smatch_conditions.c

   1 /*
   2  * Copyright (C) 2006,2008 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * The simplest type of condition is
  20  * if (a) { ...
  21  *
  22  * The next simplest kind of conditions is
  23  * if (a && b) { c;
  24  * In that case 'a' is true when we get to 'b' and both are true
  25  * when we get to c.
  26  *
  27  * Or's are a little more complicated.
  28  * if (a || b) { c;
  29  * We know 'a' is not true when we get to 'b' but it may be true
  30  * when we get to c.
  31  *
  32  * If we mix and's and or's that's even more complicated.
  33  * if (a && b && c || a && d) { d ;
  34  * 'a' is true when we evaluate 'b', and 'd'.
  35  * 'b' is true when we evaluate 'c' but otherwise we don't.
  36  *
  37  * The other thing that complicates matters is if we negate
  38  * some if conditions.
  39  * if (!a) { ...
  40  * Smatch has passes the un-negated version to the client and flip
  41  * the true and false values internally.  This makes it easier
  42  * to write checks.
  43  *
  44  * And negations can be part of a compound.
  45  * if (a && !(b || c)) { d;
  46  * In that situation we multiply the negative through to simplify
  47  * stuff so that we can remove the parens like this:
  48  * if (a && !b && !c) { d;
  49  *
  50  * One other thing is that:
  51  * if ((a) != 0){ ...
  52  * that's basically the same as testing for just 'a' and we simplify
  53  * comparisons with zero before passing it to the script.
  54  *
  55  */
  56
  57 #include "smatch.h"
  58 #include "smatch_slist.h"
  59 #include "smatch_extra.h"
  60 #include "smatch_expression_stacks.h"
  61
  62 extern int __expr_stmt_count;
  63
  64 struct expression_list *big_condition_stack;
  65
  66 static void split_conditions(struct expression *expr);
  67
  68 static int is_logical_and(struct expression *expr)
  69 {
  70         if (expr->op == SPECIAL_LOGICAL_AND)
  71                 return 1;
  72         return 0;
  73 }
  74
  75 static int handle_zero_comparisons(struct expression *expr)
  76 {
  77         struct expression *tmp = NULL;
  78         struct expression *zero;
  79
  80         // if left is zero or right is zero
  81         if (expr_is_zero(expr->left)) {
  82                 zero = strip_expr(expr->left);
  83                 if (zero->type != EXPR_VALUE)
  84                         __split_expr(expr->left);
  85                 tmp = expr->right;
  86         } else if (expr_is_zero(expr->right)) {
  87                 zero = strip_expr(expr->left);
  88                 if (zero->type != EXPR_VALUE)
  89                         __split_expr(expr->right);
  90                 tmp = expr->left;
  91         } else {
  92                 return 0;
  93         }
  94
  95         // "if (foo != 0)" is the same as "if (foo)"
  96         if (expr->op == SPECIAL_NOTEQUAL) {
  97                 split_conditions(tmp);
  98                 return 1;
  99         }
 100
 101         // "if (foo == 0)" is the same as "if (!foo)"
 102         if (expr->op == SPECIAL_EQUAL) {
 103                 split_conditions(tmp);
 104                 __negate_cond_stacks();
 105                 return 1;
 106         }
 107
 108         return 0;
 109 }
 110
 111 /*
 112  * This function is for handling calls to likely/unlikely
 113  */
 114
 115 static int ignore_builtin_expect(struct expression *expr)
 116 {
 117         if (sym_name_is("__builtin_expect", expr->fn)) {
 118                 split_conditions(first_ptr_list((struct ptr_list *) expr->args));
 119                 return 1;
 120         }
 121         return 0;
 122 }
 123
 124 /*
 125  * handle_compound_stmt() is for: foo = ({blah; blah; blah; 1})
 126  */
 127
 128 static void handle_compound_stmt(struct statement *stmt)
 129 {
 130         struct expression *expr = NULL;
 131         struct statement *last;
 132         struct statement *s;
 133
 134         last = last_ptr_list((struct ptr_list *)stmt->stmts);
 135         if (last->type == STMT_LABEL) {
 136                 if (last->label_statement &&
 137                     last->label_statement->type == STMT_EXPRESSION)
 138                         expr = last->label_statement->expression;
 139                 else
 140                         last = NULL;
 141         } else if (last->type != STMT_EXPRESSION) {
 142                 last = NULL;
 143         } else {
 144                 expr = last->expression;
 145         }
 146
 147         FOR_EACH_PTR(stmt->stmts, s) {
 148                 if (s != last)
 149                         __split_stmt(s);
 150         } END_FOR_EACH_PTR(s);
 151         if (last && last->type == STMT_LABEL)
 152                 __split_label_stmt(last);
 153         split_conditions(expr);
 154 }
 155
 156 static int handle_preop(struct expression *expr)
 157 {
 158         struct statement *stmt;
 159
 160         if (expr->op == '!') {
 161                 split_conditions(expr->unop);
 162                 __negate_cond_stacks();
 163                 return 1;
 164         }
 165         stmt = get_expression_statement(expr);
 166         if (stmt) {
 167                 handle_compound_stmt(stmt);
 168                 return 1;
 169         }
 170         return 0;
 171 }
 172
 173 static void handle_logical(struct expression *expr)
 174 {
 175         /*
 176          * If we come to an "and" expr then:
 177          * We split the left side.
