & TYPE_FLOAT))
 556                         return bigger_int_type(ltype, rtype);
 557                 else
 558                         return rtype;
 559         } else if (rclass & TYPE_FLOAT) {
 560                 unsigned long lmod = ltype->ctype.modifiers;
 561                 unsigned long rmod = rtype->ctype.modifiers;
 562                 if (rmod & ~lmod & (MOD_LONG_ALL))
 563                         return rtype;
 564                 else
 565                         return ltype;
 566         } else
 567                 return ltype;
 568 
 569 Restr:
 570         ctype = restricted_binop_type(op, left, right,
 571                                       lclass, rclass, ltype, rtype);
 572         if (ctype)
 573                 return ctype;
 574 
 575         unrestrict(left, lclass, &ltype);
 576         unrestrict(right, rclass, &rtype);
 577 
 578         goto Normal;
 579 }
 580 
 581 static inline int lvalue_expression(struct expression *expr)
 582 {
 583         return expr->type == EXPR_PREOP && expr->op == '*';
 584 }
 585 
 586 static struct symbol *evaluate_ptr_add(struct expression *expr, struct symbol *itype)
 587 {
 588         struct expression *index = expr->right;
 589         struct symbol *ctype, *base;
 590         int multiply;
 591 
 592         classify_type(degenerate(expr->left), &ctype);
 593         base = examine_pointer_target(ctype);
 594 
 595         /*
 596          * An address constant +/- an integer constant expression
 597          * yields an address constant again [6.6(7)].
 598          */
 599         if ((expr->left->flags & CEF_ADDR) && (expr->right->flags & CEF_ICE))
 600                 expr->flags = CEF_ADDR;
 601 
 602         if (!base) {
 603                 expression_error(expr, "missing type information");
 604                 return NULL;
 605         }
 606         if (is_function(base)) {
 607                 expression_error(expr, "arithmetics on pointers to functions");
 608                 return NULL;
 609         }
 610 
 611         /* Get the size of whatever the pointer points to */
 612         multiply = is_void_type(base) ? 1 : bits_to_bytes(base->bit_size);
 613 
 614         if (ctype == &null_ctype)
 615                 ctype = &ptr_ctype;
 616         expr->ctype = ctype;
 617 
 618         if (multiply == 1 && itype->bit_size >= bits_in_pointer)
 619                 return ctype;
 620 
 621         if (index->type == EXPR_VALUE) {
 622                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 623                 unsigned long long v = index->value, mask;
 624                 mask = 1ULL << (itype->bit_size - 1);
 625                 if (v & mask)
 626                         v |= -mask;
 627                 else
 628                         v &= mask - 1;
 629                 v *= multiply;
 630                 mask = 1ULL << (bits_in_pointer - 1);
 631                 v &= mask | (mask - 1);
 632                 val->value = v;
 633                 val->ctype = ssize_t_ctype;
 634                 expr->right = val;
 635                 return ctype;
 636         }
 637 
 638         if (itype->bit_size < bits_in_pointer)
 639                 index = cast_to(index, ssize_t_ctype);
 640 
 641         if (multiply > 1) {
 642                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 643                 struct expression *mul = alloc_expression(expr->pos, EXPR_BINOP);
 644 
 645                 val->ctype = ssize_t_ctype;
 646                 val->value = multiply;
 647 
 648                 mul->op = '*';
 649                 mul->ctype = ssize_t_ctype;
 650                 mul->left = index;
 651                 mul->right = val;
 652                 index = mul;
 653         }
 654 
 655         expr->right = index;
 656         return ctype;
 657 }
 658 
 659 static void examine_fn_arguments(struct symbol *fn);
 660 
 661 #define MOD_IGN (MOD_QUALIFIER | MOD_PURE)
 662 
 663 const char *type_difference(struct ctype *c1, struct ctype *c2,
 664         unsigned long mod1, unsigned long mod2)
 665 {
 666         struct ident *as1 = c1->as, *as2 = c2->as;
 667         struct symbol *t1 = c1->base_type;
 668         struct symbol *t2 = c2->base_type;
 669         int move1 = 1, move2 = 1;
 670         mod1 |= c1->modifiers;
 671         mod2 |= c2->modifiers;
 672         for (;;) {
 673                 unsigned long diff;
 674                 int type;
 675                 struct symbol *base1 = t1->ctype.base_type;
 676                 struct symbol *base2 = t2->ctype.base_type;
 677 
 678                 /*
 679                  * FIXME! Collect alignment and context too here!
 680                  */
 681                 if (move1) {
 682                         if (t1 && t1->type != SYM_PTR) {
 683                                 mod1 |= t1->ctype.modifiers;
 684                                 combine_address_space(t1->pos, &as1, t1->ctype.as);
 685                         }
 686                         move1 = 0;
 687                 }
 688 
 689                 if (move2) {
 690                         if (t2 && t2->type != SYM_PTR) {
 691                                 mod2 |= t2->ctype.modifiers;
 692                                 combine_address_space(t2->pos, &as2, t2->ctype.as);
 693                         }
 694                         move2 = 0;
 695                 }
 696 
 697                 if (t1 == t2)
 698                         break;
 699                 if (!t1 || !t2)
 700                         return "different types";
 701 
 702                 if (t1->type == SYM_NODE || t1->type == SYM_ENUM) {
 703                         t1 = base1;
 704                         move1 = 1;
 705                         if (!t1)
 706                                 return "bad types";
 707                         continue;
 708                 }
 709 
 710                 if (t2->type == SYM_NODE || t2->type == SYM_ENUM) {
 711                         t2 = base2;
 712                         move2 = 1;
 713                         if (!t2)
 714                                 return "bad types";
 715                         continue;
 716                 }
 717 
 718                 move1 = move2 = 1;
 719                 type = t1->type;
 720                 if (type != t2->type)
 721                         return "different base types";
 722 
 723                 switch (type) {
 724                 default:
 725                         sparse_error(t1->pos,
 726                                      "internal error: bad type in derived(%d)",
 727                                      type);
 728                         return "bad types";
 729                 case SYM_RESTRICT:
 730                         return "different base types";
 731                 case SYM_UNION:
 732                 case SYM_STRUCT:
 733                         /* allow definition of incomplete structs and unions */
 734                         if (t1->ident == t2->ident)
 735                           return NULL;
 736                         return "different base types";
 737                 case SYM_ARRAY:
 738                         /* XXX: we ought to compare sizes */
 739                         break;
 740                 case SYM_PTR:
 741                         if (as1 != as2)
 742                                 return "different address spaces";
 743                         /* MOD_SPECIFIER is due to idiocy in parse.c */
 744                         if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SPECIFIER)
 745                                 return "different modifiers";
 746                         /* we could be lazier here */
 747                         base1 = examine_pointer_target(t1);
 748                         base2 = examine_pointer_target(t2);
 749                         mod1 = t1->ctype.modifiers;
 750                         as1 = t1->ctype.as;
 751                         mod2 = t2->ctype.modifiers;
 752                         as2 = t2->ctype.as;
 753                         break;
 754                 case SYM_FN: {
 755                         struct symbol *arg1, *arg2;
 756                         int i;
 757 
 758                         if (as1 != as2)
 759                                 return "different address spaces";
 760                         if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SIGNEDNESS)
 761                                 return "different modifiers";
 762                         mod1 = t1->ctype.modifiers;
 763                         as1 = t1->ctype.as;
 764                         mod2 = t2->ctype.modifiers;
 765                         as2 = t2->ctype.as;
 766 
 767                         if (t1->variadic != t2->variadic)
 768                                 return "incompatible variadic arguments";
 769                         examine_fn_arguments(t1);
 770                         examine_fn_arguments(t2);
 771                         PREPARE_PTR_LIST(t1->arguments, arg1);
 772                         PREPARE_PTR_LIST(t2->arguments, arg2);
 773                         i = 1;
 774                         for (;;) {
 775                                 const char *diffstr;
 776                                 if (!arg1 && !arg2)
 777                                         break;
 778                                 if (!arg1 || !arg2)
 779                                         return "different argument counts";
 780                                 diffstr = type_difference(&arg1->ctype,
 781                                                           &arg2->ctype,
 782                                                           MOD_IGN, MOD_IGN);
 783                                 if (diffstr) {
 784                                         static char argdiff[80];
 785                                         sprintf(argdiff, "incompatible argument %d (%s)", i, diffstr);
 786                                         return argdiff;
 787                                 }
 788                                 NEXT_PTR_LIST(arg1);
 789                                 NEXT_PTR_LIST(arg2);
 790                                 i++;
 791                         }
 792                         FINISH_PTR_LIST(arg2);
 793                         FINISH_PTR_LIST(arg1);
 794                         break;
 795                 }
 796                 case SYM_BASETYPE:
 797                         if (as1 != as2)
 798                                 return "different address spaces";
 799                         if (base1 != base2)
 800                                 return "different base types";
 801                         diff = (mod1 ^ mod2) & ~MOD_IGNORE;
 802                         if (!diff)
 803                                 return NULL;
 804                         if (diff & MOD_SIZE)
 805                                 return "different type sizes";
 806                         else if (diff & ~MOD_SIGNEDNESS)
 807                                 return "different modifiers";
 808                         else
 809                                 return "different signedness";
 810                 }
 811                 t1 = base1;
 812                 t2 = base2;
 813         }
 814         if (as1 != as2)
 815                 return "different address spaces";
 816         if ((mod1 ^ mod2) & ~MOD_IGNORE & ~MOD_SIGNEDNESS)
 817                 return "different modifiers";
 818         return NULL;
 819 }
 820 
 821 static void bad_null(struct expression *expr)
 822 {
 823         if (Wnon_pointer_null)
 824                 warning(expr->pos, "Using plain integer as NULL pointer");
 825 }
 826 
 827 static unsigned long target_qualifiers(struct symbol *type)
 828 {
 829         unsigned long mod = type->ctype.modifiers & MOD_IGN;
 830         if (type->ctype.base_type && type->ctype.base_type->type == SYM_ARRAY)
 831                 mod = 0;
 832         return mod;
 833 }
 834 
 835 static struct symbol *evaluate_ptr_sub(struct expression *expr)
 836 {
 837         const char *typediff;
 838         struct symbol *ltype, *rtype;
 839         struct expression *l = expr->left;
 840         struct expression *r = expr->right;
 841         struct symbol *lbase;
 842 
 843         classify_type(degenerate(l), &ltype);
 844         classify_type(degenerate(r), &rtype);
 845 
 846         lbase = examine_pointer_target(ltype);
 847         examine_pointer_target(rtype);
 848         typediff = type_difference(&ltype->ctype, &rtype->ctype,
 849                                    target_qualifiers(rtype),
 850                                    target_qualifiers(ltype));
 851         if (typediff)
 852                 expression_error(expr, "subtraction of different types can't work (%s)", typediff);
 853 
 854         if (is_function(lbase)) {
 855                 expression_error(expr, "subtraction of functions? Share your drugs");
 856                 return NULL;
 857         }
 858 
 859         expr->ctype = ssize_t_ctype;
 860         if (lbase->bit_size > bits_in_char) {
 861                 struct expression *sub = alloc_expression(expr->pos, EXPR_BINOP);
 862                 struct expression *div = expr;
 863                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 864                 unsigned long value = bits_to_bytes(lbase->bit_size);
 865 
 866                 val->ctype = size_t_ctype;
 867                 val->value = value;
 868 
 869                 if (value & (value-1)) {
 870                         if (Wptr_subtraction_blows) {
 871                                 warning(expr->pos, "potentially expensive pointer subtraction");
 872                                 info(expr->pos, "    '%s' has a non-power-of-2 size: %lu", show_typename(lbase), value);
 873                         }
 874                 }
 875 
 876                 sub->op = '-';
 877                 sub->ctype = ssize_t_ctype;
 878                 sub->left = l;
 879                 sub->right = r;
 880 
 881                 div->op = '/';
 882                 div->left = sub;
 883                 div->right = val;
 884         }
 885                 
 886         return ssize_t_ctype;
 887 }
 888 
 889 #define is_safe_type(type) ((type)->ctype.modifiers & MOD_SAFE)
 890 
 891 static struct symbol *evaluate_conditional(struct expression *expr, int iterator)
 892 {
 893         struct symbol *ctype;
 894 
 895         if (!expr)
 896                 return NULL;
 897 
 898         if (!iterator && expr->type == EXPR_ASSIGNMENT && expr->op == '=')
 899                 warning(expr->pos, "assignment expression in conditional");
 900 
 901         ctype = evaluate_expression(expr);
 902         if (!valid_type(ctype))
 903                 return NULL;
 904         if (is_safe_type(ctype))
 905                 warning(expr->pos, "testing a 'safe expression'");
 906         if (is_func_type(ctype)) {
 907                 if (Waddress)
 908                         warning(expr->pos, "the address of %s will always evaluate as true", "a function");
 909         } else if (is_array_type(ctype)) {
 910                 if (Waddress)
 911                         warning(expr->pos, "the address of %s will always evaluate as true", "an array");
 912         } else if (!is_scalar_type(ctype)) {
 913                 sparse_error(expr->pos, "incorrect type in conditional (non-scalar type)");
 914                 info(expr->pos, "   got %s", show_typename(ctype));
 915                 return NULL;
 916         }
 917 
 918         ctype = degenerate(expr);
 919         return ctype;
 920 }
 921 
 922 static struct symbol *evaluate_logical(struct expression *expr)
 923 {
 924         if (!evaluate_conditional(expr->left, 0))
 925                 return NULL;
 926         if (!evaluate_conditional(expr->right, 0))
 927                 return NULL;
 928 
 929         /* the result is int [6.5.13(3), 6.5.14(3)] */
 930         expr->ctype = &int_ctype;
 931         expr->flags = expr->left->flags & expr->right->flags;
 932         expr->flags &= ~(CEF_CONST_MASK | CEF_ADDR);
 933         return &int_ctype;
 934 }
 935 
 936 static struct symbol *evaluate_binop(struct expression *expr)
 937 {
 938         struct symbol *ltype, *rtype, *ctype;
 939         int lclass = classify_type(expr->left->ctype, &ltype);
 940         int rclass = classify_type(expr->right->ctype, &rtype);
 941         int op = expr->op;
 942 
 943         /* number op number */
 944         if (lclass & rclass & TYPE_NUM) {
 945                 expr->flags = expr->left->flags & expr->right->flags;
 946                 expr->flags &= ~CEF_CONST_MASK;
 947 
 948                 if ((lclass | rclass) & TYPE_FLOAT) {
 949                         switch (op) {
 950                         case '+': case '-': case '*': case '/':
 951                                 break;
 952                         default:
 953                                 return bad_expr_type(expr);
 954                         }
 955                 }
 956 
 957                 if (op == SPECIAL_LEFTSHIFT || op == SPECIAL_RIGHTSHIFT) {
 958                         // shifts do integer promotions, but that's it.
