Print this page
new smatch


  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  *
  25  * Evaluate constant expressions.
  26  */
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29 #include <stddef.h>
  30 #include <stdio.h>
  31 #include <string.h>
  32 #include <ctype.h>
  33 #include <unistd.h>
  34 #include <fcntl.h>
  35 #include <limits.h>
  36 

  37 #include "lib.h"
  38 #include "allocate.h"
  39 #include "parse.h"
  40 #include "token.h"
  41 #include "symbol.h"
  42 #include "target.h"
  43 #include "expression.h"
  44 
  45 struct symbol *current_fn;
  46 


  47 static struct symbol *degenerate(struct expression *expr);
  48 static struct symbol *evaluate_symbol(struct symbol *sym);
  49 











  50 static struct symbol *evaluate_symbol_expression(struct expression *expr)
  51 {
  52         struct expression *addr;
  53         struct symbol *sym = expr->symbol;
  54         struct symbol *base_type;
  55 
  56         if (!sym) {
  57                 expression_error(expr, "undefined identifier '%s'", show_ident(expr->symbol_name));
  58                 return NULL;
  59         }
  60 
  61         examine_symbol_type(sym);
  62 
  63         base_type = get_base_type(sym);
  64         if (!base_type) {
  65                 expression_error(expr, "identifier '%s' has no type", show_ident(expr->symbol_name));
  66                 return NULL;
  67         }
  68 
  69         addr = alloc_expression(expr->pos, EXPR_SYMBOL);


 179 
 180         lmod = left->ctype.modifiers;
 181         rmod = right->ctype.modifiers;
 182         if ((lmod ^ rmod) & MOD_UNSIGNED) {
 183                 if (lmod & MOD_UNSIGNED)
 184                         goto left;
 185         } else if ((lmod & ~rmod) & (MOD_LONG_ALL))
 186                 goto left;
 187 right:
 188         left = right;
 189 left:
 190         return left;
 191 }
 192 
 193 static int same_cast_type(struct symbol *orig, struct symbol *new)
 194 {
 195         return orig->bit_size == new->bit_size &&
 196                orig->bit_offset == new->bit_offset;
 197 }
 198 
 199 static struct symbol *base_type(struct symbol *node, unsigned long *modp, unsigned long *asp)
 200 {
 201         unsigned long mod, as;

 202 
 203         mod = 0; as = 0;
 204         while (node) {
 205                 mod |= node->ctype.modifiers;
 206                 as |= node->ctype.as;
 207                 if (node->type == SYM_NODE) {
 208                         node = node->ctype.base_type;
 209                         continue;
 210                 }
 211                 break;
 212         }
 213         *modp = mod & ~MOD_IGNORE;
 214         *asp = as;
 215         return node;
 216 }
 217 
 218 static int is_same_type(struct expression *expr, struct symbol *new)
 219 {
 220         struct symbol *old = expr->ctype;
 221         unsigned long oldmod, newmod, oldas, newas;

 222 
 223         old = base_type(old, &oldmod, &oldas);
 224         new = base_type(new, &newmod, &newas);
 225 
 226         /* Same base type, same address space? */
 227         if (old == new && oldas == newas) {
 228                 unsigned long difmod;
 229 
 230                 /* Check the modifier bits. */
 231                 difmod = (oldmod ^ newmod) & ~MOD_NOCAST;
 232 
 233                 /* Exact same type? */
 234                 if (!difmod)
 235                         return 1;
 236 
 237                 /*
 238                  * Not the same type, but differs only in "const".
 239                  * Don't warn about MOD_NOCAST.
 240                  */
 241                 if (difmod == MOD_CONST)


 376         if (type->type == SYM_BASETYPE) {
 377                 if (type->ctype.base_type == &int_type)
 378                         return TYPE_NUM;
 379                 if (type->ctype.base_type == &fp_type)
 380                         return TYPE_NUM | TYPE_FLOAT;
 381         }
 382         return type_class[type->type];
 383 }
 384 
 385 #define is_int(class) ((class & (TYPE_NUM | TYPE_FLOAT)) == TYPE_NUM)
 386 
 387 static inline int is_string_type(struct symbol *type)
 388 {
 389         if (type->type == SYM_NODE)
 390                 type = type->ctype.base_type;
 391         return type->type == SYM_ARRAY && is_byte_type(type->ctype.base_type);
 392 }
 393 
 394 static struct symbol *bad_expr_type(struct expression *expr)
 395 {
 396         sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
 397         switch (expr->type) {
 398         case EXPR_BINOP:
 399         case EXPR_COMPARE:



 400                 info(expr->pos, "   left side has type %s", show_typename(expr->left->ctype));
 401                 info(expr->pos, "   right side has type %s", show_typename(expr->right->ctype));
 402                 break;
 403         case EXPR_PREOP:
 404         case EXPR_POSTOP:



 405                 info(expr->pos, "   argument has type %s", show_typename(expr->unop->ctype));
 406                 break;
 407         default:
 408                 break;
 409         }
 410 
 411         expr->flags = CEF_NONE;
 412         return expr->ctype = &bad_ctype;
 413 }
 414 
 415 static int restricted_value(struct expression *v, struct symbol *type)
 416 {
 417         if (v->type != EXPR_VALUE)
 418                 return 1;
 419         if (v->value != 0)
 420                 return 1;
 421         return 0;
 422 }
 423 
 424 static int restricted_binop(int op, struct symbol *type)


 621         if (multiply > 1) {
 622                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 623                 struct expression *mul = alloc_expression(expr->pos, EXPR_BINOP);
 624 
 625                 val->ctype = ssize_t_ctype;
 626                 val->value = multiply;
 627 
 628                 mul->op = '*';
 629                 mul->ctype = ssize_t_ctype;
 630                 mul->left = index;
 631                 mul->right = val;
 632                 index = mul;
 633         }
 634 
 635         expr->right = index;
 636         return ctype;
 637 }
 638 
 639 static void examine_fn_arguments(struct symbol *fn);
 640 
 641 #define MOD_IGN (MOD_VOLATILE | MOD_CONST | MOD_PURE)
 642 
 643 const char *type_difference(struct ctype *c1, struct ctype *c2,
 644         unsigned long mod1, unsigned long mod2)
 645 {
 646         unsigned long as1 = c1->as, as2 = c2->as;
 647         struct symbol *t1 = c1->base_type;
 648         struct symbol *t2 = c2->base_type;
 649         int move1 = 1, move2 = 1;
 650         mod1 |= c1->modifiers;
 651         mod2 |= c2->modifiers;
 652         for (;;) {
 653                 unsigned long diff;
 654                 int type;
 655                 struct symbol *base1 = t1->ctype.base_type;
 656                 struct symbol *base2 = t2->ctype.base_type;
 657 
 658                 /*
 659                  * FIXME! Collect alignment and context too here!
 660                  */
 661                 if (move1) {
 662                         if (t1 && t1->type != SYM_PTR) {
 663                                 mod1 |= t1->ctype.modifiers;
 664                                 as1 |= t1->ctype.as;
 665                         }
 666                         move1 = 0;
 667                 }
 668 
 669                 if (move2) {
 670                         if (t2 && t2->type != SYM_PTR) {
 671                                 mod2 |= t2->ctype.modifiers;
 672                                 as2 |= t2->ctype.as;
 673                         }
 674                         move2 = 0;
 675                 }
 676 
 677                 if (t1 == t2)
 678                         break;
 679                 if (!t1 || !t2)
 680                         return "different types";
 681 
 682                 if (t1->type == SYM_NODE || t1->type == SYM_ENUM) {
 683                         t1 = base1;
 684                         move1 = 1;
 685                         if (!t1)
 686                                 return "bad types";
 687                         continue;
 688                 }
 689 
 690                 if (t2->type == SYM_NODE || t2->type == SYM_ENUM) {
 691                         t2 = base2;
 692                         move2 = 1;


 830                                    target_qualifiers(ltype));
 831         if (typediff)
 832                 expression_error(expr, "subtraction of different types can't work (%s)", typediff);
 833 
 834         if (is_function(lbase)) {
 835                 expression_error(expr, "subtraction of functions? Share your drugs");
 836                 return NULL;
 837         }
 838 
 839         expr->ctype = ssize_t_ctype;
 840         if (lbase->bit_size > bits_in_char) {
 841                 struct expression *sub = alloc_expression(expr->pos, EXPR_BINOP);
 842                 struct expression *div = expr;
 843                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 844                 unsigned long value = bits_to_bytes(lbase->bit_size);
 845 
 846                 val->ctype = size_t_ctype;
 847                 val->value = value;
 848 
 849                 if (value & (value-1)) {
 850                         if (Wptr_subtraction_blows)
 851                                 warning(expr->pos, "potentially expensive pointer subtraction");

 852                 }

 853 
 854                 sub->op = '-';
 855                 sub->ctype = ssize_t_ctype;
 856                 sub->left = l;
 857                 sub->right = r;
 858 
 859                 div->op = '/';
 860                 div->left = sub;
 861                 div->right = val;
 862         }
 863                 
 864         return ssize_t_ctype;
 865 }
 866 
 867 #define is_safe_type(type) ((type)->ctype.modifiers & MOD_SAFE)
 868 
 869 static struct symbol *evaluate_conditional(struct expression *expr, int iterator)
 870 {
 871         struct symbol *ctype;
 872 
 873         if (!expr)
 874                 return NULL;
 875 
 876         if (!iterator && expr->type == EXPR_ASSIGNMENT && expr->op == '=')
 877                 warning(expr->pos, "assignment expression in conditional");
 878 
 879         ctype = evaluate_expression(expr);
 880         if (ctype) {

 881                 if (is_safe_type(ctype))
 882                         warning(expr->pos, "testing a 'safe expression'");
 883                 if (is_func_type(ctype)) {
 884                         if (Waddress)
 885                                 warning(expr->pos, "the address of %s will always evaluate as true", "a function");
 886                 } else if (is_array_type(ctype)) {
 887                         if (Waddress)
 888                                 warning(expr->pos, "the address of %s will always evaluate as true", "an array");
 889                 } else if (!is_scalar_type(ctype)) {
 890                         sparse_error(expr->pos, "incorrect type in conditional");
 891                         info(expr->pos, "   got %s", show_typename(ctype));
 892                         ctype = NULL;
 893                 }
 894         }
 895         ctype = degenerate(expr);
 896 

 897         return ctype;
 898 }
 899 
 900 static struct symbol *evaluate_logical(struct expression *expr)
 901 {
 902         if (!evaluate_conditional(expr->left, 0))
 903                 return NULL;
 904         if (!evaluate_conditional(expr->right, 0))
 905                 return NULL;
 906 
 907         /* the result is int [6.5.13(3), 6.5.14(3)] */
 908         expr->ctype = &int_ctype;
 909         expr->flags = expr->left->flags & expr->right->flags;
 910         expr->flags &= ~(CEF_CONST_MASK | CEF_ADDR);
 911         return &int_ctype;
 912 }
 913 
 914 static struct symbol *evaluate_binop(struct expression *expr)
 915 {
 916         struct symbol *ltype, *rtype, *ctype;


 988         expr->ctype = degenerate(expr->right);
 989         if (expr->ctype == &null_ctype)
 990                 expr->ctype = &ptr_ctype;
 991         expr->flags &= expr->left->flags & expr->right->flags;
 992         return expr->ctype;
 993 }
 994 
 995 static int modify_for_unsigned(int op)
 996 {
 997         if (op == '<')
 998                 op = SPECIAL_UNSIGNED_LT;
 999         else if (op == '>')
1000                 op = SPECIAL_UNSIGNED_GT;
1001         else if (op == SPECIAL_LTE)
1002                 op = SPECIAL_UNSIGNED_LTE;
1003         else if (op == SPECIAL_GTE)
1004                 op = SPECIAL_UNSIGNED_GTE;
1005         return op;
1006 }
1007 






1008 static inline int is_null_pointer_constant(struct expression *e)
1009 {
1010         if (e->ctype == &null_ctype)
1011                 return 1;
1012         if (!(e->flags & CEF_ICE))
1013                 return 0;
1014         return is_zero_constant(e) ? 2 : 0;
1015 }
1016 
1017 static struct symbol *evaluate_compare(struct expression *expr)
1018 {
1019         struct expression *left = expr->left, *right = expr->right;
1020         struct symbol *ltype, *rtype, *lbase, *rbase;
1021         int lclass = classify_type(degenerate(left), &ltype);
1022         int rclass = classify_type(degenerate(right), &rtype);
1023         struct symbol *ctype;
1024         const char *typediff;
1025 
1026         /* Type types? */
1027         if (is_type_type(ltype) && is_type_type(rtype)) {
1028                 /*
1029                  * __builtin_types_compatible_p() yields an integer
1030                  * constant expression
1031                  */
1032                 expr->flags = CEF_SET_ICE;
1033                 goto OK;
1034         }


1040 
1041         /* number on number */
1042         if (lclass & rclass & TYPE_NUM) {
1043                 ctype = usual_conversions(expr->op, expr->left, expr->right,
1044                                           lclass, rclass, ltype, rtype);
1045                 expr->left = cast_to(expr->left, ctype);
1046                 expr->right = cast_to(expr->right, ctype);
1047                 if (ctype->ctype.modifiers & MOD_UNSIGNED)
1048                         expr->op = modify_for_unsigned(expr->op);
1049                 goto OK;
1050         }
1051 
1052         /* at least one must be a pointer */
1053         if (!((lclass | rclass) & TYPE_PTR))
1054                 return bad_expr_type(expr);
1055 
1056         /* equality comparisons can be with null pointer constants */
1057         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1058                 int is_null1 = is_null_pointer_constant(left);
1059                 int is_null2 = is_null_pointer_constant(right);
1060                 if (is_null1 == 2)
1061                         bad_null(left);
1062                 if (is_null2 == 2)
1063                         bad_null(right);
1064                 if (is_null1 && is_null2) {
1065                         int positive = expr->op == SPECIAL_EQUAL;
1066                         expr->type = EXPR_VALUE;
1067                         expr->value = positive;
1068                         goto OK;
1069                 }
1070                 if (is_null1 && (rclass & TYPE_PTR)) {
1071                         left = cast_to(left, rtype);
1072                         goto OK;
1073                 }
1074                 if (is_null2 && (lclass & TYPE_PTR)) {
1075                         right = cast_to(right, ltype);
1076                         goto OK;
1077                 }
1078         }
1079         /* both should be pointers */
1080         if (!(lclass & rclass & TYPE_PTR))
1081                 return bad_expr_type(expr);
1082         expr->op = modify_for_unsigned(expr->op);