 178          * We keep all the current states.
 179          * We split the right side.
 180          * We keep all the states from both true sides.
 181          *
 182          * If it's an "or" expr then:
 183          * We save the current slist.
 184          * We split the left side.
 185          * We use the false states for the right side.
 186          * We split the right side.
 187          * We save all the states that are the same on both sides.
 188          */
 189
 190         split_conditions(expr->left);
 191
 192         if (is_logical_and(expr))
 193                 __use_cond_true_states();
 194         else
 195                 __use_cond_false_states();
 196
 197         __push_cond_stacks();
 198
 199         __save_pre_cond_states();
 200         split_conditions(expr->right);
 201         __discard_pre_cond_states();
 202
 203         if (is_logical_and(expr))
 204                 __and_cond_states();
 205         else
 206                 __or_cond_states();
 207
 208         __use_cond_true_states();
 209 }
 210
 211 static struct stree *combine_strees(struct stree *orig, struct stree *fake, struct stree *new)
 212 {
 213         struct stree *ret = NULL;
 214
 215         overwrite_stree(orig, &ret);
 216         overwrite_stree(fake, &ret);
 217         overwrite_stree(new, &ret);
 218         free_stree(&new);
 219
 220         return ret;
 221 }
 222
 223 /*
 224  * handle_select()
 225  * if ((aaa()?bbb():ccc())) { ...
 226  *
 227  * This is almost the same as:
 228  * if ((aaa() && bbb()) || (!aaa() && ccc())) { ...
 229  *
 230  * It's a bit complicated because we shouldn't pass aaa()
 231  * to the clients more than once.
 232  */
 233
 234 static void handle_select(struct expression *expr)
 235 {
 236         struct stree *a_T = NULL;
 237         struct stree *a_F = NULL;
 238         struct stree *a_T_b_T = NULL;
 239         struct stree *a_T_b_F = NULL;
 240         struct stree *a_T_b_fake = NULL;
 241         struct stree *a_F_c_T = NULL;
 242         struct stree *a_F_c_F = NULL;
 243         struct stree *a_F_c_fake = NULL;
 244         struct stree *tmp;
 245         struct sm_state *sm;
 246
 247         /*
 248          * Imagine we have this:  if (a ? b : c) { ...
 249          *
 250          * The condition is true if "a" is true and "b" is true or
 251          * "a" is false and "c" is true.  It's false if "a" is true
 252          * and "b" is false or "a" is false and "c" is false.
 253          *
 254          * The variable name "a_T_b_T" stands for "a true b true" etc.
 255          *
 256          * But if we know "b" is true then we can simpilify things.
 257          * The condition is true if "a" is true or if "a" is false and
 258          * "c" is true.  The only way the condition can be false is if
 259          * "a" is false and "c" is false.