 959                         unrestrict(expr->left, lclass, &ltype);
 960                         unrestrict(expr->right, rclass, &rtype);
 961                         ctype = ltype = integer_promotion(ltype);
 962                         rtype = integer_promotion(rtype);
 963                 } else {
 964                         // The rest do usual conversions
 965                         const unsigned left_not  = expr->left->type == EXPR_PREOP
 966                                                    && expr->left->op == '!';
 967                         const unsigned right_not = expr->right->type == EXPR_PREOP
 968                                                    && expr->right->op == '!';
 969                         if ((op == '&' || op == '|') && (left_not || right_not))
 970                                 warning(expr->pos, "dubious: %sx %c %sy",
 971                                         left_not ? "!" : "",
 972                                         op,
 973                                         right_not ? "!" : "");
 974 
 975                         ltype = usual_conversions(op, expr->left, expr->right,
 976                                                   lclass, rclass, ltype, rtype);
 977                         ctype = rtype = ltype;
 978                 }
 979 
 980                 expr->left = cast_to(expr->left, ltype);
 981                 expr->right = cast_to(expr->right, rtype);
 982                 expr->ctype = ctype;
 983                 return ctype;
 984         }
 985 
 986         /* pointer (+|-) integer */
 987         if (lclass & TYPE_PTR && is_int(rclass) && (op == '+' || op == '-')) {
 988                 unrestrict(expr->right, rclass, &rtype);
 989                 return evaluate_ptr_add(expr, rtype);
 990         }
 991 
 992         /* integer + pointer */
 993         if (rclass & TYPE_PTR && is_int(lclass) && op == '+') {
 994                 struct expression *index = expr->left;
 995                 unrestrict(index, lclass, &ltype);
 996                 expr->left = expr->right;
 997                 expr->right = index;
 998                 return evaluate_ptr_add(expr, ltype);
 999         }
1000 
1001         /* pointer - pointer */
1002         if (lclass & rclass & TYPE_PTR && expr->op == '-')
1003                 return evaluate_ptr_sub(expr);
1004 
1005         return bad_expr_type(expr);
1006 }
1007 
1008 static struct symbol *evaluate_comma(struct expression *expr)
1009 {
1010         expr->ctype = degenerate(expr->right);
1011         if (expr->ctype == &null_ctype)
1012                 expr->ctype = &ptr_ctype;
1013         expr->flags &= expr->left->flags & expr->right->flags;
1014         return expr->ctype;
1015 }
1016 
1017 static int modify_for_unsigned(int op)
1018 {
1019         if (op == '<')
1020                 op = SPECIAL_UNSIGNED_LT;
1021         else if (op == '>')
1022                 op = SPECIAL_UNSIGNED_GT;
1023         else if (op == SPECIAL_LTE)
1024                 op = SPECIAL_UNSIGNED_LTE;
1025         else if (op == SPECIAL_GTE)
1026                 op = SPECIAL_UNSIGNED_GTE;
1027         return op;
1028 }
1029 
1030 enum null_constant_type {
1031         NON_NULL,
1032         NULL_PTR,
1033         NULL_ZERO,
1034 };
1035 
1036 static inline int is_null_pointer_constant(struct expression *e)
1037 {
1038         if (e->ctype == &null_ctype)
1039                 return NULL_PTR;
1040         if (!(e->flags & CEF_ICE))
1041                 return NON_NULL;
1042         return is_zero_constant(e) ? NULL_ZERO : NON_NULL;
1043 }
1044 
1045 static struct symbol *evaluate_compare(struct expression *expr)
1046 {
1047         struct expression *left = expr->left, *right = expr->right;
1048         struct symbol *ltype, *rtype, *lbase, *rbase;
1049         int lclass = classify_type(degenerate(left), &ltype);
1050         int rclass = classify_type(degenerate(right), &rtype);
1051         struct symbol *ctype;
1052         const char *typediff;
1053 
1054         /* Type types? */
1055         if (is_type_type(ltype) && is_type_type(rtype)) {
1056                 /*
1057                  * __builtin_types_compatible_p() yields an integer
1058                  * constant expression
1059                  */
1060                 expr->flags = CEF_SET_ICE;
1061                 goto OK;
1062         }
1063 
1064         if (is_safe_type(left->ctype) || is_safe_type(right->ctype))
1065                 warning(expr->pos, "testing a 'safe expression'");
1066 
1067         expr->flags = left->flags & right->flags & ~CEF_CONST_MASK & ~CEF_ADDR;
1068 
1069         /* number on number */
1070         if (lclass & rclass & TYPE_NUM) {
1071                 ctype = usual_conversions(expr->op, expr->left, expr->right,
1072                                           lclass, rclass, ltype, rtype);
1073                 expr->left = cast_to(expr->left, ctype);
1074                 expr->right = cast_to(expr->right, ctype);
1075                 if (ctype->ctype.modifiers & MOD_UNSIGNED)
1076                         expr->op = modify_for_unsigned(expr->op);
1077                 goto OK;
1078         }
1079 
1080         /* at least one must be a pointer */
1081         if (!((lclass | rclass) & TYPE_PTR))
1082                 return bad_expr_type(expr);
1083 
1084         /* equality comparisons can be with null pointer constants */
1085         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1086                 int is_null1 = is_null_pointer_constant(left);
1087                 int is_null2 = is_null_pointer_constant(right);
1088                 if (is_null1 == NULL_ZERO)
1089                         bad_null(left);
1090                 if (is_null2 == NULL_ZERO)
1091                         bad_null(right);
1092                 if (is_null1 && is_null2) {
1093                         int positive = expr->op == SPECIAL_EQUAL;
1094                         expr->type = EXPR_VALUE;
1095                         expr->value = positive;
1096                         goto OK;
1097                 }
1098                 if (is_null1 && (rclass & TYPE_PTR)) {
1099                         left = cast_to(left, rtype);
1100                         goto OK;
1101                 }
1102                 if (is_null2 && (lclass & TYPE_PTR)) {
1103                         right = cast_to(right, ltype);
1104                         goto OK;
1105                 }
1106         }
1107         /* both should be pointers */
1108         if (!(lclass & rclass & TYPE_PTR))
1109                 return bad_expr_type(expr);
1110         expr->op = modify_for_unsigned(expr->op);
1111 
1112         lbase = examine_pointer_target(ltype);
1113         rbase = examine_pointer_target(rtype);
1114 
1115         /* they also have special treatment for pointers to void */
1116         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1117                 if (ltype->ctype.as == rtype->ctype.as) {
1118                         if (lbase == &void_ctype) {
1119                                 right = cast_to(right, ltype);
1120                                 goto OK;
1121                         }
1122                         if (rbase == &void_ctype) {
1123                                 left = cast_to(left, rtype);
1124                                 goto OK;
1125                         }
1126                 }
1127         }
1128 
1129         typediff = type_difference(&ltype->ctype, &rtype->ctype,
1130                                    target_qualifiers(rtype),
1131                                    target_qualifiers(ltype));
1132         if (!typediff)
1133                 goto OK;
1134 
1135         expression_error(expr, "incompatible types in comparison expression (%s):", typediff);
1136         info(expr->pos, "   %s", show_typename(ltype));
1137         info(expr->pos, "   %s", show_typename(rtype));
1138         return NULL;
1139 
1140 OK:
1141         /* the result is int [6.5.8(6), 6.5.9(3)]*/
1142         expr->ctype = &int_ctype;
1143         return &int_ctype;
1144 }
1145 
1146 /*
1147  * NOTE! The degenerate case of "x ? : y", where we don't
1148  * have a true case, this will possibly promote "x" to the
1149  * same type as "y", and thus _change_ the conditional
1150  * test in the expression. But since promotion is "safe"
1151  * for testing, that's OK.
1152  */
1153 static struct symbol *evaluate_conditional_expression(struct expression *expr)
1154 {
1155         struct expression **cond;
1156         struct symbol *ctype, *ltype, *rtype, *lbase, *rbase;
1157         int lclass, rclass;
1158         const char * typediff;
1159         int qual;
1160 
1161         if (!evaluate_conditional(expr->conditional, 0))
1162                 return NULL;
1163         if (!evaluate_expression(expr->cond_false))
1164                 return NULL;
1165 
1166         ctype = degenerate(expr->conditional);
1167         rtype = degenerate(expr->cond_false);
1168 
1169         cond = &expr->conditional;
1170         ltype = ctype;
1171         if (expr->cond_true) {
1172                 if (!evaluate_expression(expr->cond_true))
1173                         return NULL;
1174                 ltype = degenerate(expr->cond_true);
1175                 cond = &expr->cond_true;
1176         }
1177 
1178         expr->flags = (expr->conditional->flags & (*cond)->flags &
1179                         expr->cond_false->flags & ~CEF_CONST_MASK);
1180         /*
1181          * A conditional operator yields a particular constant
1182          * expression type only if all of its three subexpressions are
1183          * of that type [6.6(6), 6.6(8)].
1184          * As an extension, relax this restriction by allowing any
1185          * constant expression type for the condition expression.
1186          *
1187          * A conditional operator never yields an address constant
1188          * [6.6(9)].
1189          * However, as an extension, if the condition is any constant
1190          * expression, and the true and false expressions are both
1191          * address constants, mark the result as an address constant.
1192          */
1193         if (expr->conditional->flags & (CEF_ACE | CEF_ADDR))
1194                 expr->flags = (*cond)->flags & expr->cond_false->flags & ~CEF_CONST_MASK;
1195 
1196         lclass = classify_type(ltype, &ltype);
1197         rclass = classify_type(rtype, &rtype);
1198         if (lclass & rclass & TYPE_NUM) {
1199                 ctype = usual_conversions('?', *cond, expr->cond_false,
1200                                           lclass, rclass, ltype, rtype);
1201                 *cond = cast_to(*cond, ctype);
1202                 expr->cond_false = cast_to(expr->cond_false, ctype);
1203                 goto out;
1204         }
1205 
1206         if ((lclass | rclass) & TYPE_PTR) {
1207                 int is_null1 = is_null_pointer_constant(*cond);
1208                 int is_null2 = is_null_pointer_constant(expr->cond_false);
1209 
1210                 if (is_null1 && is_null2) {
1211                         *cond = cast_to(*cond, &ptr_ctype);
1212                         expr->cond_false = cast_to(expr->cond_false, &ptr_ctype);
1213                         ctype = &ptr_ctype;
1214                         goto out;
1215                 }
1216                 if (is_null1 && (rclass & TYPE_PTR)) {
1217                         if (is_null1 == NULL_ZERO)
1218                                 bad_null(*cond);
1219                         *cond = cast_to(*cond, rtype);
1220                         ctype = rtype;
1221                         goto out;
1222                 }
1223                 if (is_null2 && (lclass & TYPE_PTR)) {
1224                         if (is_null2 == NULL_ZERO)
1225                                 bad_null(expr->cond_false);
1226                         expr->cond_false = cast_to(expr->cond_false, ltype);
1227                         ctype = ltype;
1228                         goto out;
1229                 }
1230                 if (!(lclass & rclass & TYPE_PTR)) {
1231                         typediff = "different types";
1232                         goto Err;
1233                 }
1234                 /* OK, it's pointer on pointer */
1235                 if (ltype->ctype.as != rtype->ctype.as) {
1236                         typediff = "different address spaces";
1237                         goto Err;
1238                 }
1239 
1240                 /* need to be lazier here */
1241                 lbase = examine_pointer_target(ltype);
1242                 rbase = examine_pointer_target(rtype);
1243                 qual = target_qualifiers(ltype) | target_qualifiers(rtype);
1244 
1245                 if (lbase == &void_ctype) {
1246                         /* XXX: pointers to function should warn here */
1247                         ctype = ltype;
1248                         goto Qual;
1249 
1250                 }
1251                 if (rbase == &void_ctype) {
1252                         /* XXX: pointers to function should warn here */
1253                         ctype = rtype;
1254                         goto Qual;
1255                 }
1256                 /* XXX: that should be pointer to composite */
1257                 ctype = ltype;
1258                 typediff = type_difference(&ltype->ctype, &rtype->ctype,
1259                                            qual, qual);
1260                 if (!typediff)
1261                         goto Qual;
1262                 goto Err;
1263         }
1264 
1265         /* void on void, struct on same struct, union on same union */
1266         if (ltype == rtype) {
1267                 ctype = ltype;
1268                 goto out;
1269         }
1270         typediff = "different base types";
1271 
1272 Err:
1273         expression_error(expr, "incompatible types in conditional expression (%s):", typediff);
1274         info(expr->pos, "   %s", show_typename(ltype));
1275         info(expr->pos, "   %s", show_typename(rtype));
1276         /*
1277          * if the condition is constant, the type is in fact known
1278          * so use it, as gcc & clang do.
1279          */
1280         switch (expr_truth_value(expr->conditional)) {
1281         case 1: expr->ctype = ltype;
1282                 break;
1283         case 0: expr->ctype = rtype;
1284                 break;
1285         default:
1286                 break;
1287         }
1288         return NULL;
1289 
1290 out:
1291         expr->ctype = ctype;
1292         return ctype;
1293 
1294 Qual:
1295         if (qual & ~ctype->ctype.modifiers) {
1296                 struct symbol *sym = alloc_symbol(ctype->pos, SYM_PTR);
1297                 *sym = *ctype;
1298                 sym->ctype.modifiers |= qual;
1299                 ctype = sym;
1300         }
1301         *cond = cast_to(*cond, ctype);
1302         expr->cond_false = cast_to(expr->cond_false, ctype);
1303         goto out;
1304 }
1305 
1306 /* FP assignments can not do modulo or bit operations */
1307 static int compatible_float_op(int op)
1308 {
1309         return  op == SPECIAL_ADD_ASSIGN ||
1310                 op == SPECIAL_SUB_ASSIGN ||
1311                 op == SPECIAL_MUL_ASSIGN ||
1312                 op == SPECIAL_DIV_ASSIGN;
1313 }
1314 
1315 static int evaluate_assign_op(struct expression *expr)
1316 {
1317         struct symbol *target = expr->left->ctype;
1318         struct symbol *source = expr->right->ctype;
1319         struct symbol *t, *s;
1320         int tclass = classify_type(target, &t);
1321         int sclass = classify_type(source, &s);
1322         int op = expr->op;
1323 
1324         if (tclass & sclass & TYPE_NUM) {
1325                 if (tclass & TYPE_FLOAT && !compatible_float_op(op)) {
1326                         expression_error(expr, "invalid assignment");
1327                         return 0;
1328                 }
1329                 if (tclass & TYPE_RESTRICT) {
1330                         if (!restricted_binop(op, t)) {
1331                                 warning(expr->pos, "bad assignment (%s) to %s",
1332                                         show_special(op), show_typename(t));
1333                                 expr->right = cast_to(expr->right, target);
1334                                 return 0;
1335                         }
1336                         /* allowed assignments unfoul */
1337                         if (sclass & TYPE_FOULED && unfoul(s) == t)
1338                                 goto Cast;
1339                         if (!restricted_value(expr->right, t))
1340                                 return 1;
1341                 } else if (op == SPECIAL_SHR_ASSIGN || op == SPECIAL_SHL_ASSIGN) {
1342                         // shifts do integer promotions, but that's it.