1087         /* they also have special treatment for pointers to void */
1088         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1089                 if (ltype->ctype.as == rtype->ctype.as) {
1090                         if (lbase == &void_ctype) {
1091                                 right = cast_to(right, ltype);
1092                                 goto OK;
1093                         }
1094                         if (rbase == &void_ctype) {
1095                                 left = cast_to(left, rtype);
1096                                 goto OK;
1097                         }
1098                 }
1099         }
1100 
1101         typediff = type_difference(&ltype->ctype, &rtype->ctype,
1102                                    target_qualifiers(rtype),
1103                                    target_qualifiers(ltype));
1104         if (!typediff)
1105                 goto OK;
1106 
1107         expression_error(expr, "incompatible types in comparison expression (%s)", typediff);


1108         return NULL;
1109 
1110 OK:
1111         /* the result is int [6.5.8(6), 6.5.9(3)]*/
1112         expr->ctype = &int_ctype;
1113         return &int_ctype;
1114 }
1115 
1116 /*
1117  * NOTE! The degenerate case of "x ? : y", where we don't
1118  * have a true case, this will possibly promote "x" to the
1119  * same type as "y", and thus _change_ the conditional
1120  * test in the expression. But since promotion is "safe"
1121  * for testing, that's OK.
1122  */
1123 static struct symbol *evaluate_conditional_expression(struct expression *expr)
1124 {
1125         struct expression **true;
1126         struct symbol *ctype, *ltype, *rtype, *lbase, *rbase;
1127         int lclass, rclass;
1128         const char * typediff;
1129         int qual;
1130 
1131         if (!evaluate_conditional(expr->conditional, 0))
1132                 return NULL;
1133         if (!evaluate_expression(expr->cond_false))
1134                 return NULL;
1135 
1136         ctype = degenerate(expr->conditional);
1137         rtype = degenerate(expr->cond_false);
1138 
1139         true = &expr->conditional;
1140         ltype = ctype;
1141         if (expr->cond_true) {
1142                 if (!evaluate_expression(expr->cond_true))
1143                         return NULL;
1144                 ltype = degenerate(expr->cond_true);
1145                 true = &expr->cond_true;
1146         }
1147 
1148         expr->flags = (expr->conditional->flags & (*true)->flags &
1149                         expr->cond_false->flags & ~CEF_CONST_MASK);
1150         /*
1151          * A conditional operator yields a particular constant
1152          * expression type only if all of its three subexpressions are
1153          * of that type [6.6(6), 6.6(8)].
1154          * As an extension, relax this restriction by allowing any
1155          * constant expression type for the condition expression.
1156          *
1157          * A conditional operator never yields an address constant
1158          * [6.6(9)].
1159          * However, as an extension, if the condition is any constant
1160          * expression, and the true and false expressions are both
1161          * address constants, mark the result as an address constant.
1162          */
1163         if (expr->conditional->flags & (CEF_ACE | CEF_ADDR))
1164                 expr->flags = (*true)->flags & expr->cond_false->flags & ~CEF_CONST_MASK;
1165 
1166         lclass = classify_type(ltype, &ltype);
1167         rclass = classify_type(rtype, &rtype);
1168         if (lclass & rclass & TYPE_NUM) {
1169                 ctype = usual_conversions('?', *true, expr->cond_false,
1170                                           lclass, rclass, ltype, rtype);
1171                 *true = cast_to(*true, ctype);
1172                 expr->cond_false = cast_to(expr->cond_false, ctype);
1173                 goto out;
1174         }
1175 
1176         if ((lclass | rclass) & TYPE_PTR) {
1177                 int is_null1 = is_null_pointer_constant(*true);
1178                 int is_null2 = is_null_pointer_constant(expr->cond_false);
1179 
1180                 if (is_null1 && is_null2) {
1181                         *true = cast_to(*true, &ptr_ctype);
1182                         expr->cond_false = cast_to(expr->cond_false, &ptr_ctype);
1183                         ctype = &ptr_ctype;
1184                         goto out;
1185                 }
1186                 if (is_null1 && (rclass & TYPE_PTR)) {
1187                         if (is_null1 == 2)
1188                                 bad_null(*true);
1189                         *true = cast_to(*true, rtype);
1190                         ctype = rtype;
1191                         goto out;
1192                 }
1193                 if (is_null2 && (lclass & TYPE_PTR)) {
1194                         if (is_null2 == 2)
1195                                 bad_null(expr->cond_false);
1196                         expr->cond_false = cast_to(expr->cond_false, ltype);
1197                         ctype = ltype;
1198                         goto out;
1199                 }
1200                 if (!(lclass & rclass & TYPE_PTR)) {
1201                         typediff = "different types";
1202                         goto Err;
1203                 }
1204                 /* OK, it's pointer on pointer */
1205                 if (ltype->ctype.as != rtype->ctype.as) {
1206                         typediff = "different address spaces";
1207                         goto Err;
1208                 }
1209 
1210                 /* need to be lazier here */
1211                 lbase = examine_pointer_target(ltype);
1212                 rbase = examine_pointer_target(rtype);
1213                 qual = target_qualifiers(ltype) | target_qualifiers(rtype);
1214 


1223                         ctype = rtype;
1224                         goto Qual;
1225                 }
1226                 /* XXX: that should be pointer to composite */
1227                 ctype = ltype;
1228                 typediff = type_difference(&ltype->ctype, &rtype->ctype,
1229                                            qual, qual);
1230                 if (!typediff)
1231                         goto Qual;
1232                 goto Err;
1233         }
1234 
1235         /* void on void, struct on same struct, union on same union */
1236         if (ltype == rtype) {
1237                 ctype = ltype;
1238                 goto out;
1239         }
1240         typediff = "different base types";
1241 
1242 Err:
1243         expression_error(expr, "incompatible types in conditional expression (%s)", typediff);


1244         /*
1245          * if the condition is constant, the type is in fact known
1246          * so use it, as gcc & clang do.
1247          */
1248         switch (expr_truth_value(expr->conditional)) {
1249         case 1: expr->ctype = ltype;
1250                 break;
1251         case 0: expr->ctype = rtype;
1252                 break;
1253         default:
1254                 break;
1255         }
1256         return NULL;
1257 
1258 out:
1259         expr->ctype = ctype;
1260         return ctype;
1261 
1262 Qual:
1263         if (qual & ~ctype->ctype.modifiers) {
1264                 struct symbol *sym = alloc_symbol(ctype->pos, SYM_PTR);
1265                 *sym = *ctype;
1266                 sym->ctype.modifiers |= qual;
1267                 ctype = sym;
1268         }
1269         *true = cast_to(*true, ctype);
1270         expr->cond_false = cast_to(expr->cond_false, ctype);
1271         goto out;
1272 }
1273 
1274 /* FP assignments can not do modulo or bit operations */
1275 static int compatible_float_op(int op)
1276 {
1277         return  op == SPECIAL_ADD_ASSIGN ||
1278                 op == SPECIAL_SUB_ASSIGN ||
1279                 op == SPECIAL_MUL_ASSIGN ||
1280                 op == SPECIAL_DIV_ASSIGN;
1281 }
1282 
1283 static int evaluate_assign_op(struct expression *expr)
1284 {
1285         struct symbol *target = expr->left->ctype;
1286         struct symbol *source = expr->right->ctype;
1287         struct symbol *t, *s;
1288         int tclass = classify_type(target, &t);
1289         int sclass = classify_type(source, &s);
1290         int op = expr->op;
1291 
1292         if (tclass & sclass & TYPE_NUM) {
1293                 if (tclass & TYPE_FLOAT && !compatible_float_op(op)) {
1294                         expression_error(expr, "invalid assignment");
1295                         return 0;
1296                 }
1297                 if (tclass & TYPE_RESTRICT) {
1298                         if (!restricted_binop(op, t)) {
1299                                 warning(expr->pos, "bad assignment (%s) to %s",
1300                                         show_special(op), show_typename(t));
1301                                 expr->right = cast_to(expr->right, target);
1302                                 return 0;
1303                         }
1304                         /* allowed assignments unfoul */
1305                         if (sclass & TYPE_FOULED && unfoul(s) == t)
1306                                 goto Cast;
1307                         if (!restricted_value(expr->right, t))
1308                                 return 1;





1309                 } else if (!(sclass & TYPE_RESTRICT))
1310                         goto usual;
1311                 /* source and target would better be identical restricted */
1312                 if (t == s)
1313                         return 1;
1314                 warning(expr->pos, "invalid assignment: %s", show_special(op));
1315                 info(expr->pos, "   left side has type %s", show_typename(t));
1316                 info(expr->pos, "   right side has type %s", show_typename(s));
1317                 expr->right = cast_to(expr->right, target);
1318                 return 0;
1319         }
1320         if (tclass == TYPE_PTR && is_int(sclass)) {
1321                 if (op == SPECIAL_ADD_ASSIGN || op == SPECIAL_SUB_ASSIGN) {
1322                         unrestrict(expr->right, sclass, &s);
1323                         evaluate_ptr_add(expr, s);
1324                         return 1;
1325                 }
1326                 expression_error(expr, "invalid pointer assignment");
1327                 return 0;
1328         }


1377                         if (s == t)
1378                                 return 1;
1379                 } else if (!(sclass & TYPE_RESTRICT))
1380                         goto Cast;
1381                 if (t == &bool_ctype) {
1382                         if (is_fouled_type(s))
1383                                 warning((*rp)->pos, "%s degrades to integer",
1384                                         show_typename(s->ctype.base_type));
1385                         goto Cast;
1386                 }
1387                 *typediff = "different base types";
1388                 return 0;
1389         }
1390 
1391         if (tclass == TYPE_PTR) {
1392                 unsigned long mod1, mod2;
1393                 struct symbol *b1, *b2;
1394                 // NULL pointer is always OK
1395                 int is_null = is_null_pointer_constant(*rp);
1396                 if (is_null) {
1397                         if (is_null == 2)
1398                                 bad_null(*rp);
1399                         goto Cast;
1400                 }
1401                 if (!(sclass & TYPE_PTR)) {
1402                         *typediff = "different base types";
1403                         return 0;
1404                 }
1405                 b1 = examine_pointer_target(t);
1406                 b2 = examine_pointer_target(s);
1407                 mod1 = target_qualifiers(t);
1408                 mod2 = target_qualifiers(s);
1409                 if (whitelist_pointers(b1, b2)) {
1410                         /*
1411                          * assignments to/from void * are OK, provided that
1412                          * we do not remove qualifiers from pointed to [C]
1413                          * or mix address spaces [sparse].
1414                          */
1415                         if (t->ctype.as != s->ctype.as) {
1416                                 *typediff = "different address spaces";
1417                                 return 0;


1527                 mark_assigned(expr->base);
1528                 return;
1529         default:
1530                 /* Hmm? */
1531                 return;
1532         }
1533 }
1534 
1535 static void evaluate_assign_to(struct expression *left, struct symbol *type)
1536 {
1537         if (type->ctype.modifiers & MOD_CONST)
1538                 expression_error(left, "assignment to const expression");
1539 
1540         /* We know left is an lvalue, so it's a "preop-*" */
1541         mark_assigned(left->unop);
1542 }
1543 
1544 static struct symbol *evaluate_assignment(struct expression *expr)
1545 {
1546         struct expression *left = expr->left;
1547         struct expression *where = expr;
1548         struct symbol *ltype;
1549 
1550         if (!lvalue_expression(left)) {
1551                 expression_error(expr, "not an lvalue");
1552                 return NULL;
1553         }
1554 
1555         ltype = left->ctype;
1556 
1557         if (expr->op != '=') {
1558                 if (!evaluate_assign_op(expr))
1559                         return NULL;
1560         } else {
1561                 if (!compatible_assignment_types(where, ltype, &expr->right, "assignment"))
1562                         return NULL;
1563         }
1564 
1565         evaluate_assign_to(left, ltype);
1566 
1567         expr->ctype = ltype;
1568         return ltype;
1569 }
1570 
1571 static void examine_fn_arguments(struct symbol *fn)
1572 {
1573         struct symbol *s;
1574 
1575         FOR_EACH_PTR(fn->arguments, s) {
1576                 struct symbol *arg = evaluate_symbol(s);
1577                 /* Array/function arguments silently degenerate into pointers */
1578                 if (arg) {
1579                         struct symbol *ptr;
1580                         switch(arg->type) {
1581                         case SYM_ARRAY:
1582                         case SYM_FN:
1583                                 ptr = alloc_symbol(s->pos, SYM_PTR);
1584                                 if (arg->type == SYM_ARRAY)
1585                                         ptr->ctype = arg->ctype;
1586                                 else
1587                                         ptr->ctype.base_type = arg;
1588                                 ptr->ctype.as |= s->ctype.as;
1589                                 ptr->ctype.modifiers |= s->ctype.modifiers & MOD_PTRINHERIT;
1590 
1591                                 s->ctype.base_type = ptr;
1592                                 s->ctype.as = 0;
1593                                 s->ctype.modifiers &= ~MOD_PTRINHERIT;
1594                                 s->bit_size = 0;
1595                                 s->examined = 0;
1596                                 examine_symbol_type(s);
1597                                 break;
1598                         default:
1599                                 /* nothing */
1600                                 break;
1601                         }
1602                 }
1603         } END_FOR_EACH_PTR(s);
1604 }
1605 
1606 static struct symbol *convert_to_as_mod(struct symbol *sym, int as, int mod)
1607 {
1608         /* Take the modifiers of the pointer, and apply them to the member */
1609         mod |= sym->ctype.modifiers;
1610         if (sym->ctype.as != as || sym->ctype.modifiers != mod) {
1611                 struct symbol *newsym = alloc_symbol(sym->pos, SYM_NODE);
1612                 *newsym = *sym;
1613                 newsym->ctype.as = as;
1614                 newsym->ctype.modifiers = mod;
1615                 sym = newsym;
1616         }
1617         return sym;
1618 }
1619 
1620 static struct symbol *create_pointer(struct expression *expr, struct symbol *sym, int degenerate)
1621 {
1622         struct symbol *node = alloc_symbol(expr->pos, SYM_NODE);
1623         struct symbol *ptr = alloc_symbol(expr->pos, SYM_PTR);
1624 
1625         node->ctype.base_type = ptr;
1626         ptr->bit_size = bits_in_pointer;
1627         ptr->ctype.alignment = pointer_alignment;
1628 
1629         node->bit_size = bits_in_pointer;
1630         node->ctype.alignment = pointer_alignment;
1631 
1632         access_symbol(sym);
1633         if (sym->ctype.modifiers & MOD_REGISTER) {
1634                 warning(expr->pos, "taking address of 'register' variable '%s'", show_ident(sym->ident));
1635                 sym->ctype.modifiers &= ~MOD_REGISTER;
1636         }
1637         if (sym->type == SYM_NODE) {
1638                 ptr->ctype.as |= sym->ctype.as;
1639                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1640                 sym = sym->ctype.base_type;
1641         }
1642         if (degenerate && sym->type == SYM_ARRAY) {
1643                 ptr->ctype.as |= sym->ctype.as;
1644                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1645                 sym = sym->ctype.base_type;
1646         }
1647         ptr->ctype.base_type = sym;
1648 
1649         return node;
1650 }
1651 
1652 /* Arrays degenerate into pointers on pointer arithmetic */
1653 static struct symbol *degenerate(struct expression *expr)
1654 {
1655         struct symbol *ctype, *base;
1656 
1657         if (!expr)
1658                 return NULL;
1659         ctype = expr->ctype;
1660         if (!ctype)
1661                 return NULL;
1662         base = examine_symbol_type(ctype);
1663         if (ctype->type == SYM_NODE)


