debug: add __smatch_type() which prints the type of the argument
[smatch.git] / smatch_flow.c
blob38c22b42a0b8b573ef707570a9d71b71e148a3c4
1 /*
2 * Copyright (C) 2006,2008 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
18 #define _GNU_SOURCE 1
19 #include <unistd.h>
20 #include <stdio.h>
21 #include "token.h"
22 #include "scope.h"
23 #include "smatch.h"
24 #include "smatch_expression_stacks.h"
25 #include "smatch_extra.h"
26 #include "smatch_slist.h"
28 int __in_fake_assign;
29 int final_pass;
30 int __inline_call;
31 struct expression *__inline_fn;
33 static int __smatch_lineno = 0;
35 static char *base_file;
36 static const char *filename;
37 static char *pathname;
38 static char *full_filename;
39 static char *cur_func;
40 static unsigned int loop_count;
41 static int last_goto_statement_handled;
42 int __expr_stmt_count;
43 int __in_function_def;
44 static struct expression_list *switch_expr_stack = NULL;
45 static struct expression_list *post_op_stack = NULL;
47 struct expression_list *big_expression_stack;
48 struct statement_list *big_statement_stack;
49 int __in_pre_condition = 0;
50 int __bail_on_rest_of_function = 0;
51 static struct timeval fn_start_time;
52 char *get_function(void) { return cur_func; }
53 int get_lineno(void) { return __smatch_lineno; }
54 int inside_loop(void) { return !!loop_count; }
55 int definitely_inside_loop(void) { return !!(loop_count & ~0x80000000); }
56 struct expression *get_switch_expr(void) { return top_expression(switch_expr_stack); }
57 int in_expression_statement(void) { return !!__expr_stmt_count; }
59 static void split_symlist(struct symbol_list *sym_list);
60 static void split_declaration(struct symbol_list *sym_list);
61 static void split_expr_list(struct expression_list *expr_list);
62 static void add_inline_function(struct symbol *sym);
63 static void parse_inline(struct expression *expr);
65 int option_assume_loops = 0;
66 int option_known_conditions = 0;
67 int option_two_passes = 0;
68 struct symbol *cur_func_sym = NULL;
69 struct stree *global_states;
71 int outside_of_function(void)
73 return cur_func_sym == NULL;
76 const char *get_filename(void)
78 if (option_info)
79 return base_file;
80 if (option_full_path)
81 return full_filename;
82 return filename;
85 const char *get_base_file(void)
87 return base_file;
90 static void set_position(struct position pos)
92 int len;
93 static int prev_stream = -1;
95 if (pos.stream == 0 && pos.line == 0)
96 return;
98 __smatch_lineno = pos.line;
100 if (pos.stream == prev_stream)
101 return;
103 filename = stream_name(pos.stream);
105 free(full_filename);
106 pathname = getcwd(NULL, 0);
107 if (pathname) {
108 len = strlen(pathname) + 1 + strlen(filename) + 1;
109 full_filename = malloc(len);
110 snprintf(full_filename, len, "%s/%s", pathname, filename);
111 } else {
112 full_filename = alloc_string(filename);
114 free(pathname);
117 static int is_inline_func(struct expression *expr)
119 if (expr->type != EXPR_SYMBOL || !expr->symbol)
120 return 0;
121 if (expr->symbol->ctype.modifiers & MOD_INLINE)
122 return 1;
123 return 0;
126 static int is_noreturn_func(struct expression *expr)
128 if (expr->type != EXPR_SYMBOL || !expr->symbol)
129 return 0;
130 if (expr->symbol->ctype.modifiers & MOD_NORETURN)
131 return 1;
132 return 0;
135 int inlinable(struct expression *expr)
137 struct symbol *sym;
139 if (__inline_fn) /* don't nest */
140 return 0;
142 if (expr->type != EXPR_SYMBOL || !expr->symbol)
143 return 0;
144 if (is_no_inline_function(expr->symbol->ident->name))
145 return 0;
146 sym = get_base_type(expr->symbol);
147 if (sym->stmt && sym->stmt->type == STMT_COMPOUND) {
148 if (ptr_list_size((struct ptr_list *)sym->stmt->stmts) <= 10)
149 return 1;
150 return 0;
152 if (sym->inline_stmt && sym->inline_stmt->type == STMT_COMPOUND) {
153 if (ptr_list_size((struct ptr_list *)sym->inline_stmt->stmts) <= 10)
154 return 1;
155 return 0;
157 return 0;
160 void __process_post_op_stack(void)
162 struct expression *expr;
164 FOR_EACH_PTR(post_op_stack, expr) {
165 __pass_to_client(expr, OP_HOOK);
166 } END_FOR_EACH_PTR(expr);
168 __free_ptr_list((struct ptr_list **)&post_op_stack);
171 void __split_expr(struct expression *expr)
173 if (!expr)
174 return;
176 // sm_msg(" Debug expr_type %d %s", expr->type, show_special(expr->op));
178 if (__in_fake_assign && expr->type != EXPR_ASSIGNMENT)
179 return;
180 if (__in_fake_assign >= 4) /* don't allow too much nesting */
181 return;
183 push_expression(&big_expression_stack, expr);
184 set_position(expr->pos);
185 __pass_to_client(expr, EXPR_HOOK);
187 switch (expr->type) {
188 case EXPR_PREOP:
189 if (expr->op == '*')
190 __pass_to_client(expr, DEREF_HOOK);
191 __split_expr(expr->unop);
192 __pass_to_client(expr, OP_HOOK);
193 break;
194 case EXPR_POSTOP:
195 __split_expr(expr->unop);
196 push_expression(&post_op_stack, expr);
197 break;
198 case EXPR_STATEMENT:
199 __expr_stmt_count++;
200 __split_stmt(expr->statement);
201 __expr_stmt_count--;
202 break;
203 case EXPR_LOGICAL:
204 case EXPR_COMPARE:
205 __pass_to_client(expr, LOGIC_HOOK);
206 __handle_logic(expr);
207 break;
208 case EXPR_BINOP:
209 __pass_to_client(expr, BINOP_HOOK);
210 case EXPR_COMMA:
211 __split_expr(expr->left);
212 __process_post_op_stack();
213 __split_expr(expr->right);
214 break;
215 case EXPR_ASSIGNMENT: {
216 struct expression *tmp;
218 if (!expr->right)
219 break;
221 __pass_to_client(expr, RAW_ASSIGNMENT_HOOK);
223 /* foo = !bar() */
224 if (__handle_condition_assigns(expr))
225 break;
226 /* foo = (x < 5 ? foo : 5); */
227 if (__handle_select_assigns(expr))
228 break;
229 /* foo = ({frob(); frob(); frob(); 1;}) */
230 if (__handle_expr_statement_assigns(expr))
231 break;
233 __split_expr(expr->right);
234 if (outside_of_function())
235 __pass_to_client(expr, GLOBAL_ASSIGNMENT_HOOK);
236 else
237 __pass_to_client(expr, ASSIGNMENT_HOOK);
239 __fake_struct_member_assignments(expr);
241 tmp = strip_expr(expr->right);
242 if (tmp->type == EXPR_CALL)
243 __pass_to_client(expr, CALL_ASSIGNMENT_HOOK);
244 if (get_macro_name(tmp->pos) &&
245 get_macro_name(expr->pos) != get_macro_name(tmp->pos))
246 __pass_to_client(expr, MACRO_ASSIGNMENT_HOOK);
247 __split_expr(expr->left);
248 break;
250 case EXPR_DEREF:
251 __pass_to_client(expr, DEREF_HOOK);
252 __split_expr(expr->deref);
253 break;
254 case EXPR_SLICE:
255 __split_expr(expr->base);
256 break;
257 case EXPR_CAST:
258 case EXPR_FORCE_CAST:
259 __pass_to_client(expr, CAST_HOOK);
260 __split_expr(expr->cast_expression);
261 break;
262 case EXPR_SIZEOF:
263 if (expr->cast_expression)
264 __pass_to_client(strip_parens(expr->cast_expression),
265 SIZEOF_HOOK);
266 break;
267 case EXPR_OFFSETOF:
268 case EXPR_ALIGNOF:
269 evaluate_expression(expr);
270 break;
271 case EXPR_CONDITIONAL:
272 case EXPR_SELECT:
273 if (known_condition_true(expr->conditional)) {
274 __split_expr(expr->cond_true);
275 break;
277 if (known_condition_false(expr->conditional)) {
278 __split_expr(expr->cond_false);
279 break;
281 __pass_to_client(expr, SELECT_HOOK);
282 __split_whole_condition(expr->conditional);
283 __split_expr(expr->cond_true);
284 __push_true_states();
285 __use_false_states();
286 __split_expr(expr->cond_false);
287 __merge_true_states();
288 break;
289 case EXPR_CALL:
290 if (sym_name_is("__builtin_constant_p", expr->fn))
291 break;
292 split_expr_list(expr->args);
293 __split_expr(expr->fn);
294 if (is_inline_func(expr->fn))
295 add_inline_function(expr->fn->symbol);
296 if (inlinable(expr->fn))
297 __inline_call = 1;
298 __process_post_op_stack();
299 __pass_to_client(expr, FUNCTION_CALL_HOOK);
300 __inline_call = 0;
301 if (inlinable(expr->fn)) {
302 parse_inline(expr);
304 __pass_to_client(expr, CALL_HOOK_AFTER_INLINE);
305 if (is_noreturn_func(expr->fn))
306 nullify_path();
307 break;
308 case EXPR_INITIALIZER:
309 split_expr_list(expr->expr_list);
310 break;
311 case EXPR_IDENTIFIER:
312 __split_expr(expr->ident_expression);
313 break;
314 case EXPR_INDEX:
315 __split_expr(expr->idx_expression);
316 break;
317 case EXPR_POS:
318 __split_expr(expr->init_expr);
319 break;
320 case EXPR_SYMBOL:
321 __pass_to_client(expr, SYM_HOOK);
322 break;
323 case EXPR_STRING:
324 __pass_to_client(expr, STRING_HOOK);
325 break;
326 default:
327 break;
329 pop_expression(&big_expression_stack);
332 static int is_forever_loop(struct statement *stmt)
334 struct expression *expr;
336 expr = strip_expr(stmt->iterator_pre_condition);
337 if (!expr)
338 expr = stmt->iterator_post_condition;
339 if (!expr) {
340 /* this is a for(;;) loop... */
341 return 1;
344 if (expr->type == EXPR_VALUE && expr->value == 1)
345 return 1;
347 return 0;
350 static int loop_num;
351 static char *get_loop_name(int num)
353 char buf[256];
355 snprintf(buf, 255, "-loop%d", num);
356 buf[255] = '\0';
357 return alloc_sname(buf);
361 * Pre Loops are while and for loops.
363 static void handle_pre_loop(struct statement *stmt)
365 int once_through; /* we go through the loop at least once */
366 struct sm_state *extra_sm = NULL;
367 int unchanged = 0;
368 char *loop_name;
369 struct stree *stree = NULL;
370 struct sm_state *sm = NULL;
372 loop_name = get_loop_name(loop_num);
373 loop_num++;
375 __split_stmt(stmt->iterator_pre_statement);
377 once_through = implied_condition_true(stmt->iterator_pre_condition);
379 loop_count++;
380 __push_continues();
381 __push_breaks();
383 __merge_gotos(loop_name);
385 extra_sm = __extra_handle_canonical_loops(stmt, &stree);
386 __in_pre_condition++;
387 __pass_to_client(stmt, PRELOOP_HOOK);
388 __split_whole_condition(stmt->iterator_pre_condition);
389 __in_pre_condition--;
390 FOR_EACH_SM(stree, sm) {
391 set_state(sm->owner, sm->name, sm->sym, sm->state);
392 } END_FOR_EACH_SM(sm);
393 free_stree(&stree);
394 if (extra_sm)
395 extra_sm = get_sm_state(extra_sm->owner, extra_sm->name, extra_sm->sym);
397 if (option_assume_loops)
398 once_through = 1;
400 __split_stmt(stmt->iterator_statement);
401 __warn_on_silly_pre_loops();
402 if (is_forever_loop(stmt)) {
403 __merge_continues();
404 __save_gotos(loop_name);
406 __push_fake_cur_stree();
407 __split_stmt(stmt->iterator_post_statement);
408 stree = __pop_fake_cur_stree();
410 __discard_false_states();
411 __use_breaks();
413 if (!__path_is_null())
414 __merge_stree_into_cur(stree);
415 free_stree(&stree);
416 } else {
417 __merge_continues();
418 unchanged = __iterator_unchanged(extra_sm);
419 __split_stmt(stmt->iterator_post_statement);
420 __save_gotos(loop_name);
421 __in_pre_condition++;
422 __split_whole_condition(stmt->iterator_pre_condition);
423 __in_pre_condition--;
424 nullify_path();
425 __merge_false_states();
426 if (once_through)
427 __discard_false_states();
428 else
429 __merge_false_states();
431 if (extra_sm && unchanged)
432 __extra_pre_loop_hook_after(extra_sm,
433 stmt->iterator_post_statement,
434 stmt->iterator_pre_condition);
435 __merge_breaks();
437 loop_count--;
441 * Post loops are do {} while();
443 static void handle_post_loop(struct statement *stmt)
445 char *loop_name;
447 loop_name = get_loop_name(loop_num);
448 loop_num++;
449 loop_count++;
451 __push_continues();
452 __push_breaks();
453 __merge_gotos(loop_name);
454 __split_stmt(stmt->iterator_statement);
455 __merge_continues();
456 if (!is_zero(stmt->iterator_post_condition))
457 __save_gotos(loop_name);
459 if (is_forever_loop(stmt)) {
460 __use_breaks();
461 } else {
462 __split_whole_condition(stmt->iterator_post_condition);
463 __use_false_states();
464 __merge_breaks();
466 loop_count--;
469 static int empty_statement(struct statement *stmt)
471 if (!stmt)
472 return 0;
473 if (stmt->type == STMT_EXPRESSION && !stmt->expression)
474 return 1;
475 return 0;
478 static int last_stmt_on_same_line(void)
480 struct statement *stmt;
481 int i = 0;
483 FOR_EACH_PTR_REVERSE(big_statement_stack, stmt) {
484 if (!i++)
485 continue;
486 if (stmt->pos.line == get_lineno())
487 return 1;
488 return 0;
489 } END_FOR_EACH_PTR_REVERSE(stmt);
490 return 0;
493 static void split_asm_constraints(struct expression_list *expr_list)
495 struct expression *expr;
496 int state = 0;
498 FOR_EACH_PTR(expr_list, expr) {
499 switch (state) {
500 case 0: /* identifier */
501 case 1: /* constraint */
502 state++;
503 continue;
504 case 2: /* expression */
505 state = 0;
506 __split_expr(expr);
507 continue;
509 } END_FOR_EACH_PTR(expr);
512 static int is_case_val(struct statement *stmt, sval_t sval)
514 sval_t case_sval;
516 if (stmt->type != STMT_CASE)
517 return 0;
518 if (!stmt->case_expression) {
519 __set_default();
520 return 1;
522 if (!get_value(stmt->case_expression, &case_sval))
523 return 0;
524 if (case_sval.value == sval.value)
525 return 1;
526 return 0;
529 static void split_known_switch(struct statement *stmt, sval_t sval)
531 struct statement *tmp;
533 __split_expr(stmt->switch_expression);
535 push_expression(&switch_expr_stack, stmt->switch_expression);
536 __save_switch_states(top_expression(switch_expr_stack));
537 nullify_path();
538 __push_default();
539 __push_breaks();
541 stmt = stmt->switch_statement;
543 __push_scope_hooks();
544 FOR_EACH_PTR(stmt->stmts, tmp) {
545 __smatch_lineno = tmp->pos.line;
546 if (is_case_val(tmp, sval)) {
547 __merge_switches(top_expression(switch_expr_stack),
548 stmt->case_expression);
549 __pass_case_to_client(top_expression(switch_expr_stack),
550 stmt->case_expression);
552 if (__path_is_null())
553 continue;
554 __split_stmt(tmp);
555 if (__path_is_null()) {
556 __set_default();
557 goto out;
559 } END_FOR_EACH_PTR(tmp);
560 out:
561 __call_scope_hooks();
562 if (!__pop_default())
563 __merge_switches(top_expression(switch_expr_stack),
564 NULL);
565 __discard_switches();
566 __merge_breaks();
567 pop_expression(&switch_expr_stack);
570 static int taking_too_long(void)
572 int ms;
574 ms = ms_since(&fn_start_time);
575 if (ms > 1000 * 60 * 5) /* five minutes */
576 return 1;
577 return 0;
580 static int is_last_stmt(struct statement *cur_stmt)
582 struct symbol *fn = get_base_type(cur_func_sym);
583 struct statement *stmt;
585 if (!fn)
586 return 0;
587 stmt = fn->stmt;
588 if (!stmt)
589 stmt = fn->inline_stmt;
590 if (!stmt || stmt->type != STMT_COMPOUND)
591 return 0;
592 stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
593 if (stmt && stmt->type == STMT_LABEL)
594 stmt = stmt->label_statement;
595 if (stmt == cur_stmt)
596 return 1;
597 return 0;
600 static void handle_backward_goto(struct statement *goto_stmt)
602 const char *goto_name, *label_name;
603 struct statement *func_stmt;
604 struct symbol *base_type = get_base_type(cur_func_sym);
605 struct statement *tmp;
606 int found = 0;
608 if (!option_info)
609 return;
610 if (last_goto_statement_handled)
611 return;
612 last_goto_statement_handled = 1;
614 if (!goto_stmt->goto_label ||
615 goto_stmt->goto_label->type != SYM_LABEL ||
616 !goto_stmt->goto_label->ident)
617 return;
618 goto_name = goto_stmt->goto_label->ident->name;
620 func_stmt = base_type->stmt;
621 if (!func_stmt)
622 func_stmt = base_type->inline_stmt;
623 if (!func_stmt)
624 return;
625 if (func_stmt->type != STMT_COMPOUND)
626 return;
628 FOR_EACH_PTR(func_stmt->stmts, tmp) {
629 if (!found) {
630 if (tmp->type != STMT_LABEL)
631 continue;
632 if (!tmp->label_identifier ||
633 tmp->label_identifier->type != SYM_LABEL ||
634 !tmp->label_identifier->ident)
635 continue;
636 label_name = tmp->label_identifier->ident->name;
637 if (strcmp(goto_name, label_name) != 0)
638 continue;
639 found = 1;
641 __split_stmt(tmp);
642 } END_FOR_EACH_PTR(tmp);
645 static void fake_a_return(void)
647 struct symbol *return_type;
649 nullify_path();
650 __unnullify_path();
652 return_type = get_real_base_type(cur_func_sym);
653 return_type = get_real_base_type(return_type);
654 if (return_type != &void_ctype) {
655 __pass_to_client(unknown_value_expression(NULL), RETURN_HOOK);
656 nullify_path();
659 __pass_to_client(cur_func_sym, END_FUNC_HOOK);
660 __pass_to_client(cur_func_sym, AFTER_FUNC_HOOK);
663 void __split_stmt(struct statement *stmt)
665 sval_t sval;
667 if (!stmt)
668 goto out;
670 if (__bail_on_rest_of_function || out_of_memory() || taking_too_long()) {
671 static char *printed = NULL;
673 __bail_on_rest_of_function = 1;
674 if (printed != cur_func)
675 sm_msg("Function too hairy. Giving up.");
676 fake_a_return();
677 final_pass = 0; /* turn off sm_msg() from here */
678 printed = cur_func;
679 return;
682 add_ptr_list(&big_statement_stack, stmt);
683 free_expression_stack(&big_expression_stack);
684 set_position(stmt->pos);
685 __pass_to_client(stmt, STMT_HOOK);
687 switch (stmt->type) {
688 case STMT_DECLARATION:
689 split_declaration(stmt->declaration);
690 break;
691 case STMT_RETURN:
692 __split_expr(stmt->ret_value);
693 __pass_to_client(stmt->ret_value, RETURN_HOOK);
694 __process_post_op_stack();
695 nullify_path();
696 break;
697 case STMT_EXPRESSION:
698 __split_expr(stmt->expression);
699 break;
700 case STMT_COMPOUND: {
701 struct statement *tmp;
703 __push_scope_hooks();
704 FOR_EACH_PTR(stmt->stmts, tmp) {
705 __split_stmt(tmp);
706 } END_FOR_EACH_PTR(tmp);
707 __call_scope_hooks();
708 break;
710 case STMT_IF:
711 if (known_condition_true(stmt->if_conditional)) {
712 __split_stmt(stmt->if_true);
713 break;
715 if (known_condition_false(stmt->if_conditional)) {
716 __split_stmt(stmt->if_false);
717 break;
719 if (option_known_conditions &&
720 implied_condition_true(stmt->if_conditional)) {
721 sm_info("this condition is true.");
722 __split_stmt(stmt->if_true);
723 break;
725 if (option_known_conditions &&
726 implied_condition_false(stmt->if_conditional)) {
727 sm_info("this condition is false.");
728 __split_stmt(stmt->if_false);
729 break;
731 __split_whole_condition(stmt->if_conditional);
732 __split_stmt(stmt->if_true);
733 if (empty_statement(stmt->if_true) &&
734 last_stmt_on_same_line() &&
735 !get_macro_name(stmt->if_true->pos))
736 sm_msg("warn: if();");
737 __push_true_states();
738 __use_false_states();
739 __split_stmt(stmt->if_false);
740 __merge_true_states();
741 break;
742 case STMT_ITERATOR:
743 if (stmt->iterator_pre_condition)
744 handle_pre_loop(stmt);
745 else if (stmt->iterator_post_condition)
746 handle_post_loop(stmt);
747 else {
748 // these are for(;;) type loops.
749 handle_pre_loop(stmt);
751 break;
752 case STMT_SWITCH:
753 if (get_value(stmt->switch_expression, &sval)) {
754 split_known_switch(stmt, sval);
755 break;
757 __split_expr(stmt->switch_expression);
758 push_expression(&switch_expr_stack, stmt->switch_expression);
759 __save_switch_states(top_expression(switch_expr_stack));
760 nullify_path();
761 __push_default();
762 __push_breaks();
763 __split_stmt(stmt->switch_statement);
764 if (!__pop_default())
765 __merge_switches(top_expression(switch_expr_stack),
766 NULL);
767 __discard_switches();
768 __merge_breaks();
769 pop_expression(&switch_expr_stack);
770 break;
771 case STMT_CASE:
772 __merge_switches(top_expression(switch_expr_stack),
773 stmt->case_expression);
774 __pass_case_to_client(top_expression(switch_expr_stack),
775 stmt->case_expression);
776 if (!stmt->case_expression)
777 __set_default();
778 __split_expr(stmt->case_expression);
779 __split_expr(stmt->case_to);
780 __split_stmt(stmt->case_statement);
781 break;
782 case STMT_LABEL:
783 if (stmt->label_identifier &&
784 stmt->label_identifier->type == SYM_LABEL &&
785 stmt->label_identifier->ident) {
786 loop_count |= 0x80000000;
787 __merge_gotos(stmt->label_identifier->ident->name);
789 __split_stmt(stmt->label_statement);
790 break;
791 case STMT_GOTO:
792 __split_expr(stmt->goto_expression);
793 if (stmt->goto_label && stmt->goto_label->type == SYM_NODE) {
794 if (!strcmp(stmt->goto_label->ident->name, "break")) {
795 __process_breaks();
796 } else if (!strcmp(stmt->goto_label->ident->name,
797 "continue")) {
798 __process_continues();
800 } else if (stmt->goto_label &&
801 stmt->goto_label->type == SYM_LABEL &&
802 stmt->goto_label->ident) {
803 __save_gotos(stmt->goto_label->ident->name);
805 nullify_path();
806 if (is_last_stmt(stmt))
807 handle_backward_goto(stmt);
808 break;
809 case STMT_NONE:
810 break;
811 case STMT_ASM:
812 __pass_to_client(stmt, ASM_HOOK);
813 __split_expr(stmt->asm_string);
814 split_asm_constraints(stmt->asm_outputs);
815 split_asm_constraints(stmt->asm_inputs);
816 split_asm_constraints(stmt->asm_clobbers);
817 break;
818 case STMT_CONTEXT:
819 break;
820 case STMT_RANGE:
821 __split_expr(stmt->range_expression);
822 __split_expr(stmt->range_low);
823 __split_expr(stmt->range_high);
824 break;
826 __pass_to_client(stmt, STMT_HOOK_AFTER);
827 out:
828 __process_post_op_stack();
831 static void split_expr_list(struct expression_list *expr_list)
833 struct expression *expr;
835 FOR_EACH_PTR(expr_list, expr) {
836 __split_expr(expr);
837 __process_post_op_stack();
838 } END_FOR_EACH_PTR(expr);
841 static void split_sym(struct symbol *sym)
843 if (!sym)
844 return;
845 if (!(sym->namespace & NS_SYMBOL))
846 return;
848 __split_stmt(sym->stmt);
849 __split_expr(sym->array_size);
850 split_symlist(sym->arguments);
851 split_symlist(sym->symbol_list);
852 __split_stmt(sym->inline_stmt);
853 split_symlist(sym->inline_symbol_list);
856 static void split_symlist(struct symbol_list *sym_list)
858 struct symbol *sym;
860 FOR_EACH_PTR(sym_list, sym) {
861 split_sym(sym);
862 } END_FOR_EACH_PTR(sym);
865 typedef void (fake_cb)(struct expression *expr);
867 static int member_to_number(struct expression *expr, struct ident *member)
869 struct symbol *type, *tmp;
870 char *name;
871 int i;
873 if (!member)
874 return -1;
875 name = member->name;
877 type = get_type(expr);
878 if (!type || type->type != SYM_STRUCT)
879 return -1;
881 i = -1;
882 FOR_EACH_PTR(type->symbol_list, tmp) {
883 i++;
884 if (!tmp->ident)
885 continue;
886 if (strcmp(name, tmp->ident->name) == 0)
887 return i;
888 } END_FOR_EACH_PTR(tmp);
889 return -1;
892 static struct ident *number_to_member(struct expression *expr, int num)
894 struct symbol *type, *member;
895 int i = 0;
897 type = get_type(expr);
898 if (!type || type->type != SYM_STRUCT)
899 return NULL;
901 FOR_EACH_PTR(type->symbol_list, member) {
902 if (i == num)
903 return member->ident;
904 i++;
905 } END_FOR_EACH_PTR(member);
906 return NULL;
909 static void fake_element_assigns_helper(struct expression *array, struct expression_list *expr_list, fake_cb *fake_cb);
911 struct member_set {
912 struct ident *ident;
913 int set;
916 static struct member_set *alloc_member_set(struct symbol *type)
918 struct member_set *member_set;
919 struct symbol *member;
920 int member_count;
921 int member_idx;
923 member_count = ptr_list_size((struct ptr_list *)type->symbol_list);
924 member_set = malloc(member_count * sizeof(*member_set));
925 member_idx = 0;
926 FOR_EACH_PTR(type->symbol_list, member) {
927 member_set[member_idx].ident = member->ident;
928 member_set[member_idx].set = 0;
929 member_idx++;
930 } END_FOR_EACH_PTR(member);
932 return member_set;
935 static void mark_member_as_set(struct symbol *type, struct member_set *member_set, struct ident *ident)
937 int member_count = ptr_list_size((struct ptr_list *)type->symbol_list);
938 int i;
940 for (i = 0; i < member_count; i++) {
941 if (member_set[i].ident == ident) {
942 member_set[i].set = 1;
943 return;
946 // crap. this is buggy.
947 // sm_msg("internal smatch error in initializer %s.%s", type->ident->name, ident->name);
950 static void set_unset_to_zero(struct expression *symbol, struct symbol *type, struct member_set *member_set)
952 struct expression *deref, *assign;
953 struct symbol *member, *member_type;
954 int member_idx;
956 member_idx = 0;
957 FOR_EACH_PTR(type->symbol_list, member) {
958 if (!member->ident || member_set[member_idx].set) {
959 member_idx++;
960 continue;
962 member_type = get_real_base_type(member);
963 if (!member_type || member_type->type == SYM_ARRAY) {
964 member_idx++;
965 continue;
967 /* TODO: this should be handled recursively and not ignored */
968 if (member_type->type == SYM_STRUCT || member_type->type == SYM_UNION) {
969 member_idx++;
970 continue;
972 deref = member_expression(symbol, '.', member->ident);
973 assign = assign_expression(deref, zero_expr());
974 __split_expr(assign);
975 member_idx++;
976 } END_FOR_EACH_PTR(member);
980 static void fake_member_assigns_helper(struct expression *symbol, struct expression_list *members, fake_cb *fake_cb)
982 struct expression *deref, *assign, *tmp;
983 struct symbol *struct_type, *type;
984 struct ident *member;
985 int member_idx;
986 struct member_set *member_set;
988 struct_type = get_type(symbol);
989 if (!struct_type ||
990 (struct_type->type != SYM_STRUCT && struct_type->type != SYM_UNION))
991 return;
993 member_set = alloc_member_set(struct_type);
995 member_idx = 0;
996 FOR_EACH_PTR(members, tmp) {
997 member = number_to_member(symbol, member_idx);
998 while (tmp->type == EXPR_IDENTIFIER) {
999 member = tmp->expr_ident;
1000 member_idx = member_to_number(symbol, member);
1001 tmp = tmp->ident_expression;
1003 mark_member_as_set(struct_type, member_set, member);
1004 member_idx++;
1005 deref = member_expression(symbol, '.', member);
1006 if (tmp->type == EXPR_INITIALIZER) {
1007 type = get_type(deref);
1008 if (type && type->type == SYM_ARRAY)
1009 fake_element_assigns_helper(deref, tmp->expr_list, fake_cb);
1010 else
1011 fake_member_assigns_helper(deref, tmp->expr_list, fake_cb);
1012 } else {
1013 assign = assign_expression(deref, tmp);
1014 fake_cb(assign);
1016 } END_FOR_EACH_PTR(tmp);
1018 set_unset_to_zero(symbol, struct_type, member_set);
1021 static void fake_member_assigns(struct symbol *sym, fake_cb *fake_cb)
1023 fake_member_assigns_helper(symbol_expression(sym),
1024 sym->initializer->expr_list, fake_cb);
1027 static void fake_element_assigns_helper(struct expression *array, struct expression_list *expr_list, fake_cb *fake_cb)
1029 struct expression *offset, *binop, *assign, *tmp;
1030 struct symbol *type;
1031 int idx;
1033 idx = 0;
1034 FOR_EACH_PTR(expr_list, tmp) {
1035 if (tmp->type == EXPR_INDEX) {
1036 if (tmp->idx_from != tmp->idx_to)
1037 return;
1038 idx = tmp->idx_from;
1039 if (!tmp->idx_expression)
1040 goto next;
1041 tmp = tmp->idx_expression;
1043 offset = value_expr(idx);
1044 binop = array_element_expression(array, offset);
1045 if (tmp->type == EXPR_INITIALIZER) {
1046 type = get_type(binop);
1047 if (type && type->type == SYM_ARRAY)
1048 fake_element_assigns_helper(binop, tmp->expr_list, fake_cb);
1049 else
1050 fake_member_assigns_helper(binop, tmp->expr_list, fake_cb);
1051 } else {
1052 assign = assign_expression(binop, tmp);
1053 fake_cb(assign);
1055 next:
1056 idx++;
1057 } END_FOR_EACH_PTR(tmp);
1060 static void fake_element_assigns(struct symbol *sym, fake_cb *fake_cb)
1062 fake_element_assigns_helper(symbol_expression(sym), sym->initializer->expr_list, fake_cb);
1065 static void fake_assign_expr(struct symbol *sym)
1067 struct expression *assign, *symbol;
1069 symbol = symbol_expression(sym);
1070 assign = assign_expression(symbol, sym->initializer);
1071 __split_expr(assign);
1074 static void call_split_expr(struct expression *expr)
1076 __split_expr(expr);
1079 static void do_initializer_stuff(struct symbol *sym)
1081 if (!sym->initializer)
1082 return;
1084 if (sym->initializer->type == EXPR_INITIALIZER) {
1085 if (get_real_base_type(sym)->type == SYM_ARRAY)
1086 fake_element_assigns(sym, call_split_expr);
1087 else
1088 fake_member_assigns(sym, call_split_expr);
1089 } else {
1090 fake_assign_expr(sym);
1094 static void split_declaration(struct symbol_list *sym_list)
1096 struct symbol *sym;
1098 FOR_EACH_PTR(sym_list, sym) {
1099 __pass_to_client(sym, DECLARATION_HOOK);
1100 do_initializer_stuff(sym);
1101 split_sym(sym);
1102 } END_FOR_EACH_PTR(sym);
1105 static void call_global_assign_hooks(struct expression *assign)
1107 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1110 static void fake_global_assign(struct symbol *sym)
1112 struct expression *assign, *symbol;
1114 if (get_real_base_type(sym)->type == SYM_ARRAY) {
1115 if (sym->initializer && sym->initializer->type == EXPR_INITIALIZER) {
1116 fake_element_assigns(sym, call_global_assign_hooks);
1117 } else if (sym->initializer) {
1118 symbol = symbol_expression(sym);
1119 assign = assign_expression(symbol, sym->initializer);
1120 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1121 } else {
1122 fake_element_assigns_helper(symbol_expression(sym), NULL, call_global_assign_hooks);
1124 } else if (get_real_base_type(sym)->type == SYM_STRUCT) {
1125 if (sym->initializer && sym->initializer->type == EXPR_INITIALIZER) {
1126 fake_member_assigns(sym, call_global_assign_hooks);
1127 } else if (sym->initializer) {
1128 symbol = symbol_expression(sym);
1129 assign = assign_expression(symbol, sym->initializer);
1130 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1131 } else {
1132 fake_member_assigns_helper(symbol_expression(sym), NULL, call_global_assign_hooks);
1134 } else {
1135 symbol = symbol_expression(sym);
1136 if (sym->initializer)
1137 assign = assign_expression(symbol, sym->initializer);
1138 else
1139 assign = assign_expression(symbol, zero_expr());
1140 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
1144 static void start_function_definition(struct symbol *sym)
1146 __in_function_def = 1;
1147 __pass_to_client(sym, FUNC_DEF_HOOK);
1148 __in_function_def = 0;
1149 __pass_to_client(sym, AFTER_DEF_HOOK);
1153 static void split_function(struct symbol *sym)
1155 struct symbol *base_type = get_base_type(sym);
1157 if (!base_type->stmt && !base_type->inline_stmt)
1158 return;
1160 gettimeofday(&fn_start_time, NULL);
1161 cur_func_sym = sym;
1162 if (sym->ident)
1163 cur_func = sym->ident->name;
1164 __smatch_lineno = sym->pos.line;
1165 loop_count = 0;
1166 last_goto_statement_handled = 0;
1167 sm_debug("new function: %s\n", cur_func);
1168 __stree_id = 0;
1169 if (option_two_passes) {
1170 __unnullify_path();
1171 loop_num = 0;
1172 final_pass = 0;
1173 start_function_definition(sym);
1174 __split_stmt(base_type->stmt);
1175 __split_stmt(base_type->inline_stmt);
1176 nullify_path();
1178 __unnullify_path();
1179 loop_num = 0;
1180 final_pass = 1;
1181 start_function_definition(sym);
1182 __split_stmt(base_type->stmt);
1183 __split_stmt(base_type->inline_stmt);
1184 __pass_to_client(sym, END_FUNC_HOOK);
1185 __pass_to_client(sym, AFTER_FUNC_HOOK);
1187 cur_func_sym = NULL;
1188 cur_func = NULL;
1189 clear_all_states();
1190 free_data_info_allocs();
1191 free_expression_stack(&switch_expr_stack);
1192 __free_ptr_list((struct ptr_list **)&big_statement_stack);
1193 __bail_on_rest_of_function = 0;
1196 static void parse_inline(struct expression *call)
1198 struct symbol *base_type;
1199 int loop_num_bak = loop_num;
1200 int final_pass_bak = final_pass;
1201 char *cur_func_bak = cur_func;
1202 struct statement_list *big_statement_stack_bak = big_statement_stack;
1203 struct expression_list *big_expression_stack_bak = big_expression_stack;
1204 struct expression_list *switch_expr_stack_bak = switch_expr_stack;
1205 struct symbol *cur_func_sym_bak = cur_func_sym;
1207 __pass_to_client(call, INLINE_FN_START);
1208 final_pass = 0; /* don't print anything */
1209 __inline_fn = call;
1211 base_type = get_base_type(call->fn->symbol);
1212 cur_func_sym = call->fn->symbol;
1213 if (call->fn->symbol->ident)
1214 cur_func = call->fn->symbol->ident->name;
1215 else
1216 cur_func = NULL;
1217 set_position(call->fn->symbol->pos);
1219 save_all_states();
1220 big_statement_stack = NULL;
1221 big_expression_stack = NULL;
1222 switch_expr_stack = NULL;
1224 sm_debug("inline function: %s\n", cur_func);
1225 __unnullify_path();
1226 loop_num = 0;
1227 start_function_definition(call->fn->symbol);
1228 __split_stmt(base_type->stmt);
1229 __split_stmt(base_type->inline_stmt);
1230 __pass_to_client(call->fn->symbol, END_FUNC_HOOK);
1231 __pass_to_client(call->fn->symbol, AFTER_FUNC_HOOK);
1233 free_expression_stack(&switch_expr_stack);
1234 __free_ptr_list((struct ptr_list **)&big_statement_stack);
1235 nullify_path();
1236 free_goto_stack();
1238 loop_num = loop_num_bak;
1239 final_pass = final_pass_bak;
1240 cur_func_sym = cur_func_sym_bak;
1241 cur_func = cur_func_bak;
1242 big_statement_stack = big_statement_stack_bak;
1243 big_expression_stack = big_expression_stack_bak;
1244 switch_expr_stack = switch_expr_stack_bak;
1246 restore_all_states();
1247 set_position(call->pos);
1248 __inline_fn = NULL;
1249 __pass_to_client(call, INLINE_FN_END);
1252 static struct symbol_list *inlines_called;
1253 static void add_inline_function(struct symbol *sym)
1255 static struct symbol_list *already_added;
1256 struct symbol *tmp;
1258 FOR_EACH_PTR(already_added, tmp) {
1259 if (tmp == sym)
1260 return;
1261 } END_FOR_EACH_PTR(tmp);
1263 add_ptr_list(&already_added, sym);
1264 add_ptr_list(&inlines_called, sym);
1267 static void process_inlines(void)
1269 struct symbol *tmp;
1271 FOR_EACH_PTR(inlines_called, tmp) {
1272 split_function(tmp);
1273 } END_FOR_EACH_PTR(tmp);
1274 free_ptr_list(&inlines_called);
1277 static struct symbol *get_last_scoped_symbol(struct symbol_list *big_list, int use_static)
1279 struct symbol *sym;
1281 FOR_EACH_PTR_REVERSE(big_list, sym) {
1282 if (!sym->scope)
1283 continue;
1284 if (use_static && sym->ctype.modifiers & MOD_STATIC)
1285 return sym;
1286 if (!use_static && !(sym->ctype.modifiers & MOD_STATIC))
1287 return sym;
1288 } END_FOR_EACH_PTR_REVERSE(sym);
1290 return NULL;
1293 static void split_inlines_in_scope(struct symbol *sym)
1295 struct symbol *base;
1296 struct symbol_list *scope_list;
1297 int stream;
1299 scope_list = sym->scope->symbols;
1300 stream = sym->pos.stream;
1302 /* find the last static symbol in the file */
1303 FOR_EACH_PTR_REVERSE(scope_list, sym) {
1304 if (sym->pos.stream != stream)
1305 continue;
1306 if (sym->type != SYM_NODE)
1307 continue;
1308 base = get_base_type(sym);
1309 if (!base)
1310 continue;
1311 if (base->type != SYM_FN)
1312 continue;
1313 if (!base->inline_stmt)
1314 continue;
1315 add_inline_function(sym);
1316 } END_FOR_EACH_PTR_REVERSE(sym);
1318 process_inlines();
1321 static void split_inlines(struct symbol_list *sym_list)
1323 struct symbol *sym;
1325 sym = get_last_scoped_symbol(sym_list, 0);
1326 if (sym)
1327 split_inlines_in_scope(sym);
1328 sym = get_last_scoped_symbol(sym_list, 1);
1329 if (sym)
1330 split_inlines_in_scope(sym);
1333 static struct stree *clone_estates_perm(struct stree *orig)
1335 struct stree *ret = NULL;
1336 struct sm_state *tmp;
1338 FOR_EACH_SM(orig, tmp) {
1339 set_state_stree_perm(&ret, tmp->owner, tmp->name, tmp->sym, clone_estate_perm(tmp->state));
1340 } END_FOR_EACH_SM(tmp);
1342 return ret;
1345 static void split_functions(struct symbol_list *sym_list)
1347 struct symbol *sym;
1349 __unnullify_path();
1350 FOR_EACH_PTR(sym_list, sym) {
1351 set_position(sym->pos);
1352 if (sym->type != SYM_NODE || get_base_type(sym)->type != SYM_FN) {
1353 __pass_to_client(sym, BASE_HOOK);
1354 fake_global_assign(sym);
1356 } END_FOR_EACH_PTR(sym);
1357 global_states = clone_estates_perm(get_all_states_stree(SMATCH_EXTRA));
1358 nullify_path();
1360 FOR_EACH_PTR(sym_list, sym) {
1361 set_position(sym->pos);
1362 if (sym->type == SYM_NODE && get_base_type(sym)->type == SYM_FN) {
1363 split_function(sym);
1364 process_inlines();
1366 } END_FOR_EACH_PTR(sym);
1367 split_inlines(sym_list);
1368 __pass_to_client(sym_list, END_FILE_HOOK);
1371 void smatch(int argc, char **argv)
1374 struct string_list *filelist = NULL;
1375 struct symbol_list *sym_list;
1377 if (argc < 2) {
1378 printf("Usage: smatch [--debug] <filename.c>\n");
1379 exit(1);
1381 sparse_initialize(argc, argv, &filelist);
1382 FOR_EACH_PTR_NOTAG(filelist, base_file) {
1383 if (option_file_output) {
1384 char buf[256];
1386 snprintf(buf, sizeof(buf), "%s.smatch", base_file);
1387 sm_outfd = fopen(buf, "w");
1388 if (!sm_outfd) {
1389 printf("Error: Cannot open %s\n", base_file);
1390 exit(1);
1393 sym_list = sparse_keep_tokens(base_file);
1394 split_functions(sym_list);
1395 } END_FOR_EACH_PTR_NOTAG(base_file);