Context-sensitive term rewriting system for detecting missing sequence points in C expressions

Abstract

A sequence point in C is any point in the execution point of a program at which all side effects of previous evaluations performed and no side effects from subsequent evaluations have yet been performed. The end of a full expression, between of the left and right operands of the && (logical AND), || (logical OR), and comma operators are the typical sequence points of C expressions. The evaluation of C expressions missing sequence point like may produce different result from that of other compilers due to the missing sequence point. That is, C expressions missing sequence point have a potential to cause unexpected portability problems. C standard has defined those kind of expressions as undefined and proposed a method for detecting expressions missing sequence points. Also several tools such as GCC compiler and Splint provide a feature which detects errornous expression due to missing sequence points. But those are all based on C programming language specification described informally. That is, the results depend on the interpretation of C specification. We avoid the possibility of interpretation of C standard variously by choosing formal specification of C language which is mechanized by Michael Norrish. From the formal specification, we have derived reduction relations for detecting undefined expressions which is caused by missing sequence points. Base on the derived rules, we have implemented context-sensitive term rewriting system. It has revealed that existing tools providing a feature detecting missing sequence points show different results. Some of them detects less or more than expected result.