1759 
1760 
1761 static struct symbol *evaluate_dereference(struct expression *expr)
1762 {
1763         struct expression *op = expr->unop;
1764         struct symbol *ctype = op->ctype, *node, *target;
1765 
1766         /* Simplify: *&(expr) => (expr) */
1767         if (op->type == EXPR_PREOP && op->op == '&') {
1768                 *expr = *op->unop;
1769                 expr->flags = CEF_NONE;
1770                 return expr->ctype;
1771         }
1772 
1773         examine_symbol_type(ctype);
1774 
1775         /* Dereferencing a node drops all the node information. */
1776         if (ctype->type == SYM_NODE)
1777                 ctype = ctype->ctype.base_type;
1778 
1779         node = alloc_symbol(expr->pos, SYM_NODE);
1780         target = ctype->ctype.base_type;

1781 
1782         switch (ctype->type) {
1783         default:
1784                 expression_error(expr, "cannot dereference this type");
1785                 return NULL;



1786         case SYM_PTR:

1787                 node->ctype.modifiers = target->ctype.modifiers & MOD_SPECIFIER;
1788                 merge_type(node, ctype);
1789                 break;
1790 
1791         case SYM_ARRAY:
1792                 if (!lvalue_expression(op)) {
1793                         expression_error(op, "non-lvalue array??");
1794                         return NULL;
1795                 }
1796 
1797                 /* Do the implied "addressof" on the array */
1798                 *op = *op->unop;
1799 
1800                 /*
1801                  * When an array is dereferenced, we need to pick
1802                  * up the attributes of the original node too..
1803                  */

1804                 merge_type(node, op->ctype);
1805                 merge_type(node, ctype);
1806                 break;
1807         }
1808 
1809         node->bit_size = target->bit_size;
1810         node->array_size = target->array_size;
1811 
1812         expr->ctype = node;
1813         return node;
1814 }
1815 
1816 /*
1817  * Unary post-ops: x++ and x--
1818  */
1819 static struct symbol *evaluate_postop(struct expression *expr)
1820 {
1821         struct expression *op = expr->unop;
1822         struct symbol *ctype = op->ctype;
1823         int class = classify_type(ctype, &ctype);


1897         case '+':
1898         case '-':
1899         case '~':
1900                 return evaluate_sign(expr);
1901 
1902         case '*':
1903                 return evaluate_dereference(expr);
1904 
1905         case '&':
1906                 return evaluate_addressof(expr);
1907 
1908         case SPECIAL_INCREMENT:
1909         case SPECIAL_DECREMENT:
1910                 /*
1911                  * From a type evaluation standpoint the preops are
1912                  * the same as the postops
1913                  */
1914                 return evaluate_postop(expr);
1915 
1916         case '!':

1917                 expr->flags = expr->unop->flags & ~CEF_CONST_MASK;
1918                 /*
1919                  * A logical negation never yields an address constant
1920                  * [6.6(9)].
1921                  */
1922                 expr->flags &= ~CEF_ADDR;
1923 
1924                 if (is_safe_type(ctype))
1925                         warning(expr->pos, "testing a 'safe expression'");
1926                 if (is_float_type(ctype)) {
1927                         struct expression *arg = expr->unop;
1928                         expr->type = EXPR_COMPARE;
1929                         expr->op = SPECIAL_EQUAL;
1930                         expr->left = arg;
1931                         expr->right = alloc_expression(expr->pos, EXPR_FVALUE);
1932                         expr->right->ctype = ctype;
1933                         expr->right->fvalue = 0;
1934                 } else if (is_fouled_type(ctype)) {
1935                         warning(expr->pos, "%s degrades to integer",
1936                                 show_typename(ctype->ctype.base_type));


2004          * The ctype of the pointer will be lazily evaluated if
2005          * we ever take the address of this member dereference..
2006          */
2007         add->ctype = &lazy_ptr_ctype;
2008         /*
2009          * The resulting address of a member access through an address
2010          * constant is an address constant again [6.6(9)].
2011          */
2012         add->flags = expr->flags;
2013 
2014         return add;
2015 }
2016 
2017 /* structure/union dereference */
2018 static struct symbol *evaluate_member_dereference(struct expression *expr)
2019 {
2020         int offset;
2021         struct symbol *ctype, *member;
2022         struct expression *deref = expr->deref, *add;
2023         struct ident *ident = expr->member;

2024         unsigned int mod;
2025         int address_space;
2026 
2027         if (!evaluate_expression(deref))
2028                 return NULL;
2029         if (!ident) {
2030                 expression_error(expr, "bad member name");
2031                 return NULL;
2032         }
2033 
2034         ctype = deref->ctype;
2035         examine_symbol_type(ctype);
2036         address_space = ctype->ctype.as;
2037         mod = ctype->ctype.modifiers;
2038         if (ctype->type == SYM_NODE) {
2039                 ctype = ctype->ctype.base_type;
2040                 address_space |= ctype->ctype.as;
2041                 mod |= ctype->ctype.modifiers;
2042         }
2043         if (!ctype || (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION)) {
2044                 expression_error(expr, "expected structure or union");
2045                 return NULL;
2046         }
2047         offset = 0;
2048         member = find_identifier(ident, ctype->symbol_list, &offset);
2049         if (!member) {
2050                 const char *type = ctype->type == SYM_STRUCT ? "struct" : "union";
2051                 const char *name = "<unnamed>";
2052                 int namelen = 9;
2053                 if (ctype->ident) {
2054                         name = ctype->ident->name;
2055                         namelen = ctype->ident->len;
2056                 }
2057                 if (ctype->symbol_list)
2058                         expression_error(expr, "no member '%s' in %s %.*s",
2059                                 show_ident(ident), type, namelen, name);
2060                 else


2157         return sym;
2158 }
2159 
2160 static struct symbol *evaluate_sizeof(struct expression *expr)
2161 {
2162         struct symbol *type;
2163         int size;
2164 
2165         type = evaluate_type_information(expr);
2166         if (!type)
2167                 return NULL;
2168 
2169         size = type->bit_size;
2170 
2171         if (size < 0 && is_void_type(type)) {
2172                 if (Wpointer_arith)
2173                         warning(expr->pos, "expression using sizeof(void)");
2174                 size = bits_in_char;
2175         }
2176 
2177         if (size == 1 && is_bool_type(type)) {
2178                 if (Wsizeof_bool)
2179                         warning(expr->pos, "expression using sizeof bool");
2180                 size = bits_in_char;
2181         }
2182 
2183         if (is_function(type->ctype.base_type)) {
2184                 if (Wpointer_arith)
2185                         warning(expr->pos, "expression using sizeof on a function");
2186                 size = bits_in_char;
2187         }
2188 
































2189         if ((size < 0) || (size & (bits_in_char - 1)))
2190                 expression_error(expr, "cannot size expression");
2191 
2192         expr->type = EXPR_VALUE;
2193         expr->value = bits_to_bytes(size);
2194         expr->taint = 0;
2195         expr->ctype = size_t_ctype;
2196         return size_t_ctype;
2197 }
2198 
2199 static struct symbol *evaluate_ptrsizeof(struct expression *expr)
2200 {
2201         struct symbol *type;
2202         int size;
2203 
2204         type = evaluate_type_information(expr);
2205         if (!type)
2206                 return NULL;
2207 
2208         if (type->type == SYM_NODE)


2830                 /*
2831                  * Casts of integer literals to pointer type yield
2832                  * address constants [6.6(9)].
2833                  *
2834                  * As an extension, treat address constants cast to a
2835                  * different pointer type as address constants again.
2836                  *
2837                  * As another extension, treat integer constant
2838                  * expressions (in contrast to literals) cast to
2839                  * pointer type as address constants.
2840                  */
2841                 if (old->flags & (CEF_ICE | CEF_ADDR))
2842                         flags = CEF_ADDR;
2843         }
2844 
2845         return flags;
2846 }
2847 
2848 static struct symbol *evaluate_cast(struct expression *expr)
2849 {
2850         struct expression *target = expr->cast_expression;
2851         struct symbol *ctype;
2852         struct symbol *t1, *t2;
2853         int class1, class2;
2854         int as1 = 0, as2 = 0;
2855 
2856         if (!target)
2857                 return NULL;
2858 
2859         /*
2860          * Special case: a cast can be followed by an
2861          * initializer, in which case we need to pass
2862          * the type value down to that initializer rather
2863          * than trying to evaluate it as an expression
2864          *
2865          * A more complex case is when the initializer is
2866          * dereferenced as part of a post-fix expression.
2867          * We need to produce an expression that can be dereferenced.
2868          */
2869         if (target->type == EXPR_INITIALIZER) {
2870                 struct symbol *sym = expr->cast_type;
2871                 struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
2872 
2873                 sym->initializer = target;
2874                 evaluate_symbol(sym);
2875 
2876                 addr->ctype = &lazy_ptr_ctype;   /* Lazy eval */
2877                 addr->symbol = sym;
2878                 if (sym->ctype.modifiers & MOD_TOPLEVEL)
2879                         addr->flags |= CEF_ADDR;
2880 
2881                 expr->type = EXPR_PREOP;
2882                 expr->op = '*';
2883                 expr->unop = addr;
2884                 expr->ctype = sym;
2885 
2886                 return sym;
2887         }
2888 
2889         ctype = examine_symbol_type(expr->cast_type);
2890         expr->ctype = ctype;
2891         expr->cast_type = ctype;
2892 
2893         evaluate_expression(target);
2894         degenerate(target);
2895 
2896         class1 = classify_type(ctype, &t1);
2897 
2898         expr->flags = cast_flags(expr, target);
2899 
2900         /*
2901          * You can always throw a value away by casting to
2902          * "void" - that's an implicit "force". Note that
2903          * the same is _not_ true of "void *".
2904          */
2905         if (t1 == &void_ctype)
2906                 goto out;
2907 
2908         if (class1 & (TYPE_COMPOUND | TYPE_FN))
2909                 warning(expr->pos, "cast to non-scalar");
2910 
2911         t2 = target->ctype;
2912         if (!t2) {
2913                 expression_error(expr, "cast from unknown type");
2914                 goto out;
2915         }
2916         class2 = classify_type(t2, &t2);
2917 
2918         if (class2 & TYPE_COMPOUND)
2919                 warning(expr->pos, "cast from non-scalar");
2920 
2921         if (expr->type == EXPR_FORCE_CAST)
2922                 goto out;
2923 






2924         /* allowed cast unfouls */
2925         if (class2 & TYPE_FOULED)
2926                 t2 = unfoul(t2);
2927 
2928         if (t1 != t2) {
2929                 if ((class1 & TYPE_RESTRICT) && restricted_value(target, t1))
2930                         warning(expr->pos, "cast to %s",
2931                                 show_typename(t1));
2932                 if (class2 & TYPE_RESTRICT) {
2933                         if (t1 == &bool_ctype) {
2934                                 if (class2 & TYPE_FOULED)
2935                                         warning(expr->pos, "%s degrades to integer",
2936                                                 show_typename(t2));
2937                         } else {
2938                                 warning(expr->pos, "cast from %s",
2939                                         show_typename(t2));
2940                         }
2941                 }
2942         }
2943 
2944         if (t1 == &ulong_ctype)
2945                 as1 = -1;
2946         else if (class1 == TYPE_PTR) {
2947                 examine_pointer_target(t1);
2948                 as1 = t1->ctype.as;
2949         }
2950 
2951         if (t2 == &ulong_ctype)
2952                 as2 = -1;
2953         else if (class2 == TYPE_PTR) {
2954                 examine_pointer_target(t2);
2955                 as2 = t2->ctype.as;
2956         }
2957 
2958         if (!as1 && as2 > 0)
2959                 warning(expr->pos, "cast removes address space of expression");
2960         if (as1 > 0 && as2 > 0 && as1 != as2)
2961                 warning(expr->pos, "cast between address spaces (<asn:%d>-><asn:%d>)", as2, as1);
2962         if (as1 > 0 && !as2 &&
2963             !is_null_pointer_constant(target) && Wcast_to_as)
2964                 warning(expr->pos,
2965                         "cast adds address space to expression (<asn:%d>)", as1);
2966 
2967         if (!(t1->ctype.modifiers & MOD_PTRINHERIT) && class1 == TYPE_PTR &&
2968             !as1 && (target->flags & CEF_ICE)) {
2969                 if (t1->ctype.base_type == &void_ctype) {
2970                         if (is_zero_constant(target)) {
2971                                 /* NULL */
2972                                 expr->type = EXPR_VALUE;
2973                                 expr->ctype = &null_ctype;
2974                                 expr->value = 0;
2975                                 return expr->ctype;
2976                         }
2977                 }
2978         }
2979 
2980         if (t1 == &bool_ctype)
2981                 cast_to_bool(expr);
2982 



















