Print this page
11506 smatch resync
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/tools/smatch/src/smatch_conditions.c
+++ new/usr/src/tools/smatch/src/smatch_conditions.c
1 1 /*
2 2 * Copyright (C) 2006,2008 Dan Carpenter.
3 3 *
4 4 * This program is free software; you can redistribute it and/or
5 5 * modify it under the terms of the GNU General Public License
6 6 * as published by the Free Software Foundation; either version 2
7 7 * of the License, or (at your option) any later version.
8 8 *
9 9 * This program is distributed in the hope that it will be useful,
10 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 * GNU General Public License for more details.
13 13 *
14 14 * You should have received a copy of the GNU General Public License
15 15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 16 */
17 17
18 18 /*
19 19 * The simplest type of condition is
20 20 * if (a) { ...
21 21 *
22 22 * The next simplest kind of conditions is
23 23 * if (a && b) { c;
24 24 * In that case 'a' is true when we get to 'b' and both are true
25 25 * when we get to c.
26 26 *
27 27 * Or's are a little more complicated.
28 28 * if (a || b) { c;
29 29 * We know 'a' is not true when we get to 'b' but it may be true
30 30 * when we get to c.
31 31 *
32 32 * If we mix and's and or's that's even more complicated.
33 33 * if (a && b && c || a && d) { d ;
34 34 * 'a' is true when we evaluate 'b', and 'd'.
35 35 * 'b' is true when we evaluate 'c' but otherwise we don't.
36 36 *
37 37 * The other thing that complicates matters is if we negate
38 38 * some if conditions.
39 39 * if (!a) { ...
40 40 * Smatch has passes the un-negated version to the client and flip
41 41 * the true and false values internally. This makes it easier
42 42 * to write checks.
43 43 *
44 44 * And negations can be part of a compound.
45 45 * if (a && !(b || c)) { d;
46 46 * In that situation we multiply the negative through to simplify
47 47 * stuff so that we can remove the parens like this:
48 48 * if (a && !b && !c) { d;
49 49 *
50 50 * One other thing is that:
51 51 * if ((a) != 0){ ...
52 52 * that's basically the same as testing for just 'a' and we simplify
53 53 * comparisons with zero before passing it to the script.
54 54 *
55 55 */
56 56
57 57 #include "smatch.h"
58 58 #include "smatch_slist.h"
59 59 #include "smatch_extra.h"
60 60 #include "smatch_expression_stacks.h"
61 61
62 62 extern int __expr_stmt_count;
63 63
64 64 struct expression_list *big_condition_stack;
65 65
66 66 static void split_conditions(struct expression *expr);
67 67
68 68 static int is_logical_and(struct expression *expr)
69 69 {
70 70 if (expr->op == SPECIAL_LOGICAL_AND)
71 71 return 1;
72 72 return 0;
73 73 }
74 74
75 75 static int handle_zero_comparisons(struct expression *expr)
76 76 {
77 77 struct expression *tmp = NULL;
78 78 struct expression *zero;
79 79
80 80 // if left is zero or right is zero
81 81 if (is_zero(expr->left)) {
82 82 zero = strip_expr(expr->left);
83 83 if (zero->type != EXPR_VALUE)
84 84 __split_expr(expr->left);
85 85 tmp = expr->right;
86 86 } else if (is_zero(expr->right)) {
87 87 zero = strip_expr(expr->left);
88 88 if (zero->type != EXPR_VALUE)
89 89 __split_expr(expr->right);
90 90 tmp = expr->left;
91 91 } else {
92 92 return 0;
93 93 }
94 94
95 95 // "if (foo != 0)" is the same as "if (foo)"
96 96 if (expr->op == SPECIAL_NOTEQUAL) {
97 97 split_conditions(tmp);
98 98 return 1;
99 99 }
100 100
101 101 // "if (foo == 0)" is the same as "if (!foo)"
102 102 if (expr->op == SPECIAL_EQUAL) {
103 103 split_conditions(tmp);
