1  Introduction

• A driver which behaves as either the gcc or Microsoft VC compiler and can invoke the preprocessor followed by the CIL application. The advantage of this script is that you can easily use CIL and the analyses written for CIL with existing make files.
• A whole-program merger that you can use as a replacement for your compiler and it learns all the files you compile when you make a project and merges all of the preprocessed source files into a single one. This makes it easy to do whole-program analysis.
• A patcher makes it easy to create modified copies of the system include files. The CIL driver can then be told to use these patched copies instead of the standard ones.

2  Installation

1. Download the CIL distribution (latest version is distrib/cil-1.3.5.tar.gz). See the Section 20 for recent changes to the CIL distribution.
2. Unzip and untar the source distribution. This will create a directory called cil whose structure is explained below.
   tar xvfz cil-1.3.5.tar.gz
3. Enter the cil directory and run the configure script and then GNU make to build the distribution. If you are on Windows, at least the configure step must be run from within bash.
       cd cil
    ./configure
    make
    make quicktest
   
4. You should now find cilly.asm.exe in a subdirectory of obj. The name of the subdirectory is either x86_WIN32 if you are using cygwin on Windows or x86_LINUX if you are using Linux (although you should be using instead the Perl wrapper bin/cilly). Note that we do not have an install make target and you should use Cil from the development directory.
5. If you decide to use CIL, please send us a note. This will help recharge our batteries after more than a year of development. And of course, do send us your bug reports as well.

• CC=foo Specifies the path for the gcc executable. By default whichever version is in the PATH is used. If CC specifies the Microsoft cl compiler, then that compiler will be set as the default one. Otherwise, the gcc compiler will be the default.

• On Windows, cl compiler version 12.00.8168 (MSVC 6), 13.00.9466 (MSVC .Net), and 13.10.3077 (MSVC .Net 2003). Run cl with no arguments to get the compiler version.
• On Windows, using cygwin and gcc version 2.95.3, 3.0, 3.2, 3.3, and 3.4.
• On Linux, using gcc version 2.95.3, 3.0, 3.2, 3.3, and 4.0.

3  Distribution Contents

4  Compiling C to CIL

1. CIL will eliminate all declarations for unused entities. This means that just because your hello world program includes stdio.h it does not mean that your analysis has to handle all the ugly stuff from stdio.h.
   
   
2. Type specifiers are interpreted and normalized:

   
   int long signed x;
   signed long extern x;
   long static int long y;
   
   // Some code that uses these declaration, so that CIL does not remove them
   int main() { return x + y; }
   

   See the CIL output for this code fragment
   
   
3. Anonymous structure and union declarations are given a name.

   
    struct { int x; } s;
   

   See the CIL output for this code fragment
   
   
4. Nested structure tag definitions are pulled apart. This means that all structure tag definitions can be found by a simple scan of the globals.

   
   struct foo {
      struct bar {
         union baz { 
             int x1; 
             double x2;
         } u1;
         int y;
      } s1;
      int z;
   } f;
   

   See the CIL output for this code fragment
   
   
5. All structure, union, enumeration definitions and the type definitions from inners scopes are moved to global scope (with appropriate renaming). This facilitates moving around of the references to these entities.

   
   int main() {
     struct foo { 
           int x; } foo; 
     {
        struct foo { 
           double d;
        };
        return foo.x;
     }      
   }
   

   See the CIL output for this code fragment
   
   
6. Prototypes are added for those functions that are called before being defined. Furthermore, if a prototype exists but does not specify the type of parameters that is fixed. But CIL will not be able to add prototypes for those functions that are neither declared nor defined (but are used!).

   
     int f();  // Prototype without arguments
     int f(double x) {
         return g(x);
     }
     int g(double x) {
        return x;
     } 
   

   See the CIL output for this code fragment
   
   
7. Array lengths are computed based on the initializers or by constant folding.

   
     int a1[] = {1,2,3};
     int a2[sizeof(int) >= 4 ? 8 : 16];
   

   See the CIL output for this code fragment
   
   
8. Enumeration tags are computed using constant folding:

   
   int main() {
     enum { 
        FIVE = 5, 
        SIX, SEVEN, 
        FOUR = FIVE - 1, 
        EIGHT = sizeof(double)
     } x = FIVE;
    return x;
   }
   
   

   See the CIL output for this code fragment
   
   
9. Initializers are normalized to include specific initialization for the missing elements:

   
     int a1[5] = {1,2,3};
     struct foo { int x, y; } s1 = { 4 };
   

   See the CIL output for this code fragment
   
   
10. Initializer designators are interpreted and eliminated. Subobjects are properly marked with braces. CIL implements the whole ISO C99 specification for initializer (neither GCC nor MSVC do) and a few GCC extensions.

    
      struct foo { 
         int x, y; 
         int a[5];
         struct inner {
            int z;
         } inner;
      } s = { 0, .inner.z = 3, .a[1 ... 2] = 5, 4, y : 8 };
    

    See the CIL output for this code fragment
    
    
11. String initializers for arrays of characters are processed

    
    char foo[] = "foo plus bar";
    

    See the CIL output for this code fragment
    
    
12. String constants are concatenated

    
    char *foo = "foo " " plus " " bar ";
    

    See the CIL output for this code fragment
    
    
13. Initializers for local variables are turned into assignments. This is in order to separate completely the declarative part of a function body from the statements. This has the unfortunate effect that we have to drop the const qualifier from local variables !

    
      int x = 5; 
      struct foo { int f1, f2; } a [] = {1, 2, 3, 4, 5 };
    

    See the CIL output for this code fragment
    
    
14. Local variables in inner scopes are pulled to function scope (with appropriate renaming). Local scopes thus disappear. This makes it easy to find and operate on all local variables in a function.

    
      int x = 5; 
      int main() {
        int x = 6;
        { 
          int x = 7;
          return x;
        }
        return x;
      } 
    

    See the CIL output for this code fragment
    
    
15. Global declarations in local scopes are moved to global scope:

    
      int x = 5; 
      int main() {
        int x = 6;
        { 
          static int x = 7;
          return x;
        }
        return x;
      } 
    

    See the CIL output for this code fragment
    
    
16. Return statements are added for functions that are missing them. If the return type is not a base type then a return without a value is added. The guaranteed presence of return statements makes it easy to implement a transformation that inserts some code to be executed immediately before returning from a function.

    
      int foo() {
        int x = 5;
      } 
    

    See the CIL output for this code fragment
    
    
17. One of the most significant transformations is that expressions that contain side-effects are separated into statements.

    
       int x, f(int);
       return (x ++ + f(x));
    

    See the CIL output for this code fragment
    
    Internally, the x ++ statement is turned into an assignment which the pretty-printer prints like the original. CIL has only three forms of basic statements: assignments, function calls and inline assembly.
    
    
18. Shortcut evaluation of boolean expressions and the ?: operator are compiled into explicit conditionals:

    
      int x;
      int y = x ? 2 : 4;
      int z = x || y;
      // Here we duplicate the return statement
      if(x && y) { return 0; } else { return 1; }
      // To avoid excessive duplication, CIL uses goto's for 
      // statement that have more than 5 instructions
      if(x && y || z) { x ++; y ++; z ++; x ++; y ++; return z; }
    

    See the CIL output for this code fragment
    
    
19. GCC's conditional expression with missing operands are also compiled into conditionals:

    
      int f();;
      return f() ? : 4;
    

    See the CIL output for this code fragment
    
    
20. All forms of loops (while, for and do) are compiled internally as a single while(1) looping construct with explicit break statement for termination. For simple while loops the pretty printer is able to print back the original:

    
       int x, y;
       for(int i = 0; i<5; i++) {
          if(i == 5) continue;
          if(i == 4) break;
          i += 2;
       } 
       while(x < 5) {
         if(x == 3) continue;
         x ++;
       }
    

    See the CIL output for this code fragment
    
    
21. GCC's block expressions are compiled away. (That's right there is an infinite loop in this code.)

    
       int x = 5, y = x;
       int z = ({ x++; L: y -= x; y;});
       return ({ goto L; 0; });
    

    See the CIL output for this code fragment
    
    
22. CIL contains support for both MSVC and GCC inline assembly (both in one internal construct)
    
    
23. CIL compiles away the GCC extension that allows many kinds of constructs to be used as lvalues:

    
       int x, y, z;
       return &(x ? y : z) - & (x ++, x);
    

    See the CIL output for this code fragment
    
    
24. All types are computed and explicit casts are inserted for all promotions and conversions that a compiler must insert:
    
    
25. CIL will turn old-style function definition (without prototype) into new-style definitions. This will make the compiler less forgiving when checking function calls, and will catch for example cases when a function is called with too few arguments. This happens in old-style code for the purpose of implementing variable argument functions.
    
    
26. Since CIL sees the source after preprocessing the code after CIL does not contain the comments and the preprocessing directives.
    
    
27. CIL will remove from the source file those type declarations, local variables and inline functions that are not used in the file. This means that your analysis does not have to see all the ugly stuff that comes from the header files:

    
    #include <stdio.h>
    
    typedef int unused_type;
    
    static char unused_static (void) { return 0; }
    
    int main() {
      int unused_local;
      printf("Hello world\n"); // Only printf will be kept from stdio.h     
    }
    

    See the CIL output for this code fragment

5  How to Use CIL

5.1  Using cilly, the CIL driver

1. Modify logwrites.ml so that it includes a CIL “feature descriptor” like this:

   let feature : featureDescr = 
     { fd_name = "logwrites";              
       fd_enabled = ref false;
       fd_description = "generation of code to log memory writes";
       fd_extraopt = [];
       fd_doit = 
       (function (f: file) -> 
         let lwVisitor = new logWriteVisitor in
         visitCilFileSameGlobals lwVisitor f)
     } 
   

   The fd_name field names the feature and its associated command-line arguments. The fd_enabled field is a bool ref. “fd_doit” will be invoked if !fd_enabled is true after argument parsing, so initialize the ref cell to true if you want this feature to be enabled by default.
   