 260          *
 261          * The remaining thing is the "a_T_b_fake".  When we simplify
 262          * the equations we have to take into consideration that other
 263          * states may have changed that don't play into the true false
 264          * equation.  Take the following example:
 265          * if ({
 266          *         (flags) = __raw_local_irq_save();
 267          *         _spin_trylock(lock) ? 1 :
 268          *                 ({ raw_local_irq_restore(flags);  0; });
 269          *    })
 270          * Smatch has to record that the irq flags were restored on the
 271          * false path.
 272          *
 273          */
 274
 275         __save_pre_cond_states();
 276
 277         split_conditions(expr->conditional);
 278
 279         a_T = __copy_cond_true_states();
 280         a_F = __copy_cond_false_states();
 281
 282         __use_cond_true_states();
 283
 284         __push_cond_stacks();
 285         __push_fake_cur_stree();
 286         split_conditions(expr->cond_true);
 287         __process_post_op_stack();
 288         a_T_b_fake = __pop_fake_cur_stree();
 289         a_T_b_T = combine_strees(a_T, a_T_b_fake, __pop_cond_true_stack());
 290         a_T_b_F = combine_strees(a_T, a_T_b_fake, __pop_cond_false_stack());
 291
 292         __use_cond_false_states();
 293
 294         __push_cond_stacks();
 295         __push_fake_cur_stree();
 296         split_conditions(expr->cond_false);
 297         a_F_c_fake = __pop_fake_cur_stree();
 298         a_F_c_T = combine_strees(a_F, a_F_c_fake, __pop_cond_true_stack());
 299         a_F_c_F = combine_strees(a_F, a_F_c_fake, __pop_cond_false_stack());
 300
 301         /* We have to restore the pre condition states so that
 302            implied_condition_true() will use the right cur_stree */
 303         __use_pre_cond_states();
 304
 305         if (implied_condition_true(expr->cond_true)) {
 306                 free_stree(&a_T_b_T);
 307                 free_stree(&a_T_b_F);
 308                 a_T_b_T = clone_stree(a_T);
 309                 overwrite_stree(a_T_b_fake, &a_T_b_T);
 310         }
 311         if (implied_condition_false(expr->cond_true)) {
 312                 free_stree(&a_T_b_T);
 313                 free_stree(&a_T_b_F);
 314                 a_T_b_F = clone_stree(a_T);
 315                 overwrite_stree(a_T_b_fake, &a_T_b_F);
 316         }
 317         if (implied_condition_true(expr->cond_false)) {
 318                 free_stree(&a_F_c_T);
 319                 free_stree(&a_F_c_F);
 320                 a_F_c_T = clone_stree(a_F);
 321                 overwrite_stree(a_F_c_fake, &a_F_c_T);
 322         }
 323         if (implied_condition_false(expr->cond_false)) {
 324                 free_stree(&a_F_c_T);
 325                 free_stree(&a_F_c_F);
 326                 a_F_c_F = clone_stree(a_F);
 327                 overwrite_stree(a_F_c_fake, &a_F_c_F);
 328         }
 329
 330         merge_stree(&a_T_b_T, a_F_c_T);
 331         merge_stree(&a_T_b_F, a_F_c_F);
 332
 333         tmp = __pop_cond_true_stack();
 334         free_stree(&tmp);
 335         tmp = __pop_cond_false_stack();
 336         free_stree(&tmp);
 337
 338         __push_cond_stacks();
 339         FOR_EACH_SM(a_T_b_T, sm) {
 340                 __set_true_false_sm(sm, NULL);
 341         } END_FOR_EACH_SM(sm);
 342         FOR_EACH_SM(a_T_b_F, sm) {
 343                 __set_true_false_sm(NULL, sm);
 344         } END_FOR_EACH_SM(sm);
 345         __free_set_states();
 346
 347         free_stree(&a_T_b_fake);
 348         free_stree(&a_F_c_fake);
 349         free_stree(&a_F_c_T);
 350         free_stree(&a_F_c_F);
 351         free_stree(&a_T_b_T);
 352         free_stree(&a_T_b_F);
 353         free_stree(&a_T);
 354         free_stree(&a_F);
 355 }
 356
 357 static void handle_comma(struct expression *expr)
 358 {
 359         __split_expr(expr->left);
 360         split_conditions(expr->right);
 361 }
 362
 363 static int make_op_unsigned(int op)
 364 {
 365         switch (op) {
 366         case '<':
 367                 return SPECIAL_UNSIGNED_LT;
 368         case SPECIAL_LTE:
 369                 return SPECIAL_UNSIGNED_LTE;
 370         case '>':
 371                 return SPECIAL_UNSIGNED_GT;
 372         case SPECIAL_GTE:
 373                 return SPECIAL_UNSIGNED_GTE;
 374         }
 375         return op;
 376 }
 377
 378 static void hackup_unsigned_compares(struct expression *expr)
 379 {
 380         if (expr->type != EXPR_COMPARE)
 381                 return;
 382
 383         if (type_unsigned(get_type(expr)))
 384                 expr->op = make_op_unsigned(expr->op);
 385 }
 386
 387 static bool handle_expr_statement_conditions(struct expression *expr)
 388 {
 389         struct statement *last_stmt, *stmt;
 390         struct expression *last_expr;
 391
 392         if (expr->type == EXPR_PREOP && expr->op == '(')
 393                 expr = expr->unop;
 394         if (expr->type != EXPR_STATEMENT)
 395                 return false;
 396
 397         stmt = expr->statement;
 398         if (stmt->type != STMT_COMPOUND)
 399                 return false;
 400
 401         last_stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
 402         if (!last_stmt)
 403                 return false;
 404
 405         /*
 406          * I don't think this is right, but I'm not sure how to handle other
 407          * types of statements.
 408          */
 409         if (last_stmt->type == STMT_EXPRESSION)
 410                 last_expr = last_stmt->expression;
 411         else if (last_stmt->type == STMT_LABEL &&
 412                  last_stmt->label_statement->type == STMT_EXPRESSION)
 413                 last_expr = last_stmt->label_statement->expression;
 414         else
 415                 return false;
 416
 417         __expr_stmt_count++;
 418         __push_scope_hooks();
 419         FOR_EACH_PTR(stmt->stmts, stmt) {
 420                 if (stmt == last_stmt) {
 421                         if (stmt->type == STMT_LABEL)
 422                                 __split_label_stmt(stmt);
 423                         split_conditions(last_expr);
 424                         goto done;
 425                 }
 426                 __split_stmt(stmt);
 427         } END_FOR_EACH_PTR(stmt);
 428         exit(1);
 429 done:
 430         __call_scope_hooks();
 431         __expr_stmt_count--;
 432
 433         return true;
 434 }
 435
 436 static void do_condition(struct expression *expr)
 437 {
 438         __fold_in_set_states();
 439         __push_fake_cur_stree();
 440         __pass_to_client(expr, CONDITION_HOOK);
 441         __fold_in_set_states();
 442 }
 443
 444 static void split_conditions(struct expression *expr)
 445 {
 446         if (option_debug) {
 447                 char *cond = expr_to_str(expr);
 448
 449                 sm_msg("%d in split_conditions (%s)", get_lineno(), cond);
 450                 free_string(cond);
 451         }
 452
 453         expr = strip_expr_set_parent(expr);
 454         if (!expr) {
 455                 __fold_in_set_states();
 456                 return;
 457         }
 458
 459         if (handle_expr_statement_conditions(expr))
 460                 return;
 461
 462         /*
 463          * On fast paths (and also I guess some people think it's cool) people
 464          * sometimes use | instead of ||.  It works the same basically except
 465          * that || implies a memory barrier between conditions.  The easiest way
 466          * to handle it is by pretending that | also has a barrier and re-using
 467          * all the normal condition code.  This potentially hides some bugs, but
 468          * people who write code like this should just be careful or they
 469          * deserve bugs.
 470          *
 471          * We could potentially treat boolean bitwise & this way but that seems
 472          * too complicated to deal with.
 473          */
 474         if (expr->type == EXPR_BINOP && expr->op == '|') {
 475                 expr_set_parent_expr(expr->left, expr);
 476                 expr_set_parent_expr(expr->right, expr);
 477                 handle_logical(expr);
 478                 return;
 479         }
 480
 481         switch (expr->type) {
 482         case EXPR_LOGICAL:
 483                 expr_set_parent_expr(expr->left, expr);
 484                 expr_set_parent_expr(expr->right, expr);
 485                 __pass_to_client(expr, LOGIC_HOOK);
 486                 handle_logical(expr);
 487                 return;
 488         case EXPR_COMPARE:
 489                 expr_set_parent_expr(expr->left, expr);
 490                 expr_set_parent_expr(expr->right, expr);
 491                 hackup_unsigned_compares(expr);
 492                 if (handle_zero_comparisons(expr))
 493                         return;
 494                 break;
 495         case EXPR_CALL:
 496                 if (ignore_builtin_expect(expr))
 497                         return;
 498                 break;
 499         case EXPR_PREOP:
 500                 expr_set_parent_expr(expr->unop, expr);
 501                 if (handle_preop(expr))
 502                         return;
 503                 break;
 504         case EXPR_CONDITIONAL:
 505         case EXPR_SELECT:
 506                 expr_set_parent_expr(expr->conditional, expr);
 507                 expr_set_parent_expr(expr->cond_true, expr);
 508                 expr_set_parent_expr(expr->cond_false, expr);
 509                 handle_select(expr);
 510                 return;
 511         case EXPR_COMMA:
 512                 expr_set_parent_expr(expr->left, expr);
 513                 expr_set_parent_expr(expr->right, expr);
 514                 handle_comma(expr);
 515                 return;
 516         }
 517
 518         /* fixme: this should be in smatch_flow.c
 519            but because of the funny stuff we do with conditions
 520            it's awkward to put it there.  We would need to
 521            call CONDITION_HOOK in smatch_flow as well.
 522         */
 523         push_expression(&big_expression_stack, expr);
 524         push_expression(&big_condition_stack, expr);
 525
 526         if (expr->type == EXPR_COMPARE) {
 527                 if (expr->left->type != EXPR_POSTOP)
 528                         __split_expr(expr->left);
 529                 if (expr->right->type != EXPR_POSTOP)
 530                         __split_expr(expr->right);
 531         } else if (expr->type != EXPR_POSTOP) {
 532                 __split_expr(expr);
 533         }
 534         do_condition(expr);
 535         if (expr->type == EXPR_COMPARE) {
 536                 if (expr->left->type == EXPR_POSTOP)
 537                         __split_expr(expr->left);
 538                 if (expr->right->type == EXPR_POSTOP)
 539                         __split_expr(expr->right);
 540         } else if (expr->type == EXPR_POSTOP) {
 541                 __split_expr(expr);
 542         }
 543         __push_fake_cur_stree();
 544         __process_post_op_stack();
 545         __fold_in_set_states();
 546         pop_expression(&big_condition_stack);
 547         pop_expression(&big_expression_stack);
 548 }
 549
 550 static int inside_condition;
 551 void __split_whole_condition(struct expression *expr)
 552 {
 553         sm_debug("%d in __split_whole_condition\n", get_lineno());
 554         inside_condition++;
 555         __save_pre_cond_states();
 556         __push_cond_stacks();
 557         /* it's a hack, but it's sometimes handy to have this stuff
 558            on the big_expression_stack.  */
 559         push_expression(&big_expression_stack, expr);
 560         split_conditions(expr);
 561         __use_cond_states();
 562         __pass_to_client(expr, WHOLE_CONDITION_HOOK);
 563         pop_expression(&big_expression_stack);
 564         inside_condition--;
 565         sm_debug("%d done __split_whole_condition\n", get_lineno());
 566 }
 567
 568 void __handle_logic(struct expression *expr)
 569 {
 570         sm_debug("%d in __handle_logic\n", get_lineno());
 571         inside_condition++;
 572         __save_pre_cond_states();
 573         __push_cond_stacks();
 574         /* it's a hack, but it's sometimes handy to have this stuff
 575            on the big_expression_stack.  */
 576         push_expression(&big_expression_stack, expr);
 577         if (expr)
 578                 split_conditions(expr);
 579         __use_cond_states();
 580         __pass_to_client(expr, WHOLE_CONDITION_HOOK);
 581         pop_expression(&big_expression_stack);
 582         __merge_false_states();
 583         inside_condition--;
 584         sm_debug("%d done __handle_logic\n", get_lineno());
 585 }
 586
 587 int is_condition(struct expression *expr)
 588 {
 589
 590         expr = strip_expr(expr);
 591         if (!expr)
 592                 return 0;
 593
 594         switch (expr->type) {
 595         case EXPR_LOGICAL:
 596         case EXPR_COMPARE:
 597                 return 1;
 598         case EXPR_PREOP:
 599                 if (expr->op == '!')
 600                         return 1;
 601         }
 602         return 0;
 603 }
 604
 605 int __handle_condition_assigns(struct expression *expr)
 606 {
 607         struct expression *right;
 608         struct stree *true_stree, *false_stree, *fake_stree;
 609         struct sm_state *sm;
 610
 611         if (expr->op != '=')
 612                 return 0;
 613         right = strip_expr(expr->right);
 614         if (!is_condition(expr->right))
 615                 return 0;
 616
 617         inside_condition++;
 618         __save_pre_cond_states();
 619         __push_cond_stacks();
 620         /* it's a hack, but it's sometimes handy to have this stuff
 621            on the big_expression_stack.  */
 622         push_expression(&big_expression_stack, right);
 623         split_conditions(right);
 624         true_stree = __get_true_states();
 625         false_stree = __get_false_states();
 626         __use_cond_states();
 627         __push_fake_cur_stree();
 628         set_extra_expr_mod(expr->left, alloc_estate_sval(sval_type_val(get_type(expr->left), 1)));
 629         __pass_to_client(right, WHOLE_CONDITION_HOOK);
 630
 631         fake_stree = __pop_fake_cur_stree();
 632         FOR_EACH_SM(fake_stree, sm) {
 633                 overwrite_sm_state_stree(&true_stree, sm);
 634         } END_FOR_EACH_SM(sm);
 635         free_stree(&fake_stree);
 636
 637         pop_expression(&big_expression_stack);
 638         inside_condition--;
 639
 640         __push_true_states();
 641
 642         __use_false_states();
 643         __push_fake_cur_stree();
 644         set_extra_expr_mod(expr->left, alloc_estate_sval(sval_type_val(get_type(expr->left), 0)));
 645
 646         fake_stree = __pop_fake_cur_stree();
 647         FOR_EACH_SM(fake_stree, sm) {
 648                 overwrite_sm_state_stree(&false_stree, sm);
 649         } END_FOR_EACH_SM(sm);
 650         free_stree(&fake_stree);
 651
 652         __merge_true_states();
 653         merge_fake_stree(&true_stree, false_stree);
 654         free_stree(&false_stree);
 655         FOR_EACH_SM(true_stree, sm) {
 656                 __set_sm(sm);
 657         } END_FOR_EACH_SM(sm);
 658
 659         __pass_to_client(expr, ASSIGNMENT_HOOK);
 660         sm_debug("%d done __handle_condition_assigns\n", get_lineno());
 661         return 1;
 662 }
 663
 664 static int is_select_assign(struct expression *expr)
 665 {
 666         struct expression *right;
 667
 668         if (expr->op != '=')
 669                 return 0;
 670         right = strip_expr(expr->right);
 671         if (right->type == EXPR_CONDITIONAL)
 672                 return 1;
 673         if (right->type == EXPR_SELECT)
 674                 return 1;
 675         return 0;
 676 }
 677
 678 int __handle_select_assigns(struct expression *expr)
 679 {
 680         struct expression *right, *condition;
 681         struct stree *final_states = NULL;
 682         struct sm_state *sm;
 683         int is_true;
 684         int is_false;
 685
 686         if (!is_select_assign(expr))
 687                 return 0;
 688         right = strip_expr(expr->right);
 689         __pass_to_client(right, SELECT_HOOK);
 690
 691         // FIXME: why is this implied instead of known?
 692         is_true = implied_condition_true(right->conditional);
 693         is_false = implied_condition_false(right->conditional);
 694
 695         /*
 696          * For "x = frob() ?: y;" we only want to parse the frob() call once
 697          * so do the assignment and parse the condition in one step.
 698          */
 699         if (right->cond_true)
 700                 condition = right->conditional;
 701         else
 702                 condition = assign_expression(expr->left, expr->op, right->conditional);
 703
 704         expr_set_parent_expr(condition, right);
 705
 706         __save_pre_cond_states();
 707         __split_whole_condition(condition);
 708
 709         if (!is_false && right->cond_true) {
 710                 struct expression *fake_expr;
 711
 712                 fake_expr = assign_expression(expr->left, expr->op, right->cond_true);
 713                 expr_set_parent_expr(fake_expr, expr);
 714                 __split_expr(fake_expr);
 715                 final_states = clone_stree(__get_cur_stree());
 716         } else if (!is_false) {
 717                 final_states = clone_stree(__get_cur_stree());
 718         }
 719
 720         if (is_true) {
 721                 __discard_false_states();
 722                 merge_stree(&final_states, __get_cur_stree());
 723         } else {
 724                 struct expression *fake_expr;
 725
 726                 __use_false_states();
 727                 fake_expr = assign_expression(expr->left, expr->op, right->cond_false);
 728                 expr_set_parent_expr(fake_expr, expr);
 729                 __split_expr(fake_expr);
 730                 merge_stree(&final_states, __get_cur_stree());
 731         }
 732
 733         __use_pre_cond_states();
 734
 735         FOR_EACH_SM(final_states, sm) {
 736                 __set_sm(sm);
 737         } END_FOR_EACH_SM(sm);
 738
 739         free_stree(&final_states);
 740
 741         sm_debug("%d done __handle_ternary_assigns\n", get_lineno());
 742
 743         return 1;
 744 }
 745
 746 static struct statement *split_then_return_last(struct statement *stmt)
 747 {
 748         struct statement *tmp;
 749         struct statement *last_stmt;
 750
 751         last_stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
 752         if (!last_stmt)
 753                 return NULL;
 754
 755         __push_scope_hooks();
 756         FOR_EACH_PTR(stmt->stmts, tmp) {
 757                 if (tmp == last_stmt) {
 758                         if (tmp->type == STMT_LABEL) {
 759                                 __split_label_stmt(tmp);
 760                                 return tmp->label_statement;
 761                         }
 762                         return last_stmt;
 763                 }
 764                 __split_stmt(tmp);
 765         } END_FOR_EACH_PTR(tmp);
 766         return NULL;
 767 }
 768
 769 int __handle_expr_statement_assigns(struct expression *expr)
 770 {
 771         struct expression *right;
 772         struct statement *stmt;
 773
 774         right = expr->right;
 775         if (right->type == EXPR_PREOP && right->op == '(')
 776                 right = right->unop;
 777         if (right->type != EXPR_STATEMENT)
 778                 return 0;
 779
 780         __expr_stmt_count++;
 781         stmt = right->statement;
 782         if (stmt->type == STMT_COMPOUND) {
 783                 struct statement *last_stmt;
 784                 struct expression *fake_assign;
 785                 struct expression fake_expr_stmt = { .smatch_flags = Fake, };
 786
 787                 last_stmt = split_then_return_last(stmt);
 788                 if (!last_stmt) {
 789                         __expr_stmt_count--;
 790                         return 0;
 791                 }
 792
 793                 fake_expr_stmt.pos = last_stmt->pos;
 794                 fake_expr_stmt.type = EXPR_STATEMENT;
 795                 fake_expr_stmt.op = 0;
 796                 fake_expr_stmt.statement = last_stmt;
 797
 798                 fake_assign = assign_expression(expr->left, expr->op, &fake_expr_stmt);
 799                 expr_set_parent_expr(fake_assign, expr);
 800                 __split_expr(fake_assign);
 801
 802                 __pass_to_client(stmt, STMT_HOOK_AFTER);
 803                 __call_scope_hooks();
 804         } else if (stmt->type == STMT_EXPRESSION) {
 805                 struct expression *fake_assign;
 806
 807                 fake_assign = assign_expression(expr->left, expr->op, stmt->expression);
 808                 expr_set_parent_expr(fake_assign, expr);
 809                 __split_expr(fake_assign);
 810
 811         } else {
 812                 __split_stmt(stmt);
 813         }
 814         __expr_stmt_count--;
 815         return 1;
 816 }
 817
 818 int in_condition(void)
 819 {
 820         return inside_condition;
 821 }