1343                         unrestrict(expr->right, sclass, &s);
1344                         target = integer_promotion(s);
1345                         goto Cast;
1346                 } else if (!(sclass & TYPE_RESTRICT))
1347                         goto usual;
1348                 /* source and target would better be identical restricted */
1349                 if (t == s)
1350                         return 1;
1351                 warning(expr->pos, "invalid assignment: %s", show_special(op));
1352                 info(expr->pos, "   left side has type %s", show_typename(t));
1353                 info(expr->pos, "   right side has type %s", show_typename(s));
1354                 expr->right = cast_to(expr->right, target);
1355                 return 0;
1356         }
1357         if (tclass == TYPE_PTR && is_int(sclass)) {
1358                 if (op == SPECIAL_ADD_ASSIGN || op == SPECIAL_SUB_ASSIGN) {
1359                         unrestrict(expr->right, sclass, &s);
1360                         evaluate_ptr_add(expr, s);
1361                         return 1;
1362                 }
1363                 expression_error(expr, "invalid pointer assignment");
1364                 return 0;
1365         }
1366 
1367         expression_error(expr, "invalid assignment");
1368         return 0;
1369 
1370 usual:
1371         target = usual_conversions(op, expr->left, expr->right,
1372                                 tclass, sclass, target, source);
1373 Cast:
1374         expr->right = cast_to(expr->right, target);
1375         return 1;
1376 }
1377 
1378 static int whitelist_pointers(struct symbol *t1, struct symbol *t2)
1379 {
1380         if (t1 == t2)
1381                 return 0;       /* yes, 0 - we don't want a cast_to here */
1382         if (t1 == &void_ctype)
1383                 return 1;
1384         if (t2 == &void_ctype)
1385                 return 1;
1386         if (classify_type(t1, &t1) != TYPE_NUM)
1387                 return 0;
1388         if (classify_type(t2, &t2) != TYPE_NUM)
1389                 return 0;
1390         if (t1 == t2)
1391                 return 1;
1392         if (t1->ctype.modifiers & t2->ctype.modifiers & MOD_CHAR)
1393                 return 1;
1394         if ((t1->ctype.modifiers ^ t2->ctype.modifiers) & MOD_SIZE)
1395                 return 0;
1396         return !Wtypesign;
1397 }
1398 
1399 static int check_assignment_types(struct symbol *target, struct expression **rp,
1400         const char **typediff)
1401 {
1402         struct symbol *source = degenerate(*rp);
1403         struct symbol *t, *s;
1404         int tclass = classify_type(target, &t);
1405         int sclass = classify_type(source, &s);
1406 
1407         if (tclass & sclass & TYPE_NUM) {
1408                 if (tclass & TYPE_RESTRICT) {
1409                         /* allowed assignments unfoul */
1410                         if (sclass & TYPE_FOULED && unfoul(s) == t)
1411                                 goto Cast;
1412                         if (!restricted_value(*rp, target))
1413                                 return 1;
1414                         if (s == t)
1415                                 return 1;
1416                 } else if (!(sclass & TYPE_RESTRICT))
1417                         goto Cast;
1418                 if (t == &bool_ctype) {
1419                         if (is_fouled_type(s))
1420                                 warning((*rp)->pos, "%s degrades to integer",
1421                                         show_typename(s->ctype.base_type));
1422                         goto Cast;
1423                 }
1424                 *typediff = "different base types";
1425                 return 0;
1426         }
1427 
1428         if (tclass == TYPE_PTR) {
1429                 unsigned long mod1, mod2;
1430                 struct symbol *b1, *b2;
1431                 // NULL pointer is always OK
1432                 int is_null = is_null_pointer_constant(*rp);
1433                 if (is_null) {
1434                         if (is_null == NULL_ZERO)
1435                                 bad_null(*rp);
1436                         goto Cast;
1437                 }
1438                 if (!(sclass & TYPE_PTR)) {
1439                         *typediff = "different base types";
1440                         return 0;
1441                 }
1442                 b1 = examine_pointer_target(t);
1443                 b2 = examine_pointer_target(s);
1444                 mod1 = target_qualifiers(t);
1445                 mod2 = target_qualifiers(s);
1446                 if (whitelist_pointers(b1, b2)) {
1447                         /*
1448                          * assignments to/from void * are OK, provided that
1449                          * we do not remove qualifiers from pointed to [C]
1450                          * or mix address spaces [sparse].
1451                          */
1452                         if (t->ctype.as != s->ctype.as) {
1453                                 *typediff = "different address spaces";
1454                                 return 0;
1455                         }
1456                         /*
1457                          * If this is a function pointer assignment, it is
1458                          * actually fine to assign a pointer to const data to
1459                          * it, as a function pointer points to const data
1460                          * implicitly, i.e., dereferencing it does not produce
1461                          * an lvalue.
1462                          */
1463                         if (b1->type == SYM_FN)
1464                                 mod1 |= MOD_CONST;
1465                         if (mod2 & ~mod1) {
1466                                 *typediff = "different modifiers";
1467                                 return 0;
1468                         }
1469                         goto Cast;
1470                 }
1471                 /* It's OK if the target is more volatile or const than the source */
1472                 *typediff = type_difference(&t->ctype, &s->ctype, 0, mod1);
1473                 if (*typediff)
1474                         return 0;
1475                 return 1;
1476         }
1477 
1478         if ((tclass & TYPE_COMPOUND) && s == t)
1479                 return 1;
1480 
1481         if (tclass & TYPE_NUM) {
1482                 /* XXX: need to turn into comparison with NULL */
1483                 if (t == &bool_ctype && (sclass & TYPE_PTR))
1484                         goto Cast;
1485                 *typediff = "different base types";
1486                 return 0;
1487         }
1488         *typediff = "invalid types";
1489         return 0;
1490 
1491 Cast:
1492         *rp = cast_to(*rp, target);
1493         return 1;
1494 }
1495 
1496 static int compatible_assignment_types(struct expression *expr, struct symbol *target,
1497         struct expression **rp, const char *where)
1498 {
1499         const char *typediff;
1500         struct symbol *source = degenerate(*rp);
1501 
1502         if (!check_assignment_types(target, rp, &typediff)) {
1503                 warning(expr->pos, "incorrect type in %s (%s)", where, typediff);
1504                 info(expr->pos, "   expected %s", show_typename(target));
1505                 info(expr->pos, "   got %s", show_typename(source));
1506                 *rp = cast_to(*rp, target);
1507                 return 0;
1508         }
1509 
1510         return 1;
1511 }
1512 
1513 static int compatible_transparent_union(struct symbol *target,
1514         struct expression **rp)
1515 {
1516         struct symbol *t, *member;
1517         classify_type(target, &t);
1518         if (t->type != SYM_UNION || !t->transparent_union)
1519                 return 0;
1520 
1521         FOR_EACH_PTR(t->symbol_list, member) {
1522                 const char *typediff;
1523                 if (check_assignment_types(member, rp, &typediff))
1524                         return 1;
1525         } END_FOR_EACH_PTR(member);
1526 
1527         return 0;
1528 }
1529 
1530 static int compatible_argument_type(struct expression *expr, struct symbol *target,
1531         struct expression **rp, const char *where)
1532 {
1533         if (compatible_transparent_union(target, rp))
1534                 return 1;
1535 
1536         return compatible_assignment_types(expr, target, rp, where);
1537 }
1538 
1539 static void mark_assigned(struct expression *expr)
1540 {
1541         struct symbol *sym;
1542 
1543         if (!expr)
1544                 return;
1545         switch (expr->type) {
1546         case EXPR_SYMBOL:
1547                 sym = expr->symbol;
1548                 if (!sym)
1549                         return;
1550                 if (sym->type != SYM_NODE)
1551                         return;
1552                 sym->ctype.modifiers |= MOD_ASSIGNED;
1553                 return;
1554 
1555         case EXPR_BINOP:
1556                 mark_assigned(expr->left);
1557                 mark_assigned(expr->right);
1558                 return;
1559         case EXPR_CAST:
1560         case EXPR_FORCE_CAST:
1561                 mark_assigned(expr->cast_expression);
1562                 return;
1563         case EXPR_SLICE:
1564                 mark_assigned(expr->base);
1565                 return;
1566         default:
1567                 /* Hmm? */
1568                 return;
1569         }
1570 }
1571 
1572 static void evaluate_assign_to(struct expression *left, struct symbol *type)
1573 {
1574         if (type->ctype.modifiers & MOD_CONST)
1575                 expression_error(left, "assignment to const expression");
1576 
1577         /* We know left is an lvalue, so it's a "preop-*" */
1578         mark_assigned(left->unop);
1579 }
1580 
1581 static struct symbol *evaluate_assignment(struct expression *expr)
1582 {
1583         struct expression *left = expr->left;
1584         struct symbol *ltype;
1585 
1586         if (!lvalue_expression(left)) {
1587                 expression_error(expr, "not an lvalue");
1588                 return NULL;
1589         }
1590 
1591         ltype = left->ctype;
1592 
1593         if (expr->op != '=') {
1594                 if (!evaluate_assign_op(expr))
1595                         return NULL;
1596         } else {
1597                 if (!compatible_assignment_types(expr, ltype, &expr->right, "assignment"))
1598                         return NULL;
1599         }
1600 
1601         evaluate_assign_to(left, ltype);
1602 
1603         expr->ctype = ltype;
1604         return ltype;
1605 }
1606 
1607 static void examine_fn_arguments(struct symbol *fn)
1608 {
1609         struct symbol *s;
1610 
1611         FOR_EACH_PTR(fn->arguments, s) {
1612                 struct symbol *arg = evaluate_symbol(s);
1613                 /* Array/function arguments silently degenerate into pointers */
1614                 if (arg) {
1615                         struct symbol *ptr;
1616                         switch(arg->type) {
1617                         case SYM_ARRAY:
1618                         case SYM_FN:
1619                                 ptr = alloc_symbol(s->pos, SYM_PTR);
1620                                 if (arg->type == SYM_ARRAY)
1621                                         ptr->ctype = arg->ctype;
1622                                 else
1623                                         ptr->ctype.base_type = arg;
1624                                 combine_address_space(s->pos, &ptr->ctype.as, s->ctype.as);
1625                                 ptr->ctype.modifiers |= s->ctype.modifiers & MOD_PTRINHERIT;
1626 
1627                                 s->ctype.base_type = ptr;
1628                                 s->ctype.as = NULL;
1629                                 s->ctype.modifiers &= ~MOD_PTRINHERIT;
1630                                 s->bit_size = 0;
1631                                 s->examined = 0;
1632                                 examine_symbol_type(s);
1633                                 break;
1634                         default:
1635                                 /* nothing */
1636                                 break;
1637                         }
1638                 }
1639         } END_FOR_EACH_PTR(s);
1640 }
1641 
1642 static struct symbol *convert_to_as_mod(struct symbol *sym, struct ident *as, int mod)
1643 {
1644         /* Take the modifiers of the pointer, and apply them to the member */
1645         mod |= sym->ctype.modifiers;
1646         if (sym->ctype.as != as || sym->ctype.modifiers != mod) {
1647                 struct symbol *newsym = alloc_symbol(sym->pos, SYM_NODE);
1648                 *newsym = *sym;
1649                 newsym->ctype.as = as;
1650                 newsym->ctype.modifiers = mod;
1651                 sym = newsym;
1652         }
1653         return sym;
1654 }
1655 
1656 static struct symbol *create_pointer(struct expression *expr, struct symbol *sym, int degenerate)
1657 {
1658         struct symbol *node = alloc_symbol(expr->pos, SYM_NODE);
1659         struct symbol *ptr = alloc_symbol(expr->pos, SYM_PTR);
1660 
1661         node->ctype.base_type = ptr;
1662         ptr->bit_size = bits_in_pointer;
1663         ptr->ctype.alignment = pointer_alignment;
1664 
1665         node->bit_size = bits_in_pointer;
1666         node->ctype.alignment = pointer_alignment;
1667 
1668         access_symbol(sym);
1669         if (sym->ctype.modifiers & MOD_REGISTER) {
1670                 warning(expr->pos, "taking address of 'register' variable '%s'", show_ident(sym->ident));
1671                 sym->ctype.modifiers &= ~MOD_REGISTER;
1672         }
1673         if (sym->type == SYM_NODE) {
1674                 combine_address_space(sym->pos, &ptr->ctype.as, sym->ctype.as);
1675                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1676                 sym = sym->ctype.base_type;
1677         }
1678         if (degenerate && sym->type == SYM_ARRAY) {
1679                 combine_address_space(sym->pos, &ptr->ctype.as, sym->ctype.as);
1680                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1681                 sym = sym->ctype.base_type;
1682         }
1683         ptr->ctype.base_type = sym;
1684 
1685         return node;
1686 }
1687 
1688 /* Arrays degenerate into pointers on pointer arithmetic */
1689 static struct symbol *degenerate(struct expression *expr)
1690 {
1691         struct symbol *ctype, *base;
1692 
1693         if (!expr)
1694                 return NULL;
1695         ctype = expr->ctype;
1696         if (!ctype)
1697                 return NULL;
1698         base = examine_symbol_type(ctype);
1699         if (ctype->type == SYM_NODE)
1700                 base = ctype->ctype.base_type;
1701         /*
1702          * Arrays degenerate into pointers to the entries, while
1703          * functions degenerate into pointers to themselves.
1704          * If array was part of non-lvalue compound, we create a copy
1705          * of that compound first and then act as if we were dealing with
1706          * the corresponding field in there.