   When the user passes the --dologwrites command-line option to cilly, the variable associated with the fd_enabled flag is set and the fd_doit function is called on the Cil.file that represents the merger (see Section 13) of all C files listed as arguments.
   
   
2. Invoke configure with the arguments

   ./configure EXTRASRCDIRS=/home/necula EXTRAFEATURES=logwrites
   

   This step works if each feature is packaged into its own ML file, and the name of the entry point in the file is feature.
   
   An alternative way to specify the new features is to change the build files yourself, as explained below. You'll need to use this method if a single feature is split across multiple files.
   1. Put logwrites.ml in the src or src/ext directory. This will make sure that make can find it. If you want to put it in some other directory, modify Makefile.in and add to SOURCEDIRS your directory. Alternately, you can create a symlink from src or src/ext to your file.
      
      
   2. Modify the Makefile.in and add your module to the CILLY_MODULES or CILLY_LIBRARY_MODULES variables. The order of the modules matters. Add your modules somewhere after cil and before main.
      
      
   3. If you have any helper files for your module, add those to the makefile in the same way. e.g.:

      CILLY_MODULES = $(CILLY_LIBRARY_MODULES) \
                      myutilities1 myutilities2 logwrites \
                      main
      

      Again, order is important: myutilities2.ml will be able to refer to Myutilities1 but not Logwrites. If you have any ocamllex or ocamlyacc files, add them to both CILLY_MODULES and either MLLS or MLYS.
      
      
   4. Modify main.ml so that your new feature descriptor appears in the global list of CIL features.

      let features : C.featureDescr list = 
        [ Logcalls.feature;
          Oneret.feature;    
          Heapify.feature1;  
          Heapify.feature2;
          makeCFGFeature; 
          Partial.feature;
          Simplemem.feature;
          Logwrites.feature;  (* add this line to include the logwrites feature! *)
        ] 
        @ Feature_config.features 
      

      Features are processed in the order they appear on this list. Put your feature last on the list if you plan to run any of CIL's built-in features (such as makeCFGfeature) before your own.
   
   Standard code in cilly takes care of adding command-line arguments, printing the description, and calling your function automatically. Note: do not worry about introducing new bugs into CIL by adding a single line to the feature list.
   
   
3. Now you can invoke the cilly application on a preprocessed file, or instead use the cilly driver which provides a convenient compiler-like interface to cilly. See Section 7 for details using cilly. Remember to enable your analysis by passing the right argument (e.g., --dologwrites).

5.2  Using CIL as a library

$ ocamlopt -c -I $(CIL)/obj/x86_LINUX/ main.ml
$ ocamlopt -ccopt -L$(CIL)/obj/x86_LINUX/ -o main unix.cmxa str.cmxa \ 
        $(CIL)/obj/x86_LINUX/cil.cmxa main.cmx

6  CIL API Documentation

• An index of all types
• An index of all values
• Cil.file is the representation of a file.
• Cil.global is the representation of a global declaration or definitions. Values for operating on globals.
• Cil.typ is the representation of a type. Values for operating on types.
• Cil.compinfo is the representation of a structure or a union type
• Cil.fieldinfo is the representation of a field in a structure or a union
• Cil.enuminfo is the representation of an enumeration type.
• Cil.varinfo is the representation of a variable
• Cil.fundec is the representation of a function
• Cil.lval is the representation of an lvalue. Values for operating on lvalues.
• Cil.exp is the representation of an expression without side-effects. Values for operating on expressions.
• Cil.instr is the representation of an instruction (with side-effects but without control-flow)
• Cil.stmt is the representation of a control-flow statements. Values for operating on statements.
• Cil.attribute is the representation of attributes. Values for operating on attributes.

6.1  Using the visitor

• Ignore this node and all its descendants
• Descend into all of the children and when done rebuild the node if any of the children have changed.
• Replace the subtree rooted at the node with another tree.
• Replace the subtree with another tree, then descend into the children and rebuild the node if necessary and then invoke a user-specified function.
• In addition to all of the above actions then visitor can specify that some instructions should be queued to be inserted before the current instruction or statement being visited.

• Cil.visitCilFile or Cil.visitCilFileSameGlobals - visit a file
• Cil.visitCilGlobal - visit a global
• Cil.visitCilFunction - visit a function definition
• Cil.visitCilExp - visit an expression
• Cil.visitCilLval - visit an lvalue
• Cil.visitCilInstr - visit an instruction
• Cil.visitCilStmt - visit a statement
• Cil.visitCilType - visit a type. Note that this does not visit the files of a composite type. use visitGlobal to visit the [GCompTag] that defines the fields.

6.2  Interpreted Constructors and Deconstructors

Formatcil.cType "void * const (*)(int x)"

TPtr(TFun(TVoid [Attr("const", [])],
          [ ("x", TInt(IInt, []), []) ], false, []), [])

Formatcil.cInstr "%v:x = %v:x + %e:something"
        loc
        [ ("something", Fe some_exp);
          ("x", Fv some_varinfo) ]

Set((Var some_varinfo, NoOffset),
    BinOp(PlusA, Lval (Var some_varinfo, NoOffset),
          some_exp, intType), 
    loc)

Formatcil.dType "void * const (*)(int x)" t

Formatcil.dType "void * (*)(%F:t)" t

Expressions:
  E ::= %e:ID | %d:ID | %g:ID | n | L | ( E ) | Unop E | E Binop E 
        | sizeof E | sizeof ( T ) | alignof E  | alignof ( T ) 
        | & L | ( T ) E 

Unary operators:
  Unop ::= + | - | ~ | %u:ID

Binary operators:
  Binop ::= + | - | * | / | << | >> | & | ``|'' | ^ 
          | == | != | < | > | <= | >= | %b:ID

Lvalues:
  L ::= %l:ID | %v:ID Offset | * E | (* E) Offset | E -> ident Offset 

Offsets:
  Offset ::= empty | %o:ID | . ident Offset | [ E ] Offset

Types:
  T ::= Type_spec Attrs Decl

Type specifiers:
  Type_spec ::= void | char | unsigned char | short | unsigned short
            | int | unsigned int | long | unsigned long | %k:ID | float 
            | double | struct %c:ID | union %c:ID 


Declarators:
  Decl ::= * Attrs Decl | Direct_decl


Direct declarators:
  Direct_decl ::= empty | ident | ( Attrs Decl ) 
                 | Direct_decl [ Exp_opt ]
                 | ( Attrs Decl )( Parameters )

Optional expressions
  Exp_opt ::= empty | E | %eo:ID

Formal parameters
  Parameters ::= empty | ... | %va:ID | %f:ID | T | T , Parameters

List of attributes
  Attrs ::= empty | %A:ID | Attrib Attrs

Attributes
  Attrib ::= const | restrict | volatile | __attribute__ ( ( GAttr ) )

GCC Attributes
  GAttr ::= ident | ident ( AttrArg_List )

Lists of GCC Attribute arguments:
  AttrArg_List ::= AttrArg | %P:ID | AttrArg , AttrArg_List

GCC Attribute arguments  
  AttrArg ::= %p:ID | ident | ident ( AttrArg_List )

Instructions
  Instr ::= %i:ID ; | L = E ; | L Binop= E | Callres L ( Args )

Actual arguments
   Args ::= empty | %E:ID | E | E , Args

Call destination
   Callres ::= empty | L = | %lo:ID

Statements
  Stmt ::= %s:ID | if ( E ) then Stmt ; | if ( E ) then Stmt else Stmt ;
       | return Exp_opt | break ; | continue ; | { Stmt_list } 
       | while (E ) Stmt | Instr_list 

Lists of statements
   Stmt_list ::= empty | %S:ID | Stmt Stmt_list  
                | Type_spec Attrs Decl ; Stmt_list
                | Type_spec Attrs Decl = E ; Stmt_list
                | Type_spec Attrs Decl = L (Args) ; Stmt_list

List of instructions
   Instr_list ::= Instr | %I:ID | Instr Instr_list

• In the grammar description above non-terminals are written with uppercase initial
  
  
• All of the patterns consist of the % character followed by one or two letters, followed by “:” and an indentifier. For each such pattern there is a corresponding constructor of the Cil.formatArg type, whose name is the letter 'F' followed by the same one or two letters as in the pattern. That constructor is used by the user code to pass a Cil.formatArg actual argument to the interpreted constructor and by the interpreted deconstructor to return what was matched for a pattern.
  
  
• If the pattern name is uppercase, it designates a list of the elements designated by the corresponding lowercase pattern. E.g. %E designated lists of expressions (as in the actual arguments of a call).
  
  
• The two-letter patterns whose second letter is “o” designate an optional element. E.g. %eo designates an optional expression (as in the length of an array).
  
  
• Unlike in calls to printf, the pattern %g is used for strings.
  
  
• The usual precedence and associativity rules as in C apply
  
  
• The pattern string can contain newlines and comments, using both the /* ... */ style as well as the // one.
  
  
• When matching a “cast” pattern of the form ( T ) E, the deconstructor will match even expressions that do not have the actual cast but in that case the type is matched against the type of the expression. E.g. the patters "(int)%e" will match any expression of type int whether it has an explicit cast or not.
  
  
• The %k pattern is used to construct and deconstruct an integer type of any kind.
  
  
• Notice that the syntax of types and declaration are the same (in order to simplify the parser). This means that technically you can write a whole declaration instead of a type in the cast. In this case the name that you declare is ignored.
  
  
• In lists of formal parameters and lists of attributes, an empty list in the pattern matches any formal parameters or attributes.
  
  
• When matching types, uses of named types are unrolled to expose a real type before matching.
  
  
• The order of the attributes is ignored during matching. The the pattern for a list of attributes contains %A then the resulting formatArg will be bound to all attributes in the list. For example, the pattern "const %A" matches any list of attributes that contains const and binds the corresponding placeholder to the entire list of attributes, including const.
  
  
• All instruction-patterns must be terminated by semicolon
  
  
• The autoincrement and autodecrement instructions are not supported. Also not supported are complex expressions, the && and || shortcut operators, and a number of other more complex instructions or statements. In general, the patterns support only constructs that can be represented directly in CIL.
  
  
• The pattern argument identifiers are not used during deconstruction. Instead, the result contains a sequence of values in the same order as the appearance of pattern arguments in the pattern.
  
  
• You can mix statements with declarations. For each declaration a new temporary will be constructed (using a function you provive). You can then refer to that temporary by name in the rest of the pattern.
  
  
• The %v: pattern specifier is optional.

• Formatcil.cExp constructs Cil.exp.
• Formatcil.cType constructs Cil.typ.
• Formatcil.cLval constructs Cil.lval.
• Formatcil.cInstr constructs Cil.instr.
• Formatcil.cStmt and Formatcil.cStmts construct Cil.stmt.
• Formatcil.dExp deconstructs Cil.exp.
• Formatcil.dType deconstructs Cil.typ.
• Formatcil.dLval deconstructs Cil.lval.
• Formatcil.dInstr deconstructs Cil.lval.

Formatcil.cStmts
  loc
  "int idx = sizeof(array) / sizeof(array[0]) - 1;
   while(idx >= 0) {
     // Some statements to be run for all the elements of the array
     %S:init
     if(! (idx & 1)) 
       array[idx] = %e:init_even;
     /* Do not forget to decrement the index variable */
     idx = idx - 1;
   }"
  (fun n t -> makeTempVar myfunc ~name:n t)
  [ ("array", Fv myarray); 
    ("init", FS [stmt1; stmt2; stmt3]);
    ("init_even", Fe init_expr_for_even_elements) ]

6.2.1  Performance considerations for interpreted constructors

6.3  Printing and Debugging support

• Cil.d_exp - print an expression
• Cil.d_type - print a type
• Cil.d_lval - print an lvalue
• Cil.d_global - print a global
• Cil.d_stmt - print a statment
• Cil.d_instr - print an instruction
• Cil.d_init - print an initializer
• Cil.d_attr - print an attribute
• Cil.d_attrlist - print a set of attributes
• Cil.d_loc - print a location
• Cil.d_ikind - print an integer kind
• Cil.d_fkind - print a floating point kind
• Cil.d_const - print a constant
• Cil.d_storage - print a storage specifier

• Cil.printExp - print an expression
• Cil.printType - print a type
• Cil.printLval - print an lvalue
• Cil.printGlobal - print a global
• Cil.printStmt - print a statment
• Cil.printInstr - print an instruction
• Cil.printInit - print an initializer
• Cil.printAttr - print an attribute
• Cil.printAttrs - print a set of attributes

6.4  Attributes

 gccattribute ::= __attribute__((attribute))    (Note the double parentheses)

 int x N;
 int x N, * y N = 0, z[] N;
 extern void exit() N;
 int fact(int x) N { ... }

1. The type attributes for a base type (int, float, named type, reference to struct or union or enum) must be specified immediately following the type (actually it is Ok to mix attributes with the specification of the type, in between unsigned and int for example).
   
   For example:

   
     int A1 x N;  /* A1 applies to the type int. An example is an attribute
                      "even" restricting the type int to even values. */
     struct foo A1 A2 x; // Both A1 and A2 apply to the struct foo type
   

   
   
   
2. The type attributes for a pointer type must be specified immediately after the * symbol.

   
    /* A pointer (A1) to an int (A2) */
    int A2 * A1 x;
    /* A pointer (A1) to a pointer (A2) to a float (A3) */
    float A3 * A2 * A1 x;
   

   Note: The attributes for base types and for pointer types are a strict extension of the ANSI C type qualifiers (const, volatile and restrict). In fact CIL treats these qualifiers as attributes.
   
   
3. The attributes for a function type or for an array type can be specified using parenthesized declarators.
   
   For example:

   
      /* A function (A1) from int (A2) to float (A3) */
      float A3 (A1 f)(int A2);
   
      /* A pointer (A1) to a function (A2) that returns an int (A3) */
      int A3 (A2 * A1 pfun)(void);
   
      /* An array (A1) of int (A2) */
      int A2 (A1 x0)[]
   
      /* Array (A1) of pointers (A2) to functions (A3) that take an int (A4) and 
       * return a pointer (A5) to int (A6)  */
      int A6 * A5 (A3 * A2 (A1 x1)[5])(int A4);
   
   
      /* A function (A4) that takes a float (A5) and returns a pointer (A6) to an 
       * int (A7) */
      extern int A7 * A6 (A4 x2)(float A5 x);
   
      /* A function (A1) that takes a int (A2) and that returns a pointer (A3) to 
       * a function (A4) that takes a float (A5) and returns a pointer (A6) to an 
       * int (A7) */
      int A7 * A6 (A4 * A3 (A1 x3)(int A2 x))(float A5) {
         return & x2;
      }
   

        int A2 (A1 )[]

        int A2 /*(A1 )*/[]

Handling of predefined GCC attributes

• GCC name attributes:
  
  section, constructor, destructor, unused, weak, no_instrument_function, noreturn, alias, no_check_memory_usage, dllinport, dllexport, exception, model
  
  Note: the "noreturn" attribute would be more appropriately qualified as a function type attribute. But we classify it as a name attribute to make it easier to support a similarly named MSVC attribute.
  
  
• GCC function type attributes:
  
  fconst (printed as "const"), format, regparm, stdcall, cdecl, longcall
  
  I was not able to completely decipher the position in which these attributes must go. So, the CIL elaborator knows these names and applies the following rules:
  • All of the name attributes that appear in the specifier part (i.e. at the beginning) of a declaration are associated with all declared names.
    
    
  • All of the name attributes that appear at the end of a declarator are associated with the particular name being declared.
    
    
  • More complicated is the handling of the function type attributes, since there can be more than one function in a single declaration (a function returning a pointer to a function). Lacking any real understanding of how GCC handles this, I attach the function type attribute to the "nearest" function. This means that if a pointer to a function is "nearby" the attribute will be correctly associated with the function. In truth I pray that nobody uses declarations as that of x3 above.

Handling of predefined MSVC attributes

7  The CIL Driver

bin/cilly --save-temps -D HAPPY_MOOD -I myincludes hello.c -o hello

• preprocessing using the -D and -I arguments with the resulting file left in hello.i,
• the invocation of the cilly.asm application which parses hello.i converts it to CIL and the pretty-prints it to hello.cil.c
• another round of preprocessing with the result placed in hello.cil.i
• the true compilation with the result in hello.cil.o
• a linking phase with the result in hello

make CC="bin/cilly" LD="bin/cilly"

bin/cilly --mode=MSVC /D HAPPY_MOOD /I myincludes hello.c /Fe hello.exe

bin/cilly --dologwrites -D HAPPY_MOOD -I myincludes hello.c -o hello.exe

make CC="bin/cilly --save-temps --dologwrites --merge"

make CC="bin/cilly --save-temps --dologwrites --merge --leavealone=foo --leavealone=bar"

• If merging is off
  1. For every file file.c to compile
     1. Preprocess the file with the given arguments to produce file.i
     2. Invoke cilly.asm to produce a file.cil.c
     3. Preprocess to file.cil.i
     4. Invoke the underlying compiler to produce file.cil.o
  2. Link the resulting objects
• If merging is on
  1. For every file file.c to compile
     1. Preprocess the file with the given arguments to produce file.i
     2. Save the preprocessed source as file.o
  2. When linking executable hello.exe, look at every object file that must be linked and see if it actually contains preprocessed source. Pass all those files to a special merging application (described in Section 13) to produce hello.exe_comb.c
  3. Invoke cilly.asm to produce a hello.exe_comb.cil.c
  4. Preprocess to hello.exe_comb.cil.i
  5. Invoke the underlying compiler to produce hello.exe_comb.cil.o
  6. Invoke the actual linker to produce hello.exe

make CC="bin/cilly --includedir=myinclude"

7.1  cilly Options

• --mode=mode This must be the first argument if present. It makes cilly behave as a given compiled. The following modes are recognized:
  • GNUCC - the GNU C Compiler. This is the default.
  • MSVC - the Microsoft Visual C compiler. Of course, you should pass only MSVC valid options in this case.
  • AR - the archiver ar. Only the mode cr is supported and the original version of the archive is lost.
• --help Prints a list of the options supported.
• --verbose Prints lots of messages about what is going on.
• --stages Less than --verbose but lets you see what cilly is doing.
• --merge This tells cilly to first attempt to collect into one source file all of the sources that make your application, and then to apply cilly.asm on the resulting source. The sequence of actions in this case is described above and the merger itself is described in Section 13.
  
  
• --leavealone=xxx. Do not merge and do not present to CIL the files whose basename is "xxx". These files are compiled as usual and linked in at the end.
• --includedir=xxx. Override the include files with those in the given directory. The given directory is the same name that was given an an argument to the patcher (see Section 14). In particular this means that that directory contains subdirectories named based on the current compiler version. The patcher creates those directories.
• --usecabs. Do not CIL, but instead just parse the source and print its AST out. This should looked like the preprocessed file. This is useful when you suspect that the conversion to CIL phase changes the meaning of the program.
• --save-temps=xxx. Temporary files are preserved in the xxx directory. For example, the output of CIL will be put in a file named *.cil.c.
• --save-temps. Temporay files are preserved in the current directory.

7.2  cilly.asm Options

• --version output version information and exit
• --verbose Print lots of random stuff. This is passed on from cilly
• --warnall Show all warnings.
• --debug=xxx turns on debugging flag xxx
• --nodebug=xxx turns off debugging flag xxx
• --flush Flush the output streams often (aids debugging).
• --check Run a consistency check over the CIL after every operation.
• --nocheck turns off consistency checking of CIL.
• --noPrintLn Don't output #line directives in the output.
• --commPrintLn Print #line directives in the output, but put them in comments.
• --log=xxx Set the name of the log file. By default stderr is used
• --MSVC Enable MSVC compatibility. Default is GNU.
• --ignore-merge-conflicts ignore merging conflicts.
• --extrafiles=filename: the name of a file that contains a list of additional files to process, separated by whitespace.
• --stats Print statistics about the running time of the parser, conversion to CIL, etc. Also prints memory-usage statistics. You can time parts of your own code as well. Calling (Stats.time “label” func arg) will evaluate (func arg) and remember how long this takes. If you call Stats.time repeatedly with the same label, CIL will report the aggregate time.
  
  If available, CIL uses the x86 performance counters for these stats. This is very precise, but results in “wall-clock time.” To report only user-mode time, find the call to Stats.reset in main.ml, and change it to Stats.reset false.
  
  Lowering Options
• --noLowerConstants do not lower constant expressions.
• --noInsertImplicitCasts do not insert implicit casts.
• --forceRLArgEval Forces right to left evaluation of function arguments.
• --disallowDuplication Prevent small chunks of code from being duplicated.
• --keepunused Do not remove the unused variables and types.
• --rmUnusedInlines Delete any unused inline functions. This is the default in MSVC mode.
  
  Output Options:
• --printCilAsIs Do not try to simplify the CIL when printing. Without this flag, CIL will attempt to produce prettier output by e.g. changing while(1) into more meaningful loops.
• --noWrap do not wrap long lines when printing
• --out=xxx the name of the output CIL file. cilly sets this for you.
• --mergedout=xxx specify the name of the merged file
• --cabsonly=xxx CABS output file name
  
  Selected features. See Section 8 for more information.
• --dologcalls. Insert code in the processed source to print the name of functions as are called. Implemented in src/ext/logcalls.ml.
• --dologwrites. Insert code in the processed source to print the address of all memory writes. Implemented in src/ext/logwrites.ml.
• --dooneRet. Make each function have at most one 'return'. Implemented in src/ext/oneret.ml.
• --dostackGuard. Instrument function calls and returns to maintain a separate stack for return addresses. Implemeted in src/ext/heapify.ml.
• --domakeCFG. Make the program look more like a CFG. Implemented in src/cil.ml.
• --dopartial. Do interprocedural partial evaluation and constant folding. Implemented in src/ext/partial.ml.
• --dosimpleMem. Simplify all memory expressions. Implemented in src/ext/simplemem.ml.
  
  For an up-to-date list of available options, run cilly.asm --help.

8  Library of CIL Modules

8.1  Control-Flow Graphs

8.1.1  The CFG module (new in CIL 1.3.5)

8.1.2  Simplified control flow

  int foo (int predicate) {
    int x = 0;
    switch (predicate) {
      case 0: return 111;
      case 1: x = x + 1;
      case 2: return (x+3);
      case 3: break;
      default: return 222;
    }
    return 333;
  }

8.2  Data flow analysis framework

8.3  Dominators

8.4  Points-to Analysis

• Not based on C types (inferred pointer relationships are sound despite most kinds of C casts)
• One level of subtyping
• One level of context sensitivity (Golf only)
• Monomorphic type structures
• Field insensitive (fields of structs are conflated)
• Demand-driven (points-to queries are solved on demand)
• Handle function pointers

• Ptranal.may_alias: Cil.exp -> Cil.exp -> bool. If true, the two expressions may have the same value.
• Ptranal.resolve_lval: Cil.lval -> (Cil.varinfo list). Returns the list of variables to which the given left-hand value may point.
• Ptranal.resolve_exp: Cil.exp -> (Cil.varinfo list). Returns the list of variables to which the given expression may point.
• Ptranal.resolve_funptr: Cil.exp -> (Cil.fundec list). Returns the list of functions to which the given expression may point.

• Ptranal.no_sub: bool ref. If true, subtyping is disabled. Associated commandline option: --ptr_unify.
• Ptranal.analyze_mono: bool ref. (Golf only) If true, context sensitivity is disabled and the analysis is effectively monomorphic. Commandline option: --ptr_mono.
• Ptranal.smart_aliases: bool ref. (Golf only) If true, “smart” disambiguation of aliases is enabled. Otherwise, aliases are computed by intersecting points-to sets. This is an experimental feature.
• Ptranal.model_strings: bool ref. Make the alias analysis model string constants by treating them as pointers to chars. Commandline option: --ptr_model_strings
• Ptranal.conservative_undefineds: bool ref. Make the most pessimistic assumptions about globals if an undefined function is present. Such a function can write to every global variable. Commandline option: --ptr_conservative

• Ptranal.debug_may_aliases. Print the may-alias relationship of each pair of expressions in the program. Commandline option: --ptr_may_aliases.
• Ptranal.print_constraints: bool ref. If true, the analysis will print each constraint as it is generated.
• Ptranal.print_types: bool ref. If true, the analysis will print the inferred type of each variable in the program.
  
  If Ptranal.analyze_mono and Ptranal.no_sub are both true, this output is sufficient to reconstruct the points-to graph. One nice feature is that there is a pretty printer for recursive types, so the print routine does not loop.
• Ptranal.compute_results: bool ref. If true, the analysis will print out the points-to set of each variable in the program. This will essentially serialize the points-to graph.

8.5  StackGuard

  int dangerous() {
    char array[10];
    scanf("%s",array); // possible buffer overrun!
  }

  int main () {
    return dangerous();
  }

8.6  Heapify

  int dangerous() {
    char array[10];
    scanf("%s",array); // possible buffer overrun!
  }

  int main () {
    return dangerous();
  }

8.7  One Return

  int foo (int predicate) {
    if (predicate <= 0) {
      return 1;
    } else {
      if (predicate > 5)
        return 2;
      return 3;
    }
  }

8.8  Partial Evaluation and Constant Folding

  int foo(int x, int y) {
    int unknown;
    if (unknown)
      return y+2;     
    return x+3;      
  }

  int main () {
    int a,b,c;
    a = foo(5,7) + foo(6,7);
    b = 4;
    c = b * b;      
    if (b > c)     
      return b-c;
    else
      return b+c; 
  }

8.9  Reaching Definitions

• computeRDs – Computes reaching definitions. Requires that CFG information has already been computed for each statement.
• ReachingDef.stmtStartData – contains reaching definition data after computeRDs is called.
• ReachingDef.defIdStmtHash – Contains a mapping from definition IDs to the ID of the statement in which the definition occurs.
• getRDs – Takes a statement ID and returns reaching definition data for that statement.
• instrRDs – Takes a list of instructions and the definitions that reach the first instruction, and for each instruction calculates the definitions that reach either into or out of that instruction.
• rdVisitorClass – A subclass of nopCilVisitor that can be extended such that the current reaching definition data is available when expressions are visited through the get_cur_iosh method of the class.

8.10  Available Expressions

• computeAEs – Computes available expressions. Requires that CFG information has already been comptued for each statement.
• AvailableExps.stmtStartData – Contains available expressions data for each statement after computeAEs has been called.
• getAEs – Takes a statement ID and returns available expression data for that statement.
• instrAEs – Takes a list of instructions and the availalbe expressions at the first instruction, and for each instruction calculates the expressions available on entering or exiting each instruction.
• aeVisitorClass – A subclass of nopCilVisitor that can be extended such that the current available expressions data is available when expressions are visited through the get_cur_eh method of the class.

8.11  Liveness Analysis

• computeLiveness – Computes live variables. Requires that CFG information has already been computed for each statement.
• LiveFlow.stmtStartData – Contains live variable data for each statement after computeLiveness has been called.

• –doliveness – Instructs cilly to comptue liveness information and to print on standard out the variables live at the points specified by –live_func and live_label. If both are ommitted, then nothing is printed.
• –live_func – The name of the function whose liveness data is of interest. If –live_label is ommitted, then data for each statement is printed.
• –live_label – The name of the label at which the liveness data will be printed.

8.12  Dead Code Elimination

• elim_dead_code – Performs dead code elimination on a function. Requires that CFG information has already been computed (Section 8.1).
• dce – Performs dead code elimination on an entire file. Requires that CFG information has already been computed.

8.13  Simple Memory Operations

  int main () {
    int ***three;
    int **two;
    ***three = **two; 
  } 

8.14  Simple Three-Address Code

 basic::=
    Const _ 
    Addrof(Var v, NoOffset)
    StartOf(Var v, NoOffset)
    Lval(Var v, off), where v is a variable whose address is not taken
                      and off contains only "basic"

 exp::=
    basic
    Lval(Mem basic, NoOffset)
    BinOp(bop, basic, basic)
    UnOp(uop, basic)
    CastE(t, basic)
   
 lval ::= 
    Mem basic, NoOffset
    Var v, off, where v is a variable whose address is not taken and off
                contains only "basic"

  int main() {
    struct mystruct {
      int a;
      int b;
    } m;
    int local;
    int arr[3];
    int *ptr;

    ptr = &local;
    m.a = local + sizeof(m) + arr[2];
    return m.a; 
  } 

8.15  Converting C to C++

1. Any variables that use C++ keywords as identifiers are renamed.
2. C allows global variables to have multiple declarations and multiple (equivalent) definitions. This transformation removes all but one declaration and all but one definition.
3. __inline is #defined to inline, and __restrict is #defined to nothing.
4. C allows function pointers with no specified arguments to be used on any argument list. To make C++ accept this code, we insert a cast from the function pointer to a type that matches the arguments. Of course, this does nothing to guarantee that the pointer actually has that type.
5. Makes casts from int to enum types explicit. (CIL changes enum constants to int constants, but doesn't use a cast.)

9  Controlling CIL

#pragma cilnoremove("func1", "var2", "type foo", "struct bar")

10  GCC Extensions

1. Nested function definitions.
2. Constructing function calls.
3. Naming an expression's type.
4. Complex numbers
5. Hex floats
6. Subscripts on non-lvalue arrays.
7. Forward function parameter declarations

1. Attributes for functions, variables and types. In fact, we have a clear specification (see Section 6.4) of how attributes are interpreted. The specification extends that of gcc.
2. Old-style function definitions and prototypes. These are translated to new-style.
3. Locally-declared labels. As part of the translation to CIL, we generate new labels as needed.
4. Labels as values and computed goto. This allows a program to take the address of a label and to manipulate it as any value and also to perform a computed goto. We compile this by assigning each label whose address is taken a small integer that acts as its address. Every computed goto in the body of the function is replaced with a switch statement. If you want to invoke the label from another function, you are on your own (the gcc documentation says the same.)
5. Generalized lvalues. You can write code like (a, b) += 5 and it gets translated to CIL.
6. Conditionals with omitted operands. Things like x ? : y are translated to CIL.
7. Double word integers. The type long long and the LL suffix on constants is understood. This is currently interpreted as 64-bit integers.
8. Local arrays of variable length. These are converted to uses of alloca, the array variable is replaced with a pointer to the allocated array and the instances of sizeof(a) are adjusted to return the size of the array and not the size of the pointer.
9. Non-constant local initializers. Like all local initializers these are compiled into assignments.
10. Compound literals. These are also turned into assignments.
11. Designated initializers. The CIL parser actually supports the full ISO syntax for initializers, which is more than both gcc and MSVC. I (George) think that this is the most complicated part of the C language and whoever designed it should be banned from ever designing languages again.
12. Case ranges. These are compiled into separate cases. There is no code duplication, just a larger number of case statements.
13. Transparent unions. This is a strange feature that allows you to define a function whose formal argument has a (tranparent) union type, but the argument is called as if it were the first element of the union. This is compiled away by saying that the type of the formal argument is that of the first field, and the first thing in the function body we copy the formal into a union.
    
    
14. Inline assembly-language. The full syntax is supported and it is carried as such in CIL.
    
    
15. Function names as strings. The identifiers __FUNCTION__ and __PRETTY_FUNCTION__ are replaced with string literals.
    
    
16. Keywords typeof, alignof, inline are supported.

11  CIL Limitations

• CIL operates after preprocessing. If you need to see comments, for example, you cannot use CIL. But you can use attributes and pragmas instead. And there is some support to help you patch the include files before they are seen by the preprocessor. For example, this is how we turn some #defines that we don't like into function calls.
  
  
• CIL does transform the code in a non-trivial way. This is done in order to make most analyses easier. But if you want to see the code e1, e2++ exactly as it appears in the code, then you should not use CIL.
  
  
• CIL removes all local scopes and moves all variables to function scope. It also separates a declaration with an initializer into a declaration plus an assignment. The unfortunate effect of this transformation is that local variables cannot have the const qualifier.

12  Known Bugs and Limitations

• In the new versions of glibc there is a function __builtin_va_arg that takes a type as its second argument. CIL handles that through a slight trick. As it parses the function it changes a call like:

    mytype x = __builtin_va_arg(marker, mytype)
  

  into

   mytype x;
   __builtin_va_arg(marker, sizeof(mytype), &x);
  

  The latter form is used internally in CIL. However, the CIL pretty printer will try to emit the original code.
  
  Similarly, __builtin_types_compatible_p(t1, t2), which takes types as arguments, is represented internally as __builtin_types_compatible_p(sizeof t1, sizeof t2), but the sizeofs are removed when printing.
  
  
• The implementation of bitsSizeOf does not take into account the packing pragmas. However it was tested to be accurate on cygwin/gcc-2.95.3, Linux/gcc-2.95.3 and on Windows/MSVC.
  
  
• We do not support tri-graph sequences (ISO 5.2.1.1).
  
  
• GCC has a strange feature called “extern inline”. Such a function can be defined twice: first with the “extern inline” specifier and the second time without it. If optimizations are turned off then the “extern inline” definition is considered a prototype (its body is ignored). If optimizations are turned on then the extern inline function is inlined at all of its occurrences from the point of its definition all the way to the point where the (optional) second definition appears. No body is generated for an extern inline function. A body is generated for the real definition and that one is used in the rest of the file.
  
  CIL will rename your extern inline function (and its uses) with the suffix __extinline. This means that if you have two such definition, that do different things and the optimizations are not on, then the CIL version might compute a different answer !
  
  Also, if you have multiple extern inline declarations then CIL will ignore but the first one. This is not so bad because GCC itself would not like it.
  
  
• There are still a number of bugs in handling some obscure features of GCC. For example, when you use variable-length arrays, CIL turns them into calls to alloca. This means that they are deallocated when the function returns and not when the local scope ends.
  
  Variable-length arrays are not supported as fields of a struct or union.
  
  
• CIL cannot parse arbitrary #pragma directives. Their syntax must follow gcc's attribute syntax to be understood. If you need a pragma that does not follow gcc syntax, add that pragma's name to no_parse_pragma in src/frontc/clexer.mll to indicate that CIL should treat that pragma as a monolithic string rather than try to parse its arguments.
  
  CIL cannot parse a line containing an empty #pragma.
  
  
• CIL only parses #pragma directives at the "top level", this is, outside of any enum, structure, union, or function definitions.
  
  If your compiler uses pragmas in places other than the top-level, you may have to preprocess the sources in a special way (sed, perl, etc.) to remove pragmas from these locations.
  
  
• CIL cannot parse the following code (fixing this problem would require extensive hacking of the LALR grammar):

  
  int bar(int ()); // This prototype cannot be parsed
  int bar(int x()); // If you add a name to the function, it works
  int bar(int (*)()); // This also works (and it is more appropriate)
  

  
  
  
• CIL also cannot parse certain K&R old-style prototypes with missing return type:

  
  g(); // This cannot be parsed
  int g(); // This is Ok
  

  
  
  
• CIL does not understand some obscure combinations of type specifiers (“signed” and “unsigned” applied to typedefs that themselves contain a sign specification; you could argue that this should not be allowed anyway):

  
  typedef signed char __s8;
  __s8 unsigned uchartest; // This is unsigned char for gcc
  

  
  
  
• The statement x = 3 + x ++ will perform the increment of x before the assignment, while gcc delays the increment after the assignment. It turned out that this behavior is much easier to implement than gcc's one, and either way is correct (since the behavior is unspecified in this case). Similarly, if you write x = x ++; then CIL will perform the increment before the assignment, whereas GCC and MSVC will perform it after the assignment.

13  Using the merger

1. Detect what are all the sources that make a project and with what compiler arguments they are compiled.
   
   
2. Merge all of the source files into a single file.

• File-scope names (static globals, names of types defined with typedef, and structure/union/enumeration tags) are given new names if they conflict with declarations from previously processed sources. The new name is formed by appending the suffix ___n, where n is a unique integer identifier. Then the new names are applied to their occurrences in the file.
  
  
• Non-static declarations and definitions of globals are never renamed. But we try to remove duplicate ones. Equality of globals is detected by comparing the printed form of the global (ignoring the line number directives) after the body has been alpha-converted. This process is intended to remove those declarations (e.g. function prototypes) that originate from the same include file. Similarly, we try to eliminate duplicate definitions of inline functions, since these occasionally appear in include files.
  
  
• The types of all global declarations with the same name from all files are compared for type isomorphism. During this process, the merger detects all those isomorphisms between structures and type definitions that are required for the merged program to be legal. Such structure tags and typenames are coalesced and given the same name.
  
  
• Besides the structure tags and type names that are required to be isomorphic, the merger also tries to coalesce definitions of structures and types with the same name from different file. However, in this case the merger will not give an error if such definitions are not isomorphic; it will just use different names for them.
  
  
• In rare situations, it can happen that a file-local global in encountered first and it is not renamed, only to discover later when processing another file that there is an external symbol with the same name. In this case, a second pass is made over the merged file to rename the file-local symbol.

struct foo; // Forward declaration
extern struct foo *global;

struct bar {
 int x;
 struct bar *next;
};
extern struct bar *global;
struct foo {
 int y;
};
extern struct foo another;
void main() {
}

• gcc file1.c file2.c -o a.out
  

  
  
  

• gcc -c file1.c -o file1.o
  gcc -c file2.c -o file2.o
  ld file1.o file2.o -o a.out
  

  
  
  

• gcc -c file1.c -o file1.o
  gcc -c file2.c -o file2.o
  ar r libfile2.a file2.o
  gcc file1.o libfile2.a -o a.out
  

  
  
  

• gcc -c file1.c -o file1.o
  gcc -c file2.c -o file2.o
  ar r libfile2.a file2.o
  gcc file1.o -lfile2 -o a.out
  

// from file1.c
struct foo; // Forward declaration
extern struct foo *global;

// from file2.c
struct foo {
 int x;
 struct foo *next;
};
struct foo___1 {
 int y;
};
extern struct foo___1 another;

14  Using the patcher

bin/patcher [options]

Options:
  --help       Prints this help message
  --verbose    Prints a lot of information about what is being done
  --mode=xxx   What tool to emulate: 
                GNUCC     - GNU CC
                MSVC      - MS VC cl compiler

  --dest=xxx   The destination directory. Will make one if it does not exist
  --patch=xxx  Patch file (can be specified multiple times)
  --ppargs=xxx An argument to be passed to the preprocessor (can be specified
               multiple times)

  --ufile=xxx  A user-include file to be patched (treated as \#include "xxx")
  --sfile=xxx  A system-include file to be patched (treated as \#include <xxx>)
 
  --clean       Remove all files in the destination directory
  --dumpversion Print the version name used for the current compiler

 All of the other arguments are passed to the preprocessor. You should pass
 enough arguments (e.g., include directories) so that the patcher can find the
 right include files to be patched.

/usr/home/necula/cil/include/gcc_2.95.3-5

<<< flags
patterns
===
replacement
>>>

• file=foo.h - will only apply the patch on files whose name is foo.h.
• optional - this means that it is Ok if the current patch does not match any of the processed files.
• group=foo - will add this patch to the named group. If this is not specified then a unique group is created to contain just the current patch. When all files specified in the command line have been patched, an error message is generated for all groups for whom no member patch was used. We use this mechanism to receive notice when the patch triggers are out-dated with respect to the new include files.
• system=sysname - will only consider this pattern on a given operating system. The “sysname” is reported by the “$Ô” variable in Perl, except that Windows is always considered to have sysname “cygwin.” For Linux use “linux” (capitalization matters).
• ateof - In this case the patterns are ignored and the replacement text is placed at the end of the patched file. Use the file flag if you want to restrict the files in which this replacement is performed.
• atsof - The patterns are ignored and the replacement text is placed at the start of the patched file. Uf the file flag to restrict the application of this patch to a certain file.
• disabled - Use this flag if you want to disable the pattern.

15  Debugging support

cilly -c hello.c 

ALT-X my-camldebug

cilly --ocamldebug -c hello.c 

16  Who Says C is Simple?

16.1  Standard C

1. Why does the following code return 0 for most values of x? (This should be easy.)

   
     int x;
     return x == (1 && x);
   

   See the CIL output for this code fragment
   
   
2. Why does the following code return 0 and not -1? (Answer: because sizeof is unsigned, thus the result of the subtraction is unsigned, thus the shift is logical.)

   
    return ((1 - sizeof(int)) >> 32);
   

   See the CIL output for this code fragment
   
   
3. Scoping rules can be tricky. This function returns 5.

   
   int x = 5;
   int f() {
     int x = 3;
     {
       extern int x;
       return x;
     }
   }
   

   See the CIL output for this code fragment
   
   
4. Functions and function pointers are implicitly converted to each other.

   
   int (*pf)(void);
   int f(void) {
   
      pf = &f; // This looks ok
      pf = ***f; // Dereference a function?
      pf(); // Invoke a function pointer?     
      (****pf)();  // Looks strange but Ok
      (***************f)(); // Also Ok             
   }
   

   See the CIL output for this code fragment
   
   
5. Initializer with designators are one of the hardest parts about ISO C. Neither MSVC or GCC implement them fully. GCC comes close though. What is the final value of i.nested.y and i.nested.z? (Answer: 2 and respectively 6).

   
   struct { 
      int x; 
      struct { 
          int y, z; 
      } nested;
   } i = { .nested.y = 5, 6, .x = 1, 2 };               
   

   See the CIL output for this code fragment
   
   
6. This is from c-torture. This function returns 1.

   
   typedef struct
   {
     char *key;
     char *value;
   } T1;
   
   typedef struct
   {
     long type;
     char *value;
   } T3;
   
   T1 a[] =
   {
     {
       "",
       ((char *)&((T3) {1, (char *) 1}))
     }
   };
   int main() {
      T3 *pt3 = (T3*)a[0].value;
      return pt3->value;
   }
   

   See the CIL output for this code fragment
   
   
7. Another one with constructed literals. This one is legal according to the GCC documentation but somehow GCC chokes on (it works in CIL though). This code returns 2.

   
    return ((int []){1,2,3,4})[1];
   

   See the CIL output for this code fragment
   
   
8. In the example below there is one copy of “bar” and two copies of “pbar” (static prototypes at block scope have file scope, while for all other types they have block scope).

   
     int foo() {
        static bar();
        static (*pbar)() = bar;
   
     }
   
     static bar() { 
       return 1;
     }
   
     static (*pbar)() = 0;
   

   See the CIL output for this code fragment
   
   
9. Two years after heavy use of CIL, by us and others, I discovered a bug in the parser. The return value of the following function depends on what precedence you give to casts and unary minus:

   
     unsigned long foo() {
       return (unsigned long) - 1 / 8;
     }
   

   See the CIL output for this code fragment
   
   The correct interpretation is ((unsigned long) - 1) / 8, which is a relatively large number, as opposed to (unsigned long) (- 1 / 8), which is 0.

16.2  GCC ugliness

1. GCC has generalized lvalues. You can take the address of a lot of strange things:

   
     int x, y, z;
     return &(x ? y : z) - & (x++, x);
   

   See the CIL output for this code fragment
   
   
2. GCC lets you omit the second component of a conditional expression.

   
     extern int f();
     return f() ? : -1; // Returns the result of f unless it is 0
   

   See the CIL output for this code fragment
   
   
3. Computed jumps can be tricky. CIL compiles them away in a fairly clean way but you are on your own if you try to jump into another function this way.

   
   static void *jtab[2]; // A jump table
   static int doit(int x){
    
     static int jtab_init = 0;
     if(!jtab_init) { // Initialize the jump table
       jtab[0] = &&lbl1;
       jtab[1] = &&lbl2;
       jtab_init = 1;
     }
     goto *jtab[x]; // Jump through the table
   lbl1:
     return 0;
   lbl2:
     return 1;
   }
    
   int main(void){
     if (doit(0) != 0) exit(1);
     if (doit(1) != 1) exit(1);
     exit(0);
   }
   

   See the CIL output for this code fragment
   
   
4. A cute little example that we made up. What is the returned value? (Answer: 1);

   
    return ({goto L; 0;}) && ({L: 5;});
   

   See the CIL output for this code fragment
   
   
5. extern inline is a strange feature of GNU C. Can you guess what the following code computes?

   
   extern inline foo(void) { return 1; }
   int firstuse(void) { return foo(); }
   
   // A second, incompatible definition of foo
   int foo(void) { return 2; }
   
   int main() {
       return foo() + firstuse();
   }
   

   See the CIL output for this code fragment
   
   The answer depends on whether the optimizations are turned on. If they are then the answer is 3 (the first definition is inlined at all occurrences until the second definition). If the optimizations are off, then the first definition is ignore (treated like a prototype) and the answer is 4.
   
   CIL will misbehave on this example, if the optimizations are turned off (it always returns 3).
   
   
6. GCC allows you to cast an object of a type T into a union as long as the union has a field of that type:

   
   union u { 
      int i; 
      struct s { 
         int i1, i2;
      } s;
   };
   
   union u x = (union u)6;
   
   int main() {
     struct s y = {1, 2};
     union u  z = (union u)y;
   }
   

   See the CIL output for this code fragment
   
   
7. GCC allows you to use the __mode__ attribute to specify the size of the integer instead of the standard char, short and so on:

   
   int __attribute__ ((__mode__ (  __QI__ ))) i8;
   int __attribute__ ((__mode__ (  __HI__ ))) i16;
   int __attribute__ ((__mode__ (  __SI__ ))) i32;
   int __attribute__ ((__mode__ (  __DI__ ))) i64;
   

   See the CIL output for this code fragment
   
   
8. The “alias” attribute on a function declaration tells the linker to treat this declaration as another name for the specified function. CIL will replace the declaration with a trampoline function pointing to the specified target.

   
       static int bar(int x, char y) {
         return x + y;
       }
   
       //foo is considered another name for bar.
       int foo(int x, char y) __attribute__((alias("bar")));
   

   See the CIL output for this code fragment

16.3  Microsoft VC ugliness

1. Why does the following code return 0 and not -1? (Answer: because of a bug in Microsoft Visual C. It thinks that the shift is unsigned just because the second operator is unsigned. CIL reproduces this bug when in MSVC mode.)

   
    return -3 >> (8 * sizeof(int));
   

   
   
   
2. Unnamed fields in a structure seem really strange at first. It seems that Microsoft Visual C introduced this extension, then GCC picked it up (but in the process implemented it wrongly: in GCC the field y overlaps with x!).

   
   struct {
     int x;
     struct {
        int y, z;
        struct {
          int u, v;
        };
    };
   } a;
   return a.x + a.y + a.z + a.u + a.v;
   

   See the CIL output for this code fragment

17  Authors

18  License

• George C. Necula <necula@cs.berkeley.edu>
• Scott McPeak <smcpeak@cs.berkeley.edu>
• Wes Weimer <weimer@cs.berkeley.edu>
• Ben Liblit <liblit@cs.wisc.edu>

19  Bug reports

20  Changes

• May 20, 2006: Released version 1.3.5
• May 19, 2006: Makefile.cil.in/Makefile.cil have been renamed Makefile.in/Makefile. And maincil.ml has been renamed main.ml.
• May 18, 2006: Added a new module Cfg to compute the control-flow graph. Unlike the older Cil.computeCFGInfo, the new version does not modify the code.
• May 18, 2006: Added several new analyses: reaching definitions, available expressions, liveness analysis, and dead code elimination. See Section 8.
• May 2, 2006: Added a flag --noInsertImplicitCasts. When this flag is used, CIL code will only include casts inserted by the programmer. Implicit coercions are not changed to explicit casts.
• April 16, 2006: Minor improvements to the --stats flag (Section 7.2). We now use Pentium performance counters by default, if your processor supports them.
• April 10, 2006: Extended machdep.c to support microcontroller compilers where the struct alignment of integer types does not match the size of the type. Thanks to Nathan Cooprider for the patch.
• April 6, 2006: Fix for global initializers of unions when the union field being initialized is not the first one, and for missing initializers of unions when the first field is not the largest field.
• April 6, 2006: Fix for bitfields in the SFI module.
• April 6, 2006: Various fixes for gcc attributes. packed, section, and always_inline attributes are now parsed correctly. Also fixed printing of attributes on enum types.
• March 30, 2006: Fix for rmtemps.ml, which deletes unused inline functions. When in gcc mode CIL now leaves all inline functions in place, since gcc treats these as externally visible.
• March 15, 2006: Fix for typeof(e) when e has type void.
• March 3, 2006: Assume inline assembly instructions can fall through for the purposes of adding return statements. Thanks to Nathan Cooprider for the patch.
• February 27, 2006: Fix for extern inline functions when the output of CIL is fed back into CIL.
• January 30, 2006: Fix parsing of switch without braces.
• January 30, 2006: Allow `$' to appear in identifiers.
• January 13, 2006: Added support for gcc's alias attribute on functions. See Section 16.2, item 8.
• December 9, 2005: Christoph Spiel fixed the Golf and Olf modules so that Golf can be used with the points-to analysis. He also added performance fixes and cleaned up the documentation.
• December 1, 2005: Major rewrite of the ext/callgraph module.
• December 1, 2005: Preserve enumeration constants in CIL. Default is the old behavior to replace them with integers.
• November 30, 2005: Added support for many GCC __builtin functions.
• November 30, 2005: Added the EXTRAFEATURES configure option, making it easier to add Features to the build process.
• November 23, 2005: In MSVC mode do not remove any locals whose name appears as a substring in an inline assembly.
• November 23, 2005: Do not add a return to functions that have the noreturn attribute.
• November 22, 2005: Released version 1.3.4
• November 21, 2005: Performance and correctness fixes for the Points-to Analysis module. Thanks to Christoph Spiel for the patches.
• October 5, 2005: CIL now builds on SPARC/Solaris. Thanks to Nick Petroni and Remco van Engelen for the patches.
• September 26, 2005: CIL no longer uses the `-I-' flag by default when preprocessing with gcc.
• August 24, 2005: Added a command-line option “--forceRLArgEval” that forces function arguments to be evaluated right-to-left. This is the default behavior in unoptimized gcc and MSVC, but the order of evaluation is undefined when using optimizations, unless you apply this CIL transformation. This flag does not affect the order of evaluation of e.g. binary operators, which remains undefined. Thanks to Nathan Cooprider for the patch.
• August 9, 2005: Fixed merging when there are more than 20 input files.
• August 3, 2005: When merging, it is now an error to declare the same global variable twice with different initializers.
• July 27, 2005: Fixed bug in transparent unions.
• July 27, 2005: Fixed bug in collectInitializer. Thanks to Benjamin Monate for the patch.
• July 26, 2005: Better support for extended inline assembly in gcc.
• July 26, 2005: Added many more gcc __builtin* functions to CIL. Most are treated as Call instructions, but a few are translated into expressions so that they can be used in global initializers. For example, “__builtin_offsetof(t, field)” is rewritten as “&((t*)0)->field”, the traditional way of calculating an offset.
• July 18, 2005: Fixed bug in the constant folding of shifts when the second argument was negative or too large.
• July 18, 2005: Fixed bug where casts were not always inserted in function calls.
• June 10, 2005: Fixed bug in the code that makes implicit returns explicit. We weren't handling switch blocks correctly.
• June 1, 2005: Released version 1.3.3
• May 31, 2005: Fixed handling of noreturn attribute for function pointers.
• May 30, 2005: Fixed bugs in the handling of constructors in gcc.
• May 30, 2005: Fixed bugs in the generation of global variable IDs.
• May 27, 2005: Reimplemented the translation of function calls so that we can intercept some builtins. This is important for the uses of __builtin_constant_p in constants.
• May 27, 2005: Export the plainCilPrinter, for debugging.
• May 27, 2005: Fixed bug with printing of const attribute for arrays.
• May 27, 2005: Fixed bug in generation of type signatures. Now they should not contain expressions anymore, so you can use structural equality. This used to lead to Out_of_Memory exceptions.
• May 27, 2005: Fixed bug in type comparisons using TBuiltin_va_list.
• May 27, 2005: Improved the constant folding in array lengths and case expressions.
• May 27, 2005: Added the __builtin_frame_address to the set of gcc builtins.
• May 27, 2005: Added the CIL project to SourceForge.
• April 23, 2005: The cattr field was not visited.
• March 6, 2005: Debian packaging support
• February 16, 2005: Merger fixes.
• February 11, 2005: Fixed a bug in --dopartial. Thanks to Nathan Cooprider for this fix.
• January 31, 2005: Make sure the input file is closed even if a parsing error is encountered.
• January 11, 2005: Released version 1.3.2
• January 11, 2005: Fixed printing of integer constants whose integer kind is shorter than an int.
• January 11, 2005: Added checks for negative size arrays and arrays too big.
• January 10, 2005: Added support for GCC attribute “volatile” for tunctions (as a synonim for noreturn).
• January 10, 2005: Improved the comparison of array sizes when comparing array types.
• January 10, 2005: Fixed handling of shell metacharacters in the cilly command lione.
• January 10, 2005: Fixed dropping of cast in initialization of local variable with the result of a function call.
• January 10, 2005: Fixed some structural comparisons that were broken in the Ocaml 3.08.
• January 10, 2005: Fixed the unrollType function to not forget attributes.
• January 10, 2005: Better keeping track of locations of function prototypes and definitions.
• January 10, 2005: Fixed bug with the expansion of enumeration constants in attributes.
• October 18, 2004: Fixed a bug in cabsvisit.ml. CIl would wrap a BLOCK around a single atom unnecessarily.
• August 7, 2004: Released version 1.3.1
• August 4, 2004: Fixed a bug in splitting of structs using --dosimplify
• July 29, 2004: Minor changes to the type typeSig (type signatures) to ensure that they do not contain types, so that you can do structural comparison without danger of nontermination.
• July 28, 2004: Ocaml version 3.08 is required. Numerous small changes while porting to Ocaml 3.08.
• July 7, 2004: Released version 1.2.6
• July 2, 2004: Character constants such as 'c' should have type int, not char. Added a utility function Cil.charConstToInt that sign-extends chars greater than 128, if needed.
• July 2, 2004: Fixed a bug that was casting values to int before applying the logical negation operator !. This caused problems for floats, and for integer types bigger than int.
• June 13, 2004: Added the field sallstmts to a function description, to hold all statements in the function.
• June 13, 2004: Added new extensions for data flow analyses, and for computing dominators.
• June 10, 2004: Force initialization of CIL at the start of Cabs2cil.
• June 9, 2004: Added support for GCC __attribute_used__
• April 7, 2004: Released version 1.2.5
• April 7, 2004: Allow now to run ./configure CC=cl and set the MSVC compiler to be the default. The MSVC driver will now select the default name of the .exe file like the CL compiler.
• April 7, 2004: Fixed a bug in the driver. The temporary files are deleted by the Perl script before the CL compiler gets to them?
• April 7, 2004: Added the - form of arguments to the MSVC driver.
• April 7, 2004: Added a few more GCC-specific string escapes, (, [, {, %, E.
• April 7, 2004: Fixed bug with continuation lines in MSVC.
• April 6, 2004: Fixed embarassing bug in the parser: the precedence of casts and unary operators was switched.
• April 5, 2004: Fixed a bug involving statements mixed between declarations containing initializers. Now we make sure that the initializers are run in the proper order with respect to the statements.
• April 5, 2004: Fixed a bug in the merger. The merger was keeping separate alpha renaming talbes (namespaces) for variables and types. This means that it might end up with a type and a variable named the same way, if they come from different files, which breaks an important CIL invariant.
• March 11, 2004 : Fixed a bug in the Cil.copyFunction function. The new local variables were not getting fresh IDs.
• March 5, 2004: Fixed a bug in the handling of static function prototypes in a block scope. They used to be renamed. Now we just consider them global.
• February 20, 2004: Released version 1.2.4
• February 15, 2004: Changed the parser to allow extra semicolons after field declarations.
• February 14, 2004: Changed the Errormsg functions: error, unimp, bug to not raise an exception. Instead they just set Errormsg.hadErrors.
• February 13, 2004: Change the parsing of attributes to recognize enumeration constants.
• February 10, 2004: In some versions of gcc the identifier _{thread is an identifier and in others it is a keyword. Added code during configuration to detect which is the case.
• January 7, 2004: Released version 1.2.3
• January 7, 2004: Changed the alpha renamer to be less conservative. It will remember all versions of a name that were seen and will only create a new name if we have not seen one.
• December 30, 2003 : Extended the cilly command to understand better linker command options -lfoo.
• December 5, 2003: Added markup commands to the pretty-printer module. Also, changed the “@<” left-flush command into “@''.
• December 4, 2003: Wide string literals are now handled directly by Cil (rather than being exploded into arrays). This is apparently handy for Microsoft Device Driver APIs that use intrinsic functions that require literal constant wide-string arguments.
• December 3, 2003: Added support for structured exception handling extensions for the Microsoft compilers.
• December 1, 2003: Fixed a Makefile bug in the generation of the Cil library (e.g., cil.cma) that was causing it to be unusable. Thanks to KEvin Millikin for pointing out this bug.
• November 26, 2003: Added support for linkage specifications (extern “C”).
• November 26, 2003: Added the ocamlutil directory to contain some utilities shared with other projects.
• November 25, 2003: Released version 1.2.2
• November 24, 2003: Fixed a bug that allowed a static local to conflict with a global with the same name that is declared later in the file.
• November 24, 2003: Removed the --keep option of the cilly driver and replaced it with --save-temps.
• November 24, 2003: Added printing of what CIL features are being run.
• November 24, 2003: Fixed a bug that resulted in attributes being dropped for integer types.
• November 11, 2003: Fixed a bug in the visitor for enumeration definitions.
• October 24, 2003: Fixed a problem in the configuration script. It was not recognizing the Ocaml version number for beta versions.
• October 15, 2003: Fixed a problem in version 1.2.1 that was preventing compilation on OCaml 3.04.
• September 17, 2003: Released version 1.2.1.
• September 7, 2003: Redesigned the interface for choosing #line directive printing styles. Cil.printLn and Cil.printLnComment have been merged into Cil.lineDirectiveStyle.
• August 8, 2003: Do not silently pad out functions calls with arguments to match the prototype.
• August 1, 2003: A variety of fixes suggested by Steve Chamberlain: initializers for externs, prohibit float literals in enum, initializers for unsized arrays were not working always, an overflow problem in Ocaml, changed the processing of attributes before struct specifiers
  
  
• July 14, 2003: Add basic support for GCC's "__thread" storage qualifier. If given, it will appear as a "thread" attribute at the top of the type of the declared object. Treatment is very similar to "__declspec(...)" in MSVC
  
  
• July 8, 2003: Fixed some of the __alignof computations. Fixed bug in the designated initializers for arrays (Array.get error).
• July 8, 2003: Fixed infinite loop bug (Stack Overflow) in the visitor for __alignof.
• July 8, 2003: Fixed bug in the conversion to CIL. A function or array argument of the GCC __typeof() was being converted to pointer type. Instead, it should be left alone, just like for sizeof.
• July 7, 2003: New Escape module provides utility functions for escaping characters and strings in accordance with C lexical rules.
  
  
• July 2, 2003: Relax CIL's rules for when two enumeration types are considered compatible. Previously CIL considered two enums to be compatible if they were the same enum. Now we follow the C99 standard.
  
  
• June 28, 2003: In the Formatparse module, Eric Haugh found and fixed a bug in the handling of lvalues of the form “lv->field.more”.
  
  
• June 28, 2003: Extended the handling of gcc command lines arguments in the Perl scripts.
  
  
• June 23, 2003: In Rmtmps module, simplified the API for customizing the root set. Clients may supply a predicate that returns true for each root global. Modifying various “referenced” fields directly is no longer supported.
  
  
• June 17, 2003: Reimplement internal utility routine Cil.escape_char. Faster and better.
  
  
• June 14, 2003: Implemented support for __attribute__s appearing between "struct" and the struct tag name (also for unions and enums), since gcc supports this as documented in section 4.30 of the gcc (2.95.3) manual
  
  
• May 30, 2003: Released the regression tests.
• May 28, 2003: Released version 1.1.2
• May 26, 2003: Add the simplify module that compiles CIL expressions into simpler expressions, similar to those that appear in a 3-address intermediate language.
• May 26, 2003: Various fixes and improvements to the pointer analysis modules.
• May 26, 2003: Added optional consistency checking for transformations.
• May 25, 2003: Added configuration support for big endian machines. Now Cil.little_endian can be used to test whether the machine is little endian or not.
• May 22, 2003: Fixed a bug in the handling of inline functions. The CIL merger used to turn these functions into “static”, which is incorrect.
• May 22, 2003: Expanded the CIL consistency checker to verify undesired sharing relationships between data structures.
• May 22, 2003: Fixed bug in the oneret CIL module: it was mishandling certain labeled return statements.
• May 5, 2003: Released version 1.0.11
• May 5, 2003: OS X (powerpc/darwin) support for CIL. Special thanks to Jeff Foster, Andy Begel and Tim Leek.
• April 30, 2003: Better description of how to use CIL for your analysis.
• April 28, 2003: Fixed a bug with --dooneRet and --doheapify. Thanks, Manos Renieris.
• April 16, 2003: Reworked management of temporary/intermediate output files in Perl driver scripts. Default behavior is now to remove all such files. To keep intermediate files, use one of the following existing flags:
  • --keepmerged for the single-file merge of all sources
  • --keep=<dir> for various other CIL and CCured output files
  • --save-temps for various gcc intermediate files; MSVC has no equivalent option
  As part of this change, some intermediate files have changed their names slightly so that new suffixes are always preceded by a period. For example, CCured output that used to appear in “foocured.c” now appears in “foo.cured.c”.
• April 7, 2003: Changed the representation of the Cil.GVar global constructor. Now it is possible to update the initializer without reconstructing the global (which in turn it would require reconstructing the list of globals that make up a program). We did this because it is often tempting to use Cil.visitCilFileSameGlobals and the Cil.GVar was the only global that could not be updated in place.
• April 6, 2003: Reimplemented parts of the cilly.pl script to make it more robust in the presence of complex compiler arguments.
• March 10, 2003: Released version 1.0.9
• March 10, 2003: Unified and documented a large number of CIL Library Modules: oneret, simplemem, makecfg, heapify, stackguard, partial. Also documented the main client interface for the pointer analysis.
• February 18, 2003: Fixed a bug in logwrites that was causing it to produce invalid C code on writes to bitfields. Thanks, David Park.
• February 15, 2003: Released version 1.0.8
• February 15, 2003: PDF versions of the manual and API are available for those who would like to print them out.
• February 14, 2003: CIL now comes bundled with alias analyses.
• February 11, 2003: Added support for adding/removing options from ./configure.
• February 3, 2003: Released version 1.0.7
• February 1, 2003: Some bug fixes in the handling of variable argument functions in new versions of gcc And glibc.
• January 29, 2003: Added the logical AND and OR operators. Exapanded the translation to CIL to handle more complicated initializers (including those that contain logical operators).
• January 28, 2003: Released version 1.0.6
• January 28, 2003: Added support for the new handling of variable-argument functions in new versions of glibc.
• January 19, 2003: Added support for declarations in interpreted constructors. Relaxed the semantics of the patterns for variables.
• January 17, 2003: Added built-in prototypes for the gcc built-in functions. Changed the pGlobal method in the printers to print the carriage return as well.
• January 9, 2003: Reworked lexer and parser's strategy for tracking source file names and line numbers to more closely match typical native compiler behavior. The visible CIL interface is unchanged.
• January 9, 2003: Changed the interface to the alpha convertor. Now you can pass a list where it will record undo information that you can use to revert the changes that it makes to the scope tables.
• January 6, 2003: Released version 1.0.5
• January 4, 2003: Changed the interface for the Formatcil module. Now the placeholders in the pattern have names. Also expanded the documentation of the Formatcil module. Now the placeholders in the pattern have names.
• January 3, 2003: Extended the rmtmps module to also remove unused labels that are generated in the conversion to CIL. This reduces the number of warnings that you get from cgcc afterwards.
• December 17, 2002: Fixed a few bugs in CIL related to the representation of string literals. The standard says that a string literal is an array. In CIL, a string literal has type pointer to character. This is Ok, except as an argument of sizeof. To support this exception, we have added to CIL the expression constructor SizeOfStr. This allowed us to fix bugs with computing sizeof("foo bar") and sizeof((char*)"foo bar") (the former is 8 and the latter is 4).
  
  
• December 8, 2002: Fixed a few bugs in the lexer and parser relating to hex and octal escapes in string literals. Also fixed the dependencies between the lexer and parser.
• December 5, 2002: Fixed visitor bugs that were causing some attributes not to be visited and some queued instructions to be dropped.
• December 3, 2002: Added a transformation to catch stack overflows. Fixed the heapify transformation.
• October 14, 2002: CIL is now available under the BSD license (see the License section or the file LICENSE). Released version 1.0.4
• October 9, 2002: More FreeBSD configuration changes, support for the GCC-ims __signed and __volatile. Thanks to Axel Simon for pointing out these problems. Released version 1.0.3
• October 8, 2002: FreeBSD configuration and porting fixes. Thanks to Axel Simon for pointing out these problems.
• September 10, 2002: Fixed bug in conversion to CIL. Now we drop all “const” qualifiers from the types of locals, even from the fields of local structures or elements of arrays.
• September 7, 2002: Extended visitor interface to distinguish visitng offsets inside lvalues from offsets inside initializer lists.
• September 7, 2002: Released version 1.0.1
• September 6, 2002: Extended the patcher with the ateof flag.
• September 4, 2002: Fixed bug in the elaboration to CIL. In some cases constant folding of || and && was computed wrong.
• September 3, 2002: Fixed the merger documentation.
• August 29, 2002: Released version 1.0.0.
• August 29, 2002: Started numbering versions with a major nubmer, minor and revisions. Released version 1.0.0.
• August 25, 2002: Fixed the implementation of the unique identifiers for global variables and composites. Now those identifiers are globally unique.
• August 24, 2002: Added to the machine-dependent configuration the sizeofvoid. It is 1 on gcc and 0 on MSVC. Extended the implementation of Cil.bitsSizeOf to handle this (it was previously returning an error when trying to compute the size of void).
• August 24, 2002: Changed the representation of structure and unions to distinguish between undefined structures and those that are defined to be empty (allowed on gcc). The sizeof operator is undefined for the former and returns 0 for the latter.
• August 22, 2002: Apply a patch from Richard H. Y. to support FreeBSD installations. Thanks, Richard!
• August 12, 2002: Fixed a bug in the translation of wide-character strings. Now this translation matches that of the underlying compiler. Changed the implementation of the compiler dependencies.
• May 25, 2002: Added interpreted constructors and destructors.
• May 17, 2002: Changed the representation of functions to move the “inline” information to the varinfo. This way we can print the “inline” even in declarations which is what gcc does.
• May 15, 2002: Changed the visitor for initializers to make two tail-recursive passes (the second is a List.rev and only done if one of the initializers change). This prevents Stack_Overflow for large initializers. Also improved the processing of initializers when converting to CIL.
• May 15, 2002: Changed the front-end to allow the use of MSVC mode even on machines that do not have MSVC. The machine-dependent parameters for GCC will be used in that case.
• May 11, 2002: Changed the representation of formals in function types. Now the function type is purely functional.
• May 4, 2002: Added the function Cil.visitCilFileSameGlobals and changed Cil.visitCilFile to be tail recursive. This prevents stack overflow on huge files.
• February 28, 2002: Changed the significance of the CompoundInit in Cil.init to allow for missing initializers at the end of an array initializer. Added the API function Cil.foldLeftCompoundAll.

This document was translated from L^AT_EX by H^EV^EA.