2983 out:
2984         return ctype;
2985 }
2986 
2987 /*
2988  * Evaluate a call expression with a symbol. This
2989  * should expand inline functions, and evaluate
2990  * builtins.
2991  */
2992 static int evaluate_symbol_call(struct expression *expr)
2993 {
2994         struct expression *fn = expr->fn;
2995         struct symbol *ctype = fn->ctype;
2996 
2997         if (fn->type != EXPR_PREOP)
2998                 return 0;
2999 
3000         if (ctype->op && ctype->op->evaluate)
3001                 return ctype->op->evaluate(expr);
3002 


3166         return size_t_ctype;
3167 }
3168 
3169 struct symbol *evaluate_expression(struct expression *expr)
3170 {
3171         if (!expr)
3172                 return NULL;
3173         if (expr->ctype)
3174                 return expr->ctype;
3175 
3176         switch (expr->type) {
3177         case EXPR_VALUE:
3178         case EXPR_FVALUE:
3179                 expression_error(expr, "value expression without a type");
3180                 return NULL;
3181         case EXPR_STRING:
3182                 return evaluate_string(expr);
3183         case EXPR_SYMBOL:
3184                 return evaluate_symbol_expression(expr);
3185         case EXPR_BINOP:
3186                 if (!evaluate_expression(expr->left))


3187                         return NULL;
3188                 if (!evaluate_expression(expr->right))
3189                         return NULL;
3190                 return evaluate_binop(expr);
3191         case EXPR_LOGICAL:
3192                 return evaluate_logical(expr);
3193         case EXPR_COMMA:
3194                 evaluate_expression(expr->left);
3195                 if (!evaluate_expression(expr->right))
3196                         return NULL;
3197                 return evaluate_comma(expr);
3198         case EXPR_COMPARE:
3199                 if (!evaluate_expression(expr->left))


3200                         return NULL;
3201                 if (!evaluate_expression(expr->right))
3202                         return NULL;
3203                 return evaluate_compare(expr);
3204         case EXPR_ASSIGNMENT:
3205                 if (!evaluate_expression(expr->left))


3206                         return NULL;
3207                 if (!evaluate_expression(expr->right))
3208                         return NULL;
3209                 return evaluate_assignment(expr);
3210         case EXPR_PREOP:
3211                 if (!evaluate_expression(expr->unop))
3212                         return NULL;
3213                 return evaluate_preop(expr);
3214         case EXPR_POSTOP:
3215                 if (!evaluate_expression(expr->unop))
3216                         return NULL;
3217                 return evaluate_postop(expr);
3218         case EXPR_CAST:
3219         case EXPR_FORCE_CAST:
3220         case EXPR_IMPLIED_CAST:
3221                 return evaluate_cast(expr);
3222         case EXPR_SIZEOF:
3223                 return evaluate_sizeof(expr);
3224         case EXPR_PTRSIZEOF:
3225                 return evaluate_ptrsizeof(expr);
3226         case EXPR_ALIGNOF:
3227                 return evaluate_alignof(expr);
3228         case EXPR_DEREF:


3243         case EXPR_TYPE:
3244                 /* Evaluate the type of the symbol .. */
3245                 evaluate_symbol(expr->symbol);
3246                 /* .. but the type of the _expression_ is a "type" */
3247                 expr->ctype = &type_ctype;
3248                 return &type_ctype;
3249 
3250         case EXPR_OFFSETOF:
3251                 return evaluate_offsetof(expr);
3252 
3253         /* These can not exist as stand-alone expressions */
3254         case EXPR_INITIALIZER:
3255         case EXPR_IDENTIFIER:
3256         case EXPR_INDEX:
3257         case EXPR_POS:
3258                 expression_error(expr, "internal front-end error: initializer in expression");
3259                 return NULL;
3260         case EXPR_SLICE:
3261                 expression_error(expr, "internal front-end error: SLICE re-evaluated");
3262                 return NULL;



3263         }
3264         return NULL;
3265 }
3266 
3267 static void check_duplicates(struct symbol *sym)
3268 {
3269         int declared = 0;
3270         struct symbol *next = sym;
3271         int initialized = sym->initializer != NULL;
3272 
3273         while ((next = next->same_symbol) != NULL) {
3274                 const char *typediff;
3275                 evaluate_symbol(next);
3276                 if (initialized && next->initializer) {
3277                         sparse_error(sym->pos, "symbol '%s' has multiple initializers (originally initialized at %s:%d)",
3278                                 show_ident(sym->ident),
3279                                 stream_name(next->pos.stream), next->pos.line);
3280                         /* Only warn once */
3281                         initialized = 0;
3282                 }
3283                 declared++;
3284                 typediff = type_difference(&sym->ctype, &next->ctype, 0, 0);
3285                 if (typediff) {
3286                         sparse_error(sym->pos, "symbol '%s' redeclared with different type (originally declared at %s:%d) - %s",
3287                                 show_ident(sym->ident),
3288                                 stream_name(next->pos.stream), next->pos.line, typediff);
3289                         return;
3290                 }
3291         }
3292         if (!declared) {
3293                 unsigned long mod = sym->ctype.modifiers;
3294                 if (mod & (MOD_STATIC | MOD_REGISTER))
3295                         return;
3296                 if (!(mod & MOD_TOPLEVEL))
3297                         return;
3298                 if (!Wdecl)
3299                         return;
3300                 if (sym->ident == &main_ident)
3301                         return;
3302                 warning(sym->pos, "symbol '%s' was not declared. Should it be static?", show_ident(sym->ident));
3303         }
3304 }
3305 
3306 static struct symbol *evaluate_symbol(struct symbol *sym)
3307 {
3308         struct symbol *base_type;
3309 
3310         if (!sym)
3311                 return sym;
3312         if (sym->evaluated)
3313                 return sym;
3314         sym->evaluated = 1;


3405         case '=':       /* Assignment */
3406         case '+':       /* Update */
3407                 break;
3408         default:
3409                 expression_error(expr, "output constraint is not an assignment constraint (\"%s\")", constraint);
3410         }
3411 }
3412 
3413 static void verify_input_constraint(struct expression *expr, const char *constraint)
3414 {
3415         switch (*constraint) {
3416         case '=':       /* Assignment */
3417         case '+':       /* Update */
3418                 expression_error(expr, "input constraint with assignment (\"%s\")", constraint);
3419         }
3420 }
3421 
3422 static void evaluate_asm_statement(struct statement *stmt)
3423 {
3424         struct expression *expr;

3425         struct symbol *sym;
3426         int state;
3427 
3428         expr = stmt->asm_string;
3429         if (!expr || expr->type != EXPR_STRING) {
3430                 sparse_error(stmt->pos, "need constant string for inline asm");
3431                 return;
3432         }
3433 
3434         state = 0;
3435         FOR_EACH_PTR(stmt->asm_outputs, expr) {
3436                 switch (state) {
3437                 case 0: /* Identifier */
3438                         state = 1;
3439                         continue;
3440 
3441                 case 1: /* Constraint */
3442                         state = 2;
3443                         if (!expr || expr->type != EXPR_STRING) {
3444                                 sparse_error(expr ? expr->pos : stmt->pos, "asm output constraint is not a string");
3445                                 *THIS_ADDRESS(expr) = NULL;
3446                                 continue;
3447                         }
3448                         verify_output_constraint(expr, expr->string->data);
3449                         continue;
3450 
3451                 case 2: /* Expression */
3452                         state = 0;
3453                         if (!evaluate_expression(expr))
3454                                 return;
3455                         if (!lvalue_expression(expr))
3456                                 warning(expr->pos, "asm output is not an lvalue");
3457                         evaluate_assign_to(expr, expr->ctype);
3458                         continue;
3459                 }
3460         } END_FOR_EACH_PTR(expr);
3461 
3462         state = 0;
3463         FOR_EACH_PTR(stmt->asm_inputs, expr) {
3464                 switch (state) {
3465                 case 0: /* Identifier */
3466                         state = 1;
3467                         continue;
3468 
3469                 case 1: /* Constraint */
3470                         state = 2;
3471                         if (!expr || expr->type != EXPR_STRING) {
3472                                 sparse_error(expr ? expr->pos : stmt->pos, "asm input constraint is not a string");
3473                                 *THIS_ADDRESS(expr) = NULL;
3474                                 continue;
3475                         }
3476                         verify_input_constraint(expr, expr->string->data);
3477                         continue;
3478 
3479                 case 2: /* Expression */
3480                         state = 0;
3481                         if (!evaluate_expression(expr))
3482                                 return;
3483                         continue;
3484                 }
3485         } END_FOR_EACH_PTR(expr);
3486 
3487         FOR_EACH_PTR(stmt->asm_clobbers, expr) {
3488                 if (!expr) {
3489                         sparse_error(stmt->pos, "bad asm clobbers");
3490                         return;
3491                 }
3492                 if (expr->type == EXPR_STRING)
3493                         continue;
3494                 expression_error(expr, "asm clobber is not a string");
3495         } END_FOR_EACH_PTR(expr);
3496 
3497         FOR_EACH_PTR(stmt->asm_labels, sym) {
3498                 if (!sym || sym->type != SYM_LABEL) {
3499                         sparse_error(stmt->pos, "bad asm label");
3500                         return;
3501                 }
3502         } END_FOR_EACH_PTR(sym);
3503 }
3504 
3505 static void evaluate_case_statement(struct statement *stmt)


3565         struct expression *sel = stmt->switch_expression;
3566 
3567         evaluate_expression(sel);
3568         evaluate_statement(stmt->switch_statement);
3569         if (!sel)
3570                 return;
3571         if (sel->ctype && is_enum_type(sel->ctype))
3572                 enumcase_holder = NULL; /* Only check cases against switch */
3573 
3574         FOR_EACH_PTR(stmt->switch_case->symbol_list, sym) {
3575                 struct statement *case_stmt = sym->stmt;
3576                 check_case_type(sel, case_stmt->case_expression, enumcase_holder);
3577                 check_case_type(sel, case_stmt->case_to, enumcase_holder);
3578         } END_FOR_EACH_PTR(sym);
3579 }
3580 
3581 static void evaluate_goto_statement(struct statement *stmt)
3582 {
3583         struct symbol *label = stmt->goto_label;
3584 
3585         if (label && !label->stmt && !lookup_keyword(label->ident, NS_KEYWORD))
3586                 sparse_error(stmt->pos, "label '%s' was not declared", show_ident(label->ident));
3587 
3588         evaluate_expression(stmt->goto_expression);
3589 }
3590 
3591 struct symbol *evaluate_statement(struct statement *stmt)
3592 {
3593         if (!stmt)
3594                 return NULL;
3595 
3596         switch (stmt->type) {
3597         case STMT_DECLARATION: {
3598                 struct symbol *s;
3599                 FOR_EACH_PTR(stmt->declaration, s) {
3600                         evaluate_symbol(s);
3601                 } END_FOR_EACH_PTR(s);
3602                 return NULL;
3603         }
3604 
3605         case STMT_RETURN:




  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  *
  25  * Evaluate constant expressions.
  26  */
  27 #include <stdlib.h>
  28 #include <stdarg.h>
  29 #include <stddef.h>
  30 #include <stdio.h>
  31 #include <string.h>
  32 #include <ctype.h>
  33 #include <unistd.h>
  34 #include <fcntl.h>
  35 #include <limits.h>
  36 
  37 #include "evaluate.h"
  38 #include "lib.h"
  39 #include "allocate.h"
  40 #include "parse.h"
  41 #include "token.h"
  42 #include "symbol.h"
  43 #include "target.h"
  44 #include "expression.h"
  45 
  46 struct symbol *current_fn;
  47 
  48 struct ident bad_address_space = { .len = 6, .name = "bad AS", };
  49 
  50 static struct symbol *degenerate(struct expression *expr);
  51 static struct symbol *evaluate_symbol(struct symbol *sym);
  52 
  53 static inline int valid_expr_type(struct expression *expr)
  54 {
  55         return expr && valid_type(expr->ctype);
  56 }
  57 
  58 static inline int valid_subexpr_type(struct expression *expr)
  59 {
  60         return valid_expr_type(expr->left)
  61             && valid_expr_type(expr->right);
  62 }
  63 
  64 static struct symbol *evaluate_symbol_expression(struct expression *expr)
  65 {
  66         struct expression *addr;
  67         struct symbol *sym = expr->symbol;
  68         struct symbol *base_type;
  69 
  70         if (!sym) {
  71                 expression_error(expr, "undefined identifier '%s'", show_ident(expr->symbol_name));
  72                 return NULL;
  73         }
  74 
  75         examine_symbol_type(sym);
  76 
  77         base_type = get_base_type(sym);
  78         if (!base_type) {
  79                 expression_error(expr, "identifier '%s' has no type", show_ident(expr->symbol_name));
  80                 return NULL;
  81         }
  82 
  83         addr = alloc_expression(expr->pos, EXPR_SYMBOL);


 193 
 194         lmod = left->ctype.modifiers;
 195         rmod = right->ctype.modifiers;
 196         if ((lmod ^ rmod) & MOD_UNSIGNED) {
 197                 if (lmod & MOD_UNSIGNED)
 198                         goto left;
 199         } else if ((lmod & ~rmod) & (MOD_LONG_ALL))
 200                 goto left;
 201 right:
 202         left = right;
 203 left:
 204         return left;
 205 }
 206 
 207 static int same_cast_type(struct symbol *orig, struct symbol *new)
 208 {
 209         return orig->bit_size == new->bit_size &&
 210                orig->bit_offset == new->bit_offset;
 211 }
 212 
 213 static struct symbol *base_type(struct symbol *node, unsigned long *modp, struct ident **asp)
 214 {
 215         unsigned long mod = 0;
 216         struct ident *as = NULL;
 217 