1707          */
1708         switch (base->type) {
1709         case SYM_ARRAY:
1710                 if (expr->type == EXPR_SLICE) {
1711                         struct symbol *a = alloc_symbol(expr->pos, SYM_NODE);
1712                         struct expression *e0, *e1, *e2, *e3, *e4;
1713 
1714                         a->ctype.base_type = expr->base->ctype;
1715                         a->bit_size = expr->base->ctype->bit_size;
1716                         a->array_size = expr->base->ctype->array_size;
1717 
1718                         e0 = alloc_expression(expr->pos, EXPR_SYMBOL);
1719                         e0->symbol = a;
1720                         e0->ctype = &lazy_ptr_ctype;
1721 
1722                         e1 = alloc_expression(expr->pos, EXPR_PREOP);
1723                         e1->unop = e0;
1724                         e1->op = '*';
1725                         e1->ctype = expr->base->ctype; /* XXX */
1726 
1727                         e2 = alloc_expression(expr->pos, EXPR_ASSIGNMENT);
1728                         e2->left = e1;
1729                         e2->right = expr->base;
1730                         e2->op = '=';
1731                         e2->ctype = expr->base->ctype;
1732 
1733                         if (expr->r_bitpos) {
1734                                 e3 = alloc_expression(expr->pos, EXPR_BINOP);
1735                                 e3->op = '+';
1736                                 e3->left = e0;
1737                                 e3->right = alloc_const_expression(expr->pos,
1738                                                         bits_to_bytes(expr->r_bitpos));
1739                                 e3->ctype = &lazy_ptr_ctype;
1740                         } else {
1741                                 e3 = e0;
1742                         }
1743 
1744                         e4 = alloc_expression(expr->pos, EXPR_COMMA);
1745                         e4->left = e2;
1746                         e4->right = e3;
1747                         e4->ctype = &lazy_ptr_ctype;
1748 
1749                         expr->unop = e4;
1750                         expr->type = EXPR_PREOP;
1751                         expr->op = '*';
1752                 }
1753         case SYM_FN:
1754                 if (expr->op != '*' || expr->type != EXPR_PREOP) {
1755                         expression_error(expr, "strange non-value function or array");
1756                         return &bad_ctype;
1757                 }
1758                 *expr = *expr->unop;
1759                 ctype = create_pointer(expr, ctype, 1);
1760                 expr->ctype = ctype;
1761         default:
1762                 /* nothing */;
1763         }
1764         return ctype;
1765 }
1766 
1767 static struct symbol *evaluate_addressof(struct expression *expr)
1768 {
1769         struct expression *op = expr->unop;
1770         struct symbol *ctype;
1771 
1772         if (op->op != '*' || op->type != EXPR_PREOP) {
1773                 expression_error(expr, "not addressable");
1774                 return NULL;
1775         }
1776         ctype = op->ctype;
1777         *expr = *op->unop;
1778 
1779         if (expr->type == EXPR_SYMBOL) {
1780                 struct symbol *sym = expr->symbol;
1781                 sym->ctype.modifiers |= MOD_ADDRESSABLE;
1782         }
1783 
1784         /*
1785          * symbol expression evaluation is lazy about the type
1786          * of the sub-expression, so we may have to generate
1787          * the type here if so..
1788          */
1789         if (expr->ctype == &lazy_ptr_ctype) {
1790                 ctype = create_pointer(expr, ctype, 0);
1791                 expr->ctype = ctype;
1792         }
1793         return expr->ctype;
1794 }
1795 
1796 
1797 static struct symbol *evaluate_dereference(struct expression *expr)
1798 {
1799         struct expression *op = expr->unop;
1800         struct symbol *ctype = op->ctype, *node, *target;
1801 
1802         /* Simplify: *&(expr) => (expr) */
1803         if (op->type == EXPR_PREOP && op->op == '&') {
1804                 *expr = *op->unop;
1805                 expr->flags = CEF_NONE;
1806                 return expr->ctype;
1807         }
1808 
1809         examine_symbol_type(ctype);
1810 
1811         /* Dereferencing a node drops all the node information. */
1812         if (ctype->type == SYM_NODE)
1813                 ctype = ctype->ctype.base_type;
1814 
1815         target = ctype->ctype.base_type;
1816         examine_symbol_type(target);
1817 
1818         switch (ctype->type) {
1819         default:
1820                 expression_error(expr, "cannot dereference this type");
1821                 return NULL;
1822         case SYM_FN:
1823                 *expr = *op;
1824                 return expr->ctype;
1825         case SYM_PTR:
1826                 node = alloc_symbol(expr->pos, SYM_NODE);
1827                 node->ctype.modifiers = target->ctype.modifiers & MOD_SPECIFIER;
1828                 merge_type(node, ctype);
1829                 break;
1830 
1831         case SYM_ARRAY:
1832                 if (!lvalue_expression(op)) {
1833                         expression_error(op, "non-lvalue array??");
1834                         return NULL;
1835                 }
1836 
1837                 /* Do the implied "addressof" on the array */
1838                 *op = *op->unop;
1839 
1840                 /*
1841                  * When an array is dereferenced, we need to pick
1842                  * up the attributes of the original node too..
1843                  */
1844                 node = alloc_symbol(expr->pos, SYM_NODE);
1845                 merge_type(node, op->ctype);
1846                 merge_type(node, ctype);
1847                 break;
1848         }
1849 
1850         node->bit_size = target->bit_size;
1851         node->array_size = target->array_size;
1852 
1853         expr->ctype = node;
1854         return node;
1855 }
1856 
1857 /*
1858  * Unary post-ops: x++ and x--
1859  */
1860 static struct symbol *evaluate_postop(struct expression *expr)
1861 {
1862         struct expression *op = expr->unop;
1863         struct symbol *ctype = op->ctype;
1864         int class = classify_type(ctype, &ctype);
1865         int multiply = 0;
1866 
1867         if (!class || class & TYPE_COMPOUND) {
1868                 expression_error(expr, "need scalar for ++/--");
1869                 return NULL;
1870         }
1871         if (!lvalue_expression(expr->unop)) {
1872                 expression_error(expr, "need lvalue expression for ++/--");
1873                 return NULL;
1874         }
1875 
1876         if ((class & TYPE_RESTRICT) && restricted_unop(expr->op, &ctype))
1877                 unrestrict(expr, class, &ctype);
1878 
1879         if (class & TYPE_NUM) {
1880                 multiply = 1;
1881         } else if (class == TYPE_PTR) {
1882                 struct symbol *target = examine_pointer_target(ctype);
1883                 if (!is_function(target))
1884                         multiply = bits_to_bytes(target->bit_size);
1885         }
1886 
1887         if (multiply) {
1888                 evaluate_assign_to(op, op->ctype);
1889                 expr->op_value = multiply;
1890                 expr->ctype = ctype;
1891                 return ctype;
1892         }
1893 
1894         expression_error(expr, "bad argument type for ++/--");
1895         return NULL;
1896 }
1897 
1898 static struct symbol *evaluate_sign(struct expression *expr)
1899 {
1900         struct symbol *ctype = expr->unop->ctype;
1901         int class = classify_type(ctype, &ctype);
1902         unsigned char flags = expr->unop->flags & ~CEF_CONST_MASK;
1903 
1904         /* should be an arithmetic type */
1905         if (!(class & TYPE_NUM))
1906                 return bad_expr_type(expr);
1907         if (class & TYPE_RESTRICT)
1908                 goto Restr;
1909 Normal:
1910         if (!(class & TYPE_FLOAT)) {
1911                 ctype = integer_promotion(ctype);
1912                 expr->unop = cast_to(expr->unop, ctype);
1913         } else if (expr->op != '~') {
1914                 /* no conversions needed */
1915         } else {
1916                 return bad_expr_type(expr);
1917         }
1918         if (expr->op == '+')
1919                 *expr = *expr->unop;
1920         expr->flags = flags;
1921         expr->ctype = ctype;
1922         return ctype;
1923 Restr:
1924         if (restricted_unop(expr->op, &ctype))
1925                 unrestrict(expr, class, &ctype);
1926         goto Normal;
1927 }
1928 
1929 static struct symbol *evaluate_preop(struct expression *expr)
1930 {
1931         struct symbol *ctype = expr->unop->ctype;
1932 
1933         switch (expr->op) {
1934         case '(':
1935                 *expr = *expr->unop;
1936                 return ctype;
1937 
1938         case '+':
1939         case '-':
1940         case '~':
1941                 return evaluate_sign(expr);
1942 
1943         case '*':
1944                 return evaluate_dereference(expr);
1945 
1946         case '&':
1947                 return evaluate_addressof(expr);
1948 
1949         case SPECIAL_INCREMENT:
1950         case SPECIAL_DECREMENT:
1951                 /*
1952                  * From a type evaluation standpoint the preops are
1953                  * the same as the postops
1954                  */
1955                 return evaluate_postop(expr);
1956 
1957         case '!':
1958                 ctype = degenerate(expr->unop);
1959                 expr->flags = expr->unop->flags & ~CEF_CONST_MASK;
1960                 /*
1961                  * A logical negation never yields an address constant
1962                  * [6.6(9)].
1963                  */
1964                 expr->flags &= ~CEF_ADDR;
1965 
1966                 if (is_safe_type(ctype))
1967                         warning(expr->pos, "testing a 'safe expression'");
1968                 if (is_float_type(ctype)) {
1969                         struct expression *arg = expr->unop;
1970                         expr->type = EXPR_COMPARE;
1971                         expr->op = SPECIAL_EQUAL;
1972                         expr->left = arg;
1973                         expr->right = alloc_expression(expr->pos, EXPR_FVALUE);
1974                         expr->right->ctype = ctype;
1975                         expr->right->fvalue = 0;
1976                 } else if (is_fouled_type(ctype)) {
1977                         warning(expr->pos, "%s degrades to integer",
1978                                 show_typename(ctype->ctype.base_type));
1979                 }
1980                 /* the result is int [6.5.3.3(5)]*/
1981                 ctype = &int_ctype;
1982                 break;
1983 
1984         default:
1985                 break;
1986         }
1987         expr->ctype = ctype;
1988         return ctype;
1989 }
1990 
1991 struct symbol *find_identifier(struct ident *ident, struct symbol_list *_list, int *offset)
1992 {
1993         struct ptr_list *head = (struct ptr_list *)_list;
1994         struct ptr_list *list = head;
1995 
1996         if (!head)
1997                 return NULL;
1998         do {
1999                 int i;
2000                 for (i = 0; i < list->nr; i++) {
2001                         struct symbol *sym = (struct symbol *) list->list[i];
2002                         if (sym->ident) {
2003                                 if (sym->ident != ident)
2004                                         continue;
2005                                 *offset = sym->offset;
2006                                 return sym;
2007                         } else {
2008                                 struct symbol *ctype = sym->ctype.base_type;
2009                                 struct symbol *sub;
2010                                 if (!ctype)
2011                                         continue;
2012                                 if (ctype->type != SYM_UNION && ctype->type != SYM_STRUCT)
2013                                         continue;
2014                                 sub = find_identifier(ident, ctype->symbol_list, offset);
2015                                 if (!sub)
2016                                         continue;
2017                                 *offset += sym->offset;
2018                                 return sub;
2019                         }       
2020                 }
2021         } while ((list = list->next) != head);
2022         return NULL;
2023 }
2024 
2025 static struct expression *evaluate_offset(struct expression *expr, unsigned long offset)
2026 {
2027         struct expression *add;
2028 
2029         /*
2030          * Create a new add-expression
2031          *
2032          * NOTE! Even if we just add zero, we need a new node
2033          * for the member pointer, since it has a different
2034          * type than the original pointer. We could make that
2035          * be just a cast, but the fact is, a node is a node,
2036          * so we might as well just do the "add zero" here.
2037          */
2038         add = alloc_expression(expr->pos, EXPR_BINOP);
2039         add->op = '+';
2040         add->left = expr;
2041         add->right = alloc_expression(expr->pos, EXPR_VALUE);
2042         add->right->ctype = &int_ctype;
2043         add->right->value = offset;
2044 
2045         /*
2046          * The ctype of the pointer will be lazily evaluated if
2047          * we ever take the address of this member dereference..
2048          */
2049         add->ctype = &lazy_ptr_ctype;
2050         /*
2051          * The resulting address of a member access through an address
2052          * constant is an address constant again [6.6(9)].
2053          */
2054         add->flags = expr->flags;
2055 
2056         return add;
2057 }
2058 
2059 /* structure/union dereference */
2060 static struct symbol *evaluate_member_dereference(struct expression *expr)
2061 {
2062         int offset;
2063         struct symbol *ctype, *member;
2064         struct expression *deref = expr->deref, *add;
2065         struct ident *ident = expr->member;
2066         struct ident *address_space;
2067         unsigned int mod;
2068 
2069         if (!evaluate_expression(deref))
2070                 return NULL;
2071         if (!ident) {
2072                 expression_error(expr, "bad member name");
2073                 return NULL;
2074         }
2075 
2076         ctype = deref->ctype;
2077         examine_symbol_type(ctype);
2078         address_space = ctype->ctype.as;
2079         mod = ctype->ctype.modifiers;
2080         if (ctype->type == SYM_NODE) {
2081                 ctype = ctype->ctype.base_type;
2082                 combine_address_space(deref->pos, &address_space, ctype->ctype.as);
2083                 mod |= ctype->ctype.modifiers;
2084         }
2085         if (!ctype || (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION)) {
2086                 expression_error(expr, "expected structure or union");
2087                 return NULL;
2088         }
2089         offset = 0;
2090         member = find_identifier(ident, ctype->symbol_list, &offset);
2091         if (!member) {
2092                 const char *type = ctype->type == SYM_STRUCT ? "struct" : "union";
2093                 const char *name = "<unnamed>";
2094                 int namelen = 9;
2095                 if (ctype->ident) {
2096                         name = ctype->ident->name;
2097                         namelen = ctype->ident->len;
2098                 }
2099                 if (ctype->symbol_list)
2100                         expression_error(expr, "no member '%s' in %s %.*s",
2101                                 show_ident(ident), type, namelen, name);
2102                 else
2103                         expression_error(expr, "using member '%s' in "
2104                                 "incomplete %s %.*s", show_ident(ident),
2105                                 type, namelen, name);
2106                 return NULL;
2107         }
2108 
2109         /*
2110          * The member needs to take on the address space and modifiers of
2111          * the "parent" type.
