Home | History | Annotate | Line # | Download | only in lint1
func.c revision 1.167
      1 /*	$NetBSD: func.c,v 1.167 2023/07/09 12:15:07 rillig Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1994, 1995 Jochen Pohl
      5  * All Rights Reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. All advertising materials mentioning features or use of this software
     16  *    must display the following acknowledgement:
     17  *      This product includes software developed by Jochen Pohl for
     18  *	The NetBSD Project.
     19  * 4. The name of the author may not be used to endorse or promote products
     20  *    derived from this software without specific prior written permission.
     21  *
     22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     32  */
     33 
     34 #if HAVE_NBTOOL_CONFIG_H
     35 #include "nbtool_config.h"
     36 #endif
     37 
     38 #include <sys/cdefs.h>
     39 #if defined(__RCSID)
     40 __RCSID("$NetBSD: func.c,v 1.167 2023/07/09 12:15:07 rillig Exp $");
     41 #endif
     42 
     43 #include <stdlib.h>
     44 #include <string.h>
     45 
     46 #include "lint1.h"
     47 #include "cgram.h"
     48 
     49 /*
     50  * Contains a pointer to the symbol table entry of the current function
     51  * definition.
     52  */
     53 sym_t	*funcsym;
     54 
     55 /* Is set as long as a statement can be reached. Must be set at level 0. */
     56 bool	reached = true;
     57 
     58 /*
     59  * Is true by default, can be cleared by NOTREACHED.
     60  * Is reset to true whenever 'reached' changes.
     61  */
     62 bool	warn_about_unreachable;
     63 
     64 /*
     65  * In conjunction with 'reached', controls printing of "fallthrough on ..."
     66  * warnings.
     67  * Reset by each statement and set by FALLTHROUGH, stmt_switch_expr and
     68  * case_label.
     69  *
     70  * Control statements if, for, while and switch do not reset seen_fallthrough
     71  * because this must be done by the controlled statement. At least for if this
     72  * is important because ** FALLTHROUGH ** after "if (expr) statement" is
     73  * evaluated before the following token, which causes reduction of above.
     74  * This means that ** FALLTHROUGH ** after "if ..." would always be ignored.
     75  */
     76 bool	seen_fallthrough;
     77 
     78 /* The innermost control statement */
     79 static control_statement *cstmt;
     80 
     81 /*
     82  * Number of arguments which will be checked for usage in following
     83  * function definition. -1 stands for all arguments.
     84  *
     85  * The position of the last ARGSUSED comment is stored in argsused_pos.
     86  */
     87 int	nargusg = -1;
     88 pos_t	argsused_pos;
     89 
     90 /*
     91  * Number of arguments of the following function definition whose types
     92  * shall be checked by lint2. -1 stands for all arguments.
     93  *
     94  * The position of the last VARARGS comment is stored in vapos.
     95  */
     96 int	nvararg = -1;
     97 pos_t	vapos;
     98 
     99 /*
    100  * Both printflike_argnum and scanflike_argnum contain the 1-based number
    101  * of the string argument which shall be used to check the types of remaining
    102  * arguments (for PRINTFLIKE and SCANFLIKE).
    103  *
    104  * printflike_pos and scanflike_pos are the positions of the last PRINTFLIKE
    105  * or SCANFLIKE comment.
    106  */
    107 int	printflike_argnum = -1;
    108 int	scanflike_argnum = -1;
    109 pos_t	printflike_pos;
    110 pos_t	scanflike_pos;
    111 
    112 /*
    113  * If both plibflg and llibflg are set, prototypes are written as function
    114  * definitions to the output file.
    115  */
    116 bool	plibflg;
    117 
    118 /*
    119  * True means that no warnings about constants in conditional
    120  * context are printed.
    121  */
    122 bool	constcond_flag;
    123 
    124 /*
    125  * Whether a lint library shall be created. The effect of this flag is that
    126  * all defined symbols are treated as used.
    127  * (The LINTLIBRARY comment also resets vflag.)
    128  */
    129 bool	llibflg;
    130 
    131 /*
    132  * Determines the warnings that are suppressed by a LINTED directive.  For
    133  * globally suppressed warnings, see 'msgset'.
    134  *
    135  * LWARN_ALL:	all warnings are enabled
    136  * LWARN_NONE:	all warnings are suppressed
    137  * n >= 0:	warning n is ignored, the others are active
    138  */
    139 int	lwarn = LWARN_ALL;
    140 
    141 /*
    142  * Whether bitfield type errors are suppressed by a BITFIELDTYPE
    143  * directive.
    144  */
    145 bool	bitfieldtype_ok;
    146 
    147 /*
    148  * Whether complaints about use of "long long" are suppressed in
    149  * the next statement or declaration.
    150  */
    151 bool	long_long_flag;
    152 
    153 void
    154 begin_control_statement(control_statement_kind kind)
    155 {
    156 	control_statement *cs;
    157 
    158 	cs = xcalloc(1, sizeof(*cs));
    159 	cs->c_kind = kind;
    160 	cs->c_surrounding = cstmt;
    161 	cstmt = cs;
    162 }
    163 
    164 void
    165 end_control_statement(control_statement_kind kind)
    166 {
    167 	control_statement *cs;
    168 	case_label_t *cl, *next;
    169 
    170 	lint_assert(cstmt != NULL);
    171 
    172 	while (cstmt->c_kind != kind)
    173 		cstmt = cstmt->c_surrounding;
    174 
    175 	cs = cstmt;
    176 	cstmt = cs->c_surrounding;
    177 
    178 	for (cl = cs->c_case_labels; cl != NULL; cl = next) {
    179 		next = cl->cl_next;
    180 		free(cl);
    181 	}
    182 
    183 	free(cs->c_switch_type);
    184 	free(cs);
    185 }
    186 
    187 static void
    188 set_reached(bool new_reached)
    189 {
    190 	debug_step("%s -> %s",
    191 	    reached ? "reachable" : "unreachable",
    192 	    new_reached ? "reachable" : "unreachable");
    193 	reached = new_reached;
    194 	warn_about_unreachable = true;
    195 }
    196 
    197 /*
    198  * Prints a warning if a statement cannot be reached.
