?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
flow: introduce shallow assignments
[smatch.git] / smatch_flow.c
bloba77043c75e9ace23186355920c1f1fc461c57711
1 /*
2 * Copyright (C) 2006,2008 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #define _GNU_SOURCE 1
19 #include <unistd.h>
20 #include <stdio.h>
21 #include "token.h"
22 #include "scope.h"
23 #include "smatch.h"
24 #include "smatch_expression_stacks.h"
25 #include "smatch_extra.h"
26 #include "smatch_slist.h"
27
28 int __in_fake_assign;
29 int __in_fake_struct_assign;
30 int __in_buf_clear;
31 int __in_fake_var_assign;
32 int __fake_state_cnt;
33 int __debug_skip;
34 int in_fake_env;
35 int final_pass;
36 int __inline_call;
37 struct expression *__inline_fn;
38
39 int __smatch_lineno = 0;
40
41 static char *base_file;
42 static const char *filename;
43 static char *pathname;
44 static char *full_filename;
45 static char *full_base_file;
46 static char *cur_func;
47 int base_file_stream;
48 static unsigned int loop_count;
49 static int last_goto_statement_handled;
50 int __expr_stmt_count;
51 int __in_function_def;
52 int __in_unmatched_hook;
53 static struct expression_list *switch_expr_stack = NULL;
54 static struct expression_list *post_op_stack = NULL;
55
56 static struct ptr_list *fn_data_list;
57 static struct ptr_list *backup;
58
59 struct expression_list *big_expression_stack;
60 struct statement_list *big_statement_stack;
61 struct statement *__prev_stmt;
62 struct statement *__cur_stmt;
63 struct statement *__next_stmt;
64 static struct expression_list *parsed_calls;
65 static int indent_cnt;
66 int __in_pre_condition = 0;
67 int __bail_on_rest_of_function = 0;
68 static struct timeval fn_start_time;
69 static struct timeval outer_fn_start_time;
70 char *get_function(void) { return cur_func; }
71 int get_lineno(void) { return __smatch_lineno; }
72 int inside_loop(void) { return !!loop_count; }
73 int definitely_inside_loop(void) { return !!(loop_count & ~0x08000000); }
74 struct expression *get_switch_expr(void) { return top_expression(switch_expr_stack); }
75 int in_expression_statement(void) { return !!__expr_stmt_count; }
76
77 static void split_symlist(struct symbol_list *sym_list);
78 static void split_declaration(struct symbol_list *sym_list);
79 static void split_expr_list(struct expression_list *expr_list, struct expression *parent);
80 static void split_args(struct expression *expr);
81 static struct expression *fake_a_variable_assign(struct symbol *type, struct expression *call, struct expression *expr, int nr);
82 static void add_inline_function(struct symbol *sym);
83 static void parse_inline(struct expression *expr);
84
85 int option_assume_loops = 0;
86 int option_two_passes = 0;
87 struct symbol *cur_func_sym = NULL;
88 struct stree *global_states;
89
90 const unsigned long valid_ptr_min = 4096;
91 unsigned long valid_ptr_max = ULONG_MAX & ~(MTAG_OFFSET_MASK);
92 const sval_t valid_ptr_min_sval = {
93 .type = &ptr_ctype,
94 {.value = 4096},
95 };
96 sval_t valid_ptr_max_sval = {
97 .type = &ptr_ctype,
98 {.value = ULONG_MAX & ~(MTAG_OFFSET_MASK)},
99 };
100 struct range_list *valid_ptr_rl;
101
102 void alloc_valid_ptr_rl(void)
103 {
104 valid_ptr_max = sval_type_max(&ulong_ctype).value & ~(MTAG_OFFSET_MASK);
105 valid_ptr_max_sval.value = valid_ptr_max;
106
107 valid_ptr_rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
108 valid_ptr_rl = cast_rl(&ptr_ctype, valid_ptr_rl);
109 valid_ptr_rl = clone_rl_permanent(valid_ptr_rl);
110 }
111
112 int outside_of_function(void)
113 {
114 return cur_func_sym == NULL;
115 }
116
117 const char *get_filename(void)
118 {
119 if (option_info && option_full_path)
120 return full_base_file;
121 if (option_info)
122 return base_file;
123 if (option_full_path)
124 return full_filename;
125 return filename;
126 }
127
128 const char *get_base_file(void)
129 {
130 if (option_full_path)
131 return full_base_file;
132 return base_file;
133 }
134
135 unsigned long long get_file_id(void)
136 {
137 return str_to_llu_hash(get_filename());
138 }
139
140 unsigned long long get_base_file_id(void)
141 {
142 return str_to_llu_hash(get_base_file());
143 }
144
145 static void set_position(struct position pos)
146 {
147 int len;
148 static int prev_stream = -1;
149
150 if (in_fake_env)
151 return;
152
153 if (pos.stream == 0 && pos.line == 0)
154 return;
155
156 __smatch_lineno = pos.line;
157
158 if (pos.stream == prev_stream)
159 return;
160
161 filename = stream_name(pos.stream);
162
163 free(full_filename);
164 pathname = getcwd(NULL, 0);
165 if (pathname) {
166 len = strlen(pathname) + 1 + strlen(filename) + 1;
167 full_filename = malloc(len);
168 snprintf(full_filename, len, "%s/%s", pathname, filename);
169 } else {
170 full_filename = alloc_string(filename);
171 }
172 free(pathname);
173 }
174
175 int is_assigned_call(struct expression *expr)
176 {
177 struct expression *parent = expr_get_parent_expr(expr);
178
179 if (parent &&
180 parent->type == EXPR_ASSIGNMENT &&
181 parent->op == '=' &&
182 strip_expr(parent->right) == expr)
183 return 1;
184
185 return 0;
186 }
187
188 int is_fake_assigned_call(struct expression *expr)
189 {
190 struct expression *parent = expr_get_fake_parent_expr(expr);
191
192 if (parent &&
193 parent->type == EXPR_ASSIGNMENT &&
194 parent->op == '=' &&
195 strip_expr(parent->right) == expr)
196 return 1;
197
198 return 0;
199 }
200
201 static bool is_inline_func(struct expression *expr)
202 {
203 if (expr->type != EXPR_SYMBOL || !expr->symbol)
204 return false;
205 if (!expr->symbol->definition)
206 return false;
207 if (expr->symbol->definition->ctype.modifiers & MOD_INLINE)
208 return true;
209
210 return 0;
211 }
212
213 static int is_noreturn_func(struct expression *expr)
214 {
215 if (expr->type != EXPR_SYMBOL || !expr->symbol)
216 return 0;
217
218 /*
219 * It's almost impossible for Smatch to handle __builtin_constant_p()
220 * the same way that GCC does so Smatch ends up making some functions
221 * as no return functions incorrectly.
222 *
223 */
224 if (option_project == PROJ_KERNEL && expr->symbol->ident &&
225 strstr(expr->symbol->ident->name, "__compiletime_assert"))
226 return 0;
227
228 if (expr->symbol->ctype.modifiers & MOD_NORETURN)
229 return 1;
230 return 0;
231 }
232
233 static int save_func_time(void *_rl, int argc, char **argv, char **azColName)
234 {
235 unsigned long *rl = _rl;
236
237 *rl = strtoul(argv[0], NULL, 10);
238 return 0;
239 }
240
241 static int get_func_time(struct symbol *sym)
242 {
243 unsigned long time = 0;
244
245 run_sql(&save_func_time, &time,
246 "select key from return_implies where %s and type = %d;",
247 get_static_filter(sym), FUNC_TIME);
248
249 return time;
250 }
251
252 static int inline_budget = 20;
253
254 int inlinable(struct expression *expr)
255 {
256 struct symbol *sym;
257 struct statement *last_stmt = NULL;
258
259 if (__inline_fn) /* don't nest */
260 return 0;
261
262 if (expr->type != EXPR_SYMBOL || !expr->symbol)
263 return 0;
264 if (is_no_inline_function(expr->symbol->ident->name))
265 return 0;
266 sym = get_base_type(expr->symbol);
267 if (sym->stmt && sym->stmt->type == STMT_COMPOUND) {
268 if (ptr_list_size((struct ptr_list *)sym->stmt->stmts) > 10)
269 return 0;
270 if (sym->stmt->type != STMT_COMPOUND)
271 return 0;
272 last_stmt = last_ptr_list((struct ptr_list *)sym->stmt->stmts);
273 }
274 if (sym->inline_stmt && sym->inline_stmt->type == STMT_COMPOUND) {
275 if (ptr_list_size((struct ptr_list *)sym->inline_stmt->stmts) > 10)
276 return 0;
277 if (sym->inline_stmt->type != STMT_COMPOUND)
278 return 0;
279 last_stmt = last_ptr_list((struct ptr_list *)sym->inline_stmt->stmts);
280 }
281
282 if (!last_stmt)
283 return 0;
284
285 /* the magic numbers in this function are pulled out of my bum. */
286 if (last_stmt->pos.line > sym->pos.line + inline_budget)
287 return 0;
288
289 if (get_func_time(expr->symbol) >= 2)
290 return 0;
291
292 return 1;
293 }
294
295 void __process_post_op_stack(void)
296 {
297 struct expression *expr;
298
299 FOR_EACH_PTR(post_op_stack, expr) {
300 __pass_to_client(expr, OP_HOOK);
301 } END_FOR_EACH_PTR(expr);
302
303 __free_ptr_list((struct ptr_list **)&post_op_stack);
304 }
305
306 static int handle_comma_assigns(struct expression *expr)
307 {
308 struct expression *right;
309 struct expression *assign;
310
311 right = strip_expr(expr->right);
312 if (right->type != EXPR_COMMA)
313 return 0;
314
315 __split_expr(right->left);
316 __process_post_op_stack();
317
318 assign = assign_expression(expr->left, '=', right->right);
319 __split_expr(assign);
320
321 return 1;
322 }
323
324 /* This is to handle *p++ = foo; assignments */
325 static int handle_postop_assigns(struct expression *expr)
326 {
327 struct expression *left, *fake_left;
328 struct expression *assign;
329
330 left = strip_expr(expr->left);
331 if (left->type != EXPR_PREOP || left->op != '*')
332 return 0;
333 left = strip_expr(left->unop);
334 if (left->type != EXPR_POSTOP)
335 return 0;
336
337 fake_left = deref_expression(strip_expr(left->unop));
338 assign = assign_expression(fake_left, '=', expr->right);
339
340 __split_expr(assign);
341 __split_expr(expr->left);
342
343 return 1;
344 }
345
346 static int prev_expression_is_getting_address(struct expression *expr)
347 {
348 struct expression *parent;
349
350 do {
351 parent = expr_get_parent_expr(expr);
352
353 if (!parent)
354 return 0;
355 if (parent->type == EXPR_PREOP && parent->op == '&')
356 return 1;
357 if (parent->type == EXPR_PREOP && parent->op == '(')
358 goto next;
359 if (parent->type == EXPR_DEREF && parent->op == '.')