 218         while (node) {
 219                 mod |= node->ctype.modifiers;
 220                 combine_address_space(node->pos, &as, node->ctype.as);
 221                 if (node->type == SYM_NODE) {
 222                         node = node->ctype.base_type;
 223                         continue;
 224                 }
 225                 break;
 226         }
 227         *modp = mod & ~MOD_IGNORE;
 228         *asp = as;
 229         return node;
 230 }
 231 
 232 static int is_same_type(struct expression *expr, struct symbol *new)
 233 {
 234         struct symbol *old = expr->ctype;
 235         unsigned long oldmod, newmod;
 236         struct ident *oldas, *newas;
 237 
 238         old = base_type(old, &oldmod, &oldas);
 239         new = base_type(new, &newmod, &newas);
 240 
 241         /* Same base type, same address space? */
 242         if (old == new && oldas == newas) {
 243                 unsigned long difmod;
 244 
 245                 /* Check the modifier bits. */
 246                 difmod = (oldmod ^ newmod) & ~MOD_NOCAST;
 247 
 248                 /* Exact same type? */
 249                 if (!difmod)
 250                         return 1;
 251 
 252                 /*
 253                  * Not the same type, but differs only in "const".
 254                  * Don't warn about MOD_NOCAST.
 255                  */
 256                 if (difmod == MOD_CONST)


 391         if (type->type == SYM_BASETYPE) {
 392                 if (type->ctype.base_type == &int_type)
 393                         return TYPE_NUM;
 394                 if (type->ctype.base_type == &fp_type)
 395                         return TYPE_NUM | TYPE_FLOAT;
 396         }
 397         return type_class[type->type];
 398 }
 399 
 400 #define is_int(class) ((class & (TYPE_NUM | TYPE_FLOAT)) == TYPE_NUM)
 401 
 402 static inline int is_string_type(struct symbol *type)
 403 {
 404         if (type->type == SYM_NODE)
 405                 type = type->ctype.base_type;
 406         return type->type == SYM_ARRAY && is_byte_type(type->ctype.base_type);
 407 }
 408 
 409 static struct symbol *bad_expr_type(struct expression *expr)
 410 {

 411         switch (expr->type) {
 412         case EXPR_BINOP:
 413         case EXPR_COMPARE:
 414                 if (!valid_subexpr_type(expr))
 415                         break;
 416                 sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
 417                 info(expr->pos, "   left side has type %s", show_typename(expr->left->ctype));
 418                 info(expr->pos, "   right side has type %s", show_typename(expr->right->ctype));
 419                 break;
 420         case EXPR_PREOP:
 421         case EXPR_POSTOP:
 422                 if (!valid_expr_type(expr->unop))
 423                         break;
 424                 sparse_error(expr->pos, "incompatible types for operation (%s)", show_special(expr->op));
 425                 info(expr->pos, "   argument has type %s", show_typename(expr->unop->ctype));
 426                 break;
 427         default:
 428                 break;
 429         }
 430 
 431         expr->flags = CEF_NONE;
 432         return expr->ctype = &bad_ctype;
 433 }
 434 
 435 static int restricted_value(struct expression *v, struct symbol *type)
 436 {
 437         if (v->type != EXPR_VALUE)
 438                 return 1;
 439         if (v->value != 0)
 440                 return 1;
 441         return 0;
 442 }
 443 
 444 static int restricted_binop(int op, struct symbol *type)


 641         if (multiply > 1) {
 642                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 643                 struct expression *mul = alloc_expression(expr->pos, EXPR_BINOP);
 644 
 645                 val->ctype = ssize_t_ctype;
 646                 val->value = multiply;
 647 
 648                 mul->op = '*';
 649                 mul->ctype = ssize_t_ctype;
 650                 mul->left = index;
 651                 mul->right = val;
 652                 index = mul;
 653         }
 654 
 655         expr->right = index;
 656         return ctype;
 657 }
 658 
 659 static void examine_fn_arguments(struct symbol *fn);
 660 
 661 #define MOD_IGN (MOD_QUALIFIER | MOD_PURE)
 662 
 663 const char *type_difference(struct ctype *c1, struct ctype *c2,
 664         unsigned long mod1, unsigned long mod2)
 665 {
 666         struct ident *as1 = c1->as, *as2 = c2->as;
 667         struct symbol *t1 = c1->base_type;
 668         struct symbol *t2 = c2->base_type;
 669         int move1 = 1, move2 = 1;
 670         mod1 |= c1->modifiers;
 671         mod2 |= c2->modifiers;
 672         for (;;) {
 673                 unsigned long diff;
 674                 int type;
 675                 struct symbol *base1 = t1->ctype.base_type;
 676                 struct symbol *base2 = t2->ctype.base_type;
 677 
 678                 /*
 679                  * FIXME! Collect alignment and context too here!
 680                  */
 681                 if (move1) {
 682                         if (t1 && t1->type != SYM_PTR) {
 683                                 mod1 |= t1->ctype.modifiers;
 684                                 combine_address_space(t1->pos, &as1, t1->ctype.as);
 685                         }
 686                         move1 = 0;
 687                 }
 688 
 689                 if (move2) {
 690                         if (t2 && t2->type != SYM_PTR) {
 691                                 mod2 |= t2->ctype.modifiers;
 692                                 combine_address_space(t2->pos, &as2, t2->ctype.as);
 693                         }
 694                         move2 = 0;
 695                 }
 696 
 697                 if (t1 == t2)
 698                         break;
 699                 if (!t1 || !t2)
 700                         return "different types";
 701 
 702                 if (t1->type == SYM_NODE || t1->type == SYM_ENUM) {
 703                         t1 = base1;
 704                         move1 = 1;
 705                         if (!t1)
 706                                 return "bad types";
 707                         continue;
 708                 }
 709 
 710                 if (t2->type == SYM_NODE || t2->type == SYM_ENUM) {
 711                         t2 = base2;
 712                         move2 = 1;


 850                                    target_qualifiers(ltype));
 851         if (typediff)
 852                 expression_error(expr, "subtraction of different types can't work (%s)", typediff);
 853 
 854         if (is_function(lbase)) {
 855                 expression_error(expr, "subtraction of functions? Share your drugs");
 856                 return NULL;
 857         }
 858 
 859         expr->ctype = ssize_t_ctype;
 860         if (lbase->bit_size > bits_in_char) {
 861                 struct expression *sub = alloc_expression(expr->pos, EXPR_BINOP);
 862                 struct expression *div = expr;
 863                 struct expression *val = alloc_expression(expr->pos, EXPR_VALUE);
 864                 unsigned long value = bits_to_bytes(lbase->bit_size);
 865 
 866                 val->ctype = size_t_ctype;
 867                 val->value = value;
 868 
 869                 if (value & (value-1)) {
 870                         if (Wptr_subtraction_blows) {
 871                                 warning(expr->pos, "potentially expensive pointer subtraction");
 872                                 info(expr->pos, "    '%s' has a non-power-of-2 size: %lu", show_typename(lbase), value);
 873                         }
 874                 }
 875 
 876                 sub->op = '-';
 877                 sub->ctype = ssize_t_ctype;
 878                 sub->left = l;
 879                 sub->right = r;
 880 
 881                 div->op = '/';
 882                 div->left = sub;
 883                 div->right = val;
 884         }
 885                 
 886         return ssize_t_ctype;
 887 }
 888 
 889 #define is_safe_type(type) ((type)->ctype.modifiers & MOD_SAFE)
 890 
 891 static struct symbol *evaluate_conditional(struct expression *expr, int iterator)
 892 {
 893         struct symbol *ctype;
 894 
 895         if (!expr)
 896                 return NULL;
 897 
 898         if (!iterator && expr->type == EXPR_ASSIGNMENT && expr->op == '=')
 899                 warning(expr->pos, "assignment expression in conditional");
 900 
 901         ctype = evaluate_expression(expr);
 902         if (!valid_type(ctype))
 903                 return NULL;
 904         if (is_safe_type(ctype))
 905                 warning(expr->pos, "testing a 'safe expression'");
 906         if (is_func_type(ctype)) {
 907                 if (Waddress)
 908                         warning(expr->pos, "the address of %s will always evaluate as true", "a function");
 909         } else if (is_array_type(ctype)) {
 910                 if (Waddress)
 911                         warning(expr->pos, "the address of %s will always evaluate as true", "an array");
 912         } else if (!is_scalar_type(ctype)) {
 913                 sparse_error(expr->pos, "incorrect type in conditional (non-scalar type)");
 914                 info(expr->pos, "   got %s", show_typename(ctype));
 915                 return NULL;
 916         }


 917 
 918         ctype = degenerate(expr);
 919         return ctype;
 920 }
 921 
 922 static struct symbol *evaluate_logical(struct expression *expr)
 923 {
 924         if (!evaluate_conditional(expr->left, 0))
 925                 return NULL;
 926         if (!evaluate_conditional(expr->right, 0))
 927                 return NULL;
 928 
 929         /* the result is int [6.5.13(3), 6.5.14(3)] */
 930         expr->ctype = &int_ctype;
 931         expr->flags = expr->left->flags & expr->right->flags;
 932         expr->flags &= ~(CEF_CONST_MASK | CEF_ADDR);
 933         return &int_ctype;
 934 }
 935 
 936 static struct symbol *evaluate_binop(struct expression *expr)
 937 {
 938         struct symbol *ltype, *rtype, *ctype;


1010         expr->ctype = degenerate(expr->right);
1011         if (expr->ctype == &null_ctype)
1012                 expr->ctype = &ptr_ctype;
1013         expr->flags &= expr->left->flags & expr->right->flags;
1014         return expr->ctype;
1015 }
1016 
1017 static int modify_for_unsigned(int op)
1018 {
1019         if (op == '<')
1020                 op = SPECIAL_UNSIGNED_LT;
1021         else if (op == '>')
1022                 op = SPECIAL_UNSIGNED_GT;
1023         else if (op == SPECIAL_LTE)
1024                 op = SPECIAL_UNSIGNED_LTE;
1025         else if (op == SPECIAL_GTE)
1026                 op = SPECIAL_UNSIGNED_GTE;
1027         return op;
1028 }
1029 
1030 enum null_constant_type {
1031         NON_NULL,
1032         NULL_PTR,
1033         NULL_ZERO,
1034 };
1035 
1036 static inline int is_null_pointer_constant(struct expression *e)
1037 {
1038         if (e->ctype == &null_ctype)
1039                 return NULL_PTR;
1040         if (!(e->flags & CEF_ICE))
1041                 return NON_NULL;
1042         return is_zero_constant(e) ? NULL_ZERO : NON_NULL;
1043 }
1044 
1045 static struct symbol *evaluate_compare(struct expression *expr)
1046 {
1047         struct expression *left = expr->left, *right = expr->right;
1048         struct symbol *ltype, *rtype, *lbase, *rbase;
1049         int lclass = classify_type(degenerate(left), &ltype);
1050         int rclass = classify_type(degenerate(right), &rtype);
1051         struct symbol *ctype;
1052         const char *typediff;
1053 
1054         /* Type types? */
1055         if (is_type_type(ltype) && is_type_type(rtype)) {
1056                 /*
1057                  * __builtin_types_compatible_p() yields an integer
1058                  * constant expression
1059                  */
1060                 expr->flags = CEF_SET_ICE;
1061                 goto OK;
1062         }


1068 
1069         /* number on number */
1070         if (lclass & rclass & TYPE_NUM) {
1071                 ctype = usual_conversions(expr->op, expr->left, expr->right,
1072                                           lclass, rclass, ltype, rtype);
1073                 expr->left = cast_to(expr->left, ctype);
1074                 expr->right = cast_to(expr->right, ctype);
1075                 if (ctype->ctype.modifiers & MOD_UNSIGNED)
1076                         expr->op = modify_for_unsigned(expr->op);
1077                 goto OK;
1078         }
1079 
1080         /* at least one must be a pointer */
1081         if (!((lclass | rclass) & TYPE_PTR))
1082                 return bad_expr_type(expr);
1083 
1084         /* equality comparisons can be with null pointer constants */
1085         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1086                 int is_null1 = is_null_pointer_constant(left);
1087                 int is_null2 = is_null_pointer_constant(right);
1088                 if (is_null1 == NULL_ZERO)
1089                         bad_null(left);
1090                 if (is_null2 == NULL_ZERO)
1091                         bad_null(right);
1092                 if (is_null1 && is_null2) {
1093                         int positive = expr->op == SPECIAL_EQUAL;
1094                         expr->type = EXPR_VALUE;
1095                         expr->value = positive;
1096                         goto OK;
1097                 }
1098                 if (is_null1 && (rclass & TYPE_PTR)) {
1099                         left = cast_to(left, rtype);
1100                         goto OK;
1101                 }
1102                 if (is_null2 && (lclass & TYPE_PTR)) {
1103                         right = cast_to(right, ltype);
1104                         goto OK;
1105                 }
1106         }
1107         /* both should be pointers */
1108         if (!(lclass & rclass & TYPE_PTR))
1109                 return bad_expr_type(expr);
1110         expr->op = modify_for_unsigned(expr->op);