    199  */
    200 void
    201 check_statement_reachable(void)
    202 {
    203 	if (!reached && warn_about_unreachable) {
    204 		/* statement not reached */
    205 		warning(193);
    206 		warn_about_unreachable = false;
    207 	}
    208 }
    209 
    210 /*
    211  * Called after a function declaration which introduces a function definition
    212  * and before an (optional) old-style argument declaration list.
    213  *
    214  * Puts all symbols declared in the prototype or in an old-style argument
    215  * list back to the symbol table.
    216  *
    217  * Does the usual checking of storage class, type (return value),
    218  * redeclaration, etc.
    219  */
    220 void
    221 begin_function(sym_t *fsym)
    222 {
    223 	int n;
    224 	bool dowarn;
    225 	sym_t *arg, *sym, *rdsym;
    226 
    227 	funcsym = fsym;
    228 
    229 	/*
    230 	 * Put all symbols declared in the argument list back to the
    231 	 * symbol table.
    232 	 */
    233 	for (sym = dcs->d_func_proto_syms; sym != NULL;
    234 	    sym = sym->s_level_next) {
    235 		if (sym->s_block_level != -1) {
    236 			lint_assert(sym->s_block_level == 1);
    237 			inssym(1, sym);
    238 		}
    239 	}
    240 
    241 	/*
    242 	 * In old_style_function() we did not know whether it is an old
    243 	 * style function definition or only an old-style declaration,
    244 	 * if there are no arguments inside the argument list ("f()").
    245 	 */
    246 	if (!fsym->s_type->t_proto && fsym->u.s_old_style_args == NULL)
    247 		fsym->s_osdef = true;
    248 
    249 	check_type(fsym);
    250 
    251 	/*
    252 	 * check_type() checks for almost all possible errors, but not for
    253 	 * incomplete return values (these are allowed in declarations)
    254 	 */
    255 	if (fsym->s_type->t_subt->t_tspec != VOID &&
    256 	    is_incomplete(fsym->s_type->t_subt)) {
    257 		/* cannot return incomplete type */
    258 		error(67);
    259 	}
    260 
    261 	fsym->s_def = DEF;
    262 
    263 	if (fsym->s_scl == TYPEDEF) {
    264 		fsym->s_scl = EXTERN;
    265 		/* illegal storage class */
    266 		error(8);
    267 	}
    268 
    269 	if (dcs->d_inline)
    270 		fsym->s_inline = true;
    271 
    272 	/*
    273 	 * Arguments in new style function declarations need a name.
    274 	 * (void is already removed from the list of arguments)
    275 	 */
    276 	n = 1;
    277 	for (arg = fsym->s_type->t_args; arg != NULL; arg = arg->s_next) {
    278 		if (arg->s_scl == ABSTRACT) {
    279 			lint_assert(arg->s_name == unnamed);
    280 			/* formal parameter #%d lacks name */
    281 			error(59, n);
    282 		} else {
    283 			lint_assert(arg->s_name != unnamed);
    284 		}
    285 		n++;
    286 	}
    287 
    288 	/*
    289 	 * We must also remember the position. s_def_pos is overwritten
    290 	 * if this is an old-style definition, and we had already a prototype.
    291 	 */
    292 	dcs->d_func_def_pos = fsym->s_def_pos;
    293 
    294 	if ((rdsym = dcs->d_redeclared_symbol) != NULL) {
    295 
    296 		if (!check_redeclaration(fsym, (dowarn = false, &dowarn))) {
    297 
    298 			/*
    299 			 * Print nothing if the newly defined function
    300 			 * is defined in old style. A better warning will
    301 			 * be printed in check_func_lint_directives().
    302 			 */
    303 			if (dowarn && !fsym->s_osdef) {
    304 				/* TODO: error in C99 mode as well? */
    305 				if (!allow_trad && !allow_c99)
    306 					/* redeclaration of '%s' */
    307 					error(27, fsym->s_name);
    308 				else
    309 					/* redeclaration of '%s' */
    310 					warning(27, fsym->s_name);
    311 				print_previous_declaration(rdsym);
    312 			}
    313 
    314 			copy_usage_info(fsym, rdsym);
    315 
    316 			/*
    317 			 * If the old symbol was a prototype and the new
    318 			 * one is none, overtake the position of the
    319 			 * declaration of the prototype.