2112          */
2113         member = convert_to_as_mod(member, address_space, mod);
2114         ctype = get_base_type(member);
2115 
2116         if (!lvalue_expression(deref)) {
2117                 if (deref->type != EXPR_SLICE) {
2118                         expr->base = deref;
2119                         expr->r_bitpos = 0;
2120                 } else {
2121                         expr->base = deref->base;
2122                         expr->r_bitpos = deref->r_bitpos;
2123                 }
2124                 expr->r_bitpos += bytes_to_bits(offset);
2125                 expr->type = EXPR_SLICE;
2126                 expr->r_nrbits = member->bit_size;
2127                 expr->r_bitpos += member->bit_offset;
2128                 expr->ctype = member;
2129                 return member;
2130         }
2131 
2132         deref = deref->unop;
2133         expr->deref = deref;
2134 
2135         add = evaluate_offset(deref, offset);
2136         expr->type = EXPR_PREOP;
2137         expr->op = '*';
2138         expr->unop = add;
2139 
2140         expr->ctype = member;
2141         return member;
2142 }
2143 
2144 static int is_promoted(struct expression *expr)
2145 {
2146         while (1) {
2147                 switch (expr->type) {
2148                 case EXPR_BINOP:
2149                 case EXPR_SELECT:
2150                 case EXPR_CONDITIONAL:
2151                         return 1;
2152                 case EXPR_COMMA:
2153                         expr = expr->right;
2154                         continue;
2155                 case EXPR_PREOP:
2156                         switch (expr->op) {
2157                         case '(':
2158                                 expr = expr->unop;
2159                                 continue;
2160                         case '+':
2161                         case '-':
2162                         case '~':
2163                                 return 1;
2164                         default:
2165                                 return 0;
2166                         }
2167                 default:
2168                         return 0;
2169                 }
2170         }
2171 }
2172 
2173 
2174 static struct symbol *evaluate_cast(struct expression *);
2175 
2176 static struct symbol *evaluate_type_information(struct expression *expr)
2177 {
2178         struct symbol *sym = expr->cast_type;
2179         if (!sym) {
2180                 sym = evaluate_expression(expr->cast_expression);
2181                 if (!sym)
2182                         return NULL;
2183                 /*
2184                  * Expressions of restricted types will possibly get
2185                  * promoted - check that here
2186                  */
2187                 if (is_restricted_type(sym)) {
2188                         if (sym->bit_size < bits_in_int && is_promoted(expr))
2189                                 sym = &int_ctype;
2190                 } else if (is_fouled_type(sym)) {
2191                         sym = &int_ctype;
2192                 }
2193         }
2194         examine_symbol_type(sym);
2195         if (is_bitfield_type(sym)) {
2196                 expression_error(expr, "trying to examine bitfield type");
2197                 return NULL;
2198         }
2199         return sym;
2200 }
2201 
2202 static struct symbol *evaluate_sizeof(struct expression *expr)
2203 {
2204         struct symbol *type;
2205         int size;
2206 
2207         type = evaluate_type_information(expr);
2208         if (!type)
2209                 return NULL;
2210 
2211         size = type->bit_size;
2212 
2213         if (size < 0 && is_void_type(type)) {
2214                 if (Wpointer_arith)
2215                         warning(expr->pos, "expression using sizeof(void)");
2216                 size = bits_in_char;
2217         }
2218 
2219         if (is_bool_type(type)) {
2220                 if (Wsizeof_bool)
2221                         warning(expr->pos, "expression using sizeof _Bool");
2222                 size = bits_to_bytes(bits_in_bool) * bits_in_char;
2223         }
2224 
2225         if (is_function(type->ctype.base_type)) {
2226                 if (Wpointer_arith)
2227                         warning(expr->pos, "expression using sizeof on a function");
2228                 size = bits_in_char;
2229         }
2230 
2231         if (is_array_type(type) && size < 0) {       // VLA, 1-dimension only
2232                 struct expression *base, *size;
2233                 struct symbol *base_type;
2234 
2235                 if (type->type == SYM_NODE)
2236                         type = type->ctype.base_type;        // strip the SYM_NODE
2237                 base_type = get_base_type(type);
2238                 if (!base_type)
2239                         goto error;
2240                 if (base_type->bit_size <= 0) {
2241                         base = alloc_expression(expr->pos, EXPR_SIZEOF);
2242                         base->cast_type = base_type;
2243                         if (!evaluate_sizeof(base))
2244                                 goto error;
2245                 } else {
2246                         base = alloc_expression(expr->pos, EXPR_VALUE);
2247                         base->value = bits_to_bytes(base_type->bit_size);
2248                         base->ctype = size_t_ctype;
2249                 }
2250                 size = alloc_expression(expr->pos, EXPR_CAST);
2251                 size->cast_type = size_t_ctype;
2252                 size->cast_expression = type->array_size;
2253                 if (!evaluate_expression(size))
2254                         goto error;
2255                 expr->left = size;
2256                 expr->right = base;
2257                 expr->type = EXPR_BINOP;
2258                 expr->op = '*';
2259                 return expr->ctype = size_t_ctype;
2260         }
2261 
2262 error:
2263         if ((size < 0) || (size & (bits_in_char - 1)))
2264                 expression_error(expr, "cannot size expression");
2265 
2266         expr->type = EXPR_VALUE;
2267         expr->value = bits_to_bytes(size);
2268         expr->taint = 0;
2269         expr->ctype = size_t_ctype;
2270         return size_t_ctype;
2271 }
2272 
2273 static struct symbol *evaluate_ptrsizeof(struct expression *expr)
2274 {
2275         struct symbol *type;
2276         int size;
2277 
2278         type = evaluate_type_information(expr);
2279         if (!type)
2280                 return NULL;
2281 
2282         if (type->type == SYM_NODE)
2283                 type = type->ctype.base_type;
2284         if (!type)
2285                 return NULL;
2286         switch (type->type) {
2287         case SYM_ARRAY:
2288                 break;
2289         case SYM_PTR:
2290                 type = get_base_type(type);
2291                 if (type)
2292                         break;
2293         default:
2294                 expression_error(expr, "expected pointer expression");
2295                 return NULL;
2296         }
2297         size = type->bit_size;
2298         if (size & (bits_in_char-1))
2299                 size = 0;
2300         expr->type = EXPR_VALUE;
2301         expr->value = bits_to_bytes(size);
2302         expr->taint = 0;
2303         expr->ctype = size_t_ctype;
2304         return size_t_ctype;
2305 }
2306 
2307 static struct symbol *evaluate_alignof(struct expression *expr)
2308 {
2309         struct symbol *type;
2310 
2311         type = evaluate_type_information(expr);
2312         if (!type)
2313                 return NULL;
2314 
2315         expr->type = EXPR_VALUE;
2316         expr->value = type->ctype.alignment;
2317         expr->taint = 0;
2318         expr->ctype = size_t_ctype;
2319         return size_t_ctype;
2320 }
2321 
2322 static int evaluate_arguments(struct symbol *fn, struct expression_list *head)
2323 {
2324         struct expression *expr;
2325         struct symbol_list *argument_types = fn->arguments;
2326         struct symbol *argtype;
2327         int i = 1;
2328 
2329         PREPARE_PTR_LIST(argument_types, argtype);
2330         FOR_EACH_PTR (head, expr) {
2331                 struct expression **p = THIS_ADDRESS(expr);
2332                 struct symbol *ctype, *target;
2333                 ctype = evaluate_expression(expr);
2334 
2335                 if (!ctype)
2336                         return 0;
2337 
2338                 target = argtype;
2339                 if (!target) {
2340                         struct symbol *type;
2341                         int class = classify_type(ctype, &type);
2342                         if (is_int(class)) {
2343                                 *p = cast_to(expr, integer_promotion(type));
2344                         } else if (class & TYPE_FLOAT) {
2345                                 unsigned long mod = type->ctype.modifiers;
2346                                 if (!(mod & (MOD_LONG_ALL)))
2347                                         *p = cast_to(expr, &double_ctype);
2348                         } else if (class & TYPE_PTR) {
2349                                 if (expr->ctype == &null_ctype)
2350                                         *p = cast_to(expr, &ptr_ctype);
2351                                 else
2352                                         degenerate(expr);
2353                         }
2354                 } else if (!target->forced_arg){
2355                         static char where[30];
2356                         examine_symbol_type(target);
2357                         sprintf(where, "argument %d", i);
2358                         compatible_argument_type(expr, target, p, where);
2359                 }
2360 
2361                 i++;
2362                 NEXT_PTR_LIST(argtype);
2363         } END_FOR_EACH_PTR(expr);
2364         FINISH_PTR_LIST(argtype);
2365         return 1;
2366 }
2367 
2368 static void convert_index(struct expression *e)
2369 {
2370         struct expression *child = e->idx_expression;
2371         unsigned from = e->idx_from;
2372         unsigned to = e->idx_to + 1;
2373         e->type = EXPR_POS;
2374         e->init_offset = from * bits_to_bytes(e->ctype->bit_size);
2375         e->init_nr = to - from;
2376         e->init_expr = child;
2377 }
2378 
2379 static void convert_ident(struct expression *e)
2380 {
2381         struct expression *child = e->ident_expression;
2382         int offset = e->offset;
2383 
2384         e->type = EXPR_POS;
2385         e->init_offset = offset;
2386         e->init_nr = 1;
2387         e->init_expr = child;
2388 }
2389 
2390 static void convert_designators(struct expression *e)
2391 {
2392         while (e) {
2393                 if (e->type == EXPR_INDEX)
2394                         convert_index(e);
2395                 else if (e->type == EXPR_IDENTIFIER)
2396                         convert_ident(e);
2397                 else
2398                         break;
2399                 e = e->init_expr;
2400         }
2401 }
2402 
2403 static void excess(struct expression *e, const char *s)
2404 {
2405         warning(e->pos, "excessive elements in %s initializer", s);
2406 }
2407 
2408 /*
2409  * implicit designator for the first element
2410  */
2411 static struct expression *first_subobject(struct symbol *ctype, int class,
2412                                           struct expression **v)
2413 {
2414         struct expression *e = *v, *new;
2415 
2416         if (ctype->type == SYM_NODE)
2417                 ctype = ctype->ctype.base_type;
2418 
2419         if (class & TYPE_PTR) { /* array */
2420                 if (!ctype->bit_size)
2421                         return NULL;
2422                 new = alloc_expression(e->pos, EXPR_INDEX);
2423                 new->idx_expression = e;
2424                 new->ctype = ctype->ctype.base_type;
2425         } else  {
2426                 struct symbol *field, *p;
2427                 PREPARE_PTR_LIST(ctype->symbol_list, p);
2428                 while (p && !p->ident && is_bitfield_type(p))
2429                         NEXT_PTR_LIST(p);
2430                 field = p;
2431                 FINISH_PTR_LIST(p);
2432                 if (!field)
2433                         return NULL;
2434                 new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2435                 new->ident_expression = e;
2436                 new->field = new->ctype = field;
2437                 new->offset = field->offset;
2438         }
2439         *v = new;
2440         return new;
2441 }
2442 
2443 /*
2444  * sanity-check explicit designators; return the innermost one or NULL
2445  * in case of error.  Assign types.
2446  */
2447 static struct expression *check_designators(struct expression *e,
2448                                             struct symbol *ctype)
2449 {
2450         struct expression *last = NULL;
2451         const char *err;
2452         while (1) {
2453                 if (ctype->type == SYM_NODE)
2454                         ctype = ctype->ctype.base_type;
2455                 if (e->type == EXPR_INDEX) {
2456                         struct symbol *type;
2457                         if (ctype->type != SYM_ARRAY) {
2458                                 err = "array index in non-array";
2459                                 break;
2460                         }
2461                         type = ctype->ctype.base_type;
2462                         if (ctype->bit_size >= 0 && type->bit_size >= 0) {
2463                                 unsigned offset = array_element_offset(type->bit_size, e->idx_to);
2464                                 if (offset >= ctype->bit_size) {
2465                                         err = "index out of bounds in";
2466                                         break;
2467                                 }
2468                         }
2469                         e->ctype = ctype = type;
2470                         ctype = type;
2471                         last = e;
2472                         if (!e->idx_expression) {
2473                                 err = "invalid";
2474                                 break;
2475                         }
2476                         e = e->idx_expression;
2477                 } else if (e->type == EXPR_IDENTIFIER) {
2478                         int offset = 0;
2479                         if (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION) {
2480                                 err = "field name not in struct or union";
2481                                 break;
2482                         }
2483                         ctype = find_identifier(e->expr_ident, ctype->symbol_list, &offset);
2484                         if (!ctype) {
2485                                 err = "unknown field name in";
2486                                 break;
2487                         }
2488                         e->offset = offset;
2489                         e->field = e->ctype = ctype;
2490                         last = e;
2491                         if (!e->ident_expression) {
2492                                 err = "invalid";
2493                                 break;
2494                         }
2495                         e = e->ident_expression;
2496                 } else if (e->type == EXPR_POS) {
2497                         err = "internal front-end error: EXPR_POS in";
2498                         break;
2499                 } else
2500                         return last;
2501         }
2502         expression_error(e, "%s initializer", err);
2503         return NULL;
2504 }
2505 
2506 /*
2507  * choose the next subobject to initialize.
2508  *
2509  * Get designators for next element, switch old ones to EXPR_POS.
2510  * Return the resulting expression or NULL if we'd run out of subobjects.
2511  * The innermost designator is returned in *v.  Designators in old
2512  * are assumed to be already sanity-checked.
2513  */
2514 static struct expression *next_designators(struct expression *old,
2515                              struct symbol *ctype,
2516                              struct expression *e, struct expression **v)
2517 {
2518         struct expression *new = NULL;
2519 
2520         if (!old)
2521                 return NULL;
2522         if (old->type == EXPR_INDEX) {
2523                 struct expression *copy;
2524                 unsigned n;
2525 
2526                 copy = next_designators(old->idx_expression,
2527                                         old->ctype, e, v);
2528                 if (!copy) {
2529                         n = old->idx_to + 1;
2530                         if (array_element_offset(old->ctype->bit_size, n) == ctype->bit_size) {
2531                                 convert_index(old);
2532                                 return NULL;
2533                         }
2534                         copy = e;
2535                         *v = new = alloc_expression(e->pos, EXPR_INDEX);
2536                 } else {
2537                         n = old->idx_to;
2538                         new = alloc_expression(e->pos, EXPR_INDEX);
2539                 }
2540 
2541                 new->idx_from = new->idx_to = n;
2542                 new->idx_expression = copy;
2543                 new->ctype = old->ctype;
2544                 convert_index(old);
2545         } else if (old->type == EXPR_IDENTIFIER) {
2546                 struct expression *copy;
2547                 struct symbol *field;
2548                 int offset = 0;
2549 
2550                 copy = next_designators(old->ident_expression,
2551                                         old->ctype, e, v);
2552                 if (!copy) {
2553                         field = old->field->next_subobject;
2554                         if (!field) {
2555                                 convert_ident(old);
2556                                 return NULL;
2557                         }
2558                         copy = e;
2559                         *v = new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2560                         /*
2561                          * We can't necessarily trust "field->offset",
2562                          * because the field might be in an anonymous
2563                          * union, and the field offset is then the offset
2564                          * within that union.