1115         /* they also have special treatment for pointers to void */
1116         if (expr->op == SPECIAL_EQUAL || expr->op == SPECIAL_NOTEQUAL) {
1117                 if (ltype->ctype.as == rtype->ctype.as) {
1118                         if (lbase == &void_ctype) {
1119                                 right = cast_to(right, ltype);
1120                                 goto OK;
1121                         }
1122                         if (rbase == &void_ctype) {
1123                                 left = cast_to(left, rtype);
1124                                 goto OK;
1125                         }
1126                 }
1127         }
1128 
1129         typediff = type_difference(&ltype->ctype, &rtype->ctype,
1130                                    target_qualifiers(rtype),
1131                                    target_qualifiers(ltype));
1132         if (!typediff)
1133                 goto OK;
1134 
1135         expression_error(expr, "incompatible types in comparison expression (%s):", typediff);
1136         info(expr->pos, "   %s", show_typename(ltype));
1137         info(expr->pos, "   %s", show_typename(rtype));
1138         return NULL;
1139 
1140 OK:
1141         /* the result is int [6.5.8(6), 6.5.9(3)]*/
1142         expr->ctype = &int_ctype;
1143         return &int_ctype;
1144 }
1145 
1146 /*
1147  * NOTE! The degenerate case of "x ? : y", where we don't
1148  * have a true case, this will possibly promote "x" to the
1149  * same type as "y", and thus _change_ the conditional
1150  * test in the expression. But since promotion is "safe"
1151  * for testing, that's OK.
1152  */
1153 static struct symbol *evaluate_conditional_expression(struct expression *expr)
1154 {
1155         struct expression **cond;
1156         struct symbol *ctype, *ltype, *rtype, *lbase, *rbase;
1157         int lclass, rclass;
1158         const char * typediff;
1159         int qual;
1160 
1161         if (!evaluate_conditional(expr->conditional, 0))
1162                 return NULL;
1163         if (!evaluate_expression(expr->cond_false))
1164                 return NULL;
1165 
1166         ctype = degenerate(expr->conditional);
1167         rtype = degenerate(expr->cond_false);
1168 
1169         cond = &expr->conditional;
1170         ltype = ctype;
1171         if (expr->cond_true) {
1172                 if (!evaluate_expression(expr->cond_true))
1173                         return NULL;
1174                 ltype = degenerate(expr->cond_true);
1175                 cond = &expr->cond_true;
1176         }
1177 
1178         expr->flags = (expr->conditional->flags & (*cond)->flags &
1179                         expr->cond_false->flags & ~CEF_CONST_MASK);
1180         /*
1181          * A conditional operator yields a particular constant
1182          * expression type only if all of its three subexpressions are
1183          * of that type [6.6(6), 6.6(8)].
1184          * As an extension, relax this restriction by allowing any
1185          * constant expression type for the condition expression.
1186          *
1187          * A conditional operator never yields an address constant
1188          * [6.6(9)].
1189          * However, as an extension, if the condition is any constant
1190          * expression, and the true and false expressions are both
1191          * address constants, mark the result as an address constant.
1192          */
1193         if (expr->conditional->flags & (CEF_ACE | CEF_ADDR))
1194                 expr->flags = (*cond)->flags & expr->cond_false->flags & ~CEF_CONST_MASK;
1195 
1196         lclass = classify_type(ltype, &ltype);
1197         rclass = classify_type(rtype, &rtype);
1198         if (lclass & rclass & TYPE_NUM) {
1199                 ctype = usual_conversions('?', *cond, expr->cond_false,
1200                                           lclass, rclass, ltype, rtype);
1201                 *cond = cast_to(*cond, ctype);
1202                 expr->cond_false = cast_to(expr->cond_false, ctype);
1203                 goto out;
1204         }
1205 
1206         if ((lclass | rclass) & TYPE_PTR) {
1207                 int is_null1 = is_null_pointer_constant(*cond);
1208                 int is_null2 = is_null_pointer_constant(expr->cond_false);
1209 
1210                 if (is_null1 && is_null2) {
1211                         *cond = cast_to(*cond, &ptr_ctype);
1212                         expr->cond_false = cast_to(expr->cond_false, &ptr_ctype);
1213                         ctype = &ptr_ctype;
1214                         goto out;
1215                 }
1216                 if (is_null1 && (rclass & TYPE_PTR)) {
1217                         if (is_null1 == NULL_ZERO)
1218                                 bad_null(*cond);
1219                         *cond = cast_to(*cond, rtype);
1220                         ctype = rtype;
1221                         goto out;
1222                 }
1223                 if (is_null2 && (lclass & TYPE_PTR)) {
1224                         if (is_null2 == NULL_ZERO)
1225                                 bad_null(expr->cond_false);
1226                         expr->cond_false = cast_to(expr->cond_false, ltype);
1227                         ctype = ltype;
1228                         goto out;
1229                 }
1230                 if (!(lclass & rclass & TYPE_PTR)) {
1231                         typediff = "different types";
1232                         goto Err;
1233                 }
1234                 /* OK, it's pointer on pointer */
1235                 if (ltype->ctype.as != rtype->ctype.as) {
1236                         typediff = "different address spaces";
1237                         goto Err;
1238                 }
1239 
1240                 /* need to be lazier here */
1241                 lbase = examine_pointer_target(ltype);
1242                 rbase = examine_pointer_target(rtype);
1243                 qual = target_qualifiers(ltype) | target_qualifiers(rtype);
1244 


1253                         ctype = rtype;
1254                         goto Qual;
1255                 }
1256                 /* XXX: that should be pointer to composite */
1257                 ctype = ltype;
1258                 typediff = type_difference(&ltype->ctype, &rtype->ctype,
1259                                            qual, qual);
1260                 if (!typediff)
1261                         goto Qual;
1262                 goto Err;
1263         }
1264 
1265         /* void on void, struct on same struct, union on same union */
1266         if (ltype == rtype) {
1267                 ctype = ltype;
1268                 goto out;
1269         }
1270         typediff = "different base types";
1271 
1272 Err:
1273         expression_error(expr, "incompatible types in conditional expression (%s):", typediff);
1274         info(expr->pos, "   %s", show_typename(ltype));
1275         info(expr->pos, "   %s", show_typename(rtype));
1276         /*
1277          * if the condition is constant, the type is in fact known
1278          * so use it, as gcc & clang do.
1279          */
1280         switch (expr_truth_value(expr->conditional)) {
1281         case 1: expr->ctype = ltype;
1282                 break;
1283         case 0: expr->ctype = rtype;
1284                 break;
1285         default:
1286                 break;
1287         }
1288         return NULL;
1289 
1290 out:
1291         expr->ctype = ctype;
1292         return ctype;
1293 
1294 Qual:
1295         if (qual & ~ctype->ctype.modifiers) {
1296                 struct symbol *sym = alloc_symbol(ctype->pos, SYM_PTR);
1297                 *sym = *ctype;
1298                 sym->ctype.modifiers |= qual;
1299                 ctype = sym;
1300         }
1301         *cond = cast_to(*cond, ctype);
1302         expr->cond_false = cast_to(expr->cond_false, ctype);
1303         goto out;
1304 }
1305 
1306 /* FP assignments can not do modulo or bit operations */
1307 static int compatible_float_op(int op)
1308 {
1309         return  op == SPECIAL_ADD_ASSIGN ||
1310                 op == SPECIAL_SUB_ASSIGN ||
1311                 op == SPECIAL_MUL_ASSIGN ||
1312                 op == SPECIAL_DIV_ASSIGN;
1313 }
1314 
1315 static int evaluate_assign_op(struct expression *expr)
1316 {
1317         struct symbol *target = expr->left->ctype;
1318         struct symbol *source = expr->right->ctype;
1319         struct symbol *t, *s;
1320         int tclass = classify_type(target, &t);
1321         int sclass = classify_type(source, &s);
1322         int op = expr->op;
1323 
1324         if (tclass & sclass & TYPE_NUM) {
1325                 if (tclass & TYPE_FLOAT && !compatible_float_op(op)) {
1326                         expression_error(expr, "invalid assignment");
1327                         return 0;
1328                 }
1329                 if (tclass & TYPE_RESTRICT) {
1330                         if (!restricted_binop(op, t)) {
1331                                 warning(expr->pos, "bad assignment (%s) to %s",
1332                                         show_special(op), show_typename(t));
1333                                 expr->right = cast_to(expr->right, target);
1334                                 return 0;
1335                         }
1336                         /* allowed assignments unfoul */
1337                         if (sclass & TYPE_FOULED && unfoul(s) == t)
1338                                 goto Cast;
1339                         if (!restricted_value(expr->right, t))
1340                                 return 1;
1341                 } else if (op == SPECIAL_SHR_ASSIGN || op == SPECIAL_SHL_ASSIGN) {
1342                         // shifts do integer promotions, but that's it.
1343                         unrestrict(expr->right, sclass, &s);
1344                         target = integer_promotion(s);
1345                         goto Cast;
1346                 } else if (!(sclass & TYPE_RESTRICT))
1347                         goto usual;
1348                 /* source and target would better be identical restricted */
1349                 if (t == s)
1350                         return 1;
1351                 warning(expr->pos, "invalid assignment: %s", show_special(op));
1352                 info(expr->pos, "   left side has type %s", show_typename(t));
1353                 info(expr->pos, "   right side has type %s", show_typename(s));
1354                 expr->right = cast_to(expr->right, target);
1355                 return 0;
1356         }
1357         if (tclass == TYPE_PTR && is_int(sclass)) {
1358                 if (op == SPECIAL_ADD_ASSIGN || op == SPECIAL_SUB_ASSIGN) {
1359                         unrestrict(expr->right, sclass, &s);
1360                         evaluate_ptr_add(expr, s);
1361                         return 1;
1362                 }
1363                 expression_error(expr, "invalid pointer assignment");
1364                 return 0;
1365         }


1414                         if (s == t)
1415                                 return 1;
1416                 } else if (!(sclass & TYPE_RESTRICT))
1417                         goto Cast;
1418                 if (t == &bool_ctype) {
1419                         if (is_fouled_type(s))
1420                                 warning((*rp)->pos, "%s degrades to integer",
1421                                         show_typename(s->ctype.base_type));
1422                         goto Cast;
1423                 }
1424                 *typediff = "different base types";
1425                 return 0;
1426         }
1427 
1428         if (tclass == TYPE_PTR) {
1429                 unsigned long mod1, mod2;
1430                 struct symbol *b1, *b2;
1431                 // NULL pointer is always OK
1432                 int is_null = is_null_pointer_constant(*rp);
1433                 if (is_null) {
1434                         if (is_null == NULL_ZERO)
1435                                 bad_null(*rp);
1436                         goto Cast;
1437                 }
1438                 if (!(sclass & TYPE_PTR)) {
1439                         *typediff = "different base types";
1440                         return 0;
1441                 }
1442                 b1 = examine_pointer_target(t);
1443                 b2 = examine_pointer_target(s);
1444                 mod1 = target_qualifiers(t);
1445                 mod2 = target_qualifiers(s);
1446                 if (whitelist_pointers(b1, b2)) {
1447                         /*
1448                          * assignments to/from void * are OK, provided that
1449                          * we do not remove qualifiers from pointed to [C]
1450                          * or mix address spaces [sparse].
1451                          */
1452                         if (t->ctype.as != s->ctype.as) {
1453                                 *typediff = "different address spaces";
1454                                 return 0;


1564                 mark_assigned(expr->base);
1565                 return;
1566         default:
1567                 /* Hmm? */
1568                 return;
1569         }
1570 }
1571 
1572 static void evaluate_assign_to(struct expression *left, struct symbol *type)
1573 {
1574         if (type->ctype.modifiers & MOD_CONST)
1575                 expression_error(left, "assignment to const expression");
1576 
1577         /* We know left is an lvalue, so it's a "preop-*" */
1578         mark_assigned(left->unop);
1579 }
1580 
1581 static struct symbol *evaluate_assignment(struct expression *expr)
1582 {
1583         struct expression *left = expr->left;

1584         struct symbol *ltype;
1585 
1586         if (!lvalue_expression(left)) {
1587                 expression_error(expr, "not an lvalue");
1588                 return NULL;
1589         }
1590 
1591         ltype = left->ctype;
1592 
1593         if (expr->op != '=') {
1594                 if (!evaluate_assign_op(expr))
1595                         return NULL;
1596         } else {
1597                 if (!compatible_assignment_types(expr, ltype, &expr->right, "assignment"))
1598                         return NULL;
1599         }
1600 
1601         evaluate_assign_to(left, ltype);
1602 
1603         expr->ctype = ltype;
1604         return ltype;
1605 }
1606 
1607 static void examine_fn_arguments(struct symbol *fn)
1608 {
1609         struct symbol *s;
1610 
1611         FOR_EACH_PTR(fn->arguments, s) {
1612                 struct symbol *arg = evaluate_symbol(s);
1613                 /* Array/function arguments silently degenerate into pointers */
1614                 if (arg) {
1615                         struct symbol *ptr;
1616                         switch(arg->type) {
1617                         case SYM_ARRAY:
1618                         case SYM_FN:
1619                                 ptr = alloc_symbol(s->pos, SYM_PTR);
1620                                 if (arg->type == SYM_ARRAY)
1621                                         ptr->ctype = arg->ctype;
1622                                 else
1623                                         ptr->ctype.base_type = arg;
1624                                 combine_address_space(s->pos, &ptr->ctype.as, s->ctype.as);
1625                                 ptr->ctype.modifiers |= s->ctype.modifiers & MOD_PTRINHERIT;
1626 
1627                                 s->ctype.base_type = ptr;
1628                                 s->ctype.as = NULL;
1629                                 s->ctype.modifiers &= ~MOD_PTRINHERIT;
1630                                 s->bit_size = 0;
1631                                 s->examined = 0;
1632                                 examine_symbol_type(s);
1633                                 break;
1634                         default:
1635                                 /* nothing */
1636                                 break;
1637                         }
1638                 }
1639         } END_FOR_EACH_PTR(s);
1640 }
1641 
1642 static struct symbol *convert_to_as_mod(struct symbol *sym, struct ident *as, int mod)
1643 {
1644         /* Take the modifiers of the pointer, and apply them to the member */
1645         mod |= sym->ctype.modifiers;
1646         if (sym->ctype.as != as || sym->ctype.modifiers != mod) {
1647                 struct symbol *newsym = alloc_symbol(sym->pos, SYM_NODE);
1648                 *newsym = *sym;
1649                 newsym->ctype.as = as;
1650                 newsym->ctype.modifiers = mod;
1651                 sym = newsym;
1652         }
1653         return sym;
1654 }
1655 
1656 static struct symbol *create_pointer(struct expression *expr, struct symbol *sym, int degenerate)
1657 {
1658         struct symbol *node = alloc_symbol(expr->pos, SYM_NODE);
1659         struct symbol *ptr = alloc_symbol(expr->pos, SYM_PTR);
1660 
1661         node->ctype.base_type = ptr;
1662         ptr->bit_size = bits_in_pointer;
1663         ptr->ctype.alignment = pointer_alignment;
1664 
1665         node->bit_size = bits_in_pointer;
1666         node->ctype.alignment = pointer_alignment;
1667 
1668         access_symbol(sym);
1669         if (sym->ctype.modifiers & MOD_REGISTER) {
1670                 warning(expr->pos, "taking address of 'register' variable '%s'", show_ident(sym->ident));
1671                 sym->ctype.modifiers &= ~MOD_REGISTER;
1672         }
1673         if (sym->type == SYM_NODE) {
1674                 combine_address_space(sym->pos, &ptr->ctype.as, sym->ctype.as);
1675                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1676                 sym = sym->ctype.base_type;
1677         }
1678         if (degenerate && sym->type == SYM_ARRAY) {
1679                 combine_address_space(sym->pos, &ptr->ctype.as, sym->ctype.as);
1680                 ptr->ctype.modifiers |= sym->ctype.modifiers & MOD_PTRINHERIT;
1681                 sym = sym->ctype.base_type;
1682         }
1683         ptr->ctype.base_type = sym;
1684 
1685         return node;
1686 }
1687 
1688 /* Arrays degenerate into pointers on pointer arithmetic */
1689 static struct symbol *degenerate(struct expression *expr)
1690 {
1691         struct symbol *ctype, *base;
1692 
1693         if (!expr)
1694                 return NULL;
1695         ctype = expr->ctype;
1696         if (!ctype)
1697                 return NULL;
1698         base = examine_symbol_type(ctype);
1699         if (ctype->type == SYM_NODE)


1795 
1796 
1797 static struct symbol *evaluate_dereference(struct expression *expr)
1798 {
1799         struct expression *op = expr->unop;
1800         struct symbol *ctype = op->ctype, *node, *target;
1801 
1802         /* Simplify: *&(expr) => (expr) */
1803         if (op->type == EXPR_PREOP && op->op == '&') {
1804                 *expr = *op->unop;
1805                 expr->flags = CEF_NONE;
1806                 return expr->ctype;
1807         }
1808 
1809         examine_symbol_type(ctype);
1810 
1811         /* Dereferencing a node drops all the node information. */
1812         if (ctype->type == SYM_NODE)
1813                 ctype = ctype->ctype.base_type;
1814 

1815         target = ctype->ctype.base_type;
1816         examine_symbol_type(target);
1817 
1818         switch (ctype->type) {
1819         default:
1820                 expression_error(expr, "cannot dereference this type");
1821                 return NULL;
1822         case SYM_FN:
1823                 *expr = *op;
1824                 return expr->ctype;
1825         case SYM_PTR:
1826                 node = alloc_symbol(expr->pos, SYM_NODE);
1827                 node->ctype.modifiers = target->ctype.modifiers & MOD_SPECIFIER;
1828                 merge_type(node, ctype);
1829                 break;
1830 
1831         case SYM_ARRAY:
1832                 if (!lvalue_expression(op)) {
1833                         expression_error(op, "non-lvalue array??");
1834                         return NULL;
1835                 }
1836 
1837                 /* Do the implied "addressof" on the array */
1838                 *op = *op->unop;
1839 
1840                 /*
1841                  * When an array is dereferenced, we need to pick
1842                  * up the attributes of the original node too..
1843                  */
1844                 node = alloc_symbol(expr->pos, SYM_NODE);
1845                 merge_type(node, op->ctype);
1846                 merge_type(node, ctype);
1847                 break;
1848         }
1849 
1850         node->bit_size = target->bit_size;
1851         node->array_size = target->array_size;
1852 
1853         expr->ctype = node;
1854         return node;
1855 }
1856 
1857 /*
1858  * Unary post-ops: x++ and x--
1859  */
1860 static struct symbol *evaluate_postop(struct expression *expr)
1861 {
1862         struct expression *op = expr->unop;
1863         struct symbol *ctype = op->ctype;
1864         int class = classify_type(ctype, &ctype);


1938         case '+':
1939         case '-':
1940         case '~':
1941                 return evaluate_sign(expr);
1942 
1943         case '*':
1944                 return evaluate_dereference(expr);
1945 
1946         case '&':
1947                 return evaluate_addressof(expr);
1948 
1949         case SPECIAL_INCREMENT:
1950         case SPECIAL_DECREMENT:
1951                 /*
1952                  * From a type evaluation standpoint the preops are
1953                  * the same as the postops
1954                  */
1955                 return evaluate_postop(expr);
1956 
1957         case '!':
1958                 ctype = degenerate(expr->unop);
1959                 expr->flags = expr->unop->flags & ~CEF_CONST_MASK;
1960                 /*
1961                  * A logical negation never yields an address constant
1962                  * [6.6(9)].
1963                  */
1964                 expr->flags &= ~CEF_ADDR;
1965 
1966                 if (is_safe_type(ctype))
1967                         warning(expr->pos, "testing a 'safe expression'");
1968                 if (is_float_type(ctype)) {
1969                         struct expression *arg = expr->unop;
1970                         expr->type = EXPR_COMPARE;
1971                         expr->op = SPECIAL_EQUAL;
1972                         expr->left = arg;
1973                         expr->right = alloc_expression(expr->pos, EXPR_FVALUE);
1974                         expr->right->ctype = ctype;
1975                         expr->right->fvalue = 0;
1976                 } else if (is_fouled_type(ctype)) {
1977                         warning(expr->pos, "%s degrades to integer",
1978                                 show_typename(ctype->ctype.base_type));


2046          * The ctype of the pointer will be lazily evaluated if
2047          * we ever take the address of this member dereference..
2048          */
2049         add->ctype = &lazy_ptr_ctype;
2050         /*
2051          * The resulting address of a member access through an address
2052          * constant is an address constant again [6.6(9)].
2053          */
2054         add->flags = expr->flags;
2055 
2056         return add;
2057 }
2058 
2059 /* structure/union dereference */
2060 static struct symbol *evaluate_member_dereference(struct expression *expr)
2061 {
2062         int offset;
2063         struct symbol *ctype, *member;
2064         struct expression *deref = expr->deref, *add;
2065         struct ident *ident = expr->member;
2066         struct ident *address_space;
2067         unsigned int mod;

2068 
2069         if (!evaluate_expression(deref))
2070                 return NULL;
2071         if (!ident) {
2072                 expression_error(expr, "bad member name");
2073                 return NULL;
2074         }
2075 
2076         ctype = deref->ctype;
2077         examine_symbol_type(ctype);
2078         address_space = ctype->ctype.as;
2079         mod = ctype->ctype.modifiers;
2080         if (ctype->type == SYM_NODE) {
2081                 ctype = ctype->ctype.base_type;
2082                 combine_address_space(deref->pos, &address_space, ctype->ctype.as);
2083                 mod |= ctype->ctype.modifiers;
2084         }
2085         if (!ctype || (ctype->type != SYM_STRUCT && ctype->type != SYM_UNION)) {
2086                 expression_error(expr, "expected structure or union");
2087                 return NULL;
2088         }
2089         offset = 0;
2090         member = find_identifier(ident, ctype->symbol_list, &offset);
2091         if (!member) {
2092                 const char *type = ctype->type == SYM_STRUCT ? "struct" : "union";
2093                 const char *name = "<unnamed>";
2094                 int namelen = 9;
2095                 if (ctype->ident) {
2096                         name = ctype->ident->name;
2097                         namelen = ctype->ident->len;
2098                 }
2099                 if (ctype->symbol_list)
2100                         expression_error(expr, "no member '%s' in %s %.*s",
2101                                 show_ident(ident), type, namelen, name);
2102                 else


2199         return sym;
2200 }
2201 
2202 static struct symbol *evaluate_sizeof(struct expression *expr)
2203 {
2204         struct symbol *type;
2205         int size;
2206 
2207         type = evaluate_type_information(expr);
2208         if (!type)
2209                 return NULL;
2210 
2211         size = type->bit_size;
2212 
2213         if (size < 0 && is_void_type(type)) {
2214                 if (Wpointer_arith)
2215                         warning(expr->pos, "expression using sizeof(void)");
2216                 size = bits_in_char;
2217         }
2218 
2219         if (is_bool_type(type)) {
2220                 if (Wsizeof_bool)
2221                         warning(expr->pos, "expression using sizeof _Bool");
2222                 size = bits_to_bytes(bits_in_bool) * bits_in_char;
2223         }
2224 
2225         if (is_function(type->ctype.base_type)) {
2226                 if (Wpointer_arith)
2227                         warning(expr->pos, "expression using sizeof on a function");
2228                 size = bits_in_char;
2229         }
2230 
2231         if (is_array_type(type) && size < 0) {       // VLA, 1-dimension only
2232                 struct expression *base, *size;
2233                 struct symbol *base_type;
2234 
2235                 if (type->type == SYM_NODE)
2236                         type = type->ctype.base_type;        // strip the SYM_NODE
2237                 base_type = get_base_type(type);
2238                 if (!base_type)
2239                         goto error;
2240                 if (base_type->bit_size <= 0) {
2241                         base = alloc_expression(expr->pos, EXPR_SIZEOF);
2242                         base->cast_type = base_type;
2243                         if (!evaluate_sizeof(base))
2244                                 goto error;
2245                 } else {
2246                         base = alloc_expression(expr->pos, EXPR_VALUE);
2247                         base->value = bits_to_bytes(base_type->bit_size);
2248                         base->ctype = size_t_ctype;
2249                 }
2250                 size = alloc_expression(expr->pos, EXPR_CAST);
2251                 size->cast_type = size_t_ctype;
2252                 size->cast_expression = type->array_size;
2253                 if (!evaluate_expression(size))
2254                         goto error;
2255                 expr->left = size;
2256                 expr->right = base;
2257                 expr->type = EXPR_BINOP;
2258                 expr->op = '*';
2259                 return expr->ctype = size_t_ctype;
2260         }
2261 
2262 error:
2263         if ((size < 0) || (size & (bits_in_char - 1)))
2264                 expression_error(expr, "cannot size expression");
2265 
2266         expr->type = EXPR_VALUE;
2267         expr->value = bits_to_bytes(size);
2268         expr->taint = 0;
2269         expr->ctype = size_t_ctype;
2270         return size_t_ctype;
2271 }
2272 
2273 static struct symbol *evaluate_ptrsizeof(struct expression *expr)
2274 {
2275         struct symbol *type;
2276         int size;
2277 
2278         type = evaluate_type_information(expr);
2279         if (!type)
2280                 return NULL;
2281 
2282         if (type->type == SYM_NODE)


2904                 /*
2905                  * Casts of integer literals to pointer type yield
2906                  * address constants [6.6(9)].
2907                  *
2908                  * As an extension, treat address constants cast to a
2909                  * different pointer type as address constants again.
2910                  *
2911                  * As another extension, treat integer constant
2912                  * expressions (in contrast to literals) cast to
2913                  * pointer type as address constants.
2914                  */
2915                 if (old->flags & (CEF_ICE | CEF_ADDR))
2916                         flags = CEF_ADDR;
2917         }
2918 
2919         return flags;
2920 }
2921 
2922 static struct symbol *evaluate_cast(struct expression *expr)
2923 {
2924         struct expression *source = expr->cast_expression;
2925         struct symbol *ctype;
2926         struct symbol *ttype, *stype;
2927         int tclass, sclass;
2928         struct ident *tas = NULL, *sas = NULL;
2929 
2930         if (!source)
2931                 return NULL;
2932 
2933         /*
2934          * Special case: a cast can be followed by an
2935          * initializer, in which case we need to pass
2936          * the type value down to that initializer rather
2937          * than trying to evaluate it as an expression
2938          *
2939          * A more complex case is when the initializer is
2940          * dereferenced as part of a post-fix expression.
2941          * We need to produce an expression that can be dereferenced.
2942          */
2943         if (source->type == EXPR_INITIALIZER) {
2944                 struct symbol *sym = expr->cast_type;
2945                 struct expression *addr = alloc_expression(expr->pos, EXPR_SYMBOL);
2946 
2947                 sym->initializer = source;
2948                 evaluate_symbol(sym);
2949 
2950                 addr->ctype = &lazy_ptr_ctype;   /* Lazy eval */
2951                 addr->symbol = sym;
2952                 if (sym->ctype.modifiers & MOD_TOPLEVEL)
2953                         addr->flags |= CEF_ADDR;
2954 
2955                 expr->type = EXPR_PREOP;
2956                 expr->op = '*';
2957                 expr->unop = addr;
2958                 expr->ctype = sym;
2959 
2960                 return sym;
2961         }
2962 
2963         ctype = examine_symbol_type(expr->cast_type);
2964         expr->ctype = ctype;
2965         expr->cast_type = ctype;
2966 
2967         evaluate_expression(source);
2968         degenerate(source);
2969 
2970         tclass = classify_type(ctype, &ttype);
2971 
2972         expr->flags = cast_flags(expr, source);
2973 
2974         /*
2975          * You can always throw a value away by casting to
2976          * "void" - that's an implicit "force". Note that
2977          * the same is _not_ true of "void *".
2978          */
2979         if (ttype == &void_ctype)
2980                 goto out;
2981 
2982         stype = source->ctype;
2983         if (!stype) {



2984                 expression_error(expr, "cast from unknown type");
2985                 goto out;
2986         }
2987         sclass = classify_type(stype, &stype);
2988 