104 104 __negate_cond_stacks();
105 105 return 1;
106 106 }
107 107
108 108 return 0;
109 109 }
110 110
111 111 /*
112 112 * This function is for handling calls to likely/unlikely
113 113 */
114 114
115 115 static int ignore_builtin_expect(struct expression *expr)
116 116 {
117 117 if (sym_name_is("__builtin_expect", expr->fn)) {
118 118 split_conditions(first_ptr_list((struct ptr_list *) expr->args));
119 119 return 1;
120 120 }
121 121 return 0;
122 122 }
123 123
124 124 /*
125 125 * handle_compound_stmt() is for: foo = ({blah; blah; blah; 1})
126 126 */
127 127
128 128 static void handle_compound_stmt(struct statement *stmt)
129 129 {
130 130 struct expression *expr = NULL;
131 131 struct statement *last;
132 132 struct statement *s;
133 133
134 134 last = last_ptr_list((struct ptr_list *)stmt->stmts);
135 135 if (last->type == STMT_LABEL) {
136 136 if (last->label_statement &&
137 137 last->label_statement->type == STMT_EXPRESSION)
138 138 expr = last->label_statement->expression;
139 139 else
140 140 last = NULL;
141 141 } else if (last->type != STMT_EXPRESSION) {
142 142 last = NULL;
143 143 } else {
144 144 expr = last->expression;
145 145 }
146 146
147 147 FOR_EACH_PTR(stmt->stmts, s) {
148 148 if (s != last)
149 149 __split_stmt(s);
150 150 } END_FOR_EACH_PTR(s);
151 151 if (last && last->type == STMT_LABEL)
152 152 __split_label_stmt(last);
153 153 split_conditions(expr);
154 154 }
155 155
156 156 static int handle_preop(struct expression *expr)
157 157 {
158 158 struct statement *stmt;
159 159
160 160 if (expr->op == '!') {
161 161 split_conditions(expr->unop);
162 162 __negate_cond_stacks();
163 163 return 1;
164 164 }
165 165 stmt = get_expression_statement(expr);
166 166 if (stmt) {
167 167 handle_compound_stmt(stmt);
168 168 return 1;
169 169 }
170 170 return 0;
171 171 }
172 172
173 173 static void handle_logical(struct expression *expr)
174 174 {
175 175 /*
176 176 * If we come to an "and" expr then:
177 177 * We split the left side.
178 178 * We keep all the current states.
179 179 * We split the right side.
180 180 * We keep all the states from both true sides.
181 181 *
182 182 * If it's an "or" expr then:
183 183 * We save the current slist.
184 184 * We split the left side.
185 185 * We use the false states for the right side.
186 186 * We split the right side.
187 187 * We save all the states that are the same on both sides.
188 188 */
189 189
190 190 split_conditions(expr->left);
191 191
192 192 if (is_logical_and(expr))
193 193 __use_cond_true_states();
194 194 else
195 195 __use_cond_false_states();
196 196
197 197 __push_cond_stacks();
198 198
199 199 __save_pre_cond_states();
200 200 split_conditions(expr->right);
201 201 __discard_pre_cond_states();
202 202
203 203 if (is_logical_and(expr))
204 204 __and_cond_states();
205 205 else
206 206 __or_cond_states();
207 207
208 208 __use_cond_true_states();
209 209 }
210 210
211 211 static struct stree *combine_strees(struct stree *orig, struct stree *fake, struct stree *new)
212 212 {
213 213 struct stree *ret = NULL;
214 214
215 215 overwrite_stree(orig, &ret);
216 216 overwrite_stree(fake, &ret);
217 217 overwrite_stree(new, &ret);
218 218 free_stree(&new);
219 219
220 220 return ret;
221 221 }
222 222
223 223 /*
224 224 * handle_select()
225 225 * if ((aaa()?bbb():ccc())) { ...
226 226 *
227 227 * This is almost the same as:
228 228 * if ((aaa() && bbb()) || (!aaa() && ccc())) { ...
229 229 *
230 230 * It's a bit complicated because we shouldn't pass aaa()
231 231 * to the clients more than once.