2565                          *
2566                          * The "old->offset - old->field->offset"
2567                          * would be the offset of such an anonymous
2568                          * union.
2569                          */
2570                         offset = old->offset - old->field->offset;
2571                 } else {
2572                         field = old->field;
2573                         new = alloc_expression(e->pos, EXPR_IDENTIFIER);
2574                 }
2575 
2576                 new->field = field;
2577                 new->expr_ident = field->ident;
2578                 new->ident_expression = copy;
2579                 new->ctype = field;
2580                 new->offset = field->offset + offset;
2581                 convert_ident(old);
2582         }
2583         return new;
2584 }
2585 
2586 static int handle_initializer(struct expression **ep, int nested,
2587                 int class, struct symbol *ctype, unsigned long mods);
2588 
2589 /*
2590  * deal with traversing subobjects [6.7.8(17,18,20)]
2591  */
2592 static void handle_list_initializer(struct expression *expr,
2593                 int class, struct symbol *ctype, unsigned long mods)
2594 {
2595         struct expression *e, *last = NULL, *top = NULL, *next;
2596         int jumped = 0;
2597 
2598         FOR_EACH_PTR(expr->expr_list, e) {
2599                 struct expression **v;
2600                 struct symbol *type;
2601                 int lclass;
2602 
2603                 if (e->type != EXPR_INDEX && e->type != EXPR_IDENTIFIER) {
2604                         struct symbol *struct_sym;
2605                         if (!top) {
2606                                 top = e;
2607                                 last = first_subobject(ctype, class, &top);
2608                         } else {
2609                                 last = next_designators(last, ctype, e, &top);
2610                         }
2611                         if (!last) {
2612                                 excess(e, class & TYPE_PTR ? "array" :
2613                                                         "struct or union");
2614                                 DELETE_CURRENT_PTR(e);
2615                                 continue;
2616                         }
2617                         struct_sym = ctype->type == SYM_NODE ? ctype->ctype.base_type : ctype;
2618                         if (Wdesignated_init && struct_sym->designated_init)
2619                                 warning(e->pos, "%s%.*s%spositional init of field in %s %s, declared with attribute designated_init",
2620                                         ctype->ident ? "in initializer for " : "",
2621                                         ctype->ident ? ctype->ident->len : 0,
2622                                         ctype->ident ? ctype->ident->name : "",
2623                                         ctype->ident ? ": " : "",
2624                                         get_type_name(struct_sym->type),
2625                                         show_ident(struct_sym->ident));
2626                         if (jumped) {
2627                                 warning(e->pos, "advancing past deep designator");
2628                                 jumped = 0;
2629                         }
2630                         REPLACE_CURRENT_PTR(e, last);
2631                 } else {
2632                         next = check_designators(e, ctype);
2633                         if (!next) {
2634                                 DELETE_CURRENT_PTR(e);
2635                                 continue;
2636                         }
2637                         top = next;
2638                         /* deeper than one designator? */
2639                         jumped = top != e;
2640                         convert_designators(last);
2641                         last = e;
2642                 }
2643 
2644 found:
2645                 lclass = classify_type(top->ctype, &type);
2646                 if (top->type == EXPR_INDEX)
2647                         v = &top->idx_expression;
2648                 else
2649                         v = &top->ident_expression;
2650 
2651                 mods |= ctype->ctype.modifiers & MOD_STORAGE;
2652                 if (handle_initializer(v, 1, lclass, top->ctype, mods))
2653                         continue;
2654 
2655                 if (!(lclass & TYPE_COMPOUND)) {
2656                         warning(e->pos, "bogus scalar initializer");
2657                         DELETE_CURRENT_PTR(e);
2658                         continue;
2659                 }
2660 
2661                 next = first_subobject(type, lclass, v);
2662                 if (next) {
2663                         warning(e->pos, "missing braces around initializer");
2664                         top = next;
2665                         goto found;
2666                 }
2667 
2668                 DELETE_CURRENT_PTR(e);
2669                 excess(e, lclass & TYPE_PTR ? "array" : "struct or union");
2670 
2671         } END_FOR_EACH_PTR(e);
2672 
2673         convert_designators(last);
2674         expr->ctype = ctype;
2675 }
2676 
2677 static int is_string_literal(struct expression **v)
2678 {
2679         struct expression *e = *v;
2680         while (e && e->type == EXPR_PREOP && e->op == '(')
2681                 e = e->unop;
2682         if (!e || e->type != EXPR_STRING)
2683                 return 0;
2684         if (e != *v && Wparen_string)
2685                 warning(e->pos,
2686                         "array initialized from parenthesized string constant");
2687         *v = e;
2688         return 1;
2689 }
2690 
2691 /*
2692  * We want a normal expression, possibly in one layer of braces.  Warn
2693  * if the latter happens inside a list (it's legal, but likely to be
2694  * an effect of screwup).  In case of anything not legal, we are definitely
2695  * having an effect of screwup, so just fail and let the caller warn.
2696  */
2697 static struct expression *handle_scalar(struct expression *e, int nested)
2698 {
2699         struct expression *v = NULL, *p;
2700         int count = 0;
2701 
2702         /* normal case */
2703         if (e->type != EXPR_INITIALIZER)
2704                 return e;
2705 
2706         FOR_EACH_PTR(e->expr_list, p) {
2707                 if (!v)
2708                         v = p;
2709                 count++;
2710         } END_FOR_EACH_PTR(p);
2711         if (count != 1)
2712                 return NULL;
2713         switch(v->type) {
2714         case EXPR_INITIALIZER:
2715         case EXPR_INDEX:
2716         case EXPR_IDENTIFIER:
2717                 return NULL;
2718         default:
2719                 break;
2720         }
2721         if (nested)
2722                 warning(e->pos, "braces around scalar initializer");
2723         return v;
2724 }
2725 
2726 /*
2727  * deal with the cases that don't care about subobjects:
2728  * scalar <- assignment expression, possibly in braces [6.7.8(11)]
2729  * character array <- string literal, possibly in braces [6.7.8(14)]
2730  * struct or union <- assignment expression of compatible type [6.7.8(13)]
2731  * compound type <- initializer list in braces [6.7.8(16)]
2732  * The last one punts to handle_list_initializer() which, in turn will call
2733  * us for individual elements of the list.
2734  *
2735  * We do not handle 6.7.8(15) (wide char array <- wide string literal) for
2736  * the lack of support of wide char stuff in general.
2737  *
2738  * One note: we need to take care not to evaluate a string literal until
2739  * we know that we *will* handle it right here.  Otherwise we would screw
2740  * the cases like struct { struct {char s[10]; ...} ...} initialized with
2741  * { "string", ...} - we need to preserve that string literal recognizable
2742  * until we dig into the inner struct.
2743  */
2744 static int handle_initializer(struct expression **ep, int nested,
2745                 int class, struct symbol *ctype, unsigned long mods)
2746 {
2747         int is_string = is_string_type(ctype);
2748         struct expression *e = *ep, *p;
2749         struct symbol *type;
2750 
2751         if (!e)
2752                 return 0;
2753 
2754         /* scalar */
2755         if (!(class & TYPE_COMPOUND)) {
2756                 e = handle_scalar(e, nested);
2757                 if (!e)
2758                         return 0;
2759                 *ep = e;
2760                 if (!evaluate_expression(e))
2761                         return 1;
2762                 compatible_assignment_types(e, ctype, ep, "initializer");
2763                 /*
2764                  * Initializers for static storage duration objects
2765                  * shall be constant expressions or a string literal [6.7.8(4)].
2766                  */
2767                 mods |= ctype->ctype.modifiers;
2768                 mods &= (MOD_TOPLEVEL | MOD_STATIC);
2769                 if (mods && !(e->flags & (CEF_ACE | CEF_ADDR)))
2770                         if (Wconstexpr_not_const)
2771                                 warning(e->pos, "non-constant initializer for static object");
2772 
2773                 return 1;
2774         }
2775 
2776         /*
2777          * sublist; either a string, or we dig in; the latter will deal with
2778          * pathologies, so we don't need anything fancy here.
2779          */
2780         if (e->type == EXPR_INITIALIZER) {
2781                 if (is_string) {
2782                         struct expression *v = NULL;
2783                         int count = 0;
2784 
2785                         FOR_EACH_PTR(e->expr_list, p) {
2786                                 if (!v)
2787                                         v = p;
2788                                 count++;
2789                         } END_FOR_EACH_PTR(p);
2790                         if (count == 1 && is_string_literal(&v)) {
2791                                 *ep = e = v;
2792                                 goto String;
2793                         }
2794                 }
2795                 handle_list_initializer(e, class, ctype, mods);
2796                 return 1;
2797         }
2798 
2799         /* string */
2800         if (is_string_literal(&e)) {
2801                 /* either we are doing array of char, or we'll have to dig in */
2802                 if (is_string) {
2803                         *ep = e;
2804                         goto String;
2805                 }
2806                 return 0;
2807         }
2808         /* struct or union can be initialized by compatible */
2809         if (class != TYPE_COMPOUND)
2810                 return 0;
2811         type = evaluate_expression(e);
2812         if (!type)
2813                 return 0;
2814         if (ctype->type == SYM_NODE)
2815                 ctype = ctype->ctype.base_type;
2816         if (type->type == SYM_NODE)
2817                 type = type->ctype.base_type;
2818         if (ctype == type)
2819                 return 1;
2820         return 0;
2821 
2822 String:
2823         p = alloc_expression(e->pos, EXPR_STRING);
2824         *p = *e;
2825         type = evaluate_expression(p);
2826         if (ctype->bit_size != -1) {
2827                 if (ctype->bit_size + bits_in_char < type->bit_size)
2828                         warning(e->pos,
2829                                 "too long initializer-string for array of char");
2830                 else if (Winit_cstring && ctype->bit_size + bits_in_char == type->bit_size) {
2831                         warning(e->pos,
2832                                 "too long initializer-string for array of char(no space for nul char)");
2833                 }
2834         }
2835         *ep = p;
2836         return 1;
2837 }
2838 
2839 static void evaluate_initializer(struct symbol *ctype, struct expression **ep)
2840 {
2841         struct symbol *type;
2842         int class = classify_type(ctype, &type);
2843         if (!handle_initializer(ep, 0, class, ctype, 0))
2844                 expression_error(*ep, "invalid initializer");
2845 }
2846 
2847 static struct symbol *cast_to_bool(struct expression *expr)
2848 {
2849         struct expression *old = expr->cast_expression;
2850         struct expression *zero;
2851         struct symbol *otype;
2852         int oclass = classify_type(degenerate(old), &otype);
2853         struct symbol *ctype;
2854 
2855         if (oclass & TYPE_COMPOUND)
2856                 return NULL;
2857 
2858         zero = alloc_const_expression(expr->pos, 0);
2859         expr->op = SPECIAL_NOTEQUAL;
2860         ctype = usual_conversions(expr->op, old, zero,
2861                         oclass, TYPE_NUM, otype, zero->ctype);
2862         expr->type = EXPR_COMPARE;
2863         expr->left = cast_to(old, ctype);
2864         expr->right = cast_to(zero, ctype);
2865 
2866         return expr->ctype;
2867 }
2868 
2869 static int cast_flags(struct expression *expr, struct expression *old)
2870 {
2871         struct symbol *t;
2872         int class;
2873         int flags = CEF_NONE;
2874 
2875         class = classify_type(expr->ctype, &t);
2876         if (class & TYPE_NUM) {
2877                 flags = old->flags & ~CEF_CONST_MASK;
2878                 /*
2879                  * Casts to numeric types never result in address
2880                  * constants [6.6(9)].
2881                  */
2882                 flags &= ~CEF_ADDR;
2883 
2884                 /*
2885                  * As an extension, treat address constants cast to
2886                  * integer type as an arithmetic constant.
2887                  */
2888                 if (old->flags & CEF_ADDR)
2889                         flags = CEF_ACE;
2890 
2891                 /*
2892                  * Cast to float type -> not an integer constant
2893                  * expression [6.6(6)].
2894                  */
2895                 if (class & TYPE_FLOAT)
2896                         flags &= ~CEF_CLR_ICE;
2897                 /*
2898                  * Casts of float literals to integer type results in
2899                  * a constant integer expression [6.6(6)].
2900                  */
2901                 else if (old->flags & CEF_FLOAT)
2902                         flags = CEF_SET_ICE;
2903         } else if (class & TYPE_PTR) {
2904                 /*
2905                  * Casts of integer literals to pointer type yield
2906                  * address constants [6.6(9)].
2907                  *
2908                  * As an extension, treat address constants cast to a
2909                  * different pointer type as address constants again.
2910                  *
2911                  * As another extension, treat integer constant
2912                  * expressions (in contrast to literals) cast to
2913                  * pointer type as address constants.
2914                  */
2915                 if (old->flags & (CEF_ICE | CEF_ADDR))
2916                         flags = CEF_ADDR;
2917         }
2918 
2919         return flags;
2920 }
2921 
2922 static struct symbol *evaluate_cast(struct expression *expr)
2923 {
2924         struct expression *source = expr->cast_expression;
2925         struct symbol *ctype;
2926         struct symbol *ttype, *stype;
2927         int tclass, sclass;
2928         struct ident *tas = NULL, *sas = NULL;
2929 
2930         if (!source)
2931                 return NULL;
2932 
2933         /*
2934          * Special case: a cast can be followed by an
2935          * initializer, in which case we need to pass
2936          * the type value down to that initializer rather
2937          * than trying to evaluate it as an expression
2938          *
2939          * A more complex case is when the initializer is
2940          * dereferenced as part of a post-fix expression.
2941          * We need to produce an expression that can be dereferenced.
2942          */
2943         if (source->type == EXPR_INITIALIZER) {
2944                 struct symbol *sym = expr->cast_type;
2945                 struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
2946 
2947                 sym->initializer = source;
2948                 evaluate_symbol(sym);
2949 
2950                 addr->ctype = &lazy_ptr_ctype;   /* Lazy eval */
2951                 addr->symbol = sym;
2952                 if (sym->ctype.modifiers & MOD_TOPLEVEL)
2953                         addr->flags |= CEF_ADDR;
2954 
2955                 expr->type = EXPR_PREOP;
2956                 expr->op = '*';
2957                 expr->unop = addr;
2958                 expr->ctype = sym;
2959 
2960                 return sym;
2961         }
2962 
2963         ctype = examine_symbol_type(expr->cast_type);
2964         expr->ctype = ctype;
2965         expr->cast_type = ctype;
2966 
2967         evaluate_expression(source);
2968         degenerate(source);
2969 
2970         tclass = classify_type(ctype, &ttype);
2971 
2972         expr->flags = cast_flags(expr, source);
2973 
2974         /*
2975          * You can always throw a value away by casting to
2976          * "void" - that's an implicit "force". Note that
2977          * the same is _not_ true of "void *".