2989         if (expr->type == EXPR_FORCE_CAST)
2990                 goto out;
2991 
2992         if (tclass & (TYPE_COMPOUND | TYPE_FN))
2993                 warning(expr->pos, "cast to non-scalar");
2994 
2995         if (sclass & TYPE_COMPOUND)
2996                 warning(expr->pos, "cast from non-scalar");
2997 
2998         /* allowed cast unfouls */
2999         if (sclass & TYPE_FOULED)
3000                 stype = unfoul(stype);
3001 
3002         if (ttype != stype) {
3003                 if ((tclass & TYPE_RESTRICT) && restricted_value(source, ttype))
3004                         warning(expr->pos, "cast to %s",
3005                                 show_typename(ttype));
3006                 if (sclass & TYPE_RESTRICT) {
3007                         if (ttype == &bool_ctype) {
3008                                 if (sclass & TYPE_FOULED)
3009                                         warning(expr->pos, "%s degrades to integer",
3010                                                 show_typename(stype));
3011                         } else {
3012                                 warning(expr->pos, "cast from %s",
3013                                         show_typename(stype));
3014                         }
3015                 }
3016         }
3017 
3018         if ((ttype == &ulong_ctype || ttype == uintptr_ctype) && !Wcast_from_as)
3019                 tas = &bad_address_space;
3020         else if (tclass == TYPE_PTR) {
3021                 examine_pointer_target(ttype);
3022                 tas = ttype->ctype.as;
3023         }
3024 
3025         if ((stype == &ulong_ctype || stype == uintptr_ctype))
3026                 sas = &bad_address_space;
3027         else if (sclass == TYPE_PTR) {
3028                 examine_pointer_target(stype);
3029                 sas = stype->ctype.as;
3030         }
3031 
3032         if (!tas && valid_as(sas))
3033                 warning(expr->pos, "cast removes address space '%s' of expression", show_as(sas));
3034         if (valid_as(tas) && valid_as(sas) && tas != sas)
3035                 warning(expr->pos, "cast between address spaces (%s -> %s)", show_as(sas), show_as(tas));
3036         if (valid_as(tas) && !sas &&
3037             !is_null_pointer_constant(source) && Wcast_to_as)
3038                 warning(expr->pos,
3039                         "cast adds address space '%s' to expression", show_as(tas));
3040 
3041         if (!(ttype->ctype.modifiers & MOD_PTRINHERIT) && tclass == TYPE_PTR &&
3042             !tas && (source->flags & CEF_ICE)) {
3043                 if (ttype->ctype.base_type == &void_ctype) {
3044                         if (is_zero_constant(source)) {
3045                                 /* NULL */
3046                                 expr->type = EXPR_VALUE;
3047                                 expr->ctype = &null_ctype;
3048                                 expr->value = 0;
3049                                 return expr->ctype;
3050                         }
3051                 }
3052         }
3053 
3054         if (ttype == &bool_ctype)
3055                 cast_to_bool(expr);
3056 
3057         // checks pointers to restricted
3058         while (Wbitwise_pointer && tclass == TYPE_PTR && sclass == TYPE_PTR) {
3059                 tclass = classify_type(ttype->ctype.base_type, &ttype);
3060                 sclass = classify_type(stype->ctype.base_type, &stype);
3061                 if (ttype == stype)
3062                         break;
3063                 if (!ttype || !stype)
3064                         break;
3065                 if (ttype == &void_ctype || stype == &void_ctype)
3066                         break;
3067                 if (tclass & TYPE_RESTRICT) {
3068                         warning(expr->pos, "cast to %s", show_typename(ctype));
3069                         break;
3070                 }
3071                 if (sclass & TYPE_RESTRICT) {
3072                         warning(expr->pos, "cast from %s", show_typename(source->ctype));
3073                         break;
3074                 }
3075         }
3076 out:
3077         return ctype;
3078 }
3079 
3080 /*
3081  * Evaluate a call expression with a symbol. This
3082  * should expand inline functions, and evaluate
3083  * builtins.
3084  */
3085 static int evaluate_symbol_call(struct expression *expr)
3086 {
3087         struct expression *fn = expr->fn;
3088         struct symbol *ctype = fn->ctype;
3089 
3090         if (fn->type != EXPR_PREOP)
3091                 return 0;
3092 
3093         if (ctype->op && ctype->op->evaluate)
3094                 return ctype->op->evaluate(expr);
3095 


3259         return size_t_ctype;
3260 }
3261 
3262 struct symbol *evaluate_expression(struct expression *expr)
3263 {
3264         if (!expr)
3265                 return NULL;
3266         if (expr->ctype)
3267                 return expr->ctype;
3268 
3269         switch (expr->type) {
3270         case EXPR_VALUE:
3271         case EXPR_FVALUE:
3272                 expression_error(expr, "value expression without a type");
3273                 return NULL;
3274         case EXPR_STRING:
3275                 return evaluate_string(expr);
3276         case EXPR_SYMBOL:
3277                 return evaluate_symbol_expression(expr);
3278         case EXPR_BINOP:
3279                 evaluate_expression(expr->left);
3280                 evaluate_expression(expr->right);
3281                 if (!valid_subexpr_type(expr))
3282                         return NULL;


3283                 return evaluate_binop(expr);
3284         case EXPR_LOGICAL:
3285                 return evaluate_logical(expr);
3286         case EXPR_COMMA:
3287                 evaluate_expression(expr->left);
3288                 if (!evaluate_expression(expr->right))
3289                         return NULL;
3290                 return evaluate_comma(expr);
3291         case EXPR_COMPARE:
3292                 evaluate_expression(expr->left);
3293                 evaluate_expression(expr->right);
3294                 if (!valid_subexpr_type(expr))
3295                         return NULL;


3296                 return evaluate_compare(expr);
3297         case EXPR_ASSIGNMENT:
3298                 evaluate_expression(expr->left);
3299                 evaluate_expression(expr->right);
3300                 if (!valid_subexpr_type(expr))
3301                         return NULL;


3302                 return evaluate_assignment(expr);
3303         case EXPR_PREOP:
3304                 if (!evaluate_expression(expr->unop))
3305                         return NULL;
3306                 return evaluate_preop(expr);
3307         case EXPR_POSTOP:
3308                 if (!evaluate_expression(expr->unop))
3309                         return NULL;
3310                 return evaluate_postop(expr);
3311         case EXPR_CAST:
3312         case EXPR_FORCE_CAST:
3313         case EXPR_IMPLIED_CAST:
3314                 return evaluate_cast(expr);
3315         case EXPR_SIZEOF:
3316                 return evaluate_sizeof(expr);
3317         case EXPR_PTRSIZEOF:
3318                 return evaluate_ptrsizeof(expr);
3319         case EXPR_ALIGNOF:
3320                 return evaluate_alignof(expr);
3321         case EXPR_DEREF:


3336         case EXPR_TYPE:
3337                 /* Evaluate the type of the symbol .. */
3338                 evaluate_symbol(expr->symbol);
3339                 /* .. but the type of the _expression_ is a "type" */
3340                 expr->ctype = &type_ctype;
3341                 return &type_ctype;
3342 
3343         case EXPR_OFFSETOF:
3344                 return evaluate_offsetof(expr);
3345 
3346         /* These can not exist as stand-alone expressions */
3347         case EXPR_INITIALIZER:
3348         case EXPR_IDENTIFIER:
3349         case EXPR_INDEX:
3350         case EXPR_POS:
3351                 expression_error(expr, "internal front-end error: initializer in expression");
3352                 return NULL;
3353         case EXPR_SLICE:
3354                 expression_error(expr, "internal front-end error: SLICE re-evaluated");
3355                 return NULL;
3356         case EXPR_ASM_OPERAND:
3357                 expression_error(expr, "internal front-end error: ASM_OPERAND evaluated");
3358                 return NULL;
3359         }
3360         return NULL;
3361 }
3362 
3363 void check_duplicates(struct symbol *sym)
3364 {
3365         int declared = 0;
3366         struct symbol *next = sym;
3367         int initialized = sym->initializer != NULL;
3368 
3369         while ((next = next->same_symbol) != NULL) {
3370                 const char *typediff;
3371                 evaluate_symbol(next);
3372                 if (initialized && next->initializer) {
3373                         sparse_error(sym->pos, "symbol '%s' has multiple initializers (originally initialized at %s:%d)",
3374                                 show_ident(sym->ident),
3375                                 stream_name(next->pos.stream), next->pos.line);
3376                         /* Only warn once */
3377                         initialized = 0;
3378                 }
3379                 declared++;
3380                 typediff = type_difference(&sym->ctype, &next->ctype, 0, 0);
3381                 if (typediff) {
3382                         sparse_error(sym->pos, "symbol '%s' redeclared with different type (originally declared at %s:%d) - %s",
3383                                 show_ident(sym->ident),
3384                                 stream_name(next->pos.stream), next->pos.line, typediff);
3385                         return;
3386                 }
3387         }
3388         if (!declared) {
3389                 unsigned long mod = sym->ctype.modifiers;
3390                 if (mod & (MOD_STATIC | MOD_REGISTER | MOD_EXT_VISIBLE))
3391                         return;
3392                 if (!(mod & MOD_TOPLEVEL))
3393                         return;
3394                 if (!Wdecl)
3395                         return;
3396                 if (sym->ident == &main_ident)
3397                         return;
3398                 warning(sym->pos, "symbol '%s' was not declared. Should it be static?", show_ident(sym->ident));
3399         }
3400 }
3401 
3402 static struct symbol *evaluate_symbol(struct symbol *sym)
3403 {
3404         struct symbol *base_type;
3405 
3406         if (!sym)
3407                 return sym;
3408         if (sym->evaluated)
3409                 return sym;
3410         sym->evaluated = 1;


3501         case '=':       /* Assignment */
3502         case '+':       /* Update */
3503                 break;
3504         default:
3505                 expression_error(expr, "output constraint is not an assignment constraint (\"%s\")", constraint);
3506         }
3507 }
3508 
3509 static void verify_input_constraint(struct expression *expr, const char *constraint)
3510 {
3511         switch (*constraint) {
3512         case '=':       /* Assignment */
3513         case '+':       /* Update */
3514                 expression_error(expr, "input constraint with assignment (\"%s\")", constraint);
3515         }
3516 }
3517 
3518 static void evaluate_asm_statement(struct statement *stmt)
3519 {
3520         struct expression *expr;
3521         struct expression *op;
3522         struct symbol *sym;

3523 
3524         expr = stmt->asm_string;
3525         if (!expr || expr->type != EXPR_STRING) {
3526                 sparse_error(stmt->pos, "need constant string for inline asm");
3527                 return;
3528         }
3529 
3530         FOR_EACH_PTR(stmt->asm_outputs, op) {
3531                 /* Identifier */




3532 
3533                 /* Constraint */
3534                 expr = op->constraint;
3535                 if (!expr || expr->type != EXPR_STRING) {
3536                         sparse_error(expr ? expr->pos : stmt->pos, "asm output constraint is not a string");
3537                         op->constraint = NULL;
3538                 } else

3539                         verify_output_constraint(expr, expr->string->data);

3540 
3541                 /* Expression */
3542                 expr = op->expr;
3543                 if (!evaluate_expression(expr))
3544                         return;
3545                 if (!lvalue_expression(expr))
3546                         warning(expr->pos, "asm output is not an lvalue");
3547                 evaluate_assign_to(expr, expr->ctype);
3548         } END_FOR_EACH_PTR(op);


3549 
3550         FOR_EACH_PTR(stmt->asm_inputs, op) {
3551                 /* Identifier */




3552 
3553                 /* Constraint */
3554                 expr = op->constraint;
3555                 if (!expr || expr->type != EXPR_STRING) {
3556                         sparse_error(expr ? expr->pos : stmt->pos, "asm input constraint is not a string");
3557                         op->constraint = NULL;
3558                 } else

3559                         verify_input_constraint(expr, expr->string->data);

3560 
3561                 /* Expression */
3562                 if (!evaluate_expression(op->expr))

3563                         return;
3564         } END_FOR_EACH_PTR(op);


3565 
3566         FOR_EACH_PTR(stmt->asm_clobbers, expr) {
3567                 if (!expr) {
3568                         sparse_error(stmt->pos, "bad asm clobbers");
3569                         return;
3570                 }
3571                 if (expr->type == EXPR_STRING)
3572                         continue;
3573                 expression_error(expr, "asm clobber is not a string");
3574         } END_FOR_EACH_PTR(expr);
3575 
3576         FOR_EACH_PTR(stmt->asm_labels, sym) {
3577                 if (!sym || sym->type != SYM_LABEL) {
3578                         sparse_error(stmt->pos, "bad asm label");
3579                         return;
3580                 }
3581         } END_FOR_EACH_PTR(sym);
3582 }
3583 
3584 static void evaluate_case_statement(struct statement *stmt)


3644         struct expression *sel = stmt->switch_expression;
3645 
3646         evaluate_expression(sel);
3647         evaluate_statement(stmt->switch_statement);
3648         if (!sel)
3649                 return;
3650         if (sel->ctype && is_enum_type(sel->ctype))
3651                 enumcase_holder = NULL; /* Only check cases against switch */
3652 
3653         FOR_EACH_PTR(stmt->switch_case->symbol_list, sym) {
3654                 struct statement *case_stmt = sym->stmt;
3655                 check_case_type(sel, case_stmt->case_expression, enumcase_holder);
3656                 check_case_type(sel, case_stmt->case_to, enumcase_holder);
3657         } END_FOR_EACH_PTR(sym);
3658 }
3659 
3660 static void evaluate_goto_statement(struct statement *stmt)
3661 {
3662         struct symbol *label = stmt->goto_label;
3663 
3664         if (label && !label->stmt && label->ident && !lookup_keyword(label->ident, NS_KEYWORD))
3665                 sparse_error(stmt->pos, "label '%s' was not declared", show_ident(label->ident));
3666 
3667         evaluate_expression(stmt->goto_expression);
3668 }
3669 
3670 struct symbol *evaluate_statement(struct statement *stmt)
3671 {
3672         if (!stmt)
3673                 return NULL;
3674 
3675         switch (stmt->type) {
3676         case STMT_DECLARATION: {
3677                 struct symbol *s;
3678                 FOR_EACH_PTR(stmt->declaration, s) {
3679                         evaluate_symbol(s);
3680                 } END_FOR_EACH_PTR(s);
3681                 return NULL;
3682         }
3683 
3684         case STMT_RETURN: