4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 #include "smatch_slist.h"
12 #include "smatch_extra.h"
14 static sval_t
_get_value(struct expression
*expr
, int *undefined
, int implied
);
15 static sval_t
_get_implied_value(struct expression
*expr
, int *undefined
, int implied
);
19 static sval_t zero
= {.type
= &int_ctype
, .value
= 0};
20 static sval_t one
= {.type
= &int_ctype
, .value
= 1};
21 static sval_t bogus
= {.type
= &int_ctype
, .value
= BOGUS
};
29 #define ABSOLUTE_MIN 6
30 #define ABSOLUTE_MAX 7
33 static int opposite_implied(int implied
)
35 if (implied
== IMPLIED_MIN
)
37 if (implied
== IMPLIED_MAX
)
39 if (implied
== ABSOLUTE_MIN
)
41 if (implied
== ABSOLUTE_MAX
)
46 static int last_stmt_sval(struct statement
*stmt
, sval_t
*sval
)
48 struct expression
*expr
;
53 stmt
= last_ptr_list((struct ptr_list
*)stmt
->stmts
);
54 if (stmt
->type
!= STMT_EXPRESSION
)
56 expr
= stmt
->expression
;
57 if (!get_value(expr
, sval
))
62 static sval_t
handle_expression_statement(struct expression
*expr
, int *undefined
, int implied
)
64 struct statement
*stmt
;
67 stmt
= get_expression_statement(expr
);
68 if (!last_stmt_sval(stmt
, &ret
)) {
76 static sval_t
handle_ampersand(int *undefined
, int implied
)
80 ret
.type
= &ptr_ctype
;
83 if (implied
== IMPLIED_MIN
|| implied
== FUZZYMIN
|| implied
== ABSOLUTE_MIN
)
84 return valid_ptr_min_sval
;
85 if (implied
== IMPLIED_MAX
|| implied
== FUZZYMAX
|| implied
== ABSOLUTE_MAX
)
86 return valid_ptr_max_sval
;
92 static sval_t
handle_preop(struct expression
*expr
, int *undefined
, int implied
)
98 ret
= handle_ampersand(undefined
, implied
);
101 ret
= _get_value(expr
->unop
, undefined
, implied
);
102 ret
= sval_preop(ret
, '!');
105 ret
= _get_value(expr
->unop
, undefined
, implied
);
106 ret
= sval_preop(ret
, '~');
107 ret
= sval_cast(get_type(expr
->unop
), ret
);
110 ret
= _get_value(expr
->unop
, undefined
, implied
);
111 ret
= sval_preop(ret
, '-');
114 ret
= _get_implied_value(expr
, undefined
, implied
);
117 ret
= handle_expression_statement(expr
, undefined
, implied
);
121 ret
= sval_blank(expr
);
123 ret
= sval_cast(get_type(expr
), ret
);
127 static sval_t
handle_divide(struct expression
*expr
, int *undefined
, int implied
)
131 left
= _get_value(expr
->left
, undefined
, implied
);
132 right
= _get_value(expr
->right
, undefined
, opposite_implied(implied
));
134 if (right
.value
== 0) {
139 return sval_binop(left
, '/', right
);
142 static sval_t
handle_subtract(struct expression
*expr
, int *undefined
, int implied
)
146 left
= _get_value(expr
->left
, undefined
, implied
);
147 right
= _get_value(expr
->right
, undefined
, opposite_implied(implied
));
149 return sval_binop(left
, '-', right
);
152 static sval_t
handle_binop(struct expression
*expr
, int *undefined
, int implied
)
155 sval_t ret
= {.type
= &int_ctype
, .value
= 123456};
160 left
= _get_value(expr
->left
, &local_undef
, implied
);
162 if (implied
== ABSOLUTE_MIN
) {
163 ret
= sval_blank(expr
->left
);
167 if (implied
!= ABSOLUTE_MAX
)
169 if (!get_absolute_max(expr
->left
, &left
))
172 right
= _get_value(expr
->right
, undefined
, implied
);
173 if (right
.value
== 0)
177 return sval_binop(left
, '%', right
);
180 left
= _get_value(expr
->left
, &local_undef
, implied
);
182 if (implied
== ABSOLUTE_MIN
) {
183 ret
= sval_blank(expr
->left
);
187 if (implied
!= ABSOLUTE_MAX
)
189 if (!get_absolute_max(expr
->left
, &left
))
192 right
= _get_value(expr
->right
, undefined
, implied
);
195 return sval_binop(left
, '&', right
);
197 case SPECIAL_RIGHTSHIFT
:
198 left
= _get_value(expr
->left
, &local_undef
, implied
);
200 if (implied
== ABSOLUTE_MIN
) {
201 ret
= sval_blank(expr
->left
);
205 if (implied
!= ABSOLUTE_MAX
)
207 if (!get_absolute_max(expr
->left
, &left
))
210 right
= _get_value(expr
->right
, undefined
, implied
);
213 return sval_binop(left
, SPECIAL_RIGHTSHIFT
, right
);
216 left
= _get_value(expr
->left
, undefined
, implied
);
217 right
= _get_value(expr
->right
, undefined
, implied
);
224 return handle_divide(expr
, undefined
, implied
);
226 if (right
.value
== 0) {
230 return sval_binop(left
, '%', right
);
233 ret
= handle_subtract(expr
, undefined
, implied
);
236 ret
= sval_binop(left
, expr
->op
, right
);
241 static int do_comparison(struct expression
*expr
)
243 struct range_list
*left_ranges
= NULL
;
244 struct range_list
*right_ranges
= NULL
;
245 int poss_true
, poss_false
;
247 get_implied_range_list(expr
->left
, &left_ranges
);
248 get_implied_range_list(expr
->right
, &right_ranges
);
250 poss_true
= possibly_true_range_lists(left_ranges
, expr
->op
, right_ranges
);
251 poss_false
= possibly_false_range_lists(left_ranges
, expr
->op
, right_ranges
);
253 free_range_list(&left_ranges
);
254 free_range_list(&right_ranges
);
256 if (!poss_true
&& !poss_false
)
258 if (poss_true
&& !poss_false
)
260 if (!poss_true
&& poss_false
)
265 static sval_t
handle_comparison(struct expression
*expr
, int *undefined
, int implied
)
270 if (get_value(expr
->left
, &left
) && get_value(expr
->right
, &right
)) {
271 struct data_range tmp_left
, tmp_right
;
275 tmp_right
.min
= right
;
276 tmp_right
.max
= right
;
277 if (true_comparison_range(&tmp_left
, expr
->op
, &tmp_right
))
282 if (implied
== NOTIMPLIED
) {
287 res
= do_comparison(expr
);
293 if (implied
== IMPLIED_MIN
|| implied
== FUZZYMIN
|| implied
== ABSOLUTE_MIN
)
295 if (implied
== IMPLIED_MAX
|| implied
== FUZZYMAX
|| implied
== ABSOLUTE_MAX
)
302 static sval_t
handle_logical(struct expression
*expr
, int *undefined
, int implied
)
306 if ((implied
== NOTIMPLIED
&& get_value(expr
->left
, &left
) &&
307 get_value(expr
->right
, &right
)) ||
308 (implied
!= NOTIMPLIED
&& get_implied_value(expr
->left
, &left
) &&
309 get_implied_value(expr
->right
, &right
))) {
311 case SPECIAL_LOGICAL_OR
:
312 if (left
.value
|| right
.value
)
315 case SPECIAL_LOGICAL_AND
:
316 if (left
.value
&& right
.value
)
325 if (implied
== IMPLIED_MIN
|| implied
== FUZZYMIN
|| implied
== ABSOLUTE_MIN
)
327 if (implied
== IMPLIED_MAX
|| implied
== FUZZYMAX
|| implied
== ABSOLUTE_MAX
)
334 static sval_t
handle_conditional(struct expression
*expr
, int *undefined
, int implied
)
336 if (known_condition_true(expr
->conditional
))
337 return _get_value(expr
->cond_true
, undefined
, implied
);
338 if (known_condition_false(expr
->conditional
))
339 return _get_value(expr
->cond_false
, undefined
, implied
);
341 if (implied
== NOTIMPLIED
) {
346 if (implied_condition_true(expr
->conditional
))
347 return _get_value(expr
->cond_true
, undefined
, implied
);
348 if (implied_condition_false(expr
->conditional
))
349 return _get_value(expr
->cond_false
, undefined
, implied
);
355 static int get_implied_value_helper(struct expression
*expr
, sval_t
*sval
, int implied
)
357 struct smatch_state
*state
;
361 /* fixme: this should return the casted value */
363 expr
= strip_expr(expr
);
365 if (get_value(expr
, sval
))
368 name
= get_variable_from_expr(expr
, &sym
);
371 *sval
= sval_blank(expr
);
372 state
= get_state(SMATCH_EXTRA
, name
, sym
);
374 if (!state
|| !state
->data
)
376 if (implied
== IMPLIED
) {
377 if (estate_get_single_value(state
, sval
))
381 if (implied
== HARD_MAX
) {
382 if (estate_get_hard_max(state
, sval
))
386 if (implied
== IMPLIED_MAX
) {
387 *sval
= estate_max(state
);
388 if (sval_is_max(*sval
)) /* this means just guessing. fixme. not really */
392 *sval
= estate_min(state
);
393 if (sval_is_min(*sval
)) /* fixme */
398 static int get_fuzzy_max_helper(struct expression
*expr
, sval_t
*max
)
401 struct sm_state
*tmp
;
404 if (get_hard_max(expr
, &sval
)) {
409 sm
= get_sm_state_expr(SMATCH_EXTRA
, expr
);
413 sval
= sval_type_min(estate_type(sm
->state
));
414 FOR_EACH_PTR(sm
->possible
, tmp
) {
417 new_min
= estate_min(tmp
->state
);
418 if (sval_cmp(new_min
, sval
) > 0)
420 } END_FOR_EACH_PTR(tmp
);
422 if (sval_is_min(sval
))
425 *max
= sval_cast(get_type(expr
), sval
);
429 static int get_fuzzy_min_helper(struct expression
*expr
, sval_t
*min
)
432 struct sm_state
*tmp
;
435 if (get_implied_min(expr
, min
))
438 sm
= get_sm_state_expr(SMATCH_EXTRA
, expr
);
442 sval
= sval_type_max(estate_type(sm
->state
));
443 FOR_EACH_PTR(sm
->possible
, tmp
) {
446 new_max
= estate_max(tmp
->state
);
447 if (sval_cmp(new_max
, sval
) < 0)
449 } END_FOR_EACH_PTR(tmp
);
451 if (sval_is_max(sval
))
453 *min
= sval_cast(get_type(expr
), sval
);
457 static sval_t
_get_implied_value(struct expression
*expr
, int *undefined
, int implied
)
461 ret
= sval_blank(expr
);
468 if (!get_implied_value_helper(expr
, &ret
, implied
))
472 if (!get_absolute_min_helper(expr
, &ret
))
476 if (!get_absolute_max_helper(expr
, &ret
))
480 if (!get_fuzzy_max_helper(expr
, &ret
))
484 if (!get_fuzzy_min_helper(expr
, &ret
))
493 static int get_const_value(struct expression
*expr
, sval_t
*sval
)
498 if (expr
->type
!= EXPR_SYMBOL
|| !expr
->symbol
)
501 if (!(sym
->ctype
.modifiers
& MOD_CONST
))
503 if (get_value(sym
->initializer
, &right
)) {
504 *sval
= sval_cast(get_type(expr
), right
);
510 static sval_t
_get_value(struct expression
*expr
, int *undefined
, int implied
)
521 expr
= strip_parens(expr
);
523 switch (expr
->type
) {
525 ret
= sval_from_val(expr
, expr
->value
);
528 ret
= handle_preop(expr
, undefined
, implied
);
531 ret
= _get_value(expr
->unop
, undefined
, implied
);
534 case EXPR_FORCE_CAST
:
535 case EXPR_IMPLIED_CAST
:
536 ret
= _get_value(expr
->cast_expression
, undefined
, implied
);
537 ret
= sval_cast(get_type(expr
), ret
);
540 ret
= handle_binop(expr
, undefined
, implied
);
543 ret
= handle_comparison(expr
, undefined
, implied
);
546 ret
= handle_logical(expr
, undefined
, implied
);
550 ret
= sval_blank(expr
);
551 ret
.value
= get_expression_value_nomod(expr
);
554 if (get_const_value(expr
, &ret
)) {
557 ret
= _get_implied_value(expr
, undefined
, implied
);
560 case EXPR_CONDITIONAL
:
561 ret
= handle_conditional(expr
, undefined
, implied
);
564 ret
= _get_implied_value(expr
, undefined
, implied
);
571 /* returns 1 if it can get a value literal or else returns 0 */
572 int get_value(struct expression
*expr
, sval_t
*sval
)
577 ret
= _get_value(expr
, &undefined
, NOTIMPLIED
);
584 int get_implied_value(struct expression
*expr
, sval_t
*sval
)
589 ret
= _get_value(expr
, &undefined
, IMPLIED
);
596 int get_implied_min(struct expression
*expr
, sval_t
*sval
)
601 ret
= _get_value(expr
, &undefined
, IMPLIED_MIN
);
608 int get_implied_max(struct expression
*expr
, sval_t
*sval
)
613 ret
= _get_value(expr
, &undefined
, IMPLIED_MAX
);
620 int get_hard_max(struct expression
*expr
, sval_t
*sval
)
625 ret
= _get_value(expr
, &undefined
, HARD_MAX
);
632 int get_fuzzy_min(struct expression
*expr
, sval_t
*sval
)
637 ret
= _get_value(expr
, &undefined
, FUZZYMIN
);
644 int get_fuzzy_max(struct expression
*expr
, sval_t
*sval
)
649 ret
= _get_value(expr
, &undefined
, FUZZYMAX
);
656 int get_absolute_min(struct expression
*expr
, sval_t
*sval
)
661 type
= get_type(expr
);
663 type
= &llong_ctype
; // FIXME: this is wrong but places assume get type can't fail.
664 *sval
= _get_value(expr
, &undefined
, ABSOLUTE_MIN
);
666 *sval
= sval_type_min(type
);
670 if (sval_cmp(*sval
, sval_type_min(type
)) < 0)
671 *sval
= sval_type_min(type
);
675 int get_absolute_max(struct expression
*expr
, sval_t
*sval
)
680 type
= get_type(expr
);
683 *sval
= _get_value(expr
, &undefined
, ABSOLUTE_MAX
);
685 *sval
= sval_type_max(type
);
689 if (sval_cmp(sval_type_max(type
), *sval
) < 0)
690 *sval
= sval_type_max(type
);
694 int known_condition_true(struct expression
*expr
)
701 if (get_value(expr
, &tmp
) && tmp
.value
)
707 int known_condition_false(struct expression
*expr
)
715 if (expr
->type
== EXPR_CALL
) {
716 if (sym_name_is("__builtin_constant_p", expr
->fn
))
722 int implied_condition_true(struct expression
*expr
)
729 if (known_condition_true(expr
))
731 if (get_implied_value(expr
, &tmp
) && tmp
.value
)
734 if (expr
->type
== EXPR_POSTOP
)
735 return implied_condition_true(expr
->unop
);
737 if (expr
->type
== EXPR_PREOP
&& expr
->op
== SPECIAL_DECREMENT
)
738 return implied_not_equal(expr
->unop
, 1);
739 if (expr
->type
== EXPR_PREOP
&& expr
->op
== SPECIAL_INCREMENT
)
740 return implied_not_equal(expr
->unop
, -1);
742 expr
= strip_expr(expr
);
743 switch (expr
->type
) {
745 if (do_comparison(expr
) == 1)
749 if (expr
->op
== '!') {
750 if (implied_condition_false(expr
->unop
))
756 if (implied_not_equal(expr
, 0) == 1)
763 int implied_condition_false(struct expression
*expr
)
765 struct expression
*tmp
;
771 if (known_condition_false(expr
))
774 switch (expr
->type
) {
776 if (do_comparison(expr
) == 2)
779 if (expr
->op
== '!') {
780 if (implied_condition_true(expr
->unop
))
784 tmp
= strip_expr(expr
);
786 return implied_condition_false(tmp
);
789 if (get_implied_value(expr
, &sval
) && sval
.value
== 0)