232 232 */
233 233
234 234 static void handle_select(struct expression *expr)
235 235 {
236 236 struct stree *a_T = NULL;
237 237 struct stree *a_F = NULL;
238 238 struct stree *a_T_b_T = NULL;
239 239 struct stree *a_T_b_F = NULL;
240 240 struct stree *a_T_b_fake = NULL;
241 241 struct stree *a_F_c_T = NULL;
242 242 struct stree *a_F_c_F = NULL;
243 243 struct stree *a_F_c_fake = NULL;
244 244 struct stree *tmp;
245 245 struct sm_state *sm;
246 246
247 247 /*
248 248 * Imagine we have this: if (a ? b : c) { ...
249 249 *
250 250 * The condition is true if "a" is true and "b" is true or
251 251 * "a" is false and "c" is true. It's false if "a" is true
252 252 * and "b" is false or "a" is false and "c" is false.
253 253 *
254 254 * The variable name "a_T_b_T" stands for "a true b true" etc.
255 255 *
256 256 * But if we know "b" is true then we can simpilify things.
257 257 * The condition is true if "a" is true or if "a" is false and
258 258 * "c" is true. The only way the condition can be false is if
259 259 * "a" is false and "c" is false.
260 260 *
261 261 * The remaining thing is the "a_T_b_fake". When we simplify
262 262 * the equations we have to take into consideration that other
263 263 * states may have changed that don't play into the true false
264 264 * equation. Take the following example:
265 265 * if ({
266 266 * (flags) = __raw_local_irq_save();
267 267 * _spin_trylock(lock) ? 1 :
268 268 * ({ raw_local_irq_restore(flags); 0; });
269 269 * })
270 270 * Smatch has to record that the irq flags were restored on the
271 271 * false path.
272 272 *
273 273 */
274 274
275 275 __save_pre_cond_states();
276 276
277 277 split_conditions(expr->conditional);
278 278
279 279 a_T = __copy_cond_true_states();
280 280 a_F = __copy_cond_false_states();
281 281
282 282 __use_cond_true_states();
283 283
284 284 __push_cond_stacks();
285 285 __push_fake_cur_stree();
286 286 split_conditions(expr->cond_true);
287 287 __process_post_op_stack();
288 288 a_T_b_fake = __pop_fake_cur_stree();
289 289 a_T_b_T = combine_strees(a_T, a_T_b_fake, __pop_cond_true_stack());
290 290 a_T_b_F = combine_strees(a_T, a_T_b_fake, __pop_cond_false_stack());
291 291
292 292 __use_cond_false_states();
293 293
294 294 __push_cond_stacks();
295 295 __push_fake_cur_stree();
296 296 split_conditions(expr->cond_false);
297 297 a_F_c_fake = __pop_fake_cur_stree();
298 298 a_F_c_T = combine_strees(a_F, a_F_c_fake, __pop_cond_true_stack());
299 299 a_F_c_F = combine_strees(a_F, a_F_c_fake, __pop_cond_false_stack());
300 300
301 301 /* We have to restore the pre condition states so that
302 302 implied_condition_true() will use the right cur_stree */
303 303 __use_pre_cond_states();
304 304
305 305 if (implied_condition_true(expr->cond_true)) {
306 306 free_stree(&a_T_b_T);
307 307 free_stree(&a_T_b_F);
308 308 a_T_b_T = clone_stree(a_T);
309 309 overwrite_stree(a_T_b_fake, &a_T_b_T);
310 310 }
311 311 if (implied_condition_false(expr->cond_true)) {
312 312 free_stree(&a_T_b_T);
313 313 free_stree(&a_T_b_F);
314 314 a_T_b_F = clone_stree(a_T);
315 315 overwrite_stree(a_T_b_fake, &a_T_b_F);
316 316 }
317 317 if (implied_condition_true(expr->cond_false)) {
318 318 free_stree(&a_F_c_T);
319 319 free_stree(&a_F_c_F);
320 320 a_F_c_T = clone_stree(a_F);
321 321 overwrite_stree(a_F_c_fake, &a_F_c_T);
322 322 }
323 323 if (implied_condition_false(expr->cond_false)) {
324 324 free_stree(&a_F_c_T);
325 325 free_stree(&a_F_c_F);
326 326 a_F_c_F = clone_stree(a_F);
327 327 overwrite_stree(a_F_c_fake, &a_F_c_F);
328 328 }
329 329
330 330 merge_stree(&a_T_b_T, a_F_c_T);
331 331 merge_stree(&a_T_b_F, a_F_c_F);
332 332
333 333 tmp = __pop_cond_true_stack();
334 334 free_stree(&tmp);
335 335 tmp = __pop_cond_false_stack();
336 336 free_stree(&tmp);
337 337
338 338 __push_cond_stacks();
339 339 FOR_EACH_SM(a_T_b_T, sm) {
340 340 __set_true_false_sm(sm, NULL);
341 341 } END_FOR_EACH_SM(sm);
342 342 FOR_EACH_SM(a_T_b_F, sm) {
343 343 __set_true_false_sm(NULL, sm);
344 344 } END_FOR_EACH_SM(sm);
345 345 __free_set_states();
346 346
347 347 free_stree(&a_T_b_fake);
348 348 free_stree(&a_F_c_fake);
349 349 free_stree(&a_F_c_T);
350 350 free_stree(&a_F_c_F);
351 351 free_stree(&a_T_b_T);
352 352 free_stree(&a_T_b_F);
353 353 free_stree(&a_T);
354 354 free_stree(&a_F);
355 355 }
356 356
357 357 static void handle_comma(struct expression *expr)
358 358 {
359 359 __split_expr(expr->left);
360 360 split_conditions(expr->right);
361 361 }
362 362
363 363 static int make_op_unsigned(int op)
364 364 {
365 365 switch (op) {
366 366 case '<':
367 367 return SPECIAL_UNSIGNED_LT;
368 368 case SPECIAL_LTE:
369 369 return SPECIAL_UNSIGNED_LTE;
370 370 case '>':
371 371 return SPECIAL_UNSIGNED_GT;
372 372 case SPECIAL_GTE:
373 373 return SPECIAL_UNSIGNED_GTE;
374 374 }
375 375 return op;
376 376 }
377 377
378 378 static void hackup_unsigned_compares(struct expression *expr)
379 379 {
380 380 if (expr->type != EXPR_COMPARE)
381 381 return;
382 382
383 383 if (type_unsigned(get_type(expr)))
384 384 expr->op = make_op_unsigned(expr->op);
385 385 }
386 386
387 387 static void do_condition(struct expression *expr)
388 388 {
389 389 __fold_in_set_states();
390 390 __push_fake_cur_stree();
391 391 __pass_to_client(expr, CONDITION_HOOK);
392 392 __fold_in_set_states();
393 393 }
394 394
395 395 static void split_conditions(struct expression *expr)
396 396 {
397 397 if (option_debug) {
398 398 char *cond = expr_to_str(expr);
399 399
400 400 sm_msg("%d in split_conditions (%s)", get_lineno(), cond);
401 401 free_string(cond);
402 402 }
403 403
404 404 expr = strip_expr_set_parent(expr);
405 405 if (!expr) {
406 406 __fold_in_set_states();
407 407 return;
408 408 }
409 409
410 410 /*
411 411 * On fast paths (and also I guess some people think it's cool) people
412 412 * sometimes use | instead of ||. It works the same basically except
|
↓ open down ↓ |
412 lines elided |
↑ open up ↑ |
413 413 * that || implies a memory barrier between conditions. The easiest way
414 414 * to handle it is by pretending that | also has a barrier and re-using
415 415 * all the normal condition code. This potentially hides some bugs, but
416 416 * people who write code like this should just be careful or they
417 417 * deserve bugs.
418 418 *
419 419 * We could potentially treat boolean bitwise & this way but that seems
420 420 * too complicated to deal with.
421 421 */
422 422 if (expr->type == EXPR_BINOP && expr->op == '|') {
423 + expr_set_parent_expr(expr->left, expr);
424 + expr_set_parent_expr(expr->right, expr);
423 425 handle_logical(expr);
424 426 return;
425 427 }
426 428
427 429 switch (expr->type) {
428 430 case EXPR_LOGICAL:
429 431 expr_set_parent_expr(expr->left, expr);
430 432 expr_set_parent_expr(expr->right, expr);
431 433 __pass_to_client(expr, LOGIC_HOOK);
432 434 handle_logical(expr);
433 435 return;
434 436 case EXPR_COMPARE:
435 437 expr_set_parent_expr(expr->left, expr);
436 438 expr_set_parent_expr(expr->right, expr);
437 439 hackup_unsigned_compares(expr);
438 440 if (handle_zero_comparisons(expr))
439 441 return;
440 442 break;
441 443 case EXPR_CALL:
442 444 if (ignore_builtin_expect(expr))
443 445 return;
444 446 break;
445 447 case EXPR_PREOP:
446 448 expr_set_parent_expr(expr->unop, expr);
447 449 if (handle_preop(expr))
448 450 return;
449 451 break;
450 452 case EXPR_CONDITIONAL:
451 453 case EXPR_SELECT:
452 454 expr_set_parent_expr(expr->conditional, expr);
453 455 expr_set_parent_expr(expr->cond_true, expr);
454 456 expr_set_parent_expr(expr->cond_false, expr);
455 457 handle_select(expr);
456 458 return;
457 459 case EXPR_COMMA:
458 460 expr_set_parent_expr(expr->left, expr);
459 461 expr_set_parent_expr(expr->right, expr);
460 462 handle_comma(expr);
461 463 return;
462 464 }
463 465
464 466 /* fixme: this should be in smatch_flow.c
465 467 but because of the funny stuff we do with conditions
466 468 it's awkward to put it there. We would need to
467 469 call CONDITION_HOOK in smatch_flow as well.
468 470 */
469 471 push_expression(&big_expression_stack, expr);
470 472 push_expression(&big_condition_stack, expr);
471 473
472 474 if (expr->type == EXPR_COMPARE) {
473 475 if (expr->left->type != EXPR_POSTOP)
474 476 __split_expr(expr->left);
475 477 if (expr->right->type != EXPR_POSTOP)
476 478 __split_expr(expr->right);
477 479 } else if (expr->type != EXPR_POSTOP) {
478 480 __split_expr(expr);
479 481 }
480 482 do_condition(expr);
481 483 if (expr->type == EXPR_COMPARE) {
482 484 if (expr->left->type == EXPR_POSTOP)
483 485 __split_expr(expr->left);
484 486 if (expr->right->type == EXPR_POSTOP)
485 487 __split_expr(expr->right);
486 488 } else if (expr->type == EXPR_POSTOP) {
487 489 __split_expr(expr);
488 490 }
489 491 __push_fake_cur_stree();
490 492 __process_post_op_stack();
491 493 __fold_in_set_states();
492 494 pop_expression(&big_condition_stack);
493 495 pop_expression(&big_expression_stack);
494 496 }
495 497
496 498 static int inside_condition;
497 499 void __split_whole_condition(struct expression *expr)
498 500 {
499 501 sm_debug("%d in __split_whole_condition\n", get_lineno());
500 502 inside_condition++;
501 503 __save_pre_cond_states();
502 504 __push_cond_stacks();
503 505 /* it's a hack, but it's sometimes handy to have this stuff
504 506 on the big_expression_stack. */
505 507 push_expression(&big_expression_stack, expr);
506 508 split_conditions(expr);
507 509 __use_cond_states();
508 510 __pass_to_client(expr, WHOLE_CONDITION_HOOK);
509 511 pop_expression(&big_expression_stack);
510 512 inside_condition--;
511 513 sm_debug("%d done __split_whole_condition\n", get_lineno());
512 514 }
513 515
514 516 void __handle_logic(struct expression *expr)
515 517 {
516 518 sm_debug("%d in __handle_logic\n", get_lineno());
517 519 inside_condition++;
518 520 __save_pre_cond_states();
519 521 __push_cond_stacks();
520 522 /* it's a hack, but it's sometimes handy to have this stuff
521 523 on the big_expression_stack. */
522 524 push_expression(&big_expression_stack, expr);
523 525 if (expr)
524 526 split_conditions(expr);
525 527 __use_cond_states();
526 528 __pass_to_client(expr, WHOLE_CONDITION_HOOK);
527 529 pop_expression(&big_expression_stack);
528 530 __merge_false_states();
529 531 inside_condition--;
530 532 sm_debug("%d done __handle_logic\n", get_lineno());
531 533 }
532 534
533 535 int is_condition(struct expression *expr)
534 536 {
535 537
536 538 expr = strip_expr(expr);
537 539 if (!expr)
538 540 return 0;
539 541
540 542 switch (expr->type) {
541 543 case EXPR_LOGICAL:
542 544 case EXPR_COMPARE:
543 545 return 1;
544 546 case EXPR_PREOP:
545 547 if (expr->op == '!')
546 548 return 1;
547 549 }
548 550 return 0;
549 551 }
550 552
551 553 int __handle_condition_assigns(struct expression *expr)
552 554 {
553 555 struct expression *right;
554 556 struct stree *true_stree, *false_stree, *fake_stree;
555 557 struct sm_state *sm;
556 558
557 559 if (expr->op != '=')
558 560 return 0;
559 561 right = strip_expr(expr->right);
560 562 if (!is_condition(expr->right))
561 563 return 0;
562 564
563 565 sm_debug("%d in __handle_condition_assigns\n", get_lineno());
564 566 inside_condition++;
565 567 __save_pre_cond_states();
566 568 __push_cond_stacks();
567 569 /* it's a hack, but it's sometimes handy to have this stuff
568 570 on the big_expression_stack. */
569 571 push_expression(&big_expression_stack, right);
570 572 split_conditions(right);
571 573 true_stree = __get_true_states();
572 574 false_stree = __get_false_states();
573 575 __use_cond_states();
574 576 __push_fake_cur_stree();
575 577 set_extra_expr_mod(expr->left, alloc_estate_sval(sval_type_val(get_type(expr->left), 1)));
576 578 __pass_to_client(right, WHOLE_CONDITION_HOOK);
577 579
578 580 fake_stree = __pop_fake_cur_stree();
579 581 FOR_EACH_SM(fake_stree, sm) {
580 582 overwrite_sm_state_stree(&true_stree, sm);
581 583 } END_FOR_EACH_SM(sm);
582 584 free_stree(&fake_stree);
583 585
584 586 pop_expression(&big_expression_stack);
585 587 inside_condition--;
586 588
587 589 __push_true_states();
588 590
589 591 __use_false_states();
590 592 __push_fake_cur_stree();
591 593 set_extra_expr_mod(expr->left, alloc_estate_sval(sval_type_val(get_type(expr->left), 0)));
592 594
593 595 fake_stree = __pop_fake_cur_stree();
594 596 FOR_EACH_SM(fake_stree, sm) {
595 597 overwrite_sm_state_stree(&false_stree, sm);
596 598 } END_FOR_EACH_SM(sm);
597 599 free_stree(&fake_stree);
598 600
599 601 __merge_true_states();
600 602 merge_fake_stree(&true_stree, false_stree);
601 603 free_stree(&false_stree);
602 604 FOR_EACH_SM(true_stree, sm) {
603 605 __set_sm(sm);
604 606 } END_FOR_EACH_SM(sm);
605 607
606 608 __pass_to_client(expr, ASSIGNMENT_HOOK);
607 609 sm_debug("%d done __handle_condition_assigns\n", get_lineno());
608 610 return 1;
609 611 }
610 612
611 613 static int is_select_assign(struct expression *expr)
612 614 {
613 615 struct expression *right;
614 616
615 617 if (expr->op != '=')
616 618 return 0;
617 619 right = strip_expr(expr->right);
618 620 if (right->type == EXPR_CONDITIONAL)
619 621 return 1;
620 622 if (right->type == EXPR_SELECT)
621 623 return 1;
622 624 return 0;
623 625 }
624 626
625 627 int __handle_select_assigns(struct expression *expr)
626 628 {
627 629 struct expression *right;
628 630 struct stree *final_states = NULL;
629 631 struct sm_state *sm;
630 632 int is_true;
631 633 int is_false;
632 634
633 635 if (!is_select_assign(expr))
634 636 return 0;
635 637 sm_debug("%d in __handle_ternary_assigns\n", get_lineno());
636 638 right = strip_expr(expr->right);
637 639 __pass_to_client(right, SELECT_HOOK);
638 640
639 641 is_true = implied_condition_true(right->conditional);
640 642 is_false = implied_condition_false(right->conditional);
641 643
642 644 /* hah hah. the ultra fake out */
643 645 __save_pre_cond_states();
644 646 __split_whole_condition(right->conditional);
