Home | History | Annotate | Line # | Download | only in lint1
      1 /*	$NetBSD: func.c,v 1.201 2026/10/25 21:42:57 rillig Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1994, 1995 Jochen Pohl
      5  * All Rights Reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. All advertising materials mentioning features or use of this software
     16  *    must display the following acknowledgement:
     17  *	This product includes software developed by Jochen Pohl for
     18  *	The NetBSD Project.
     19  * 4. The name of the author may not be used to endorse or promote products
     20  *    derived from this software without specific prior written permission.
     21  *
     22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     32  */
     33 
     34 #if HAVE_NBTOOL_CONFIG_H
     35 #include "nbtool_config.h"
     36 #endif
     37 
     38 #include <sys/cdefs.h>
     39 #if defined(__RCSID)
     40 __RCSID("$NetBSD: func.c,v 1.201 2026/10/25 21:42:57 rillig Exp $");
     41 #endif
     42 
     43 #include <stdlib.h>
     44 #include <string.h>
     45 
     46 #include "lint1.h"
     47 #include "cgram.h"
     48 
     49 /*
     50  * Contains a pointer to the symbol table entry of the current function
     51  * definition.
     52  */
     53 sym_t *funcsym;
     54 
     55 /* Is set as long as a statement can be reached. Must be set at level 0. */
     56 bool reached = true;
     57 
     58 /*
     59  * Is true by default, can be cleared by NOTREACHED.
     60  * Is reset to true whenever 'reached' changes.
     61  */
     62 bool warn_about_unreachable;
     63 
     64 /*
     65  * In conjunction with 'reached', controls printing of "fallthrough on ..."
     66  * warnings.
     67  * Reset by each statement and set by FALLTHROUGH, stmt_switch_expr and
     68  * case_label.
     69  *
     70  * The control statements 'if', 'for', 'while' and 'switch' do not reset
     71  * suppress_fallthrough because this must be done by the controlled statement.
     72  * At least for 'if', this is important because ** FALLTHROUGH ** after "if
     73  * (expr) statement" is evaluated before the following token, which causes
     74  * reduction of above. This means that ** FALLTHROUGH ** after "if ..." would
     75  * always be ignored.
     76  */
     77 bool suppress_fallthrough;
     78 
     79 /* The innermost control statement */
     80 static control_statement *cstmt;
     81 
     82 /*
     83  * Number of parameters which will be checked for usage in following
     84  * function definition. -1 stands for all parameters.
     85  *
     86  * The position of the last ARGSUSED comment is stored in argsused_pos.
     87  */
     88 int nargusg = -1;
     89 pos_t argsused_pos;
     90 
     91 /*
     92  * Number of parameters of the following function definition whose types
     93  * shall be checked by lint2. -1 stands for all parameters.
     94  *
     95  * The position of the last VARARGS comment is stored in vapos.
     96  */
     97 int nvararg = -1;
     98 pos_t vapos;
     99 
    100 /*
    101  * Both printflike_argnum and scanflike_argnum contain the 1-based number
    102  * of the string parameter which shall be used to check the types of remaining
    103  * arguments (for PRINTFLIKE and SCANFLIKE).
    104  *
    105  * printflike_pos and scanflike_pos are the positions of the last PRINTFLIKE
    106  * or SCANFLIKE comment.
    107  */
    108 int printflike_argnum = -1;
    109 int scanflike_argnum = -1;
    110 pos_t printflike_pos;
    111 pos_t scanflike_pos;
    112 
    113 /*
    114  * If both plibflg and llibflg are set, prototypes are written as function
    115  * definitions to the output file.
    116  */
    117 bool plibflg;
    118 
    119 /*
    120  * Whether a lint library shall be created. The effect of this flag is that
    121  * all defined symbols are treated as used.
    122  * (The LINTLIBRARY comment also resets vflag.)
    123  */
    124 bool llibflg;
    125 
    126 /*
    127  * Determines the warnings that are suppressed by a LINTED directive.  For
    128  * globally suppressed warnings, see 'msgset'.
    129  *
    130  * LWARN_ALL:	all warnings are enabled
    131  * LWARN_NONE:	all warnings are suppressed
    132  * n >= 0:	warning n is ignored, the others are active
    133  */
    134 int lwarn = LWARN_ALL;
    135 
    136 /* Temporarily suppress warnings about wrong types for bit-fields. */
    137 bool suppress_bitfieldtype;
    138 
    139 /* Temporarily suppress warnings about use of 'long long'. */
    140 bool suppress_longlong;
    141 
    142 void
    143 begin_control_statement(control_statement_kind kind)
    144 {
    145 	control_statement *cs;
    146 
    147 	cs = xcalloc(1, sizeof(*cs));
    148 	cs->c_kind = kind;
    149 	cs->c_surrounding = cstmt;
    150 	cstmt = cs;
    151 }
    152 
    153 void
    154 end_control_statement(control_statement_kind kind)
    155 {
    156 	while (cstmt->c_kind != kind)
    157 		cstmt = cstmt->c_surrounding;
    158 
    159 	control_statement *cs = cstmt;
    160 	cstmt = cs->c_surrounding;
    161 
    162 	free(cs->c_case_labels.vals);
    163 	free(cs->c_switch_type);
    164 	free(cs);
    165 }
    166 
    167 static void
    168 set_reached(bool new_reached)
    169 {
    170 	debug_step("%s -> %s",
    171 	    reached ? "reachable" : "unreachable",
    172 	    new_reached ? "reachable" : "unreachable");
    173 	reached = new_reached;
    174 	warn_about_unreachable = true;
    175 }
    176 
    177 /*
    178  * Prints a warning if a statement cannot be reached.