2978          */
2979         if (ttype == &void_ctype)
2980                 goto out;
2981 
2982         stype = source->ctype;
2983         if (!stype) {
2984                 expression_error(expr, "cast from unknown type");
2985                 goto out;
2986         }
2987         sclass = classify_type(stype, &stype);
2988 
2989         if (expr->type == EXPR_FORCE_CAST)
2990                 goto out;
2991 
2992         if (tclass & (TYPE_COMPOUND | TYPE_FN))
2993                 warning(expr->pos, "cast to non-scalar");
2994 
2995         if (sclass & TYPE_COMPOUND)
2996                 warning(expr->pos, "cast from non-scalar");
2997 
2998         /* allowed cast unfouls */
2999         if (sclass & TYPE_FOULED)
3000                 stype = unfoul(stype);
3001 
3002         if (ttype != stype) {
3003                 if ((tclass & TYPE_RESTRICT) && restricted_value(source, ttype))
3004                         warning(expr->pos, "cast to %s",
3005                                 show_typename(ttype));
3006                 if (sclass & TYPE_RESTRICT) {
3007                         if (ttype == &bool_ctype) {
3008                                 if (sclass & TYPE_FOULED)
3009                                         warning(expr->pos, "%s degrades to integer",
3010                                                 show_typename(stype));
3011                         } else {
3012                                 warning(expr->pos, "cast from %s",
3013                                         show_typename(stype));
3014                         }
3015                 }
3016         }
3017 
3018         if ((ttype == &ulong_ctype || ttype == uintptr_ctype) && !Wcast_from_as)
3019                 tas = &bad_address_space;
3020         else if (tclass == TYPE_PTR) {
3021                 examine_pointer_target(ttype);
3022                 tas = ttype->ctype.as;
3023         }
3024 
3025         if ((stype == &ulong_ctype || stype == uintptr_ctype))
3026                 sas = &bad_address_space;
3027         else if (sclass == TYPE_PTR) {
3028                 examine_pointer_target(stype);
3029                 sas = stype->ctype.as;
3030         }
3031 
3032         if (!tas && valid_as(sas))
3033                 warning(expr->pos, "cast removes address space '%s' of expression", show_as(sas));
3034         if (valid_as(tas) && valid_as(sas) && tas != sas)
3035                 warning(expr->pos, "cast between address spaces (%s -> %s)", show_as(sas), show_as(tas));
3036         if (valid_as(tas) && !sas &&
3037             !is_null_pointer_constant(source) && Wcast_to_as)
3038                 warning(expr->pos,
3039                         "cast adds address space '%s' to expression", show_as(tas));
3040 
3041         if (!(ttype->ctype.modifiers & MOD_PTRINHERIT) && tclass == TYPE_PTR &&
3042             !tas && (source->flags & CEF_ICE)) {
3043                 if (ttype->ctype.base_type == &void_ctype) {
3044                         if (is_zero_constant(source)) {
3045                                 /* NULL */
3046                                 expr->type = EXPR_VALUE;
3047                                 expr->ctype = &null_ctype;
3048                                 expr->value = 0;
3049                                 return expr->ctype;
3050                         }
3051                 }
3052         }
3053 
3054         if (ttype == &bool_ctype)
3055                 cast_to_bool(expr);
3056 
3057         // checks pointers to restricted
3058         while (Wbitwise_pointer && tclass == TYPE_PTR && sclass == TYPE_PTR) {
3059                 tclass = classify_type(ttype->ctype.base_type, &ttype);
3060                 sclass = classify_type(stype->ctype.base_type, &stype);
3061                 if (ttype == stype)
3062                         break;
3063                 if (!ttype || !stype)
3064                         break;
3065                 if (ttype == &void_ctype || stype == &void_ctype)
3066                         break;
3067                 if (tclass & TYPE_RESTRICT) {
3068                         warning(expr->pos, "cast to %s", show_typename(ctype));
3069                         break;
3070                 }
3071                 if (sclass & TYPE_RESTRICT) {
3072                         warning(expr->pos, "cast from %s", show_typename(source->ctype));
3073                         break;
3074                 }
3075         }
3076 out:
3077         return ctype;
3078 }
3079 
3080 /*
3081  * Evaluate a call expression with a symbol. This
3082  * should expand inline functions, and evaluate
3083  * builtins.
3084  */
3085 static int evaluate_symbol_call(struct expression *expr)
3086 {
3087         struct expression *fn = expr->fn;
3088         struct symbol *ctype = fn->ctype;
3089 
3090         if (fn->type != EXPR_PREOP)
3091                 return 0;
3092 
3093         if (ctype->op && ctype->op->evaluate)
3094                 return ctype->op->evaluate(expr);
3095 
3096         if (ctype->ctype.modifiers & MOD_INLINE) {
3097                 int ret;
3098                 struct symbol *curr = current_fn;
3099 
3100                 if (ctype->definition)
3101                         ctype = ctype->definition;
3102 
3103                 current_fn = ctype->ctype.base_type;
3104 
3105                 ret = inline_function(expr, ctype);
3106 
3107                 /* restore the old function */
3108                 current_fn = curr;
3109                 return ret;
3110         }
3111 
3112         return 0;
3113 }
3114 
3115 static struct symbol *evaluate_call(struct expression *expr)
3116 {
3117         int args, fnargs;
3118         struct symbol *ctype, *sym;
3119         struct expression *fn = expr->fn;
3120         struct expression_list *arglist = expr->args;
3121 
3122         if (!evaluate_expression(fn))
3123                 return NULL;
3124         sym = ctype = fn->ctype;
3125         if (ctype->type == SYM_NODE)
3126                 ctype = ctype->ctype.base_type;
3127         if (ctype->type == SYM_PTR)
3128                 ctype = get_base_type(ctype);
3129 
3130         if (ctype->type != SYM_FN) {
3131                 struct expression *arg;
3132                 expression_error(expr, "not a function %s",
3133                              show_ident(sym->ident));
3134                 /* do typechecking in arguments */
3135                 FOR_EACH_PTR (arglist, arg) {
3136                         evaluate_expression(arg);
3137                 } END_FOR_EACH_PTR(arg);
3138                 return NULL;
3139         }
3140 
3141         examine_fn_arguments(ctype);
3142         if (sym->type == SYM_NODE && fn->type == EXPR_PREOP &&
3143             sym->op && sym->op->args) {
3144                 if (!sym->op->args(expr))
3145                         return NULL;
3146         } else {
3147                 if (!evaluate_arguments(ctype, arglist))
3148                         return NULL;
3149                 args = expression_list_size(expr->args);
3150                 fnargs = symbol_list_size(ctype->arguments);
3151                 if (args < fnargs) {
3152                         expression_error(expr,
3153                                      "not enough arguments for function %s",
3154                                      show_ident(sym->ident));
3155                         return NULL;
3156                 }
3157                 if (args > fnargs && !ctype->variadic)
3158                         expression_error(expr,
3159                                      "too many arguments for function %s",
3160                                      show_ident(sym->ident));
3161         }
3162         expr->ctype = ctype->ctype.base_type;
3163         if (sym->type == SYM_NODE) {
3164                 if (evaluate_symbol_call(expr))
3165                         return expr->ctype;
3166         }
3167         return expr->ctype;
3168 }
3169 
3170 static struct symbol *evaluate_offsetof(struct expression *expr)
3171 {
3172         struct expression *e = expr->down;
3173         struct symbol *ctype = expr->in;
3174         int class;
3175 
3176         if (expr->op == '.') {
3177                 struct symbol *field;
3178                 int offset = 0;
3179                 if (!ctype) {
3180                         expression_error(expr, "expected structure or union");
3181                         return NULL;
3182                 }
3183                 examine_symbol_type(ctype);
3184                 class = classify_type(ctype, &ctype);
3185                 if (class != TYPE_COMPOUND) {
3186                         expression_error(expr, "expected structure or union");
3187                         return NULL;
3188                 }
3189 
3190                 field = find_identifier(expr->ident, ctype->symbol_list, &offset);
3191                 if (!field) {
3192                         expression_error(expr, "unknown member");
3193                         return NULL;
3194                 }
3195                 ctype = field;
3196                 expr->type = EXPR_VALUE;
3197                 expr->flags = CEF_SET_ICE;
3198                 expr->value = offset;
3199                 expr->taint = 0;
3200                 expr->ctype = size_t_ctype;
3201         } else {
3202                 if (!ctype) {
3203                         expression_error(expr, "expected structure or union");
3204                         return NULL;
3205                 }
3206                 examine_symbol_type(ctype);
3207                 class = classify_type(ctype, &ctype);
3208                 if (class != (TYPE_COMPOUND | TYPE_PTR)) {
3209                         expression_error(expr, "expected array");
3210                         return NULL;
3211                 }
3212                 ctype = ctype->ctype.base_type;
3213                 if (!expr->index) {
3214                         expr->type = EXPR_VALUE;
3215                         expr->flags = CEF_SET_ICE;
3216                         expr->value = 0;
3217                         expr->taint = 0;
3218                         expr->ctype = size_t_ctype;
3219                 } else {
3220                         struct expression *idx = expr->index, *m;
3221                         struct symbol *i_type = evaluate_expression(idx);
3222                         unsigned old_idx_flags;
3223                         int i_class = classify_type(i_type, &i_type);
3224 
3225                         if (!is_int(i_class)) {
3226                                 expression_error(expr, "non-integer index");
3227                                 return NULL;
3228                         }
3229                         unrestrict(idx, i_class, &i_type);
3230                         old_idx_flags = idx->flags;
3231                         idx = cast_to(idx, size_t_ctype);
3232                         idx->flags = old_idx_flags;
3233                         m = alloc_const_expression(expr->pos,
3234                                                    bits_to_bytes(ctype->bit_size));
3235                         m->ctype = size_t_ctype;
3236                         m->flags = CEF_SET_INT;
3237                         expr->type = EXPR_BINOP;
3238                         expr->left = idx;
3239                         expr->right = m;
3240                         expr->op = '*';
3241                         expr->ctype = size_t_ctype;
3242                         expr->flags = m->flags & idx->flags & ~CEF_CONST_MASK;
3243                 }
3244         }
3245         if (e) {
3246                 struct expression *copy = __alloc_expression(0);
3247                 *copy = *expr;
3248                 if (e->type == EXPR_OFFSETOF)
3249                         e->in = ctype;
3250                 if (!evaluate_expression(e))
3251                         return NULL;
3252                 expr->type = EXPR_BINOP;
3253                 expr->flags = e->flags & copy->flags & ~CEF_CONST_MASK;
3254                 expr->op = '+';
3255                 expr->ctype = size_t_ctype;
3256                 expr->left = copy;
3257                 expr->right = e;
3258         }
3259         return size_t_ctype;
3260 }
3261 
3262 struct symbol *evaluate_expression(struct expression *expr)
3263 {
3264         if (!expr)
3265                 return NULL;
3266         if (expr->ctype)
3267                 return expr->ctype;
3268 
3269         switch (expr->type) {
3270         case EXPR_VALUE:
3271         case EXPR_FVALUE:
3272                 expression_error(expr, "value expression without a type");
3273                 return NULL;
3274         case EXPR_STRING:
3275                 return evaluate_string(expr);
3276         case EXPR_SYMBOL:
3277                 return evaluate_symbol_expression(expr);
3278         case EXPR_BINOP:
3279                 evaluate_expression(expr->left);
3280                 evaluate_expression(expr->right);
3281                 if (!valid_subexpr_type(expr))
3282                         return NULL;
3283                 return evaluate_binop(expr);
3284         case EXPR_LOGICAL:
3285                 return evaluate_logical(expr);
3286         case EXPR_COMMA:
3287                 evaluate_expression(expr->left);
3288                 if (!evaluate_expression(expr->right))
3289                         return NULL;
3290                 return evaluate_comma(expr);
3291         case EXPR_COMPARE:
3292                 evaluate_expression(expr->left);
3293                 evaluate_expression(expr->right);
3294                 if (!valid_subexpr_type(expr))
3295                         return NULL;
3296                 return evaluate_compare(expr);
3297         case EXPR_ASSIGNMENT:
3298                 evaluate_expression(expr->left);
3299                 evaluate_expression(expr->right);
3300                 if (!valid_subexpr_type(expr))
3301                         return NULL;
3302                 return evaluate_assignment(expr);
3303         case EXPR_PREOP:
3304                 if (!evaluate_expression(expr->unop))
3305                         return NULL;
3306                 return evaluate_preop(expr);
3307         case EXPR_POSTOP:
3308                 if (!evaluate_expression(expr->unop))
3309                         return NULL;
3310                 return evaluate_postop(expr);
3311         case EXPR_CAST:
3312         case EXPR_FORCE_CAST:
3313         case EXPR_IMPLIED_CAST:
3314                 return evaluate_cast(expr);
3315         case EXPR_SIZEOF:
3316                 return evaluate_sizeof(expr);
3317         case EXPR_PTRSIZEOF:
3318                 return evaluate_ptrsizeof(expr);
3319         case EXPR_ALIGNOF:
3320                 return evaluate_alignof(expr);
3321         case EXPR_DEREF:
3322                 return evaluate_member_dereference(expr);
3323         case EXPR_CALL:
3324                 return evaluate_call(expr);
3325         case EXPR_SELECT:
3326         case EXPR_CONDITIONAL:
3327                 return evaluate_conditional_expression(expr);
3328         case EXPR_STATEMENT:
3329                 expr->ctype = evaluate_statement(expr->statement);
3330                 return expr->ctype;
3331 
3332         case EXPR_LABEL:
3333                 expr->ctype = &ptr_ctype;
3334                 return &ptr_ctype;
3335 
3336         case EXPR_TYPE:
3337                 /* Evaluate the type of the symbol .. */
3338                 evaluate_symbol(expr->symbol);
3339                 /* .. but the type of the _expression_ is a "type" */
3340                 expr->ctype = &type_ctype;
3341                 return &type_ctype;
3342 
3343         case EXPR_OFFSETOF:
3344                 return evaluate_offsetof(expr);
3345 
3346         /* These can not exist as stand-alone expressions */
3347         case EXPR_INITIALIZER:
3348         case EXPR_IDENTIFIER:
3349         case EXPR_INDEX:
