[PATCH 14/73] inline: Copy union cast types and VLA bounds when inlining

[Bart Van Assche <bvanassche@acm.org>]

Duplicate union EXPR_CAST target symbols and clone variable-length array
SYM_ARRAY chains in inline.c so that union casts and VLA dimension
expressions inside inlined functions do not share or mutate symbols
across call sites.

Add regression tests in validation/eval-expand-inline-fixes.c and
validation/eval-ptr-incomplete-and-inline.c.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 inline.c                                    | 101 ++++++++++++++++++--
 validation/eval-expand-inline-fixes.c       |  49 ++++++++++
 validation/eval-ptr-incomplete-and-inline.c |  70 ++++++++++++++
 3 files changed, 213 insertions(+), 7 deletions(-)
 create mode 100644 validation/eval-expand-inline-fixes.c
 create mode 100644 validation/eval-ptr-incomplete-and-inline.c

diff --git a/inline.c b/inline.c
index a7ab73d37492..1948bea52ffb 100644
--- a/inline.c
+++ b/inline.c
@@ -35,6 +35,7 @@
 #include "evaluate.h"
 
 static void copy_statement(struct statement *src, struct statement *dst);
+static struct expression *copy_expression(struct expression *expr);
 
 static struct expression * dup_expression(struct expression *expr)
 {
@@ -63,6 +64,64 @@ static struct symbol *copy_symbol(struct position pos, struct symbol *sym)
 	return sym->replace;
 }
 
+static struct symbol *copy_type(struct symbol *type)
+{
+	if (!type)
+		return NULL;
+	switch (type->type) {
+	case SYM_NODE: {
+		struct symbol *base = copy_type(type->ctype.base_type);
+		struct symbol *n;
+		if (base == type->ctype.base_type)
+			return type;
+		n = alloc_symbol(type->pos, SYM_NODE);
+		*n = *type;
+		n->ctype.base_type = base;
+		if (base && base->bit_size < 0)
+			n->examined = 0;
+		return n;
+	}
+	case SYM_ARRAY: {
+		struct symbol *elem = copy_type(type->ctype.base_type);
+		struct expression *size = copy_expression(type->array_size);
+		struct symbol *arr;
+		if (elem == type->ctype.base_type && size == type->array_size && !type->array_size)
+			return type;
+		arr = alloc_symbol(type->pos, SYM_ARRAY);
+		*arr = *type;
+		arr->ctype.base_type = elem;
+		arr->array_size = size;
+		if (type->array_size || elem != type->ctype.base_type)
+			arr->examined = 0;
+		return arr;
+	}
+	case SYM_PTR: {
+		struct symbol *base = copy_type(type->ctype.base_type);
+		struct symbol *ptr;
+		if (base == type->ctype.base_type)
+			return type;
+		ptr = alloc_symbol(type->pos, SYM_PTR);
+		*ptr = *type;
+		ptr->ctype.base_type = base;
+		return ptr;
+	}
+	case SYM_TYPEOF:
+	case SYM_TYPEOF_UNQUAL: {
+		struct expression *init = copy_expression(type->initializer);
+		struct symbol *t;
+		if (init == type->initializer)
+			return type;
+		t = alloc_symbol(type->pos, type->type);
+		*t = *type;
+		t->initializer = init;
+		t->examined = 0;
+		return t;
+	}
+	default:
+		return type;
+	}
+}
+
 static struct symbol_list *copy_symbol_list(struct symbol_list *src)
 {
 	struct symbol_list *dst = NULL;
@@ -155,11 +214,19 @@ static struct expression * copy_expression(struct expression *expr)
 
 	/* Cast/sizeof/__alignof__ */
 	case EXPR_CAST:
-		if (!expr->cast_expression)
-			return NULL;
-		if (expr->cast_expression->type == EXPR_INITIALIZER) {
+		if (!expr->cast_expression) {
+			struct symbol *cast_type = copy_type(expr->cast_type);
+			if (cast_type != expr->cast_type) {
+				expr = dup_expression(expr);
+				expr->cast_type = cast_type;
+			}
+			return expr;
+		}
+		if (expr->cast_expression->type == EXPR_INITIALIZER ||
+		    (expr->cast_type && expr->cast_type->ctype.base_type &&
+		     expr->cast_type->ctype.base_type->type == SYM_UNION)) {
 			struct expression *cast = expr->cast_expression;
-			struct symbol *sym = expr->cast_type;
+			struct symbol *sym = copy_type(expr->cast_type);
 			expr = dup_expression(expr);
 			expr->cast_expression = copy_expression(cast);
 			expr->cast_type = alloc_symbol(sym->pos, sym->type);
@@ -172,10 +239,12 @@ static struct expression * copy_expression(struct expression *expr)
 	case EXPR_PTRSIZEOF:
 	case EXPR_ALIGNOF: {
 		struct expression *cast = copy_expression(expr->cast_expression);
-		if (cast == expr->cast_expression)
+		struct symbol *cast_type = copy_type(expr->cast_type);
+		if (cast == expr->cast_expression && cast_type == expr->cast_type)
 			break;
 		expr = dup_expression(expr);
 		expr->cast_expression = cast;
+		expr->cast_type = cast_type;
 		break;
 	}
 
@@ -343,8 +412,10 @@ static struct statement *copy_one_statement(struct statement *stmt)
 		newstmt->declaration = NULL;
 		FOR_EACH_PTR(stmt->declaration, sym) {
 			struct symbol *newsym = copy_symbol(stmt->pos, sym);
-			if (newsym != sym)
+			if (newsym != sym) {
+				newsym->ctype.base_type = copy_type(newsym->ctype.base_type);
 				newsym->initializer = copy_expression(sym->initializer);
+			}
 			add_symbol(&newstmt->declaration, newsym);
 		} END_FOR_EACH_PTR(sym);
 		stmt = newstmt;
@@ -424,10 +495,20 @@ static struct statement *copy_one_statement(struct statement *stmt)
 		break;		
 	}
 	case STMT_ITERATOR: {
+		struct symbol_list *old_syms = stmt->iterator_syms;
+		struct symbol *sym;
 		stmt = dup_statement(stmt);
 		stmt->iterator_break = copy_symbol(stmt->pos, stmt->iterator_break);
 		stmt->iterator_continue = copy_symbol(stmt->pos, stmt->iterator_continue);
-		stmt->iterator_syms = copy_symbol_list(stmt->iterator_syms);
+		stmt->iterator_syms = NULL;
+		FOR_EACH_PTR(old_syms, sym) {
+			struct symbol *newsym = copy_symbol(stmt->pos, sym);
+			if (newsym != sym) {
+				newsym->ctype.base_type = copy_type(newsym->ctype.base_type);
+				newsym->initializer = copy_expression(sym->initializer);
+			}
+			add_symbol(&stmt->iterator_syms, newsym);
+		} END_FOR_EACH_PTR(sym);
 
 		stmt->iterator_pre_statement = copy_one_statement(stmt->iterator_pre_statement);
 		stmt->iterator_pre_condition = copy_expression(stmt->iterator_pre_condition);
@@ -542,6 +623,8 @@ int inline_function(struct expression *expr, struct symbol *sym)
 
 		if (name) {
 			*a = *name;
+			a->bb_target = NULL;
+			a->pseudo = NULL;
 			set_replace(name, a);
 			add_symbol(&fn_symbol_list, a);
 			a->initializer = arg;
@@ -557,6 +640,10 @@ int inline_function(struct expression *expr, struct symbol *sym)
 	} END_FOR_EACH_PTR(arg);
 	FINISH_PTR_LIST(name);
 
+	FOR_EACH_PTR(arg_decl, name) {
+		name->ctype.base_type = copy_type(name->ctype.base_type);
+	} END_FOR_EACH_PTR(name);
+
 	copy_statement(fn->inline_stmt, stmt);
 
 	if (arg_decl) {
diff --git a/validation/eval-expand-inline-fixes.c b/validation/eval-expand-inline-fixes.c
new file mode 100644
index 000000000000..95600c32ec93
--- /dev/null
+++ b/validation/eval-expand-inline-fixes.c
@@ -0,0 +1,49 @@
+/* 1. _Generic array/function decay and qualifier stripping */
+extern int arr[4];
+extern int fn(void);
+const int ci = 0;
+
+_Static_assert(_Generic(arr, int *: 1, default: 0) == 1, "array decay");
+_Static_assert(_Generic(fn, int (*)(void): 1, default: 0) == 1, "func decay");
+_Static_assert(_Generic(ci, int: 1, const int: 0) == 1, "qual strip");
+
+/* 2. Inlining function with cleanup attribute and _Static_assert */
+void cl(int *p);
+
+static inline int inl_cleanup(int v)
+{
+	_Static_assert(sizeof(v) == sizeof(int), "int size");
+	int x __attribute__((cleanup(cl))) = v;
+	return x + 1;
+}
+
+int call_inl(int v)
+{
+	return inl_cleanup(v);
+}
+
+/* 3. Conditional operator preserving noderef qualifier */
+#define __noderef __attribute__((noderef))
+void cond_noderef(void *vp, int __noderef *p)
+{
+	int *q = (1 ? vp : p);
+	(void)q;
+}
+
+/* 4. Signed division overflow in constant expression */
+int div_ovf(void)
+{
+	return (-9223372036854775807LL - 1LL) / -1LL;
+}
+
+/*
+ * check-name: eval-expand-inline-fixes
+ * check-command: sparse -Wno-decl $file
+ *
+ * check-error-start
+eval-expand-inline-fixes.c:29:21: warning: incorrect type in initializer (different modifiers)
+eval-expand-inline-fixes.c:29:21:    expected int *q
+eval-expand-inline-fixes.c:29:21:    got void [noderef] *
+eval-expand-inline-fixes.c:36:47: warning: constant integer operation overflow
+ * check-error-end
+ */
diff --git a/validation/eval-ptr-incomplete-and-inline.c b/validation/eval-ptr-incomplete-and-inline.c
new file mode 100644
index 000000000000..fb1c7b71496b
--- /dev/null
+++ b/validation/eval-ptr-incomplete-and-inline.c
@@ -0,0 +1,70 @@
+/* 1. Subtraction of pointers to incomplete type */
+extern int arr[];
+static int test_sub(int (*p)[], int (*q)[])
+{
+	return p - q;
+}
+
+/* 2. _Alignof on incomplete type (void) */
+static unsigned long test_align(void)
+{
+	return _Alignof(void);
+}
+
+/* 3. Float <-> unsigned integer constant folding in initializers */
+static unsigned int u = (unsigned int)3.8f;
+static float f = 4000000000U;
+
+/* 4. Unsigned pointer arithmetic */
+static char *test_ptr_add(char *p)
+{
+	return p + 0x80000000U;
+}
+
+/* 5. Named asm constraint */
+static int test_asm_named(int val)
+{
+	int out;
+	asm("mov %0, %[in]" : "=r"(out) : [in] "r"(val));
+	return out;
+}
+
+/* 6. Inlining with local array and union cast */
+union U { int x; float y; };
+static inline int inl_func(int v)
+{
+	int a[4] = { v, 1, 2, 3 };
+	union U u = (union U)v;
+	return a[0] + u.x;
+}
+static int call_inl(int x, int y)
+{
+	return inl_func(x) + inl_func(y);
+}
+
+/* 7. Inlining multi-dimensional VLAs, VLA pointers, and typeof(VLA) */
+static inline unsigned long inl_vla(int n, int m)
+{
+	int mat[n][m];
+	int (*p)[m] = mat;
+	typeof(mat) mat2;
+
+	for (int row[n], k = 0; k < 1; k++)
+		row[0] = n;
+	return sizeof(mat) + sizeof(*p) + sizeof(mat2) + sizeof(int [n][m]);
+}
+
+static unsigned long call_inl_vla(int a, int b, int c, int d)
+{
+	return inl_vla(a, b) + inl_vla(c, d);
+}
+
+/*
+ * check-name: eval-ptr-incomplete-and-inline
+ * check-command: sparse -Wno-vla $file
+ *
+ * check-error-start
+eval-ptr-incomplete-and-inline.c:5:18: error: subtraction of pointers to incomplete type
+eval-ptr-incomplete-and-inline.c:11:16: error: cannot size alignment of incomplete type
+ * check-error-end
+ */