    320 			 */
    321 			if (fsym->s_osdef && rdsym->s_type->t_proto)
    322 				fsym->s_def_pos = rdsym->s_def_pos;
    323 
    324 			complete_type(fsym, rdsym);
    325 
    326 			if (rdsym->s_inline)
    327 				fsym->s_inline = true;
    328 
    329 		}
    330 
    331 		/* remove the old symbol from the symbol table */
    332 		rmsym(rdsym);
    333 
    334 	}
    335 
    336 	if (fsym->s_osdef && !fsym->s_type->t_proto) {
    337 		/* TODO: Make this an error in C99 mode as well. */
    338 		if ((!allow_trad && !allow_c99) && hflag &&
    339 		    strcmp(fsym->s_name, "main") != 0)
    340 			/* function definition is not a prototype */
    341 			warning(286);
    342 	}
    343 
    344 	if (dcs->d_no_type_specifier)
    345 		fsym->s_return_type_implicit_int = true;
    346 
    347 	set_reached(true);
    348 }
    349 
    350 static void
    351 check_missing_return_value(void)
    352 {
    353 	if (funcsym->s_type->t_subt->t_tspec == VOID)
    354 		return;
    355 	if (funcsym->s_return_type_implicit_int)
    356 		return;
    357 
    358 	/* C99 5.1.2.2.3 "Program termination" p1 */
    359 	if (allow_c99 && strcmp(funcsym->s_name, "main") == 0)
    360 		return;
    361 
    362 	/* function '%s' falls off bottom without returning value */
    363 	warning(217, funcsym->s_name);
    364 }
    365 
    366 /*
    367  * Called at the end of a function definition.
    368  */
    369 void
    370 end_function(void)
    371 {
    372 	sym_t *arg;
    373 	int n;
    374 
    375 	if (reached) {
    376 		cstmt->c_had_return_noval = true;
    377 		check_missing_return_value();
    378 	}
    379 
    380 	/*
    381 	 * This warning is printed only if the return value was implicitly
    382 	 * declared to be int. Otherwise, the wrong return statement
    383 	 * has already printed a warning.
    384 	 */
    385 	if (cstmt->c_had_return_noval && cstmt->c_had_return_value &&
    386 	    funcsym->s_return_type_implicit_int)
    387 		/* function '%s' has 'return expr' and 'return' */
    388 		warning(216, funcsym->s_name);
    389 
    390 	/* Print warnings for unused arguments */
    391 	arg = dcs->d_func_args;
    392 	n = 0;
    393 	while (arg != NULL && (nargusg == -1 || n < nargusg)) {
    394 		check_usage_sym(dcs->d_asm, arg);
    395 		arg = arg->s_next;
    396 		n++;
    397 	}
    398 	nargusg = -1;
    399 
    400 	/*
    401 	 * write the information about the function definition to the
    402 	 * output file
    403 	 * inline functions explicitly declared extern are written as
    404 	 * declarations only.
    405 	 */
    406 	if (dcs->d_scl == EXTERN && funcsym->s_inline) {
    407 		outsym(funcsym, funcsym->s_scl, DECL);
    408 	} else {
    409 		outfdef(funcsym, &dcs->d_func_def_pos,
    410 		    cstmt->c_had_return_value, funcsym->s_osdef,
    411 		    dcs->d_func_args);
    412 	}
    413 
    414 	/* clean up after syntax errors, see test stmt_for.c. */
    415 	while (dcs->d_enclosing != NULL)
    416 		dcs = dcs->d_enclosing;
    417 
    418 	/*
    419 	 * remove all symbols declared during argument declaration from
    420 	 * the symbol table
    421 	 */
    422 	lint_assert(dcs->d_enclosing == NULL);
    423 	lint_assert(dcs->d_kind == DLK_EXTERN);
    424 	symtab_remove_level(dcs->d_func_proto_syms);
    425 
    426 	/* must be set on level 0 */
    427 	set_reached(true);
    428 
    429 	funcsym = NULL;
    430 }
    431 
    432 void
    433 named_label(sym_t *sym)
    434 {
    435 
    436 	if (sym->s_set) {
    437 		/* label '%s' redefined */
    438 		error(194, sym->s_name);
    439 	} else {
    440 		mark_as_set(sym);
    441 	}
    442 
    443 	/* XXX: Assuming that each label is reachable is wrong. */
    444 	set_reached(true);
    445 }
    446 
    447 static void
    448 check_case_label_bitand(const tnode_t *case_expr, const tnode_t *switch_expr)
    449 {
    450 
    451 	if (switch_expr->tn_op != BITAND ||
    452 	    switch_expr->tn_right->tn_op != CON)
    453 		return;
    454 
    455 	lint_assert(case_expr->tn_op == CON);
    456 	uint64_t case_value = (uint64_t)case_expr->tn_val.u.integer;
    457 	uint64_t mask = (uint64_t)switch_expr->tn_right->tn_val.u.integer;
    458 
    459 	if ((case_value & ~mask) != 0) {
    460 		/* statement not reached */
    461 		warning(193);
    462 	}
    463 }
    464 
    465 static void
    466 check_case_label_enum(const tnode_t *tn, const control_statement *cs)
    467 {
    468 	/* similar to typeok_enum in tree.c */
    469 
    470 	if (!(tn->tn_type->t_is_enum || cs->c_switch_type->t_is_enum))
    471 		return;
    472 	if (tn->tn_type->t_is_enum && cs->c_switch_type->t_is_enum &&
    473 	    tn->tn_type->t_enum == cs->c_switch_type->t_enum)
    474 		return;
    475 
    476 #if 0 /* not yet ready, see msg_130.c */
    477 	/* enum type mismatch: '%s' '%s' '%s' */
    478 	warning(130, type_name(cs->c_switch_type), op_name(EQ),
    479 	    type_name(tn->tn_type));
    480 #endif
    481 }
    482 
    483 static void
    484 check_case_label(tnode_t *tn, control_statement *cs)
    485 {
    486 	case_label_t *cl;
    487 	val_t *v;
    488 	val_t nv;
    489 	tspec_t t;
    490 
    491 	if (cs == NULL) {
    492 		/* case not in switch */
    493 		error(195);
    494 		return;
    495 	}
    496 
    497 	if (tn == NULL)
    498 		return;
    499 
    500 	if (tn->tn_op != CON) {
    501 		/* non-constant case expression */
    502 		error(197);
    503 		return;
    504 	}
    505 
    506 	if (!is_integer(tn->tn_type->t_tspec)) {
    507 		/* non-integral case expression */
    508 		error(198);
    509 		return;
    510 	}
    511 
    512 	check_case_label_bitand(tn, cs->c_switch_expr);
    513 	check_case_label_enum(tn, cs);
    514 
    515 	lint_assert(cs->c_switch_type != NULL);
    516 
    517 	if (reached && !seen_fallthrough) {
    518 		if (hflag)
    519 			/* fallthrough on case statement */
    520 			warning(220);
    521 	}
    522 
    523 	t = tn->tn_type->t_tspec;
    524 	if (t == LONG || t == ULONG ||
    525 	    t == LLONG || t == ULLONG) {
    526 		if (!allow_c90)
    527 			/* case label must be of type 'int' in traditional C */
    528 			warning(203);
    529 	}
    530 
    531 	/*
    532 	 * get the value of the expression and convert it
    533 	 * to the type of the switch expression
    534 	 */
    535 	v = integer_constant(tn, true);
    536 	(void)memset(&nv, 0, sizeof(nv));
    537 	convert_constant(CASE, 0, cs->c_switch_type, &nv, v);
    538 	free(v);
    539 
    540 	/* look if we had this value already */
    541 	for (cl = cs->c_case_labels; cl != NULL; cl = cl->cl_next) {
    542 		if (cl->cl_val.u.integer == nv.u.integer)
    543 			break;
    544 	}
    545 	if (cl != NULL && is_uinteger(nv.v_tspec)) {
    546 		/* duplicate case '%lu' in switch */
    547 		error(200, (unsigned long)nv.u.integer);
    548 	} else if (cl != NULL) {
    549 		/* duplicate case '%ld' in switch */
    550 		error(199, (long)nv.u.integer);
    551 	} else {
    552 		check_getopt_case_label(nv.u.integer);
    553 
    554 		/* append the value to the list of case values */
    555 		cl = xcalloc(1, sizeof(*cl));
    556 		cl->cl_val = nv;
    557 		cl->cl_next = cs->c_case_labels;
    558 		cs->c_case_labels = cl;
    559 	}
    560 }
    561 
    562 void
    563 case_label(tnode_t *tn)
    564 {
    565 	control_statement *cs;
    566 
    567 	/* find the innermost switch statement */
    568 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
    569 		continue;
    570 
    571 	check_case_label(tn, cs);
    572 
    573 	expr_free_all();
    574 
    575 	set_reached(true);
    576 }
    577 
    578 void
    579 default_label(void)
    580 {
    581 	control_statement *cs;
    582 
    583 	/* find the innermost switch statement */
    584 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
    585 		continue;
    586 
    587 	if (cs == NULL) {
    588 		/* default outside switch */
    589 		error(201);
    590 	} else if (cs->c_default) {
    591 		/* duplicate default in switch */
    592 		error(202);
    593 	} else {
    594 		if (reached && !seen_fallthrough) {
    595 			if (hflag)
    596 				/* fallthrough on default statement */
    597 				warning(284);
    598 		}
    599 		cs->c_default = true;
    600 	}
    601 
    602 	set_reached(true);
    603 }
    604 
    605 static tnode_t *
    606 check_controlling_expression(tnode_t *tn)
    607 {
    608 
    609 	tn = cconv(tn);
    610 	if (tn != NULL)
    611 		tn = promote(NOOP, false, tn);
    612 
    613 	if (tn != NULL && !is_scalar(tn->tn_type->t_tspec)) {
    614 		/* C99 6.5.15p4 for the ?: operator; see typeok:QUEST */
    615 		/* C99 6.8.4.1p1 for if statements */
    616 		/* C99 6.8.5p2 for while, do and for loops */
    617 		/* controlling expressions must have scalar type */
    618 		error(204);
    619 		return NULL;
    620 	}
    621 
    622 	if (tn != NULL && Tflag && !is_typeok_bool_compares_with_zero(tn)) {
    623 		/* controlling expression must be bool, not '%s' */
    624 		error(333, tn->tn_type->t_is_enum ? type_name(tn->tn_type)
    625 		    : tspec_name(tn->tn_type->t_tspec));
    626 	}
    627 
    628 	return tn;
    629 }
    630 
    631 void
    632 stmt_if_expr(tnode_t *tn)
    633 {
    634 
    635 	if (tn != NULL)
    636 		tn = check_controlling_expression(tn);
    637 	if (tn != NULL)
    638 		expr(tn, false, true, false, false);
    639 	begin_control_statement(CS_IF);
    640 
    641 	if (tn != NULL && tn->tn_op == CON && !tn->tn_system_dependent) {
    642 		/* XXX: what if inside 'if (0)'? */
    643 		set_reached(constant_is_nonzero(tn));
    644 		/* XXX: what about always_else? */
    645 		cstmt->c_always_then = reached;
    646 	}
    647 }
    648 
    649 void
    650 stmt_if_then_stmt(void)
    651 {
    652 
    653 	cstmt->c_reached_end_of_then = reached;
    654 	/* XXX: what if inside 'if (0)'? */
    655 	set_reached(!cstmt->c_always_then);
    656 }
    657 
    658 void
    659 stmt_if_else_stmt(bool els)
    660 {
    661 	if (cstmt->c_reached_end_of_then)
    662 		set_reached(true);
    663 	else if (cstmt->c_always_then)
    664 		set_reached(false);
    665 	else if (!els)
    666 		set_reached(true);
    667 
    668 	end_control_statement(CS_IF);
    669 }
    670 
    671 void
    672 stmt_switch_expr(tnode_t *tn)
    673 {
    674 	tspec_t t;
    675 	type_t *tp;
    676 
    677 	if (tn != NULL)
    678 		tn = cconv(tn);
    679 	if (tn != NULL)
    680 		tn = promote(NOOP, false, tn);
    681 	if (tn != NULL && !is_integer(tn->tn_type->t_tspec)) {
    682 		/* switch expression must have integral type */
    683 		error(205);
    684 		tn = NULL;
    685 	}
    686 	if (tn != NULL && !allow_c90) {
    687 		t = tn->tn_type->t_tspec;
    688 		if (t == LONG || t == ULONG || t == LLONG || t == ULLONG) {
    689 			/* switch expression must be of type 'int' in ... */
    690 			warning(271);
    691 		}
    692 	}
    693 
    694 	/*
    695 	 * Remember the type of the expression. Because it's possible
    696 	 * that (*tp) is allocated on tree memory, the type must be
    697 	 * duplicated. This is not too complicated because it is
    698 	 * only an integer type.
    699 	 */
    700 	tp = xcalloc(1, sizeof(*tp));
    701 	if (tn != NULL) {
    702 		tp->t_tspec = tn->tn_type->t_tspec;
    703 		if ((tp->t_is_enum = tn->tn_type->t_is_enum) != false)
    704 			tp->t_enum = tn->tn_type->t_enum;
    705 	} else {
    706 		tp->t_tspec = INT;
    707 	}
    708 
    709 	/* leak the memory, for check_case_label_bitand */
    710 	(void)expr_save_memory();
    711 
    712 	check_getopt_begin_switch();
    713 	expr(tn, true, false, false, false);
    714 
    715 	begin_control_statement(CS_SWITCH);
    716 	cstmt->c_switch = true;
    717 	cstmt->c_switch_type = tp;
    718 	cstmt->c_switch_expr = tn;
    719 
    720 	set_reached(false);
    721 	seen_fallthrough = true;
    722 }
    723 
    724 void
    725 stmt_switch_expr_stmt(void)
    726 {
    727 	int nenum = 0, nclab = 0;
    728 	sym_t *esym;
    729 	case_label_t *cl;
    730 
    731 	lint_assert(cstmt->c_switch_type != NULL);
    732 
    733 	if (cstmt->c_switch_type->t_is_enum) {
    734 		/*
    735 		 * Warn if the number of case labels is different from the
    736 		 * number of enumerators.
    737 		 */
    738 		nenum = nclab = 0;
    739 		lint_assert(cstmt->c_switch_type->t_enum != NULL);
    740 		for (esym = cstmt->c_switch_type->t_enum->en_first_enumerator;
    741 		     esym != NULL; esym = esym->s_next) {
    742 			nenum++;
    743 		}
    744 		for (cl = cstmt->c_case_labels; cl != NULL; cl = cl->cl_next)
    745 			nclab++;
    746 		if (hflag && eflag && nclab < nenum && !cstmt->c_default) {
    747 			/* enumeration value(s) not handled in switch */
    748 			warning(206);
    749 		}
    750 	}
    751 
    752 	check_getopt_end_switch();
    753 
    754 	if (cstmt->c_break) {
    755 		/*
    756 		 * The end of the switch statement is always reached since
    757 		 * c_break is only set if a break statement can actually
    758 		 * be reached.
    759 		 */
    760 		set_reached(true);
    761 	} else if (cstmt->c_default ||
    762 		   (hflag && cstmt->c_switch_type->t_is_enum &&
    763 		    nenum == nclab)) {
    764 		/*
    765 		 * The end of the switch statement is reached if the end
    766 		 * of the last statement inside it is reached.
    767 		 */
    768 	} else {
    769 		/*
    770 		 * There are possible values that are not handled in the
    771 		 * switch statement.
    772 		 */
    773 		set_reached(true);
    774 	}
    775 
    776 	end_control_statement(CS_SWITCH);
    777 }
    778 
    779 void
    780 stmt_while_expr(tnode_t *tn)
    781 {
    782 	bool body_reached;
    783 
    784 	if (!reached) {
    785 		/* loop not entered at top */
    786 		warning(207);
    787 		/* FIXME: that's plain wrong. */
    788 		set_reached(true);
    789 	}
    790 
    791 	if (tn != NULL)
    792 		tn = check_controlling_expression(tn);
    793 
    794 	begin_control_statement(CS_WHILE);
    795 	cstmt->c_loop = true;
    796 	cstmt->c_maybe_endless = is_nonzero(tn);
    797 	body_reached = !is_zero(tn);
    798 
    799 	check_getopt_begin_while(tn);
    800 	expr(tn, false, true, true, false);
    801 
    802 	set_reached(body_reached);
    803 }
    804 
    805 void
    806 stmt_while_expr_stmt(void)
    807 {
    808 
    809 	/*
    810 	 * The end of the loop can be reached if it is no endless loop
    811 	 * or there was a break statement which was reached.
    812 	 */
    813 	set_reached(!cstmt->c_maybe_endless || cstmt->c_break);
    814 
    815 	check_getopt_end_while();
    816 	end_control_statement(CS_WHILE);
    817 }
    818 
    819 void
    820 stmt_do(void)
    821 {
    822 
    823 	if (!reached) {
    824 		/* loop not entered at top */
    825 		warning(207);
    826 		set_reached(true);
    827 	}
    828 
    829 	begin_control_statement(CS_DO_WHILE);
    830 	cstmt->c_loop = true;
    831 }
    832 
    833 void
    834 stmt_do_while_expr(tnode_t *tn)
    835 {
    836 
    837 	/*
    838 	 * If there was a continue statement, the expression controlling the
    839 	 * loop is reached.
    840 	 */
    841 	if (cstmt->c_continue)
    842 		set_reached(true);
    843 
    844 	if (tn != NULL)
    845 		tn = check_controlling_expression(tn);
    846 
    847 	if (tn != NULL && tn->tn_op == CON) {
    848 		cstmt->c_maybe_endless = constant_is_nonzero(tn);
    849 		if (!cstmt->c_maybe_endless && cstmt->c_continue)
    850 			/* continue in 'do ... while (0)' loop */
    851 			error(323);
    852 	}
    853 
    854 	expr(tn, false, true, true, true);
    855 
    856 	if (cstmt->c_maybe_endless)
    857 		set_reached(false);
    858 	if (cstmt->c_break)
    859 		set_reached(true);
    860 
    861 	end_control_statement(CS_DO_WHILE);
    862 }
    863 
    864 void
    865 stmt_for_exprs(tnode_t *tn1, tnode_t *tn2, tnode_t *tn3)
    866 {
    867 
    868 	/*
    869 	 * If there is no initialization expression it is possible that
    870 	 * it is intended not to enter the loop at top.
    871 	 */
    872 	if (tn1 != NULL && !reached) {
    873 		/* loop not entered at top */
    874 		warning(207);
    875 		set_reached(true);
    876 	}
    877 
    878 	begin_control_statement(CS_FOR);
    879 	cstmt->c_loop = true;
    880 
    881 	/*
    882 	 * Store the tree memory for the reinitialization expression.
    883 	 * Also remember this expression itself. We must check it at
    884 	 * the end of the loop to get "used but not set" warnings correct.
    885 	 */
    886 	cstmt->c_for_expr3_mem = expr_save_memory();
    887 	cstmt->c_for_expr3 = tn3;
    888 	cstmt->c_for_expr3_pos = curr_pos;
    889 	cstmt->c_for_expr3_csrc_pos = csrc_pos;
    890 
    891 	if (tn1 != NULL)
    892 		expr(tn1, false, false, true, false);
    893 
    894 	if (tn2 != NULL)
    895 		tn2 = check_controlling_expression(tn2);
    896 	if (tn2 != NULL)
    897 		expr(tn2, false, true, true, false);
    898 
    899 	cstmt->c_maybe_endless = tn2 == NULL || is_nonzero(tn2);
    900 
    901 	/* The tn3 expression is checked in stmt_for_exprs_stmt. */
    902 
    903 	set_reached(!is_zero(tn2));
    904 }
    905 
    906 void
    907 stmt_for_exprs_stmt(void)
    908 {
    909 	pos_t cpos, cspos;
    910 	tnode_t *tn3;
    911 
    912 	if (cstmt->c_continue)
    913 		set_reached(true);
    914 
    915 	cpos = curr_pos;
    916 	cspos = csrc_pos;
    917 
    918 	/* Restore the tree memory for the reinitialization expression */
    919 	expr_restore_memory(cstmt->c_for_expr3_mem);
    920 	tn3 = cstmt->c_for_expr3;
    921 	curr_pos = cstmt->c_for_expr3_pos;
    922 	csrc_pos = cstmt->c_for_expr3_csrc_pos;
    923 
    924 	/* simply "statement not reached" would be confusing */
    925 	if (!reached && warn_about_unreachable) {
    926 		/* end-of-loop code not reached */
    927 		warning(223);
    928 		set_reached(true);
    929 	}
    930 
    931 	if (tn3 != NULL) {
    932 		expr(tn3, false, false, true, false);
    933 	} else {
    934 		expr_free_all();
    935 	}
    936 
    937 	curr_pos = cpos;
    938 	csrc_pos = cspos;
    939 
    940 	/* An endless loop without break will never terminate */
    941 	/* TODO: What if the loop contains a 'return'? */
    942 	set_reached(cstmt->c_break || !cstmt->c_maybe_endless);
    943 
    944 	end_control_statement(CS_FOR);
    945 }
    946 
    947 void
    948 stmt_goto(sym_t *lab)
    949 {
    950 
    951 	mark_as_used(lab, false, false);
    952 
    953 	check_statement_reachable();
    954 
    955 	set_reached(false);
    956 }
    957 
    958 void
    959 stmt_break(void)
    960 {
    961 	control_statement *cs;
    962 
    963 	cs = cstmt;
    964 	while (cs != NULL && !cs->c_loop && !cs->c_switch)
    965 		cs = cs->c_surrounding;
    966 
    967 	if (cs == NULL) {
    968 		/* break outside loop or switch */
    969 		error(208);
    970 	} else {
    971 		if (reached)
    972 			cs->c_break = true;
    973 	}
    974 
    975 	if (bflag)
    976 		check_statement_reachable();
    977 
    978 	set_reached(false);
    979 }
    980 
    981 void
    982 stmt_continue(void)
    983 {
    984 	control_statement *cs;
    985 
    986 	for (cs = cstmt; cs != NULL && !cs->c_loop; cs = cs->c_surrounding)
    987 		continue;
    988 
    989 	if (cs == NULL) {
    990 		/* continue outside loop */
    991 		error(209);
    992 	} else {
    993 		/* TODO: only if reachable, for symmetry with c_break */
    994 		cs->c_continue = true;
    995 	}
    996 
    997 	check_statement_reachable();
    998 
    999 	set_reached(false);
   1000 }
   1001 
   1002 static bool
   1003 is_parenthesized(const tnode_t *tn)
   1004 {
   1005 
   1006 	while (!tn->tn_parenthesized && tn->tn_op == COMMA)
   1007 		tn = tn->tn_right;
   1008 	return tn->tn_parenthesized && !tn->tn_sys;
   1009 }
   1010 
   1011 static void
   1012 check_return_value(bool sys, tnode_t *tn)
   1013 {
   1014 
   1015 	if (any_query_enabled && is_parenthesized(tn)) {
   1016 		/* parenthesized return value */
   1017 		query_message(9);
   1018 	}
   1019 
   1020 	/* Create a temporary node for the left side */
   1021 	tnode_t *ln = expr_zero_alloc(sizeof(*ln));
   1022 	ln->tn_op = NAME;
   1023 	ln->tn_type = expr_unqualified_type(funcsym->s_type->t_subt);
   1024 	ln->tn_lvalue = true;
   1025 	ln->tn_sym = funcsym;	/* better than nothing */
   1026 
   1027 	tnode_t *retn = build_binary(ln, RETURN, sys, tn);
   1028 
   1029 	if (retn != NULL) {
   1030 		const tnode_t *rn = retn->tn_right;
   1031 		while (rn->tn_op == CVT || rn->tn_op == PLUS)
   1032 			rn = rn->tn_left;
   1033 		if (rn->tn_op == ADDR && rn->tn_left->tn_op == NAME &&
   1034 		    rn->tn_left->tn_sym->s_scl == AUTO) {
   1035 			/* '%s' returns pointer to automatic object */
   1036 			warning(302, funcsym->s_name);
   1037 		}
   1038 	}
   1039 
   1040 	expr(retn, true, false, true, false);
   1041 }
   1042 
   1043 void
   1044 stmt_return(bool sys, tnode_t *tn)
   1045 {
   1046 	control_statement *cs = cstmt;
   1047 
   1048 	if (cs == NULL) {
   1049 		/* syntax error '%s' */
   1050 		error(249, "return outside function");
   1051 		return;
   1052 	}
   1053 
   1054 	for (; cs->c_surrounding != NULL; cs = cs->c_surrounding)
   1055 		continue;
   1056 
   1057 	if (tn != NULL)
   1058 		cs->c_had_return_value = true;
   1059 	else
   1060 		cs->c_had_return_noval = true;
   1061 
   1062 	if (tn != NULL && funcsym->s_type->t_subt->t_tspec == VOID) {
   1063 		/* void function '%s' cannot return value */
   1064 		error(213, funcsym->s_name);
   1065 		expr_free_all();
   1066 		tn = NULL;
   1067 	} else if (tn == NULL && funcsym->s_type->t_subt->t_tspec != VOID) {
   1068 		/*
   1069 		 * Assume that the function has a return value only if it
   1070 		 * is explicitly declared.
   1071 		 */
   1072 		if (!funcsym->s_return_type_implicit_int)
   1073 			/* function '%s' expects to return value */
   1074 			warning(214, funcsym->s_name);
   1075 	}
   1076 
   1077 	if (tn != NULL)
   1078 		check_return_value(sys, tn);
   1079 	else
   1080 		check_statement_reachable();
   1081 
   1082 	set_reached(false);
   1083 }
   1084 
   1085 /*
   1086  * Do some cleanup after a global declaration or definition.
   1087  * Especially remove information about unused lint comments.
   1088  */
   1089 void
   1090 global_clean_up_decl(bool silent)
   1091 {
   1092 
   1093 	if (nargusg != -1) {
   1094 		if (!silent) {
   1095 			/* comment ** %s ** must precede function definition */
   1096 			warning_at(282, &argsused_pos, "ARGSUSED");
   1097 		}
   1098 		nargusg = -1;
   1099 	}
   1100 	if (nvararg != -1) {
   1101 		if (!silent) {
   1102 			/* comment ** %s ** must precede function definition */
   1103 			warning_at(282, &vapos, "VARARGS");
   1104 		}
   1105 		nvararg = -1;
   1106 	}
   1107 	if (printflike_argnum != -1) {
   1108 		if (!silent) {
   1109 			/* comment ** %s ** must precede function definition */
   1110 			warning_at(282, &printflike_pos, "PRINTFLIKE");
   1111 		}
   1112 		printflike_argnum = -1;
   1113 	}
   1114 	if (scanflike_argnum != -1) {
   1115 		if (!silent) {
   1116 			/* comment ** %s ** must precede function definition */
   1117 			warning_at(282, &scanflike_pos, "SCANFLIKE");
   1118 		}
   1119 		scanflike_argnum = -1;
   1120 	}
   1121 
   1122 	dcs->d_asm = false;
   1123 
   1124 	/*
   1125 	 * Needed for BSD yacc in case of parse errors; GNU Bison 3.0.4 is
   1126 	 * fine.  See test gcc_attribute.c, function_with_unknown_attribute.
   1127 	 */
   1128 	in_gcc_attribute = false;
   1129 	while (dcs->d_enclosing != NULL)
   1130 		end_declaration_level();
   1131 }
   1132 
   1133 /*
   1134  * ARGSUSED comment
   1135  *
   1136  * Only the first n arguments of the following function are checked
   1137  * for usage. A missing argument is taken to be 0.
   1138  */
   1139 void
   1140 argsused(int n)
   1141 {
   1142 
   1143 	if (n == -1)
   1144 		n = 0;
   1145 
   1146 	if (dcs->d_kind != DLK_EXTERN) {
   1147 		/* comment ** %s ** must be outside function */
   1148 		warning(280, "ARGSUSED");
   1149 		return;
   1150 	}
   1151 	if (nargusg != -1) {
   1152 		/* duplicate comment ** %s ** */
   1153 		warning(281, "ARGSUSED");
   1154 	}
   1155 	nargusg = n;
   1156 	argsused_pos = curr_pos;
   1157 }
   1158 
   1159 /*
   1160  * VARARGS comment
   1161  *
   1162  * Causes lint2 to check only the first n arguments for compatibility
   1163  * with the function definition. A missing argument is taken to be 0.
   1164  */
   1165 void
   1166 varargs(int n)
   1167 {
   1168 
   1169 	if (n == -1)
   1170 		n = 0;
   1171 
   1172 	if (dcs->d_kind != DLK_EXTERN) {
   1173 		/* comment ** %s ** must be outside function */
   1174 		warning(280, "VARARGS");
   1175 		return;
   1176 	}
   1177 	if (nvararg != -1) {
   1178 		/* duplicate comment ** %s ** */
   1179 		warning(281, "VARARGS");
   1180 	}
   1181 	nvararg = n;
   1182 	vapos = curr_pos;
   1183 }
   1184 
   1185 /*
   1186  * PRINTFLIKE comment
   1187  *
   1188  * Check all arguments until the (n-1)-th as usual. The n-th argument is
   1189  * used the check the types of remaining arguments.
   1190  */
   1191 void
   1192 printflike(int n)
   1193 {
   1194 
   1195 	if (n == -1)
   1196 		n = 0;
   1197 
   1198 	if (dcs->d_kind != DLK_EXTERN) {
   1199 		/* comment ** %s ** must be outside function */
   1200 		warning(280, "PRINTFLIKE");
   1201 		return;
   1202 	}
   1203 	if (printflike_argnum != -1) {
   1204 		/* duplicate comment ** %s ** */
   1205 		warning(281, "PRINTFLIKE");
   1206 	}
   1207 	printflike_argnum = n;
   1208 	printflike_pos = curr_pos;
   1209 }
   1210 
   1211 /*
   1212  * SCANFLIKE comment
   1213  *
   1214  * Check all arguments until the (n-1)-th as usual. The n-th argument is
   1215  * used the check the types of remaining arguments.
   1216  */
   1217 void
   1218 scanflike(int n)
   1219 {
   1220 
   1221 	if (n == -1)
   1222 		n = 0;
   1223 
   1224 	if (dcs->d_kind != DLK_EXTERN) {
   1225 		/* comment ** %s ** must be outside function */
   1226 		warning(280, "SCANFLIKE");
   1227 		return;
   1228 	}
   1229 	if (scanflike_argnum != -1) {
   1230 		/* duplicate comment ** %s ** */
   1231 		warning(281, "SCANFLIKE");
   1232 	}
   1233 	scanflike_argnum = n;
   1234 	scanflike_pos = curr_pos;
   1235 }
   1236 
   1237 /*
   1238  * Set the line number for a CONSTCOND comment. At this and the following
   1239  * line no warnings about constants in conditional contexts are printed.
   1240  */
   1241 /* ARGSUSED */
   1242 void
   1243 constcond(int n)
   1244 {
   1245 
   1246 	constcond_flag = true;
   1247 }
   1248 
   1249 /*
   1250  * Suppress printing of "fallthrough on ..." warnings until next
   1251  * statement.
   1252  */
   1253 /* ARGSUSED */
   1254 void
   1255 fallthru(int n)
   1256 {
   1257 
   1258 	seen_fallthrough = true;
   1259 }
   1260 
   1261 /*
   1262  * Stop warnings about statements which cannot be reached. Also tells lint
   1263  * that the following statements cannot be reached (e.g. after exit()).
   1264  */
   1265 /* ARGSUSED */
   1266 void
   1267 not_reached(int n)
   1268 {
   1269 
   1270 	set_reached(false);
   1271 	warn_about_unreachable = false;
   1272 }
   1273 
   1274 /* ARGSUSED */
   1275 void
   1276 lintlib(int n)
   1277 {
   1278 
   1279 	if (dcs->d_kind != DLK_EXTERN) {
   1280 		/* comment ** %s ** must be outside function */
   1281 		warning(280, "LINTLIBRARY");
   1282 		return;
   1283 	}
   1284 	llibflg = true;
   1285 	vflag = true;
   1286 }
   1287 
   1288 /* Suppress one or most warnings at the current and the following line. */
   1289 void
   1290 linted(int n)
   1291 {
   1292 
   1293 	debug_step("set lwarn %d", n);
   1294 	lwarn = n;
   1295 }
   1296 
   1297 /*
   1298  * Suppress bitfield type errors on the current line.
   1299  */
   1300 /* ARGSUSED */
   1301 void
   1302 bitfieldtype(int n)
   1303 {
   1304 
   1305 	debug_step("%s, %d: bitfieldtype_ok = true",
   1306 	    curr_pos.p_file, curr_pos.p_line);
   1307 	bitfieldtype_ok = true;
   1308 }
   1309 
   1310 /*
   1311  * PROTOLIB in conjunction with LINTLIBRARY can be used to handle
   1312  * prototypes like function definitions. This is done if the argument
   1313  * to PROTOLIB is nonzero. Otherwise, prototypes are handled normally.
   1314  */
   1315 void
   1316 protolib(int n)
   1317 {
   1318 
   1319 	if (dcs->d_kind != DLK_EXTERN) {
   1320 		/* comment ** %s ** must be outside function */
   1321 		warning(280, "PROTOLIB");
   1322 		return;
   1323 	}
   1324 	plibflg = n != 0;
   1325 }
   1326 
   1327 /* The next statement/declaration may use "long long" without a diagnostic. */
   1328 /* ARGSUSED */
   1329 void
   1330 longlong(int n)
   1331 {
   1332 
   1333 	long_long_flag = true;
   1334 }
   1335