    179  */
    180 void
    181 check_statement_reachable(const char *stmt_kind)
    182 {
    183 	if (!reached && warn_about_unreachable) {
    184 		/* '%s' statement not reached */
    185 		warning(193, stmt_kind);
    186 		warn_about_unreachable = false;
    187 	}
    188 }
    189 
    190 /*
    191  * Called after a function declaration which introduces a function definition
    192  * and before an (optional) old-style parameter declaration list.
    193  *
    194  * Puts all symbols declared in the prototype or in an old-style parameter
    195  * list back to the symbol table.
    196  *
    197  * Does the usual checking of storage class, type (return value),
    198  * redeclaration, etc.
    199  */
    200 void
    201 begin_function(sym_t *fsym)
    202 {
    203 	funcsym = fsym;
    204 
    205 	/*
    206 	 * Put all symbols declared in the parameter list back to the symbol
    207 	 * table.
    208 	 */
    209 	for (sym_t *sym = dcs->d_func_proto_syms; sym != NULL;
    210 	    sym = sym->s_level_next) {
    211 		if (sym->s_block_level != -1) {
    212 			lint_assert(sym->s_block_level == 1);
    213 			inssym(1, sym);
    214 		}
    215 	}
    216 
    217 	/*
    218 	 * In old_style_function() we did not know whether it is an old style
    219 	 * function definition or only an old-style declaration, if there are
    220 	 * no parameters inside the parameter list ("f()").
    221 	 */
    222 	if (!fsym->s_type->t_proto && fsym->u.s_old_style_params == NULL)
    223 		fsym->s_osdef = true;
    224 
    225 	check_type(fsym);
    226 
    227 	/*
    228 	 * check_type() checks for almost all possible errors, but not for
    229 	 * incomplete return values (these are allowed in declarations)
    230 	 */
    231 	if (fsym->s_type->t_subt->t_tspec != VOID &&
    232 	    is_incomplete(fsym->s_type->t_subt)) {
    233 		/* cannot return incomplete type */
    234 		error(67);
    235 	}
    236 
    237 	fsym->s_def = DEF;
    238 
    239 	if (fsym->s_scl == TYPEDEF) {
    240 		fsym->s_scl = EXTERN;
    241 		/* invalid storage class */
    242 		error(8);
    243 	}
    244 
    245 	if (dcs->d_inline)
    246 		fsym->s_inline = true;
    247 
    248 	/*
    249 	 * Parameters in new-style function declarations need a name. ('void'
    250 	 * is already removed from the list of parameters.)
    251 	 */
    252 	int n = 1;
    253 	for (const sym_t *param = fsym->s_type->u.params;
    254 	    param != NULL; param = param->s_next) {
    255 		if (param->s_scl == ABSTRACT) {
    256 			lint_assert(param->s_name == unnamed);
    257 			/* formal parameter #%d lacks name */
    258 			error(59, n);
    259 		} else {
    260 			lint_assert(param->s_name != unnamed);
    261 		}
    262 		n++;
    263 	}
    264 
    265 	/*
    266 	 * We must also remember the position. s_def_pos is overwritten if this
    267 	 * is an old-style definition, and we had already a prototype.
    268 	 */
    269 	dcs->d_func_def_pos = fsym->s_def_pos;
    270 
    271 	sym_t *rdsym = dcs->d_redeclared_symbol;
    272 	if (rdsym != NULL) {
    273 		bool dowarn = false;
    274 		if (!check_redeclaration(fsym, &dowarn)) {
    275 
    276 			/*
    277 			 * Print nothing if the newly defined function is
    278 			 * defined in old style. A better warning will be
    279 			 * printed in check_func_lint_directives().
    280 			 */
    281 			if (dowarn && !fsym->s_osdef) {
    282 				/* TODO: error in C99 mode as well? */
    283 				if (!allow_trad && !allow_c99)
    284 					/* redeclaration of '%s' */
    285 					error(27, fsym->s_name);
    286 				else
    287 					/* redeclaration of '%s' */
    288 					warning(27, fsym->s_name);
    289 				print_previous_declaration(rdsym);
    290 			}
    291 
    292 			copy_usage_info(fsym, rdsym);
    293 
    294 			/*
    295 			 * If the old symbol was a prototype and the new one is
    296 			 * none, overtake the position of the declaration of
    297 			 * the prototype.
    298 			 */
    299 			if (fsym->s_osdef && rdsym->s_type->t_proto)
    300 				fsym->s_def_pos = rdsym->s_def_pos;
    301 
    302 			complete_type(fsym, rdsym);
    303 
    304 			if (rdsym->s_inline)
    305 				fsym->s_inline = true;
    306 		}
    307 
    308 		symtab_remove_forever(rdsym);
    309 	}
    310 
    311 	if (fsym->s_osdef && !fsym->s_type->t_proto && !fsym->s_type->t_identifier_params) {
    312 		if (!allow_trad &&
    313 		    (allow_c99 || strcmp(fsym->s_name, "main") != 0))
    314 			/* function definition for '%s' is not a prototype */
    315 			warning(286, fsym->s_name);
    316 	}
    317 
    318 	if (dcs->d_no_type_specifier)
    319 		fsym->s_return_type_implicit_int = true;
    320 
    321 	set_reached(true);
    322 }
    323 
    324 static void
    325 check_missing_return_value(void)
    326 {
    327 	if (funcsym->s_type->t_subt->t_tspec == VOID)
    328 		return;
    329 	if (funcsym->s_return_type_implicit_int)
    330 		return;
    331 
    332 	/* C99 5.1.2.2.3 "Program termination" p1 */
    333 	if (allow_c99 && strcmp(funcsym->s_name, "main") == 0)
    334 		return;
    335 
    336 	/* function '%s' falls off bottom without returning value */
    337 	warning(217, funcsym->s_name);
    338 }
    339 
    340 void
    341 end_function(void)
    342 {
    343 	if (reached) {
    344 		cstmt->c_had_return_noval = true;
    345 		check_missing_return_value();
    346 	}
    347 
    348 	if (cstmt->c_had_return_noval && cstmt->c_had_return_value &&
    349 	    funcsym->s_return_type_implicit_int)
    350 		/* function '%s' has 'return expr' and 'return' */
    351 		warning(216, funcsym->s_name);
    352 
    353 	/* Warn about unused parameters. */
    354 	int n = nargusg;
    355 	nargusg = -1;
    356 	for (const sym_t *param = dcs->d_func_params;
    357 	    param != NULL && n != 0; param = param->s_next, n--)
    358 		check_usage_sym(dcs->d_asm, param);
    359 
    360 	if (dcs->d_scl == EXTERN && funcsym->s_inline)
    361 		outsym(funcsym, funcsym->s_scl, DECL);
    362 	else
    363 		outfdef(funcsym, &dcs->d_func_def_pos,
    364 		    cstmt->c_had_return_value, funcsym->s_osdef,
    365 		    dcs->d_func_params);
    366 
    367 	/* clean up after syntax errors, see test stmt_for.c. */
    368 	while (dcs->d_enclosing != NULL)
    369 		dcs = dcs->d_enclosing;
    370 
    371 	lint_assert(dcs->d_enclosing == NULL);
    372 	lint_assert(dcs->d_kind == DLK_EXTERN);
    373 	symtab_remove_level(dcs->d_func_proto_syms);
    374 
    375 	/* must be set on level 0 */
    376 	set_reached(true);
    377 
    378 	funcsym = NULL;
    379 }
    380 
    381 void
    382 named_label(sym_t *sym)
    383 {
    384 
    385 	if (sym->s_set)
    386 		/* label '%s' redefined */
    387 		error(194, sym->s_name);
    388 	else
    389 		mark_as_set(sym);
    390 
    391 	/* XXX: Assuming that each label is reachable is wrong. */
    392 	set_reached(true);
    393 }
    394 
    395 static void
    396 check_case_label_bitand(const tnode_t *case_expr, const tnode_t *switch_expr)
    397 {
    398 	if (switch_expr == NULL ||
    399 	    switch_expr->tn_op != BITAND ||
    400 	    switch_expr->u.ops.right->tn_op != CON)
    401 		return;
    402 
    403 	lint_assert(case_expr->tn_op == CON);
    404 	uint64_t case_value = (uint64_t)case_expr->u.value.u.integer;
    405 	uint64_t mask = (uint64_t)switch_expr->u.ops.right->u.value.u.integer;
    406 
    407 	if ((case_value & ~mask) != 0)
    408 		/* '%s' statement not reached */
    409 		warning(193, "case");
    410 }
    411 
    412 static void
    413 check_case_label_enum(const tnode_t *tn, const control_statement *cs)
    414 {
    415 	/* similar to typeok_enum in tree.c */
    416 
    417 	if (!(tn->tn_type->t_is_enum || cs->c_switch_type->t_is_enum))
    418 		return;
    419 	if (tn->tn_type->t_is_enum && cs->c_switch_type->t_is_enum &&
    420 	    tn->tn_type->u.enumer == cs->c_switch_type->u.enumer)
    421 		return;
    422 
    423 #if 0 /* not yet ready, see msg_130.c */
    424 	/* enum type mismatch: '%s' '%s' '%s' */
    425 	warning(130, type_name(cs->c_switch_type), op_name(EQ),
    426 	    type_name(tn->tn_type));
    427 #endif
    428 }
    429 
    430 static bool
    431 check_duplicate_case_label(control_statement *cs, const val_t *nv)
    432 {
    433 	case_labels *labels = &cs->c_case_labels;
    434 	size_t i = 0, n = labels->len;
    435 
    436 	while (i < n && labels->vals[i].u.integer != nv->u.integer)
    437 		i++;
    438 
    439 	if (i < n) {
    440 		if (is_uinteger(nv->v_tspec))
    441 			/* duplicate case '%ju' in switch */
    442 			error(200, (uintmax_t)nv->u.integer);
    443 		else
    444 			/* duplicate case '%jd' in switch */
    445 			error(199, (intmax_t)nv->u.integer);
    446 		return false;
    447 	}
    448 
    449 	if (labels->len >= labels->cap) {
    450 		labels->cap = 16 + 2 * labels->cap;
    451 		labels->vals = xrealloc(labels->vals,
    452 		    sizeof(*labels->vals) * labels->cap);
    453 	}
    454 	labels->vals[labels->len++] = *nv;
    455 	return true;
    456 }
    457 
    458 static void
    459 check_case_label(tnode_t *tn)
    460 {
    461 	control_statement *cs;
    462 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
    463 		continue;
    464 
    465 	if (cs == NULL) {
    466 		/* case not in switch */
    467 		error(195);
    468 		return;
    469 	}
    470 
    471 	if (tn == NULL)
    472 		return;
    473 
    474 	if (tn->tn_op != CON) {
    475 		/* non-constant case expression */
    476 		error(197);
    477 		return;
    478 	}
    479 
    480 	if (!is_integer(tn->tn_type->t_tspec)) {
    481 		/* non-integral case expression */
    482 		error(198);
    483 		return;
    484 	}
    485 
    486 	check_case_label_bitand(tn, cs->c_switch_expr);
    487 	check_case_label_enum(tn, cs);
    488 
    489 	lint_assert(cs->c_switch_type != NULL);
    490 
    491 	if (reached && !suppress_fallthrough) {
    492 		if (hflag)
    493 			/* fallthrough on case statement */
    494 			warning(220);
    495 	}
    496 
    497 	tspec_t t = tn->tn_type->t_tspec;
    498 	if ((t == LONG || t == ULONG || t == LLONG || t == ULLONG)
    499 	    && !allow_c90)
    500 		/* case label must be of type 'int' in traditional C */
    501 		warning(203);
    502 
    503 	val_t *v = integer_constant(tn, true);
    504 	val_t nv;
    505 	(void)memset(&nv, 0, sizeof(nv));
    506 	convert_constant(CASE, 0, cs->c_switch_type, &nv, v);
    507 	free(v);
    508 
    509 	if (check_duplicate_case_label(cs, &nv))
    510 		check_getopt_case_label(nv.u.integer);
    511 }
    512 
    513 void
    514 case_label(tnode_t *tn)
    515 {
    516 	check_case_label(tn);
    517 	expr_free_all();
    518 	set_reached(true);
    519 	suppress_fallthrough = true;
    520 }
    521 
    522 void
    523 case_label_range(tnode_t *ln, tnode_t *rn)
    524 {
    525 	if (ln->tn_op == CON && rn->tn_op == CON
    526 	    && ln->tn_type->t_tspec == rn->tn_type->t_tspec
    527 	    && is_integer(ln->tn_type->t_tspec)) {
    528 		uint64_t mask = is_uinteger(ln->tn_type->t_tspec)
    529 		    ? 1ULL << 63 : 0;
    530 		if (is_integer(ln->tn_type->t_tspec)) {
    531 			uint64_t lo = (uint64_t)ln->u.value.u.integer ^ mask;
    532 			uint64_t hi = (uint64_t)rn->u.value.u.integer ^ mask;
    533 			if (lo < hi && hi - lo > 1000)
    534 				hi = 0;
    535 			for (; lo < hi; lo++) {
    536 				tnode_t *tn = expr_alloc_tnode();
    537 				tn->tn_sys = ln->tn_sys;
    538 				tn->tn_op = CON;
    539 				tn->tn_type = ln->tn_type;
    540 				tn->u.value.v_tspec = tn->tn_type->t_tspec;
    541 				tn->u.value.u.integer = (int64_t)(lo ^ mask);
    542 				check_case_label(tn);
    543 			}
    544 		}
    545 	}
    546 	check_case_label(rn);
    547 	expr_free_all();
    548 	set_reached(true);
    549 	suppress_fallthrough = true;
    550 }
    551 
    552 void
    553 default_label(void)
    554 {
    555 	/* find the innermost switch statement */
    556 	control_statement *cs;
    557 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
    558 		continue;
    559 
    560 	if (cs == NULL)
    561 		/* default outside switch */
    562 		error(201);
    563 	else if (cs->c_default)
    564 		/* duplicate default in switch */
    565 		error(202);
    566 	else {
    567 		if (reached && !suppress_fallthrough) {
    568 			if (hflag)
    569 				/* fallthrough on default statement */
    570 				warning(284);
    571 		}
    572 		cs->c_default = true;
    573 	}
    574 
    575 	set_reached(true);
    576 }
    577 
    578 static tnode_t *
    579 check_controlling_expression(tnode_t *tn, bool is_do_while)
    580 {
    581 	tn = cconv(tn);
    582 	if (tn != NULL)
    583 		tn = promote(NOOP, false, tn);
    584 
    585 	if (tn != NULL && !is_scalar(tn->tn_type->t_tspec)) {
    586 		/* C99 6.5.15p4 for the ?: operator; see typeok:QUEST */
    587 		/* C99 6.8.4.1p1 for if statements */
    588 		/* C99 6.8.5p2 for while, do and for loops */
    589 		/* controlling expressions must have scalar type, not '%s' */
    590 		error(204, type_name(tn->tn_type));
    591 		return NULL;
    592 	}
    593 
    594 	if (tn != NULL && Tflag
    595 	    && !is_typeok_bool_compares_with_zero(tn, is_do_while)) {
    596 		/* controlling expression must be bool, not '%s' */
    597 		error(333, tn->tn_type->t_is_enum ? expr_type_name(tn)
    598 		    : tspec_name(tn->tn_type->t_tspec));
    599 	}
    600 
    601 	return tn;
    602 }
    603 
    604 void
    605 stmt_if_expr(tnode_t *tn)
    606 {
    607 	if (tn != NULL)
    608 		tn = check_controlling_expression(tn, false);
    609 	if (tn != NULL)
    610 		expr(tn, false, true, false, false, "if");
    611 	begin_control_statement(CS_IF);
    612 
    613 	if (tn != NULL && tn->tn_op == CON && !tn->tn_system_dependent) {
    614 		/* XXX: what if inside 'if (0)'? */
    615 		set_reached(constant_is_nonzero(tn));
    616 		/* XXX: what about always_else? */
    617 		cstmt->c_always_then = reached;
    618 	}
    619 }
    620 
    621 void
    622 stmt_if_then_stmt(void)
    623 {
    624 	cstmt->c_reached_end_of_then = reached;
    625 	/* XXX: what if inside 'if (0)'? */
    626 	set_reached(!cstmt->c_always_then);
    627 }
    628 
    629 void
    630 stmt_if_else_stmt(bool els)
    631 {
    632 	if (cstmt->c_reached_end_of_then)
    633 		set_reached(true);
    634 	else if (cstmt->c_always_then)
    635 		set_reached(false);
    636 	else if (!els)
    637 		set_reached(true);
    638 
    639 	end_control_statement(CS_IF);
    640 }
    641 
    642 void
    643 stmt_switch_expr(tnode_t *tn)
    644 {
    645 	if (tn != NULL)
    646 		tn = cconv(tn);
    647 	if (tn != NULL)
    648 		tn = promote(NOOP, false, tn);
    649 	if (tn != NULL && !is_integer(tn->tn_type->t_tspec)) {
    650 		/* switch expression must have integral type, not '%s' */
    651 		error(205, type_name(tn->tn_type));
    652 		tn = NULL;
    653 	}
    654 	if (tn != NULL && !allow_c90) {
    655 		tspec_t t = tn->tn_type->t_tspec;
    656 		if (t == LONG || t == ULONG || t == LLONG || t == ULLONG)
    657 			/* switch expression must be of type 'int' in ... */
    658 			warning(271);
    659 	}
    660 
    661 	/*
    662 	 * Remember the type of the expression. Because it's possible that
    663 	 * (*tp) is allocated on tree memory, the type must be duplicated. This
    664 	 * is not too complicated because it is only an integer type.
    665 	 */
    666 	type_t *tp = xcalloc(1, sizeof(*tp));
    667 	if (tn != NULL) {
    668 		tp->t_tspec = tn->tn_type->t_tspec;
    669 		if ((tp->t_is_enum = tn->tn_type->t_is_enum) != false)
    670 			tp->u.enumer = tn->tn_type->u.enumer;
    671 	} else {
    672 		tp->t_tspec = INT;
    673 	}
    674 
    675 	/* leak the memory, for check_case_label_bitand */
    676 	(void)expr_save_memory();
    677 
    678 	check_getopt_begin_switch();
    679 	expr(tn, true, false, false, false, "switch");
    680 
    681 	begin_control_statement(CS_SWITCH);
    682 	cstmt->c_switch = true;
    683 	cstmt->c_switch_type = tp;
    684 	cstmt->c_switch_expr = tn;
    685 
    686 	set_reached(false);
    687 	suppress_fallthrough = true;
    688 }
    689 
    690 void
    691 stmt_switch_expr_stmt(void)
    692 {
    693 	int nenum = 0, nclab = 0;
    694 	sym_t *esym;
    695 
    696 	lint_assert(cstmt->c_switch_type != NULL);
    697 
    698 	if (cstmt->c_switch_type->t_is_enum) {
    699 		/*
    700 		 * Warn if the number of case labels is different from the
    701 		 * number of enumerators.
    702 		 */
    703 		nenum = nclab = 0;
    704 		lint_assert(cstmt->c_switch_type->u.enumer != NULL);
    705 		for (esym = cstmt->c_switch_type->u.enumer->en_first_enumerator;
    706 		    esym != NULL; esym = esym->s_next) {
    707 			nenum++;
    708 		}
    709 		nclab = (int)cstmt->c_case_labels.len;
    710 		if (hflag && eflag && nclab < nenum && !cstmt->c_default)
    711 			/* enumeration value(s) not handled in switch */
    712 			warning(206);
    713 	}
    714 
    715 	check_getopt_end_switch();
    716 
    717 	if (cstmt->c_break) {
    718 		/*
    719 		 * The end of the switch statement is always reached since
    720 		 * c_break is only set if a break statement can actually be
    721 		 * reached.
    722 		 */
    723 		set_reached(true);
    724 	} else if (cstmt->c_default ||
    725 		   (hflag && cstmt->c_switch_type->t_is_enum &&
    726 		    nenum == nclab)) {
    727 		/*
    728 		 * The end of the switch statement is reached if the end of the
    729 		 * last statement inside it is reached.
    730 		 */
    731 	} else {
    732 		/*
    733 		 * There are possible values that are not handled in the switch
    734 		 * statement.
    735 		 */
    736 		set_reached(true);
    737 	}
    738 
    739 	end_control_statement(CS_SWITCH);
    740 }
    741 
    742 void
    743 stmt_while_expr(tnode_t *tn)
    744 {
    745 	if (!reached) {
    746 		/* FIXME: that's plain wrong. */
    747 		set_reached(true);
    748 	}
    749 
    750 	if (tn != NULL)
    751 		tn = check_controlling_expression(tn, false);
    752 
    753 	begin_control_statement(CS_WHILE);
    754 	cstmt->c_loop = true;
    755 	cstmt->c_maybe_endless = is_nonzero(tn);
    756 	bool body_reached = !is_zero(tn);
    757 
    758 	check_getopt_begin_while(tn);
    759 	expr(tn, false, true, true, false, "while");
    760 
    761 	set_reached(body_reached);
    762 }
    763 
    764 void
    765 stmt_while_expr_stmt(void)
    766 {
    767 	set_reached(!cstmt->c_maybe_endless || cstmt->c_break);
    768 	check_getopt_end_while();
    769 	end_control_statement(CS_WHILE);
    770 }
    771 
    772 void
    773 stmt_do(void)
    774 {
    775 	if (!reached)
    776 		set_reached(true);
    777 
    778 	begin_control_statement(CS_DO_WHILE);
    779 	cstmt->c_loop = true;
    780 }
    781 
    782 void
    783 stmt_do_while_expr(tnode_t *tn)
    784 {
    785 	if (cstmt->c_continue)
    786 		set_reached(true);
    787 
    788 	if (tn != NULL)
    789 		tn = check_controlling_expression(tn, true);
    790 
    791 	if (tn != NULL && tn->tn_op == CON) {
    792 		cstmt->c_maybe_endless = constant_is_nonzero(tn);
    793 		if (!cstmt->c_maybe_endless && cstmt->c_continue)
    794 			/* continue in 'do ... while (0)' loop */
    795 			error(323);
    796 	}
    797 
    798 	expr(tn, false, true, true, true, "do-while");
    799 
    800 	if (cstmt->c_maybe_endless)
    801 		set_reached(false);
    802 	if (cstmt->c_break)
    803 		set_reached(true);
    804 
    805 	end_control_statement(CS_DO_WHILE);
    806 }
    807 
    808 void
    809 stmt_for_exprs(tnode_t *tn1, tnode_t *tn2, tnode_t *tn3)
    810 {
    811 	/*
    812 	 * If there is no initialization expression it is possible that it is
    813 	 * intended not to enter the loop at top.
    814 	 */
    815 	if (tn1 != NULL && !reached)
    816 		set_reached(true);
    817 
    818 	begin_control_statement(CS_FOR);
    819 	cstmt->c_loop = true;
    820 
    821 	/*
    822 	 * Store the tree memory for the reinitialization expression. Also
    823 	 * remember this expression itself. We must check it at the end of the
    824 	 * loop to get "used but not set" warnings correct.
    825 	 */
    826 	cstmt->c_for_expr3_mem = expr_save_memory();
    827 	cstmt->c_for_expr3 = tn3;
    828 	cstmt->c_for_expr3_pos = curr_pos;
    829 	cstmt->c_for_expr3_csrc_pos = csrc_pos;
    830 
    831 	if (tn1 != NULL)
    832 		expr(tn1, false, false, true, false, "for");
    833 
    834 	if (tn2 != NULL)
    835 		tn2 = check_controlling_expression(tn2, false);
    836 	if (tn2 != NULL)
    837 		expr(tn2, false, true, true, false, "for");
    838 
    839 	cstmt->c_maybe_endless = tn2 == NULL || is_nonzero(tn2);
    840 
    841 	/* The tn3 expression is checked in stmt_for_exprs_stmt. */
    842 
    843 	set_reached(!is_zero(tn2));
    844 }
    845 
    846 void
    847 stmt_for_exprs_stmt(void)
    848 {
    849 	if (cstmt->c_continue)
    850 		set_reached(true);
    851 
    852 	expr_restore_memory(cstmt->c_for_expr3_mem);
    853 	tnode_t *tn3 = cstmt->c_for_expr3;
    854 
    855 	pos_t saved_curr_pos = curr_pos;
    856 	pos_t saved_csrc_pos = csrc_pos;
    857 	curr_pos = cstmt->c_for_expr3_pos;
    858 	csrc_pos = cstmt->c_for_expr3_csrc_pos;
    859 
    860 	/* simply "statement not reached" would be confusing */
    861 	if (!reached && warn_about_unreachable) {
    862 		/* end-of-loop code not reached */
    863 		warning(223);
    864 		set_reached(true);
    865 	}
    866 
    867 	if (tn3 != NULL)
    868 		expr(tn3, false, false, true, false, "for continuation");
    869 	else
    870 		expr_free_all();
    871 
    872 	curr_pos = saved_curr_pos;
    873 	csrc_pos = saved_csrc_pos;
    874 
    875 	set_reached(cstmt->c_break || !cstmt->c_maybe_endless);
    876 
    877 	end_control_statement(CS_FOR);
    878 }
    879 
    880 void
    881 stmt_goto(sym_t *lab)
    882 {
    883 	mark_as_used(lab, false, false);
    884 	check_statement_reachable("goto");
    885 	set_reached(false);
    886 }
    887 
    888 void
    889 stmt_break(void)
    890 {
    891 	control_statement *cs = cstmt;
    892 	while (cs != NULL && !cs->c_loop && !cs->c_switch)
    893 		cs = cs->c_surrounding;
    894 
    895 	if (cs == NULL)
    896 		/* break outside loop or switch */
    897 		error(208);
    898 	else if (reached)
    899 		cs->c_break = true;
    900 
    901 	if (bflag)
    902 		check_statement_reachable("break");
    903 
    904 	set_reached(false);
    905 }
    906 
    907 void
    908 stmt_continue(void)
    909 {
    910 	control_statement *cs;
    911 
    912 	for (cs = cstmt; cs != NULL && !cs->c_loop; cs = cs->c_surrounding)
    913 		continue;
    914 
    915 	if (cs == NULL)
    916 		/* continue outside loop */
    917 		error(209);
    918 	else
    919 		/* TODO: only if reachable, for symmetry with c_break */
    920 		cs->c_continue = true;
    921 
    922 	check_statement_reachable("continue");
    923 
    924 	set_reached(false);
    925 }
    926 
    927 void
    928 stmt_call_noreturn(void)
    929 {
    930 	set_reached(false);
    931 }
    932 
    933 static bool
    934 is_parenthesized(const tnode_t *tn)
    935 {
    936 	while (!tn->tn_parenthesized && tn->tn_op == COMMA)
    937 		tn = tn->u.ops.right;
    938 	return tn->tn_parenthesized && !tn->tn_sys;
    939 }
    940 
    941 static void
    942 check_return_value(bool sys, tnode_t *tn)
    943 {
    944 	if (any_query_enabled && is_parenthesized(tn))
    945 		/* parenthesized return value */
    946 		query_message(9);
    947 
    948 	/* Create a temporary node for the left side */
    949 	tnode_t *ln = expr_zero_alloc(sizeof(*ln), "tnode");
    950 	ln->tn_op = NAME;
    951 	ln->tn_type = expr_unqualified_type(funcsym->s_type->t_subt);
    952 	ln->tn_lvalue = true;
    953 	ln->u.sym = funcsym;	/* better than nothing */
    954 
    955 	tnode_t *retn = build_binary(ln, RETURN, sys, tn);
    956 
    957 	if (retn != NULL) {
    958 		const tnode_t *rn = retn->u.ops.right;
    959 		while (rn->tn_op == CVT || rn->tn_op == PLUS)
    960 			rn = rn->u.ops.left;
    961 		if (rn->tn_op == ADDR && rn->u.ops.left->tn_op == NAME &&
    962 		    rn->u.ops.left->u.sym->s_scl == AUTO)
    963 			/* '%s' returns pointer to automatic object */
    964 			warning(302, funcsym->s_name);
    965 	}
    966 
    967 	expr(retn, true, false, true, false, "return");
    968 }
    969 
    970 void
    971 stmt_return(bool sys, tnode_t *tn)
    972 {
    973 	control_statement *cs = cstmt;
    974 
    975 	if (cs == NULL) {
    976 		/* syntax error '%s' */
    977 		error(249, "return outside function");
    978 		return;
    979 	}
    980 
    981 	for (; cs->c_surrounding != NULL; cs = cs->c_surrounding)
    982 		continue;
    983 
    984 	if (tn != NULL)
    985 		cs->c_had_return_value = true;
    986 	else
    987 		cs->c_had_return_noval = true;
    988 
    989 	if (tn != NULL && funcsym->s_type->t_subt->t_tspec == VOID) {
    990 		/* void function '%s' cannot return value */
    991 		error(213, funcsym->s_name);
    992 		expr_free_all();
    993 		tn = NULL;
    994 	}
    995 	if (tn == NULL && funcsym->s_type->t_subt->t_tspec != VOID
    996 	    && !funcsym->s_return_type_implicit_int) {
    997 		if (allow_c99)
    998 			/* function '%s' expects to return value */
    999 			error(214, funcsym->s_name);
   1000 		else
   1001 			/* function '%s' expects to return value */
   1002 			warning(214, funcsym->s_name);
   1003 	}
   1004 
   1005 	if (tn != NULL)
   1006 		check_return_value(sys, tn);
   1007 	else
   1008 		check_statement_reachable("return");
   1009 
   1010 	set_reached(false);
   1011 }
   1012 
   1013 void
   1014 global_clean_up_decl(bool silent)
   1015 {
   1016 	if (nargusg != -1) {
   1017 		if (!silent)
   1018 			/* comment ** %s ** must precede function definition */
   1019 			warning_at(282, &argsused_pos, "ARGSUSED");
   1020 		nargusg = -1;
   1021 	}
   1022 	if (nvararg != -1) {
   1023 		if (!silent)
   1024 			/* comment ** %s ** must precede function definition */
   1025 			warning_at(282, &vapos, "VARARGS");
   1026 		nvararg = -1;
   1027 	}
   1028 	if (printflike_argnum != -1) {
   1029 		if (!silent)
   1030 			/* comment ** %s ** must precede function definition */
   1031 			warning_at(282, &printflike_pos, "PRINTFLIKE");
   1032 		printflike_argnum = -1;
   1033 	}
   1034 	if (scanflike_argnum != -1) {
   1035 		if (!silent)
   1036 			/* comment ** %s ** must precede function definition */
   1037 			warning_at(282, &scanflike_pos, "SCANFLIKE");
   1038 		scanflike_argnum = -1;
   1039 	}
   1040 
   1041 	dcs->d_asm = false;
   1042 
   1043 	/*
   1044 	 * Needed for BSD yacc in case of parse errors; GNU Bison 3.0.4 is
   1045 	 * fine.  See test gcc_attribute.c, function_with_unknown_attribute.
   1046 	 */
   1047 	in_gcc_attribute = false;
   1048 	while (dcs->d_enclosing != NULL)
   1049 		end_declaration_level();
   1050 }
   1051 
   1052 /*
   1053  * Only the first n parameters of the following function are checked for usage.
   1054  * A missing argument is taken to be 0.
   1055  */
   1056 static void
   1057 argsused(int n)
   1058 {
   1059 	if (dcs->d_kind != DLK_EXTERN) {
   1060 		/* comment ** %s ** must be outside function */
   1061 		warning(280, "ARGSUSED");
   1062 		return;
   1063 	}
   1064 	if (nargusg != -1)
   1065 		/* duplicate comment ** %s ** */
   1066 		warning(281, "ARGSUSED");
   1067 	nargusg = n != -1 ? n : 0;
   1068 	argsused_pos = curr_pos;
   1069 }
   1070 
   1071 static void
   1072 varargs(int n)
   1073 {
   1074 	if (dcs->d_kind != DLK_EXTERN) {
   1075 		/* comment ** %s ** must be outside function */
   1076 		warning(280, "VARARGS");
   1077 		return;
   1078 	}
   1079 	if (nvararg != -1)
   1080 		/* duplicate comment ** %s ** */
   1081 		warning(281, "VARARGS");
   1082 	nvararg = n != -1 ? n : 0;
   1083 	vapos = curr_pos;
   1084 }
   1085 
   1086 /*
   1087  * Check all parameters until the (n-1)-th as usual. The n-th argument is
   1088  * used to check the types of the remaining arguments.
   1089  */
   1090 static void
   1091 printflike(int n)
   1092 {
   1093 	if (dcs->d_kind != DLK_EXTERN) {
   1094 		/* comment ** %s ** must be outside function */
   1095 		warning(280, "PRINTFLIKE");
   1096 		return;
   1097 	}
   1098 	if (printflike_argnum != -1)
   1099 		/* duplicate comment ** %s ** */
   1100 		warning(281, "PRINTFLIKE");
   1101 	printflike_argnum = n != -1 ? n : 0;
   1102 	printflike_pos = curr_pos;
   1103 }
   1104 
   1105 /*
   1106  * Check all parameters until the (n-1)-th as usual. The n-th argument is
   1107  * used the check the types of remaining arguments.
   1108  */
   1109 static void
   1110 scanflike(int n)
   1111 {
   1112 	if (dcs->d_kind != DLK_EXTERN) {
   1113 		/* comment ** %s ** must be outside function */
   1114 		warning(280, "SCANFLIKE");
   1115 		return;
   1116 	}
   1117 	if (scanflike_argnum != -1)
   1118 		/* duplicate comment ** %s ** */
   1119 		warning(281, "SCANFLIKE");
   1120 	scanflike_argnum = n != -1 ? n : 0;
   1121 	scanflike_pos = curr_pos;
   1122 }
   1123 
   1124 static void
   1125 lintlib(void)
   1126 {
   1127 	if (dcs->d_kind != DLK_EXTERN) {
   1128 		/* comment ** %s ** must be outside function */
   1129 		warning(280, "LINTLIBRARY");
   1130 		return;
   1131 	}
   1132 	llibflg = true;
   1133 	vflag = true;
   1134 }
   1135 
   1136 /*
   1137  * PROTOLIB in conjunction with LINTLIBRARY can be used to handle
   1138  * prototypes like function definitions. This is done if the argument
   1139  * to PROTOLIB is nonzero. Otherwise, prototypes are handled normally.
   1140  */
   1141 static void
   1142 protolib(int n)
   1143 {
   1144 	if (dcs->d_kind != DLK_EXTERN) {
   1145 		/* comment ** %s ** must be outside function */
   1146 		warning(280, "PROTOLIB");
   1147 		return;
   1148 	}
   1149 	plibflg = n != 0;
   1150 }
   1151 
   1152 void
   1153 handle_lint_comment(lint_comment comment, int arg)
   1154 {
   1155 	switch (comment) {
   1156 	case LC_ARGSUSED:	argsused(arg);			break;
   1157 	case LC_BITFIELDTYPE:	suppress_bitfieldtype = true;	break;
   1158 	case LC_FALLTHROUGH:	suppress_fallthrough = true;	break;
   1159 	case LC_LINTLIBRARY:	lintlib();			break;
   1160 	case LC_LINTED:		debug_step("set lwarn %d", arg);
   1161 				lwarn = arg;			break;
   1162 	case LC_LONGLONG:	suppress_longlong = true;	break;
   1163 	case LC_NOTREACHED:	set_reached(false);
   1164 				warn_about_unreachable = false;	break;
   1165 	case LC_PRINTFLIKE:	printflike(arg);		break;
   1166 	case LC_PROTOLIB:	protolib(arg);			break;
   1167 	case LC_SCANFLIKE:	scanflike(arg);			break;
   1168 	case LC_VARARGS:	varargs(arg);			break;
   1169 	}
   1170 }
   1171