3350         case EXPR_POS:
3351                 expression_error(expr, "internal front-end error: initializer in expression");
3352                 return NULL;
3353         case EXPR_SLICE:
3354                 expression_error(expr, "internal front-end error: SLICE re-evaluated");
3355                 return NULL;
3356         case EXPR_ASM_OPERAND:
3357                 expression_error(expr, "internal front-end error: ASM_OPERAND evaluated");
3358                 return NULL;
3359         }
3360         return NULL;
3361 }
3362 
3363 void check_duplicates(struct symbol *sym)
3364 {
3365         int declared = 0;
3366         struct symbol *next = sym;
3367         int initialized = sym->initializer != NULL;
3368 
3369         while ((next = next->same_symbol) != NULL) {
3370                 const char *typediff;
3371                 evaluate_symbol(next);
3372                 if (initialized && next->initializer) {
3373                         sparse_error(sym->pos, "symbol '%s' has multiple initializers (originally initialized at %s:%d)",
3374                                 show_ident(sym->ident),
3375                                 stream_name(next->pos.stream), next->pos.line);
3376                         /* Only warn once */
3377                         initialized = 0;
3378                 }
3379                 declared++;
3380                 typediff = type_difference(&sym->ctype, &next->ctype, 0, 0);
3381                 if (typediff) {
3382                         sparse_error(sym->pos, "symbol '%s' redeclared with different type (originally declared at %s:%d) - %s",
3383                                 show_ident(sym->ident),
3384                                 stream_name(next->pos.stream), next->pos.line, typediff);
3385                         return;
3386                 }
3387         }
3388         if (!declared) {
3389                 unsigned long mod = sym->ctype.modifiers;
3390                 if (mod & (MOD_STATIC | MOD_REGISTER | MOD_EXT_VISIBLE))
3391                         return;
3392                 if (!(mod & MOD_TOPLEVEL))
3393                         return;
3394                 if (!Wdecl)
3395                         return;
3396                 if (sym->ident == &main_ident)
3397                         return;
3398                 warning(sym->pos, "symbol '%s' was not declared. Should it be static?", show_ident(sym->ident));
3399         }
3400 }
3401 
3402 static struct symbol *evaluate_symbol(struct symbol *sym)
3403 {
3404         struct symbol *base_type;
3405 
3406         if (!sym)
3407                 return sym;
3408         if (sym->evaluated)
3409                 return sym;
3410         sym->evaluated = 1;
3411 
3412         sym = examine_symbol_type(sym);
3413         base_type = get_base_type(sym);
3414         if (!base_type)
3415                 return NULL;
3416 
3417         /* Evaluate the initializers */
3418         if (sym->initializer)
3419                 evaluate_initializer(sym, &sym->initializer);
3420 
3421         /* And finally, evaluate the body of the symbol too */
3422         if (base_type->type == SYM_FN) {
3423                 struct symbol *curr = current_fn;
3424 
3425                 if (sym->definition && sym->definition != sym)
3426                         return evaluate_symbol(sym->definition);
3427 
3428                 current_fn = base_type;
3429 
3430                 examine_fn_arguments(base_type);
3431                 if (!base_type->stmt && base_type->inline_stmt)
3432                         uninline(sym);
3433                 if (base_type->stmt)
3434                         evaluate_statement(base_type->stmt);
3435 
3436                 current_fn = curr;
3437         }
3438 
3439         return base_type;
3440 }
3441 
3442 void evaluate_symbol_list(struct symbol_list *list)
3443 {
3444         struct symbol *sym;
3445 
3446         FOR_EACH_PTR(list, sym) {
3447                 has_error &= ~ERROR_CURR_PHASE;
3448                 evaluate_symbol(sym);
3449                 check_duplicates(sym);
3450         } END_FOR_EACH_PTR(sym);
3451 }
3452 
3453 static struct symbol *evaluate_return_expression(struct statement *stmt)
3454 {
3455         struct expression *expr = stmt->expression;
3456         struct symbol *fntype;
3457 
3458         evaluate_expression(expr);
3459         fntype = current_fn->ctype.base_type;
3460         if (!fntype || fntype == &void_ctype) {
3461                 if (expr && expr->ctype != &void_ctype)
3462                         expression_error(expr, "return expression in %s function", fntype?"void":"typeless");
3463                 if (expr && Wreturn_void)
3464                         warning(stmt->pos, "returning void-valued expression");
3465                 return NULL;
3466         }
3467 
3468         if (!expr) {
3469                 sparse_error(stmt->pos, "return with no return value");
3470                 return NULL;
3471         }
3472         if (!expr->ctype)
3473                 return NULL;
3474         compatible_assignment_types(expr, fntype, &stmt->expression, "return expression");
3475         return NULL;
3476 }
3477 
3478 static void evaluate_if_statement(struct statement *stmt)
3479 {
3480         if (!stmt->if_conditional)
3481                 return;
3482 
3483         evaluate_conditional(stmt->if_conditional, 0);
3484         evaluate_statement(stmt->if_true);
3485         evaluate_statement(stmt->if_false);
3486 }
3487 
3488 static void evaluate_iterator(struct statement *stmt)
3489 {
3490         evaluate_symbol_list(stmt->iterator_syms);
3491         evaluate_conditional(stmt->iterator_pre_condition, 1);
3492         evaluate_conditional(stmt->iterator_post_condition,1);
3493         evaluate_statement(stmt->iterator_pre_statement);
3494         evaluate_statement(stmt->iterator_statement);
3495         evaluate_statement(stmt->iterator_post_statement);
3496 }
3497 
3498 static void verify_output_constraint(struct expression *expr, const char *constraint)
3499 {
3500         switch (*constraint) {
3501         case '=':       /* Assignment */
3502         case '+':       /* Update */
3503                 break;
3504         default:
3505                 expression_error(expr, "output constraint is not an assignment constraint (\"%s\")", constraint);
3506         }
3507 }
3508 
3509 static void verify_input_constraint(struct expression *expr, const char *constraint)
3510 {
3511         switch (*constraint) {
3512         case '=':       /* Assignment */
3513         case '+':       /* Update */
3514                 expression_error(expr, "input constraint with assignment (\"%s\")", constraint);
3515         }
3516 }
3517 
3518 static void evaluate_asm_statement(struct statement *stmt)
3519 {
3520         struct expression *expr;
3521         struct expression *op;
3522         struct symbol *sym;
3523 
3524         expr = stmt->asm_string;
3525         if (!expr || expr->type != EXPR_STRING) {
3526                 sparse_error(stmt->pos, "need constant string for inline asm");
3527                 return;
3528         }
3529 
3530         FOR_EACH_PTR(stmt->asm_outputs, op) {
3531                 /* Identifier */
3532 
3533                 /* Constraint */
3534                 expr = op->constraint;
3535                 if (!expr || expr->type != EXPR_STRING) {
3536                         sparse_error(expr ? expr->pos : stmt->pos, "asm output constraint is not a string");
3537                         op->constraint = NULL;
3538                 } else
3539                         verify_output_constraint(expr, expr->string->data);
3540 
3541                 /* Expression */
3542                 expr = op->expr;
3543                 if (!evaluate_expression(expr))
3544                         return;
3545                 if (!lvalue_expression(expr))
3546                         warning(expr->pos, "asm output is not an lvalue");
3547                 evaluate_assign_to(expr, expr->ctype);
3548         } END_FOR_EACH_PTR(op);
3549 
3550         FOR_EACH_PTR(stmt->asm_inputs, op) {
3551                 /* Identifier */
3552 
3553                 /* Constraint */
3554                 expr = op->constraint;
3555                 if (!expr || expr->type != EXPR_STRING) {
3556                         sparse_error(expr ? expr->pos : stmt->pos, "asm input constraint is not a string");
3557                         op->constraint = NULL;
3558                 } else
3559                         verify_input_constraint(expr, expr->string->data);
3560 
3561                 /* Expression */
3562                 if (!evaluate_expression(op->expr))
3563                         return;
3564         } END_FOR_EACH_PTR(op);
3565 
3566         FOR_EACH_PTR(stmt->asm_clobbers, expr) {
3567                 if (!expr) {
3568                         sparse_error(stmt->pos, "bad asm clobbers");
3569                         return;
3570                 }
3571                 if (expr->type == EXPR_STRING)
3572                         continue;
3573                 expression_error(expr, "asm clobber is not a string");
3574         } END_FOR_EACH_PTR(expr);
3575 
3576         FOR_EACH_PTR(stmt->asm_labels, sym) {
3577                 if (!sym || sym->type != SYM_LABEL) {
3578                         sparse_error(stmt->pos, "bad asm label");
3579                         return;
3580                 }
3581         } END_FOR_EACH_PTR(sym);
3582 }
3583 
3584 static void evaluate_case_statement(struct statement *stmt)
3585 {
3586         evaluate_expression(stmt->case_expression);
3587         evaluate_expression(stmt->case_to);
3588         evaluate_statement(stmt->case_statement);
3589 }
3590 
3591 static void check_case_type(struct expression *switch_expr,
3592                             struct expression *case_expr,
3593                             struct expression **enumcase)
3594 {
3595         struct symbol *switch_type, *case_type;
3596         int sclass, cclass;
3597 
3598         if (!case_expr)
3599                 return;
3600 
3601         switch_type = switch_expr->ctype;
3602         case_type = evaluate_expression(case_expr);
3603 
3604         if (!switch_type || !case_type)
3605                 goto Bad;
3606         if (enumcase) {
3607                 if (*enumcase)
3608                         warn_for_different_enum_types(case_expr->pos, case_type, (*enumcase)->ctype);
3609                 else if (is_enum_type(case_type))
3610                         *enumcase = case_expr;
3611         }
3612 
3613         sclass = classify_type(switch_type, &switch_type);
3614         cclass = classify_type(case_type, &case_type);
3615 
3616         /* both should be arithmetic */
3617         if (!(sclass & cclass & TYPE_NUM))
3618                 goto Bad;
3619 
3620         /* neither should be floating */
3621         if ((sclass | cclass) & TYPE_FLOAT)
3622                 goto Bad;
3623 
3624         /* if neither is restricted, we are OK */
3625         if (!((sclass | cclass) & TYPE_RESTRICT))
3626                 return;
3627 
3628         if (!restricted_binop_type(SPECIAL_EQUAL, case_expr, switch_expr,
3629                                    cclass, sclass, case_type, switch_type)) {
3630                 unrestrict(case_expr, cclass, &case_type);
3631                 unrestrict(switch_expr, sclass, &switch_type);
3632         }
3633         return;
3634 
3635 Bad:
3636         expression_error(case_expr, "incompatible types for 'case' statement");
3637 }
3638 
3639 static void evaluate_switch_statement(struct statement *stmt)
3640 {
3641         struct symbol *sym;
3642         struct expression *enumcase = NULL;
3643         struct expression **enumcase_holder = &enumcase;
3644         struct expression *sel = stmt->switch_expression;
3645 
3646         evaluate_expression(sel);
3647         evaluate_statement(stmt->switch_statement);
3648         if (!sel)
3649                 return;
3650         if (sel->ctype && is_enum_type(sel->ctype))
3651                 enumcase_holder = NULL; /* Only check cases against switch */
3652 
3653         FOR_EACH_PTR(stmt->switch_case->symbol_list, sym) {
3654                 struct statement *case_stmt = sym->stmt;
3655                 check_case_type(sel, case_stmt->case_expression, enumcase_holder);
3656                 check_case_type(sel, case_stmt->case_to, enumcase_holder);
3657         } END_FOR_EACH_PTR(sym);
3658 }
3659 
3660 static void evaluate_goto_statement(struct statement *stmt)
3661 {
3662         struct symbol *label = stmt->goto_label;
3663 
3664         if (label && !label->stmt && label->ident && !lookup_keyword(label->ident, NS_KEYWORD))
3665                 sparse_error(stmt->pos, "label '%s' was not declared", show_ident(label->ident));
3666 
3667         evaluate_expression(stmt->goto_expression);
3668 }
3669 
3670 struct symbol *evaluate_statement(struct statement *stmt)
3671 {
3672         if (!stmt)
3673                 return NULL;
3674 
3675         switch (stmt->type) {
3676         case STMT_DECLARATION: {
3677                 struct symbol *s;
3678                 FOR_EACH_PTR(stmt->declaration, s) {
3679                         evaluate_symbol(s);
3680                 } END_FOR_EACH_PTR(s);
3681                 return NULL;
3682         }
3683 
3684         case STMT_RETURN:
3685                 return evaluate_return_expression(stmt);
3686 
3687         case STMT_EXPRESSION:
3688                 if (!evaluate_expression(stmt->expression))
3689                         return NULL;
3690                 if (stmt->expression->ctype == &null_ctype)
3691                         stmt->expression = cast_to(stmt->expression, &ptr_ctype);
3692                 return degenerate(stmt->expression);
3693 
3694         case STMT_COMPOUND: {
3695                 struct statement *s;
3696                 struct symbol *type = NULL;
3697 
3698                 /* Evaluate the return symbol in the compound statement */
3699                 evaluate_symbol(stmt->ret);
3700 
3701                 /*
3702                  * Then, evaluate each statement, making the type of the
3703                  * compound statement be the type of the last statement
3704                  */
3705                 type = evaluate_statement(stmt->args);
3706                 FOR_EACH_PTR(stmt->stmts, s) {
3707                         type = evaluate_statement(s);
3708                 } END_FOR_EACH_PTR(s);
3709                 if (!type)
3710                         type = &void_ctype;
3711                 return type;
3712         }
3713         case STMT_IF:
3714                 evaluate_if_statement(stmt);
3715                 return NULL;
3716         case STMT_ITERATOR:
3717                 evaluate_iterator(stmt);
3718                 return NULL;
3719         case STMT_SWITCH:
3720                 evaluate_switch_statement(stmt);
3721                 return NULL;
3722         case STMT_CASE:
3723                 evaluate_case_statement(stmt);
3724                 return NULL;
3725         case STMT_LABEL:
3726                 return evaluate_statement(stmt->label_statement);
3727         case STMT_GOTO:
3728                 evaluate_goto_statement(stmt);
3729                 return NULL;
3730         case STMT_NONE:
3731                 break;
3732         case STMT_ASM:
3733                 evaluate_asm_statement(stmt);
3734                 return NULL;
3735         case STMT_CONTEXT:
3736                 evaluate_expression(stmt->expression);
3737                 return NULL;
3738         case STMT_RANGE:
3739                 evaluate_expression(stmt->range_expression);
3740                 evaluate_expression(stmt->range_low);
3741                 evaluate_expression(stmt->range_high);
3742                 return NULL;
3743         }
3744         return NULL;
3745 }