360 goto next;
361 /* Handle &foo->array[offset] */
362 if (parent->type == EXPR_BINOP && parent->op == '+') {
363 parent = expr_get_parent_expr(parent);
364 if (!parent)
365 return 0;
366 if (parent->type == EXPR_PREOP && parent->op == '*')
367 goto next;
368 }
369
370 return 0;
371 next:
372 expr = parent;
373 } while (1);
374 }
375
376 int __in_builtin_overflow_func;
377 static void handle_builtin_overflow_func(struct expression *expr)
378 {
379 struct expression *a, *b, *res, *assign;
380 int op;
381
382 if (sym_name_is("__builtin_add_overflow", expr->fn))
383 op = '+';
384 else if (sym_name_is("__builtin_sub_overflow", expr->fn))
385 op = '-';
386 else if (sym_name_is("__builtin_mul_overflow", expr->fn))
387 op = '*';
388 else
389 return;
390
391 a = get_argument_from_call_expr(expr->args, 0);
392 b = get_argument_from_call_expr(expr->args, 1);
393 res = get_argument_from_call_expr(expr->args, 2);
394
395 assign = assign_expression(deref_expression(res), '=', binop_expression(a, op, b));
396
397 __in_builtin_overflow_func++;
398 __split_expr(assign);
399 __in_builtin_overflow_func--;
400 }
401
402 static int handle__builtin_choose_expr(struct expression *expr)
403 {
404 struct expression *const_expr, *expr1, *expr2;
405 sval_t sval;
406
407 if (!sym_name_is("__builtin_choose_expr", expr->fn))
408 return 0;
409
410 const_expr = get_argument_from_call_expr(expr->args, 0);
411 expr1 = get_argument_from_call_expr(expr->args, 1);
412 expr2 = get_argument_from_call_expr(expr->args, 2);
413
414 if (!get_value(const_expr, &sval) || !expr1 || !expr2)
415 return 0;
416 if (sval.value)
417 __split_expr(expr1);
418 else
419 __split_expr(expr2);
420 return 1;
421 }
422
423 static int handle__builtin_choose_expr_assigns(struct expression *expr)
424 {
425 struct expression *const_expr, *right, *expr1, *expr2, *fake;
426 sval_t sval;
427
428 /*
429 * We can't use strip_no_cast() because it strips out
430 * __builtin_choose_expr() which turns this function into a no-op.
431 *
432 */
433 right = strip_parens(expr->right);
434 if (right->type != EXPR_CALL)
435 return 0;
436 if (!sym_name_is("__builtin_choose_expr", right->fn))
437 return 0;
438
439 const_expr = get_argument_from_call_expr(right->args, 0);
440 expr1 = get_argument_from_call_expr(right->args, 1);
441 expr2 = get_argument_from_call_expr(right->args, 2);
442
443 if (!get_value(const_expr, &sval) || !expr1 || !expr2)
444 return 0;
445
446 fake = assign_expression(expr->left, '=', sval.value ? expr1 : expr2);
447 __split_expr(fake);
448 return 1;
449 }
450
451 int is_condition_call(struct expression *expr)
452 {
453 struct expression *tmp;
454
455 FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
456 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
457 return 1;
458 if (tmp->pos.line < expr->pos.line)
459 return 0;
460 } END_FOR_EACH_PTR_REVERSE(tmp);
461
462 return 0;
463 }
464
465 static struct expression *expr_get_parent_no_parens(struct expression *expr)
466 {
467 do {
468 expr = expr_get_parent_expr(expr);
469 } while (expr &&
470 expr->type == EXPR_PREOP &&
471 expr->op == '(');
472
473 return expr;
474 }
475
476 static bool gen_fake_function_assign(struct expression *expr)
477 {
478 static struct expression *parsed;
479 struct expression *assign, *parent;
480 struct symbol *type;
481 char buf[64];
482
483 /* The rule is that every non-void function call has to be part of an
484 * assignment. TODO: Should we create a fake non-casted assignment
485 * for casted assignments? Also faked assigns for += assignments?
486 */
487 type = get_type(expr);
488 if (!type || type == &void_ctype)
489 return false;
490
491 parent = expr_get_parent_no_parens(expr);
492 if (parent && parent->type == EXPR_ASSIGNMENT)
493 return false;
494
495 parent = expr_get_fake_parent_expr(expr);
496 if (parent) {
497 struct expression *left = parent->left;
498
499 if (parent == parsed)
500 return false;
501 if (!left || left->type != EXPR_SYMBOL)
502 return false;
503 if (strncmp(left->symbol_name->name, "__fake_assign_", 14) != 0)
504 return false;
505 parsed = parent;
506 __split_expr(parent);
507 return true;
508 }
509
510 // TODO: faked_assign skipping conditions is a hack
511 if (is_condition_call(expr))
512 return false;
513
514 snprintf(buf, sizeof(buf), "__fake_assign_%p", expr);
515 assign = create_fake_assign(buf, get_type(expr), expr);
516
517 parsed = assign;
518 __split_expr(assign);
519 return true;
520 }
521
522 static void split_call(struct expression *expr)
523 {
524 if (gen_fake_function_assign(expr))
525 return;
526
527 expr_set_parent_expr(expr->fn, expr);
528
529 if (sym_name_is("__builtin_constant_p", expr->fn))
530 return;
531 if (handle__builtin_choose_expr(expr))
532 return;
533 __split_expr(expr->fn);
534 split_args(expr);
535 if (is_inline_func(expr->fn))
536 add_inline_function(expr->fn->symbol->definition);
537 if (inlinable(expr->fn))
538 __inline_call = 1;
539 __process_post_op_stack();
540 __pass_to_client(expr, FUNCTION_CALL_HOOK_BEFORE);
541 __pass_to_client(expr, FUNCTION_CALL_HOOK);
542 __inline_call = 0;
543 if (inlinable(expr->fn))
544 parse_inline(expr);
545 __pass_to_client(expr, CALL_HOOK_AFTER_INLINE);
546 if (is_noreturn_func(expr->fn))
547 nullify_path();
548 if (!expr_get_parent_expr(expr) && indent_cnt == 1)
549 __discard_fake_states(expr);
550 handle_builtin_overflow_func(expr);
551 __add_ptr_list((struct ptr_list **)&parsed_calls, expr);
552 }
553
554 static unsigned long skip_split;
555 void parse_assignment(struct expression *expr, bool shallow)
556 {
557 struct expression *right;
558
559 expr_set_parent_expr(expr->left, expr);
560 expr_set_parent_expr(expr->right, expr);
561
562 right = strip_expr(expr->right);
563 if (!right)
564 return;
565
566 if (shallow)
567 skip_split++;
568
569 __pass_to_client(expr, RAW_ASSIGNMENT_HOOK);
570
571 /* foo = !bar() */
572 if (__handle_condition_assigns(expr))
573 goto after_assign;
574 /* foo = (x < 5 ? foo : 5); */
575 if (__handle_select_assigns(expr))
576 goto after_assign;
577 /* foo = ({frob(); frob(); frob(); 1;}) */
578 if (__handle_expr_statement_assigns(expr))
579 goto done; // FIXME: goto after
580 /* foo = (3, 4); */
581 if (handle_comma_assigns(expr))
582 goto after_assign;
583 if (handle__builtin_choose_expr_assigns(expr))
584 goto after_assign;
585 if (handle_postop_assigns(expr))
586 goto done; /* no need to goto after_assign */
587
588 __split_expr(expr->right);
589 if (outside_of_function())
590 __pass_to_client(expr, GLOBAL_ASSIGNMENT_HOOK);
591 else
592 __pass_to_client(expr, ASSIGNMENT_HOOK);
593
594
595 // FIXME: the ordering of this is tricky
596 __fake_struct_member_assignments(expr);
597
598 /* Re-examine ->right for inlines. See the commit message */
599 right = strip_expr(expr->right);
600 if (expr->op == '=' && right->type == EXPR_CALL)
601 __pass_to_client(expr, CALL_ASSIGNMENT_HOOK);
602
603 after_assign:
604 if (get_macro_name(right->pos) &&
605 get_macro_name(expr->left->pos) != get_macro_name(right->pos))
606 __pass_to_client(expr, MACRO_ASSIGNMENT_HOOK);
607
608 __pass_to_client(expr, ASSIGNMENT_HOOK_AFTER);
609 __split_expr(expr->left);
610
611 done:
612 if (shallow)
613 skip_split--;
614 }
615
616 static bool skip_split_off(struct expression *expr)
617 {
618 if (expr->type == EXPR_CALL &&
619 sym_name_is("__smatch_stop_skip", expr->fn))
620 return true;
621 return false;
622 }
623
624 void __split_expr(struct expression *expr)
625 {
626 if (!expr)
627 return;
628
629 if (skip_split_off(expr))
630 __debug_skip = 0;
631 if (__debug_skip)
632 return;
633
634 if (skip_split)
635 return;
636
637 // if (local_debug)
638 // sm_msg("Debug expr_type %d %s expr = '%s'", expr->type, show_special(expr->op), expr_to_str(expr));
639
640 if (__in_fake_assign && expr->type != EXPR_ASSIGNMENT)
641 return;
642 if (__in_fake_assign >= 4) /* don't allow too much nesting */
643 return;
644
645 push_expression(&big_expression_stack, expr);
646 set_position(expr->pos);
647 __pass_to_client(expr, EXPR_HOOK);
648
649 switch (expr->type) {
650 case EXPR_PREOP:
651 expr_set_parent_expr(expr->unop, expr);
652
653 if (expr->op == '*' &&
654 !prev_expression_is_getting_address(expr))
655 __pass_to_client(expr, DEREF_HOOK);
656 __split_expr(expr->unop);
657 __pass_to_client(expr, OP_HOOK);
658 break;
659 case EXPR_POSTOP:
660 expr_set_parent_expr(expr->unop, expr);
661
662 __split_expr(expr->unop);
663 push_expression(&post_op_stack, expr);
664 break;
665 case EXPR_STATEMENT:
666 __expr_stmt_count++;
667 if (expr->statement && !expr->statement) {
668 stmt_set_parent_stmt(expr->statement,
669 last_ptr_list((struct ptr_list *)big_statement_stack));
670 }
671 __split_stmt(expr->statement);
672 __expr_stmt_count--;
673 break;
674 case EXPR_LOGICAL:
675 case EXPR_COMPARE:
676 expr_set_parent_expr(expr->left, expr);
677 expr_set_parent_expr(expr->right, expr);
678
679 __pass_to_client(expr, LOGIC_HOOK);
680 __handle_logic(expr);
681 break;
682 case EXPR_BINOP:
683 expr_set_parent_expr(expr->left, expr);
684 expr_set_parent_expr(expr->right, expr);
685
686 __pass_to_client(expr, BINOP_HOOK);
687 __split_expr(expr->left);
688 __split_expr(expr->right);
689 break;
690 case EXPR_COMMA:
691 expr_set_parent_expr(expr->left, expr);
692 expr_set_parent_expr(expr->right, expr);
693
694 __split_expr(expr->left);
695 __process_post_op_stack();
696 __split_expr(expr->right);
697 break;
698 case EXPR_ASSIGNMENT:
699 parse_assignment(expr, false);
700 break;
701 case EXPR_DEREF:
702 expr_set_parent_expr(expr->deref, expr);
703
704 __pass_to_client(expr, DEREF_HOOK);
705 __split_expr(expr->deref);
706 break;
707 case EXPR_SLICE:
708 expr_set_parent_expr(expr->base, expr);
709
710 __split_expr(expr->base);
711 break;
712 case EXPR_CAST:
713 case EXPR_FORCE_CAST:
714 expr_set_parent_expr(expr->cast_expression, expr);
715
716 __pass_to_client(expr, CAST_HOOK);
717 __split_expr(expr->cast_expression);
718 break;
719 case EXPR_SIZEOF:
720 if (expr->cast_expression)
721 __pass_to_client(strip_parens(expr->cast_expression),
722 SIZEOF_HOOK);
723 break;
724 case EXPR_OFFSETOF:
725 case EXPR_ALIGNOF:
726 break;
727 case EXPR_CONDITIONAL:
728 case EXPR_SELECT:
729 expr_set_parent_expr(expr->conditional, expr);
730 expr_set_parent_expr(expr->cond_true, expr);
731 expr_set_parent_expr(expr->cond_false, expr);
732
733 if (known_condition_true(expr->conditional)) {
734 __split_expr(expr->cond_true);
735 break;
736 }
737 if (known_condition_false(expr->conditional)) {
738 __split_expr(expr->cond_false);
739 break;
740 }
741 __pass_to_client(expr, SELECT_HOOK);
742 __split_whole_condition(expr->conditional);
743 __split_expr(expr->cond_true);
744 __push_true_states();
745 __use_false_states();
746 __split_expr(expr->cond_false);
747 __merge_true_states();
748 break;
749 case EXPR_CALL:
750 split_call(expr);
751 break;
752 case EXPR_INITIALIZER:
753 split_expr_list(expr->expr_list, expr);
754 break;
755 case EXPR_IDENTIFIER:
756 expr_set_parent_expr(expr->ident_expression, expr);
757 __split_expr(expr->ident_expression);
758 break;
759 case EXPR_INDEX:
760 expr_set_parent_expr(expr->idx_expression, expr);
761 __split_expr(expr->idx_expression);
762 break;
763 case EXPR_POS:
764 expr_set_parent_expr(expr->init_expr, expr);
765 __split_expr(expr->init_expr);
766 break;
767 case EXPR_SYMBOL:
768 __pass_to_client(expr, SYM_HOOK);
769 break;
770 case EXPR_STRING:
771 __pass_to_client(expr, STRING_HOOK);
772 break;
773 case EXPR_GENERIC: {
774 struct expression *tmp;
775
776 tmp = strip_Generic(expr);
777 if (tmp != expr)
778 __split_expr(tmp);
779 break;
780 }
781 default:
782 break;
783 };
784 __pass_to_client(expr, EXPR_HOOK_AFTER);
785 pop_expression(&big_expression_stack);
786 }
787
788 static int is_forever_loop(struct statement *stmt)
789 {
790 struct expression *expr;
791 sval_t sval;
792
793 expr = strip_expr(stmt->iterator_pre_condition);
794 if (!expr)
795 expr = stmt->iterator_post_condition;
796 if (!expr) {
797 /* this is a for(;;) loop... */
798 return 1;
799 }
800
801 if (get_value(expr, &sval) && sval.value != 0)
802 return 1;
803
804 return 0;
805 }
806
807 static int loop_num;
808 static char *get_loop_name(int num)
809 {
810 char buf[256];
811
812 snprintf(buf, 255, "-loop%d", num);
813 buf[255] = '\0';
814 return alloc_sname(buf);
815 }
816
817 static struct bool_stmt_fn_list *once_through_hooks;
818 void add_once_through_hook(bool_stmt_func *fn)
819 {
820 add_ptr_list(&once_through_hooks, fn);
821 }
822
823 static bool call_once_through_hooks(struct statement *stmt)
824 {
825 bool_stmt_func *fn;
826
827 if (implied_condition_true(stmt->iterator_pre_condition))
828 return true;
829 if (option_assume_loops)
830 return true;
831
832 FOR_EACH_PTR(once_through_hooks, fn) {
833 if ((fn)(stmt))
834 return true;
835 } END_FOR_EACH_PTR(fn);
836
837 return false;
838 }
839
840 /*
841 * Pre Loops are while and for loops.
842 */
843 static void handle_pre_loop(struct statement *stmt)
844 {
845 int once_through; /* we go through the loop at least once */
846 struct sm_state *extra_sm = NULL;
847 int unchanged = 0;
848 char *loop_name;
849 struct stree *stree = NULL;
850 struct sm_state *sm = NULL;
851
852 loop_name = get_loop_name(loop_num);
853 loop_num++;
854
855 split_declaration(stmt->iterator_syms);
856 if (stmt->iterator_pre_statement) {
857 __split_stmt(stmt->iterator_pre_statement);
858 __prev_stmt = stmt->iterator_pre_statement;
859 }
860
861 once_through = call_once_through_hooks(stmt);
862
863 loop_count++;
864 __push_continues();
865 __push_breaks();
866
867 __merge_gotos(loop_name, NULL);
868
869 extra_sm = __extra_handle_canonical_loops(stmt, &stree);
870 __in_pre_condition++;
871 __pass_to_client(stmt, PRELOOP_HOOK);
872 __split_whole_condition(stmt->iterator_pre_condition);
873 __in_pre_condition--;
874 FOR_EACH_SM(stree, sm) {
875 set_state(sm->owner, sm->name, sm->sym, sm->state);
876 } END_FOR_EACH_SM(sm);
877 free_stree(&stree);
878 if (extra_sm)
879 extra_sm = get_sm_state(extra_sm->owner, extra_sm->name, extra_sm->sym);
880
881 __split_stmt(stmt->iterator_statement);
882 if (is_forever_loop(stmt)) {
883 __merge_continues();
884 __save_gotos(loop_name, NULL);
885
886 __push_fake_cur_stree();
887 __split_stmt(stmt->iterator_post_statement);
888 stree = __pop_fake_cur_stree();
889
890 __discard_false_states();
891 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
892 __use_breaks();
893
894 if (!__path_is_null())
895 __merge_stree_into_cur(stree);
896 free_stree(&stree);
897 } else {
898 __merge_continues();
899 unchanged = __iterator_unchanged(extra_sm);
900 __split_stmt(stmt->iterator_post_statement);
901 __prev_stmt = stmt->iterator_post_statement;
902 __cur_stmt = stmt;
903
904 __save_gotos(loop_name, NULL);
905 __in_pre_condition++;
906 __split_whole_condition(stmt->iterator_pre_condition);
907 __in_pre_condition--;
908 nullify_path();
909 __merge_false_states();
910 if (once_through)
911 __discard_false_states();
912 else
913 __merge_false_states();
914
915 if (extra_sm && unchanged)
916 __extra_pre_loop_hook_after(extra_sm,
917 stmt->iterator_post_statement,
918 stmt->iterator_pre_condition);
919 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
920 __merge_breaks();
921 }
922 loop_count--;
923 }
924
925 /*
926 * Post loops are do {} while();
927 */
928 static void handle_post_loop(struct statement *stmt)
929 {
930 char *loop_name;
931
932 loop_name = get_loop_name(loop_num);
933 loop_num++;
934 loop_count++;
935
936 __pass_to_client(stmt, POSTLOOP_HOOK);
937
938 __push_continues();
939 __push_breaks();
940 __merge_gotos(loop_name, NULL);
941 __split_stmt(stmt->iterator_statement);
942 __merge_continues();
943 if (!expr_is_zero(stmt->iterator_post_condition))
944 __save_gotos(loop_name, NULL);
945
946 if (is_forever_loop(stmt)) {
947 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
948 __use_breaks();
949 } else {
950 __split_whole_condition(stmt->iterator_post_condition);
951 __use_false_states();
952 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
953 __merge_breaks();
954 }
955 loop_count--;
956 }
957
958 static int empty_statement(struct statement *stmt)
959 {
960 if (!stmt)
961 return 0;
962 if (stmt->type == STMT_EXPRESSION && !stmt->expression)
963 return 1;
964 return 0;
965 }
966
967 static int last_stmt_on_same_line(void)
968 {
969 struct statement *stmt;
970 int i = 0;
971
972 FOR_EACH_PTR_REVERSE(big_statement_stack, stmt) {
973 if (!i++)
974 continue;
975 if (stmt->pos.line == get_lineno())
976 return 1;
977 return 0;
978 } END_FOR_EACH_PTR_REVERSE(stmt);
979 return 0;
980 }
981
982 static void split_asm_ops(struct asm_operand_list *ops)
983 {
984 struct asm_operand *op;
985
986 FOR_EACH_PTR(ops, op) {
987 __split_expr(op->expr);
988 } END_FOR_EACH_PTR(op);
989 }
990
991 static int is_case_val(struct statement *stmt, sval_t sval)
992 {
993 sval_t case_sval;
994
995 if (stmt->type != STMT_CASE)
996 return 0;
997 if (!stmt->case_expression) {
998 __set_default();
999 return 1;
1000 }
1001 if (!get_value(stmt->case_expression, &case_sval))
1002 return 0;
1003 if (case_sval.value == sval.value)
1004 return 1;
1005 return 0;
1006 }
1007
1008 static struct range_list *get_case_rl(struct expression *switch_expr,
1009 struct expression *case_expr,
1010 struct expression *case_to)
1011 {
1012 sval_t start, end;
1013 struct range_list *rl = NULL;
1014 struct symbol *switch_type;
1015
1016 switch_type = get_type(switch_expr);
1017 if (get_value(case_to, &end) && get_value(case_expr, &start)) {
1018 start = sval_cast(switch_type, start);
1019 end = sval_cast(switch_type, end);
1020 add_range(&rl, start, end);
1021 } else if (get_value(case_expr, &start)) {
1022 start = sval_cast(switch_type, start);
1023 add_range(&rl, start, start);
1024 }
1025
1026 return rl;
1027 }
1028
1029 static void split_known_switch(struct statement *stmt, sval_t sval)
1030 {
1031 struct statement *tmp;
1032 struct range_list *rl;
1033
1034 __split_expr(stmt->switch_expression);
1035 sval = sval_cast(get_type(stmt->switch_expression), sval);
1036
1037 push_expression(&switch_expr_stack, stmt->switch_expression);
1038 __save_switch_states(top_expression(switch_expr_stack));
1039 nullify_path();
1040 __push_default();
1041 __push_breaks();
1042
1043 stmt = stmt->switch_statement;
1044
1045 __push_scope_hooks();
1046 FOR_EACH_PTR(stmt->stmts, tmp) {
1047 __smatch_lineno = tmp->pos.line;
1048 // FIXME: what if default comes before the known case statement?
1049 if (is_case_val(tmp, sval)) {
1050 rl = alloc_rl(sval, sval);
1051 __merge_switches(top_expression(switch_expr_stack), rl);
1052 __pass_case_to_client(top_expression(switch_expr_stack), rl);
1053 stmt_set_parent_stmt(tmp->case_statement, tmp);
1054 __split_stmt(tmp->case_statement);
1055 goto next;
1056 }
1057 if (__path_is_null())
1058 continue;
1059 __split_stmt(tmp);
1060 next:
1061 if (__path_is_null()) {
1062 __set_default();
1063 goto out;
1064 }
1065 } END_FOR_EACH_PTR(tmp);
1066 out:
1067 __call_scope_hooks();
1068 if (!__pop_default())
1069 __merge_switches(top_expression(switch_expr_stack), NULL);
1070 __discard_switches();
1071 __merge_breaks();
1072 pop_expression(&switch_expr_stack);
1073 }
1074
1075 static void split_case(struct statement *stmt)
1076 {
1077 struct range_list *rl = NULL;
1078
1079 expr_set_parent_stmt(stmt->case_expression, stmt);
1080 expr_set_parent_stmt(stmt->case_to, stmt);
1081
1082 rl = get_case_rl(top_expression(switch_expr_stack),
1083 stmt->case_expression, stmt->case_to);
1084 while (stmt->case_statement->type == STMT_CASE) {
1085 struct range_list *tmp;
1086
1087 tmp = get_case_rl(top_expression(switch_expr_stack),
1088 stmt->case_statement->case_expression,
1089 stmt->case_statement->case_to);
1090 if (!tmp)
1091 goto next;
1092 rl = rl_union(rl, tmp);
1093 if (!stmt->case_expression)
1094 __set_default();
1095 next:
1096 stmt = stmt->case_statement;
1097 }
1098
1099 __merge_switches(top_expression(switch_expr_stack), rl);
1100
1101 if (!stmt->case_expression)
1102 __set_default();
1103
1104 stmt_set_parent_stmt(stmt->case_statement, stmt);
1105 __split_stmt(stmt->case_statement);
1106 }
1107
1108 int time_parsing_function(void)
1109 {
1110 return ms_since(&fn_start_time) / 1000;
1111 }
1112
1113 bool taking_too_long(void)
1114 {
1115 if ((ms_since(&outer_fn_start_time) / 1000) > 60 * 5) /* five minutes */
1116 return 1;
1117 return 0;
1118 }
1119
1120 struct statement *get_last_stmt(void)
1121 {
1122 struct symbol *fn;
1123 struct statement *stmt;
1124
1125 fn = get_base_type(cur_func_sym);
1126 if (!fn)
1127 return NULL;
1128 stmt = fn->stmt;
1129 if (!stmt)
1130 stmt = fn->inline_stmt;
1131 if (!stmt || stmt->type != STMT_COMPOUND)
1132 return NULL;
1133 stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
1134 if (stmt && stmt->type == STMT_LABEL)
1135 stmt = stmt->label_statement;
1136 return stmt;
1137 }
1138
1139 int is_last_stmt(struct statement *cur_stmt)
1140 {
1141 struct statement *last;
1142
1143 last = get_last_stmt();
1144 if (last && last == cur_stmt)
1145 return 1;
1146 return 0;
1147 }
1148
1149 static void handle_backward_goto(struct statement *goto_stmt)
1150 {
1151 const char *goto_name, *label_name;
1152 struct statement *func_stmt;
1153 struct symbol *base_type = get_base_type(cur_func_sym);
1154 struct statement *tmp;
1155 int found = 0;
1156
1157 if (!option_info)
1158 return;
1159 if (last_goto_statement_handled)
1160 return;
1161 last_goto_statement_handled = 1;
1162
1163 if (!goto_stmt->goto_label ||
1164 goto_stmt->goto_label->type != SYM_LABEL ||
1165 !goto_stmt->goto_label->ident)
1166 return;
1167 goto_name = goto_stmt->goto_label->ident->name;
1168
1169 func_stmt = base_type->stmt;
1170 if (!func_stmt)
1171 func_stmt = base_type->inline_stmt;
1172 if (!func_stmt)
1173 return;
1174 if (func_stmt->type != STMT_COMPOUND)
1175 return;
1176
1177 FOR_EACH_PTR(func_stmt->stmts, tmp) {
1178 if (!found) {
1179 if (tmp->type != STMT_LABEL)
1180 continue;
1181 if (!tmp->label_identifier ||
1182 tmp->label_identifier->type != SYM_LABEL ||
1183 !tmp->label_identifier->ident)
1184 continue;
1185 label_name = tmp->label_identifier->ident->name;
1186 if (strcmp(goto_name, label_name) != 0)
1187 continue;
1188 found = 1;
1189 }
1190 __split_stmt(tmp);
1191 } END_FOR_EACH_PTR(tmp);
1192 }
1193
1194 static void fake_a_return(void)
1195 {
1196 struct expression *ret = NULL;
1197
1198 nullify_path();
1199 __unnullify_path();
1200
1201 if (cur_func_return_type() != &void_ctype)
1202 ret = unknown_value_expression(NULL);
1203
1204 __pass_to_client(ret, RETURN_HOOK);
1205 nullify_path();
1206 }
1207
1208 static void split_ret_value(struct expression *expr)
1209 {
1210 struct symbol *type;
1211
1212 if (!expr)
1213 return;
1214
1215 type = get_real_base_type(cur_func_sym);
1216 type = get_real_base_type(type);
1217 expr = fake_a_variable_assign(type, NULL, expr, -1);
1218
1219 __in_fake_var_assign++;
1220 __split_expr(expr);
1221 __in_fake_var_assign--;
1222 }
1223
1224 static void fake_an_empty_default(struct position pos)
1225 {
1226 static struct statement none = {};
1227
1228 none.pos = pos;
1229 none.type = STMT_NONE;
1230 __merge_switches(top_expression(switch_expr_stack), NULL);
1231 __split_stmt(&none);
1232 }
1233
1234 static void split_compound(struct statement *stmt)
1235 {
1236 struct statement *prev = NULL;
1237 struct statement *cur = NULL;
1238 struct statement *next;
1239
1240 __push_scope_hooks();
1241
1242 FOR_EACH_PTR(stmt->stmts, next) {
1243 /* just set them all ahead of time */
1244 stmt_set_parent_stmt(next, stmt);
1245
1246 if (cur) {
1247 __prev_stmt = prev;
1248 __next_stmt = next;
1249 __cur_stmt = cur;
1250 __split_stmt(cur);
1251 }
1252 prev = cur;
1253 cur = next;
1254 } END_FOR_EACH_PTR(next);
1255 if (cur) {
1256 __prev_stmt = prev;
1257 __cur_stmt = cur;
1258 __next_stmt = NULL;
1259 __split_stmt(cur);
1260 }
1261
1262 /*
1263 * For function scope, then delay calling the scope hooks until the
1264 * end of function hooks can run. I'm not positive this is the right
1265 * thing...
1266 */
1267 if (!is_last_stmt(cur))
1268 __call_scope_hooks();
1269 }
1270
1271 /*
1272 * This is a hack, work around for detecting empty functions.
1273 */
1274 static int need_delayed_scope_hooks(void)
1275 {
1276 struct symbol *fn = get_base_type(cur_func_sym);
1277 struct statement *stmt;
1278
1279 if (!fn)
1280 return 0;
1281 stmt = fn->stmt;
1282 if (!stmt)
1283 stmt = fn->inline_stmt;
1284 if (stmt && stmt->type == STMT_COMPOUND)
1285 return 1;
1286 return 0;
1287 }
1288
1289 void __split_label_stmt(struct statement *stmt)
1290 {
1291 if (stmt->label_identifier &&
1292 stmt->label_identifier->type == SYM_LABEL &&
1293 stmt->label_identifier->ident) {
1294 loop_count |= 0x0800000;
1295 __merge_gotos(stmt->label_identifier->ident->name, stmt->label_identifier);
1296 }
1297 }
1298
1299 static void find_asm_gotos(struct statement *stmt)
1300 {
1301 struct symbol *sym;
1302
1303 FOR_EACH_PTR(stmt->asm_labels, sym) {
1304 __save_gotos(sym->ident->name, sym);
1305 } END_FOR_EACH_PTR(sym);
1306 }
1307
1308 static bool already_parsed_call(struct expression *call)
1309 {
1310 struct expression *expr;
1311
1312 FOR_EACH_PTR(parsed_calls, expr) {
1313 if (expr == call)
1314 return true;
1315 } END_FOR_EACH_PTR(expr);
1316 return false;
1317 }
1318
1319 static void free_parsed_call_stuff(bool free_fake_states)
1320 {
1321 free_expression_stack(&parsed_calls);
1322 if (free_fake_states)
1323 __discard_fake_states(NULL);
1324 }
1325
1326 void __split_stmt(struct statement *stmt)
1327 {
1328 sval_t sval;
1329 struct timeval start, stop;
1330 bool skip_after = false;
1331
1332 gettimeofday(&start, NULL);
1333
1334 if (!stmt)
1335 goto out;
1336
1337 if (!__in_fake_assign)
1338 __silence_warnings_for_stmt = false;
1339
1340 if (__bail_on_rest_of_function || is_skipped_function())
1341 return;
1342
1343 if (out_of_memory() || taking_too_long()) {
1344 gettimeofday(&start, NULL);
1345
1346 __bail_on_rest_of_function = 1;
1347 final_pass = 1;
1348 sm_perror("Function too hairy. Giving up. %lu seconds",
1349 start.tv_sec - fn_start_time.tv_sec);
1350 fake_a_return();
1351 final_pass = 0; /* turn off sm_msg() from here */
1352 return;
1353 }
1354
1355 indent_cnt++;
1356
1357 add_ptr_list(&big_statement_stack, stmt);
1358 free_expression_stack(&big_expression_stack);
1359 free_parsed_call_stuff(indent_cnt == 1);
1360 set_position(stmt->pos);
1361 __pass_to_client(stmt, STMT_HOOK);
1362
1363 switch (stmt->type) {
1364 case STMT_DECLARATION:
1365 split_declaration(stmt->declaration);
1366 break;
1367 case STMT_RETURN:
1368 expr_set_parent_stmt(stmt->ret_value, stmt);
1369
1370 split_ret_value(stmt->ret_value);
1371 __pass_to_client(stmt->ret_value, RETURN_HOOK);
1372 __process_post_op_stack();
1373 nullify_path();
1374 break;
1375 case STMT_EXPRESSION:
1376 expr_set_parent_stmt(stmt->expression, stmt);
1377 expr_set_parent_stmt(stmt->context, stmt);
1378
1379 __split_expr(stmt->expression);
1380 break;
1381 case STMT_COMPOUND:
1382 split_compound(stmt);
1383 break;
1384 case STMT_IF:
1385 stmt_set_parent_stmt(stmt->if_true, stmt);
1386 stmt_set_parent_stmt(stmt->if_false, stmt);
1387 expr_set_parent_stmt(stmt->if_conditional, stmt);
1388
1389 if (known_condition_true(stmt->if_conditional)) {
1390 __split_stmt(stmt->if_true);
1391 break;
1392 }
1393 if (known_condition_false(stmt->if_conditional)) {
1394 __split_stmt(stmt->if_false);
1395 break;
1396 }
1397 __split_whole_condition(stmt->if_conditional);
1398 __split_stmt(stmt->if_true);
1399 if (empty_statement(stmt->if_true) &&
1400 last_stmt_on_same_line() &&
1401 !get_macro_name(stmt->if_true->pos))
1402 sm_warning("if();");
1403 __push_true_states();
1404 __use_false_states();
1405 __split_stmt(stmt->if_false);
1406 __merge_true_states();
1407 break;
1408 case STMT_ITERATOR:
1409 stmt_set_parent_stmt(stmt->iterator_pre_statement, stmt);
1410 stmt_set_parent_stmt(stmt->iterator_statement, stmt);
1411 stmt_set_parent_stmt(stmt->iterator_post_statement, stmt);
1412 expr_set_parent_stmt(stmt->iterator_pre_condition, stmt);
1413 expr_set_parent_stmt(stmt->iterator_post_condition, stmt);
1414
1415 if (stmt->iterator_pre_condition)
1416 handle_pre_loop(stmt);
1417 else if (stmt->iterator_post_condition)
1418 handle_post_loop(stmt);
1419 else {
1420 // these are for(;;) type loops.
1421 handle_pre_loop(stmt);
1422 }
1423 break;
1424 case STMT_SWITCH:
1425 stmt_set_parent_stmt(stmt->switch_statement, stmt);
1426 expr_set_parent_stmt(stmt->switch_expression, stmt);
1427
1428 if (get_value(stmt->switch_expression, &sval)) {
1429 split_known_switch(stmt, sval);
1430 break;
1431 }
1432 __split_expr(stmt->switch_expression);
1433 push_expression(&switch_expr_stack, stmt->switch_expression);
1434 __save_switch_states(top_expression(switch_expr_stack));
1435 nullify_path();
1436 __push_default();
1437 __push_breaks();
1438 __split_stmt(stmt->switch_statement);
1439 if (!__pop_default() && have_remaining_cases())
1440 fake_an_empty_default(stmt->pos);
1441 __discard_switches();
1442 __merge_breaks();
1443 pop_expression(&switch_expr_stack);
1444 break;
1445 case STMT_CASE:
1446 split_case(stmt);
1447 break;
1448 case STMT_LABEL:
1449 __split_label_stmt(stmt);
1450 __pass_to_client(stmt, STMT_HOOK_AFTER);
1451 skip_after = true;
1452 __split_stmt(stmt->label_statement);
1453 break;
1454 case STMT_GOTO:
1455 expr_set_parent_stmt(stmt->goto_expression, stmt);
1456
1457 __split_expr(stmt->goto_expression);
1458 if (stmt->goto_label && stmt->goto_label->type == SYM_NODE) {
1459 if (!strcmp(stmt->goto_label->ident->name, "break")) {
1460 __process_breaks();
1461 } else if (!strcmp(stmt->goto_label->ident->name,
1462 "continue")) {
1463 __process_continues();
1464 }
1465 } else if (stmt->goto_label &&
1466 stmt->goto_label->type == SYM_LABEL &&
1467 stmt->goto_label->ident) {
1468 __save_gotos(stmt->goto_label->ident->name, stmt->goto_label);
1469 }
1470 nullify_path();
1471 if (is_last_stmt(stmt))
1472 handle_backward_goto(stmt);
1473 break;
1474 case STMT_NONE:
1475 break;
1476 case STMT_ASM:
1477 expr_set_parent_stmt(stmt->asm_string, stmt);
1478
1479 find_asm_gotos(stmt);
1480 __pass_to_client(stmt, ASM_HOOK);
1481 __split_expr(stmt->asm_string);
1482 split_asm_ops(stmt->asm_outputs);
1483 split_asm_ops(stmt->asm_inputs);
1484 split_expr_list(stmt->asm_clobbers, NULL);
1485 break;
1486 case STMT_CONTEXT:
1487 break;
1488 case STMT_RANGE:
1489 __split_expr(stmt->range_expression);
1490 __split_expr(stmt->range_low);
1491 __split_expr(stmt->range_high);
1492 break;
1493 }
1494 if (!skip_after)
1495 __pass_to_client(stmt, STMT_HOOK_AFTER);
1496 if (--indent_cnt == 1)
1497 free_parsed_call_stuff(true);
1498
1499 out:
1500 __process_post_op_stack();
1501
1502 gettimeofday(&stop, NULL);
1503 if (option_time_stmt && stmt)
1504 sm_msg("stmt_time%s: %ld",
1505 stmt->type == STMT_COMPOUND ? "_block" : "",
1506 stop.tv_sec - start.tv_sec);
1507 }
1508
1509 static void split_expr_list(struct expression_list *expr_list, struct expression *parent)
1510 {
1511 struct expression *expr;
1512
1513 FOR_EACH_PTR(expr_list, expr) {
1514 expr_set_parent_expr(expr, parent);
1515 __split_expr(expr);
1516 __process_post_op_stack();
1517 } END_FOR_EACH_PTR(expr);
1518 }
1519
1520 static bool cast_arg(struct symbol *type, struct expression *arg)
1521 {
1522 struct symbol *orig;
1523
1524 if (!type)
1525 return false;
1526
1527 arg = strip_parens(arg);
1528 if (arg != strip_expr(arg))
1529 return true;
1530
1531 orig = get_type(arg);
1532 if (!orig)
1533 return true;
1534 if (types_equiv(orig, type))
1535 return false;
1536
1537 if (orig->type == SYM_ARRAY && type->type == SYM_PTR)
1538 return true;
1539
1540 /*
1541 * I would have expected that we could just do use (orig == type) but I
1542 * guess for pointers we need to get the basetype to do that comparison.
1543 *
1544 */
1545
1546 if (orig->type != SYM_PTR ||
1547 type->type != SYM_PTR) {
1548 if (type_fits(type, orig))
1549 return false;
1550 return true;
1551 }
1552 orig = get_real_base_type(orig);
1553 type = get_real_base_type(type);
1554 if (orig == type)
1555 return false;
1556
1557 return true;
1558 }
1559
1560 static struct expression *fake_a_variable_assign(struct symbol *type, struct expression *call, struct expression *expr, int nr)
1561 {
1562 char buf[64];
1563 bool cast;
1564
1565 if (!expr || !cur_func_sym)
1566 return NULL;
1567
1568 if (already_parsed_call(call))
1569 return NULL;
1570
1571 if (expr->type == EXPR_ASSIGNMENT)
1572 return expr;
1573
1574 /* for va_args then we don't know the type */
1575 if (!type)
1576 type = get_type(expr);
1577
1578 cast = cast_arg(type, expr);
1579 /*
1580 * Using expr_to_sym() here is a hack. We want to say that we don't
1581 * need to assign frob(foo) or frob(foo->bar) if the types are right.
1582 * It turns out faking these assignments is way more expensive than I
1583 * would have imagined. I'm not sure why exactly.
1584 *
1585 */
1586 if (!cast) {
1587 /*
1588 * if the code is "return *p;" where "p" is a user pointer then
1589 * we want to create a fake assignment so that it sets the state
1590 * in check_kernel_user_data.c.
1591 *
1592 */
1593 if (expr->type != EXPR_PREOP &&
1594 expr->op != '*' && expr->op != '&' &&
1595 expr_to_sym(expr))
1596 return expr;
1597 }
1598
1599 if (nr == -1)
1600 snprintf(buf, sizeof(buf), "__fake_return_%p", expr);
1601 else
1602 snprintf(buf, sizeof(buf), "__fake_param_%p_%d", call, nr);
1603
1604 return create_fake_assign(buf, type, expr);
1605 }
1606
1607 static void split_args(struct expression *expr)
1608 {
1609 struct expression *arg, *tmp;
1610 struct symbol *type;
1611 int i;
1612
1613 i = -1;
1614 FOR_EACH_PTR(expr->args, arg) {
1615 i++;
1616 expr_set_parent_expr(arg, expr);
1617 type = get_arg_type(expr->fn, i);
1618 tmp = fake_a_variable_assign(type, expr, arg, i);
1619 if (tmp != arg)
1620 __in_fake_var_assign++;
1621 __split_expr(tmp);
1622 if (tmp != arg)
1623 __in_fake_var_assign--;
1624 __process_post_op_stack();
1625 } END_FOR_EACH_PTR(arg);
1626 }
1627
1628 static void call_cleanup_fn(void *_sym)
1629 {
1630 struct symbol *sym = _sym;
1631 struct expression *call, *arg;
1632 struct expression_list *args = NULL;
1633
1634 if (!sym->cleanup)
1635 return;
1636
1637 arg = symbol_expression(sym);
1638 arg = preop_expression(arg, '&');
1639 add_ptr_list(&args, arg);
1640 call = call_expression(sym->cleanup, args);
1641
1642 __split_expr(call);
1643 }
1644
1645 static void add_cleanup_hook(struct symbol *sym)
1646 {
1647 add_scope_hook(&call_cleanup_fn, sym);
1648 }
1649
1650 static void split_sym(struct symbol *sym)
1651 {
1652 if (!sym)
1653 return;
1654 if (!(sym->namespace & NS_SYMBOL))
1655 return;
1656
1657 __split_stmt(sym->stmt);
1658 __split_expr(sym->array_size);
1659 if (sym->cleanup)
1660 add_cleanup_hook(sym);
1661 split_symlist(sym->arguments);
1662 split_symlist(sym->symbol_list);
1663 __split_stmt(sym->inline_stmt);
1664 split_symlist(sym->inline_symbol_list);
1665 }
1666
1667 static void split_symlist(struct symbol_list *sym_list)
1668 {
1669 struct symbol *sym;
1670
1671 FOR_EACH_PTR(sym_list, sym) {
1672 split_sym(sym);
1673 } END_FOR_EACH_PTR(sym);
1674 }
1675
1676 typedef void (fake_cb)(struct expression *expr);
1677
1678 static int member_to_number(struct expression *expr, struct ident *member)
1679 {
1680 struct symbol *type, *tmp;
1681 char *name;
1682 int i;
1683
1684 if (!member)
1685 return -1;
1686 name = member->name;
1687
1688 type = get_type(expr);
1689 if (!type || type->type != SYM_STRUCT)
1690 return -1;
1691
1692 i = -1;
1693 FOR_EACH_PTR(type->symbol_list, tmp) {
1694 i++;
1695 if (!tmp->ident)
1696 continue;
1697 if (strcmp(name, tmp->ident->name) == 0)
1698 return i;
1699 } END_FOR_EACH_PTR(tmp);
1700 return -1;
1701 }
1702
1703 static struct ident *number_to_member(struct expression *expr, int num)
1704 {
1705 struct symbol *type, *member;
1706 int i = 0;
1707
1708 type = get_type(expr);
1709 if (!type || type->type != SYM_STRUCT)
1710 return NULL;
1711
1712 FOR_EACH_PTR(type->symbol_list, member) {
1713 if (i == num)
1714 return member->ident;
1715 i++;
1716 } END_FOR_EACH_PTR(member);
1717 return NULL;
1718 }
1719
1720 static void fake_element_assigns_helper(struct expression *array, struct expression_list *expr_list, fake_cb *fake_cb);
1721
1722 static void set_inner_struct_members(struct expression *expr, struct symbol *member)
1723 {
1724 struct expression *edge_member, *assign;
1725 struct symbol *base = get_real_base_type(member);
1726 struct symbol *tmp;
1727
1728 if (member->ident)
1729 expr = member_expression(expr, '.', member->ident);
1730
1731 FOR_EACH_PTR(base->symbol_list, tmp) {
1732 struct symbol *type;
1733
1734 type = get_real_base_type(tmp);
1735 if (!type)
1736 continue;
1737
1738 edge_member = member_expression(expr, '.', tmp->ident);
1739 if (get_extra_state(edge_member))
1740 continue;
1741
1742 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
1743 set_inner_struct_members(expr, tmp);
1744 continue;
1745 }
1746
1747 if (!tmp->ident)
1748 continue;
1749
1750 assign = assign_expression(edge_member, '=', zero_expr());
1751 __split_expr(assign);
1752 } END_FOR_EACH_PTR(tmp);
1753
1754
1755 }
1756
1757 static void set_unset_to_zero(struct symbol *type, struct expression *expr)
1758 {
1759 struct symbol *tmp;
1760 struct expression *member = NULL;
1761 struct expression *assign;
1762
1763 FOR_EACH_PTR(type->symbol_list, tmp) {
1764 type = get_real_base_type(tmp);
1765 if (!type)
1766 continue;
1767
1768 if (tmp->ident) {
1769 member = member_expression(expr, '.', tmp->ident);
1770 if (get_extra_state(member))
1771 continue;
1772 }
1773
1774 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
1775 set_inner_struct_members(expr, tmp);
1776 continue;
1777 }
1778 if (type->type == SYM_ARRAY)
1779 continue;
1780 if (!tmp->ident)
1781 continue;
1782
1783 assign = assign_expression(member, '=', zero_expr());
1784 __split_expr(assign);
1785 } END_FOR_EACH_PTR(tmp);
1786 }
1787
1788 static void fake_member_assigns_helper(struct expression *symbol, struct expression_list *members, fake_cb *fake_cb)
1789 {
1790 struct expression *deref, *assign, *tmp, *right;
1791 struct symbol *struct_type, *type;
1792 struct ident *member;
1793 int member_idx;
1794
1795 struct_type = get_type(symbol);
1796 if (!struct_type ||
1797 (struct_type->type != SYM_STRUCT && struct_type->type != SYM_UNION))
1798 return;
1799
1800 /*
1801 * We're parsing an initializer that could look something like this:
1802 * struct foo foo = {
1803 * 42,
1804 * .whatever.xxx = 11,
1805 * .zzz = 12,
1806 * };
1807 *
1808 * So what we have here is a list with 42, .whatever, and .zzz. We need
1809 * to break it up into left and right sides of the assignments.
1810 *
1811 */
1812 member_idx = 0;
1813 FOR_EACH_PTR(members, tmp) {
1814 deref = NULL;
1815 if (tmp->type == EXPR_IDENTIFIER) {
1816 member_idx = member_to_number(symbol, tmp->expr_ident);
1817 while (tmp->type == EXPR_IDENTIFIER) {
1818 member = tmp->expr_ident;
1819 tmp = tmp->ident_expression;
1820 if (deref)
1821 deref = member_expression(deref, '.', member);
1822 else
1823 deref = member_expression(symbol, '.', member);
1824 }
1825 } else {
1826 member = number_to_member(symbol, member_idx);
1827 deref = member_expression(symbol, '.', member);
1828 }
1829 right = tmp;
1830 member_idx++;
1831 if (right->type == EXPR_INITIALIZER) {
1832 type = get_type(deref);
1833 if (type && type->type == SYM_ARRAY)
1834 fake_element_assigns_helper(deref, right->expr_list, fake_cb);
1835 else
1836 fake_member_assigns_helper(deref, right->expr_list, fake_cb);
1837 } else {
1838 assign = assign_expression(deref, '=', right);
1839 fake_cb(assign);
1840 }
1841 } END_FOR_EACH_PTR(tmp);
1842
1843 set_unset_to_zero(struct_type, symbol);
1844 }
1845
1846 static void fake_member_assigns(struct symbol *sym, fake_cb *fake_cb)
1847 {
1848 fake_member_assigns_helper(symbol_expression(sym),
1849 sym->initializer->expr_list, fake_cb);
1850 }
1851
1852 static void fake_element_assigns_helper(struct expression *array, struct expression_list *expr_list, fake_cb *fake_cb)
1853 {
1854 struct expression *offset, *binop, *assign, *tmp;
1855 struct symbol *type;
1856 int idx, max;
1857
1858 if (ptr_list_size((struct ptr_list *)expr_list) > 1000)
1859 return;
1860
1861 max = 0;
1862 idx = 0;
1863 FOR_EACH_PTR(expr_list, tmp) {
1864 if (tmp->type == EXPR_INDEX) {
1865 if (tmp->idx_from != tmp->idx_to)
1866 return;
1867 idx = tmp->idx_from;
1868 if (idx > max)
1869 max = idx;
1870 if (!tmp->idx_expression)
1871 goto next;
1872 tmp = tmp->idx_expression;
1873 }
1874 offset = value_expr(idx);
1875 binop = array_element_expression(array, offset);
1876 if (tmp->type == EXPR_INITIALIZER) {
1877 type = get_type(binop);
1878 if (type && type->type == SYM_ARRAY)
1879 fake_element_assigns_helper(binop, tmp->expr_list, fake_cb);
1880 else
1881 fake_member_assigns_helper(binop, tmp->expr_list, fake_cb);
1882 } else {
1883 assign = assign_expression(binop, '=', tmp);
1884 fake_cb(assign);
1885 }
1886 next:
1887 idx++;
1888 if (idx > max)
1889 max = idx;
1890 } END_FOR_EACH_PTR(tmp);
1891
1892 __call_array_initialized_hooks(array, max);
1893 }
1894
1895 static void fake_element_assigns(struct symbol *sym, fake_cb *fake_cb)
1896 {
1897 fake_element_assigns_helper(symbol_expression(sym), sym->initializer->expr_list, fake_cb);
1898 }
1899
1900 static void fake_assign_expr(struct symbol *sym)
1901 {
1902 struct expression *assign, *symbol;
1903
1904 symbol = symbol_expression(sym);
1905 assign = assign_expression(symbol, '=', sym->initializer);
1906 __split_expr(assign);
1907 }
1908
1909 static void do_initializer_stuff(struct symbol *sym)
1910 {
1911 if (!sym->initializer)
1912 return;
1913
1914 if (sym->initializer->type == EXPR_INITIALIZER) {
1915 if (get_real_base_type(sym)->type == SYM_ARRAY)
1916 fake_element_assigns(sym, __split_expr);
1917 else
1918 fake_member_assigns(sym, __split_expr);
1919 } else {
1920 fake_assign_expr(sym);
1921 }
1922 }
1923
1924 static void split_declaration(struct symbol_list *sym_list)
1925 {
1926 struct symbol *sym;
1927
1928 FOR_EACH_PTR(sym_list, sym) {
1929 __pass_to_client(sym, DECLARATION_HOOK);
1930 do_initializer_stuff(sym);
1931 __pass_to_client(sym, DECLARATION_HOOK_AFTER);
1932 split_sym(sym);
1933 } END_FOR_EACH_PTR(sym);
1934 }
1935
1936 static void call_global_assign_hooks(struct expression *assign)
1937 {
1938 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1939 }
1940
1941 static void fake_global_assign(struct symbol *sym)
1942 {
1943 struct expression *assign, *symbol;
1944
1945 if (get_real_base_type(sym)->type == SYM_ARRAY) {
1946 if (sym->initializer && sym->initializer->type == EXPR_INITIALIZER) {
1947 fake_element_assigns(sym, call_global_assign_hooks);
1948 } else if (sym->initializer) {
1949 symbol = symbol_expression(sym);
1950 assign = assign_expression(symbol, '=', sym->initializer);
1951 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1952 } else {
1953 fake_element_assigns_helper(symbol_expression(sym), NULL, call_global_assign_hooks);
1954 }
1955 } else if (get_real_base_type(sym)->type == SYM_STRUCT) {
1956 if (sym->initializer && sym->initializer->type == EXPR_INITIALIZER) {
1957 fake_member_assigns(sym, call_global_assign_hooks);
1958 } else if (sym->initializer) {
1959 symbol = symbol_expression(sym);
1960 assign = assign_expression(symbol, '=', sym->initializer);
1961 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1962 } else {
1963 fake_member_assigns_helper(symbol_expression(sym), NULL, call_global_assign_hooks);
1964 }
1965 } else {
1966 symbol = symbol_expression(sym);
1967 if (sym->initializer) {
1968 assign = assign_expression(symbol, '=', sym->initializer);
1969 __split_expr(assign);
1970 } else {
1971 assign = assign_expression(symbol, '=', zero_expr());
1972 }
1973 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1974 }
1975 }
1976
1977 static void start_function_definition(struct symbol *sym)
1978 {
1979 __in_function_def = 1;
1980 __pass_to_client(sym, FUNC_DEF_HOOK);
1981 __in_function_def = 0;
1982 __pass_to_client(sym, AFTER_DEF_HOOK);
1983
1984 }
1985
1986 void add_function_data(unsigned long *fn_data)
1987 {
1988 __add_ptr_list(&fn_data_list, fn_data);
1989 }
1990
1991 static void clear_function_data(void)
1992 {
1993 unsigned long *tmp;
1994
1995 FOR_EACH_PTR(fn_data_list, tmp) {
1996 *tmp = 0;
1997 } END_FOR_EACH_PTR(tmp);
1998 }
1999
2000 static void record_func_time(void)
2001 {
2002 struct timeval stop;
2003 int func_time;
2004 char buf[32];
2005
2006 gettimeofday(&stop, NULL);
2007 func_time = stop.tv_sec - fn_start_time.tv_sec;
2008 snprintf(buf, sizeof(buf), "%d", func_time);
2009 sql_insert_return_implies(FUNC_TIME, 0, "", buf);
2010 if (option_time && func_time > 2) {
2011 final_pass++;
2012 sm_msg("func_time: %d", func_time);
2013 final_pass--;
2014 }
2015 }
2016
2017 static void split_function(struct symbol *sym)
2018 {
2019 struct symbol *base_type = get_base_type(sym);
2020
2021 if (!base_type->stmt && !base_type->inline_stmt)
2022 return;
2023
2024 gettimeofday(&outer_fn_start_time, NULL);
2025 gettimeofday(&fn_start_time, NULL);
2026 cur_func_sym = sym;
2027 if (sym->ident)
2028 cur_func = sym->ident->name;
2029 if (option_process_function && cur_func &&
2030 strcmp(option_process_function, cur_func) != 0)
2031 return;
2032 set_position(sym->pos);
2033 clear_function_data();
2034 loop_count = 0;
2035 last_goto_statement_handled = 0;
2036 sm_debug("new function: %s\n", cur_func);
2037 __stree_id = 0;
2038 if (option_two_passes) {
2039 __unnullify_path();
2040 loop_num = 0;
2041 final_pass = 0;
2042 start_function_definition(sym);
2043 __split_stmt(base_type->stmt);
2044 __split_stmt(base_type->inline_stmt);
2045 nullify_path();
2046 }
2047 __unnullify_path();
2048 loop_num = 0;
2049 final_pass = 1;
2050 start_function_definition(sym);
2051 __split_stmt(base_type->stmt);
2052 __split_stmt(base_type->inline_stmt);
2053 if (!__path_is_null() &&
2054 cur_func_return_type() == &void_ctype &&
2055 !__bail_on_rest_of_function) {
2056 __pass_to_client(NULL, RETURN_HOOK);
2057 nullify_path();
2058 }
2059 __pass_to_client(sym, END_FUNC_HOOK);
2060 if (need_delayed_scope_hooks())
2061 __call_scope_hooks();
2062 __pass_to_client(sym, AFTER_FUNC_HOOK);
2063 sym->parsed = true;
2064
2065 clear_all_states();
2066
2067 record_func_time();
2068
2069 cur_func_sym = NULL;
2070 cur_func = NULL;
2071 free_data_info_allocs();
2072 free_expression_stack(&switch_expr_stack);
2073 __free_ptr_list((struct ptr_list **)&big_statement_stack);
2074 __bail_on_rest_of_function = 0;
2075 }
2076
2077 static void save_flow_state(void)
2078 {
2079 unsigned long *tmp;
2080
2081 __add_ptr_list(&backup, INT_PTR(loop_num << 2));
2082 __add_ptr_list(&backup, INT_PTR(loop_count << 2));
2083 __add_ptr_list(&backup, INT_PTR(final_pass << 2));
2084
2085 __add_ptr_list(&backup, big_statement_stack);
2086 __add_ptr_list(&backup, big_expression_stack);
2087 __add_ptr_list(&backup, big_condition_stack);
2088 __add_ptr_list(&backup, switch_expr_stack);
2089
2090 __add_ptr_list(&backup, cur_func_sym);
2091
2092 __add_ptr_list(&backup, parsed_calls);
2093
2094 __add_ptr_list(&backup, __prev_stmt);
2095 __add_ptr_list(&backup, __cur_stmt);
2096 __add_ptr_list(&backup, __next_stmt);
2097
2098 FOR_EACH_PTR(fn_data_list, tmp) {
2099 __add_ptr_list(&backup, (void *)*tmp);
2100 } END_FOR_EACH_PTR(tmp);
2101 }
2102
2103 static void *pop_backup(void)
2104 {
2105 void *ret;
2106
2107 ret = last_ptr_list(backup);
2108 delete_ptr_list_last(&backup);
2109 return ret;
2110 }
2111
2112 static void restore_flow_state(void)
2113 {
2114 unsigned long *tmp;
2115
2116 FOR_EACH_PTR_REVERSE(fn_data_list, tmp) {
2117 *tmp = (unsigned long)pop_backup();
2118 } END_FOR_EACH_PTR_REVERSE(tmp);
2119
2120 __next_stmt = pop_backup();
2121 __cur_stmt = pop_backup();
2122 __prev_stmt = pop_backup();
2123
2124 parsed_calls = pop_backup();
2125
2126 cur_func_sym = pop_backup();
2127 switch_expr_stack = pop_backup();
2128 big_condition_stack = pop_backup();
2129 big_expression_stack = pop_backup();
2130 big_statement_stack = pop_backup();
2131 final_pass = PTR_INT(pop_backup()) >> 2;
2132 loop_count = PTR_INT(pop_backup()) >> 2;
2133 loop_num = PTR_INT(pop_backup()) >> 2;
2134 }
2135
2136 void parse_inline(struct expression *call)
2137 {
2138 struct symbol *base_type;
2139 char *cur_func_bak = cur_func; /* not aligned correctly for backup */
2140 struct timeval time_backup = fn_start_time;
2141 struct expression *orig_inline = __inline_fn;
2142 int orig_budget;
2143
2144 if (out_of_memory() || taking_too_long())
2145 return;
2146
2147 if (already_parsed_call(call))
2148 return;
2149
2150 save_flow_state();
2151
2152 __pass_to_client(call, INLINE_FN_START);
2153 final_pass = 0; /* don't print anything */
2154 __inline_fn = call;
2155 orig_budget = inline_budget;
2156 inline_budget = inline_budget - 5;
2157
2158 base_type = get_base_type(call->fn->symbol);
2159 cur_func_sym = call->fn->symbol;
2160 if (call->fn->symbol->ident)
2161 cur_func = call->fn->symbol->ident->name;
2162 else
2163 cur_func = NULL;
2164 set_position(call->fn->symbol->pos);
2165
2166 save_all_states();
2167 big_statement_stack = NULL;
2168 big_expression_stack = NULL;
2169 big_condition_stack = NULL;
2170 switch_expr_stack = NULL;
2171 parsed_calls = NULL;
2172
2173 sm_debug("inline function: %s\n", cur_func);
2174 __unnullify_path();
2175 clear_function_data();
2176 loop_num = 0;
2177 loop_count = 0;
2178 start_function_definition(call->fn->symbol);
2179 __split_stmt(base_type->stmt);
2180 __split_stmt(base_type->inline_stmt);
2181 __pass_to_client(call->fn->symbol, END_FUNC_HOOK);
2182 __pass_to_client(call->fn->symbol, AFTER_FUNC_HOOK);
2183 call->fn->symbol->parsed = true;
2184
2185 free_expression_stack(&switch_expr_stack);
2186 __free_ptr_list((struct ptr_list **)&big_statement_stack);
2187 nullify_path();
2188 free_goto_stack();
2189
2190 restore_flow_state();
2191 fn_start_time = time_backup;
2192 cur_func = cur_func_bak;
2193
2194 restore_all_states();
2195 set_position(call->pos);
2196 __inline_fn = orig_inline;
2197 inline_budget = orig_budget;
2198 __pass_to_client(call, INLINE_FN_END);
2199 }
2200
2201 static struct symbol_list *inlines_called;
2202 static void add_inline_function(struct symbol *sym)
2203 {
2204 static struct symbol_list *already_added;
2205 struct symbol *tmp;
2206
2207 FOR_EACH_PTR(already_added, tmp) {
2208 if (tmp == sym)
2209 return;
2210 } END_FOR_EACH_PTR(tmp);
2211
2212 add_ptr_list(&already_added, sym);
2213 add_ptr_list(&inlines_called, sym);
2214 }
2215
2216 static void process_inlines(void)
2217 {
2218 struct symbol *tmp;
2219
2220 FOR_EACH_PTR(inlines_called, tmp) {
2221 split_function(tmp);
2222 } END_FOR_EACH_PTR(tmp);
2223 free_ptr_list(&inlines_called);
2224 }
2225
2226 static struct symbol *get_last_scoped_symbol(struct symbol_list *big_list, int use_static)
2227 {
2228 struct symbol *sym;
2229
2230 FOR_EACH_PTR_REVERSE(big_list, sym) {
2231 if (!sym->scope)
2232 continue;
2233 if (use_static && sym->ctype.modifiers & MOD_STATIC)
2234 return sym;
2235 if (!use_static && !(sym->ctype.modifiers & MOD_STATIC))
2236 return sym;
2237 } END_FOR_EACH_PTR_REVERSE(sym);
2238
2239 return NULL;
2240 }
2241
2242 static bool interesting_function(struct symbol *sym)
2243 {
2244 static int prev_stream = -1;
2245 static bool prev_answer;
2246 const char *filename;
2247 int len;
2248
2249 if (!(sym->ctype.modifiers & MOD_INLINE))
2250 return true;
2251
2252 if (sym->pos.stream == prev_stream)
2253 return prev_answer;
2254
2255 prev_stream = sym->pos.stream;
2256 prev_answer = false;
2257
2258 filename = stream_name(sym->pos.stream);
2259 len = strlen(filename);
2260 if (len > 0 && filename[len - 1] == 'c')
2261 prev_answer = true;
2262 return prev_answer;
2263 }
2264
2265 static void split_inlines_in_scope(struct symbol *sym)
2266 {
2267 struct symbol *base;
2268 struct symbol_list *scope_list;
2269 int stream;
2270
2271 scope_list = sym->scope->symbols;
2272 stream = sym->pos.stream;
2273
2274 /* find the last static symbol in the file */
2275 FOR_EACH_PTR_REVERSE(scope_list, sym) {
2276 if (sym->pos.stream != stream)
2277 continue;
2278 if (sym->type != SYM_NODE)
2279 continue;
2280 base = get_base_type(sym);
2281 if (!base)
2282 continue;
2283 if (base->type != SYM_FN)
2284 continue;
2285 if (!base->inline_stmt)
2286 continue;
2287 if (!interesting_function(sym))
2288 continue;
2289 add_inline_function(sym);
2290 } END_FOR_EACH_PTR_REVERSE(sym);
2291
2292 process_inlines();
2293 }
2294
2295 static void split_inlines(struct symbol_list *sym_list)
2296 {
2297 struct symbol *sym;
2298
2299 sym = get_last_scoped_symbol(sym_list, 0);
2300 if (sym)
2301 split_inlines_in_scope(sym);
2302 sym = get_last_scoped_symbol(sym_list, 1);
2303 if (sym)
2304 split_inlines_in_scope(sym);
2305 }
2306
2307 static struct stree *clone_estates_perm(struct stree *orig)
2308 {
2309 struct stree *ret = NULL;
2310 struct sm_state *tmp;
2311
2312 FOR_EACH_SM(orig, tmp) {
2313 set_state_stree_perm(&ret, tmp->owner, tmp->name, tmp->sym, clone_estate_perm(tmp->state));
2314 } END_FOR_EACH_SM(tmp);
2315
2316 return ret;
2317 }
2318
2319 struct position last_pos;
2320 static void split_c_file_functions(struct symbol_list *sym_list)
2321 {
2322 struct symbol *sym;
2323
2324 __unnullify_path();
2325 FOR_EACH_PTR(sym_list, sym) {
2326 set_position(sym->pos);
2327 if (sym->type != SYM_NODE || get_base_type(sym)->type != SYM_FN) {
2328 __pass_to_client(sym, BASE_HOOK);
2329 fake_global_assign(sym);
2330 __pass_to_client(sym, DECLARATION_HOOK_AFTER);
2331 }
2332 } END_FOR_EACH_PTR(sym);
2333 global_states = clone_estates_perm(get_all_states_stree(SMATCH_EXTRA));
2334 nullify_path();
2335
2336 FOR_EACH_PTR(sym_list, sym) {
2337 set_position(sym->pos);
2338 last_pos = sym->pos;
2339 if (!interesting_function(sym))
2340 continue;
2341 if (sym->type == SYM_NODE && get_base_type(sym)->type == SYM_FN) {
2342 split_function(sym);
2343 process_inlines();
2344 }
2345 last_pos = sym->pos;
2346 } END_FOR_EACH_PTR(sym);
2347 split_inlines(sym_list);
2348 __pass_to_client(sym_list, END_FILE_HOOK);
2349 }
2350
2351 static int final_before_fake;
2352 void init_fake_env(void)
2353 {
2354 if (!in_fake_env)
2355 final_before_fake = final_pass;
2356 in_fake_env++;
2357 __push_fake_cur_stree();
2358 final_pass = 0;
2359 }
2360
2361 void end_fake_env(void)
2362 {
2363 __free_fake_cur_stree();
2364 in_fake_env--;
2365 if (!in_fake_env)
2366 final_pass = final_before_fake;
2367 }
2368
2369 static void open_output_files(char *base_file)
2370 {
2371 char buf[256];
2372
2373 snprintf(buf, sizeof(buf), "%s.smatch", base_file);
2374 sm_outfd = fopen(buf, "w");
2375 if (!sm_outfd)
2376 sm_fatal("Cannot open %s", buf);
2377
2378 if (!option_info)
2379 return;
2380
2381 snprintf(buf, sizeof(buf), "%s.smatch.sql", base_file);
2382 sql_outfd = fopen(buf, "w");
2383 if (!sql_outfd)
2384 sm_fatal("Error: Cannot open %s", buf);
2385
2386 snprintf(buf, sizeof(buf), "%s.smatch.caller_info", base_file);
2387 caller_info_fd = fopen(buf, "w");
2388 if (!caller_info_fd)
2389 sm_fatal("Error: Cannot open %s", buf);
2390 }
2391
2392 void smatch(struct string_list *filelist)
2393 {
2394 struct symbol_list *sym_list;
2395 struct timeval stop, start;
2396 char *path;
2397 int len;
2398
2399 gettimeofday(&start, NULL);
2400
2401 FOR_EACH_PTR_NOTAG(filelist, base_file) {
2402 path = getcwd(NULL, 0);
2403 free(full_base_file);
2404 if (path) {
2405 len = strlen(path) + 1 + strlen(base_file) + 1;
2406 full_base_file = malloc(len);
2407 snprintf(full_base_file, len, "%s/%s", path, base_file);
2408 } else {
2409 full_base_file = alloc_string(base_file);
2410 }
2411 if (option_file_output)
2412 open_output_files(base_file);
2413 base_file_stream = input_stream_nr;
2414 sym_list = sparse_keep_tokens(base_file);
2415 split_c_file_functions(sym_list);
2416 } END_FOR_EACH_PTR_NOTAG(base_file);
2417
2418 gettimeofday(&stop, NULL);
2419
2420 set_position(last_pos);
2421 final_pass = 1;
2422 if (option_time)
2423 sm_msg("time: %lu", stop.tv_sec - start.tv_sec);
2424 if (option_mem)
2425 sm_msg("mem: %luKb", get_max_memory());
2426 }
Static analysis for C