645 647
646 648 if (!is_false) {
647 649 struct expression *fake_expr;
648 650
649 651 if (right->cond_true)
650 652 fake_expr = assign_expression(expr->left, expr->op, right->cond_true);
651 653 else
652 654 fake_expr = assign_expression(expr->left, expr->op, right->conditional);
653 655 __split_expr(fake_expr);
654 656 final_states = clone_stree(__get_cur_stree());
655 657 }
656 658
657 659 __use_false_states();
658 660 if (!is_true) {
659 661 struct expression *fake_expr;
660 662
661 663 fake_expr = assign_expression(expr->left, expr->op, right->cond_false);
662 664 __split_expr(fake_expr);
663 665 merge_stree(&final_states, __get_cur_stree());
664 666 }
665 667
666 668 __use_pre_cond_states();
667 669
668 670 FOR_EACH_SM(final_states, sm) {
669 671 __set_sm(sm);
670 672 } END_FOR_EACH_SM(sm);
671 673
672 674 free_stree(&final_states);
673 675
674 676 sm_debug("%d done __handle_ternary_assigns\n", get_lineno());
675 677
676 678 return 1;
677 679 }
678 680
679 681 static struct statement *split_then_return_last(struct statement *stmt)
680 682 {
681 683 struct statement *tmp;
682 684 struct statement *last_stmt;
683 685
684 686 last_stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
685 687 if (!last_stmt)
686 688 return NULL;
687 689
688 690 __push_scope_hooks();
689 691 FOR_EACH_PTR(stmt->stmts, tmp) {
690 692 if (tmp == last_stmt) {
691 693 if (tmp->type == STMT_LABEL) {
692 694 __split_label_stmt(tmp);
693 695 return tmp->label_statement;
694 696 }
695 697 return last_stmt;
696 698 }
697 699 __split_stmt(tmp);
698 700 } END_FOR_EACH_PTR(tmp);
699 701 return NULL;
700 702 }
701 703
702 704 int __handle_expr_statement_assigns(struct expression *expr)
703 705 {
704 706 struct expression *right;
705 707 struct statement *stmt;
706 708
707 709 right = expr->right;
708 710 if (right->type == EXPR_PREOP && right->op == '(')
709 711 right = right->unop;
710 712 if (right->type != EXPR_STATEMENT)
711 713 return 0;
712 714
713 715 __expr_stmt_count++;
714 716 stmt = right->statement;
715 717 if (stmt->type == STMT_COMPOUND) {
716 718 struct statement *last_stmt;
717 719 struct expression *fake_assign;
718 720 struct expression fake_expr_stmt = { .smatch_flags = Fake, };
719 721
720 722 last_stmt = split_then_return_last(stmt);
721 723 if (!last_stmt) {
722 724 __expr_stmt_count--;
723 725 return 0;
724 726 }
725 727
726 728 fake_expr_stmt.pos = last_stmt->pos;
727 729 fake_expr_stmt.type = EXPR_STATEMENT;
728 730 fake_expr_stmt.op = 0;
729 731 fake_expr_stmt.statement = last_stmt;
730 732
731 733 fake_assign = assign_expression(expr->left, expr->op, &fake_expr_stmt);
732 734 __split_expr(fake_assign);
733 735
734 736 __pass_to_client(stmt, STMT_HOOK_AFTER);
735 737 __call_scope_hooks();
736 738 } else if (stmt->type == STMT_EXPRESSION) {
737 739 struct expression *fake_assign;
738 740
739 741 fake_assign = assign_expression(expr->left, expr->op, stmt->expression);
740 742 __split_expr(fake_assign);
741 743
742 744 } else {
743 745 __split_stmt(stmt);
744 746 }
745 747 __expr_stmt_count--;
746 748 return 1;
747 749 }
748 750
749 751 int in_condition(void)
750 752 {
751 753 return inside_condition;
752 754 }
|
↓ open down ↓ |
320 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX