[v2] analyzer: Move gcc.dg/analyzer tests to c-c++-common (1) [PR96395]
Checks
Commit Message
From: benjamin priour <priour.be@gmail.com>
Hi,
Updated version of the patch, regstrapping the changes described in
https://gcc.gnu.org/pipermail/gcc-patches/2023-August/628455.html.
Regstrapped off trunk 66be6ed81f369573824f1a8f5a3538a63472292f
on x86_64-linux-gnu.
OK for trunk ?
Thanks,
Benjamin.
Patch below.
---
First batch of moving tests from under gcc.dg/analyzer into
c-c++-common/analyzer.
C builtins are not recognized as such by C++, therefore
this patch no longer uses tree.h:fndecl_built_in_p to recognize
a builtin function, but rather the function names.
Thus functions named as C builtins - such as calloc, sprintf ... -
are recognized as such both in C and C++ sources by the analyzer.
For user-declared functions named after builtins, the latters' function_decl
tree are now preferred over the function_decl the user declared, even
when the FE consider their declaration to mismatch
(Wbuiltin-declaration-mismatch emitted). This mainly comes into account
in the handling of these function attributes : the analyzer uses
the builtin's attributes defined in gcc/builtins.def.
Signed-off-by: benjamin priour <priour.be@gmail.com>
gcc/analyzer/ChangeLog:
analyzer/PR 96395
* analyzer.h (class known_function): Add virtual casts
to builtin_known_function.
(class builtin_known_function): New subclass of known_function
for builtins.
* kf.cc (class kf_alloca): Now derived from
builtin_known_function.
(class kf_calloc): Likewise.
(class kf_free): Likewise.
(class kf_malloc): Likewise.
(class kf_memcpy_memmove): Likewise.
(class kf_memset): Likewise.
(class kf_realloc): Likewise.
(class kf_strchr): Likewise.
(class kf_sprintf): Likewise.
(class kf_strcat): Likewise.
(class kf_strcpy): Likewise.
(class kf_strdup): Likewise.
(class kf_strlen): Likewise.
(class kf_strndup): Likewise.
(register_known_functions): Builtins are now registered as
known_functions by name rather than by their BUILTIN_CODE.
* known-function-manager.cc (get_normal_builtin): New overload.
* known-function-manager.h: New overload declaration.
* region-model.cc (region_model::get_builtin_kf): New function.
* region-model.h (class region_model): Add declaration of
get_builtin_kf.
* sm-fd.cc: For called recognized as builtins, use the
attributes of that builtin as defined in gcc/builtins.def
rather than the user's.
* sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
gcc/testsuite/ChangeLog:
analyzer/PR 96395
* gcc.dg/analyzer/aliasing-3.c: Moved to...
* c-c++-common/analyzer/aliasing-3.c: ...here.
* gcc.dg/analyzer/aliasing-pr106473.c: Moved to...
* c-c++-common/analyzer/aliasing-pr106473.c: ...here.
* gcc.dg/analyzer/asm-x86-dyndbg-2.c: Moved to...
* c-c++-common/analyzer/asm-x86-dyndbg-2.c: ...here.
* gcc.dg/analyzer/asm-x86-lp64-2.c: Moved to...
* c-c++-common/analyzer/asm-x86-lp64-2.c: ...here.
* gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c: Moved to...
* c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c: ...here.
* gcc.dg/analyzer/atomic-builtins-qemu-sockets.c: Moved to...
* c-c++-common/analyzer/atomic-builtins-qemu-sockets.c: ...here.
* gcc.dg/analyzer/attr-malloc-6.c: Moved to...
* c-c++-common/analyzer/attr-malloc-6.c: ...here.
* gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c: Moved to...
* c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c: ...here.
* gcc.dg/analyzer/attr-tainted_args-1.c: Moved to...
* c-c++-common/analyzer/attr-tainted_args-1.c: ...here.
* gcc.dg/analyzer/call-summaries-pr107158.c: Moved to...
* c-c++-common/analyzer/call-summaries-pr107158.c: ...here.
* gcc.dg/analyzer/calloc-1.c: Moved to...
* c-c++-common/analyzer/calloc-1.c: ...here.
* gcc.dg/analyzer/compound-assignment-5.c: Moved to...
* c-c++-common/analyzer/compound-assignment-5.c: ...here.
* gcc.dg/analyzer/coreutils-cksum-pr108664.c: Moved to...
* c-c++-common/analyzer/coreutils-cksum-pr108664.c: ...here.
* gcc.dg/analyzer/coreutils-sum-pr108666.c: Moved to...
* c-c++-common/analyzer/coreutils-sum-pr108666.c: ...here.
* gcc.dg/analyzer/deref-before-check-pr108455-1.c: Moved to...
* c-c++-common/analyzer/deref-before-check-pr108455-1.c: ...here.
* gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c: Moved to...
* c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c: ...here.
* gcc.dg/analyzer/deref-before-check-pr108475-1.c: Moved to...
* c-c++-common/analyzer/deref-before-check-pr108475-1.c: ...here.
* gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c: Moved to...
* c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c: ...here.
* gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c: Moved to...
* c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c: ...here.
* gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c: Moved to...
* c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c: ...here.
* gcc.dg/analyzer/deref-before-check-pr77425.c: Moved to...
* c-c++-common/analyzer/deref-before-check-pr77425.c: ...here.
* gcc.dg/analyzer/exec-1.c: Moved to...
* c-c++-common/analyzer/exec-1.c: ...here.
* gcc.dg/analyzer/feasibility-3.c: Moved to...
* c-c++-common/analyzer/feasibility-3.c: ...here.
* gcc.dg/analyzer/fields.c: Moved to...
* c-c++-common/analyzer/fields.c: ...here.
* gcc.dg/analyzer/function-ptr-5.c: Moved to...
* c-c++-common/analyzer/function-ptr-5.c: ...here.
* gcc.dg/analyzer/infinite-recursion-pr108524-1.c: Moved to...
* c-c++-common/analyzer/infinite-recursion-pr108524-1.c: ...here.
* gcc.dg/analyzer/infinite-recursion-pr108524-2.c: Moved to...
* c-c++-common/analyzer/infinite-recursion-pr108524-2.c: ...here.
* gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c: Moved to...
* c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c: ...here.
* gcc.dg/analyzer/init.c: Moved to...
* c-c++-common/analyzer/init.c: ...here.
* gcc.dg/analyzer/inlining-3-multiline.c: Moved to...
* c-c++-common/analyzer/inlining-3-multiline.c: ...here.
* gcc.dg/analyzer/inlining-3.c: Moved to...
* c-c++-common/analyzer/inlining-3.c: ...here.
* gcc.dg/analyzer/inlining-4-multiline.c: Moved to...
* c-c++-common/analyzer/inlining-4-multiline.c: ...here.
* gcc.dg/analyzer/inlining-4.c: Moved to...
* c-c++-common/analyzer/inlining-4.c: ...here.
* gcc.dg/analyzer/leak-pr105906.c: Moved to...
* c-c++-common/analyzer/leak-pr105906.c: ...here.
* gcc.dg/analyzer/leak-pr108045-with-call-summaries.c: Moved to...
* c-c++-common/analyzer/leak-pr108045-with-call-summaries.c: ...here.
* gcc.dg/analyzer/leak-pr108045-without-call-summaries.c: Moved to...
* c-c++-common/analyzer/leak-pr108045-without-call-summaries.c: ...here.
* gcc.dg/analyzer/leak-pr109059-1.c: Moved to...
* c-c++-common/analyzer/leak-pr109059-1.c: ...here.
* gcc.dg/analyzer/leak-pr109059-2.c: Moved to...
* c-c++-common/analyzer/leak-pr109059-2.c: ...here.
* gcc.dg/analyzer/malloc-2.c: Moved to...
* c-c++-common/analyzer/malloc-2.c: ...here.
* gcc.dg/analyzer/memcpy-2.c: Moved to...
* c-c++-common/analyzer/memcpy-2.c: ...here.
* gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c: Moved to...
* c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c: ...here.
* gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: Moved to...
* c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: ...here.
* gcc.dg/analyzer/null-deref-pr108806-qemu.c: Moved to...
* c-c++-common/analyzer/null-deref-pr108806-qemu.c: ...here.
* gcc.dg/analyzer/null-deref-pr108830.c: Moved to...
* c-c++-common/analyzer/null-deref-pr108830.c: ...here.
* gcc.dg/analyzer/pr101962.c: Moved to...
* c-c++-common/analyzer/pr101962.c: ...here.
* gcc.dg/analyzer/pr103217-2.c: Moved to...
* c-c++-common/analyzer/pr103217-2.c: ...here.
* gcc.dg/analyzer/pr103217.c: Moved to...
* c-c++-common/analyzer/pr103217.c: ...here.
* gcc.dg/analyzer/pr104029.c: Moved to...
* c-c++-common/analyzer/pr104029.c: ...here.
* gcc.dg/analyzer/pr104062.c: Moved to...
* c-c++-common/analyzer/pr104062.c: ...here.
* gcc.dg/analyzer/pr105783.c: Moved to...
* c-c++-common/analyzer/pr105783.c: ...here.
* gcc.dg/analyzer/pr107345.c: Moved to...
* c-c++-common/analyzer/pr107345.c: ...here.
* gcc.dg/analyzer/pr93695-1.c: Moved to...
* c-c++-common/analyzer/pr93695-1.c: ...here.
* gcc.dg/analyzer/pr94596.c: Moved to...
* c-c++-common/analyzer/pr94596.c: ...here.
* gcc.dg/analyzer/pr94839.c: Moved to...
* c-c++-common/analyzer/pr94839.c: ...here.
* gcc.dg/analyzer/pr95152-4.c: Moved to...
* c-c++-common/analyzer/pr95152-4.c: ...here.
* gcc.dg/analyzer/pr95152-5.c: Moved to...
* c-c++-common/analyzer/pr95152-5.c: ...here.
* gcc.dg/analyzer/pr95240.c: Moved to...
* c-c++-common/analyzer/pr95240.c: ...here.
* gcc.dg/analyzer/pr96639.c: Moved to...
* c-c++-common/analyzer/pr96639.c: ...here.
* gcc.dg/analyzer/pr96653.c: Moved to...
* c-c++-common/analyzer/pr96653.c: ...here.
* gcc.dg/analyzer/pr96792.c: Moved to...
* c-c++-common/analyzer/pr96792.c: ...here.
* gcc.dg/analyzer/pr96841.c: Moved to...
* c-c++-common/analyzer/pr96841.c: ...here.
* gcc.dg/analyzer/pr98564.c: Moved to...
* c-c++-common/analyzer/pr98564.c: ...here.
* gcc.dg/analyzer/pr98628.c: Moved to...
* c-c++-common/analyzer/pr98628.c: ...here.
* gcc.dg/analyzer/pr98969.c: Moved to...
* c-c++-common/analyzer/pr98969.c: ...here.
* gcc.dg/analyzer/pr99193-2.c: Moved to...
* c-c++-common/analyzer/pr99193-2.c: ...here.
* gcc.dg/analyzer/pr99193-3.c: Moved to...
* c-c++-common/analyzer/pr99193-3.c: ...here.
* gcc.dg/analyzer/pr99716-1.c: Moved to...
* c-c++-common/analyzer/pr99716-1.c: ...here.
* gcc.dg/analyzer/pr99774-1.c: Moved to...
* c-c++-common/analyzer/pr99774-1.c: ...here.
* gcc.dg/analyzer/realloc-1.c: Moved to...
* c-c++-common/analyzer/realloc-1.c: ...here.
* gcc.dg/analyzer/realloc-2.c: Moved to...
* c-c++-common/analyzer/realloc-2.c: ...here.
* gcc.dg/analyzer/realloc-3.c: Moved to...
* c-c++-common/analyzer/realloc-3.c: ...here.
* gcc.dg/analyzer/realloc-4.c: Moved to...
* c-c++-common/analyzer/realloc-4.c: ...here.
* gcc.dg/analyzer/realloc-5.c: Moved to...
* c-c++-common/analyzer/realloc-5.c: ...here.
* gcc.dg/analyzer/realloc-pr110014.c: Moved to...
* c-c++-common/analyzer/realloc-pr110014.c: ...here.
* gcc.dg/analyzer/snprintf-concat.c: Moved to...
* c-c++-common/analyzer/snprintf-concat.c: ...here.
* gcc.dg/analyzer/sock-1.c: Moved to...
* c-c++-common/analyzer/sock-1.c: ...here.
* gcc.dg/analyzer/sprintf-concat.c: Moved to...
* c-c++-common/analyzer/sprintf-concat.c: ...here.
* gcc.dg/analyzer/string-ops-concat-pair.c: Moved to...
* c-c++-common/analyzer/string-ops-concat-pair.c: ...here.
* gcc.dg/analyzer/string-ops-dup.c: Moved to...
* c-c++-common/analyzer/string-ops-dup.c: ...here.
* gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c: Moved to...
* c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c: ...here.
* gcc.dg/analyzer/symbolic-12.c: Moved to...
* c-c++-common/analyzer/symbolic-12.c: ...here.
* gcc.dg/analyzer/uninit-alloca.c: Moved to...
* c-c++-common/analyzer/uninit-alloca.c: ...here.
* gcc.dg/analyzer/untracked-2.c: Moved to...
* c-c++-common/analyzer/untracked-2.c: ...here.
* gcc.dg/analyzer/vasprintf-1.c: Moved to...
* c-c++-common/analyzer/vasprintf-1.c: ...here.
* gcc.dg/analyzer/write-to-const-1.c: Moved to...
* c-c++-common/analyzer/write-to-const-1.c: ...here.
* gcc.dg/analyzer/write-to-function-1.c: Moved to...
* c-c++-common/analyzer/write-to-function-1.c: ...here.
* gcc.dg/analyzer/write-to-string-literal-1.c: Moved to...
* c-c++-common/analyzer/write-to-string-literal-1.c: ...here.
* gcc.dg/analyzer/write-to-string-literal-4-disabled.c: Moved to...
* c-c++-common/analyzer/write-to-string-literal-4-disabled.c: ...here.
* gcc.dg/analyzer/write-to-string-literal-5.c: Moved to...
* c-c++-common/analyzer/write-to-string-literal-5.c: ...here.
* g++.dg/analyzer/analyzer.exp: Now also run tests under
c-c++-common/analyzer.
* gcc.dg/analyzer/analyzer-decls.h: Add NULL definition.
* gcc.dg/analyzer/analyzer.exp: Now also run tests under
c-c++-common/analyzer.
* gcc.dg/analyzer/pr104369-1.c: Checked for C++ but not
migrated.
* gcc.dg/analyzer/pr104369-2.c: Likewise.
* gcc.dg/analyzer/pr93355-localealias-feasibility-2.c: Likewise.
* gcc.dg/analyzer/sprintf-1.c: Split into C-only and
C++-friendly bits.
* gcc.dg/analyzer/allocation-size-multiline-1.c: Removed.
* gcc.dg/analyzer/allocation-size-multiline-2.c: Removed.
* gcc.dg/analyzer/allocation-size-multiline-3.c: Removed.
* gcc.dg/analyzer/data-model-11.c: Removed.
* gcc.dg/analyzer/pr61861.c: Removed.
* gcc.dg/analyzer/pr93457.c: Removed.
* gcc.dg/analyzer/pr97568.c: Removed.
* gcc.dg/analyzer/write-to-string-literal-4.c: Removed.
* c-c++-common/analyzer/allocation-size-multiline-1.c: New test.
* c-c++-common/analyzer/allocation-size-multiline-2.c: New test.
* c-c++-common/analyzer/allocation-size-multiline-3.c: New test.
* c-c++-common/analyzer/data-model-11.c: New test.
* c-c++-common/analyzer/pr61861.c: New test.
* c-c++-common/analyzer/pr93457.c: New test.
* c-c++-common/analyzer/pr97568.c: New test.
* c-c++-common/analyzer/sprintf-2.c: C++-friendly bit of
previous gcc.dg/analyzer/sprintf-1.c.
* c-c++-common/analyzer/write-to-string-literal-4.c: New test.
---
gcc/analyzer/analyzer.h | 24 ++
gcc/analyzer/kf.cc | 210 ++++++++++++++----
gcc/analyzer/known-function-manager.cc | 7 +
gcc/analyzer/known-function-manager.h | 2 +
gcc/analyzer/region-model.cc | 56 +++++
gcc/analyzer/region-model.h | 4 +
gcc/analyzer/sm-fd.cc | 25 ++-
gcc/analyzer/sm-malloc.cc | 133 ++++++-----
.../analyzer/aliasing-3.c | 8 +-
.../analyzer/aliasing-pr106473.c | 2 +-
.../analyzer/allocation-size-multiline-1.c | 96 ++++++++
.../analyzer/allocation-size-multiline-2.c | 98 ++++++++
.../analyzer/allocation-size-multiline-3.c | 68 ++++++
.../analyzer/asm-x86-dyndbg-2.c | 8 +-
.../analyzer/asm-x86-lp64-2.c | 4 +-
.../analyzer/atomic-builtins-haproxy-proxy.c | 2 +-
.../analyzer/atomic-builtins-qemu-sockets.c | 2 +-
.../analyzer/attr-malloc-6.c | 12 +-
.../attr-malloc-CVE-2019-19078-usb-leak.c | 9 +-
.../analyzer/attr-tainted_args-1.c | 6 +-
.../analyzer/call-summaries-pr107158.c | 4 +-
.../analyzer/calloc-1.c | 7 +-
.../analyzer/compound-assignment-5.c | 30 +--
.../analyzer/coreutils-cksum-pr108664.c | 7 +-
.../analyzer/coreutils-sum-pr108666.c | 2 +-
.../c-c++-common/analyzer/data-model-11.c | 6 +
.../analyzer/deref-before-check-pr108455-1.c | 2 +-
...-before-check-pr108455-git-pack-revindex.c | 2 +-
.../analyzer/deref-before-check-pr108475-1.c | 3 +-
...f-before-check-pr108475-haproxy-tcpcheck.c | 8 +-
...f-before-check-pr109060-haproxy-cfgparse.c | 2 +-
.../deref-before-check-pr109239-linux-bus.c | 5 +-
.../analyzer/deref-before-check-pr77425.c | 4 +-
.../analyzer/exec-1.c | 18 +-
.../analyzer/feasibility-3.c | 13 +-
.../analyzer/fields.c | 2 +-
.../analyzer/function-ptr-5.c | 2 +-
.../analyzer/infinite-recursion-pr108524-1.c | 4 +-
.../analyzer/infinite-recursion-pr108524-2.c | 4 +-
...e-recursion-pr108524-qobject-json-parser.c | 4 +-
.../{gcc.dg => c-c++-common}/analyzer/init.c | 4 +-
.../analyzer/inlining-3-multiline.c | 39 +++-
.../analyzer/inlining-3.c | 10 +-
.../analyzer/inlining-4-multiline.c | 49 +++-
.../analyzer/inlining-4.c | 9 +-
.../analyzer/leak-pr105906.c | 5 +-
.../leak-pr108045-with-call-summaries.c | 8 +-
.../leak-pr108045-without-call-summaries.c | 8 +-
.../analyzer/leak-pr109059-1.c | 2 +-
.../analyzer/leak-pr109059-2.c | 2 +-
.../analyzer/malloc-2.c | 2 +-
.../analyzer/memcpy-2.c | 5 +-
...f-pr108251-smp_fetch_ssl_fc_has_early-O2.c | 6 +-
...eref-pr108251-smp_fetch_ssl_fc_has_early.c | 6 +-
.../analyzer/null-deref-pr108806-qemu.c | 2 +-
.../analyzer/null-deref-pr108830.c | 8 +-
.../analyzer/pr101962.c | 5 +-
.../analyzer/pr103217-2.c | 2 +-
.../analyzer/pr103217.c | 2 +-
.../analyzer/pr104029.c | 2 +-
.../analyzer/pr104062.c | 4 +-
.../analyzer/pr105783.c | 6 +-
.../analyzer/pr107345.c | 3 +-
gcc/testsuite/c-c++-common/analyzer/pr61861.c | 3 +
gcc/testsuite/c-c++-common/analyzer/pr93457.c | 12 +
.../analyzer/pr93695-1.c | 6 +-
.../analyzer/pr94596.c | 9 +-
.../analyzer/pr94839.c | 2 +-
.../analyzer/pr95152-4.c | 4 +-
.../analyzer/pr95152-5.c | 1 +
.../analyzer/pr95240.c | 2 +-
.../analyzer/pr96639.c | 2 +-
.../analyzer/pr96653.c | 26 +--
.../analyzer/pr96792.c | 2 +-
.../analyzer/pr96841.c | 2 +-
gcc/testsuite/c-c++-common/analyzer/pr97568.c | 31 +++
.../analyzer/pr98564.c | 2 +-
.../analyzer/pr98628.c | 4 +-
.../analyzer/pr98969.c | 5 +-
.../analyzer/pr99193-2.c | 2 +-
.../analyzer/pr99193-3.c | 4 +-
.../analyzer/pr99716-1.c | 3 +-
.../analyzer/pr99774-1.c | 2 +-
.../analyzer/realloc-1.c | 11 +-
.../analyzer/realloc-2.c | 8 +-
.../analyzer/realloc-3.c | 7 +-
.../analyzer/realloc-4.c | 5 +-
.../analyzer/realloc-5.c | 7 +-
.../analyzer/realloc-pr110014.c | 6 +-
.../analyzer/snprintf-concat.c | 6 +-
.../analyzer/sock-1.c | 8 +-
.../c-c++-common/analyzer/sprintf-2.c | 59 +++++
.../analyzer/sprintf-concat.c | 6 +-
.../analyzer/string-ops-concat-pair.c | 11 +-
.../analyzer/string-ops-dup.c | 10 +-
.../switch-enum-pr105273-git-vreportf-2.c | 2 +-
.../analyzer/symbolic-12.c | 12 +-
.../analyzer/uninit-alloca.c | 2 +-
.../analyzer/untracked-2.c | 2 +-
.../analyzer/vasprintf-1.c | 3 +-
.../analyzer/write-to-const-1.c | 2 +-
.../analyzer/write-to-function-1.c | 2 +
.../analyzer/write-to-string-literal-1.c | 13 +-
.../write-to-string-literal-4-disabled.c | 2 +-
.../analyzer/write-to-string-literal-4.c | 26 +++
.../analyzer/write-to-string-literal-5.c | 10 +-
gcc/testsuite/g++.dg/analyzer/analyzer.exp | 3 +
.../analyzer/allocation-size-multiline-1.c | 59 -----
.../analyzer/allocation-size-multiline-2.c | 62 ------
.../analyzer/allocation-size-multiline-3.c | 44 ----
.../gcc.dg/analyzer/analyzer-decls.h | 12 +
gcc/testsuite/gcc.dg/analyzer/analyzer.exp | 3 +
gcc/testsuite/gcc.dg/analyzer/data-model-11.c | 6 -
gcc/testsuite/gcc.dg/analyzer/pr104369-1.c | 8 +-
gcc/testsuite/gcc.dg/analyzer/pr104369-2.c | 8 +-
gcc/testsuite/gcc.dg/analyzer/pr61861.c | 2 -
.../pr93355-localealias-feasibility-2.c | 1 -
gcc/testsuite/gcc.dg/analyzer/pr93457.c | 10 -
gcc/testsuite/gcc.dg/analyzer/pr97568.c | 29 ---
gcc/testsuite/gcc.dg/analyzer/sprintf-1.c | 54 +----
.../analyzer/write-to-string-literal-4.c | 23 --
121 files changed, 1142 insertions(+), 620 deletions(-)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/aliasing-3.c (89%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/aliasing-pr106473.c (53%)
create mode 100644 gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/asm-x86-dyndbg-2.c (96%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/asm-x86-lp64-2.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/atomic-builtins-haproxy-proxy.c (95%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/atomic-builtins-qemu-sockets.c (74%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/attr-malloc-6.c (88%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c (97%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/attr-tainted_args-1.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/call-summaries-pr107158.c (95%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/calloc-1.c (87%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/compound-assignment-5.c (83%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/coreutils-cksum-pr108664.c (97%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/coreutils-sum-pr108666.c (97%)
create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-11.c
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108455-1.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108455-git-pack-revindex.c (98%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108475-1.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c (96%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c (97%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr109239-linux-bus.c (96%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr77425.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/exec-1.c (59%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/feasibility-3.c (92%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/fields.c (92%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/function-ptr-5.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/infinite-recursion-pr108524-1.c (98%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/infinite-recursion-pr108524-2.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/infinite-recursion-pr108524-qobject-json-parser.c (99%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/init.c (97%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-3-multiline.c (55%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-3.c (51%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-4-multiline.c (54%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-4.c (51%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr105906.c (81%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr108045-with-call-summaries.c (87%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr108045-without-call-summaries.c (87%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr109059-1.c (93%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr109059-2.c (92%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/malloc-2.c (89%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/memcpy-2.c (79%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c (93%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c (93%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108806-qemu.c (97%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108830.c (92%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr101962.c (95%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr103217-2.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr103217.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr104029.c (97%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr104062.c (70%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr105783.c (85%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr107345.c (73%)
create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr61861.c
create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93457.c
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr93695-1.c (83%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr94596.c (92%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr94839.c (82%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr95152-4.c (55%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr95152-5.c (61%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr95240.c (89%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96639.c (80%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96653.c (98%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96792.c (93%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96841.c (89%)
create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97568.c
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr98564.c (59%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr98628.c (100%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr98969.c (61%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99193-2.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99193-3.c (91%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99716-1.c (93%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99774-1.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-1.c (84%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-2.c (95%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-3.c (96%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-4.c (97%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-5.c (90%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-pr110014.c (70%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/snprintf-concat.c (81%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/sock-1.c (91%)
create mode 100644 gcc/testsuite/c-c++-common/analyzer/sprintf-2.c
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/sprintf-concat.c (82%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/string-ops-concat-pair.c (83%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/string-ops-dup.c (83%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/switch-enum-pr105273-git-vreportf-2.c (94%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/symbolic-12.c (88%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/uninit-alloca.c (57%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/untracked-2.c (76%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/vasprintf-1.c (96%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-const-1.c (91%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-function-1.c (81%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-string-literal-1.c (73%)
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-string-literal-4-disabled.c (94%)
create mode 100644 gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c
rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-string-literal-5.c (59%)
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-11.c
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr61861.c
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93457.c
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97568.c
delete mode 100644 gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c
Comments
On Sat, 2023-08-26 at 14:22 +0200, priour.be@gmail.com wrote:
> From: benjamin priour <priour.be@gmail.com>
>
> Hi,
>
> Updated version of the patch, regstrapping the changes described in
> https://gcc.gnu.org/pipermail/gcc-patches/2023-August/628455.html.
>
> Regstrapped off trunk 66be6ed81f369573824f1a8f5a3538a63472292f
> on x86_64-linux-gnu.
>
> OK for trunk ?
Thanks for the v2 patch.
This is almost ready, some minor nits below...
[...snip...]
>
> gcc/analyzer/ChangeLog:
>
> analyzer/PR 96395
This should be PR analyzer/96395.
> * analyzer.h (class known_function): Add virtual casts
> to builtin_known_function.
> (class builtin_known_function): New subclass of known_function
> for builtins.
[...snip...]
>
> gcc/testsuite/ChangeLog:
>
> analyzer/PR 96395
Likewise here.
> * gcc.dg/analyzer/aliasing-3.c: Moved to...
> * c-c++-common/analyzer/aliasing-3.c: ...here.
> * gcc.dg/analyzer/aliasing-pr106473.c: Moved to...
> * c-c++-common/analyzer/aliasing-pr106473.c: ...here.
[...snip...]
> diff --git a/gcc/analyzer/analyzer.h b/gcc/analyzer/analyzer.h
> index 93a28b4b5cf..d42771f1e20 100644
> --- a/gcc/analyzer/analyzer.h
> +++ b/gcc/analyzer/analyzer.h
[...snip...]
> @@ -279,6 +283,26 @@ public:
> {
> return;
> }
> +
> + virtual const builtin_known_function *
> + dyn_cast_builtin_kf () const { return NULL; }
> + virtual builtin_known_function *
> + dyn_cast_builtin_kf () { return NULL; }
As noted in the review of v1, I don't think we ever work with non-const
known_function pointers, so we don't need the non-const version of the
vfunc.
[...snip...]
> diff --git a/gcc/testsuite/c-c++-common/analyzer/pr61861.c b/gcc/testsuite/c-c++-common/analyzer/pr61861.c
> new file mode 100644
> index 00000000000..bb9e039ebd5
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr61861.c
> @@ -0,0 +1,3 @@
> +/* { dg-additional-options "-Wno-int-conversion" } */
> +/* { dg-skip-if "-Wno-int-conversion for C++" { c++ } } */
> +#include "../../gcc.dg/pr61861.c"
For tests like this that aren't going to be portable to C++, let's keep
it in the gcc.dg subdirectory, with a suitable comment, rather than
moving them and having a dg-skip-if on it.
Perhaps:
/* C only: -Wno-int-conversion is not valid for C++. */
That way we can easily grep for the absence of "C only" when checking
to see which analyzer tests below gcc.dg still need considering for
moving below c-c++-common. The string "C only" is conveniently short.
[...snip...]
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c b/gcc/testsuite/c-c++-common/analyzer/pr95152-4.c
> similarity index 55%
> rename from gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr95152-4.c
> index f2a72cad01c..5ebbae85aee 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr95152-4.c
> @@ -1,4 +1,6 @@
> +/* { dg-skip-if "'-Wno-pointer-to-int-cast' invalid for C++" { c++ } } */
> /* { dg-additional-options "-Wno-pointer-to-int-cast" } */
Likewise here.
[...snip...]
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c b/gcc/testsuite/c-c++-common/analyzer/pr95152-5.c
> similarity index 61%
> rename from gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr95152-5.c
> index 604b78458c7..fbc4753e0b4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr95152-5.c
> @@ -1,3 +1,4 @@
> +/* { dg-skip-if "'-Wno-incompatible-pointer-types' invalid for C++" { c++ } } */
> /* { dg-additional-options "-Wno-incompatible-pointer-types" } */
> void foo(void)
> {
Likewise here.
[...snip...]
> diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c b/gcc/testsuite/c-c++-common/analyzer/write-to-function-1.c
> similarity index 81%
> rename from gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/write-to-function-1.c
> index c1bece632ce..dd4adc13141 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/write-to-function-1.c
> @@ -1,3 +1,5 @@
> +/* { dg-skip-if "c++ does not allow for conversion from function pointer to 'void *'" { c++ } } */
> +
Likewise here.
[...snip...]
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c b/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
> index c05137bb219..788a2059013 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
> +++ b/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
> @@ -1,5 +1,8 @@
> /* { dg-additional-options "-Wno-analyzer-too-complex -Wno-analyzer-fd-leak" } */
> // TODO: remove need for these options
> +/* This test needs not be moved to c-c++-common/analyzer as C++
> + does not support transparent_union. */
> +
Perhaps update this comment to:
/* C only: C++ does not support transparent_union. */
so that we can grep for (the absence) of "C only".
and similarly for the other testfiles where you add similar comments?
These are:
pr104369-2.c
sprintf-1.c
[...snip...]
OK for trunk with the above nits fixed (i.e. I trust you to go ahead
and push the v3 patch without another review once you fix the above and
check that it builds)
Thanks again for the updated patch
Dave
On Sat, 26 Aug 2023 at 18:02, Benjamin Priour via Gcc-patches
<gcc-patches@gcc.gnu.org> wrote:
>
> From: benjamin priour <priour.be@gmail.com>
>
> Hi,
>
> Updated version of the patch, regstrapping the changes described in
> https://gcc.gnu.org/pipermail/gcc-patches/2023-August/628455.html.
>
> Regstrapped off trunk 66be6ed81f369573824f1a8f5a3538a63472292f
> on x86_64-linux-gnu.
Hi Benjamin,
It seems your patch committed in 55f6a7d949abc708d1c6ebc01eb3053f96d1472b
caused following regressions on arm-eabi config:
Running gcc:gcc.dg/analyzer/analyzer.exp ...
FAIL: c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
(test for excess errors)
FAIL: c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
(test for excess errors)
Please let me know if you need help to reproduce these failures.
Thanks,
Prathamesh
>
> OK for trunk ?
>
> Thanks,
> Benjamin.
>
> Patch below.
> ---
>
> First batch of moving tests from under gcc.dg/analyzer into
> c-c++-common/analyzer.
>
> C builtins are not recognized as such by C++, therefore
> this patch no longer uses tree.h:fndecl_built_in_p to recognize
> a builtin function, but rather the function names.
>
> Thus functions named as C builtins - such as calloc, sprintf ... -
> are recognized as such both in C and C++ sources by the analyzer.
>
> For user-declared functions named after builtins, the latters' function_decl
> tree are now preferred over the function_decl the user declared, even
> when the FE consider their declaration to mismatch
> (Wbuiltin-declaration-mismatch emitted). This mainly comes into account
> in the handling of these function attributes : the analyzer uses
> the builtin's attributes defined in gcc/builtins.def.
>
> Signed-off-by: benjamin priour <priour.be@gmail.com>
>
> gcc/analyzer/ChangeLog:
>
> analyzer/PR 96395
> * analyzer.h (class known_function): Add virtual casts
> to builtin_known_function.
> (class builtin_known_function): New subclass of known_function
> for builtins.
> * kf.cc (class kf_alloca): Now derived from
> builtin_known_function.
> (class kf_calloc): Likewise.
> (class kf_free): Likewise.
> (class kf_malloc): Likewise.
> (class kf_memcpy_memmove): Likewise.
> (class kf_memset): Likewise.
> (class kf_realloc): Likewise.
> (class kf_strchr): Likewise.
> (class kf_sprintf): Likewise.
> (class kf_strcat): Likewise.
> (class kf_strcpy): Likewise.
> (class kf_strdup): Likewise.
> (class kf_strlen): Likewise.
> (class kf_strndup): Likewise.
> (register_known_functions): Builtins are now registered as
> known_functions by name rather than by their BUILTIN_CODE.
> * known-function-manager.cc (get_normal_builtin): New overload.
> * known-function-manager.h: New overload declaration.
> * region-model.cc (region_model::get_builtin_kf): New function.
> * region-model.h (class region_model): Add declaration of
> get_builtin_kf.
> * sm-fd.cc: For called recognized as builtins, use the
> attributes of that builtin as defined in gcc/builtins.def
> rather than the user's.
> * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
>
> gcc/testsuite/ChangeLog:
>
> analyzer/PR 96395
> * gcc.dg/analyzer/aliasing-3.c: Moved to...
> * c-c++-common/analyzer/aliasing-3.c: ...here.
> * gcc.dg/analyzer/aliasing-pr106473.c: Moved to...
> * c-c++-common/analyzer/aliasing-pr106473.c: ...here.
> * gcc.dg/analyzer/asm-x86-dyndbg-2.c: Moved to...
> * c-c++-common/analyzer/asm-x86-dyndbg-2.c: ...here.
> * gcc.dg/analyzer/asm-x86-lp64-2.c: Moved to...
> * c-c++-common/analyzer/asm-x86-lp64-2.c: ...here.
> * gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c: Moved to...
> * c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c: ...here.
> * gcc.dg/analyzer/atomic-builtins-qemu-sockets.c: Moved to...
> * c-c++-common/analyzer/atomic-builtins-qemu-sockets.c: ...here.
> * gcc.dg/analyzer/attr-malloc-6.c: Moved to...
> * c-c++-common/analyzer/attr-malloc-6.c: ...here.
> * gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c: Moved to...
> * c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c: ...here.
> * gcc.dg/analyzer/attr-tainted_args-1.c: Moved to...
> * c-c++-common/analyzer/attr-tainted_args-1.c: ...here.
> * gcc.dg/analyzer/call-summaries-pr107158.c: Moved to...
> * c-c++-common/analyzer/call-summaries-pr107158.c: ...here.
> * gcc.dg/analyzer/calloc-1.c: Moved to...
> * c-c++-common/analyzer/calloc-1.c: ...here.
> * gcc.dg/analyzer/compound-assignment-5.c: Moved to...
> * c-c++-common/analyzer/compound-assignment-5.c: ...here.
> * gcc.dg/analyzer/coreutils-cksum-pr108664.c: Moved to...
> * c-c++-common/analyzer/coreutils-cksum-pr108664.c: ...here.
> * gcc.dg/analyzer/coreutils-sum-pr108666.c: Moved to...
> * c-c++-common/analyzer/coreutils-sum-pr108666.c: ...here.
> * gcc.dg/analyzer/deref-before-check-pr108455-1.c: Moved to...
> * c-c++-common/analyzer/deref-before-check-pr108455-1.c: ...here.
> * gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c: Moved to...
> * c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c: ...here.
> * gcc.dg/analyzer/deref-before-check-pr108475-1.c: Moved to...
> * c-c++-common/analyzer/deref-before-check-pr108475-1.c: ...here.
> * gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c: Moved to...
> * c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c: ...here.
> * gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c: Moved to...
> * c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c: ...here.
> * gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c: Moved to...
> * c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c: ...here.
> * gcc.dg/analyzer/deref-before-check-pr77425.c: Moved to...
> * c-c++-common/analyzer/deref-before-check-pr77425.c: ...here.
> * gcc.dg/analyzer/exec-1.c: Moved to...
> * c-c++-common/analyzer/exec-1.c: ...here.
> * gcc.dg/analyzer/feasibility-3.c: Moved to...
> * c-c++-common/analyzer/feasibility-3.c: ...here.
> * gcc.dg/analyzer/fields.c: Moved to...
> * c-c++-common/analyzer/fields.c: ...here.
> * gcc.dg/analyzer/function-ptr-5.c: Moved to...
> * c-c++-common/analyzer/function-ptr-5.c: ...here.
> * gcc.dg/analyzer/infinite-recursion-pr108524-1.c: Moved to...
> * c-c++-common/analyzer/infinite-recursion-pr108524-1.c: ...here.
> * gcc.dg/analyzer/infinite-recursion-pr108524-2.c: Moved to...
> * c-c++-common/analyzer/infinite-recursion-pr108524-2.c: ...here.
> * gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c: Moved to...
> * c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c: ...here.
> * gcc.dg/analyzer/init.c: Moved to...
> * c-c++-common/analyzer/init.c: ...here.
> * gcc.dg/analyzer/inlining-3-multiline.c: Moved to...
> * c-c++-common/analyzer/inlining-3-multiline.c: ...here.
> * gcc.dg/analyzer/inlining-3.c: Moved to...
> * c-c++-common/analyzer/inlining-3.c: ...here.
> * gcc.dg/analyzer/inlining-4-multiline.c: Moved to...
> * c-c++-common/analyzer/inlining-4-multiline.c: ...here.
> * gcc.dg/analyzer/inlining-4.c: Moved to...
> * c-c++-common/analyzer/inlining-4.c: ...here.
> * gcc.dg/analyzer/leak-pr105906.c: Moved to...
> * c-c++-common/analyzer/leak-pr105906.c: ...here.
> * gcc.dg/analyzer/leak-pr108045-with-call-summaries.c: Moved to...
> * c-c++-common/analyzer/leak-pr108045-with-call-summaries.c: ...here.
> * gcc.dg/analyzer/leak-pr108045-without-call-summaries.c: Moved to...
> * c-c++-common/analyzer/leak-pr108045-without-call-summaries.c: ...here.
> * gcc.dg/analyzer/leak-pr109059-1.c: Moved to...
> * c-c++-common/analyzer/leak-pr109059-1.c: ...here.
> * gcc.dg/analyzer/leak-pr109059-2.c: Moved to...
> * c-c++-common/analyzer/leak-pr109059-2.c: ...here.
> * gcc.dg/analyzer/malloc-2.c: Moved to...
> * c-c++-common/analyzer/malloc-2.c: ...here.
> * gcc.dg/analyzer/memcpy-2.c: Moved to...
> * c-c++-common/analyzer/memcpy-2.c: ...here.
> * gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c: Moved to...
> * c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c: ...here.
> * gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: Moved to...
> * c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: ...here.
> * gcc.dg/analyzer/null-deref-pr108806-qemu.c: Moved to...
> * c-c++-common/analyzer/null-deref-pr108806-qemu.c: ...here.
> * gcc.dg/analyzer/null-deref-pr108830.c: Moved to...
> * c-c++-common/analyzer/null-deref-pr108830.c: ...here.
> * gcc.dg/analyzer/pr101962.c: Moved to...
> * c-c++-common/analyzer/pr101962.c: ...here.
> * gcc.dg/analyzer/pr103217-2.c: Moved to...
> * c-c++-common/analyzer/pr103217-2.c: ...here.
> * gcc.dg/analyzer/pr103217.c: Moved to...
> * c-c++-common/analyzer/pr103217.c: ...here.
> * gcc.dg/analyzer/pr104029.c: Moved to...
> * c-c++-common/analyzer/pr104029.c: ...here.
> * gcc.dg/analyzer/pr104062.c: Moved to...
> * c-c++-common/analyzer/pr104062.c: ...here.
> * gcc.dg/analyzer/pr105783.c: Moved to...
> * c-c++-common/analyzer/pr105783.c: ...here.
> * gcc.dg/analyzer/pr107345.c: Moved to...
> * c-c++-common/analyzer/pr107345.c: ...here.
> * gcc.dg/analyzer/pr93695-1.c: Moved to...
> * c-c++-common/analyzer/pr93695-1.c: ...here.
> * gcc.dg/analyzer/pr94596.c: Moved to...
> * c-c++-common/analyzer/pr94596.c: ...here.
> * gcc.dg/analyzer/pr94839.c: Moved to...
> * c-c++-common/analyzer/pr94839.c: ...here.
> * gcc.dg/analyzer/pr95152-4.c: Moved to...
> * c-c++-common/analyzer/pr95152-4.c: ...here.
> * gcc.dg/analyzer/pr95152-5.c: Moved to...
> * c-c++-common/analyzer/pr95152-5.c: ...here.
> * gcc.dg/analyzer/pr95240.c: Moved to...
> * c-c++-common/analyzer/pr95240.c: ...here.
> * gcc.dg/analyzer/pr96639.c: Moved to...
> * c-c++-common/analyzer/pr96639.c: ...here.
> * gcc.dg/analyzer/pr96653.c: Moved to...
> * c-c++-common/analyzer/pr96653.c: ...here.
> * gcc.dg/analyzer/pr96792.c: Moved to...
> * c-c++-common/analyzer/pr96792.c: ...here.
> * gcc.dg/analyzer/pr96841.c: Moved to...
> * c-c++-common/analyzer/pr96841.c: ...here.
> * gcc.dg/analyzer/pr98564.c: Moved to...
> * c-c++-common/analyzer/pr98564.c: ...here.
> * gcc.dg/analyzer/pr98628.c: Moved to...
> * c-c++-common/analyzer/pr98628.c: ...here.
> * gcc.dg/analyzer/pr98969.c: Moved to...
> * c-c++-common/analyzer/pr98969.c: ...here.
> * gcc.dg/analyzer/pr99193-2.c: Moved to...
> * c-c++-common/analyzer/pr99193-2.c: ...here.
> * gcc.dg/analyzer/pr99193-3.c: Moved to...
> * c-c++-common/analyzer/pr99193-3.c: ...here.
> * gcc.dg/analyzer/pr99716-1.c: Moved to...
> * c-c++-common/analyzer/pr99716-1.c: ...here.
> * gcc.dg/analyzer/pr99774-1.c: Moved to...
> * c-c++-common/analyzer/pr99774-1.c: ...here.
> * gcc.dg/analyzer/realloc-1.c: Moved to...
> * c-c++-common/analyzer/realloc-1.c: ...here.
> * gcc.dg/analyzer/realloc-2.c: Moved to...
> * c-c++-common/analyzer/realloc-2.c: ...here.
> * gcc.dg/analyzer/realloc-3.c: Moved to...
> * c-c++-common/analyzer/realloc-3.c: ...here.
> * gcc.dg/analyzer/realloc-4.c: Moved to...
> * c-c++-common/analyzer/realloc-4.c: ...here.
> * gcc.dg/analyzer/realloc-5.c: Moved to...
> * c-c++-common/analyzer/realloc-5.c: ...here.
> * gcc.dg/analyzer/realloc-pr110014.c: Moved to...
> * c-c++-common/analyzer/realloc-pr110014.c: ...here.
> * gcc.dg/analyzer/snprintf-concat.c: Moved to...
> * c-c++-common/analyzer/snprintf-concat.c: ...here.
> * gcc.dg/analyzer/sock-1.c: Moved to...
> * c-c++-common/analyzer/sock-1.c: ...here.
> * gcc.dg/analyzer/sprintf-concat.c: Moved to...
> * c-c++-common/analyzer/sprintf-concat.c: ...here.
> * gcc.dg/analyzer/string-ops-concat-pair.c: Moved to...
> * c-c++-common/analyzer/string-ops-concat-pair.c: ...here.
> * gcc.dg/analyzer/string-ops-dup.c: Moved to...
> * c-c++-common/analyzer/string-ops-dup.c: ...here.
> * gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c: Moved to...
> * c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c: ...here.
> * gcc.dg/analyzer/symbolic-12.c: Moved to...
> * c-c++-common/analyzer/symbolic-12.c: ...here.
> * gcc.dg/analyzer/uninit-alloca.c: Moved to...
> * c-c++-common/analyzer/uninit-alloca.c: ...here.
> * gcc.dg/analyzer/untracked-2.c: Moved to...
> * c-c++-common/analyzer/untracked-2.c: ...here.
> * gcc.dg/analyzer/vasprintf-1.c: Moved to...
> * c-c++-common/analyzer/vasprintf-1.c: ...here.
> * gcc.dg/analyzer/write-to-const-1.c: Moved to...
> * c-c++-common/analyzer/write-to-const-1.c: ...here.
> * gcc.dg/analyzer/write-to-function-1.c: Moved to...
> * c-c++-common/analyzer/write-to-function-1.c: ...here.
> * gcc.dg/analyzer/write-to-string-literal-1.c: Moved to...
> * c-c++-common/analyzer/write-to-string-literal-1.c: ...here.
> * gcc.dg/analyzer/write-to-string-literal-4-disabled.c: Moved to...
> * c-c++-common/analyzer/write-to-string-literal-4-disabled.c: ...here.
> * gcc.dg/analyzer/write-to-string-literal-5.c: Moved to...
> * c-c++-common/analyzer/write-to-string-literal-5.c: ...here.
> * g++.dg/analyzer/analyzer.exp: Now also run tests under
> c-c++-common/analyzer.
> * gcc.dg/analyzer/analyzer-decls.h: Add NULL definition.
> * gcc.dg/analyzer/analyzer.exp: Now also run tests under
> c-c++-common/analyzer.
> * gcc.dg/analyzer/pr104369-1.c: Checked for C++ but not
> migrated.
> * gcc.dg/analyzer/pr104369-2.c: Likewise.
> * gcc.dg/analyzer/pr93355-localealias-feasibility-2.c: Likewise.
> * gcc.dg/analyzer/sprintf-1.c: Split into C-only and
> C++-friendly bits.
> * gcc.dg/analyzer/allocation-size-multiline-1.c: Removed.
> * gcc.dg/analyzer/allocation-size-multiline-2.c: Removed.
> * gcc.dg/analyzer/allocation-size-multiline-3.c: Removed.
> * gcc.dg/analyzer/data-model-11.c: Removed.
> * gcc.dg/analyzer/pr61861.c: Removed.
> * gcc.dg/analyzer/pr93457.c: Removed.
> * gcc.dg/analyzer/pr97568.c: Removed.
> * gcc.dg/analyzer/write-to-string-literal-4.c: Removed.
> * c-c++-common/analyzer/allocation-size-multiline-1.c: New test.
> * c-c++-common/analyzer/allocation-size-multiline-2.c: New test.
> * c-c++-common/analyzer/allocation-size-multiline-3.c: New test.
> * c-c++-common/analyzer/data-model-11.c: New test.
> * c-c++-common/analyzer/pr61861.c: New test.
> * c-c++-common/analyzer/pr93457.c: New test.
> * c-c++-common/analyzer/pr97568.c: New test.
> * c-c++-common/analyzer/sprintf-2.c: C++-friendly bit of
> previous gcc.dg/analyzer/sprintf-1.c.
> * c-c++-common/analyzer/write-to-string-literal-4.c: New test.
> ---
> gcc/analyzer/analyzer.h | 24 ++
> gcc/analyzer/kf.cc | 210 ++++++++++++++----
> gcc/analyzer/known-function-manager.cc | 7 +
> gcc/analyzer/known-function-manager.h | 2 +
> gcc/analyzer/region-model.cc | 56 +++++
> gcc/analyzer/region-model.h | 4 +
> gcc/analyzer/sm-fd.cc | 25 ++-
> gcc/analyzer/sm-malloc.cc | 133 ++++++-----
> .../analyzer/aliasing-3.c | 8 +-
> .../analyzer/aliasing-pr106473.c | 2 +-
> .../analyzer/allocation-size-multiline-1.c | 96 ++++++++
> .../analyzer/allocation-size-multiline-2.c | 98 ++++++++
> .../analyzer/allocation-size-multiline-3.c | 68 ++++++
> .../analyzer/asm-x86-dyndbg-2.c | 8 +-
> .../analyzer/asm-x86-lp64-2.c | 4 +-
> .../analyzer/atomic-builtins-haproxy-proxy.c | 2 +-
> .../analyzer/atomic-builtins-qemu-sockets.c | 2 +-
> .../analyzer/attr-malloc-6.c | 12 +-
> .../attr-malloc-CVE-2019-19078-usb-leak.c | 9 +-
> .../analyzer/attr-tainted_args-1.c | 6 +-
> .../analyzer/call-summaries-pr107158.c | 4 +-
> .../analyzer/calloc-1.c | 7 +-
> .../analyzer/compound-assignment-5.c | 30 +--
> .../analyzer/coreutils-cksum-pr108664.c | 7 +-
> .../analyzer/coreutils-sum-pr108666.c | 2 +-
> .../c-c++-common/analyzer/data-model-11.c | 6 +
> .../analyzer/deref-before-check-pr108455-1.c | 2 +-
> ...-before-check-pr108455-git-pack-revindex.c | 2 +-
> .../analyzer/deref-before-check-pr108475-1.c | 3 +-
> ...f-before-check-pr108475-haproxy-tcpcheck.c | 8 +-
> ...f-before-check-pr109060-haproxy-cfgparse.c | 2 +-
> .../deref-before-check-pr109239-linux-bus.c | 5 +-
> .../analyzer/deref-before-check-pr77425.c | 4 +-
> .../analyzer/exec-1.c | 18 +-
> .../analyzer/feasibility-3.c | 13 +-
> .../analyzer/fields.c | 2 +-
> .../analyzer/function-ptr-5.c | 2 +-
> .../analyzer/infinite-recursion-pr108524-1.c | 4 +-
> .../analyzer/infinite-recursion-pr108524-2.c | 4 +-
> ...e-recursion-pr108524-qobject-json-parser.c | 4 +-
> .../{gcc.dg => c-c++-common}/analyzer/init.c | 4 +-
> .../analyzer/inlining-3-multiline.c | 39 +++-
> .../analyzer/inlining-3.c | 10 +-
> .../analyzer/inlining-4-multiline.c | 49 +++-
> .../analyzer/inlining-4.c | 9 +-
> .../analyzer/leak-pr105906.c | 5 +-
> .../leak-pr108045-with-call-summaries.c | 8 +-
> .../leak-pr108045-without-call-summaries.c | 8 +-
> .../analyzer/leak-pr109059-1.c | 2 +-
> .../analyzer/leak-pr109059-2.c | 2 +-
> .../analyzer/malloc-2.c | 2 +-
> .../analyzer/memcpy-2.c | 5 +-
> ...f-pr108251-smp_fetch_ssl_fc_has_early-O2.c | 6 +-
> ...eref-pr108251-smp_fetch_ssl_fc_has_early.c | 6 +-
> .../analyzer/null-deref-pr108806-qemu.c | 2 +-
> .../analyzer/null-deref-pr108830.c | 8 +-
> .../analyzer/pr101962.c | 5 +-
> .../analyzer/pr103217-2.c | 2 +-
> .../analyzer/pr103217.c | 2 +-
> .../analyzer/pr104029.c | 2 +-
> .../analyzer/pr104062.c | 4 +-
> .../analyzer/pr105783.c | 6 +-
> .../analyzer/pr107345.c | 3 +-
> gcc/testsuite/c-c++-common/analyzer/pr61861.c | 3 +
> gcc/testsuite/c-c++-common/analyzer/pr93457.c | 12 +
> .../analyzer/pr93695-1.c | 6 +-
> .../analyzer/pr94596.c | 9 +-
> .../analyzer/pr94839.c | 2 +-
> .../analyzer/pr95152-4.c | 4 +-
> .../analyzer/pr95152-5.c | 1 +
> .../analyzer/pr95240.c | 2 +-
> .../analyzer/pr96639.c | 2 +-
> .../analyzer/pr96653.c | 26 +--
> .../analyzer/pr96792.c | 2 +-
> .../analyzer/pr96841.c | 2 +-
> gcc/testsuite/c-c++-common/analyzer/pr97568.c | 31 +++
> .../analyzer/pr98564.c | 2 +-
> .../analyzer/pr98628.c | 4 +-
> .../analyzer/pr98969.c | 5 +-
> .../analyzer/pr99193-2.c | 2 +-
> .../analyzer/pr99193-3.c | 4 +-
> .../analyzer/pr99716-1.c | 3 +-
> .../analyzer/pr99774-1.c | 2 +-
> .../analyzer/realloc-1.c | 11 +-
> .../analyzer/realloc-2.c | 8 +-
> .../analyzer/realloc-3.c | 7 +-
> .../analyzer/realloc-4.c | 5 +-
> .../analyzer/realloc-5.c | 7 +-
> .../analyzer/realloc-pr110014.c | 6 +-
> .../analyzer/snprintf-concat.c | 6 +-
> .../analyzer/sock-1.c | 8 +-
> .../c-c++-common/analyzer/sprintf-2.c | 59 +++++
> .../analyzer/sprintf-concat.c | 6 +-
> .../analyzer/string-ops-concat-pair.c | 11 +-
> .../analyzer/string-ops-dup.c | 10 +-
> .../switch-enum-pr105273-git-vreportf-2.c | 2 +-
> .../analyzer/symbolic-12.c | 12 +-
> .../analyzer/uninit-alloca.c | 2 +-
> .../analyzer/untracked-2.c | 2 +-
> .../analyzer/vasprintf-1.c | 3 +-
> .../analyzer/write-to-const-1.c | 2 +-
> .../analyzer/write-to-function-1.c | 2 +
> .../analyzer/write-to-string-literal-1.c | 13 +-
> .../write-to-string-literal-4-disabled.c | 2 +-
> .../analyzer/write-to-string-literal-4.c | 26 +++
> .../analyzer/write-to-string-literal-5.c | 10 +-
> gcc/testsuite/g++.dg/analyzer/analyzer.exp | 3 +
> .../analyzer/allocation-size-multiline-1.c | 59 -----
> .../analyzer/allocation-size-multiline-2.c | 62 ------
> .../analyzer/allocation-size-multiline-3.c | 44 ----
> .../gcc.dg/analyzer/analyzer-decls.h | 12 +
> gcc/testsuite/gcc.dg/analyzer/analyzer.exp | 3 +
> gcc/testsuite/gcc.dg/analyzer/data-model-11.c | 6 -
> gcc/testsuite/gcc.dg/analyzer/pr104369-1.c | 8 +-
> gcc/testsuite/gcc.dg/analyzer/pr104369-2.c | 8 +-
> gcc/testsuite/gcc.dg/analyzer/pr61861.c | 2 -
> .../pr93355-localealias-feasibility-2.c | 1 -
> gcc/testsuite/gcc.dg/analyzer/pr93457.c | 10 -
> gcc/testsuite/gcc.dg/analyzer/pr97568.c | 29 ---
> gcc/testsuite/gcc.dg/analyzer/sprintf-1.c | 54 +----
> .../analyzer/write-to-string-literal-4.c | 23 --
> 121 files changed, 1142 insertions(+), 620 deletions(-)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/aliasing-3.c (89%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/aliasing-pr106473.c (53%)
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/asm-x86-dyndbg-2.c (96%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/asm-x86-lp64-2.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/atomic-builtins-haproxy-proxy.c (95%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/atomic-builtins-qemu-sockets.c (74%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/attr-malloc-6.c (88%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c (97%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/attr-tainted_args-1.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/call-summaries-pr107158.c (95%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/calloc-1.c (87%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/compound-assignment-5.c (83%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/coreutils-cksum-pr108664.c (97%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/coreutils-sum-pr108666.c (97%)
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/data-model-11.c
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108455-1.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108455-git-pack-revindex.c (98%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108475-1.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c (96%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c (97%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr109239-linux-bus.c (96%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/deref-before-check-pr77425.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/exec-1.c (59%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/feasibility-3.c (92%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/fields.c (92%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/function-ptr-5.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/infinite-recursion-pr108524-1.c (98%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/infinite-recursion-pr108524-2.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/infinite-recursion-pr108524-qobject-json-parser.c (99%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/init.c (97%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-3-multiline.c (55%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-3.c (51%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-4-multiline.c (54%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/inlining-4.c (51%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr105906.c (81%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr108045-with-call-summaries.c (87%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr108045-without-call-summaries.c (87%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr109059-1.c (93%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/leak-pr109059-2.c (92%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/malloc-2.c (89%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/memcpy-2.c (79%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c (93%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c (93%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108806-qemu.c (97%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/null-deref-pr108830.c (92%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr101962.c (95%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr103217-2.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr103217.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr104029.c (97%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr104062.c (70%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr105783.c (85%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr107345.c (73%)
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr61861.c
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr93457.c
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr93695-1.c (83%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr94596.c (92%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr94839.c (82%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr95152-4.c (55%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr95152-5.c (61%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr95240.c (89%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96639.c (80%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96653.c (98%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96792.c (93%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr96841.c (89%)
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/pr97568.c
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr98564.c (59%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr98628.c (100%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr98969.c (61%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99193-2.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99193-3.c (91%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99716-1.c (93%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/pr99774-1.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-1.c (84%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-2.c (95%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-3.c (96%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-4.c (97%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-5.c (90%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/realloc-pr110014.c (70%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/snprintf-concat.c (81%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/sock-1.c (91%)
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/sprintf-2.c
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/sprintf-concat.c (82%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/string-ops-concat-pair.c (83%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/string-ops-dup.c (83%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/switch-enum-pr105273-git-vreportf-2.c (94%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/symbolic-12.c (88%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/uninit-alloca.c (57%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/untracked-2.c (76%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/vasprintf-1.c (96%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-const-1.c (91%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-function-1.c (81%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-string-literal-1.c (73%)
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-string-literal-4-disabled.c (94%)
> create mode 100644 gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c
> rename gcc/testsuite/{gcc.dg => c-c++-common}/analyzer/write-to-string-literal-5.c (59%)
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-11.c
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr61861.c
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr93457.c
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97568.c
> delete mode 100644 gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c
>
> diff --git a/gcc/analyzer/analyzer.h b/gcc/analyzer/analyzer.h
> index 93a28b4b5cf..d42771f1e20 100644
> --- a/gcc/analyzer/analyzer.h
> +++ b/gcc/analyzer/analyzer.h
> @@ -128,6 +128,10 @@ struct interesting_t;
>
> class feasible_node;
>
> +class known_function;
> + class builtin_known_function;
> + class internal_known_function;
> +
> /* Forward decls of functions. */
>
> extern void dump_tree (pretty_printer *pp, tree t);
> @@ -279,6 +283,26 @@ public:
> {
> return;
> }
> +
> + virtual const builtin_known_function *
> + dyn_cast_builtin_kf () const { return NULL; }
> + virtual builtin_known_function *
> + dyn_cast_builtin_kf () { return NULL; }
> +};
> +
> +/* Subclass of known_function for builtin functions. */
> +
> +class builtin_known_function : public known_function
> +{
> +public:
> + virtual enum built_in_function builtin_code () const = 0;
> + tree builtin_decl () const {
> + gcc_assert (builtin_code () < END_BUILTINS);
> + return builtin_info[builtin_code ()].decl;
> + }
> +
> + const builtin_known_function *
> + dyn_cast_builtin_kf () const final override { return this; }
> };
>
> /* Subclass of known_function for IFN_* functions. */
> diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc
> index 36d9d10bb01..333ffd9751a 100644
> --- a/gcc/analyzer/kf.cc
> +++ b/gcc/analyzer/kf.cc
> @@ -53,13 +53,17 @@ impl_call_pre (const call_details &cd) const
>
> /* Handler for "alloca". */
>
> -class kf_alloca : public known_function
> +class kf_alloca : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return cd.num_args () == 1;
> }
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_ALLOCA;
> + }
> void impl_call_pre (const call_details &cd) const final override;
> };
>
> @@ -322,7 +326,7 @@ public:
>
> /* Handler for "calloc". */
>
> -class kf_calloc : public known_function
> +class kf_calloc : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> @@ -331,6 +335,11 @@ public:
> && cd.arg_is_size_p (0)
> && cd.arg_is_size_p (1));
> }
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_CALLOC;
> + }
> +
> void impl_call_pre (const call_details &cd) const final override;
> };
>
> @@ -462,12 +471,16 @@ public:
> all pointers to the region to the "freed" state together, regardless
> of casts. */
>
> -class kf_free : public known_function
> +class kf_free : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> {
> - return (cd.num_args () == 0 && cd.arg_is_pointer_p (0));
> + return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
> + }
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_FREE;
> }
> void impl_call_post (const call_details &cd) const final override;
> };
> @@ -488,7 +501,7 @@ kf_free::impl_call_post (const call_details &cd) const
>
> /* Handle the on_call_pre part of "malloc". */
>
> -class kf_malloc : public known_function
> +class kf_malloc : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> @@ -496,6 +509,10 @@ public:
> return (cd.num_args () == 1
> && cd.arg_is_size_p (0));
> }
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_MALLOC;
> + }
> void impl_call_pre (const call_details &cd) const final override;
> };
>
> @@ -520,9 +537,18 @@ kf_malloc::impl_call_pre (const call_details &cd) const
> /* TODO: complain about overlapping src and dest for the memcpy
> variants. */
>
> -class kf_memcpy_memmove : public known_function
> +class kf_memcpy_memmove : public builtin_known_function
> {
> public:
> + enum kf_memcpy_memmove_variant
> + {
> + KF_MEMCPY,
> + KF_MEMCPY_CHK,
> + KF_MEMMOVE,
> + KF_MEMMOVE_CHK,
> + };
> + kf_memcpy_memmove (enum kf_memcpy_memmove_variant variant)
> + : m_variant (variant) {};
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return (cd.num_args () == 3
> @@ -530,7 +556,25 @@ public:
> && cd.arg_is_pointer_p (1)
> && cd.arg_is_size_p (2));
> }
> + enum built_in_function builtin_code () const final override
> + {
> + switch (m_variant)
> + {
> + case KF_MEMCPY:
> + return BUILT_IN_MEMCPY;
> + case KF_MEMCPY_CHK:
> + return BUILT_IN_MEMCPY_CHK;
> + case KF_MEMMOVE:
> + return BUILT_IN_MEMMOVE;
> + case KF_MEMMOVE_CHK:
> + return BUILT_IN_MEMMOVE_CHK;
> + default:
> + gcc_unreachable ();
> + }
> + }
> void impl_call_pre (const call_details &cd) const final override;
> +private:
> + const enum kf_memcpy_memmove_variant m_variant;
> };
>
> void
> @@ -557,15 +601,21 @@ kf_memcpy_memmove::impl_call_pre (const call_details &cd) const
>
> /* Handler for "memset" and "__builtin_memset". */
>
> -class kf_memset : public known_function
> +class kf_memset : public builtin_known_function
> {
> public:
> + kf_memset (bool chk_variant) : m_chk_variant (chk_variant) {}
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return (cd.num_args () == 3 && cd.arg_is_pointer_p (0));
> }
> -
> + enum built_in_function builtin_code () const final override
> + {
> + return m_chk_variant ? BUILT_IN_MEMSET_CHK : BUILT_IN_MEMSET;
> + }
> void impl_call_pre (const call_details &cd) const final override;
> +private:
> + const bool m_chk_variant;
> };
>
> void
> @@ -747,7 +797,7 @@ public:
> Each of these has a custom_edge_info subclass, which updates
> the region_model and sm-state of the destination state. */
>
> -class kf_realloc : public known_function
> +class kf_realloc : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> @@ -756,6 +806,12 @@ public:
> && cd.arg_is_pointer_p (0)
> && cd.arg_is_size_p (1));
> }
> +
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_REALLOC;
> + }
> +
> void impl_call_post (const call_details &cd) const final override;
> };
>
> @@ -968,7 +1024,7 @@ kf_realloc::impl_call_post (const call_details &cd) const
>
> /* Handler for "strchr" and "__builtin_strchr". */
>
> -class kf_strchr : public known_function
> +class kf_strchr : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> @@ -979,6 +1035,11 @@ public:
> {
> cd.check_for_null_terminated_string_arg (0);
> }
> +
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_STRCHR;
> + }
> void impl_call_post (const call_details &cd) const final override;
> };
>
> @@ -1055,7 +1116,7 @@ kf_strchr::impl_call_post (const call_details &cd) const
> int sprintf(char *str, const char *format, ...);
> */
>
> -class kf_sprintf : public known_function
> +class kf_sprintf : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> @@ -1065,6 +1126,11 @@ public:
> && cd.arg_is_pointer_p (1));
> }
>
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_SPRINTF;
> + }
> +
> void impl_call_pre (const call_details &cd) const final override
> {
> /* For now, merely assume that the destination buffer gets set to a
> @@ -1108,10 +1174,12 @@ public:
>
> /* Handler for "strcat" and "__builtin_strcat_chk". */
>
> -class kf_strcat : public known_function
> +class kf_strcat : public builtin_known_function
> {
> public:
> - kf_strcat (unsigned int num_args) : m_num_args (num_args) {}
> + kf_strcat (unsigned int num_args, bool chk_variant)
> + : m_num_args (num_args),
> + m_chk_variant (chk_variant) {}
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return (cd.num_args () == m_num_args
> @@ -1119,6 +1187,11 @@ public:
> && cd.arg_is_pointer_p (1));
> }
>
> + enum built_in_function builtin_code () const final override
> + {
> + return m_chk_variant ? BUILT_IN_STRCAT_CHK : BUILT_IN_STRCAT;
> + }
> +
> void impl_call_pre (const call_details &cd) const final override
> {
> region_model *model = cd.get_model ();
> @@ -1159,25 +1232,32 @@ public:
>
> private:
> unsigned int m_num_args;
> + const bool m_chk_variant;
> };
>
> /* Handler for "strcpy" and "__builtin_strcpy_chk". */
>
> -class kf_strcpy : public known_function
> +class kf_strcpy : public builtin_known_function
> {
> public:
> - kf_strcpy (unsigned int num_args) : m_num_args (num_args) {}
> + kf_strcpy (unsigned int num_args, bool chk_variant)
> + : m_num_args (num_args),
> + m_chk_variant (chk_variant) {}
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return (cd.num_args () == m_num_args
> && cd.arg_is_pointer_p (0)
> && cd.arg_is_pointer_p (1));
> }
> -
> + enum built_in_function builtin_code () const final override
> + {
> + return m_chk_variant ? BUILT_IN_STRCPY_CHK : BUILT_IN_STRCPY;
> + }
> void impl_call_pre (const call_details &cd) const final override;
>
> private:
> unsigned int m_num_args;
> + const bool m_chk_variant;
> };
>
> void
> @@ -1207,13 +1287,17 @@ kf_strcpy::impl_call_pre (const call_details &cd) const
>
> /* Handler for "strdup" and "__builtin_strdup". */
>
> -class kf_strdup : public known_function
> +class kf_strdup : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
> }
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_STRDUP;
> + }
> void impl_call_pre (const call_details &cd) const final override
> {
> region_model *model = cd.get_model ();
> @@ -1234,13 +1318,18 @@ public:
>
> /* Handler for "strlen" and for "__analyzer_get_strlen". */
>
> -class kf_strlen : public known_function
> +class kf_strlen : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
> }
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_STRLEN;
> + }
> +
> void impl_call_pre (const call_details &cd) const final override
> {
> if (const svalue *strlen_sval
> @@ -1266,13 +1355,17 @@ make_kf_strlen ()
>
> /* Handler for "strndup" and "__builtin_strndup". */
>
> -class kf_strndup : public known_function
> +class kf_strndup : public builtin_known_function
> {
> public:
> bool matches_call_types_p (const call_details &cd) const final override
> {
> return (cd.num_args () == 2 && cd.arg_is_pointer_p (0));
> }
> + enum built_in_function builtin_code () const final override
> + {
> + return BUILT_IN_STRNDUP;
> + }
> void impl_call_pre (const call_details &cd) const final override
> {
> region_model *model = cd.get_model ();
> @@ -1445,44 +1538,73 @@ register_known_functions (known_function_manager &kfm)
> kfm.add (IFN_UBSAN_BOUNDS, make_unique<kf_ubsan_bounds> ());
> }
>
> - /* Built-ins the analyzer has known_functions for. */
> + /* GCC built-ins that do not correspond to a function
> + in the standard library. */
> {
> - kfm.add (BUILT_IN_ALLOCA, make_unique<kf_alloca> ());
> - kfm.add (BUILT_IN_ALLOCA_WITH_ALIGN, make_unique<kf_alloca> ());
> - kfm.add (BUILT_IN_CALLOC, make_unique<kf_calloc> ());
> kfm.add (BUILT_IN_EXPECT, make_unique<kf_expect> ());
> kfm.add (BUILT_IN_EXPECT_WITH_PROBABILITY, make_unique<kf_expect> ());
> - kfm.add (BUILT_IN_FREE, make_unique<kf_free> ());
> - kfm.add (BUILT_IN_MALLOC, make_unique<kf_malloc> ());
> - kfm.add (BUILT_IN_MEMCPY, make_unique<kf_memcpy_memmove> ());
> - kfm.add (BUILT_IN_MEMCPY_CHK, make_unique<kf_memcpy_memmove> ());
> - kfm.add (BUILT_IN_MEMMOVE, make_unique<kf_memcpy_memmove> ());
> - kfm.add (BUILT_IN_MEMMOVE_CHK, make_unique<kf_memcpy_memmove> ());
> - kfm.add (BUILT_IN_MEMSET, make_unique<kf_memset> ());
> - kfm.add (BUILT_IN_MEMSET_CHK, make_unique<kf_memset> ());
> - kfm.add (BUILT_IN_REALLOC, make_unique<kf_realloc> ());
> - kfm.add (BUILT_IN_SPRINTF, make_unique<kf_sprintf> ());
> + kfm.add (BUILT_IN_ALLOCA_WITH_ALIGN, make_unique<kf_alloca> ());
> kfm.add (BUILT_IN_STACK_RESTORE, make_unique<kf_stack_restore> ());
> kfm.add (BUILT_IN_STACK_SAVE, make_unique<kf_stack_save> ());
> - kfm.add (BUILT_IN_STRCAT, make_unique<kf_strcat> (2));
> - kfm.add (BUILT_IN_STRCAT_CHK, make_unique<kf_strcat> (3));
> - kfm.add (BUILT_IN_STRCHR, make_unique<kf_strchr> ());
> - kfm.add (BUILT_IN_STRCPY, make_unique<kf_strcpy> (2));
> - kfm.add (BUILT_IN_STRCPY_CHK, make_unique<kf_strcpy> (3));
> - kfm.add (BUILT_IN_STRDUP, make_unique<kf_strdup> ());
> - kfm.add (BUILT_IN_STRNDUP, make_unique<kf_strndup> ());
> - kfm.add (BUILT_IN_STRLEN, make_kf_strlen ());
>
> register_atomic_builtins (kfm);
> register_varargs_builtins (kfm);
> }
>
> - /* Known builtins and C standard library functions. */
> + /* Known builtins and C standard library functions
> + the analyzer has known functions for. */
> {
> - kfm.add ("memset", make_unique<kf_memset> ());
> - kfm.add ("strcat", make_unique<kf_strcat> (2));
> + kfm.add ("alloca", make_unique<kf_alloca> ());
> + kfm.add ("__builtin_alloca", make_unique<kf_alloca> ());
> + kfm.add ("calloc", make_unique<kf_calloc> ());
> + kfm.add ("__builtin_calloc", make_unique<kf_calloc> ());
> + kfm.add ("free", make_unique<kf_free> ());
> + kfm.add ("__builtin_free", make_unique<kf_free> ());
> + kfm.add ("malloc", make_unique<kf_malloc> ());
> + kfm.add ("__builtin_malloc", make_unique<kf_malloc> ());
> + kfm.add ("memcpy",
> + make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMCPY));
> + kfm.add ("__builtin_memcpy",
> + make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMCPY));
> + kfm.add ("__memcpy_chk", make_unique<kf_memcpy_memmove>
> + (kf_memcpy_memmove::KF_MEMCPY_CHK));
> + kfm.add ("__builtin___memcpy_chk", make_unique<kf_memcpy_memmove>
> + (kf_memcpy_memmove::KF_MEMCPY_CHK));
> + kfm.add ("memmove",
> + make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMMOVE));
> + kfm.add ("__builtin_memmove",
> + make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMMOVE));
> + kfm.add ("__memmove_chk", make_unique<kf_memcpy_memmove>
> + (kf_memcpy_memmove::KF_MEMMOVE_CHK));
> + kfm.add ("__builtin___memmove_chk", make_unique<kf_memcpy_memmove>
> + (kf_memcpy_memmove::KF_MEMMOVE_CHK));
> + kfm.add ("memset", make_unique<kf_memset> (false));
> + kfm.add ("__builtin_memset", make_unique<kf_memset> (false));
> + kfm.add ("__memset_chk", make_unique<kf_memset> (true));
> + kfm.add ("__builtin___memset_chk", make_unique<kf_memset> (true));
> + kfm.add ("realloc", make_unique<kf_realloc> ());
> + kfm.add ("__builtin_realloc", make_unique<kf_realloc> ());
> + kfm.add ("sprintf", make_unique<kf_sprintf> ());
> + kfm.add ("__builtin_sprintf", make_unique<kf_sprintf> ());
> + kfm.add ("strchr", make_unique<kf_strchr> ());
> + kfm.add ("__builtin_strchr", make_unique<kf_strchr> ());
> + kfm.add ("strcpy", make_unique<kf_strcpy> (2, false));
> + kfm.add ("__builtin_strcpy", make_unique<kf_strcpy> (2, false));
> + kfm.add ("__strcpy_chk", make_unique<kf_strcpy> (3, true));
> + kfm.add ("__builtin___strcpy_chk", make_unique<kf_strcpy> (3, true));
> + kfm.add ("strcat", make_unique<kf_strcat> (2, false));
> + kfm.add ("__builtin_strcat", make_unique<kf_strcat> (2, false));
> + kfm.add ("__strcat_chk", make_unique<kf_strcat> (3, true));
> + kfm.add ("__builtin___strcat_chk", make_unique<kf_strcat> (3, true));
> kfm.add ("strdup", make_unique<kf_strdup> ());
> + kfm.add ("__builtin_strdup", make_unique<kf_strdup> ());
> kfm.add ("strndup", make_unique<kf_strndup> ());
> + kfm.add ("__builtin_strndup", make_unique<kf_strndup> ());
> + kfm.add ("strlen", make_unique<kf_strlen> ());
> + kfm.add ("__builtin_strlen", make_unique<kf_strlen> ());
> +
> + register_atomic_builtins (kfm);
> + register_varargs_builtins (kfm);
> }
>
> /* Known POSIX functions, and some non-standard extensions. */
> diff --git a/gcc/analyzer/known-function-manager.cc b/gcc/analyzer/known-function-manager.cc
> index 4a2cf52d0b8..615c495f895 100644
> --- a/gcc/analyzer/known-function-manager.cc
> +++ b/gcc/analyzer/known-function-manager.cc
> @@ -137,6 +137,13 @@ known_function_manager::get_normal_builtin (enum built_in_function name) const
> return m_combined_fns_arr[name];
> }
>
> +const known_function *
> +known_function_manager::
> +get_normal_builtin (const builtin_known_function *builtin_kf) const
> +{
> + return get_normal_builtin (builtin_kf->builtin_code ());
> +}
> +
> /* Get any known_function matching IDENTIFIER, without type-checking.
> Return NULL if there isn't one. */
>
> diff --git a/gcc/analyzer/known-function-manager.h b/gcc/analyzer/known-function-manager.h
> index 1432e548acb..04f49ceb768 100644
> --- a/gcc/analyzer/known-function-manager.h
> +++ b/gcc/analyzer/known-function-manager.h
> @@ -54,6 +54,8 @@ private:
> DISABLE_COPY_AND_ASSIGN (known_function_manager);
>
> const known_function *get_normal_builtin (enum built_in_function name) const;
> + const known_function *
> + get_normal_builtin (const builtin_known_function *builtin_kf) const;
> const known_function *get_by_identifier (tree identifier) const;
>
> /* Map from identifier to known_function instance.
> diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
> index 02c073c15bc..4f31a6dcf0f 100644
> --- a/gcc/analyzer/region-model.cc
> +++ b/gcc/analyzer/region-model.cc
> @@ -1514,6 +1514,62 @@ region_model::get_known_function (enum internal_fn ifn) const
> return known_fn_mgr->get_internal_fn (ifn);
> }
>
> +/* Get any builtin_known_function for CALL and emit any warning to CTXT
> + if not NULL.
> +
> + The call must match all assumptions made by the known_function (such as
> + e.g. "argument 1's type must be a pointer type").
> +
> + Return NULL if no builtin_known_function is found, or it does
> + not match the assumption(s).
> +
> + Internally calls get_known_function to find a known_function and cast it
> + to a builtin_known_function.
> +
> + For instance, calloc is a C builtin, defined in gcc/builtins.def
> + by the DEF_LIB_BUILTIN macro. Such builtins are recognized by the
> + analyzer by their name, so that even in C++ or if the user redeclares
> + them but mismatch their signature, they are still recognized as builtins.
> +
> + Cases when a supposed builtin is not flagged as one by the FE:
> +
> + The C++ FE does not recognize calloc as a builtin if it has not been
> + included from a standard header, but the C FE does. Hence in C++ if
> + CALL comes from a calloc and stdlib is not included,
> + gcc/tree.h:fndecl_built_in_p (CALL) would be false.
> +
> + In C code, a __SIZE_TYPE__ calloc (__SIZE_TYPE__, __SIZE_TYPE__) user
> + declaration has obviously a mismatching signature from the standard, and
> + its function_decl tree won't be unified by
> + gcc/c-decl.cc:match_builtin_function_types.
> +
> + Yet in both cases the analyzer should treat the calls as a builtin calloc
> + so that extra attributes unspecified by the standard but added by GCC
> + (e.g. sprintf attributes in gcc/builtins.def), useful for the detection of
> + dangerous behavior, are indeed processed.
> +
> + Therefore for those cases when a "builtin flag" is not added by the FE,
> + builtins' kf are derived from builtin_known_function, whose method
> + builtin_known_function::builtin_decl returns the builtin's
> + function_decl tree as defined in gcc/builtins.def, with all the extra
> + attributes. */
> +
> +const builtin_known_function *
> +region_model::get_builtin_kf (const gcall *call,
> + region_model_context *ctxt /* = NULL */) const
> +{
> + region_model *mut_this = const_cast <region_model *> (this);
> + tree callee_fndecl = mut_this->get_fndecl_for_call (call, ctxt);
> + if (! callee_fndecl)
> + return NULL;
> +
> + call_details cd (call, mut_this, ctxt);
> + if (const known_function *kf = get_known_function (callee_fndecl, cd))
> + return kf->dyn_cast_builtin_kf ();
> +
> + return NULL;
> +}
> +
> /* Update this model for the CALL stmt, using CTXT to report any
> diagnostics - the first half.
>
> diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h
> index 40259625fb0..10b2a59e787 100644
> --- a/gcc/analyzer/region-model.h
> +++ b/gcc/analyzer/region-model.h
> @@ -528,6 +528,10 @@ class region_model
> bool include_terminator,
> const svalue **out_sval);
>
> + const builtin_known_function *
> + get_builtin_kf (const gcall *call,
> + region_model_context *ctxt = NULL) const;
> +
> private:
> const region *get_lvalue_1 (path_var pv, region_model_context *ctxt) const;
> const svalue *get_rvalue_1 (path_var pv, region_model_context *ctxt) const;
> diff --git a/gcc/analyzer/sm-fd.cc b/gcc/analyzer/sm-fd.cc
> index c75744ff63a..34bbd84f6e7 100644
> --- a/gcc/analyzer/sm-fd.cc
> +++ b/gcc/analyzer/sm-fd.cc
> @@ -1294,8 +1294,19 @@ fd_state_machine::check_for_fd_attrs (
> const gcall *call, const tree callee_fndecl, const char *attr_name,
> access_directions fd_attr_access_dir) const
> {
> -
> - tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));
> + /* Handle interesting fd attributes of the callee_fndecl,
> + or prioritize those of the builtin that callee_fndecl is
> + expected to be.
> + Might want this to be controlled by a flag. */
> + tree fndecl = callee_fndecl;
> + /* If call is recognized as a builtin known_function,
> + use that builtin's function_decl. */
> + if (const region_model *old_model = sm_ctxt->get_old_region_model ())
> + if (const builtin_known_function *builtin_kf
> + = old_model->get_builtin_kf (call))
> + fndecl = builtin_kf->builtin_decl ();
> +
> + tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (fndecl));
> attrs = lookup_attribute (attr_name, attrs);
> if (!attrs)
> return;
> @@ -1325,13 +1336,15 @@ fd_state_machine::check_for_fd_attrs (
> // attributes
> {
>
> + /* Do use the fndecl that caused the warning so that the
> + misused attributes are printed and the user not confused. */
> if (is_closed_fd_p (state))
> {
>
> sm_ctxt->warn (node, stmt, arg,
> make_unique<fd_use_after_close>
> (*this, diag_arg,
> - callee_fndecl, attr_name,
> + fndecl, attr_name,
> arg_idx));
> continue;
> }
> @@ -1343,7 +1356,7 @@ fd_state_machine::check_for_fd_attrs (
> sm_ctxt->warn (node, stmt, arg,
> make_unique<fd_use_without_check>
> (*this, diag_arg,
> - callee_fndecl, attr_name,
> + fndecl, attr_name,
> arg_idx));
> continue;
> }
> @@ -1361,7 +1374,7 @@ fd_state_machine::check_for_fd_attrs (
> node, stmt, arg,
> make_unique<fd_access_mode_mismatch> (*this, diag_arg,
> DIRS_WRITE,
> - callee_fndecl,
> + fndecl,
> attr_name,
> arg_idx));
> }
> @@ -1375,7 +1388,7 @@ fd_state_machine::check_for_fd_attrs (
> node, stmt, arg,
> make_unique<fd_access_mode_mismatch> (*this, diag_arg,
> DIRS_READ,
> - callee_fndecl,
> + fndecl,
> attr_name,
> arg_idx));
> }
> diff --git a/gcc/analyzer/sm-malloc.cc b/gcc/analyzer/sm-malloc.cc
> index ec763254b29..2ff777daaca 100644
> --- a/gcc/analyzer/sm-malloc.cc
> +++ b/gcc/analyzer/sm-malloc.cc
> @@ -1965,71 +1965,88 @@ malloc_state_machine::on_stmt (sm_context *sm_ctxt,
> malloc_state_machine *mutable_this
> = const_cast <malloc_state_machine *> (this);
>
> - /* Handle "__attribute__((malloc(FOO)))". */
> - if (const deallocator_set *deallocators
> + /* Handle interesting attributes of the callee_fndecl,
> + or prioritize those of the builtin that callee_fndecl is expected
> + to be.
> + Might want this to be controlled by a flag. */
> + {
> + tree fndecl = callee_fndecl;
> + /* If call is recognized as a builtin known_function, use that
> + builtin's function_decl. */
> + if (const region_model *old_model = sm_ctxt->get_old_region_model ())
> + if (const builtin_known_function *builtin_kf
> + = old_model->get_builtin_kf (call))
> + fndecl = builtin_kf->builtin_decl ();
> +
> + /* Handle "__attribute__((malloc(FOO)))". */
> + if (const deallocator_set *deallocators
> = mutable_this->get_or_create_custom_deallocator_set
> - (callee_fndecl))
> + (fndecl))
> + {
> + tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (fndecl));
> + bool returns_nonnull
> + = lookup_attribute ("returns_nonnull", attrs);
> + on_allocator_call (sm_ctxt, call, deallocators, returns_nonnull);
> + }
> +
> {
> - tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));
> - bool returns_nonnull
> - = lookup_attribute ("returns_nonnull", attrs);
> - on_allocator_call (sm_ctxt, call, deallocators, returns_nonnull);
> + /* Handle "__attribute__((nonnull))". */
> + tree fntype = TREE_TYPE (fndecl);
> + bitmap nonnull_args = get_nonnull_args (fntype);
> + if (nonnull_args)
> + {
> + for (unsigned i = 0; i < gimple_call_num_args (stmt); i++)
> + {
> + tree arg = gimple_call_arg (stmt, i);
> + if (TREE_CODE (TREE_TYPE (arg)) != POINTER_TYPE)
> + continue;
> + /* If we have a nonnull-args, and either all pointers, or
> + just the specified pointers. */
> + if (bitmap_empty_p (nonnull_args)
> + || bitmap_bit_p (nonnull_args, i))
> + {
> + state_t state = sm_ctxt->get_state (stmt, arg);
> + /* Can't use a switch as the states are non-const. */
> + /* Do use the fndecl that caused the warning so that the
> + misused attributes are printed and the user not
> + confused. */
> + if (unchecked_p (state))
> + {
> + tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
> + sm_ctxt->warn (node, stmt, arg,
> + make_unique<possible_null_arg>
> + (*this, diag_arg, fndecl, i));
> + const allocation_state *astate
> + = as_a_allocation_state (state);
> + sm_ctxt->set_next_state (stmt, arg,
> + astate->get_nonnull ());
> + }
> + else if (state == m_null)
> + {
> + tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
> + sm_ctxt->warn (node, stmt, arg,
> + make_unique<null_arg>
> + (*this, diag_arg, fndecl, i));
> + sm_ctxt->set_next_state (stmt, arg, m_stop);
> + }
> + else if (state == m_start)
> + maybe_assume_non_null (sm_ctxt, arg, stmt);
> + }
> + }
> + BITMAP_FREE (nonnull_args);
> + }
> }
>
> - /* Handle "__attribute__((nonnull))". */
> - {
> - tree fntype = TREE_TYPE (callee_fndecl);
> - bitmap nonnull_args = get_nonnull_args (fntype);
> - if (nonnull_args)
> + /* Check for this after nonnull, so that if we have both
> + then we transition to "freed", rather than "checked". */
> + unsigned dealloc_argno = fndecl_dealloc_argno (fndecl);
> + if (dealloc_argno != UINT_MAX)
> {
> - for (unsigned i = 0; i < gimple_call_num_args (stmt); i++)
> - {
> - tree arg = gimple_call_arg (stmt, i);
> - if (TREE_CODE (TREE_TYPE (arg)) != POINTER_TYPE)
> - continue;
> - /* If we have a nonnull-args, and either all pointers, or just
> - the specified pointers. */
> - if (bitmap_empty_p (nonnull_args)
> - || bitmap_bit_p (nonnull_args, i))
> - {
> - state_t state = sm_ctxt->get_state (stmt, arg);
> - /* Can't use a switch as the states are non-const. */
> - if (unchecked_p (state))
> - {
> - tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
> - sm_ctxt->warn (node, stmt, arg,
> - make_unique<possible_null_arg>
> - (*this, diag_arg, callee_fndecl, i));
> - const allocation_state *astate
> - = as_a_allocation_state (state);
> - sm_ctxt->set_next_state (stmt, arg,
> - astate->get_nonnull ());
> - }
> - else if (state == m_null)
> - {
> - tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
> - sm_ctxt->warn (node, stmt, arg,
> - make_unique<null_arg>
> - (*this, diag_arg, callee_fndecl, i));
> - sm_ctxt->set_next_state (stmt, arg, m_stop);
> - }
> - else if (state == m_start)
> - maybe_assume_non_null (sm_ctxt, arg, stmt);
> - }
> - }
> - BITMAP_FREE (nonnull_args);
> + const deallocator *d
> + = mutable_this->get_or_create_deallocator (fndecl);
> + on_deallocator_call (sm_ctxt, node, call, d, dealloc_argno);
> }
> }
> -
> - /* Check for this after nonnull, so that if we have both
> - then we transition to "freed", rather than "checked". */
> - unsigned dealloc_argno = fndecl_dealloc_argno (callee_fndecl);
> - if (dealloc_argno != UINT_MAX)
> - {
> - const deallocator *d
> - = mutable_this->get_or_create_deallocator (callee_fndecl);
> - on_deallocator_call (sm_ctxt, node, call, d, dealloc_argno);
> - }
> }
>
> /* Look for pointers explicitly being compared against zero
> diff --git a/gcc/testsuite/gcc.dg/analyzer/aliasing-3.c b/gcc/testsuite/c-c++-common/analyzer/aliasing-3.c
> similarity index 89%
> rename from gcc/testsuite/gcc.dg/analyzer/aliasing-3.c
> rename to gcc/testsuite/c-c++-common/analyzer/aliasing-3.c
> index 003077ad5c1..30772dca454 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/aliasing-3.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/aliasing-3.c
> @@ -1,6 +1,4 @@
> -#include "analyzer-decls.h"
> -
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> struct s1
> {
> @@ -39,7 +37,7 @@ static struct s2 *p2_glob = NULL;
> void test_2 (struct s2 **pp2, struct s2 *p2_parm)
> {
> /* Ensure that p2_glob is modified. */
> - p2_glob = __builtin_malloc (sizeof (struct s2));
> + p2_glob = (struct s2 *) __builtin_malloc (sizeof (struct s2));
> if (!p2_glob)
> return;
>
> @@ -61,7 +59,7 @@ struct s3 *p3_glob = NULL;
>
> void test_3 (struct s3 **pp3, struct s3 *p3_parm)
> {
> - p3_glob = __builtin_malloc (sizeof (struct s3));
> + p3_glob = (struct s3 *) __builtin_malloc (sizeof (struct s3));
> if (!p3_glob)
> return;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/aliasing-pr106473.c b/gcc/testsuite/c-c++-common/analyzer/aliasing-pr106473.c
> similarity index 53%
> rename from gcc/testsuite/gcc.dg/analyzer/aliasing-pr106473.c
> rename to gcc/testsuite/c-c++-common/analyzer/aliasing-pr106473.c
> index afd1492252e..4affa27b26c 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/aliasing-pr106473.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/aliasing-pr106473.c
> @@ -1,5 +1,5 @@
> void foo(char **args[], int *argc)
> {
> *argc = 1;
> - (*args)[0] = __builtin_malloc(42);
> + (*args)[0] = (char *) __builtin_malloc(42);
> }
> diff --git a/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c
> new file mode 100644
> index 00000000000..de1a49c436e
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-1.c
> @@ -0,0 +1,96 @@
> +/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
> +
> +#include <stdint.h>
> +
> +void test_constant_1 (void)
> +{
> + int32_t *ptr = (int32_t *) __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> + __builtin_free (ptr);
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_malloc (1);
> + ^~~~~~~~~~~~~~~~~~~~
> + 'test_constant_1': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_malloc (1);
> + | ^~~~~~~~~~~~~~~~~~~~
> + | |
> + | (1) allocated 1 byte here
> + | (2) assigned to 'int32_t *'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_malloc (1);
> + ~~~~~~~~~~~~~~~~~^~~
> + 'void test_constant_1()': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_malloc (1);
> + | ~~~~~~~~~~~~~~~~~^~~
> + | |
> + | (1) allocated 1 byte here
> + | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> +
> +void test_constant_2 (void)
> +{
> + int32_t *ptr = (int32_t *) __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> + __builtin_free (ptr);
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_malloc (2);
> + ^~~~~~~~~~~~~~~~~~~~
> + 'test_constant_2': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_malloc (2);
> + | ^~~~~~~~~~~~~~~~~~~~
> + | |
> + | (1) allocated 2 bytes here
> + | (2) assigned to 'int32_t *'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_malloc (2);
> + ~~~~~~~~~~~~~~~~~^~~
> + 'void test_constant_2()': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_malloc (2);
> + | ~~~~~~~~~~~~~~~~~^~~
> + | |
> + | (1) allocated 2 bytes here
> + | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> +
> +void test_symbolic (int n)
> +{
> + int32_t *ptr = (int32_t *) __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> + __builtin_free (ptr);
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
> + ^~~~~~~~~~~~~~~~~~~~~~~~
> + 'test_symbolic': event 1
> + |
> + | int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
> + | ^~~~~~~~~~~~~~~~~~~~~~~~
> + | |
> + | (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
> + ~~~~~~~~~~~~~~~~~^~~~~~~
> + 'void test_symbolic(int)': event 1
> + |
> + | int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
> + | ~~~~~~~~~~~~~~~~~^~~~~~~
> + | |
> + | (1) allocated '(n * 2)' bytes and assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> diff --git a/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c
> new file mode 100644
> index 00000000000..a5def2764fe
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-2.c
> @@ -0,0 +1,98 @@
> +/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
> +/* { dg-require-effective-target alloca } */
> +
> +#include <stdint.h>
> +
> +void test_constant_1 (void)
> +{
> + int32_t *ptr = (int32_t *) __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_alloca (1);
> + ^~~~~~~~~~~~~~~~~~~~
> + 'test_constant_1': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_alloca (1);
> + | ^~~~~~~~~~~~~~~~~~~~
> + | |
> + | (1) allocated 1 byte here
> + | (2) assigned to 'int32_t *'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_alloca (1);
> + ~~~~~~~~~~~~~~~~~^~~
> + 'void test_constant_1()': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_alloca (1);
> + | ~~~~~~~~~~~~~~~~~^~~
> + | |
> + | (1) allocated 1 byte here
> + | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> +
> +void test_constant_2 (void)
> +{
> + int32_t *ptr = (int32_t *) __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_alloca (2);
> + ^~~~~~~~~~~~~~~~~~~~
> + 'test_constant_2': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_alloca (2);
> + | ^~~~~~~~~~~~~~~~~~~~
> + | |
> + | (1) allocated 2 bytes here
> + | (2) assigned to 'int32_t *'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_alloca (2);
> + ~~~~~~~~~~~~~~~~~^~~
> + 'void test_constant_2()': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_alloca (2);
> + | ~~~~~~~~~~~~~~~~~^~~
> + | |
> + | (1) allocated 2 bytes here
> + | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> +
> +void test_symbolic (int n)
> +{
> + int32_t *ptr = (int32_t *) __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
> + ^~~~~~~~~~~~~~~~~~~~~~~~
> + 'test_symbolic': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
> + | ^~~~~~~~~~~~~~~~~~~~~~~~
> + | |
> + | (1) allocated 'n * 2' bytes here
> + | (2) assigned to 'int32_t *'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
> + ~~~~~~~~~~~~~~~~~^~~~~~~
> + 'void test_symbolic(int)': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
> + | ~~~~~~~~~~~~~~~~~^~~~~~~
> + | |
> + | (1) allocated '(n * 2)' bytes here
> + | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> +
> +/* FIXME: am getting a duplicate warning here for some reason
> + without -fanalyzer-fine-grained (PR PR analyzer/107851). */
> +
> diff --git a/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c
> new file mode 100644
> index 00000000000..3cf7fb00424
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/allocation-size-multiline-3.c
> @@ -0,0 +1,68 @@
> +/* Verify that we warn for incorrect uses of "alloca" (which may be in a
> + macro in a system header), and that the output looks correct. */
> +
> +/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
> +/* { dg-require-effective-target alloca } */
> +
> +#include <stdint.h>
> +#include "../../gcc.dg/analyzer/test-alloca.h"
> +
> +void test_constant_99 (void)
> +{
> + int32_t *ptr = (int32_t *) alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) alloca (99);
> + ^~~~~~
> + 'test_constant_99': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) alloca (99);
> + | ^~~~~~
> + | |
> + | (1) allocated 99 bytes here
> + | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) alloca (99);
> + ^~~~~~
> + 'void test_constant_99()': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) alloca (99);
> + | ^~~~~~
> + | |
> + | (1) allocated 99 bytes here
> + | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> +
> +void test_symbolic (int n)
> +{
> + int32_t *ptr = (int32_t *) alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> +}
> +
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) alloca (n * 2);
> + ^~~~~~
> + 'test_symbolic': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) alloca (n * 2);
> + | ^~~~~~
> + | |
> + | (1) allocated 'n * 2' bytes here
> + | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c } } */
> +/* { dg-begin-multiline-output "" }
> + int32_t *ptr = (int32_t *) alloca (n * 2);
> + ^~~~~~
> + 'void test_symbolic(int)': events 1-2
> + |
> + | int32_t *ptr = (int32_t *) alloca (n * 2);
> + | ^~~~~~
> + | |
> + | (1) allocated '(n * 2)' bytes here
> + | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/asm-x86-dyndbg-2.c b/gcc/testsuite/c-c++-common/analyzer/asm-x86-dyndbg-2.c
> similarity index 96%
> rename from gcc/testsuite/gcc.dg/analyzer/asm-x86-dyndbg-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/asm-x86-dyndbg-2.c
> index 8111709206f..d5e748c9acd 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/asm-x86-dyndbg-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/asm-x86-dyndbg-2.c
> @@ -8,9 +8,11 @@
> /* Adapted from various files in the Linux kernel, all of which have: */
> /* SPDX-License-Identifier: GPL-2.0 */
>
> -typedef _Bool bool;
> -#define true 1
> -#define false 0
> +#ifndef __cplusplus
> + typedef _Bool bool;
> + #define true 1
> + #define false 0
> +#endif
>
> typedef struct {} atomic_t;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/asm-x86-lp64-2.c b/gcc/testsuite/c-c++-common/analyzer/asm-x86-lp64-2.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/asm-x86-lp64-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/asm-x86-lp64-2.c
> index 2864ab69d2a..37c487a69c2 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/asm-x86-lp64-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/asm-x86-lp64-2.c
> @@ -3,7 +3,9 @@
>
> /* Adapted from Linux x86: page_ref_dec_and_test.c (GPL-2.0). */
>
> -typedef _Bool bool;
> +#ifndef __cplusplus
> + typedef _Bool bool;
> +#endif
>
> typedef struct {
> int counter;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c
> similarity index 95%
> rename from gcc/testsuite/gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c
> rename to gcc/testsuite/c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c
> index 72953a561b8..fbe89f7dfbb 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c
> @@ -37,7 +37,7 @@ proxy_capture_error(struct proxy* proxy,
>
> /* [...snip...] */
>
> - es = malloc(sizeof(*es));
> + es = (struct error_snapshot *) malloc(sizeof(*es));
> if (!es)
> return;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-qemu-sockets.c b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-qemu-sockets.c
> similarity index 74%
> rename from gcc/testsuite/gcc.dg/analyzer/atomic-builtins-qemu-sockets.c
> rename to gcc/testsuite/c-c++-common/analyzer/atomic-builtins-qemu-sockets.c
> index cd90f8f263d..05ac339ada7 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/atomic-builtins-qemu-sockets.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/atomic-builtins-qemu-sockets.c
> @@ -5,7 +5,7 @@ struct foo {
> void *
> test (const char *str)
> {
> - struct foo *p = __builtin_malloc(sizeof(struct foo));
> + struct foo *p = (struct foo *) __builtin_malloc(sizeof(struct foo));
> if (!p)
> return p;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-6.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-6.c
> similarity index 88%
> rename from gcc/testsuite/gcc.dg/analyzer/attr-malloc-6.c
> rename to gcc/testsuite/c-c++-common/analyzer/attr-malloc-6.c
> index bd28107d0d7..1665d4128f5 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-6.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-6.c
> @@ -74,7 +74,7 @@ void warn_fdopen (void)
>
> {
> FILE *q = fdopen (0); // { dg-message "allocated here" }
> - q = realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
> + q = (FILE *) realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
> sink (q);
> }
> }
> @@ -117,7 +117,7 @@ void warn_fopen (void)
>
> {
> FILE *q = fdopen (0);
> - q = realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
> + q = (FILE *) realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
> sink (q);
> }
> }
> @@ -170,18 +170,18 @@ void test_tmpfile (void)
> void warn_malloc (void)
> {
> {
> - FILE *p = malloc (100); // { dg-message "allocated here" }
> + FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
> fclose (p); // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'fclose'" }
> }
>
> {
> - FILE *p = malloc (100); // { dg-message "allocated here" }
> + FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
> p = freopen ("1", "r", p);// { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'freopen'" }
> fclose (p);
> }
>
> {
> - FILE *p = malloc (100); // { dg-message "allocated here" }
> + FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
> pclose (p); // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'pclose'" }
> }
> }
> @@ -222,7 +222,7 @@ void test_acquire (void)
>
> {
> FILE *p = acquire (); // { dg-message "allocated here \\(expects deallocation with 'release'\\)" }
> - p = realloc (p, 123); // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
> + p = (FILE *) realloc (p, 123); // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
> sink (p);
> }
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
> rename to gcc/testsuite/c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
> index e086843c42b..24fb46bd5a9 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
> @@ -3,7 +3,10 @@
>
> typedef unsigned char u8;
> typedef unsigned short u16;
> -typedef _Bool bool;
> +
> +#ifndef __cplusplus
> + typedef _Bool bool;
> +#endif
>
> #define ENOMEM 12
> #define EINVAL 22
> @@ -149,7 +152,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
> goto err;
> }
>
> - skb = items[i].transfer_context;
> + skb = (struct sk_buff *) items[i].transfer_context;
> urb_context->skb = skb;
>
> urb = usb_alloc_urb(0, GFP_ATOMIC); /* { dg-message "allocated here" } */
> @@ -209,7 +212,7 @@ static const struct ath10k_hif_ops ath10k_usb_hif_ops = {
>
> /* Simulate code to register the callback. */
> extern void callback_registration (const void *);
> -int ath10k_usb_probe(void)
> +void ath10k_usb_probe(void)
> {
> callback_registration(&ath10k_usb_hif_ops);
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-1.c b/gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-1.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-1.c
> index e1d87c9cece..0ff34469967 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-1.c
> @@ -1,7 +1,7 @@
> // TODO: remove need for this option
> /* { dg-additional-options "-fanalyzer-checker=taint" } */
>
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> struct arg_buf
> {
> @@ -23,7 +23,7 @@ test_1 (int i, void *p, char *q)
> __analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
> __analyzer_dump_state ("taint", *q); /* { dg-warning "state: 'tainted'" } */
>
> - struct arg_buf *args = p;
> + struct arg_buf *args = (struct arg_buf *) p;
> __analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'tainted'" } */
> __analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'tainted'" } */
> }
> @@ -49,7 +49,7 @@ test_2a (int i, void *p, char *q)
> __analyzer_dump_state ("taint", p); /* { dg-warning "state: 'start'" } */
> __analyzer_dump_state ("taint", q); /* { dg-warning "state: 'start'" } */
>
> - struct arg_buf *args = p;
> + struct arg_buf *args = (struct arg_buf *) p;
> __analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'start'" } */
> __analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'start'" } */
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/call-summaries-pr107158.c b/gcc/testsuite/c-c++-common/analyzer/call-summaries-pr107158.c
> similarity index 95%
> rename from gcc/testsuite/gcc.dg/analyzer/call-summaries-pr107158.c
> rename to gcc/testsuite/c-c++-common/analyzer/call-summaries-pr107158.c
> index 54f442f0ad4..d4cf079cef8 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/call-summaries-pr107158.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/call-summaries-pr107158.c
> @@ -25,7 +25,7 @@ __attribute__((__noreturn__)) void failed(const char *message);
> static char *string_dup(const char *string) {
> char *buf;
>
> - if ((buf = malloc(strlen(string) + 1)) == ((void *)0))
> + if ((buf = (char *) malloc(strlen(string) + 1)) == ((void *)0))
> failed("malloc() failed");
>
> return strcpy(buf, string);
> @@ -37,7 +37,7 @@ static void store_data(const char *name, const char *type) {
> if ((p = (struct mydata *)malloc(sizeof(struct mydata))) == ((void *)0))
> failed("malloc() failed");
>
> - p->link = ((void *)0);
> + p->link = (struct mydata *)((void *)0);
> p->name = string_dup(name);
> p->type = string_dup(type);
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/calloc-1.c b/gcc/testsuite/c-c++-common/analyzer/calloc-1.c
> similarity index 87%
> rename from gcc/testsuite/gcc.dg/analyzer/calloc-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/calloc-1.c
> index bc28128671f..6bd658ec94a 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/calloc-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/calloc-1.c
> @@ -1,9 +1,6 @@
> -#include "analyzer-decls.h"
> -
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> typedef __SIZE_TYPE__ size_t;
>
> -#define NULL ((void *)0)
> -
> extern void *calloc (size_t __nmemb, size_t __size)
> __attribute__ ((__nothrow__ , __leaf__))
> __attribute__ ((__malloc__))
> @@ -13,7 +10,7 @@ char *test_1 (size_t sz)
> {
> char *p;
>
> - p = calloc (1, 3);
> + p = (char *) calloc (1, 3);
> if (!p)
> return NULL;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/compound-assignment-5.c b/gcc/testsuite/c-c++-common/analyzer/compound-assignment-5.c
> similarity index 83%
> rename from gcc/testsuite/gcc.dg/analyzer/compound-assignment-5.c
> rename to gcc/testsuite/c-c++-common/analyzer/compound-assignment-5.c
> index ccf8fe392bf..3ce2b72c8ff 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/compound-assignment-5.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/compound-assignment-5.c
> @@ -1,4 +1,4 @@
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> struct coord
> {
> @@ -23,7 +23,7 @@ void test_1 (void)
>
> /* Copying from an on-stack array to a global array. */
>
> -struct coord glob_arr[16];
> +struct coord glob_arr2[16];
>
> void test_2 (void)
> {
> @@ -31,32 +31,30 @@ void test_2 (void)
> arr[3].x = 5;
> arr[3].y = 6;
>
> - glob_arr[7] = arr[3];
> + glob_arr2[7] = arr[3];
>
> - __analyzer_eval (glob_arr[7].x == 5); /* { dg-warning "TRUE" } */
> - __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
> + __analyzer_eval (glob_arr2[7].x == 5); /* { dg-warning "TRUE" } */
> + __analyzer_eval (glob_arr2[7].y == 6); /* { dg-warning "TRUE" } */
> }
>
> /* Copying from a partially initialized on-stack array to a global array. */
>
> -struct coord glob_arr[16];
> +struct coord glob_arr3[16];
>
> void test_3 (void)
> {
> struct coord arr[16];
> arr[3].y = 6;
>
> - glob_arr[7] = arr[3]; // or should the uninit warning be here?
> + glob_arr3[7] = arr[3]; // or should the uninit warning be here?
>
> - __analyzer_eval (glob_arr[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
> + __analyzer_eval (glob_arr3[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
> /* { dg-bogus "UNKNOWN" "unknown" { xfail *-*-* } .-1 } */
> - __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
> + __analyzer_eval (glob_arr3[7].y == 6); /* { dg-warning "TRUE" } */
> }
>
> /* Symbolic bindings: copying from one array to another. */
>
> -struct coord glob_arr[16];
> -
> void test_4 (int i)
> {
> struct coord arr_a[16];
> @@ -77,8 +75,6 @@ void test_4 (int i)
>
> /* Symbolic bindings: copying within an array: symbolic src and dest */
>
> -struct coord glob_arr[16];
> -
> void test_5a (int i, int j)
> {
> struct coord arr[16];
> @@ -95,8 +91,6 @@ void test_5a (int i, int j)
>
> /* Symbolic bindings: copying within an array: symbolic src, concrete dest. */
>
> -struct coord glob_arr[16];
> -
> void test_5b (int i)
> {
> struct coord arr[16];
> @@ -113,8 +107,6 @@ void test_5b (int i)
>
> /* Symbolic bindings: copying within an array: concrete src, symbolic dest. */
>
> -struct coord glob_arr[16];
> -
> void test_5c (int i)
> {
> struct coord arr[16];
> @@ -132,10 +124,12 @@ void test_5c (int i)
> /* No info on the subregion being copied, and hence
> binding_cluster2::maybe_get_compound_binding should return NULL. */
>
> +struct coord glob_arr6[16];
> +
> void test_6 (void)
> {
> struct coord arr[16];
> - arr[7] = glob_arr[3];
> + arr[7] = glob_arr6[3];
>
> __analyzer_eval (arr[7].x == 5); /* { dg-warning "UNKNOWN" } */
> __analyzer_eval (arr[7].y == 6); /* { dg-warning "UNKNOWN" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/coreutils-cksum-pr108664.c b/gcc/testsuite/c-c++-common/analyzer/coreutils-cksum-pr108664.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/coreutils-cksum-pr108664.c
> rename to gcc/testsuite/c-c++-common/analyzer/coreutils-cksum-pr108664.c
> index 62698f3d148..7ae4e6b06be 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/coreutils-cksum-pr108664.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/coreutils-cksum-pr108664.c
> @@ -7,6 +7,11 @@ typedef long unsigned int size_t;
> typedef unsigned int __uint32_t;
> typedef unsigned long int __uintmax_t;
> typedef struct _IO_FILE FILE;
> +
> +#ifndef __cplusplus
> + typedef _Bool bool;
> +#endif
> +
> extern size_t
> fread_unlocked(void* __restrict __ptr,
> size_t __size,
> @@ -30,7 +35,7 @@ __errno_location(void) __attribute__((__nothrow__, __leaf__))
> __attribute__((__const__));
> extern uint_fast32_t const crctab[8][256];
>
> -static _Bool
> +static bool
> cksum_slice8(FILE* fp, uint_fast32_t* crc_out, uintmax_t* length_out)
> {
> uint32_t buf[(1 << 16) / sizeof(uint32_t)];
> diff --git a/gcc/testsuite/gcc.dg/analyzer/coreutils-sum-pr108666.c b/gcc/testsuite/c-c++-common/analyzer/coreutils-sum-pr108666.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/coreutils-sum-pr108666.c
> rename to gcc/testsuite/c-c++-common/analyzer/coreutils-sum-pr108666.c
> index 9d13fce8531..5684d1b02d4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/coreutils-sum-pr108666.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/coreutils-sum-pr108666.c
> @@ -35,7 +35,7 @@ bsd_sum_stream(FILE* stream, void* resstream, uintmax_t* length)
> int checksum = 0;
> uintmax_t total_bytes = 0;
> static const size_t buffer_length = 32768;
> - uint8_t* buffer = malloc(buffer_length);
> + uint8_t* buffer = (uint8_t *) malloc(buffer_length);
>
> if (!buffer)
> return -1;
> diff --git a/gcc/testsuite/c-c++-common/analyzer/data-model-11.c b/gcc/testsuite/c-c++-common/analyzer/data-model-11.c
> new file mode 100644
> index 00000000000..0e64e5bf3ba
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/data-model-11.c
> @@ -0,0 +1,6 @@
> +int test (void)
> +{
> + const unsigned char *s = (const unsigned char *) "abc";
> + const signed char *t = (const signed char *) "xyz";
> + return s[1] + t[1];
> +}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-1.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-1.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-1.c
> index d7d873edc51..5f2ca966931 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-1.c
> @@ -19,7 +19,7 @@ int test_1 (void) {
> }
>
> data = could_fail_2 (fd);
> - hdr = data;
> + hdr = (struct header *) data;
>
> if (hdr->signature != 42) {
> ret = -2;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c
> similarity index 98%
> rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c
> rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c
> index 7553f86051d..7431bd11c42 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c
> @@ -95,7 +95,7 @@ int load_revindex_from_disk(char *revindex_name, uint32_t num_objects,
> }
>
> data = xmmap(((void *)0), revindex_size, 0x1, 0x02, fd, 0);
> - hdr = data;
> + hdr = (struct revindex_header *) data;
>
> if (git_bswap32(hdr->signature) != 0x52494458) {
> ret =
> diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-1.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-1.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-1.c
> index fa3beaaa15f..0d5edf821f2 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-1.c
> @@ -1,6 +1,7 @@
> /* Reduced from haproxy-2.7.1: src/tcpcheck.c. */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
>
> int
> test_1 (char **args, int cur_arg)
> diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
> similarity index 96%
> rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
> rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
> index 1180e17e555..7123cf5196b 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
> @@ -3,7 +3,9 @@
> /* { dg-additional-options "-Wno-analyzer-too-complex" } */
>
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
>
> extern void *calloc(size_t __nmemb, size_t __size)
> __attribute__((__nothrow__, __leaf__)) __attribute__((__malloc__))
> @@ -86,7 +88,7 @@ void free_tcpcheck(struct tcpcheck_rule *rule, int in_pool);
> void free_tcpcheck_http_hdr(struct tcpcheck_http_hdr *hdr);
>
> #define ist(str) ({ \
> - char *__x = (void *)(str); \
> + char *__x = (char *) ((void *)(str)); \
> (struct ist){ \
> .ptr = __x, \
> .len = __builtin_constant_p(str) ? \
> @@ -114,7 +116,7 @@ struct tcpcheck_rule *proxy_parse_httpchk_req(char **args, int cur_arg,
> goto error;
> }
>
> - chk = calloc(1, sizeof(*chk));
> + chk = (struct tcpcheck_rule *) calloc(1, sizeof(*chk));
> if (!chk) {
> /* [...snip...] */
> goto error;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
> rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
> index 4f50882eb8a..1d28e10747c 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
> @@ -51,7 +51,7 @@ parse_process_number(const char* arg,
> else if (strcmp(arg, "even") == 0)
> *proc |= (~0UL / 3UL) << 1;
> else {
> - const char *p, *dash = ((void*)0);
> + const char *p, *dash = (const char *) ((void*)0);
> unsigned int low, high;
>
> for (p = arg; *p; p++) {
> diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c
> similarity index 96%
> rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c
> rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c
> index 49b6420cc6b..add7731c6b0 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c
> @@ -1,7 +1,8 @@
> /* Reduced from linux-5.10.162's drivers-base-bus.c */
> /* { dg-additional-options "-fno-delete-null-pointer-checks -O2" } */
>
> -#define NULL ((void*)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
>
> typedef unsigned int __kernel_size_t;
> typedef int __kernel_ssize_t;
> @@ -57,7 +58,7 @@ struct kset*
> to_kset(struct kobject* kobj)
> {
> return kobj ? ({
> - void* __mptr = (void*)(kobj);
> + char* __mptr = (char*)(kobj);
> ((struct kset*)(__mptr - __builtin_offsetof(struct kset, kobj)));
> }) : NULL;
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr77425.c b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr77425.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr77425.c
> rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr77425.c
> index 1ceea97b422..c9be77c0553 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr77425.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr77425.c
> @@ -1,7 +1,9 @@
> /* Fixed in r7-2945-g61f46d0e6dd568.
> Simplified from gcc/ipa-devirt.c. */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
> +
> typedef struct odr_type_d {
> /* .... */
> int id;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/exec-1.c b/gcc/testsuite/c-c++-common/analyzer/exec-1.c
> similarity index 59%
> rename from gcc/testsuite/gcc.dg/analyzer/exec-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/exec-1.c
> index 6b71118bd54..25b88995515 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/exec-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/exec-1.c
> @@ -1,4 +1,10 @@
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
> +#ifdef __cplusplus
> + #define CONST_CAST(type) const_cast<type>
> +#else
> + #define CONST_CAST(type)
> +#endif
>
> extern int execl(const char *pathname, const char *arg, ...);
> extern int execlp(const char *file, const char *arg, ...);
> @@ -19,25 +25,25 @@ int test_execlpl_ls_al ()
>
> int test_execle_ls_al ()
> {
> - const char *env[3] = {"FOO=BAR", "BAZ", NULL};
> + char * env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
> return execl ("/usr/bin/ls", "ls", "-al", NULL, env);
> }
>
> int test_execv_ls_al ()
> {
> - char *argv[3] = {"ls", "-al", NULL};
> + char * argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
> return execv ("/usr/bin/ls", argv);
> }
>
> int test_execvp_ls_al ()
> {
> - char *argv[3] = {"ls", "-al", NULL};
> + char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
> return execvp ("ls", argv);
> }
>
> int test_execvpe_ls_al ()
> {
> - char *env[3] = {"FOO=BAR", "BAZ", NULL};
> - char *argv[3] = {"ls", "-al", NULL};
> + char *env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
> + char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
> return execvpe ("ls", argv, env);
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/feasibility-3.c b/gcc/testsuite/c-c++-common/analyzer/feasibility-3.c
> similarity index 92%
> rename from gcc/testsuite/gcc.dg/analyzer/feasibility-3.c
> rename to gcc/testsuite/c-c++-common/analyzer/feasibility-3.c
> index 0c0bd14fa54..2fcd064e801 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/feasibility-3.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/feasibility-3.c
> @@ -4,7 +4,9 @@
> /* Types. */
>
> typedef unsigned char u8;
> +#ifndef __cplusplus
> typedef _Bool bool;
> +#endif
> typedef unsigned int gfp_t;
>
> struct file;
> @@ -67,7 +69,7 @@ static inline bool pde_is_permanent(const struct proc_dir_entry *pde)
>
> static inline struct proc_inode *PROC_I(const struct inode *inode)
> {
> - void *__mptr = (void *)(inode);
> + char *__mptr = (char *)(inode);
> return ((struct proc_inode *)(__mptr - __builtin_offsetof(struct proc_inode, vfs_inode)));
> }
>
> @@ -89,8 +91,11 @@ static int proc_reg_open(struct inode *inode, struct file *file)
> {
> struct proc_dir_entry *pde = PDE(inode);
> int rv = 0;
> - typeof(((struct proc_ops*)0)->proc_open) open;
> - typeof(((struct proc_ops*)0)->proc_release) release;
> +
> +
> + int (*open)(struct inode *, struct file *);
> + int (*release)(struct inode *, struct file *);
> +
> struct pde_opener *pdeo;
>
> if (pde_is_permanent(pde)) {
> @@ -104,7 +109,7 @@ static int proc_reg_open(struct inode *inode, struct file *file)
>
> release = pde->proc_ops->proc_release;
> if (release) {
> - pdeo = kmem_cache_alloc(pde_opener_cache,
> + pdeo = (struct pde_opener *) kmem_cache_alloc(pde_opener_cache,
> ((( gfp_t)(0x400u|0x800u))
> | (( gfp_t)0x40u)
> | (( gfp_t)0x80u)));
> diff --git a/gcc/testsuite/gcc.dg/analyzer/fields.c b/gcc/testsuite/c-c++-common/analyzer/fields.c
> similarity index 92%
> rename from gcc/testsuite/gcc.dg/analyzer/fields.c
> rename to gcc/testsuite/c-c++-common/analyzer/fields.c
> index 0bf877fcf1e..18595307c9b 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/fields.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/fields.c
> @@ -30,7 +30,7 @@ recvauth_common (int problem)
> krb5_error error;
> const char *message = error_message(problem);
> error.text.length = strlen(message) + 1;
> - if (!(error.text.data = malloc(error.text.length))) {
> + if (!(error.text.data = (char *) malloc(error.text.length))) {
> goto cleanup;
> }
> free(error.text.data);
> diff --git a/gcc/testsuite/gcc.dg/analyzer/function-ptr-5.c b/gcc/testsuite/c-c++-common/analyzer/function-ptr-5.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/function-ptr-5.c
> rename to gcc/testsuite/c-c++-common/analyzer/function-ptr-5.c
> index 3c46f289082..2b83978c1ad 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/function-ptr-5.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/function-ptr-5.c
> @@ -1,4 +1,4 @@
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> void calling_null_fn_ptr_1 (void)
> {
> diff --git a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-1.c b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-1.c
> similarity index 98%
> rename from gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-1.c
> index d9221fa8dc5..26fc8d2e8d4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-1.c
> @@ -3,7 +3,9 @@
>
> /* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
> +
> typedef __builtin_va_list va_list;
>
> typedef struct _GQueue GQueue;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-2.c b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-2.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-2.c
> index 58f6d2f4463..d483d7e643c 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-2.c
> @@ -62,7 +62,7 @@ void test_5 (struct st2 *p)
>
> void test_6 (struct st2 *p)
> {
> - struct st2 *q = __builtin_malloc (p->i);
> + struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
> if (!q)
> return;
> q->i = p->i;
> @@ -72,7 +72,7 @@ void test_6 (struct st2 *p)
>
> void test_7 (struct st2 *p)
> {
> - struct st2 *q = __builtin_malloc (p->i);
> + struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
> q->i = p->i; /* { dg-warning "dereference of possibly-NULL 'q'" } */
> test_7 (q);
> __builtin_free (q);
> diff --git a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
> similarity index 99%
> rename from gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
> rename to gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
> index b40326fc252..64ea62edd65 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
> @@ -3,7 +3,9 @@
>
> /* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
> +
> typedef __builtin_va_list va_list;
> typedef __SIZE_TYPE__ size_t;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/init.c b/gcc/testsuite/c-c++-common/analyzer/init.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/init.c
> rename to gcc/testsuite/c-c++-common/analyzer/init.c
> index e51d88e9ff9..cd3c16f4766 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/init.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/init.c
> @@ -5,7 +5,7 @@
> gimple assign stmts, with just "zero-init everything" CONSTRUCTORs
> and "clobber" CONSTRUCTORs. */
>
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> struct coord
> {
> @@ -95,7 +95,7 @@ void test_9 (void)
>
> void test_10 (void)
> {
> - struct coord c[2] = {{.y = 4, .x = 3}, {5, 6}};
> + struct coord c[2] = {{.x = 3, .y = 4}, {5, 6}};
> __analyzer_eval (c[0].x == 3); /* { dg-warning "TRUE" } */
> __analyzer_eval (c[0].y == 4); /* { dg-warning "TRUE" } */
> __analyzer_eval (c[1].x == 5); /* { dg-warning "TRUE" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-3-multiline.c b/gcc/testsuite/c-c++-common/analyzer/inlining-3-multiline.c
> similarity index 55%
> rename from gcc/testsuite/gcc.dg/analyzer/inlining-3-multiline.c
> rename to gcc/testsuite/c-c++-common/analyzer/inlining-3-multiline.c
> index 15a2dd8f0e1..fbd20e949b6 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/inlining-3-multiline.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/inlining-3-multiline.c
> @@ -4,8 +4,8 @@
> /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
> /* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
>
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
>
> struct input_file_st
> {
> @@ -61,4 +61,39 @@ test (const input_file *inpf)
> | (4) ...to here
> | (5) argument 1 ('<unknown>') NULL where non-null expected
> |
> - { dg-end-multiline-output "" } */
> + { dg-end-multiline-output "" { target c } } */
> +
> +
> +/* { dg-begin-multiline-output "" }
> + return __builtin_strlen (f);
> + ~~~~~~~~~~~~~~~~~^~~
> + 'size_t test(const input_file*)': events 1-2 (depth 1)
> + |
> + | test (const input_file *inpf)
> + | ^~~~
> + | |
> + | (1) entry to 'test'
> + |
> + | const char *f = get_input_file_name (inpf);
> + | ~
> + | |
> + | (2) inlined call to 'get_input_file_name' from 'test'
> + |
> + +--> 'const char* get_input_file_name(const input_file*)': event 3 (depth 2)
> + |
> + | if (inpf)
> + | ^~
> + | |
> + | (3) following 'false' branch (when 'inpf' is NULL)...
> + |
> + <------+
> + |
> + 'size_t test(const input_file*)': events 4-5 (depth 1)
> + |
> + | return __builtin_strlen (f);
> + | ~~~~~~~~~~~~~~~~~^~~
> + | |
> + | (4) ...to here
> + | (5) argument 1 ('<unknown>') NULL where non-null expected
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> \ No newline at end of file
> diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-3.c b/gcc/testsuite/c-c++-common/analyzer/inlining-3.c
> similarity index 51%
> rename from gcc/testsuite/gcc.dg/analyzer/inlining-3.c
> rename to gcc/testsuite/c-c++-common/analyzer/inlining-3.c
> index 7a292ac87fa..0345585bed2 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/inlining-3.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/inlining-3.c
> @@ -3,8 +3,9 @@
>
> /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
>
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +
>
> struct input_file_st
> {
> @@ -16,7 +17,9 @@ typedef struct input_file_st input_file;
> static inline const char*
> get_input_file_name (const input_file *inpf)
> {
> - if (inpf) /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" } */
> + if (inpf)
> + /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" "" { target c } .-1 } */
> + /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'const char\\* get_input_file_name\\(const input_file\\*\\)', depth 2\\)" "" { target c++ } .-2 } */
> return inpf->inpname;
> return NULL;
> }
> @@ -26,5 +29,6 @@ test (const input_file *inpf)
> {
> const char *f = get_input_file_name (inpf);
> return __builtin_strlen (f); /* { dg-warning "use of NULL" "warning" } */
> - /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target *-*-* } .-1 } */
> + /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target c } .-1 } */
> + /* { dg-message "NULL where non-null expected \\(fndecl 'size_t test\\(const input_file\\*\\)', depth 1\\)" "message" { target c++ } .-2 } */
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-4-multiline.c b/gcc/testsuite/c-c++-common/analyzer/inlining-4-multiline.c
> similarity index 54%
> rename from gcc/testsuite/gcc.dg/analyzer/inlining-4-multiline.c
> rename to gcc/testsuite/c-c++-common/analyzer/inlining-4-multiline.c
> index 0413c39af03..c870a9f654d 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/inlining-4-multiline.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/inlining-4-multiline.c
> @@ -4,7 +4,8 @@
> /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
> /* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
>
> static inline const char*
> inner (int flag)
> @@ -69,4 +70,48 @@ outer (int flag)
> | |
> | (6) dereference of NULL '<unknown>'
> |
> - { dg-end-multiline-output "" } */
> + { dg-end-multiline-output "" { target c } } */
> +/* { dg-begin-multiline-output "" }
> + return *middle (flag);
> + ^
> + 'char outer(int)': events 1-2 (depth 1)
> + |
> + | outer (int flag)
> + | ^~~~~
> + | |
> + | (1) entry to 'outer'
> + |
> + | return *middle (flag);
> + | ~
> + | |
> + | (2) inlined call to 'middle' from 'outer'
> + |
> + +--> 'const char* middle(int)': event 3 (depth 2)
> + |
> + | return inner (flag);
> + | ^
> + | |
> + | (3) inlined call to 'inner' from 'middle'
> + |
> + +--> 'const char* inner(int)': event 4 (depth 3)
> + |
> + | if (flag)
> + | ^~
> + | |
> + | (4) following 'true' branch (when 'flag != 0')...
> + |
> + <-------------+
> + |
> + 'char outer(int)': event 5 (depth 1)
> + |
> + |cc1plus:
> + | (5): ...to here
> + |
> + 'char outer(int)': event 6 (depth 1)
> + |
> + | return *middle (flag);
> + | ^
> + | |
> + | (6) dereference of NULL '<unknown>'
> + |
> + { dg-end-multiline-output "" { target c++ } } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/inlining-4.c b/gcc/testsuite/c-c++-common/analyzer/inlining-4.c
> similarity index 51%
> rename from gcc/testsuite/gcc.dg/analyzer/inlining-4.c
> rename to gcc/testsuite/c-c++-common/analyzer/inlining-4.c
> index f4e42084c91..85b42445d26 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/inlining-4.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/inlining-4.c
> @@ -3,12 +3,14 @@
>
> /* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> static inline const char*
> inner (int flag)
> {
> - if (flag) /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" } */
> + if (flag)
> + /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" "" { target c } .-1 } */
> + /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'const char\\* inner\\(int\\)', depth 3\\)" "" { target c++ } .-2 } */
> return NULL;
> return "foo";
> }
> @@ -23,5 +25,6 @@ char
> outer (int flag)
> {
> return *middle (flag); /* { dg-warning "dereference of NULL" "warning" } */
> - /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target *-*-* } .-1 } */
> + /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target c } .-1 } */
> + /* { dg-message "\\(fndecl 'char outer\\(int\\)', depth 1\\)" "message" { target c++ } .-2 } */
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr105906.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr105906.c
> similarity index 81%
> rename from gcc/testsuite/gcc.dg/analyzer/leak-pr105906.c
> rename to gcc/testsuite/c-c++-common/analyzer/leak-pr105906.c
> index 72901e4d1eb..a37aa59ca7b 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/leak-pr105906.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr105906.c
> @@ -1,6 +1,7 @@
> /* { dg-additional-options "-Wno-analyzer-too-complex" } */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
>
> #define LEN 64
>
> @@ -13,7 +14,7 @@ epystr_explode(const char *delim, char *str)
> if (str == NULL || delim == NULL)
> return NULL;
>
> - out = __builtin_malloc(LEN * sizeof(char *));
> + out = (char **) __builtin_malloc(LEN * sizeof(char *));
> if (out == NULL)
> return NULL;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-with-call-summaries.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-with-call-summaries.c
> similarity index 87%
> rename from gcc/testsuite/gcc.dg/analyzer/leak-pr108045-with-call-summaries.c
> rename to gcc/testsuite/c-c++-common/analyzer/leak-pr108045-with-call-summaries.c
> index d63be06a9bb..e4be5093641 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-with-call-summaries.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-with-call-summaries.c
> @@ -1,7 +1,7 @@
> /* { dg-additional-options "-fanalyzer-call-summaries" } */
>
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> /* data structures */
>
> @@ -31,7 +31,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
> {
> struct screen_s *result = NULL;
>
> - result = __builtin_calloc(1, sizeof(*result));
> + result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
> if (!result)
> return NULL;
>
> @@ -39,7 +39,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
> result->rows = rows;
>
> /* make one allocation which will be accessed like a 2D array */
> - result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
> + result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
> if (!result->data) {
> __builtin_free(result);
> return NULL;
> @@ -91,7 +91,7 @@ void resize_screen(size_t cols, size_t rows)
>
> int main(void)
> {
> - ctx = __builtin_calloc(1, sizeof(*ctx));
> + ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
> if (!ctx)
> __builtin_abort();
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-without-call-summaries.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-without-call-summaries.c
> similarity index 87%
> rename from gcc/testsuite/gcc.dg/analyzer/leak-pr108045-without-call-summaries.c
> rename to gcc/testsuite/c-c++-common/analyzer/leak-pr108045-without-call-summaries.c
> index ae7a7d5c159..3196e99ba37 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/leak-pr108045-without-call-summaries.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr108045-without-call-summaries.c
> @@ -2,7 +2,7 @@
> /* { dg-additional-options "-Wno-analyzer-too-complex" } */
>
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> /* data structures */
>
> @@ -32,7 +32,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
> {
> struct screen_s *result = NULL;
>
> - result = __builtin_calloc(1, sizeof(*result));
> + result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
> if (!result)
> return NULL;
>
> @@ -40,7 +40,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
> result->rows = rows;
>
> /* make one allocation which will be accessed like a 2D array */
> - result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
> + result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
> if (!result->data) {
> __builtin_free(result);
> return NULL;
> @@ -92,7 +92,7 @@ void resize_screen(size_t cols, size_t rows)
>
> int main(void)
> {
> - ctx = __builtin_calloc(1, sizeof(*ctx));
> + ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
> if (!ctx)
> __builtin_abort();
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-1.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-1.c
> similarity index 93%
> rename from gcc/testsuite/gcc.dg/analyzer/leak-pr109059-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/leak-pr109059-1.c
> index 033ab79460e..ae196d75b93 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-1.c
> @@ -27,7 +27,7 @@ cfg_register_postparser(char* name, int (*func)())
> {
> struct cfg_postparser* cp;
>
> - cp = calloc(1, sizeof(*cp));
> + cp = (struct cfg_postparser *) calloc(1, sizeof(*cp));
> if (!cp) {
> /* [...snip...] */
> return 0;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-2.c b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-2.c
> similarity index 92%
> rename from gcc/testsuite/gcc.dg/analyzer/leak-pr109059-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/leak-pr109059-2.c
> index 125bce84864..26329ffac46 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/leak-pr109059-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/leak-pr109059-2.c
> @@ -26,7 +26,7 @@ test_1 (char* name)
> {
> struct cfg_postparser* cp;
>
> - cp = calloc(1, sizeof(*cp));
> + cp = (struct cfg_postparser*) calloc(1, sizeof(*cp));
> if (!cp) {
> /* [...snip...] */
> return 0;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-2.c b/gcc/testsuite/c-c++-common/analyzer/malloc-2.c
> similarity index 89%
> rename from gcc/testsuite/gcc.dg/analyzer/malloc-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/malloc-2.c
> index bb93c53d3e0..ed68209da72 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/malloc-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/malloc-2.c
> @@ -16,7 +16,7 @@ void test_1 (void)
>
> int *test_2 (void)
> {
> - int *i = malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
> + int *i = (int *) malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
> *i = 42; /* { dg-warning "dereference of possibly-NULL 'i'" "warning" } */
> /* { dg-message "\\(2\\) 'i' could be NULL: unchecked value from \\(1\\)" "event" { target *-*-* } .-1 } */
> return i;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/memcpy-2.c b/gcc/testsuite/c-c++-common/analyzer/memcpy-2.c
> similarity index 79%
> rename from gcc/testsuite/gcc.dg/analyzer/memcpy-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/memcpy-2.c
> index 51e4a694951..25b0a5e4ff4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/memcpy-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/memcpy-2.c
> @@ -1,8 +1,9 @@
> /* { dg-additional-options "-Wno-stringop-overflow -Wno-analyzer-out-of-bounds" } */
>
> -void
> -main (int c, void *v)
> +int
> +test (int c, void *v)
> {
> static char a[] = "";
> __builtin_memcpy (v, a, -1);
> + return 0;
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
> similarity index 93%
> rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
> rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
> index cb46827ab65..c46ffe91a6b 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
> @@ -61,12 +61,12 @@ static inline enum obj_type obj_type(const enum obj_type *t)
> }
> static inline struct connection *__objt_conn(enum obj_type *t)
> {
> - return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
> + return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
> }
> static inline struct connection *objt_conn(enum obj_type *t)
> {
> if (!t || *t != OBJ_TYPE_CONN)
> - return ((void *)0);
> + return (struct connection *)((void *)0);
> return __objt_conn(t);
> }
> struct session {
> @@ -80,7 +80,7 @@ SSL *ssl_sock_get_ssl_object(struct connection *conn);
> /*****************************************************************************/
>
> int
> -smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
> +smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
> {
> SSL *ssl;
> struct connection *conn;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
> similarity index 93%
> rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
> rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
> index fbacb6ca2d3..ef34a76c50d 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
> @@ -60,12 +60,12 @@ static inline enum obj_type obj_type(const enum obj_type *t)
> }
> static inline struct connection *__objt_conn(enum obj_type *t)
> {
> - return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
> + return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
> }
> static inline struct connection *objt_conn(enum obj_type *t)
> {
> if (!t || *t != OBJ_TYPE_CONN)
> - return ((void *)0);
> + return (struct connection *) ((void *)0);
> return __objt_conn(t);
> }
> struct session {
> @@ -79,7 +79,7 @@ SSL *ssl_sock_get_ssl_object(struct connection *conn);
> /*****************************************************************************/
>
> int
> -smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
> +smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
> {
> SSL *ssl;
> struct connection *conn;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108806-qemu.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108806-qemu.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108806-qemu.c
> rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108806-qemu.c
> index 3ab72c053af..f7f6923927f 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108806-qemu.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108806-qemu.c
> @@ -1,6 +1,6 @@
> /* Reduced from qemu-7.2.0's hw/intc/omap_intc.c */
>
> -#define NULL ((void*)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> typedef unsigned char __uint8_t;
> typedef unsigned int __uint32_t;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108830.c b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108830.c
> similarity index 92%
> rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108830.c
> rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108830.c
> index 417ab00794d..0c95148ebd5 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108830.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/null-deref-pr108830.c
> @@ -2,7 +2,7 @@
>
> /* { dg-additional-options "-Wno-analyzer-too-complex" } */
>
> -#define NULL ((void*)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> typedef __SIZE_TYPE__ size_t;
>
> @@ -43,7 +43,7 @@ struct apr_hash_t
> static apr_hash_entry_t**
> alloc_array(apr_hash_t* ht, unsigned int max)
> {
> - return memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
> + return (apr_hash_entry_t **) memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
> 0,
> sizeof(*ht->array) * (max + 1));
> }
> @@ -57,7 +57,7 @@ apr_hash_merge(apr_pool_t* p,
> apr_hash_entry_t* new_vals = NULL;
> apr_hash_entry_t* iter;
> unsigned int i, j, k;
> - res = apr_palloc(p, sizeof(apr_hash_t));
> + res = (apr_hash_t *) apr_palloc(p, sizeof(apr_hash_t));
> res->pool = p;
> res->free = NULL;
> res->hash_func = base->hash_func;
> @@ -69,7 +69,7 @@ apr_hash_merge(apr_pool_t* p,
> res->seed = base->seed;
> res->array = alloc_array(res, res->max);
> if (base->count + overlay->count) {
> - new_vals =
> + new_vals = (apr_hash_entry_t *)
> apr_palloc(p, sizeof(apr_hash_entry_t) * (base->count + overlay->count));
> }
> j = 0;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr101962.c b/gcc/testsuite/c-c++-common/analyzer/pr101962.c
> similarity index 95%
> rename from gcc/testsuite/gcc.dg/analyzer/pr101962.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr101962.c
> index 5eb7cf0b995..32cef1617c1 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr101962.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr101962.c
> @@ -1,6 +1,5 @@
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> -#define NULL ((void *)0)
>
> /* Verify that the analyzer makes the simplifying assumption that we don't
> hit NULL when incrementing pointers to non-NULL memory regions. */
> @@ -35,7 +34,7 @@ maybe_inc_char_ptr (const char *ptr)
> return ++ptr;
> }
>
> -char
> +void
> test_s (void)
> {
> const char *msg = "hello world";
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr103217-2.c b/gcc/testsuite/c-c++-common/analyzer/pr103217-2.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/pr103217-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr103217-2.c
> index aa8bca7ce5f..69ba6454e57 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr103217-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr103217-2.c
> @@ -30,7 +30,7 @@ struct test {
> };
>
> int main(int argc, char *argv[]) {
> - struct test *options = calloc(1, sizeof(*options));
> + struct test *options = (struct test *) calloc(1, sizeof(*options));
> int rc;
> if (!options)
> abort();
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr103217.c b/gcc/testsuite/c-c++-common/analyzer/pr103217.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/pr103217.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr103217.c
> index 08889acb2c9..ae298ccaebb 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr103217.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr103217.c
> @@ -13,7 +13,7 @@ extern char *optarg;
> extern void free (void *__ptr)
> __attribute__ ((__nothrow__ , __leaf__));
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> char *xstrdup(const char *src) {
> char *val = strdup(src);
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104029.c b/gcc/testsuite/c-c++-common/analyzer/pr104029.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/pr104029.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr104029.c
> index adf15ed356f..873f0eb16b7 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr104029.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr104029.c
> @@ -23,7 +23,7 @@ int heapsort(void *vbase, size_t nmemb, size_t size, t_compfunc compar) {
> return (-1);
> }
>
> - k = my_malloc1(__FILE__, __LINE__, size);
> + k = (char *) my_malloc1(__FILE__, __LINE__, size);
>
> abase = (char *)vbase - size;
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104062.c b/gcc/testsuite/c-c++-common/analyzer/pr104062.c
> similarity index 70%
> rename from gcc/testsuite/gcc.dg/analyzer/pr104062.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr104062.c
> index 7129c27f60b..9b44893dd4b 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr104062.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr104062.c
> @@ -7,7 +7,7 @@ realloc (void *, __SIZE_TYPE__);
> void
> foo (void)
> {
> - int *ap5 = calloc (4, sizeof *ap5);
> - int *ap7 = realloc (ap5, sizeof *ap5);
> + int *ap5 = (int *) calloc (4, sizeof *ap5);
> + int *ap7 = (int *) realloc (ap5, sizeof *ap5);
> } /* { dg-warning "leak of 'ap5'" "leak of ap5" } */
> /* { dg-warning "leak of 'ap7'" "leak of ap7" { target *-*-* } .-1 } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr105783.c b/gcc/testsuite/c-c++-common/analyzer/pr105783.c
> similarity index 85%
> rename from gcc/testsuite/gcc.dg/analyzer/pr105783.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr105783.c
> index 00f44d04b64..f17519415ce 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr105783.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr105783.c
> @@ -1,11 +1,15 @@
> /* { dg-additional-options "-O" } */
>
> +#ifndef __cplusplus
> +typedef _Bool bool;
> +#endif
> +
> struct ss_s {
> union out_or_counting_u {
> char *newstr;
> unsigned long long cnt;
> } uu;
> - _Bool counting;
> + bool counting;
> };
>
> struct ss_s ss_init(void) {
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr107345.c b/gcc/testsuite/c-c++-common/analyzer/pr107345.c
> similarity index 73%
> rename from gcc/testsuite/gcc.dg/analyzer/pr107345.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr107345.c
> index 540596d1182..ea1925bfa19 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr107345.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr107345.c
> @@ -9,7 +9,8 @@ int main() {
> int g = 0;
> int *h[2][1];
> h[1][0] = f;
> - if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" } */
> + if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" "" { target c } } */
> + /* { dg-error "ISO C\\+\\+ forbids comparison between pointer and integer" "" { target c++ } .-1 } */
> unsigned int *i = 0;
> }
> printf("NPD_FLAG: %d\n ", *f);
> diff --git a/gcc/testsuite/c-c++-common/analyzer/pr61861.c b/gcc/testsuite/c-c++-common/analyzer/pr61861.c
> new file mode 100644
> index 00000000000..bb9e039ebd5
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr61861.c
> @@ -0,0 +1,3 @@
> +/* { dg-additional-options "-Wno-int-conversion" } */
> +/* { dg-skip-if "-Wno-int-conversion for C++" { c++ } } */
> +#include "../../gcc.dg/pr61861.c"
> diff --git a/gcc/testsuite/c-c++-common/analyzer/pr93457.c b/gcc/testsuite/c-c++-common/analyzer/pr93457.c
> new file mode 100644
> index 00000000000..71b3962980d
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr93457.c
> @@ -0,0 +1,12 @@
> +/* { dg-do compile } */
> +
> +void
> +p5 (const void *);
> +
> +void
> +s5 (const void *cl)
> +{
> + p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" "" { target c } } */
> + /* { dg-warning "pointer of type 'void \\*' used in arithmetic" "" { target c++ } .-1 } */
> + /* { dg-error "'const void\\*' is not a pointer-to-object type" "" { target c++ } .-2 } */
> +}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93695-1.c b/gcc/testsuite/c-c++-common/analyzer/pr93695-1.c
> similarity index 83%
> rename from gcc/testsuite/gcc.dg/analyzer/pr93695-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr93695-1.c
> index e0500c49be7..529c60131ca 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr93695-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr93695-1.c
> @@ -11,7 +11,7 @@ test_1 (void)
> int i;
>
> for (i = 0; i < ARRAY_SIZE (p); ++i)
> - p[i] = __builtin_malloc (sizeof (i));
> + p[i] = (int *) __builtin_malloc (sizeof (i));
>
> for (i = 0; i < ARRAY_SIZE (p); ++i)
> __builtin_free (p [i]);
> @@ -28,7 +28,7 @@ test_2 (int n)
> return;
>
> for (i = 0; i < n; ++i)
> - p[i] = __builtin_malloc (sizeof (i));
> + p[i] = (int *) __builtin_malloc (sizeof (i));
>
> for (i = 0; i < n; ++i)
> __builtin_free (p [i]);
> @@ -41,7 +41,7 @@ test_3 (int **p, int n)
> {
> int i;
> for (i = 0; i < n; ++i)
> - p[i] = __builtin_malloc (sizeof (i));
> + p[i] = (int *) __builtin_malloc (sizeof (i));
> }
>
> void
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94596.c b/gcc/testsuite/c-c++-common/analyzer/pr94596.c
> similarity index 92%
> rename from gcc/testsuite/gcc.dg/analyzer/pr94596.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr94596.c
> index 055d2098064..10ea549924e 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr94596.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr94596.c
> @@ -16,15 +16,18 @@
> * limitations under the License.
> */
>
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +
> +#ifndef __cplusplus
> #define false 0
> +#endif
>
> #define OBJECT_OFFSETOF(OBJECT, MEMBER)\
> - __builtin_offsetof(typeof(*(OBJECT)), MEMBER)
> + __builtin_offsetof(struct zone_limit, MEMBER)
>
> #define OBJECT_CONTAINING(POINTER, OBJECT, MEMBER) \
> - ((typeof(OBJECT)) (void *) \
> + ((struct zone_limit *) (void *) \
> ((char *) (POINTER) - OBJECT_OFFSETOF(OBJECT, MEMBER)))
>
> #define ASSIGN_CONTAINER(OBJECT, POINTER, MEMBER) \
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr94839.c b/gcc/testsuite/c-c++-common/analyzer/pr94839.c
> similarity index 82%
> rename from gcc/testsuite/gcc.dg/analyzer/pr94839.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr94839.c
> index 46c8bb98bd2..26e7e616cf6 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr94839.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr94839.c
> @@ -13,7 +13,7 @@ int bitmap_create(struct bitmap *bm, int min, int max)
>
> bm->min = min;
> bm->max = max;
> - bm->vec = __builtin_calloc(sz, sizeof(int));
> + bm->vec = (int *) __builtin_calloc(sz, sizeof(int));
> if (!bm->vec)
> return (-12);
> return 0; /* { dg-bogus "leak" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c b/gcc/testsuite/c-c++-common/analyzer/pr95152-4.c
> similarity index 55%
> rename from gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr95152-4.c
> index f2a72cad01c..5ebbae85aee 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr95152-4.c
> @@ -1,4 +1,6 @@
> +/* { dg-skip-if "'-Wno-pointer-to-int-cast' invalid for C++" { c++ } } */
> /* { dg-additional-options "-Wno-pointer-to-int-cast" } */
> +
> extern void my_func (int);
> typedef struct {
> int var;
> @@ -6,6 +8,6 @@ typedef struct {
> extern void *_data_offs;
> void test()
> {
> - info_t *info = ((void *)((void *)1) + ((unsigned int)&_data_offs));
> + info_t *info = (info_t *) ((void *)((void *)1) + ((unsigned int)&_data_offs));
> my_func(info->var == 0);
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c b/gcc/testsuite/c-c++-common/analyzer/pr95152-5.c
> similarity index 61%
> rename from gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr95152-5.c
> index 604b78458c7..fbc4753e0b4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr95152-5.c
> @@ -1,3 +1,4 @@
> +/* { dg-skip-if "'-Wno-incompatible-pointer-types' invalid for C++" { c++ } } */
> /* { dg-additional-options "-Wno-incompatible-pointer-types" } */
> void foo(void)
> {
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr95240.c b/gcc/testsuite/c-c++-common/analyzer/pr95240.c
> similarity index 89%
> rename from gcc/testsuite/gcc.dg/analyzer/pr95240.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr95240.c
> index c84c64de8b8..afd831b3d26 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr95240.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr95240.c
> @@ -8,7 +8,7 @@ static char *activeTroubleArray;
> int
> initActiveTroubleArray ()
> {
> - activeTroubleArray = calloc (1, 1);
> + activeTroubleArray = (char *) calloc (1, 1);
> return activeTroubleArray ? 0 : 1;
> }
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96639.c b/gcc/testsuite/c-c++-common/analyzer/pr96639.c
> similarity index 80%
> rename from gcc/testsuite/gcc.dg/analyzer/pr96639.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr96639.c
> index aedf0464dc9..b95217df6c4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr96639.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr96639.c
> @@ -3,7 +3,7 @@ void *calloc (__SIZE_TYPE__, __SIZE_TYPE__);
> int
> x7 (void)
> {
> - int **md = calloc (1, sizeof (void *));
> + int **md = (int **) calloc (1, sizeof (void *));
>
> return md[0][0]; /* { dg-warning "possibly-NULL" "unchecked deref" } */
> /* { dg-warning "leak of 'md'" "leak" { target *-*-* } .-1 } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96653.c b/gcc/testsuite/c-c++-common/analyzer/pr96653.c
> similarity index 98%
> rename from gcc/testsuite/gcc.dg/analyzer/pr96653.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr96653.c
> index e5e387c44a5..75f3d23aa98 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr96653.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr96653.c
> @@ -753,7 +753,7 @@ const char *v4l2_ctrl_get_name(u32 id) {
> case ((0x00a30000 | 0x900) + 4):
> return "MD Region Grid";
> default:
> - return ((void *)0);
> + return (const char *) ((void *)0);
> }
> }
>
> @@ -989,40 +989,40 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type,
> *type = V4L2_CTRL_TYPE_U32;
> break;
> case ((0x00990000 | 0x900) + 250):
> - *type = 0x0103;
> + *type = (enum v4l2_ctrl_type) 0x0103;
> break;
> case ((0x00990000 | 0x900) + 251):
> - *type = 0x0104;
> + *type = (enum v4l2_ctrl_type) 0x0104;
> break;
> case ((0x00990000 | 0x900) + 292):
> - *type = 0x0105;
> + *type = (enum v4l2_ctrl_type) 0x0105;
> break;
> case ((0x00990000 | 0x900) + 1000):
> - *type = 0x0110;
> + *type = (enum v4l2_ctrl_type) 0x0110;
> break;
> case ((0x00990000 | 0x900) + 1001):
> - *type = 0x0111;
> + *type = (enum v4l2_ctrl_type) 0x0111;
> break;
> case ((0x00990000 | 0x900) + 1002):
> - *type = 0x0112;
> + *type = (enum v4l2_ctrl_type) 0x0112;
> break;
> case ((0x00990000 | 0x900) + 1003):
> - *type = 0x0113;
> + *type = (enum v4l2_ctrl_type) 0x0113;
> break;
> case ((0x00990000 | 0x900) + 1004):
> - *type = 0x0114;
> + *type = (enum v4l2_ctrl_type) 0x0114;
> break;
> case ((0x00990000 | 0x900) + 2000):
> - *type = 0x301;
> + *type = (enum v4l2_ctrl_type) 0x301;
> break;
> case ((0x00990000 | 0x900) + 1008):
> - *type = 0x0120;
> + *type = (enum v4l2_ctrl_type) 0x0120;
> break;
> case ((0x00990000 | 0x900) + 1009):
> - *type = 0x0121;
> + *type = (enum v4l2_ctrl_type) 0x0121;
> break;
> case ((0x00990000 | 0x900) + 1010):
> - *type = 0x0122;
> + *type = (enum v4l2_ctrl_type) 0x0122;
> break;
> case ((0x009e0000 | 0x900) + 8):
> *type = V4L2_CTRL_TYPE_AREA;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96792.c b/gcc/testsuite/c-c++-common/analyzer/pr96792.c
> similarity index 93%
> rename from gcc/testsuite/gcc.dg/analyzer/pr96792.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr96792.c
> index 7757645a133..accaf22ba70 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr96792.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr96792.c
> @@ -1,4 +1,4 @@
> -#define NULL (void *)0
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> struct block
> {
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr96841.c b/gcc/testsuite/c-c++-common/analyzer/pr96841.c
> similarity index 89%
> rename from gcc/testsuite/gcc.dg/analyzer/pr96841.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr96841.c
> index 14f3f7a86a3..b2951a0651c 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr96841.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr96841.c
> @@ -1,4 +1,4 @@
> -/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch" } */
> +/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch -Wno-analyzer-too-complex" } */
>
> int
> l8 (void);
> diff --git a/gcc/testsuite/c-c++-common/analyzer/pr97568.c b/gcc/testsuite/c-c++-common/analyzer/pr97568.c
> new file mode 100644
> index 00000000000..da97b9ddc4f
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr97568.c
> @@ -0,0 +1,31 @@
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
> +
> +extern int *const p1;
> +
> +int *const p2 = NULL;
> +
> +int v3;
> +extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" "C FE warning" { target c } } */
> +
> +int v4;
> +int *const p4 = &v4;
> +
> +int main (void)
> +{
> + __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" "" { target c } } */
> + /* { dg-message "INIT_VAL\\(int\\* const p1\\)" "" { target c++ } .-1 } */
> + __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
> +
> + __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
> +
> + __analyzer_describe (0, p3); /* { dg-message "&v3" "" { target c } } */
> + /* { dg-message "&int v3" "" { target c++ } .-1 } */
> + __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
> +
> + __analyzer_describe (0, p4); /* { dg-message "&v4" "" { target c } } */
> + /* { dg-message "&int v4" "" { target c++ } .-1 } */
> + __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
> +
> + return p1[0];
> +}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98564.c b/gcc/testsuite/c-c++-common/analyzer/pr98564.c
> similarity index 59%
> rename from gcc/testsuite/gcc.dg/analyzer/pr98564.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr98564.c
> index 74b1abec6bf..a404e358cd2 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr98564.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr98564.c
> @@ -2,5 +2,5 @@ void *calloc (__SIZE_TYPE__, __SIZE_TYPE__);
>
> void test_1 (void)
> {
> - int *p = calloc (0, 1); /* { dg-message "allocated here" } */
> + int *p = (int *) calloc (0, 1); /* { dg-message "allocated here" } */
> } /* { dg-warning "leak of 'p'" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98628.c b/gcc/testsuite/c-c++-common/analyzer/pr98628.c
> similarity index 100%
> rename from gcc/testsuite/gcc.dg/analyzer/pr98628.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr98628.c
> index fa0ca961c46..f339c495fd4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr98628.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr98628.c
> @@ -1,12 +1,12 @@
> /* { dg-additional-options "-O1" } */
>
> void foo(void *);
> -struct chanset_t help_subst_chan;
> -struct chanset_t *help_subst_chan_0_0;
> struct chanset_t {
> struct chanset_t *next;
> char dname[];
> };
> +struct chanset_t help_subst_chan;
> +struct chanset_t *help_subst_chan_0_0;
> void help_subst(char *writeidx) {
> for (;; help_subst_chan = *help_subst_chan_0_0) {
> foo(help_subst_chan.next->dname);
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr98969.c b/gcc/testsuite/c-c++-common/analyzer/pr98969.c
> similarity index 61%
> rename from gcc/testsuite/gcc.dg/analyzer/pr98969.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr98969.c
> index e4e4f059197..4fe76012f00 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr98969.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr98969.c
> @@ -7,14 +7,15 @@ void
> test_1 (__UINTPTR_TYPE__ i)
> {
> struct foo *f = (struct foo *)i;
> - f->expr = __builtin_malloc (1024);
> + f->expr = (char *) __builtin_malloc (1024);
> } /* { dg-bogus "leak" } */
>
> void
> test_2 (__UINTPTR_TYPE__ i)
> {
> __builtin_free (((struct foo *)i)->expr);
> - __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" } */
> + __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" "" { target c } } */
> + /* { dg-warning "double-'free' of '\\*\\(\\(foo\\*\\)i\\)\\.foo::expr'" "" { target c++ } .-1 } */
> }
>
> void
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99193-2.c b/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/pr99193-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr99193-2.c
> index 40e61817503..791b857dcc5 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr99193-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr99193-2.c
> @@ -56,7 +56,7 @@ make_display_name (struct drv *drvs)
> ret = single_drive_display_name (drvs);
> len = __builtin_strlen (ret);
>
> - ret = realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
> + ret = (char *) realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
> if (ret == NULL)
> error (EXIT_FAILURE, errno, "realloc");
> for (i = len; i < len + pluses; ++i)
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99193-3.c b/gcc/testsuite/c-c++-common/analyzer/pr99193-3.c
> similarity index 91%
> rename from gcc/testsuite/gcc.dg/analyzer/pr99193-3.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr99193-3.c
> index d64b0458e9e..696ded00738 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr99193-3.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr99193-3.c
> @@ -8,7 +8,7 @@
> typedef __SIZE_TYPE__ size_t;
> typedef __builtin_va_list va_list;
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> extern void free (void *);
> extern void *realloc (void *__ptr, size_t __size)
> @@ -35,7 +35,7 @@ debug_help (const char **cmds, size_t argc, char *const *const argv)
> len = __builtin_strlen (r);
> for (i = 0; cmds[i] != NULL; ++i) {
> len += __builtin_strlen (cmds[i]) + 1;
> - p = realloc (r, len + 1); /* { dg-bogus "'free'" } */
> + p = (char *) realloc (r, len + 1); /* { dg-bogus "'free'" } */
> if (p == NULL) {
> free (r);
> return NULL;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99716-1.c b/gcc/testsuite/c-c++-common/analyzer/pr99716-1.c
> similarity index 93%
> rename from gcc/testsuite/gcc.dg/analyzer/pr99716-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr99716-1.c
> index 2ccdcc73a5c..41be8cab048 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr99716-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr99716-1.c
> @@ -4,7 +4,8 @@ FILE* fopen (const char*, const char*);
> int fclose (FILE*);
> int fprintf (FILE *, const char *, ...);
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
>
> void
> test_1 (void)
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99774-1.c b/gcc/testsuite/c-c++-common/analyzer/pr99774-1.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/pr99774-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/pr99774-1.c
> index a0bca8b1fe2..184baeef935 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr99774-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/pr99774-1.c
> @@ -42,7 +42,7 @@ int vu_check_queue_inflights(VuVirtq *vq) {
> int i = 0;
>
> if (vq->inuse) {
> - vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
> + vq->resubmit_list = (VuVirtqInflightDesc *) calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
> if (!vq->resubmit_list) {
> return -1;
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-1.c b/gcc/testsuite/c-c++-common/analyzer/realloc-1.c
> similarity index 84%
> rename from gcc/testsuite/gcc.dg/analyzer/realloc-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/realloc-1.c
> index 9951e118efe..75e0b10e964 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/realloc-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/realloc-1.c
> @@ -20,14 +20,14 @@ void *test_1 (void *ptr)
> return realloc (ptr, 1024);
> }
>
> -void *test_2 (void *ptr)
> +void test_2 (void *ptr)
> {
> void *p = malloc (1024); /* { dg-message "allocated here" } */
> p = realloc (p, 4096); /* { dg-message "when 'realloc' fails" } */
> free (p);
> } /* { dg-warning "leak of 'p'" } */ // ideally this would be on the realloc stmt
>
> -void *test_3 (void *ptr)
> +void test_3 (void *ptr)
> {
> void *p = malloc (1024);
> void *q = realloc (p, 4096);
> @@ -45,7 +45,7 @@ void *test_4 (void)
> int *test_5 (int *p)
> {
> *p = 42;
> - int *q = realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
> + int *q = (int *) realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
> *q = 43; /* { dg-warning "dereference of NULL 'q'" } */
> return q;
> }
> @@ -60,7 +60,7 @@ void test_6 (size_t sz)
> void *test_7 (size_t sz)
> {
> char buf[100]; /* { dg-message "region created on stack here" } */
> - void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '&buf' which points to memory on the stack" } */
> + void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '& ?buf' which points to memory on the stack" } */
> return p;
> }
>
> @@ -91,5 +91,6 @@ void test_9 (void *p)
>
> void test_10 (char *s, int n)
> {
> - __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" } */
> + __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" "" { target c } } */
> + /* { dg-warning "ignoring return value of 'void\\* __builtin_realloc\\(void\\*, (long )?unsigned int\\)' declared with attribute 'warn_unused_result'" "" { target c++ } .-1 } */
> } /* { dg-warning "leak" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-2.c b/gcc/testsuite/c-c++-common/analyzer/realloc-2.c
> similarity index 95%
> rename from gcc/testsuite/gcc.dg/analyzer/realloc-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/realloc-2.c
> index ab3e4b6628a..e608e0e19c3 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/realloc-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/realloc-2.c
> @@ -1,11 +1,9 @@
> /* { dg-additional-options "-fno-analyzer-suppress-followups" } */
>
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> typedef __SIZE_TYPE__ size_t;
>
> -#define NULL ((void *)0)
> -
> extern void *malloc (size_t __size)
> __attribute__ ((__nothrow__ , __leaf__))
> __attribute__ ((__malloc__))
> @@ -21,7 +19,7 @@ char *test_8 (size_t sz)
> {
> char *p, *q;
>
> - p = malloc (3);
> + p = (char *) malloc (3);
> if (!p)
> return NULL;
>
> @@ -35,7 +33,7 @@ char *test_8 (size_t sz)
> __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
> __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
>
> - q = realloc (p, 6);
> + q = (char *) realloc (p, 6);
>
> /* We should have 3 nodes, corresponding to "failure",
> "success without moving", and "success with moving". */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-3.c b/gcc/testsuite/c-c++-common/analyzer/realloc-3.c
> similarity index 96%
> rename from gcc/testsuite/gcc.dg/analyzer/realloc-3.c
> rename to gcc/testsuite/c-c++-common/analyzer/realloc-3.c
> index eec61497d5b..b38013569e4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/realloc-3.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/realloc-3.c
> @@ -1,10 +1,9 @@
> /* { dg-additional-options "-fno-analyzer-suppress-followups" } */
>
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> typedef __SIZE_TYPE__ size_t;
>
> -#define NULL ((void *)0)
>
> extern void *calloc (size_t __nmemb, size_t __size)
> __attribute__ ((__nothrow__ , __leaf__))
> @@ -27,7 +26,7 @@ char *test_8 (size_t sz)
> {
> char *p, *q;
>
> - p = calloc (1, 3);
> + p = (char *) calloc (1, 3);
> if (!p)
> return NULL;
>
> @@ -37,7 +36,7 @@ char *test_8 (size_t sz)
> __analyzer_eval (p[1] == 0); /* { dg-warning "TRUE" } */
> __analyzer_eval (p[2] == 0); /* { dg-warning "TRUE" } */
>
> - q = realloc (p, 6);
> + q = (char *) realloc (p, 6);
>
> /* We should have 3 nodes, corresponding to "failure",
> "success without moving", and "success with moving". */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-4.c b/gcc/testsuite/c-c++-common/analyzer/realloc-4.c
> similarity index 97%
> rename from gcc/testsuite/gcc.dg/analyzer/realloc-4.c
> rename to gcc/testsuite/c-c++-common/analyzer/realloc-4.c
> index ac338ec0497..7e9a8edcac8 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/realloc-4.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/realloc-4.c
> @@ -1,8 +1,7 @@
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> typedef __SIZE_TYPE__ size_t;
>
> -#define NULL ((void *)0)
>
> extern void *calloc (size_t __nmemb, size_t __size)
> __attribute__ ((__nothrow__ , __leaf__))
> @@ -34,7 +33,7 @@ char *test_8 (char *p, size_t sz)
> __analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
> __analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
>
> - q = realloc (p, 6);
> + q = (char *) realloc (p, 6);
>
> /* We should have 3 nodes, corresponding to "failure",
> "success without moving", and "success with moving". */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-5.c b/gcc/testsuite/c-c++-common/analyzer/realloc-5.c
> similarity index 90%
> rename from gcc/testsuite/gcc.dg/analyzer/realloc-5.c
> rename to gcc/testsuite/c-c++-common/analyzer/realloc-5.c
> index f65f2c6ca25..d469ae9306b 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/realloc-5.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/realloc-5.c
> @@ -1,10 +1,9 @@
> /* { dg-additional-options "-fno-analyzer-suppress-followups" } */
>
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> typedef __SIZE_TYPE__ size_t;
>
> -#define NULL ((void *)0)
>
> extern void *malloc (size_t __size)
> __attribute__ ((__nothrow__ , __leaf__))
> @@ -22,12 +21,12 @@ extern void *memset (void *__ptr, int __value, size_t __size);
>
> void test_1 ()
> {
> - char *p = malloc (16);
> + char *p = (char *) malloc (16);
> if (!p)
> return;
> memset (p, 1, 16);
>
> - char *q = realloc (p, 8);
> + char *q = (char *) realloc (p, 8);
> if (!q)
> {
> free (p);
> diff --git a/gcc/testsuite/gcc.dg/analyzer/realloc-pr110014.c b/gcc/testsuite/c-c++-common/analyzer/realloc-pr110014.c
> similarity index 70%
> rename from gcc/testsuite/gcc.dg/analyzer/realloc-pr110014.c
> rename to gcc/testsuite/c-c++-common/analyzer/realloc-pr110014.c
> index d76b8781413..e25722a3328 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/realloc-pr110014.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/realloc-pr110014.c
> @@ -8,18 +8,18 @@ slurp (long *buffer, unsigned long file_size)
> unsigned long cc;
> if (!__builtin_add_overflow (file_size - file_size % sizeof (long),
> 2 * sizeof (long), &cc))
> - buffer = realloc (buffer, cc);
> + buffer = (long *) realloc (buffer, cc);
> return buffer;
> }
>
> long *
> slurp1 (long *buffer, unsigned long file_size)
> {
> - return realloc (buffer, file_size - file_size % sizeof (long));
> + return (long *) realloc (buffer, file_size - file_size % sizeof (long));
> }
>
> long *
> slurp2 (long *buffer, unsigned long file_size)
> {
> - return realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
> + return (long *) realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/snprintf-concat.c b/gcc/testsuite/c-c++-common/analyzer/snprintf-concat.c
> similarity index 81%
> rename from gcc/testsuite/gcc.dg/analyzer/snprintf-concat.c
> rename to gcc/testsuite/c-c++-common/analyzer/snprintf-concat.c
> index a557dee6e44..c40440c4905 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/snprintf-concat.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/snprintf-concat.c
> @@ -1,5 +1,5 @@
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> extern size_t
> strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
> @@ -17,7 +17,7 @@ char *
> test_1 (const char *a, const char *b)
> {
> size_t sz = strlen (a) + strlen (b) + 2;
> - char *p = malloc (sz);
> + char *p = (char *) malloc (sz);
> if (!p)
> return NULL;
> snprintf (p, sz, "%s/%s", a, b);
> @@ -28,7 +28,7 @@ void
> test_2 (const char *a, const char *b)
> {
> size_t sz = strlen (a) + strlen (b) + 2;
> - char *p = malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
> + char *p = (char *) malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
> if (!p)
> return;
> snprintf (p, sz, "%s/%s", a, b); /* { dg-warning "leak of 'p'" "PR 107017" { xfail *-*-* } } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/sock-1.c b/gcc/testsuite/c-c++-common/analyzer/sock-1.c
> similarity index 91%
> rename from gcc/testsuite/gcc.dg/analyzer/sock-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/sock-1.c
> index 0f3e822492f..e5e2f23bba0 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/sock-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/sock-1.c
> @@ -5,7 +5,9 @@ typedef __u32 u32;
> typedef __s64 s64;
> typedef __u64 u64;
> typedef long long __kernel_time64_t;
> +#ifndef __cplusplus
> typedef _Bool bool;
> +#endif
> typedef __s64 time64_t;
> struct __kernel_timespec {
> __kernel_time64_t tv_sec;
> @@ -76,12 +78,12 @@ struct sock {
>
> static ktime_t sock_read_timestamp(struct sock *sk)
> {
> - return *(const volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp);
> + return *(const volatile ktime_t *)&(sk->sk_stamp);
> }
>
> static void sock_write_timestamp(struct sock *sk, ktime_t kt)
> {
> - *(volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp) = kt;
> + *(volatile ktime_t *)&(sk->sk_stamp) = kt;
> }
>
> /* [...snip...] */
> @@ -108,5 +110,5 @@ int sock_gettstamp(struct socket *sock, void *userstamp,
>
> if (time32)
> return put_old_timespec32(&ts, userstamp);
> - return put_timespec64(&ts, userstamp);
> + return put_timespec64(&ts, (struct __kernel_timespec *) userstamp);
> }
> diff --git a/gcc/testsuite/c-c++-common/analyzer/sprintf-2.c b/gcc/testsuite/c-c++-common/analyzer/sprintf-2.c
> new file mode 100644
> index 00000000000..4e101306ae1
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/sprintf-2.c
> @@ -0,0 +1,59 @@
> +/* See e.g. https://en.cppreference.com/w/c/io/fprintf
> + and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
> +
> +extern int
> +sprintf(char* dst, const char* fmt, ...)
> + __attribute__((__nothrow__));
> +
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
> +int
> +test_passthrough (char* dst, const char* fmt)
> +{
> + /* This assumes that fmt doesn't have any arguments. */
> + return sprintf (dst, fmt);
> +}
> +
> +void
> +test_known (void)
> +{
> + char buf[10];
> + int res = sprintf (buf, "foo");
> + /* TODO: ideally we would know the value of "res" is 3,
> + and known the content and strlen of "buf" after the call */
> +}
> +
> +int
> +test_null_dst (void)
> +{
> + return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
> +}
> +
> +int
> +test_null_fmt (char *dst)
> +{
> + return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */
> +}
> +
> +int
> +test_uninit_dst (void)
> +{
> + char *dst;
> + return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
> +}
> +
> +int
> +test_uninit_fmt_ptr (char *dst)
> +{
> + const char *fmt;
> + return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
> +}
> +
> +void
> +test_strlen_1 (void)
> +{
> + char buf[10];
> + sprintf (buf, "msg: %s\n", "abc");
> + __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
> + // TODO: ideally would be TRUE
> +}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c b/gcc/testsuite/c-c++-common/analyzer/sprintf-concat.c
> similarity index 82%
> rename from gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c
> rename to gcc/testsuite/c-c++-common/analyzer/sprintf-concat.c
> index 0094f3e6449..ad744588bc0 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/sprintf-concat.c
> @@ -1,5 +1,5 @@
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> extern size_t
> strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
> @@ -17,7 +17,7 @@ char *
> test_1 (const char *a, const char *b)
> {
> size_t sz = strlen (a) + strlen (b) + 2;
> - char *p = malloc (sz);
> + char *p = (char *) malloc (sz);
> if (!p)
> return NULL;
> sprintf (p, "%s/%s", a, b);
> @@ -28,7 +28,7 @@ void
> test_2 (const char *a, const char *b)
> {
> size_t sz = strlen (a) + strlen (b) + 2;
> - char *p = malloc (sz); /* { dg-message "allocated here" } */
> + char *p = (char *) malloc (sz); /* { dg-message "allocated here" } */
> if (!p)
> return;
> sprintf (p, "%s/%s", a, b); /* { dg-warning "leak of 'p' " } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/string-ops-concat-pair.c b/gcc/testsuite/c-c++-common/analyzer/string-ops-concat-pair.c
> similarity index 83%
> rename from gcc/testsuite/gcc.dg/analyzer/string-ops-concat-pair.c
> rename to gcc/testsuite/c-c++-common/analyzer/string-ops-concat-pair.c
> index f5bcd67594f..254730b2ad4 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/string-ops-concat-pair.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/string-ops-concat-pair.c
> @@ -1,5 +1,5 @@
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> /* Concatenating a pair of strings. */
>
> @@ -9,7 +9,7 @@ char *
> alloc_dup_of_concatenated_pair_1_correct (const char *x, const char *y)
> {
> size_t sz = __builtin_strlen (x) + __builtin_strlen (y) + 1;
> - char *result = __builtin_malloc (sz);
> + char *result = (char *) __builtin_malloc (sz);
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, __builtin_strlen (x));
> @@ -25,7 +25,7 @@ alloc_dup_of_concatenated_pair_1_incorrect (const char *x, const char *y)
> {
> /* Forgetting to add space for the terminator here. */
> size_t sz = __builtin_strlen (x) + __builtin_strlen (y);
> - char *result = __builtin_malloc (sz);
> + char *result = (char *) __builtin_malloc (sz);
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, __builtin_strlen (x));
> @@ -42,7 +42,7 @@ alloc_dup_of_concatenated_pair_2_correct (const char *x, const char *y)
> size_t len_x = __builtin_strlen (x);
> size_t len_y = __builtin_strlen (y);
> size_t sz = len_x + len_y + 1;
> - char *result = __builtin_malloc (sz);
> + char *result = (char *) __builtin_malloc (sz);
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, len_x);
> @@ -57,7 +57,8 @@ alloc_dup_of_concatenated_pair_2_incorrect (const char *x, const char *y)
> size_t len_x = __builtin_strlen (x);
> size_t len_y = __builtin_strlen (y);
> size_t sz = len_x + len_y; /* Forgetting to add space for the terminator. */
> - char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" } */
> + char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" "" { target c } } */
> + /* { dg-message "capacity: '\\(len_x \\+ len_y\\)' bytes" "" { target c++ } .-1 } */
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, len_x);
> diff --git a/gcc/testsuite/gcc.dg/analyzer/string-ops-dup.c b/gcc/testsuite/c-c++-common/analyzer/string-ops-dup.c
> similarity index 83%
> rename from gcc/testsuite/gcc.dg/analyzer/string-ops-dup.c
> rename to gcc/testsuite/c-c++-common/analyzer/string-ops-dup.c
> index 44c4e9dc67e..d7ec088f0f7 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/string-ops-dup.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/string-ops-dup.c
> @@ -1,5 +1,5 @@
> typedef __SIZE_TYPE__ size_t;
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> /* Duplicating a string. */
>
> @@ -9,7 +9,7 @@ char *
> alloc_dup_1_correct (const char *x)
> {
> size_t sz = __builtin_strlen (x) + 1;
> - char *result = __builtin_malloc (sz);
> + char *result = (char *) __builtin_malloc (sz);
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, __builtin_strlen (x));
> @@ -24,7 +24,7 @@ alloc_dup_1_incorrect (const char *x, const char *y)
> {
> /* Forgetting to add space for the terminator here. */
> size_t sz = __builtin_strlen (x) + 1;
> - char *result = __builtin_malloc (sz);
> + char *result = (char *) __builtin_malloc (sz);
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, __builtin_strlen (x));
> @@ -39,7 +39,7 @@ alloc_dup_2_correct (const char *x)
> {
> size_t len_x = __builtin_strlen (x);
> size_t sz = len_x + 1;
> - char *result = __builtin_malloc (sz);
> + char *result = (char *) __builtin_malloc (sz);
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, len_x);
> @@ -52,7 +52,7 @@ alloc_dup_of_concatenated_pair_2_incorrect (const char *x, const char *y)
> {
> size_t len_x = __builtin_strlen (x);
> size_t sz = len_x; /* Forgetting to add space for the terminator. */
> - char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
> + char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
> if (!result)
> return NULL;
> __builtin_memcpy (result, x, len_x);
> diff --git a/gcc/testsuite/gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c b/gcc/testsuite/c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c
> index 336222759e3..bb1ef085691 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c
> @@ -34,7 +34,7 @@ static void __analyzer_vreportf(enum usage_kind kind)
>
> int main(void)
> {
> - __analyzer_vreportf(42);
> + __analyzer_vreportf((enum usage_kind) 42);
>
> return 0;
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/symbolic-12.c b/gcc/testsuite/c-c++-common/analyzer/symbolic-12.c
> similarity index 88%
> rename from gcc/testsuite/gcc.dg/analyzer/symbolic-12.c
> rename to gcc/testsuite/c-c++-common/analyzer/symbolic-12.c
> index d7c50de9f27..26d9d1df93a 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/symbolic-12.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/symbolic-12.c
> @@ -1,4 +1,4 @@
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> void external_fn(void);
>
> @@ -10,7 +10,7 @@ struct st_1
>
> void test_1a (void *p, unsigned next_off)
> {
> - struct st_1 *r = p;
> + struct st_1 *r = (struct st_1 *) p;
>
> external_fn();
>
> @@ -24,7 +24,7 @@ void test_1a (void *p, unsigned next_off)
>
> void test_1b (void *p, unsigned next_off)
> {
> - struct st_1 *r = p;
> + struct st_1 *r = (struct st_1 *) p;
>
> if (next_off >= r->size)
> return;
> @@ -58,7 +58,7 @@ void test_1d (struct st_1 *r, unsigned next_off)
>
> void test_1e (void *p, unsigned next_off)
> {
> - struct st_1 *r = p;
> + struct st_1 *r = (struct st_1 *) p;
>
> while (1)
> {
> @@ -79,7 +79,7 @@ struct st_2
>
> void test_2a (void *p, unsigned next_off)
> {
> - struct st_2 *r = p;
> + struct st_2 *r = (struct st_2 *) p;
>
> external_fn();
>
> @@ -93,7 +93,7 @@ void test_2a (void *p, unsigned next_off)
>
> void test_2b (void *p, unsigned next_off, int idx)
> {
> - struct st_2 *r = p;
> + struct st_2 *r = (struct st_2 *) p;
>
> external_fn();
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/uninit-alloca.c b/gcc/testsuite/c-c++-common/analyzer/uninit-alloca.c
> similarity index 57%
> rename from gcc/testsuite/gcc.dg/analyzer/uninit-alloca.c
> rename to gcc/testsuite/c-c++-common/analyzer/uninit-alloca.c
> index 5dd3f8522d2..d8c842171a8 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/uninit-alloca.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/uninit-alloca.c
> @@ -2,6 +2,6 @@
>
> int test_1 (void)
> {
> - int *p = __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
> + int *p = (int *) __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
> return *p; /* { dg-warning "use of uninitialized value '\\*p'" } */
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/untracked-2.c b/gcc/testsuite/c-c++-common/analyzer/untracked-2.c
> similarity index 76%
> rename from gcc/testsuite/gcc.dg/analyzer/untracked-2.c
> rename to gcc/testsuite/c-c++-common/analyzer/untracked-2.c
> index 565a9ccd58e..8c6d9d6f023 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/untracked-2.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/untracked-2.c
> @@ -2,6 +2,6 @@ typedef unsigned char u8;
> extern int foo(const u8 *key, unsigned int keylen);
> int test (void)
> {
> - static const u8 default_salt[64];
> + static const u8 default_salt[64] = {};
> return foo(default_salt, 64);
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/vasprintf-1.c b/gcc/testsuite/c-c++-common/analyzer/vasprintf-1.c
> similarity index 96%
> rename from gcc/testsuite/gcc.dg/analyzer/vasprintf-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/vasprintf-1.c
> index 061cd008c13..5e8ee9f233b 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/vasprintf-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/vasprintf-1.c
> @@ -1,6 +1,7 @@
> /* { dg-additional-options "-Wno-analyzer-too-complex" } */
>
> -#define NULL ((void *)0)
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
> +
>
> extern int printf (const char *__restrict __format, ...);
> extern int vasprintf (char **__restrict __ptr, const char *__restrict __f,
> diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-const-1.c b/gcc/testsuite/c-c++-common/analyzer/write-to-const-1.c
> similarity index 91%
> rename from gcc/testsuite/gcc.dg/analyzer/write-to-const-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/write-to-const-1.c
> index dc724e29185..c74442af267 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/write-to-const-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/write-to-const-1.c
> @@ -9,7 +9,7 @@ int test_1 (void)
>
> /* Example of writing to a subregion (an element within a const array). */
>
> -const int c2[10]; /* { dg-message "declared here" } */
> +const int c2[10] = {}; /* { dg-message "declared here" } */
> int test_2 (void)
> {
> ((int*) &c2)[5] = 10; /* { dg-warning "write to 'const' object 'c2'" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c b/gcc/testsuite/c-c++-common/analyzer/write-to-function-1.c
> similarity index 81%
> rename from gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/write-to-function-1.c
> index c1bece632ce..dd4adc13141 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/write-to-function-1.c
> @@ -1,3 +1,5 @@
> +/* { dg-skip-if "c++ does not allow for conversion from function pointer to 'void *'" { c++ } } */
> +
> typedef __SIZE_TYPE__ size_t;
>
> int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-1.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-1.c
> similarity index 73%
> rename from gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-1.c
> rename to gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-1.c
> index 092500e066f..46e907a8560 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-1.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-1.c
> @@ -1,10 +1,16 @@
> #include <string.h>
>
> +#ifdef __cplusplus
> +#define CONST_CAST(type) const_cast<type>
> +#else
> +#define CONST_CAST(type)
> +#endif
> +
> /* PR analyzer/95007. */
>
> void test_1 (void)
> {
> - char *s = "foo";
> + char *s = CONST_CAST(char *)("foo");
> s[0] = 'g'; /* { dg-warning "write to string literal" } */
> }
>
> @@ -12,9 +18,12 @@ void test_1 (void)
>
> void test_2 (void)
> {
> - memcpy ("abc", "def", 3); /* { dg-warning "write to string literal" } */
> + // Technically irrelevant for C++ as fpermissive will warn about invalid conversion.
> + memcpy (CONST_CAST(char *)("abc"), "def", 3); /* { dg-warning "write to string literal" } */
> }
>
> +/* PR c/83347. */
> +
> static char * __attribute__((noinline))
> called_by_test_3 (void)
> {
> diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4-disabled.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4-disabled.c
> similarity index 94%
> rename from gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4-disabled.c
> rename to gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4-disabled.c
> index fa21af13341..868c39368e1 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4-disabled.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4-disabled.c
> @@ -16,7 +16,7 @@ void test (int flag)
> char *buf;
>
> if (flag)
> - buf = __builtin_malloc (1024);
> + buf = (char *) __builtin_malloc (1024);
> else
> buf = (char *)""; /* { dg-bogus "here" } */
>
> diff --git a/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c
> new file mode 100644
> index 00000000000..971e8f38574
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4.c
> @@ -0,0 +1,26 @@
> +typedef __SIZE_TYPE__ size_t;
> +
> +int getrandom (void *__buffer, size_t __length, /* { dg-line getrandom } */
> + unsigned int __flags)
> + __attribute__ ((access (__write_only__, 1, 2)));
> +
> +/* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c} getrandom } */
> +/* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } getrandom } */
> +
> +#define GRND_RANDOM 0x02
> +
> +void test (int flag)
> +{
> + char *buf;
> +
> + if (flag)
> + buf = (char *) __builtin_malloc (1024);
> + else
> + buf = (char *)""; /* { dg-message "here" } */
> +
> + if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
> + __builtin_printf("%s\n", buf);
> +
> + if (flag)
> + __builtin_free (buf);
> +}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-5.c b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-5.c
> similarity index 59%
> rename from gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-5.c
> rename to gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-5.c
> index 42efc49fb22..a949f15323d 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-5.c
> +++ b/gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-5.c
> @@ -4,11 +4,13 @@
> /* { dg-additional-options "-fanalyzer-show-duplicate-count" } */
> /* { dg-require-effective-target alloca } */
>
> -#include "analyzer-decls.h"
> +#include "../../gcc.dg/analyzer/analyzer-decls.h"
>
> typedef __SIZE_TYPE__ size_t;
>
> -int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
> +int getrandom (void *__buffer, size_t __length,
> + /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c } .-1 } */
> + /* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } .-2 } */
> unsigned int __flags)
> __attribute__ ((access (__write_only__, 1, 2)));
>
> @@ -18,9 +20,9 @@ void *test (int flag)
> {
> char *ptr;
> if (flag)
> - ptr = __builtin_malloc (1024);
> + ptr = (char *) __builtin_malloc (1024);
> else
> - ptr = __builtin_alloca (1024);
> + ptr = (char *) __builtin_alloca (1024);
>
> __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
>
> diff --git a/gcc/testsuite/g++.dg/analyzer/analyzer.exp b/gcc/testsuite/g++.dg/analyzer/analyzer.exp
> index 9551d827c65..848bea616df 100644
> --- a/gcc/testsuite/g++.dg/analyzer/analyzer.exp
> +++ b/gcc/testsuite/g++.dg/analyzer/analyzer.exp
> @@ -39,6 +39,9 @@ set tests [lsort [glob -nocomplain $srcdir/$subdir/*.C]]
>
> g++-dg-runtest $tests "" $DEFAULT_CXXFLAGS
>
> +g++-dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
> + "" $DEFAULT_CXXFLAGS
> +
> # All done.
> dg-finish
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
> deleted file mode 100644
> index 7251665105d..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
> +++ /dev/null
> @@ -1,59 +0,0 @@
> -/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
> -
> -#include <stdint.h>
> -
> -void test_constant_1 (void)
> -{
> - int32_t *ptr = __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> - __builtin_free (ptr);
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = __builtin_malloc (1);
> - ^~~~~~~~~~~~~~~~~~~~
> - 'test_constant_1': events 1-2
> - |
> - | int32_t *ptr = __builtin_malloc (1);
> - | ^~~~~~~~~~~~~~~~~~~~
> - | |
> - | (1) allocated 1 byte here
> - | (2) assigned to 'int32_t *'
> - |
> - { dg-end-multiline-output "" } */
> -
> -void test_constant_2 (void)
> -{
> - int32_t *ptr = __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> - __builtin_free (ptr);
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = __builtin_malloc (2);
> - ^~~~~~~~~~~~~~~~~~~~
> - 'test_constant_2': events 1-2
> - |
> - | int32_t *ptr = __builtin_malloc (2);
> - | ^~~~~~~~~~~~~~~~~~~~
> - | |
> - | (1) allocated 2 bytes here
> - | (2) assigned to 'int32_t *'
> - |
> - { dg-end-multiline-output "" } */
> -
> -void test_symbolic (int n)
> -{
> - int32_t *ptr = __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> - __builtin_free (ptr);
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = __builtin_malloc (n * 2);
> - ^~~~~~~~~~~~~~~~~~~~~~~~
> - 'test_symbolic': event 1
> - |
> - | int32_t *ptr = __builtin_malloc (n * 2);
> - | ^~~~~~~~~~~~~~~~~~~~~~~~
> - | |
> - | (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
> - |
> - { dg-end-multiline-output "" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
> deleted file mode 100644
> index 7cadbb74751..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
> +++ /dev/null
> @@ -1,62 +0,0 @@
> -/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
> -/* { dg-require-effective-target alloca } */
> -
> -#include <stdint.h>
> -
> -void test_constant_1 (void)
> -{
> - int32_t *ptr = __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = __builtin_alloca (1);
> - ^~~~~~~~~~~~~~~~~~~~
> - 'test_constant_1': events 1-2
> - |
> - | int32_t *ptr = __builtin_alloca (1);
> - | ^~~~~~~~~~~~~~~~~~~~
> - | |
> - | (1) allocated 1 byte here
> - | (2) assigned to 'int32_t *'
> - |
> - { dg-end-multiline-output "" } */
> -
> -void test_constant_2 (void)
> -{
> - int32_t *ptr = __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = __builtin_alloca (2);
> - ^~~~~~~~~~~~~~~~~~~~
> - 'test_constant_2': events 1-2
> - |
> - | int32_t *ptr = __builtin_alloca (2);
> - | ^~~~~~~~~~~~~~~~~~~~
> - | |
> - | (1) allocated 2 bytes here
> - | (2) assigned to 'int32_t *'
> - |
> - { dg-end-multiline-output "" } */
> -
> -void test_symbolic (int n)
> -{
> - int32_t *ptr = __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = __builtin_alloca (n * 2);
> - ^~~~~~~~~~~~~~~~~~~~~~~~
> - 'test_symbolic': events 1-2
> - |
> - | int32_t *ptr = __builtin_alloca (n * 2);
> - | ^~~~~~~~~~~~~~~~~~~~~~~~
> - | |
> - | (1) allocated 'n * 2' bytes here
> - | (2) assigned to 'int32_t *'
> - |
> - { dg-end-multiline-output "" } */
> -
> -/* FIXME: am getting a duplicate warning here for some reason
> - without -fanalyzer-fine-grained (PR PR analyzer/107851). */
> -
> diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
> deleted file mode 100644
> index b3de582368f..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
> +++ /dev/null
> @@ -1,44 +0,0 @@
> -/* Verify that we warn for incorrect uses of "alloca" (which may be in a
> - macro in a system header), and that the output looks correct. */
> -
> -/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
> -/* { dg-require-effective-target alloca } */
> -
> -#include <stdint.h>
> -#include "test-alloca.h"
> -
> -void test_constant_99 (void)
> -{
> - int32_t *ptr = alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = alloca (99);
> - ^~~~~~
> - 'test_constant_99': events 1-2
> - |
> - | int32_t *ptr = alloca (99);
> - | ^~~~~~
> - | |
> - | (1) allocated 99 bytes here
> - | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> - |
> - { dg-end-multiline-output "" } */
> -
> -void test_symbolic (int n)
> -{
> - int32_t *ptr = alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
> -}
> -
> -/* { dg-begin-multiline-output "" }
> - int32_t *ptr = alloca (n * 2);
> - ^~~~~~
> - 'test_symbolic': events 1-2
> - |
> - | int32_t *ptr = alloca (n * 2);
> - | ^~~~~~
> - | |
> - | (1) allocated 'n * 2' bytes here
> - | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
> - |
> - { dg-end-multiline-output "" } */
> diff --git a/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h b/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h
> index a6267289462..372a13608d0 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h
> +++ b/gcc/testsuite/gcc.dg/analyzer/analyzer-decls.h
> @@ -1,6 +1,18 @@
> #ifndef ANALYZER_DECLS_H
> #define ANALYZER_DECLS_H
>
> +#ifndef NULL
> +#ifdef __cplusplus
> +#if __cplusplus >= 201103L
> +#define NULL nullptr
> +#else
> +#define NULL 0
> +#endif
> +#else
> +#define NULL ((void *)0)
> +#endif
> +#endif
> +
> /* Function decls with special meaning to the analyzer.
> None of these are actually implemented. */
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/analyzer.exp b/gcc/testsuite/gcc.dg/analyzer/analyzer.exp
> index af05c98fa16..cedf3c0466f 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/analyzer.exp
> +++ b/gcc/testsuite/gcc.dg/analyzer/analyzer.exp
> @@ -47,6 +47,9 @@ dg-init
> dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/*.\[cS\]]] \
> "" $DEFAULT_CFLAGS
>
> +dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
> + "" $DEFAULT_CFLAGS
> +
> # All done.
> dg-finish
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-11.c b/gcc/testsuite/gcc.dg/analyzer/data-model-11.c
> deleted file mode 100644
> index 27663247c32..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/data-model-11.c
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -int test (void)
> -{
> - unsigned char *s = "abc";
> - char *t = "xyz";
> - return s[1] + t[1];
> -}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c b/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
> index c05137bb219..788a2059013 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
> +++ b/gcc/testsuite/gcc.dg/analyzer/pr104369-1.c
> @@ -1,5 +1,8 @@
> /* { dg-additional-options "-Wno-analyzer-too-complex -Wno-analyzer-fd-leak" } */
> // TODO: remove need for these options
> +/* This test needs not be moved to c-c++-common/analyzer as C++
> + does not support transparent_union. */
> +
>
> typedef __SIZE_TYPE__ size_t;
> #define NULL ((void *)0)
> @@ -61,7 +64,7 @@ int main() {
> struct sockaddr_un remote;
> socklen_t len = sizeof(remote);
>
> - pollfds = calloc(1, sizeof(struct pollfd));
> + pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
> if (!pollfds) {
> exit(1);
> }
> @@ -74,12 +77,13 @@ int main() {
>
> if (pollfds[0].revents & POLLIN) {
> nsockets++;
> - newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
> + newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
> if (!newpollfds) {
> exit(1);
> }
> pollfds = newpollfds;
> pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
> + /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
> }
> }
> return 0;
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c b/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c
> index 93d9987d0ba..30b47a42d57 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c
> +++ b/gcc/testsuite/gcc.dg/analyzer/pr104369-2.c
> @@ -1,5 +1,7 @@
> /* { dg-additional-options "-Wno-analyzer-fd-leak" } */
> // TODO: remove need for this option
> +/* This test needs not be moved to c-c++-common/analyzer as C++
> + does not support transparent_union. */
>
> typedef __SIZE_TYPE__ size_t;
> #define NULL ((void *)0)
> @@ -61,7 +63,7 @@ int main() {
> struct sockaddr_un remote;
> socklen_t len = sizeof(remote);
>
> - pollfds = calloc(1, sizeof(struct pollfd));
> + pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
> if (!pollfds) {
> exit(1);
> }
> @@ -72,11 +74,13 @@ int main() {
> }
>
> nsockets++;
> - newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
> + newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
> if (!newpollfds) {
> exit(3);
> }
> pollfds = newpollfds;
> pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
> + /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
> +
> exit(4);
> }
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr61861.c b/gcc/testsuite/gcc.dg/analyzer/pr61861.c
> deleted file mode 100644
> index a85e7438905..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/pr61861.c
> +++ /dev/null
> @@ -1,2 +0,0 @@
> -/* { dg-additional-options "-Wno-int-conversion" } */
> -#include "../pr61861.c"
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c b/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c
> index 148429768cd..df14bea7155 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c
> +++ b/gcc/testsuite/gcc.dg/analyzer/pr93355-localealias-feasibility-2.c
> @@ -6,7 +6,6 @@
>
> #include "analyzer-decls.h"
>
> -#define NULL ((void *) 0)
> #define PATH_SEPARATOR ':'
> #define LOCALE_ALIAS_PATH "value for LOCALE_ALIAS_PATH"
>
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr93457.c b/gcc/testsuite/gcc.dg/analyzer/pr93457.c
> deleted file mode 100644
> index b77911ba789..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/pr93457.c
> +++ /dev/null
> @@ -1,10 +0,0 @@
> -/* { dg-do compile } */
> -
> -void
> -p5 (const void *);
> -
> -void
> -s5 (const void *cl)
> -{
> - p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" } */
> -}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97568.c b/gcc/testsuite/gcc.dg/analyzer/pr97568.c
> deleted file mode 100644
> index 22d574b5fbd..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/pr97568.c
> +++ /dev/null
> @@ -1,29 +0,0 @@
> -#include "analyzer-decls.h"
> -
> -#define NULL ((void *)0)
> -
> -extern int *const p1;
> -
> -int *const p2;
> -
> -int v3;
> -extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" } */
> -
> -int v4;
> -int *const p4 = &v4;
> -
> -int main (void)
> -{
> - __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" } */
> - __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
> -
> - __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
> -
> - __analyzer_describe (0, p3); /* { dg-message "&v3" } */
> - __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
> -
> - __analyzer_describe (0, p4); /* { dg-message "&v4" } */
> - __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
> -
> - return p1[0];
> -}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c
> index e7c2b3089c5..78a7026a73a 100644
> --- a/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c
> +++ b/gcc/testsuite/gcc.dg/analyzer/sprintf-1.c
> @@ -1,55 +1,16 @@
> /* See e.g. https://en.cppreference.com/w/c/io/fprintf
> and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
>
> +/* This test needs not be moved to c-c++-common/analyzer as C++
> + fpermissive already emits errors. */
> #include "analyzer-decls.h"
>
> extern int
> sprintf(char* dst, const char* fmt, ...)
> __attribute__((__nothrow__));
>
> -#define NULL ((void *)0)
> -
> -int
> -test_passthrough (char* dst, const char* fmt)
> -{
> - /* This assumes that fmt doesn't have any arguments. */
> - return sprintf (dst, fmt);
> -}
> -
> -void
> -test_known (void)
> -{
> - char buf[10];
> - int res = sprintf (buf, "foo");
> - /* TODO: ideally we would know the value of "res" is 3,
> - and known the content and strlen of "buf" after the call */
> -}
>
> -int
> -test_null_dst (void)
> -{
> - return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
> -}
> -
> -int
> -test_null_fmt (char *dst)
> -{
> - return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */
> -}
> -
> -int
> -test_uninit_dst (void)
> -{
> - char *dst;
> - return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
> -}
> -
> -int
> -test_uninit_fmt_ptr (char *dst)
> -{
> - const char *fmt;
> - return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
> -}
> +#define NULL ((void *)0)
>
> int
> test_uninit_fmt_buf (char *dst)
> @@ -66,12 +27,3 @@ test_fmt_not_terminated (char *dst)
> return sprintf (dst, fmt); /* { dg-warning "stack-based buffer over-read" } */
> /* { dg-message "while looking for null terminator for argument 2 \\('&fmt'\\) of 'sprintf'..." "event" { target *-*-* } .-1 } */
> }
> -
> -void
> -test_strlen_1 (void)
> -{
> - char buf[10];
> - sprintf (buf, "msg: %s\n", "abc");
> - __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
> - // TODO: ideally would be TRUE
> -}
> diff --git a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c b/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c
> deleted file mode 100644
> index a8f600f81a3..00000000000
> --- a/gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4.c
> +++ /dev/null
> @@ -1,23 +0,0 @@
> -typedef __SIZE_TYPE__ size_t;
> -
> -int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
> - unsigned int __flags)
> - __attribute__ ((access (__write_only__, 1, 2)));
> -
> -#define GRND_RANDOM 0x02
> -
> -void test (int flag)
> -{
> - char *buf;
> -
> - if (flag)
> - buf = __builtin_malloc (1024);
> - else
> - buf = (char *)""; /* { dg-message "here" } */
> -
> - if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
> - __builtin_printf("%s\n", buf);
> -
> - if (flag)
> - __builtin_free (buf);
> -}
> --
> 2.34.1
>
Hi Prathamesh,
Thanks for the report, I am running on a x86_64_linux_gnu and never had to
cross-compile before.
I've tried to set it up and reproduce your errors, please tell me if I'm
off the mark.
I configured gcc as:
../gcc/configure --prefix $CONTROL_PFX --disable-bootstrap
--host=x86_64-linux-gnu --target=arm-eabi --enable-languages=c --with-newlib
Then from the patch 7997f0d35efca8a24d1b0ceae5066b1019d633d7 prior to mine,
*I ran the tests manually as arm-sim refused to work*:
$GCC_SRC/control/eabi_arm_build/gcc/xgcc
-B$GCC_SRC/control//eabi_arm_build/gcc \
../../gcc/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
\
-fanalyzer -Wanalyzer-too-complex -fanalyzer-call-summaries
and
$GCC_SRC/control/eabi_arm_build/gcc/xgcc
-B$GCC_SRC/control//eabi_arm_build/gcc \
../../gcc/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
\
-fanalyzer -Wanalyzer-too-complex -fanalyzer-call-summaries -O2
From my patch, I ran similar commands, only s/gcc.dg/c-c++-common/ as the
patch
moved the tests there.
The output were *identical*, for both pre/post-patched.
I do agree with you that there is an excess error compared to
x86_64-linux-gnu and the test expectations.
../../gcc/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c:63:65:
warning: converting a packed ‘enum obj_type’ pointer (alignment 1) to a
‘struct connection’ pointer (alignment 4) may result in an unaligned
pointer value [-Waddress-of-packed-member]
63 | return ((struct connection *)(((void *)(t)) - ((long)&((struct
connection *)0)->obj_type)));
|
^~~~~~~~~~
../../gcc/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c:31:6:
note: defined here
31 | enum obj_type {
| ^~~~~~~~
../../gcc/gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c:47:8:
note: defined here
47 | struct connection {
| ^~~~~~~~~~
Therefore I do also see a regression, but it does not come from
55f6a7d949abc708d1c6ebc01eb3053f96d1472b.
It seems like an easy fix though and I will add it to the second part of
this patch.
However I did run the tests manually, rather than with make check-gcc as it
failed to run - an issue with stdio not found.
I'm attending this issue and will further update you in case the conclusion
of this mail changes.
Thanks again,
Benjamin.
On Tue, Aug 29, 2023 at 8:47 AM Prathamesh Kulkarni <
prathamesh.kulkarni@linaro.org> wrote:
> On Sat, 26 Aug 2023 at 18:02, Benjamin Priour via Gcc-patches
> <gcc-patches@gcc.gnu.org> wrote:
> >
> > From: benjamin priour <priour.be@gmail.com>
> >
> > Hi,
> >
> > Updated version of the patch, regstrapping the changes described in
> > https://gcc.gnu.org/pipermail/gcc-patches/2023-August/628455.html.
> >
> > Regstrapped off trunk 66be6ed81f369573824f1a8f5a3538a63472292f
> > on x86_64-linux-gnu.
> Hi Benjamin,
> It seems your patch committed in 55f6a7d949abc708d1c6ebc01eb3053f96d1472b
> caused following regressions on arm-eabi config:
> Running gcc:gcc.dg/analyzer/analyzer.exp ...
> FAIL:
> c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
> (test for excess errors)
> FAIL:
> c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
> (test for excess errors)
>
> Please let me know if you need help to reproduce these failures.
>
> Thanks,
> Prathamesh
>
>
@@ -128,6 +128,10 @@ struct interesting_t;
class feasible_node;
+class known_function;
+ class builtin_known_function;
+ class internal_known_function;
+
/* Forward decls of functions. */
extern void dump_tree (pretty_printer *pp, tree t);
@@ -279,6 +283,26 @@ public:
{
return;
}
+
+ virtual const builtin_known_function *
+ dyn_cast_builtin_kf () const { return NULL; }
+ virtual builtin_known_function *
+ dyn_cast_builtin_kf () { return NULL; }
+};
+
+/* Subclass of known_function for builtin functions. */
+
+class builtin_known_function : public known_function
+{
+public:
+ virtual enum built_in_function builtin_code () const = 0;
+ tree builtin_decl () const {
+ gcc_assert (builtin_code () < END_BUILTINS);
+ return builtin_info[builtin_code ()].decl;
+ }
+
+ const builtin_known_function *
+ dyn_cast_builtin_kf () const final override { return this; }
};
/* Subclass of known_function for IFN_* functions. */
@@ -53,13 +53,17 @@ impl_call_pre (const call_details &cd) const
/* Handler for "alloca". */
-class kf_alloca : public known_function
+class kf_alloca : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return cd.num_args () == 1;
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_ALLOCA;
+ }
void impl_call_pre (const call_details &cd) const final override;
};
@@ -322,7 +326,7 @@ public:
/* Handler for "calloc". */
-class kf_calloc : public known_function
+class kf_calloc : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
@@ -331,6 +335,11 @@ public:
&& cd.arg_is_size_p (0)
&& cd.arg_is_size_p (1));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_CALLOC;
+ }
+
void impl_call_pre (const call_details &cd) const final override;
};
@@ -462,12 +471,16 @@ public:
all pointers to the region to the "freed" state together, regardless
of casts. */
-class kf_free : public known_function
+class kf_free : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
- return (cd.num_args () == 0 && cd.arg_is_pointer_p (0));
+ return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
+ }
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_FREE;
}
void impl_call_post (const call_details &cd) const final override;
};
@@ -488,7 +501,7 @@ kf_free::impl_call_post (const call_details &cd) const
/* Handle the on_call_pre part of "malloc". */
-class kf_malloc : public known_function
+class kf_malloc : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
@@ -496,6 +509,10 @@ public:
return (cd.num_args () == 1
&& cd.arg_is_size_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_MALLOC;
+ }
void impl_call_pre (const call_details &cd) const final override;
};
@@ -520,9 +537,18 @@ kf_malloc::impl_call_pre (const call_details &cd) const
/* TODO: complain about overlapping src and dest for the memcpy
variants. */
-class kf_memcpy_memmove : public known_function
+class kf_memcpy_memmove : public builtin_known_function
{
public:
+ enum kf_memcpy_memmove_variant
+ {
+ KF_MEMCPY,
+ KF_MEMCPY_CHK,
+ KF_MEMMOVE,
+ KF_MEMMOVE_CHK,
+ };
+ kf_memcpy_memmove (enum kf_memcpy_memmove_variant variant)
+ : m_variant (variant) {};
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 3
@@ -530,7 +556,25 @@ public:
&& cd.arg_is_pointer_p (1)
&& cd.arg_is_size_p (2));
}
+ enum built_in_function builtin_code () const final override
+ {
+ switch (m_variant)
+ {
+ case KF_MEMCPY:
+ return BUILT_IN_MEMCPY;
+ case KF_MEMCPY_CHK:
+ return BUILT_IN_MEMCPY_CHK;
+ case KF_MEMMOVE:
+ return BUILT_IN_MEMMOVE;
+ case KF_MEMMOVE_CHK:
+ return BUILT_IN_MEMMOVE_CHK;
+ default:
+ gcc_unreachable ();
+ }
+ }
void impl_call_pre (const call_details &cd) const final override;
+private:
+ const enum kf_memcpy_memmove_variant m_variant;
};
void
@@ -557,15 +601,21 @@ kf_memcpy_memmove::impl_call_pre (const call_details &cd) const
/* Handler for "memset" and "__builtin_memset". */
-class kf_memset : public known_function
+class kf_memset : public builtin_known_function
{
public:
+ kf_memset (bool chk_variant) : m_chk_variant (chk_variant) {}
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 3 && cd.arg_is_pointer_p (0));
}
-
+ enum built_in_function builtin_code () const final override
+ {
+ return m_chk_variant ? BUILT_IN_MEMSET_CHK : BUILT_IN_MEMSET;
+ }
void impl_call_pre (const call_details &cd) const final override;
+private:
+ const bool m_chk_variant;
};
void
@@ -747,7 +797,7 @@ public:
Each of these has a custom_edge_info subclass, which updates
the region_model and sm-state of the destination state. */
-class kf_realloc : public known_function
+class kf_realloc : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
@@ -756,6 +806,12 @@ public:
&& cd.arg_is_pointer_p (0)
&& cd.arg_is_size_p (1));
}
+
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_REALLOC;
+ }
+
void impl_call_post (const call_details &cd) const final override;
};
@@ -968,7 +1024,7 @@ kf_realloc::impl_call_post (const call_details &cd) const
/* Handler for "strchr" and "__builtin_strchr". */
-class kf_strchr : public known_function
+class kf_strchr : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
@@ -979,6 +1035,11 @@ public:
{
cd.check_for_null_terminated_string_arg (0);
}
+
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRCHR;
+ }
void impl_call_post (const call_details &cd) const final override;
};
@@ -1055,7 +1116,7 @@ kf_strchr::impl_call_post (const call_details &cd) const
int sprintf(char *str, const char *format, ...);
*/
-class kf_sprintf : public known_function
+class kf_sprintf : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
@@ -1065,6 +1126,11 @@ public:
&& cd.arg_is_pointer_p (1));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_SPRINTF;
+ }
+
void impl_call_pre (const call_details &cd) const final override
{
/* For now, merely assume that the destination buffer gets set to a
@@ -1108,10 +1174,12 @@ public:
/* Handler for "strcat" and "__builtin_strcat_chk". */
-class kf_strcat : public known_function
+class kf_strcat : public builtin_known_function
{
public:
- kf_strcat (unsigned int num_args) : m_num_args (num_args) {}
+ kf_strcat (unsigned int num_args, bool chk_variant)
+ : m_num_args (num_args),
+ m_chk_variant (chk_variant) {}
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == m_num_args
@@ -1119,6 +1187,11 @@ public:
&& cd.arg_is_pointer_p (1));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return m_chk_variant ? BUILT_IN_STRCAT_CHK : BUILT_IN_STRCAT;
+ }
+
void impl_call_pre (const call_details &cd) const final override
{
region_model *model = cd.get_model ();
@@ -1159,25 +1232,32 @@ public:
private:
unsigned int m_num_args;
+ const bool m_chk_variant;
};
/* Handler for "strcpy" and "__builtin_strcpy_chk". */
-class kf_strcpy : public known_function
+class kf_strcpy : public builtin_known_function
{
public:
- kf_strcpy (unsigned int num_args) : m_num_args (num_args) {}
+ kf_strcpy (unsigned int num_args, bool chk_variant)
+ : m_num_args (num_args),
+ m_chk_variant (chk_variant) {}
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == m_num_args
&& cd.arg_is_pointer_p (0)
&& cd.arg_is_pointer_p (1));
}
-
+ enum built_in_function builtin_code () const final override
+ {
+ return m_chk_variant ? BUILT_IN_STRCPY_CHK : BUILT_IN_STRCPY;
+ }
void impl_call_pre (const call_details &cd) const final override;
private:
unsigned int m_num_args;
+ const bool m_chk_variant;
};
void
@@ -1207,13 +1287,17 @@ kf_strcpy::impl_call_pre (const call_details &cd) const
/* Handler for "strdup" and "__builtin_strdup". */
-class kf_strdup : public known_function
+class kf_strdup : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRDUP;
+ }
void impl_call_pre (const call_details &cd) const final override
{
region_model *model = cd.get_model ();
@@ -1234,13 +1318,18 @@ public:
/* Handler for "strlen" and for "__analyzer_get_strlen". */
-class kf_strlen : public known_function
+class kf_strlen : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 1 && cd.arg_is_pointer_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRLEN;
+ }
+
void impl_call_pre (const call_details &cd) const final override
{
if (const svalue *strlen_sval
@@ -1266,13 +1355,17 @@ make_kf_strlen ()
/* Handler for "strndup" and "__builtin_strndup". */
-class kf_strndup : public known_function
+class kf_strndup : public builtin_known_function
{
public:
bool matches_call_types_p (const call_details &cd) const final override
{
return (cd.num_args () == 2 && cd.arg_is_pointer_p (0));
}
+ enum built_in_function builtin_code () const final override
+ {
+ return BUILT_IN_STRNDUP;
+ }
void impl_call_pre (const call_details &cd) const final override
{
region_model *model = cd.get_model ();
@@ -1445,44 +1538,73 @@ register_known_functions (known_function_manager &kfm)
kfm.add (IFN_UBSAN_BOUNDS, make_unique<kf_ubsan_bounds> ());
}
- /* Built-ins the analyzer has known_functions for. */
+ /* GCC built-ins that do not correspond to a function
+ in the standard library. */
{
- kfm.add (BUILT_IN_ALLOCA, make_unique<kf_alloca> ());
- kfm.add (BUILT_IN_ALLOCA_WITH_ALIGN, make_unique<kf_alloca> ());
- kfm.add (BUILT_IN_CALLOC, make_unique<kf_calloc> ());
kfm.add (BUILT_IN_EXPECT, make_unique<kf_expect> ());
kfm.add (BUILT_IN_EXPECT_WITH_PROBABILITY, make_unique<kf_expect> ());
- kfm.add (BUILT_IN_FREE, make_unique<kf_free> ());
- kfm.add (BUILT_IN_MALLOC, make_unique<kf_malloc> ());
- kfm.add (BUILT_IN_MEMCPY, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMCPY_CHK, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMMOVE, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMMOVE_CHK, make_unique<kf_memcpy_memmove> ());
- kfm.add (BUILT_IN_MEMSET, make_unique<kf_memset> ());
- kfm.add (BUILT_IN_MEMSET_CHK, make_unique<kf_memset> ());
- kfm.add (BUILT_IN_REALLOC, make_unique<kf_realloc> ());
- kfm.add (BUILT_IN_SPRINTF, make_unique<kf_sprintf> ());
+ kfm.add (BUILT_IN_ALLOCA_WITH_ALIGN, make_unique<kf_alloca> ());
kfm.add (BUILT_IN_STACK_RESTORE, make_unique<kf_stack_restore> ());
kfm.add (BUILT_IN_STACK_SAVE, make_unique<kf_stack_save> ());
- kfm.add (BUILT_IN_STRCAT, make_unique<kf_strcat> (2));
- kfm.add (BUILT_IN_STRCAT_CHK, make_unique<kf_strcat> (3));
- kfm.add (BUILT_IN_STRCHR, make_unique<kf_strchr> ());
- kfm.add (BUILT_IN_STRCPY, make_unique<kf_strcpy> (2));
- kfm.add (BUILT_IN_STRCPY_CHK, make_unique<kf_strcpy> (3));
- kfm.add (BUILT_IN_STRDUP, make_unique<kf_strdup> ());
- kfm.add (BUILT_IN_STRNDUP, make_unique<kf_strndup> ());
- kfm.add (BUILT_IN_STRLEN, make_kf_strlen ());
register_atomic_builtins (kfm);
register_varargs_builtins (kfm);
}
- /* Known builtins and C standard library functions. */
+ /* Known builtins and C standard library functions
+ the analyzer has known functions for. */
{
- kfm.add ("memset", make_unique<kf_memset> ());
- kfm.add ("strcat", make_unique<kf_strcat> (2));
+ kfm.add ("alloca", make_unique<kf_alloca> ());
+ kfm.add ("__builtin_alloca", make_unique<kf_alloca> ());
+ kfm.add ("calloc", make_unique<kf_calloc> ());
+ kfm.add ("__builtin_calloc", make_unique<kf_calloc> ());
+ kfm.add ("free", make_unique<kf_free> ());
+ kfm.add ("__builtin_free", make_unique<kf_free> ());
+ kfm.add ("malloc", make_unique<kf_malloc> ());
+ kfm.add ("__builtin_malloc", make_unique<kf_malloc> ());
+ kfm.add ("memcpy",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMCPY));
+ kfm.add ("__builtin_memcpy",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMCPY));
+ kfm.add ("__memcpy_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMCPY_CHK));
+ kfm.add ("__builtin___memcpy_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMCPY_CHK));
+ kfm.add ("memmove",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMMOVE));
+ kfm.add ("__builtin_memmove",
+ make_unique<kf_memcpy_memmove> (kf_memcpy_memmove::KF_MEMMOVE));
+ kfm.add ("__memmove_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMMOVE_CHK));
+ kfm.add ("__builtin___memmove_chk", make_unique<kf_memcpy_memmove>
+ (kf_memcpy_memmove::KF_MEMMOVE_CHK));
+ kfm.add ("memset", make_unique<kf_memset> (false));
+ kfm.add ("__builtin_memset", make_unique<kf_memset> (false));
+ kfm.add ("__memset_chk", make_unique<kf_memset> (true));
+ kfm.add ("__builtin___memset_chk", make_unique<kf_memset> (true));
+ kfm.add ("realloc", make_unique<kf_realloc> ());
+ kfm.add ("__builtin_realloc", make_unique<kf_realloc> ());
+ kfm.add ("sprintf", make_unique<kf_sprintf> ());
+ kfm.add ("__builtin_sprintf", make_unique<kf_sprintf> ());
+ kfm.add ("strchr", make_unique<kf_strchr> ());
+ kfm.add ("__builtin_strchr", make_unique<kf_strchr> ());
+ kfm.add ("strcpy", make_unique<kf_strcpy> (2, false));
+ kfm.add ("__builtin_strcpy", make_unique<kf_strcpy> (2, false));
+ kfm.add ("__strcpy_chk", make_unique<kf_strcpy> (3, true));
+ kfm.add ("__builtin___strcpy_chk", make_unique<kf_strcpy> (3, true));
+ kfm.add ("strcat", make_unique<kf_strcat> (2, false));
+ kfm.add ("__builtin_strcat", make_unique<kf_strcat> (2, false));
+ kfm.add ("__strcat_chk", make_unique<kf_strcat> (3, true));
+ kfm.add ("__builtin___strcat_chk", make_unique<kf_strcat> (3, true));
kfm.add ("strdup", make_unique<kf_strdup> ());
+ kfm.add ("__builtin_strdup", make_unique<kf_strdup> ());
kfm.add ("strndup", make_unique<kf_strndup> ());
+ kfm.add ("__builtin_strndup", make_unique<kf_strndup> ());
+ kfm.add ("strlen", make_unique<kf_strlen> ());
+ kfm.add ("__builtin_strlen", make_unique<kf_strlen> ());
+
+ register_atomic_builtins (kfm);
+ register_varargs_builtins (kfm);
}
/* Known POSIX functions, and some non-standard extensions. */
@@ -137,6 +137,13 @@ known_function_manager::get_normal_builtin (enum built_in_function name) const
return m_combined_fns_arr[name];
}
+const known_function *
+known_function_manager::
+get_normal_builtin (const builtin_known_function *builtin_kf) const
+{
+ return get_normal_builtin (builtin_kf->builtin_code ());
+}
+
/* Get any known_function matching IDENTIFIER, without type-checking.
Return NULL if there isn't one. */
@@ -54,6 +54,8 @@ private:
DISABLE_COPY_AND_ASSIGN (known_function_manager);
const known_function *get_normal_builtin (enum built_in_function name) const;
+ const known_function *
+ get_normal_builtin (const builtin_known_function *builtin_kf) const;
const known_function *get_by_identifier (tree identifier) const;
/* Map from identifier to known_function instance.
@@ -1514,6 +1514,62 @@ region_model::get_known_function (enum internal_fn ifn) const
return known_fn_mgr->get_internal_fn (ifn);
}
+/* Get any builtin_known_function for CALL and emit any warning to CTXT
+ if not NULL.
+
+ The call must match all assumptions made by the known_function (such as
+ e.g. "argument 1's type must be a pointer type").
+
+ Return NULL if no builtin_known_function is found, or it does
+ not match the assumption(s).
+
+ Internally calls get_known_function to find a known_function and cast it
+ to a builtin_known_function.
+
+ For instance, calloc is a C builtin, defined in gcc/builtins.def
+ by the DEF_LIB_BUILTIN macro. Such builtins are recognized by the
+ analyzer by their name, so that even in C++ or if the user redeclares
+ them but mismatch their signature, they are still recognized as builtins.
+
+ Cases when a supposed builtin is not flagged as one by the FE:
+
+ The C++ FE does not recognize calloc as a builtin if it has not been
+ included from a standard header, but the C FE does. Hence in C++ if
+ CALL comes from a calloc and stdlib is not included,
+ gcc/tree.h:fndecl_built_in_p (CALL) would be false.
+
+ In C code, a __SIZE_TYPE__ calloc (__SIZE_TYPE__, __SIZE_TYPE__) user
+ declaration has obviously a mismatching signature from the standard, and
+ its function_decl tree won't be unified by
+ gcc/c-decl.cc:match_builtin_function_types.
+
+ Yet in both cases the analyzer should treat the calls as a builtin calloc
+ so that extra attributes unspecified by the standard but added by GCC
+ (e.g. sprintf attributes in gcc/builtins.def), useful for the detection of
+ dangerous behavior, are indeed processed.
+
+ Therefore for those cases when a "builtin flag" is not added by the FE,
+ builtins' kf are derived from builtin_known_function, whose method
+ builtin_known_function::builtin_decl returns the builtin's
+ function_decl tree as defined in gcc/builtins.def, with all the extra
+ attributes. */
+
+const builtin_known_function *
+region_model::get_builtin_kf (const gcall *call,
+ region_model_context *ctxt /* = NULL */) const
+{
+ region_model *mut_this = const_cast <region_model *> (this);
+ tree callee_fndecl = mut_this->get_fndecl_for_call (call, ctxt);
+ if (! callee_fndecl)
+ return NULL;
+
+ call_details cd (call, mut_this, ctxt);
+ if (const known_function *kf = get_known_function (callee_fndecl, cd))
+ return kf->dyn_cast_builtin_kf ();
+
+ return NULL;
+}
+
/* Update this model for the CALL stmt, using CTXT to report any
diagnostics - the first half.
@@ -528,6 +528,10 @@ class region_model
bool include_terminator,
const svalue **out_sval);
+ const builtin_known_function *
+ get_builtin_kf (const gcall *call,
+ region_model_context *ctxt = NULL) const;
+
private:
const region *get_lvalue_1 (path_var pv, region_model_context *ctxt) const;
const svalue *get_rvalue_1 (path_var pv, region_model_context *ctxt) const;
@@ -1294,8 +1294,19 @@ fd_state_machine::check_for_fd_attrs (
const gcall *call, const tree callee_fndecl, const char *attr_name,
access_directions fd_attr_access_dir) const
{
-
- tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));
+ /* Handle interesting fd attributes of the callee_fndecl,
+ or prioritize those of the builtin that callee_fndecl is
+ expected to be.
+ Might want this to be controlled by a flag. */
+ tree fndecl = callee_fndecl;
+ /* If call is recognized as a builtin known_function,
+ use that builtin's function_decl. */
+ if (const region_model *old_model = sm_ctxt->get_old_region_model ())
+ if (const builtin_known_function *builtin_kf
+ = old_model->get_builtin_kf (call))
+ fndecl = builtin_kf->builtin_decl ();
+
+ tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (fndecl));
attrs = lookup_attribute (attr_name, attrs);
if (!attrs)
return;
@@ -1325,13 +1336,15 @@ fd_state_machine::check_for_fd_attrs (
// attributes
{
+ /* Do use the fndecl that caused the warning so that the
+ misused attributes are printed and the user not confused. */
if (is_closed_fd_p (state))
{
sm_ctxt->warn (node, stmt, arg,
make_unique<fd_use_after_close>
(*this, diag_arg,
- callee_fndecl, attr_name,
+ fndecl, attr_name,
arg_idx));
continue;
}
@@ -1343,7 +1356,7 @@ fd_state_machine::check_for_fd_attrs (
sm_ctxt->warn (node, stmt, arg,
make_unique<fd_use_without_check>
(*this, diag_arg,
- callee_fndecl, attr_name,
+ fndecl, attr_name,
arg_idx));
continue;
}
@@ -1361,7 +1374,7 @@ fd_state_machine::check_for_fd_attrs (
node, stmt, arg,
make_unique<fd_access_mode_mismatch> (*this, diag_arg,
DIRS_WRITE,
- callee_fndecl,
+ fndecl,
attr_name,
arg_idx));
}
@@ -1375,7 +1388,7 @@ fd_state_machine::check_for_fd_attrs (
node, stmt, arg,
make_unique<fd_access_mode_mismatch> (*this, diag_arg,
DIRS_READ,
- callee_fndecl,
+ fndecl,
attr_name,
arg_idx));
}
@@ -1965,71 +1965,88 @@ malloc_state_machine::on_stmt (sm_context *sm_ctxt,
malloc_state_machine *mutable_this
= const_cast <malloc_state_machine *> (this);
- /* Handle "__attribute__((malloc(FOO)))". */
- if (const deallocator_set *deallocators
+ /* Handle interesting attributes of the callee_fndecl,
+ or prioritize those of the builtin that callee_fndecl is expected
+ to be.
+ Might want this to be controlled by a flag. */
+ {
+ tree fndecl = callee_fndecl;
+ /* If call is recognized as a builtin known_function, use that
+ builtin's function_decl. */
+ if (const region_model *old_model = sm_ctxt->get_old_region_model ())
+ if (const builtin_known_function *builtin_kf
+ = old_model->get_builtin_kf (call))
+ fndecl = builtin_kf->builtin_decl ();
+
+ /* Handle "__attribute__((malloc(FOO)))". */
+ if (const deallocator_set *deallocators
= mutable_this->get_or_create_custom_deallocator_set
- (callee_fndecl))
+ (fndecl))
+ {
+ tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (fndecl));
+ bool returns_nonnull
+ = lookup_attribute ("returns_nonnull", attrs);
+ on_allocator_call (sm_ctxt, call, deallocators, returns_nonnull);
+ }
+
{
- tree attrs = TYPE_ATTRIBUTES (TREE_TYPE (callee_fndecl));
- bool returns_nonnull
- = lookup_attribute ("returns_nonnull", attrs);
- on_allocator_call (sm_ctxt, call, deallocators, returns_nonnull);
+ /* Handle "__attribute__((nonnull))". */
+ tree fntype = TREE_TYPE (fndecl);
+ bitmap nonnull_args = get_nonnull_args (fntype);
+ if (nonnull_args)
+ {
+ for (unsigned i = 0; i < gimple_call_num_args (stmt); i++)
+ {
+ tree arg = gimple_call_arg (stmt, i);
+ if (TREE_CODE (TREE_TYPE (arg)) != POINTER_TYPE)
+ continue;
+ /* If we have a nonnull-args, and either all pointers, or
+ just the specified pointers. */
+ if (bitmap_empty_p (nonnull_args)
+ || bitmap_bit_p (nonnull_args, i))
+ {
+ state_t state = sm_ctxt->get_state (stmt, arg);
+ /* Can't use a switch as the states are non-const. */
+ /* Do use the fndecl that caused the warning so that the
+ misused attributes are printed and the user not
+ confused. */
+ if (unchecked_p (state))
+ {
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ sm_ctxt->warn (node, stmt, arg,
+ make_unique<possible_null_arg>
+ (*this, diag_arg, fndecl, i));
+ const allocation_state *astate
+ = as_a_allocation_state (state);
+ sm_ctxt->set_next_state (stmt, arg,
+ astate->get_nonnull ());
+ }
+ else if (state == m_null)
+ {
+ tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
+ sm_ctxt->warn (node, stmt, arg,
+ make_unique<null_arg>
+ (*this, diag_arg, fndecl, i));
+ sm_ctxt->set_next_state (stmt, arg, m_stop);
+ }
+ else if (state == m_start)
+ maybe_assume_non_null (sm_ctxt, arg, stmt);
+ }
+ }
+ BITMAP_FREE (nonnull_args);
+ }
}
- /* Handle "__attribute__((nonnull))". */
- {
- tree fntype = TREE_TYPE (callee_fndecl);
- bitmap nonnull_args = get_nonnull_args (fntype);
- if (nonnull_args)
+ /* Check for this after nonnull, so that if we have both
+ then we transition to "freed", rather than "checked". */
+ unsigned dealloc_argno = fndecl_dealloc_argno (fndecl);
+ if (dealloc_argno != UINT_MAX)
{
- for (unsigned i = 0; i < gimple_call_num_args (stmt); i++)
- {
- tree arg = gimple_call_arg (stmt, i);
- if (TREE_CODE (TREE_TYPE (arg)) != POINTER_TYPE)
- continue;
- /* If we have a nonnull-args, and either all pointers, or just
- the specified pointers. */
- if (bitmap_empty_p (nonnull_args)
- || bitmap_bit_p (nonnull_args, i))
- {
- state_t state = sm_ctxt->get_state (stmt, arg);
- /* Can't use a switch as the states are non-const. */
- if (unchecked_p (state))
- {
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
- sm_ctxt->warn (node, stmt, arg,
- make_unique<possible_null_arg>
- (*this, diag_arg, callee_fndecl, i));
- const allocation_state *astate
- = as_a_allocation_state (state);
- sm_ctxt->set_next_state (stmt, arg,
- astate->get_nonnull ());
- }
- else if (state == m_null)
- {
- tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
- sm_ctxt->warn (node, stmt, arg,
- make_unique<null_arg>
- (*this, diag_arg, callee_fndecl, i));
- sm_ctxt->set_next_state (stmt, arg, m_stop);
- }
- else if (state == m_start)
- maybe_assume_non_null (sm_ctxt, arg, stmt);
- }
- }
- BITMAP_FREE (nonnull_args);
+ const deallocator *d
+ = mutable_this->get_or_create_deallocator (fndecl);
+ on_deallocator_call (sm_ctxt, node, call, d, dealloc_argno);
}
}
-
- /* Check for this after nonnull, so that if we have both
- then we transition to "freed", rather than "checked". */
- unsigned dealloc_argno = fndecl_dealloc_argno (callee_fndecl);
- if (dealloc_argno != UINT_MAX)
- {
- const deallocator *d
- = mutable_this->get_or_create_deallocator (callee_fndecl);
- on_deallocator_call (sm_ctxt, node, call, d, dealloc_argno);
- }
}
/* Look for pointers explicitly being compared against zero
similarity index 89%
rename from gcc/testsuite/gcc.dg/analyzer/aliasing-3.c
rename to gcc/testsuite/c-c++-common/analyzer/aliasing-3.c
@@ -1,6 +1,4 @@
-#include "analyzer-decls.h"
-
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct s1
{
@@ -39,7 +37,7 @@ static struct s2 *p2_glob = NULL;
void test_2 (struct s2 **pp2, struct s2 *p2_parm)
{
/* Ensure that p2_glob is modified. */
- p2_glob = __builtin_malloc (sizeof (struct s2));
+ p2_glob = (struct s2 *) __builtin_malloc (sizeof (struct s2));
if (!p2_glob)
return;
@@ -61,7 +59,7 @@ struct s3 *p3_glob = NULL;
void test_3 (struct s3 **pp3, struct s3 *p3_parm)
{
- p3_glob = __builtin_malloc (sizeof (struct s3));
+ p3_glob = (struct s3 *) __builtin_malloc (sizeof (struct s3));
if (!p3_glob)
return;
similarity index 53%
rename from gcc/testsuite/gcc.dg/analyzer/aliasing-pr106473.c
rename to gcc/testsuite/c-c++-common/analyzer/aliasing-pr106473.c
@@ -1,5 +1,5 @@
void foo(char **args[], int *argc)
{
*argc = 1;
- (*args)[0] = __builtin_malloc(42);
+ (*args)[0] = (char *) __builtin_malloc(42);
}
new file mode 100644
@@ -0,0 +1,96 @@
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
+
+#include <stdint.h>
+
+void test_constant_1 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_1': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_1()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (1);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_constant_2 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_2': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_2()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (2);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+ int32_t *ptr = (int32_t *) __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+ __builtin_free (ptr);
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ ^~~~~~~~~~~~~~~~~~~~~~~~
+ 'test_symbolic': event 1
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ ~~~~~~~~~~~~~~~~~^~~~~~~
+ 'void test_symbolic(int)': event 1
+ |
+ | int32_t *ptr = (int32_t *) __builtin_malloc (n * 2);
+ | ~~~~~~~~~~~~~~~~~^~~~~~~
+ | |
+ | (1) allocated '(n * 2)' bytes and assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
new file mode 100644
@@ -0,0 +1,98 @@
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
+/* { dg-require-effective-target alloca } */
+
+#include <stdint.h>
+
+void test_constant_1 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_1': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_1()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (1);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 1 byte here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_constant_2 (void)
+{
+ int32_t *ptr = (int32_t *) __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ ^~~~~~~~~~~~~~~~~~~~
+ 'test_constant_2': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ | ^~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'void test_constant_2()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (2);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (1) allocated 2 bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+ int32_t *ptr = (int32_t *) __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ ^~~~~~~~~~~~~~~~~~~~~~~~
+ 'test_symbolic': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+ | |
+ | (1) allocated 'n * 2' bytes here
+ | (2) assigned to 'int32_t *'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ ~~~~~~~~~~~~~~~~~^~~~~~~
+ 'void test_symbolic(int)': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) __builtin_alloca (n * 2);
+ | ~~~~~~~~~~~~~~~~~^~~~~~~
+ | |
+ | (1) allocated '(n * 2)' bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+/* FIXME: am getting a duplicate warning here for some reason
+ without -fanalyzer-fine-grained (PR PR analyzer/107851). */
+
new file mode 100644
@@ -0,0 +1,68 @@
+/* Verify that we warn for incorrect uses of "alloca" (which may be in a
+ macro in a system header), and that the output looks correct. */
+
+/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
+/* { dg-require-effective-target alloca } */
+
+#include <stdint.h>
+#include "../../gcc.dg/analyzer/test-alloca.h"
+
+void test_constant_99 (void)
+{
+ int32_t *ptr = (int32_t *) alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (99);
+ ^~~~~~
+ 'test_constant_99': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (99);
+ | ^~~~~~
+ | |
+ | (1) allocated 99 bytes here
+ | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (99);
+ ^~~~~~
+ 'void test_constant_99()': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (99);
+ | ^~~~~~
+ | |
+ | (1) allocated 99 bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
+
+void test_symbolic (int n)
+{
+ int32_t *ptr = (int32_t *) alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+}
+
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (n * 2);
+ ^~~~~~
+ 'test_symbolic': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (n * 2);
+ | ^~~~~~
+ | |
+ | (1) allocated 'n * 2' bytes here
+ | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ int32_t *ptr = (int32_t *) alloca (n * 2);
+ ^~~~~~
+ 'void test_symbolic(int)': events 1-2
+ |
+ | int32_t *ptr = (int32_t *) alloca (n * 2);
+ | ^~~~~~
+ | |
+ | (1) allocated '(n * 2)' bytes here
+ | (2) assigned to 'int32_t*' {aka '{re:long :re?}int*'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
similarity index 96%
rename from gcc/testsuite/gcc.dg/analyzer/asm-x86-dyndbg-2.c
rename to gcc/testsuite/c-c++-common/analyzer/asm-x86-dyndbg-2.c
@@ -8,9 +8,11 @@
/* Adapted from various files in the Linux kernel, all of which have: */
/* SPDX-License-Identifier: GPL-2.0 */
-typedef _Bool bool;
-#define true 1
-#define false 0
+#ifndef __cplusplus
+ typedef _Bool bool;
+ #define true 1
+ #define false 0
+#endif
typedef struct {} atomic_t;
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/asm-x86-lp64-2.c
rename to gcc/testsuite/c-c++-common/analyzer/asm-x86-lp64-2.c
@@ -3,7 +3,9 @@
/* Adapted from Linux x86: page_ref_dec_and_test.c (GPL-2.0). */
-typedef _Bool bool;
+#ifndef __cplusplus
+ typedef _Bool bool;
+#endif
typedef struct {
int counter;
similarity index 95%
rename from gcc/testsuite/gcc.dg/analyzer/atomic-builtins-haproxy-proxy.c
rename to gcc/testsuite/c-c++-common/analyzer/atomic-builtins-haproxy-proxy.c
@@ -37,7 +37,7 @@ proxy_capture_error(struct proxy* proxy,
/* [...snip...] */
- es = malloc(sizeof(*es));
+ es = (struct error_snapshot *) malloc(sizeof(*es));
if (!es)
return;
similarity index 74%
rename from gcc/testsuite/gcc.dg/analyzer/atomic-builtins-qemu-sockets.c
rename to gcc/testsuite/c-c++-common/analyzer/atomic-builtins-qemu-sockets.c
@@ -5,7 +5,7 @@ struct foo {
void *
test (const char *str)
{
- struct foo *p = __builtin_malloc(sizeof(struct foo));
+ struct foo *p = (struct foo *) __builtin_malloc(sizeof(struct foo));
if (!p)
return p;
similarity index 88%
rename from gcc/testsuite/gcc.dg/analyzer/attr-malloc-6.c
rename to gcc/testsuite/c-c++-common/analyzer/attr-malloc-6.c
@@ -74,7 +74,7 @@ void warn_fdopen (void)
{
FILE *q = fdopen (0); // { dg-message "allocated here" }
- q = realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
+ q = (FILE *) realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
sink (q);
}
}
@@ -117,7 +117,7 @@ void warn_fopen (void)
{
FILE *q = fdopen (0);
- q = realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
+ q = (FILE *) realloc (q, 7); // { dg-warning "'realloc' called on 'q' returned from a mismatched allocation function" }
sink (q);
}
}
@@ -170,18 +170,18 @@ void test_tmpfile (void)
void warn_malloc (void)
{
{
- FILE *p = malloc (100); // { dg-message "allocated here" }
+ FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
fclose (p); // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'fclose'" }
}
{
- FILE *p = malloc (100); // { dg-message "allocated here" }
+ FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
p = freopen ("1", "r", p);// { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'freopen'" }
fclose (p);
}
{
- FILE *p = malloc (100); // { dg-message "allocated here" }
+ FILE *p = (FILE *) malloc (100); // { dg-message "allocated here" }
pclose (p); // { dg-warning "'p' should have been deallocated with 'free' but was deallocated with 'pclose'" }
}
}
@@ -222,7 +222,7 @@ void test_acquire (void)
{
FILE *p = acquire (); // { dg-message "allocated here \\(expects deallocation with 'release'\\)" }
- p = realloc (p, 123); // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
+ p = (FILE *) realloc (p, 123); // { dg-warning "'p' should have been deallocated with 'release' but was deallocated with 'realloc'" }
sink (p);
}
}
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
rename to gcc/testsuite/c-c++-common/analyzer/attr-malloc-CVE-2019-19078-usb-leak.c
@@ -3,7 +3,10 @@
typedef unsigned char u8;
typedef unsigned short u16;
-typedef _Bool bool;
+
+#ifndef __cplusplus
+ typedef _Bool bool;
+#endif
#define ENOMEM 12
#define EINVAL 22
@@ -149,7 +152,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
goto err;
}
- skb = items[i].transfer_context;
+ skb = (struct sk_buff *) items[i].transfer_context;
urb_context->skb = skb;
urb = usb_alloc_urb(0, GFP_ATOMIC); /* { dg-message "allocated here" } */
@@ -209,7 +212,7 @@ static const struct ath10k_hif_ops ath10k_usb_hif_ops = {
/* Simulate code to register the callback. */
extern void callback_registration (const void *);
-int ath10k_usb_probe(void)
+void ath10k_usb_probe(void)
{
callback_registration(&ath10k_usb_hif_ops);
}
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/attr-tainted_args-1.c
rename to gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-1.c
@@ -1,7 +1,7 @@
// TODO: remove need for this option
/* { dg-additional-options "-fanalyzer-checker=taint" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct arg_buf
{
@@ -23,7 +23,7 @@ test_1 (int i, void *p, char *q)
__analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", *q); /* { dg-warning "state: 'tainted'" } */
- struct arg_buf *args = p;
+ struct arg_buf *args = (struct arg_buf *) p;
__analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'tainted'" } */
}
@@ -49,7 +49,7 @@ test_2a (int i, void *p, char *q)
__analyzer_dump_state ("taint", p); /* { dg-warning "state: 'start'" } */
__analyzer_dump_state ("taint", q); /* { dg-warning "state: 'start'" } */
- struct arg_buf *args = p;
+ struct arg_buf *args = (struct arg_buf *) p;
__analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'start'" } */
__analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'start'" } */
}
similarity index 95%
rename from gcc/testsuite/gcc.dg/analyzer/call-summaries-pr107158.c
rename to gcc/testsuite/c-c++-common/analyzer/call-summaries-pr107158.c
@@ -25,7 +25,7 @@ __attribute__((__noreturn__)) void failed(const char *message);
static char *string_dup(const char *string) {
char *buf;
- if ((buf = malloc(strlen(string) + 1)) == ((void *)0))
+ if ((buf = (char *) malloc(strlen(string) + 1)) == ((void *)0))
failed("malloc() failed");
return strcpy(buf, string);
@@ -37,7 +37,7 @@ static void store_data(const char *name, const char *type) {
if ((p = (struct mydata *)malloc(sizeof(struct mydata))) == ((void *)0))
failed("malloc() failed");
- p->link = ((void *)0);
+ p->link = (struct mydata *)((void *)0);
p->name = string_dup(name);
p->type = string_dup(type);
similarity index 87%
rename from gcc/testsuite/gcc.dg/analyzer/calloc-1.c
rename to gcc/testsuite/c-c++-common/analyzer/calloc-1.c
@@ -1,9 +1,6 @@
-#include "analyzer-decls.h"
-
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
-
extern void *calloc (size_t __nmemb, size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
__attribute__ ((__malloc__))
@@ -13,7 +10,7 @@ char *test_1 (size_t sz)
{
char *p;
- p = calloc (1, 3);
+ p = (char *) calloc (1, 3);
if (!p)
return NULL;
similarity index 83%
rename from gcc/testsuite/gcc.dg/analyzer/compound-assignment-5.c
rename to gcc/testsuite/c-c++-common/analyzer/compound-assignment-5.c
@@ -1,4 +1,4 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct coord
{
@@ -23,7 +23,7 @@ void test_1 (void)
/* Copying from an on-stack array to a global array. */
-struct coord glob_arr[16];
+struct coord glob_arr2[16];
void test_2 (void)
{
@@ -31,32 +31,30 @@ void test_2 (void)
arr[3].x = 5;
arr[3].y = 6;
- glob_arr[7] = arr[3];
+ glob_arr2[7] = arr[3];
- __analyzer_eval (glob_arr[7].x == 5); /* { dg-warning "TRUE" } */
- __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
+ __analyzer_eval (glob_arr2[7].x == 5); /* { dg-warning "TRUE" } */
+ __analyzer_eval (glob_arr2[7].y == 6); /* { dg-warning "TRUE" } */
}
/* Copying from a partially initialized on-stack array to a global array. */
-struct coord glob_arr[16];
+struct coord glob_arr3[16];
void test_3 (void)
{
struct coord arr[16];
arr[3].y = 6;
- glob_arr[7] = arr[3]; // or should the uninit warning be here?
+ glob_arr3[7] = arr[3]; // or should the uninit warning be here?
- __analyzer_eval (glob_arr[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
+ __analyzer_eval (glob_arr3[7].x); /* { dg-warning "uninitialized" "uninit" { xfail *-*-* } } */
/* { dg-bogus "UNKNOWN" "unknown" { xfail *-*-* } .-1 } */
- __analyzer_eval (glob_arr[7].y == 6); /* { dg-warning "TRUE" } */
+ __analyzer_eval (glob_arr3[7].y == 6); /* { dg-warning "TRUE" } */
}
/* Symbolic bindings: copying from one array to another. */
-struct coord glob_arr[16];
-
void test_4 (int i)
{
struct coord arr_a[16];
@@ -77,8 +75,6 @@ void test_4 (int i)
/* Symbolic bindings: copying within an array: symbolic src and dest */
-struct coord glob_arr[16];
-
void test_5a (int i, int j)
{
struct coord arr[16];
@@ -95,8 +91,6 @@ void test_5a (int i, int j)
/* Symbolic bindings: copying within an array: symbolic src, concrete dest. */
-struct coord glob_arr[16];
-
void test_5b (int i)
{
struct coord arr[16];
@@ -113,8 +107,6 @@ void test_5b (int i)
/* Symbolic bindings: copying within an array: concrete src, symbolic dest. */
-struct coord glob_arr[16];
-
void test_5c (int i)
{
struct coord arr[16];
@@ -132,10 +124,12 @@ void test_5c (int i)
/* No info on the subregion being copied, and hence
binding_cluster2::maybe_get_compound_binding should return NULL. */
+struct coord glob_arr6[16];
+
void test_6 (void)
{
struct coord arr[16];
- arr[7] = glob_arr[3];
+ arr[7] = glob_arr6[3];
__analyzer_eval (arr[7].x == 5); /* { dg-warning "UNKNOWN" } */
__analyzer_eval (arr[7].y == 6); /* { dg-warning "UNKNOWN" } */
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/coreutils-cksum-pr108664.c
rename to gcc/testsuite/c-c++-common/analyzer/coreutils-cksum-pr108664.c
@@ -7,6 +7,11 @@ typedef long unsigned int size_t;
typedef unsigned int __uint32_t;
typedef unsigned long int __uintmax_t;
typedef struct _IO_FILE FILE;
+
+#ifndef __cplusplus
+ typedef _Bool bool;
+#endif
+
extern size_t
fread_unlocked(void* __restrict __ptr,
size_t __size,
@@ -30,7 +35,7 @@ __errno_location(void) __attribute__((__nothrow__, __leaf__))
__attribute__((__const__));
extern uint_fast32_t const crctab[8][256];
-static _Bool
+static bool
cksum_slice8(FILE* fp, uint_fast32_t* crc_out, uintmax_t* length_out)
{
uint32_t buf[(1 << 16) / sizeof(uint32_t)];
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/coreutils-sum-pr108666.c
rename to gcc/testsuite/c-c++-common/analyzer/coreutils-sum-pr108666.c
@@ -35,7 +35,7 @@ bsd_sum_stream(FILE* stream, void* resstream, uintmax_t* length)
int checksum = 0;
uintmax_t total_bytes = 0;
static const size_t buffer_length = 32768;
- uint8_t* buffer = malloc(buffer_length);
+ uint8_t* buffer = (uint8_t *) malloc(buffer_length);
if (!buffer)
return -1;
new file mode 100644
@@ -0,0 +1,6 @@
+int test (void)
+{
+ const unsigned char *s = (const unsigned char *) "abc";
+ const signed char *t = (const signed char *) "xyz";
+ return s[1] + t[1];
+}
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-1.c
rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-1.c
@@ -19,7 +19,7 @@ int test_1 (void) {
}
data = could_fail_2 (fd);
- hdr = data;
+ hdr = (struct header *) data;
if (hdr->signature != 42) {
ret = -2;
similarity index 98%
rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108455-git-pack-revindex.c
rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108455-git-pack-revindex.c
@@ -95,7 +95,7 @@ int load_revindex_from_disk(char *revindex_name, uint32_t num_objects,
}
data = xmmap(((void *)0), revindex_size, 0x1, 0x02, fd, 0);
- hdr = data;
+ hdr = (struct revindex_header *) data;
if (git_bswap32(hdr->signature) != 0x52494458) {
ret =
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-1.c
rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-1.c
@@ -1,6 +1,7 @@
/* Reduced from haproxy-2.7.1: src/tcpcheck.c. */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
int
test_1 (char **args, int cur_arg)
similarity index 96%
rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr108475-haproxy-tcpcheck.c
@@ -3,7 +3,9 @@
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
extern void *calloc(size_t __nmemb, size_t __size)
__attribute__((__nothrow__, __leaf__)) __attribute__((__malloc__))
@@ -86,7 +88,7 @@ void free_tcpcheck(struct tcpcheck_rule *rule, int in_pool);
void free_tcpcheck_http_hdr(struct tcpcheck_http_hdr *hdr);
#define ist(str) ({ \
- char *__x = (void *)(str); \
+ char *__x = (char *) ((void *)(str)); \
(struct ist){ \
.ptr = __x, \
.len = __builtin_constant_p(str) ? \
@@ -114,7 +116,7 @@ struct tcpcheck_rule *proxy_parse_httpchk_req(char **args, int cur_arg,
goto error;
}
- chk = calloc(1, sizeof(*chk));
+ chk = (struct tcpcheck_rule *) calloc(1, sizeof(*chk));
if (!chk) {
/* [...snip...] */
goto error;
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109060-haproxy-cfgparse.c
@@ -51,7 +51,7 @@ parse_process_number(const char* arg,
else if (strcmp(arg, "even") == 0)
*proc |= (~0UL / 3UL) << 1;
else {
- const char *p, *dash = ((void*)0);
+ const char *p, *dash = (const char *) ((void*)0);
unsigned int low, high;
for (p = arg; *p; p++) {
similarity index 96%
rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr109239-linux-bus.c
rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr109239-linux-bus.c
@@ -1,7 +1,8 @@
/* Reduced from linux-5.10.162's drivers-base-bus.c */
/* { dg-additional-options "-fno-delete-null-pointer-checks -O2" } */
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
typedef unsigned int __kernel_size_t;
typedef int __kernel_ssize_t;
@@ -57,7 +58,7 @@ struct kset*
to_kset(struct kobject* kobj)
{
return kobj ? ({
- void* __mptr = (void*)(kobj);
+ char* __mptr = (char*)(kobj);
((struct kset*)(__mptr - __builtin_offsetof(struct kset, kobj)));
}) : NULL;
}
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/deref-before-check-pr77425.c
rename to gcc/testsuite/c-c++-common/analyzer/deref-before-check-pr77425.c
@@ -1,7 +1,9 @@
/* Fixed in r7-2945-g61f46d0e6dd568.
Simplified from gcc/ipa-devirt.c. */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
typedef struct odr_type_d {
/* .... */
int id;
similarity index 59%
rename from gcc/testsuite/gcc.dg/analyzer/exec-1.c
rename to gcc/testsuite/c-c++-common/analyzer/exec-1.c
@@ -1,4 +1,10 @@
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+#ifdef __cplusplus
+ #define CONST_CAST(type) const_cast<type>
+#else
+ #define CONST_CAST(type)
+#endif
extern int execl(const char *pathname, const char *arg, ...);
extern int execlp(const char *file, const char *arg, ...);
@@ -19,25 +25,25 @@ int test_execlpl_ls_al ()
int test_execle_ls_al ()
{
- const char *env[3] = {"FOO=BAR", "BAZ", NULL};
+ char * env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
return execl ("/usr/bin/ls", "ls", "-al", NULL, env);
}
int test_execv_ls_al ()
{
- char *argv[3] = {"ls", "-al", NULL};
+ char * argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
return execv ("/usr/bin/ls", argv);
}
int test_execvp_ls_al ()
{
- char *argv[3] = {"ls", "-al", NULL};
+ char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
return execvp ("ls", argv);
}
int test_execvpe_ls_al ()
{
- char *env[3] = {"FOO=BAR", "BAZ", NULL};
- char *argv[3] = {"ls", "-al", NULL};
+ char *env[3] = {CONST_CAST(char *)("FOO=BAR"), CONST_CAST(char *)("BAZ"), NULL};
+ char *argv[3] = {CONST_CAST(char *)("ls"), CONST_CAST(char *)("-al"), NULL};
return execvpe ("ls", argv, env);
}
similarity index 92%
rename from gcc/testsuite/gcc.dg/analyzer/feasibility-3.c
rename to gcc/testsuite/c-c++-common/analyzer/feasibility-3.c
@@ -4,7 +4,9 @@
/* Types. */
typedef unsigned char u8;
+#ifndef __cplusplus
typedef _Bool bool;
+#endif
typedef unsigned int gfp_t;
struct file;
@@ -67,7 +69,7 @@ static inline bool pde_is_permanent(const struct proc_dir_entry *pde)
static inline struct proc_inode *PROC_I(const struct inode *inode)
{
- void *__mptr = (void *)(inode);
+ char *__mptr = (char *)(inode);
return ((struct proc_inode *)(__mptr - __builtin_offsetof(struct proc_inode, vfs_inode)));
}
@@ -89,8 +91,11 @@ static int proc_reg_open(struct inode *inode, struct file *file)
{
struct proc_dir_entry *pde = PDE(inode);
int rv = 0;
- typeof(((struct proc_ops*)0)->proc_open) open;
- typeof(((struct proc_ops*)0)->proc_release) release;
+
+
+ int (*open)(struct inode *, struct file *);
+ int (*release)(struct inode *, struct file *);
+
struct pde_opener *pdeo;
if (pde_is_permanent(pde)) {
@@ -104,7 +109,7 @@ static int proc_reg_open(struct inode *inode, struct file *file)
release = pde->proc_ops->proc_release;
if (release) {
- pdeo = kmem_cache_alloc(pde_opener_cache,
+ pdeo = (struct pde_opener *) kmem_cache_alloc(pde_opener_cache,
((( gfp_t)(0x400u|0x800u))
| (( gfp_t)0x40u)
| (( gfp_t)0x80u)));
similarity index 92%
rename from gcc/testsuite/gcc.dg/analyzer/fields.c
rename to gcc/testsuite/c-c++-common/analyzer/fields.c
@@ -30,7 +30,7 @@ recvauth_common (int problem)
krb5_error error;
const char *message = error_message(problem);
error.text.length = strlen(message) + 1;
- if (!(error.text.data = malloc(error.text.length))) {
+ if (!(error.text.data = (char *) malloc(error.text.length))) {
goto cleanup;
}
free(error.text.data);
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/function-ptr-5.c
rename to gcc/testsuite/c-c++-common/analyzer/function-ptr-5.c
@@ -1,4 +1,4 @@
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void calling_null_fn_ptr_1 (void)
{
similarity index 98%
rename from gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-1.c
rename to gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-1.c
@@ -3,7 +3,9 @@
/* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
typedef __builtin_va_list va_list;
typedef struct _GQueue GQueue;
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-2.c
rename to gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-2.c
@@ -62,7 +62,7 @@ void test_5 (struct st2 *p)
void test_6 (struct st2 *p)
{
- struct st2 *q = __builtin_malloc (p->i);
+ struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
if (!q)
return;
q->i = p->i;
@@ -72,7 +72,7 @@ void test_6 (struct st2 *p)
void test_7 (struct st2 *p)
{
- struct st2 *q = __builtin_malloc (p->i);
+ struct st2 *q = (struct st2 *) __builtin_malloc (p->i);
q->i = p->i; /* { dg-warning "dereference of possibly-NULL 'q'" } */
test_7 (q);
__builtin_free (q);
similarity index 99%
rename from gcc/testsuite/gcc.dg/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
rename to gcc/testsuite/c-c++-common/analyzer/infinite-recursion-pr108524-qobject-json-parser.c
@@ -3,7 +3,9 @@
/* { dg-additional-options "-fno-analyzer-call-summaries -Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
typedef __builtin_va_list va_list;
typedef __SIZE_TYPE__ size_t;
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/init.c
rename to gcc/testsuite/c-c++-common/analyzer/init.c
@@ -5,7 +5,7 @@
gimple assign stmts, with just "zero-init everything" CONSTRUCTORs
and "clobber" CONSTRUCTORs. */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct coord
{
@@ -95,7 +95,7 @@ void test_9 (void)
void test_10 (void)
{
- struct coord c[2] = {{.y = 4, .x = 3}, {5, 6}};
+ struct coord c[2] = {{.x = 3, .y = 4}, {5, 6}};
__analyzer_eval (c[0].x == 3); /* { dg-warning "TRUE" } */
__analyzer_eval (c[0].y == 4); /* { dg-warning "TRUE" } */
__analyzer_eval (c[1].x == 5); /* { dg-warning "TRUE" } */
similarity index 55%
rename from gcc/testsuite/gcc.dg/analyzer/inlining-3-multiline.c
rename to gcc/testsuite/c-c++-common/analyzer/inlining-3-multiline.c
@@ -4,8 +4,8 @@
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
struct input_file_st
{
@@ -61,4 +61,39 @@ test (const input_file *inpf)
| (4) ...to here
| (5) argument 1 ('<unknown>') NULL where non-null expected
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+
+
+/* { dg-begin-multiline-output "" }
+ return __builtin_strlen (f);
+ ~~~~~~~~~~~~~~~~~^~~
+ 'size_t test(const input_file*)': events 1-2 (depth 1)
+ |
+ | test (const input_file *inpf)
+ | ^~~~
+ | |
+ | (1) entry to 'test'
+ |
+ | const char *f = get_input_file_name (inpf);
+ | ~
+ | |
+ | (2) inlined call to 'get_input_file_name' from 'test'
+ |
+ +--> 'const char* get_input_file_name(const input_file*)': event 3 (depth 2)
+ |
+ | if (inpf)
+ | ^~
+ | |
+ | (3) following 'false' branch (when 'inpf' is NULL)...
+ |
+ <------+
+ |
+ 'size_t test(const input_file*)': events 4-5 (depth 1)
+ |
+ | return __builtin_strlen (f);
+ | ~~~~~~~~~~~~~~~~~^~~
+ | |
+ | (4) ...to here
+ | (5) argument 1 ('<unknown>') NULL where non-null expected
+ |
+ { dg-end-multiline-output "" { target c++ } } */
\ No newline at end of file
similarity index 51%
rename from gcc/testsuite/gcc.dg/analyzer/inlining-3.c
rename to gcc/testsuite/c-c++-common/analyzer/inlining-3.c
@@ -3,8 +3,9 @@
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
struct input_file_st
{
@@ -16,7 +17,9 @@ typedef struct input_file_st input_file;
static inline const char*
get_input_file_name (const input_file *inpf)
{
- if (inpf) /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" } */
+ if (inpf)
+ /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'get_input_file_name', depth 2\\)" "" { target c } .-1 } */
+ /* { dg-message "following 'false' branch \\(when 'inpf' is NULL\\)\\.\\.\\. \\(fndecl 'const char\\* get_input_file_name\\(const input_file\\*\\)', depth 2\\)" "" { target c++ } .-2 } */
return inpf->inpname;
return NULL;
}
@@ -26,5 +29,6 @@ test (const input_file *inpf)
{
const char *f = get_input_file_name (inpf);
return __builtin_strlen (f); /* { dg-warning "use of NULL" "warning" } */
- /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target *-*-* } .-1 } */
+ /* { dg-message "NULL where non-null expected \\(fndecl 'test', depth 1\\)" "message" { target c } .-1 } */
+ /* { dg-message "NULL where non-null expected \\(fndecl 'size_t test\\(const input_file\\*\\)', depth 1\\)" "message" { target c++ } .-2 } */
}
similarity index 54%
rename from gcc/testsuite/gcc.dg/analyzer/inlining-4-multiline.c
rename to gcc/testsuite/c-c++-common/analyzer/inlining-4-multiline.c
@@ -4,7 +4,8 @@
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
static inline const char*
inner (int flag)
@@ -69,4 +70,48 @@ outer (int flag)
| |
| (6) dereference of NULL '<unknown>'
|
- { dg-end-multiline-output "" } */
+ { dg-end-multiline-output "" { target c } } */
+/* { dg-begin-multiline-output "" }
+ return *middle (flag);
+ ^
+ 'char outer(int)': events 1-2 (depth 1)
+ |
+ | outer (int flag)
+ | ^~~~~
+ | |
+ | (1) entry to 'outer'
+ |
+ | return *middle (flag);
+ | ~
+ | |
+ | (2) inlined call to 'middle' from 'outer'
+ |
+ +--> 'const char* middle(int)': event 3 (depth 2)
+ |
+ | return inner (flag);
+ | ^
+ | |
+ | (3) inlined call to 'inner' from 'middle'
+ |
+ +--> 'const char* inner(int)': event 4 (depth 3)
+ |
+ | if (flag)
+ | ^~
+ | |
+ | (4) following 'true' branch (when 'flag != 0')...
+ |
+ <-------------+
+ |
+ 'char outer(int)': event 5 (depth 1)
+ |
+ |cc1plus:
+ | (5): ...to here
+ |
+ 'char outer(int)': event 6 (depth 1)
+ |
+ | return *middle (flag);
+ | ^
+ | |
+ | (6) dereference of NULL '<unknown>'
+ |
+ { dg-end-multiline-output "" { target c++ } } */
similarity index 51%
rename from gcc/testsuite/gcc.dg/analyzer/inlining-4.c
rename to gcc/testsuite/c-c++-common/analyzer/inlining-4.c
@@ -3,12 +3,14 @@
/* { dg-additional-options "-O2 -fdiagnostics-show-path-depths" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
static inline const char*
inner (int flag)
{
- if (flag) /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" } */
+ if (flag)
+ /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'inner', depth 3\\)" "" { target c } .-1 } */
+ /* { dg-message "following 'true' branch \\(when 'flag != 0'\\)\\.\\.\\. \\(fndecl 'const char\\* inner\\(int\\)', depth 3\\)" "" { target c++ } .-2 } */
return NULL;
return "foo";
}
@@ -23,5 +25,6 @@ char
outer (int flag)
{
return *middle (flag); /* { dg-warning "dereference of NULL" "warning" } */
- /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target *-*-* } .-1 } */
+ /* { dg-message "\\(fndecl 'outer', depth 1\\)" "message" { target c } .-1 } */
+ /* { dg-message "\\(fndecl 'char outer\\(int\\)', depth 1\\)" "message" { target c++ } .-2 } */
}
similarity index 81%
rename from gcc/testsuite/gcc.dg/analyzer/leak-pr105906.c
rename to gcc/testsuite/c-c++-common/analyzer/leak-pr105906.c
@@ -1,6 +1,7 @@
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
#define LEN 64
@@ -13,7 +14,7 @@ epystr_explode(const char *delim, char *str)
if (str == NULL || delim == NULL)
return NULL;
- out = __builtin_malloc(LEN * sizeof(char *));
+ out = (char **) __builtin_malloc(LEN * sizeof(char *));
if (out == NULL)
return NULL;
similarity index 87%
rename from gcc/testsuite/gcc.dg/analyzer/leak-pr108045-with-call-summaries.c
rename to gcc/testsuite/c-c++-common/analyzer/leak-pr108045-with-call-summaries.c
@@ -1,7 +1,7 @@
/* { dg-additional-options "-fanalyzer-call-summaries" } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* data structures */
@@ -31,7 +31,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
{
struct screen_s *result = NULL;
- result = __builtin_calloc(1, sizeof(*result));
+ result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
if (!result)
return NULL;
@@ -39,7 +39,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
result->rows = rows;
/* make one allocation which will be accessed like a 2D array */
- result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
+ result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
if (!result->data) {
__builtin_free(result);
return NULL;
@@ -91,7 +91,7 @@ void resize_screen(size_t cols, size_t rows)
int main(void)
{
- ctx = __builtin_calloc(1, sizeof(*ctx));
+ ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
if (!ctx)
__builtin_abort();
similarity index 87%
rename from gcc/testsuite/gcc.dg/analyzer/leak-pr108045-without-call-summaries.c
rename to gcc/testsuite/c-c++-common/analyzer/leak-pr108045-without-call-summaries.c
@@ -2,7 +2,7 @@
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* data structures */
@@ -32,7 +32,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
{
struct screen_s *result = NULL;
- result = __builtin_calloc(1, sizeof(*result));
+ result = (struct screen_s *) __builtin_calloc(1, sizeof(*result));
if (!result)
return NULL;
@@ -40,7 +40,7 @@ struct screen_s *screen_create(size_t cols, size_t rows)
result->rows = rows;
/* make one allocation which will be accessed like a 2D array */
- result->data = __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
+ result->data = (char **) __builtin_calloc(rows, sizeof(result->data) + sizeof(*result->data) * cols);
if (!result->data) {
__builtin_free(result);
return NULL;
@@ -92,7 +92,7 @@ void resize_screen(size_t cols, size_t rows)
int main(void)
{
- ctx = __builtin_calloc(1, sizeof(*ctx));
+ ctx = (struct context_s *) __builtin_calloc(1, sizeof(*ctx));
if (!ctx)
__builtin_abort();
similarity index 93%
rename from gcc/testsuite/gcc.dg/analyzer/leak-pr109059-1.c
rename to gcc/testsuite/c-c++-common/analyzer/leak-pr109059-1.c
@@ -27,7 +27,7 @@ cfg_register_postparser(char* name, int (*func)())
{
struct cfg_postparser* cp;
- cp = calloc(1, sizeof(*cp));
+ cp = (struct cfg_postparser *) calloc(1, sizeof(*cp));
if (!cp) {
/* [...snip...] */
return 0;
similarity index 92%
rename from gcc/testsuite/gcc.dg/analyzer/leak-pr109059-2.c
rename to gcc/testsuite/c-c++-common/analyzer/leak-pr109059-2.c
@@ -26,7 +26,7 @@ test_1 (char* name)
{
struct cfg_postparser* cp;
- cp = calloc(1, sizeof(*cp));
+ cp = (struct cfg_postparser*) calloc(1, sizeof(*cp));
if (!cp) {
/* [...snip...] */
return 0;
similarity index 89%
rename from gcc/testsuite/gcc.dg/analyzer/malloc-2.c
rename to gcc/testsuite/c-c++-common/analyzer/malloc-2.c
@@ -16,7 +16,7 @@ void test_1 (void)
int *test_2 (void)
{
- int *i = malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
+ int *i = (int *) malloc (sizeof (int)); /* { dg-message "\\(1\\) this call could return NULL" } */
*i = 42; /* { dg-warning "dereference of possibly-NULL 'i'" "warning" } */
/* { dg-message "\\(2\\) 'i' could be NULL: unchecked value from \\(1\\)" "event" { target *-*-* } .-1 } */
return i;
similarity index 79%
rename from gcc/testsuite/gcc.dg/analyzer/memcpy-2.c
rename to gcc/testsuite/c-c++-common/analyzer/memcpy-2.c
@@ -1,8 +1,9 @@
/* { dg-additional-options "-Wno-stringop-overflow -Wno-analyzer-out-of-bounds" } */
-void
-main (int c, void *v)
+int
+test (int c, void *v)
{
static char a[] = "";
__builtin_memcpy (v, a, -1);
+ return 0;
}
similarity index 93%
rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early-O2.c
@@ -61,12 +61,12 @@ static inline enum obj_type obj_type(const enum obj_type *t)
}
static inline struct connection *__objt_conn(enum obj_type *t)
{
- return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
+ return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
}
static inline struct connection *objt_conn(enum obj_type *t)
{
if (!t || *t != OBJ_TYPE_CONN)
- return ((void *)0);
+ return (struct connection *)((void *)0);
return __objt_conn(t);
}
struct session {
@@ -80,7 +80,7 @@ SSL *ssl_sock_get_ssl_object(struct connection *conn);
/*****************************************************************************/
int
-smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
+smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
{
SSL *ssl;
struct connection *conn;
similarity index 93%
rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c
@@ -60,12 +60,12 @@ static inline enum obj_type obj_type(const enum obj_type *t)
}
static inline struct connection *__objt_conn(enum obj_type *t)
{
- return ((struct connection *)(((void *)(t)) - ((long)&((struct connection *)0)->obj_type)));
+ return ((struct connection *)(((char *)(t)) - ((long)&((struct connection *)0)->obj_type)));
}
static inline struct connection *objt_conn(enum obj_type *t)
{
if (!t || *t != OBJ_TYPE_CONN)
- return ((void *)0);
+ return (struct connection *) ((void *)0);
return __objt_conn(t);
}
struct session {
@@ -79,7 +79,7 @@ SSL *ssl_sock_get_ssl_object(struct connection *conn);
/*****************************************************************************/
int
-smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private)
+smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *Private)
{
SSL *ssl;
struct connection *conn;
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108806-qemu.c
rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108806-qemu.c
@@ -1,6 +1,6 @@
/* Reduced from qemu-7.2.0's hw/intc/omap_intc.c */
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef unsigned char __uint8_t;
typedef unsigned int __uint32_t;
similarity index 92%
rename from gcc/testsuite/gcc.dg/analyzer/null-deref-pr108830.c
rename to gcc/testsuite/c-c++-common/analyzer/null-deref-pr108830.c
@@ -2,7 +2,7 @@
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
-#define NULL ((void*)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
@@ -43,7 +43,7 @@ struct apr_hash_t
static apr_hash_entry_t**
alloc_array(apr_hash_t* ht, unsigned int max)
{
- return memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
+ return (apr_hash_entry_t **) memset(apr_palloc(ht->pool, sizeof(*ht->array) * (max + 1)),
0,
sizeof(*ht->array) * (max + 1));
}
@@ -57,7 +57,7 @@ apr_hash_merge(apr_pool_t* p,
apr_hash_entry_t* new_vals = NULL;
apr_hash_entry_t* iter;
unsigned int i, j, k;
- res = apr_palloc(p, sizeof(apr_hash_t));
+ res = (apr_hash_t *) apr_palloc(p, sizeof(apr_hash_t));
res->pool = p;
res->free = NULL;
res->hash_func = base->hash_func;
@@ -69,7 +69,7 @@ apr_hash_merge(apr_pool_t* p,
res->seed = base->seed;
res->array = alloc_array(res, res->max);
if (base->count + overlay->count) {
- new_vals =
+ new_vals = (apr_hash_entry_t *)
apr_palloc(p, sizeof(apr_hash_entry_t) * (base->count + overlay->count));
}
j = 0;
similarity index 95%
rename from gcc/testsuite/gcc.dg/analyzer/pr101962.c
rename to gcc/testsuite/c-c++-common/analyzer/pr101962.c
@@ -1,6 +1,5 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
-#define NULL ((void *)0)
/* Verify that the analyzer makes the simplifying assumption that we don't
hit NULL when incrementing pointers to non-NULL memory regions. */
@@ -35,7 +34,7 @@ maybe_inc_char_ptr (const char *ptr)
return ++ptr;
}
-char
+void
test_s (void)
{
const char *msg = "hello world";
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/pr103217-2.c
rename to gcc/testsuite/c-c++-common/analyzer/pr103217-2.c
@@ -30,7 +30,7 @@ struct test {
};
int main(int argc, char *argv[]) {
- struct test *options = calloc(1, sizeof(*options));
+ struct test *options = (struct test *) calloc(1, sizeof(*options));
int rc;
if (!options)
abort();
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/pr103217.c
rename to gcc/testsuite/c-c++-common/analyzer/pr103217.c
@@ -13,7 +13,7 @@ extern char *optarg;
extern void free (void *__ptr)
__attribute__ ((__nothrow__ , __leaf__));
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
char *xstrdup(const char *src) {
char *val = strdup(src);
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/pr104029.c
rename to gcc/testsuite/c-c++-common/analyzer/pr104029.c
@@ -23,7 +23,7 @@ int heapsort(void *vbase, size_t nmemb, size_t size, t_compfunc compar) {
return (-1);
}
- k = my_malloc1(__FILE__, __LINE__, size);
+ k = (char *) my_malloc1(__FILE__, __LINE__, size);
abase = (char *)vbase - size;
similarity index 70%
rename from gcc/testsuite/gcc.dg/analyzer/pr104062.c
rename to gcc/testsuite/c-c++-common/analyzer/pr104062.c
@@ -7,7 +7,7 @@ realloc (void *, __SIZE_TYPE__);
void
foo (void)
{
- int *ap5 = calloc (4, sizeof *ap5);
- int *ap7 = realloc (ap5, sizeof *ap5);
+ int *ap5 = (int *) calloc (4, sizeof *ap5);
+ int *ap7 = (int *) realloc (ap5, sizeof *ap5);
} /* { dg-warning "leak of 'ap5'" "leak of ap5" } */
/* { dg-warning "leak of 'ap7'" "leak of ap7" { target *-*-* } .-1 } */
similarity index 85%
rename from gcc/testsuite/gcc.dg/analyzer/pr105783.c
rename to gcc/testsuite/c-c++-common/analyzer/pr105783.c
@@ -1,11 +1,15 @@
/* { dg-additional-options "-O" } */
+#ifndef __cplusplus
+typedef _Bool bool;
+#endif
+
struct ss_s {
union out_or_counting_u {
char *newstr;
unsigned long long cnt;
} uu;
- _Bool counting;
+ bool counting;
};
struct ss_s ss_init(void) {
similarity index 73%
rename from gcc/testsuite/gcc.dg/analyzer/pr107345.c
rename to gcc/testsuite/c-c++-common/analyzer/pr107345.c
@@ -9,7 +9,8 @@ int main() {
int g = 0;
int *h[2][1];
h[1][0] = f;
- if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" } */
+ if (g == (h[1][0])) { /* { dg-warning "comparison between pointer and integer" "" { target c } } */
+ /* { dg-error "ISO C\\+\\+ forbids comparison between pointer and integer" "" { target c++ } .-1 } */
unsigned int *i = 0;
}
printf("NPD_FLAG: %d\n ", *f);
new file mode 100644
@@ -0,0 +1,3 @@
+/* { dg-additional-options "-Wno-int-conversion" } */
+/* { dg-skip-if "-Wno-int-conversion for C++" { c++ } } */
+#include "../../gcc.dg/pr61861.c"
new file mode 100644
@@ -0,0 +1,12 @@
+/* { dg-do compile } */
+
+void
+p5 (const void *);
+
+void
+s5 (const void *cl)
+{
+ p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" "" { target c } } */
+ /* { dg-warning "pointer of type 'void \\*' used in arithmetic" "" { target c++ } .-1 } */
+ /* { dg-error "'const void\\*' is not a pointer-to-object type" "" { target c++ } .-2 } */
+}
similarity index 83%
rename from gcc/testsuite/gcc.dg/analyzer/pr93695-1.c
rename to gcc/testsuite/c-c++-common/analyzer/pr93695-1.c
@@ -11,7 +11,7 @@ test_1 (void)
int i;
for (i = 0; i < ARRAY_SIZE (p); ++i)
- p[i] = __builtin_malloc (sizeof (i));
+ p[i] = (int *) __builtin_malloc (sizeof (i));
for (i = 0; i < ARRAY_SIZE (p); ++i)
__builtin_free (p [i]);
@@ -28,7 +28,7 @@ test_2 (int n)
return;
for (i = 0; i < n; ++i)
- p[i] = __builtin_malloc (sizeof (i));
+ p[i] = (int *) __builtin_malloc (sizeof (i));
for (i = 0; i < n; ++i)
__builtin_free (p [i]);
@@ -41,7 +41,7 @@ test_3 (int **p, int n)
{
int i;
for (i = 0; i < n; ++i)
- p[i] = __builtin_malloc (sizeof (i));
+ p[i] = (int *) __builtin_malloc (sizeof (i));
}
void
similarity index 92%
rename from gcc/testsuite/gcc.dg/analyzer/pr94596.c
rename to gcc/testsuite/c-c++-common/analyzer/pr94596.c
@@ -16,15 +16,18 @@
* limitations under the License.
*/
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+
+#ifndef __cplusplus
#define false 0
+#endif
#define OBJECT_OFFSETOF(OBJECT, MEMBER)\
- __builtin_offsetof(typeof(*(OBJECT)), MEMBER)
+ __builtin_offsetof(struct zone_limit, MEMBER)
#define OBJECT_CONTAINING(POINTER, OBJECT, MEMBER) \
- ((typeof(OBJECT)) (void *) \
+ ((struct zone_limit *) (void *) \
((char *) (POINTER) - OBJECT_OFFSETOF(OBJECT, MEMBER)))
#define ASSIGN_CONTAINER(OBJECT, POINTER, MEMBER) \
similarity index 82%
rename from gcc/testsuite/gcc.dg/analyzer/pr94839.c
rename to gcc/testsuite/c-c++-common/analyzer/pr94839.c
@@ -13,7 +13,7 @@ int bitmap_create(struct bitmap *bm, int min, int max)
bm->min = min;
bm->max = max;
- bm->vec = __builtin_calloc(sz, sizeof(int));
+ bm->vec = (int *) __builtin_calloc(sz, sizeof(int));
if (!bm->vec)
return (-12);
return 0; /* { dg-bogus "leak" } */
similarity index 55%
rename from gcc/testsuite/gcc.dg/analyzer/pr95152-4.c
rename to gcc/testsuite/c-c++-common/analyzer/pr95152-4.c
@@ -1,4 +1,6 @@
+/* { dg-skip-if "'-Wno-pointer-to-int-cast' invalid for C++" { c++ } } */
/* { dg-additional-options "-Wno-pointer-to-int-cast" } */
+
extern void my_func (int);
typedef struct {
int var;
@@ -6,6 +8,6 @@ typedef struct {
extern void *_data_offs;
void test()
{
- info_t *info = ((void *)((void *)1) + ((unsigned int)&_data_offs));
+ info_t *info = (info_t *) ((void *)((void *)1) + ((unsigned int)&_data_offs));
my_func(info->var == 0);
}
similarity index 61%
rename from gcc/testsuite/gcc.dg/analyzer/pr95152-5.c
rename to gcc/testsuite/c-c++-common/analyzer/pr95152-5.c
@@ -1,3 +1,4 @@
+/* { dg-skip-if "'-Wno-incompatible-pointer-types' invalid for C++" { c++ } } */
/* { dg-additional-options "-Wno-incompatible-pointer-types" } */
void foo(void)
{
similarity index 89%
rename from gcc/testsuite/gcc.dg/analyzer/pr95240.c
rename to gcc/testsuite/c-c++-common/analyzer/pr95240.c
@@ -8,7 +8,7 @@ static char *activeTroubleArray;
int
initActiveTroubleArray ()
{
- activeTroubleArray = calloc (1, 1);
+ activeTroubleArray = (char *) calloc (1, 1);
return activeTroubleArray ? 0 : 1;
}
similarity index 80%
rename from gcc/testsuite/gcc.dg/analyzer/pr96639.c
rename to gcc/testsuite/c-c++-common/analyzer/pr96639.c
@@ -3,7 +3,7 @@ void *calloc (__SIZE_TYPE__, __SIZE_TYPE__);
int
x7 (void)
{
- int **md = calloc (1, sizeof (void *));
+ int **md = (int **) calloc (1, sizeof (void *));
return md[0][0]; /* { dg-warning "possibly-NULL" "unchecked deref" } */
/* { dg-warning "leak of 'md'" "leak" { target *-*-* } .-1 } */
similarity index 98%
rename from gcc/testsuite/gcc.dg/analyzer/pr96653.c
rename to gcc/testsuite/c-c++-common/analyzer/pr96653.c
@@ -753,7 +753,7 @@ const char *v4l2_ctrl_get_name(u32 id) {
case ((0x00a30000 | 0x900) + 4):
return "MD Region Grid";
default:
- return ((void *)0);
+ return (const char *) ((void *)0);
}
}
@@ -989,40 +989,40 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type,
*type = V4L2_CTRL_TYPE_U32;
break;
case ((0x00990000 | 0x900) + 250):
- *type = 0x0103;
+ *type = (enum v4l2_ctrl_type) 0x0103;
break;
case ((0x00990000 | 0x900) + 251):
- *type = 0x0104;
+ *type = (enum v4l2_ctrl_type) 0x0104;
break;
case ((0x00990000 | 0x900) + 292):
- *type = 0x0105;
+ *type = (enum v4l2_ctrl_type) 0x0105;
break;
case ((0x00990000 | 0x900) + 1000):
- *type = 0x0110;
+ *type = (enum v4l2_ctrl_type) 0x0110;
break;
case ((0x00990000 | 0x900) + 1001):
- *type = 0x0111;
+ *type = (enum v4l2_ctrl_type) 0x0111;
break;
case ((0x00990000 | 0x900) + 1002):
- *type = 0x0112;
+ *type = (enum v4l2_ctrl_type) 0x0112;
break;
case ((0x00990000 | 0x900) + 1003):
- *type = 0x0113;
+ *type = (enum v4l2_ctrl_type) 0x0113;
break;
case ((0x00990000 | 0x900) + 1004):
- *type = 0x0114;
+ *type = (enum v4l2_ctrl_type) 0x0114;
break;
case ((0x00990000 | 0x900) + 2000):
- *type = 0x301;
+ *type = (enum v4l2_ctrl_type) 0x301;
break;
case ((0x00990000 | 0x900) + 1008):
- *type = 0x0120;
+ *type = (enum v4l2_ctrl_type) 0x0120;
break;
case ((0x00990000 | 0x900) + 1009):
- *type = 0x0121;
+ *type = (enum v4l2_ctrl_type) 0x0121;
break;
case ((0x00990000 | 0x900) + 1010):
- *type = 0x0122;
+ *type = (enum v4l2_ctrl_type) 0x0122;
break;
case ((0x009e0000 | 0x900) + 8):
*type = V4L2_CTRL_TYPE_AREA;
similarity index 93%
rename from gcc/testsuite/gcc.dg/analyzer/pr96792.c
rename to gcc/testsuite/c-c++-common/analyzer/pr96792.c
@@ -1,4 +1,4 @@
-#define NULL (void *)0
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct block
{
similarity index 89%
rename from gcc/testsuite/gcc.dg/analyzer/pr96841.c
rename to gcc/testsuite/c-c++-common/analyzer/pr96841.c
@@ -1,4 +1,4 @@
-/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch" } */
+/* { dg-additional-options "-O1 -Wno-builtin-declaration-mismatch -Wno-analyzer-too-complex" } */
int
l8 (void);
new file mode 100644
@@ -0,0 +1,31 @@
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+
+extern int *const p1;
+
+int *const p2 = NULL;
+
+int v3;
+extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" "C FE warning" { target c } } */
+
+int v4;
+int *const p4 = &v4;
+
+int main (void)
+{
+ __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" "" { target c } } */
+ /* { dg-message "INIT_VAL\\(int\\* const p1\\)" "" { target c++ } .-1 } */
+ __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
+
+ __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
+
+ __analyzer_describe (0, p3); /* { dg-message "&v3" "" { target c } } */
+ /* { dg-message "&int v3" "" { target c++ } .-1 } */
+ __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
+
+ __analyzer_describe (0, p4); /* { dg-message "&v4" "" { target c } } */
+ /* { dg-message "&int v4" "" { target c++ } .-1 } */
+ __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
+
+ return p1[0];
+}
similarity index 59%
rename from gcc/testsuite/gcc.dg/analyzer/pr98564.c
rename to gcc/testsuite/c-c++-common/analyzer/pr98564.c
@@ -2,5 +2,5 @@ void *calloc (__SIZE_TYPE__, __SIZE_TYPE__);
void test_1 (void)
{
- int *p = calloc (0, 1); /* { dg-message "allocated here" } */
+ int *p = (int *) calloc (0, 1); /* { dg-message "allocated here" } */
} /* { dg-warning "leak of 'p'" } */
similarity index 100%
rename from gcc/testsuite/gcc.dg/analyzer/pr98628.c
rename to gcc/testsuite/c-c++-common/analyzer/pr98628.c
@@ -1,12 +1,12 @@
/* { dg-additional-options "-O1" } */
void foo(void *);
-struct chanset_t help_subst_chan;
-struct chanset_t *help_subst_chan_0_0;
struct chanset_t {
struct chanset_t *next;
char dname[];
};
+struct chanset_t help_subst_chan;
+struct chanset_t *help_subst_chan_0_0;
void help_subst(char *writeidx) {
for (;; help_subst_chan = *help_subst_chan_0_0) {
foo(help_subst_chan.next->dname);
similarity index 61%
rename from gcc/testsuite/gcc.dg/analyzer/pr98969.c
rename to gcc/testsuite/c-c++-common/analyzer/pr98969.c
@@ -7,14 +7,15 @@ void
test_1 (__UINTPTR_TYPE__ i)
{
struct foo *f = (struct foo *)i;
- f->expr = __builtin_malloc (1024);
+ f->expr = (char *) __builtin_malloc (1024);
} /* { dg-bogus "leak" } */
void
test_2 (__UINTPTR_TYPE__ i)
{
__builtin_free (((struct foo *)i)->expr);
- __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" } */
+ __builtin_free (((struct foo *)i)->expr); /* { dg-warning "double-'free' of '\\*\\(\\(struct foo \\*\\)i\\)\\.expr'" "" { target c } } */
+ /* { dg-warning "double-'free' of '\\*\\(\\(foo\\*\\)i\\)\\.foo::expr'" "" { target c++ } .-1 } */
}
void
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/pr99193-2.c
rename to gcc/testsuite/c-c++-common/analyzer/pr99193-2.c
@@ -56,7 +56,7 @@ make_display_name (struct drv *drvs)
ret = single_drive_display_name (drvs);
len = __builtin_strlen (ret);
- ret = realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
+ ret = (char *) realloc (ret, len + pluses + 1); /* { dg-bogus "'free'" } */
if (ret == NULL)
error (EXIT_FAILURE, errno, "realloc");
for (i = len; i < len + pluses; ++i)
similarity index 91%
rename from gcc/testsuite/gcc.dg/analyzer/pr99193-3.c
rename to gcc/testsuite/c-c++-common/analyzer/pr99193-3.c
@@ -8,7 +8,7 @@
typedef __SIZE_TYPE__ size_t;
typedef __builtin_va_list va_list;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern void free (void *);
extern void *realloc (void *__ptr, size_t __size)
@@ -35,7 +35,7 @@ debug_help (const char **cmds, size_t argc, char *const *const argv)
len = __builtin_strlen (r);
for (i = 0; cmds[i] != NULL; ++i) {
len += __builtin_strlen (cmds[i]) + 1;
- p = realloc (r, len + 1); /* { dg-bogus "'free'" } */
+ p = (char *) realloc (r, len + 1); /* { dg-bogus "'free'" } */
if (p == NULL) {
free (r);
return NULL;
similarity index 93%
rename from gcc/testsuite/gcc.dg/analyzer/pr99716-1.c
rename to gcc/testsuite/c-c++-common/analyzer/pr99716-1.c
@@ -4,7 +4,8 @@ FILE* fopen (const char*, const char*);
int fclose (FILE*);
int fprintf (FILE *, const char *, ...);
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
void
test_1 (void)
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/pr99774-1.c
rename to gcc/testsuite/c-c++-common/analyzer/pr99774-1.c
@@ -42,7 +42,7 @@ int vu_check_queue_inflights(VuVirtq *vq) {
int i = 0;
if (vq->inuse) {
- vq->resubmit_list = calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
+ vq->resubmit_list = (VuVirtqInflightDesc *) calloc(vq->inuse, sizeof(VuVirtqInflightDesc));
if (!vq->resubmit_list) {
return -1;
}
similarity index 84%
rename from gcc/testsuite/gcc.dg/analyzer/realloc-1.c
rename to gcc/testsuite/c-c++-common/analyzer/realloc-1.c
@@ -20,14 +20,14 @@ void *test_1 (void *ptr)
return realloc (ptr, 1024);
}
-void *test_2 (void *ptr)
+void test_2 (void *ptr)
{
void *p = malloc (1024); /* { dg-message "allocated here" } */
p = realloc (p, 4096); /* { dg-message "when 'realloc' fails" } */
free (p);
} /* { dg-warning "leak of 'p'" } */ // ideally this would be on the realloc stmt
-void *test_3 (void *ptr)
+void test_3 (void *ptr)
{
void *p = malloc (1024);
void *q = realloc (p, 4096);
@@ -45,7 +45,7 @@ void *test_4 (void)
int *test_5 (int *p)
{
*p = 42;
- int *q = realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
+ int *q = (int *) realloc (p, sizeof(int) * 4); /* { dg-message "when 'realloc' fails" } */
*q = 43; /* { dg-warning "dereference of NULL 'q'" } */
return q;
}
@@ -60,7 +60,7 @@ void test_6 (size_t sz)
void *test_7 (size_t sz)
{
char buf[100]; /* { dg-message "region created on stack here" } */
- void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '&buf' which points to memory on the stack" } */
+ void *p = realloc (&buf, sz); /* { dg-warning "'realloc' of '& ?buf' which points to memory on the stack" } */
return p;
}
@@ -91,5 +91,6 @@ void test_9 (void *p)
void test_10 (char *s, int n)
{
- __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" } */
+ __builtin_realloc(s, n); /* { dg-warning "ignoring return value of '__builtin_realloc' declared with attribute 'warn_unused_result'" "" { target c } } */
+ /* { dg-warning "ignoring return value of 'void\\* __builtin_realloc\\(void\\*, (long )?unsigned int\\)' declared with attribute 'warn_unused_result'" "" { target c++ } .-1 } */
} /* { dg-warning "leak" } */
similarity index 95%
rename from gcc/testsuite/gcc.dg/analyzer/realloc-2.c
rename to gcc/testsuite/c-c++-common/analyzer/realloc-2.c
@@ -1,11 +1,9 @@
/* { dg-additional-options "-fno-analyzer-suppress-followups" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
-
extern void *malloc (size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
__attribute__ ((__malloc__))
@@ -21,7 +19,7 @@ char *test_8 (size_t sz)
{
char *p, *q;
- p = malloc (3);
+ p = (char *) malloc (3);
if (!p)
return NULL;
@@ -35,7 +33,7 @@ char *test_8 (size_t sz)
__analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
__analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
- q = realloc (p, 6);
+ q = (char *) realloc (p, 6);
/* We should have 3 nodes, corresponding to "failure",
"success without moving", and "success with moving". */
similarity index 96%
rename from gcc/testsuite/gcc.dg/analyzer/realloc-3.c
rename to gcc/testsuite/c-c++-common/analyzer/realloc-3.c
@@ -1,10 +1,9 @@
/* { dg-additional-options "-fno-analyzer-suppress-followups" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
extern void *calloc (size_t __nmemb, size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
@@ -27,7 +26,7 @@ char *test_8 (size_t sz)
{
char *p, *q;
- p = calloc (1, 3);
+ p = (char *) calloc (1, 3);
if (!p)
return NULL;
@@ -37,7 +36,7 @@ char *test_8 (size_t sz)
__analyzer_eval (p[1] == 0); /* { dg-warning "TRUE" } */
__analyzer_eval (p[2] == 0); /* { dg-warning "TRUE" } */
- q = realloc (p, 6);
+ q = (char *) realloc (p, 6);
/* We should have 3 nodes, corresponding to "failure",
"success without moving", and "success with moving". */
similarity index 97%
rename from gcc/testsuite/gcc.dg/analyzer/realloc-4.c
rename to gcc/testsuite/c-c++-common/analyzer/realloc-4.c
@@ -1,8 +1,7 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
extern void *calloc (size_t __nmemb, size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
@@ -34,7 +33,7 @@ char *test_8 (char *p, size_t sz)
__analyzer_eval (p[1] == 'b'); /* { dg-warning "TRUE" } */
__analyzer_eval (p[2] == 'c'); /* { dg-warning "TRUE" } */
- q = realloc (p, 6);
+ q = (char *) realloc (p, 6);
/* We should have 3 nodes, corresponding to "failure",
"success without moving", and "success with moving". */
similarity index 90%
rename from gcc/testsuite/gcc.dg/analyzer/realloc-5.c
rename to gcc/testsuite/c-c++-common/analyzer/realloc-5.c
@@ -1,10 +1,9 @@
/* { dg-additional-options "-fno-analyzer-suppress-followups" } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
extern void *malloc (size_t __size)
__attribute__ ((__nothrow__ , __leaf__))
@@ -22,12 +21,12 @@ extern void *memset (void *__ptr, int __value, size_t __size);
void test_1 ()
{
- char *p = malloc (16);
+ char *p = (char *) malloc (16);
if (!p)
return;
memset (p, 1, 16);
- char *q = realloc (p, 8);
+ char *q = (char *) realloc (p, 8);
if (!q)
{
free (p);
similarity index 70%
rename from gcc/testsuite/gcc.dg/analyzer/realloc-pr110014.c
rename to gcc/testsuite/c-c++-common/analyzer/realloc-pr110014.c
@@ -8,18 +8,18 @@ slurp (long *buffer, unsigned long file_size)
unsigned long cc;
if (!__builtin_add_overflow (file_size - file_size % sizeof (long),
2 * sizeof (long), &cc))
- buffer = realloc (buffer, cc);
+ buffer = (long *) realloc (buffer, cc);
return buffer;
}
long *
slurp1 (long *buffer, unsigned long file_size)
{
- return realloc (buffer, file_size - file_size % sizeof (long));
+ return (long *) realloc (buffer, file_size - file_size % sizeof (long));
}
long *
slurp2 (long *buffer, unsigned long file_size)
{
- return realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
+ return (long *) realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
}
similarity index 81%
rename from gcc/testsuite/gcc.dg/analyzer/snprintf-concat.c
rename to gcc/testsuite/c-c++-common/analyzer/snprintf-concat.c
@@ -1,5 +1,5 @@
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern size_t
strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
@@ -17,7 +17,7 @@ char *
test_1 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz);
+ char *p = (char *) malloc (sz);
if (!p)
return NULL;
snprintf (p, sz, "%s/%s", a, b);
@@ -28,7 +28,7 @@ void
test_2 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
+ char *p = (char *) malloc (sz); /* { dg-message "allocated here" "PR 107017" { xfail *-*-* } } */
if (!p)
return;
snprintf (p, sz, "%s/%s", a, b); /* { dg-warning "leak of 'p'" "PR 107017" { xfail *-*-* } } */
similarity index 91%
rename from gcc/testsuite/gcc.dg/analyzer/sock-1.c
rename to gcc/testsuite/c-c++-common/analyzer/sock-1.c
@@ -5,7 +5,9 @@ typedef __u32 u32;
typedef __s64 s64;
typedef __u64 u64;
typedef long long __kernel_time64_t;
+#ifndef __cplusplus
typedef _Bool bool;
+#endif
typedef __s64 time64_t;
struct __kernel_timespec {
__kernel_time64_t tv_sec;
@@ -76,12 +78,12 @@ struct sock {
static ktime_t sock_read_timestamp(struct sock *sk)
{
- return *(const volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp);
+ return *(const volatile ktime_t *)&(sk->sk_stamp);
}
static void sock_write_timestamp(struct sock *sk, ktime_t kt)
{
- *(volatile typeof(sk->sk_stamp) *)&(sk->sk_stamp) = kt;
+ *(volatile ktime_t *)&(sk->sk_stamp) = kt;
}
/* [...snip...] */
@@ -108,5 +110,5 @@ int sock_gettstamp(struct socket *sock, void *userstamp,
if (time32)
return put_old_timespec32(&ts, userstamp);
- return put_timespec64(&ts, userstamp);
+ return put_timespec64(&ts, (struct __kernel_timespec *) userstamp);
}
new file mode 100644
@@ -0,0 +1,59 @@
+/* See e.g. https://en.cppreference.com/w/c/io/fprintf
+ and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
+
+extern int
+sprintf(char* dst, const char* fmt, ...)
+ __attribute__((__nothrow__));
+
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
+int
+test_passthrough (char* dst, const char* fmt)
+{
+ /* This assumes that fmt doesn't have any arguments. */
+ return sprintf (dst, fmt);
+}
+
+void
+test_known (void)
+{
+ char buf[10];
+ int res = sprintf (buf, "foo");
+ /* TODO: ideally we would know the value of "res" is 3,
+ and known the content and strlen of "buf" after the call */
+}
+
+int
+test_null_dst (void)
+{
+ return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
+}
+
+int
+test_null_fmt (char *dst)
+{
+ return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */
+}
+
+int
+test_uninit_dst (void)
+{
+ char *dst;
+ return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
+}
+
+int
+test_uninit_fmt_ptr (char *dst)
+{
+ const char *fmt;
+ return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
+}
+
+void
+test_strlen_1 (void)
+{
+ char buf[10];
+ sprintf (buf, "msg: %s\n", "abc");
+ __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
+ // TODO: ideally would be TRUE
+}
similarity index 82%
rename from gcc/testsuite/gcc.dg/analyzer/sprintf-concat.c
rename to gcc/testsuite/c-c++-common/analyzer/sprintf-concat.c
@@ -1,5 +1,5 @@
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
extern size_t
strlen(const char* __s) __attribute__((__nothrow__, __leaf__))
@@ -17,7 +17,7 @@ char *
test_1 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz);
+ char *p = (char *) malloc (sz);
if (!p)
return NULL;
sprintf (p, "%s/%s", a, b);
@@ -28,7 +28,7 @@ void
test_2 (const char *a, const char *b)
{
size_t sz = strlen (a) + strlen (b) + 2;
- char *p = malloc (sz); /* { dg-message "allocated here" } */
+ char *p = (char *) malloc (sz); /* { dg-message "allocated here" } */
if (!p)
return;
sprintf (p, "%s/%s", a, b); /* { dg-warning "leak of 'p' " } */
similarity index 83%
rename from gcc/testsuite/gcc.dg/analyzer/string-ops-concat-pair.c
rename to gcc/testsuite/c-c++-common/analyzer/string-ops-concat-pair.c
@@ -1,5 +1,5 @@
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* Concatenating a pair of strings. */
@@ -9,7 +9,7 @@ char *
alloc_dup_of_concatenated_pair_1_correct (const char *x, const char *y)
{
size_t sz = __builtin_strlen (x) + __builtin_strlen (y) + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
@@ -25,7 +25,7 @@ alloc_dup_of_concatenated_pair_1_incorrect (const char *x, const char *y)
{
/* Forgetting to add space for the terminator here. */
size_t sz = __builtin_strlen (x) + __builtin_strlen (y);
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
@@ -42,7 +42,7 @@ alloc_dup_of_concatenated_pair_2_correct (const char *x, const char *y)
size_t len_x = __builtin_strlen (x);
size_t len_y = __builtin_strlen (y);
size_t sz = len_x + len_y + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
@@ -57,7 +57,8 @@ alloc_dup_of_concatenated_pair_2_incorrect (const char *x, const char *y)
size_t len_x = __builtin_strlen (x);
size_t len_y = __builtin_strlen (y);
size_t sz = len_x + len_y; /* Forgetting to add space for the terminator. */
- char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" } */
+ char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x \\+ len_y' bytes" "" { target c } } */
+ /* { dg-message "capacity: '\\(len_x \\+ len_y\\)' bytes" "" { target c++ } .-1 } */
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
similarity index 83%
rename from gcc/testsuite/gcc.dg/analyzer/string-ops-dup.c
rename to gcc/testsuite/c-c++-common/analyzer/string-ops-dup.c
@@ -1,5 +1,5 @@
typedef __SIZE_TYPE__ size_t;
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
/* Duplicating a string. */
@@ -9,7 +9,7 @@ char *
alloc_dup_1_correct (const char *x)
{
size_t sz = __builtin_strlen (x) + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
@@ -24,7 +24,7 @@ alloc_dup_1_incorrect (const char *x, const char *y)
{
/* Forgetting to add space for the terminator here. */
size_t sz = __builtin_strlen (x) + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, __builtin_strlen (x));
@@ -39,7 +39,7 @@ alloc_dup_2_correct (const char *x)
{
size_t len_x = __builtin_strlen (x);
size_t sz = len_x + 1;
- char *result = __builtin_malloc (sz);
+ char *result = (char *) __builtin_malloc (sz);
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
@@ -52,7 +52,7 @@ alloc_dup_of_concatenated_pair_2_incorrect (const char *x, const char *y)
{
size_t len_x = __builtin_strlen (x);
size_t sz = len_x; /* Forgetting to add space for the terminator. */
- char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
+ char *result = (char *) __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
if (!result)
return NULL;
__builtin_memcpy (result, x, len_x);
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/switch-enum-pr105273-git-vreportf-2.c
rename to gcc/testsuite/c-c++-common/analyzer/switch-enum-pr105273-git-vreportf-2.c
@@ -34,7 +34,7 @@ static void __analyzer_vreportf(enum usage_kind kind)
int main(void)
{
- __analyzer_vreportf(42);
+ __analyzer_vreportf((enum usage_kind) 42);
return 0;
}
similarity index 88%
rename from gcc/testsuite/gcc.dg/analyzer/symbolic-12.c
rename to gcc/testsuite/c-c++-common/analyzer/symbolic-12.c
@@ -1,4 +1,4 @@
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
void external_fn(void);
@@ -10,7 +10,7 @@ struct st_1
void test_1a (void *p, unsigned next_off)
{
- struct st_1 *r = p;
+ struct st_1 *r = (struct st_1 *) p;
external_fn();
@@ -24,7 +24,7 @@ void test_1a (void *p, unsigned next_off)
void test_1b (void *p, unsigned next_off)
{
- struct st_1 *r = p;
+ struct st_1 *r = (struct st_1 *) p;
if (next_off >= r->size)
return;
@@ -58,7 +58,7 @@ void test_1d (struct st_1 *r, unsigned next_off)
void test_1e (void *p, unsigned next_off)
{
- struct st_1 *r = p;
+ struct st_1 *r = (struct st_1 *) p;
while (1)
{
@@ -79,7 +79,7 @@ struct st_2
void test_2a (void *p, unsigned next_off)
{
- struct st_2 *r = p;
+ struct st_2 *r = (struct st_2 *) p;
external_fn();
@@ -93,7 +93,7 @@ void test_2a (void *p, unsigned next_off)
void test_2b (void *p, unsigned next_off, int idx)
{
- struct st_2 *r = p;
+ struct st_2 *r = (struct st_2 *) p;
external_fn();
similarity index 57%
rename from gcc/testsuite/gcc.dg/analyzer/uninit-alloca.c
rename to gcc/testsuite/c-c++-common/analyzer/uninit-alloca.c
@@ -2,6 +2,6 @@
int test_1 (void)
{
- int *p = __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
+ int *p = (int *) __builtin_alloca (sizeof (int)); /* { dg-message "region created on stack here" } */
return *p; /* { dg-warning "use of uninitialized value '\\*p'" } */
}
similarity index 76%
rename from gcc/testsuite/gcc.dg/analyzer/untracked-2.c
rename to gcc/testsuite/c-c++-common/analyzer/untracked-2.c
@@ -2,6 +2,6 @@ typedef unsigned char u8;
extern int foo(const u8 *key, unsigned int keylen);
int test (void)
{
- static const u8 default_salt[64];
+ static const u8 default_salt[64] = {};
return foo(default_salt, 64);
}
similarity index 96%
rename from gcc/testsuite/gcc.dg/analyzer/vasprintf-1.c
rename to gcc/testsuite/c-c++-common/analyzer/vasprintf-1.c
@@ -1,6 +1,7 @@
/* { dg-additional-options "-Wno-analyzer-too-complex" } */
-#define NULL ((void *)0)
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
+
extern int printf (const char *__restrict __format, ...);
extern int vasprintf (char **__restrict __ptr, const char *__restrict __f,
similarity index 91%
rename from gcc/testsuite/gcc.dg/analyzer/write-to-const-1.c
rename to gcc/testsuite/c-c++-common/analyzer/write-to-const-1.c
@@ -9,7 +9,7 @@ int test_1 (void)
/* Example of writing to a subregion (an element within a const array). */
-const int c2[10]; /* { dg-message "declared here" } */
+const int c2[10] = {}; /* { dg-message "declared here" } */
int test_2 (void)
{
((int*) &c2)[5] = 10; /* { dg-warning "write to 'const' object 'c2'" } */
similarity index 81%
rename from gcc/testsuite/gcc.dg/analyzer/write-to-function-1.c
rename to gcc/testsuite/c-c++-common/analyzer/write-to-function-1.c
@@ -1,3 +1,5 @@
+/* { dg-skip-if "c++ does not allow for conversion from function pointer to 'void *'" { c++ } } */
+
typedef __SIZE_TYPE__ size_t;
int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
similarity index 73%
rename from gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-1.c
rename to gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-1.c
@@ -1,10 +1,16 @@
#include <string.h>
+#ifdef __cplusplus
+#define CONST_CAST(type) const_cast<type>
+#else
+#define CONST_CAST(type)
+#endif
+
/* PR analyzer/95007. */
void test_1 (void)
{
- char *s = "foo";
+ char *s = CONST_CAST(char *)("foo");
s[0] = 'g'; /* { dg-warning "write to string literal" } */
}
@@ -12,9 +18,12 @@ void test_1 (void)
void test_2 (void)
{
- memcpy ("abc", "def", 3); /* { dg-warning "write to string literal" } */
+ // Technically irrelevant for C++ as fpermissive will warn about invalid conversion.
+ memcpy (CONST_CAST(char *)("abc"), "def", 3); /* { dg-warning "write to string literal" } */
}
+/* PR c/83347. */
+
static char * __attribute__((noinline))
called_by_test_3 (void)
{
similarity index 94%
rename from gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-4-disabled.c
rename to gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-4-disabled.c
@@ -16,7 +16,7 @@ void test (int flag)
char *buf;
if (flag)
- buf = __builtin_malloc (1024);
+ buf = (char *) __builtin_malloc (1024);
else
buf = (char *)""; /* { dg-bogus "here" } */
new file mode 100644
@@ -0,0 +1,26 @@
+typedef __SIZE_TYPE__ size_t;
+
+int getrandom (void *__buffer, size_t __length, /* { dg-line getrandom } */
+ unsigned int __flags)
+ __attribute__ ((access (__write_only__, 1, 2)));
+
+/* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c} getrandom } */
+/* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } getrandom } */
+
+#define GRND_RANDOM 0x02
+
+void test (int flag)
+{
+ char *buf;
+
+ if (flag)
+ buf = (char *) __builtin_malloc (1024);
+ else
+ buf = (char *)""; /* { dg-message "here" } */
+
+ if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
+ __builtin_printf("%s\n", buf);
+
+ if (flag)
+ __builtin_free (buf);
+}
similarity index 59%
rename from gcc/testsuite/gcc.dg/analyzer/write-to-string-literal-5.c
rename to gcc/testsuite/c-c++-common/analyzer/write-to-string-literal-5.c
@@ -4,11 +4,13 @@
/* { dg-additional-options "-fanalyzer-show-duplicate-count" } */
/* { dg-require-effective-target alloca } */
-#include "analyzer-decls.h"
+#include "../../gcc.dg/analyzer/analyzer-decls.h"
typedef __SIZE_TYPE__ size_t;
-int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
+int getrandom (void *__buffer, size_t __length,
+ /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c } .-1 } */
+ /* { dg-message "parameter 1 of 'int getrandom\\(void\\*, size_t, unsigned int\\)' marked with attribute 'access \\(write_only, 1, 2\\)'" "" { target c++ } .-2 } */
unsigned int __flags)
__attribute__ ((access (__write_only__, 1, 2)));
@@ -18,9 +20,9 @@ void *test (int flag)
{
char *ptr;
if (flag)
- ptr = __builtin_malloc (1024);
+ ptr = (char *) __builtin_malloc (1024);
else
- ptr = __builtin_alloca (1024);
+ ptr = (char *) __builtin_alloca (1024);
__analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
@@ -39,6 +39,9 @@ set tests [lsort [glob -nocomplain $srcdir/$subdir/*.C]]
g++-dg-runtest $tests "" $DEFAULT_CXXFLAGS
+g++-dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
+ "" $DEFAULT_CXXFLAGS
+
# All done.
dg-finish
deleted file mode 100644
@@ -1,59 +0,0 @@
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
-
-#include <stdint.h>
-
-void test_constant_1 (void)
-{
- int32_t *ptr = __builtin_malloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
- __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_malloc (1);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_1': events 1-2
- |
- | int32_t *ptr = __builtin_malloc (1);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 1 byte here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_constant_2 (void)
-{
- int32_t *ptr = __builtin_malloc (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
- __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_malloc (2);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_2': events 1-2
- |
- | int32_t *ptr = __builtin_malloc (2);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 2 bytes here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
- int32_t *ptr = __builtin_malloc (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
- __builtin_free (ptr);
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_malloc (n * 2);
- ^~~~~~~~~~~~~~~~~~~~~~~~
- 'test_symbolic': event 1
- |
- | int32_t *ptr = __builtin_malloc (n * 2);
- | ^~~~~~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
deleted file mode 100644
@@ -1,62 +0,0 @@
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
-/* { dg-require-effective-target alloca } */
-
-#include <stdint.h>
-
-void test_constant_1 (void)
-{
- int32_t *ptr = __builtin_alloca (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_alloca (1);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_1': events 1-2
- |
- | int32_t *ptr = __builtin_alloca (1);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 1 byte here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_constant_2 (void)
-{
- int32_t *ptr = __builtin_alloca (2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_alloca (2);
- ^~~~~~~~~~~~~~~~~~~~
- 'test_constant_2': events 1-2
- |
- | int32_t *ptr = __builtin_alloca (2);
- | ^~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 2 bytes here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
- int32_t *ptr = __builtin_alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = __builtin_alloca (n * 2);
- ^~~~~~~~~~~~~~~~~~~~~~~~
- 'test_symbolic': events 1-2
- |
- | int32_t *ptr = __builtin_alloca (n * 2);
- | ^~~~~~~~~~~~~~~~~~~~~~~~
- | |
- | (1) allocated 'n * 2' bytes here
- | (2) assigned to 'int32_t *'
- |
- { dg-end-multiline-output "" } */
-
-/* FIXME: am getting a duplicate warning here for some reason
- without -fanalyzer-fine-grained (PR PR analyzer/107851). */
-
deleted file mode 100644
@@ -1,44 +0,0 @@
-/* Verify that we warn for incorrect uses of "alloca" (which may be in a
- macro in a system header), and that the output looks correct. */
-
-/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -fanalyzer-fine-grained" } */
-/* { dg-require-effective-target alloca } */
-
-#include <stdint.h>
-#include "test-alloca.h"
-
-void test_constant_99 (void)
-{
- int32_t *ptr = alloca (99); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = alloca (99);
- ^~~~~~
- 'test_constant_99': events 1-2
- |
- | int32_t *ptr = alloca (99);
- | ^~~~~~
- | |
- | (1) allocated 99 bytes here
- | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
- |
- { dg-end-multiline-output "" } */
-
-void test_symbolic (int n)
-{
- int32_t *ptr = alloca (n * 2); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
-}
-
-/* { dg-begin-multiline-output "" }
- int32_t *ptr = alloca (n * 2);
- ^~~~~~
- 'test_symbolic': events 1-2
- |
- | int32_t *ptr = alloca (n * 2);
- | ^~~~~~
- | |
- | (1) allocated 'n * 2' bytes here
- | (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
- |
- { dg-end-multiline-output "" } */
@@ -1,6 +1,18 @@
#ifndef ANALYZER_DECLS_H
#define ANALYZER_DECLS_H
+#ifndef NULL
+#ifdef __cplusplus
+#if __cplusplus >= 201103L
+#define NULL nullptr
+#else
+#define NULL 0
+#endif
+#else
+#define NULL ((void *)0)
+#endif
+#endif
+
/* Function decls with special meaning to the analyzer.
None of these are actually implemented. */
@@ -47,6 +47,9 @@ dg-init
dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/*.\[cS\]]] \
"" $DEFAULT_CFLAGS
+dg-runtest [lsort [glob -nocomplain $srcdir/c-c++-common/analyzer/*.\[cS\]]] \
+ "" $DEFAULT_CFLAGS
+
# All done.
dg-finish
deleted file mode 100644
@@ -1,6 +0,0 @@
-int test (void)
-{
- unsigned char *s = "abc";
- char *t = "xyz";
- return s[1] + t[1];
-}
@@ -1,5 +1,8 @@
/* { dg-additional-options "-Wno-analyzer-too-complex -Wno-analyzer-fd-leak" } */
// TODO: remove need for these options
+/* This test needs not be moved to c-c++-common/analyzer as C++
+ does not support transparent_union. */
+
typedef __SIZE_TYPE__ size_t;
#define NULL ((void *)0)
@@ -61,7 +64,7 @@ int main() {
struct sockaddr_un remote;
socklen_t len = sizeof(remote);
- pollfds = calloc(1, sizeof(struct pollfd));
+ pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
if (!pollfds) {
exit(1);
}
@@ -74,12 +77,13 @@ int main() {
if (pollfds[0].revents & POLLIN) {
nsockets++;
- newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
+ newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
if (!newpollfds) {
exit(1);
}
pollfds = newpollfds;
pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
+ /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
}
}
return 0;
@@ -1,5 +1,7 @@
/* { dg-additional-options "-Wno-analyzer-fd-leak" } */
// TODO: remove need for this option
+/* This test needs not be moved to c-c++-common/analyzer as C++
+ does not support transparent_union. */
typedef __SIZE_TYPE__ size_t;
#define NULL ((void *)0)
@@ -61,7 +63,7 @@ int main() {
struct sockaddr_un remote;
socklen_t len = sizeof(remote);
- pollfds = calloc(1, sizeof(struct pollfd));
+ pollfds = (struct pollfd *) calloc(1, sizeof(struct pollfd));
if (!pollfds) {
exit(1);
}
@@ -72,11 +74,13 @@ int main() {
}
nsockets++;
- newpollfds = realloc(pollfds, nsockets * sizeof(*pollfds));
+ newpollfds = (struct pollfd *) realloc(pollfds, nsockets * sizeof(*pollfds));
if (!newpollfds) {
exit(3);
}
pollfds = newpollfds;
pollfds[nsockets - 1].fd = accept(pollfds[0].fd, &remote, &len);
+ /* { dg-error "could not convert '& remote' from 'sockaddr_un*' to '__SOCKADDR_ARG'" "G++ doesn't support transparent_union" { target c++ } .-1 } */
+
exit(4);
}
deleted file mode 100644
@@ -1,2 +0,0 @@
-/* { dg-additional-options "-Wno-int-conversion" } */
-#include "../pr61861.c"
@@ -6,7 +6,6 @@
#include "analyzer-decls.h"
-#define NULL ((void *) 0)
#define PATH_SEPARATOR ':'
#define LOCALE_ALIAS_PATH "value for LOCALE_ALIAS_PATH"
deleted file mode 100644
@@ -1,10 +0,0 @@
-/* { dg-do compile } */
-
-void
-p5 (const void *);
-
-void
-s5 (const void *cl)
-{
- p5 (&cl[1]); /* { dg-warning "dereferencing 'void \\*' pointer" } */
-}
deleted file mode 100644
@@ -1,29 +0,0 @@
-#include "analyzer-decls.h"
-
-#define NULL ((void *)0)
-
-extern int *const p1;
-
-int *const p2;
-
-int v3;
-extern int *const p3 = &v3; /* { dg-warning "'p3' initialized and declared 'extern'" } */
-
-int v4;
-int *const p4 = &v4;
-
-int main (void)
-{
- __analyzer_describe (0, p1); /* { dg-message "INIT_VAL\\(p1\\)" } */
- __analyzer_eval (p1 == NULL); /* { dg-message "UNKNOWN" } */
-
- __analyzer_eval (p2 == NULL); /* { dg-message "TRUE" } */
-
- __analyzer_describe (0, p3); /* { dg-message "&v3" } */
- __analyzer_eval (p3 == NULL); /* { dg-message "FALSE" } */
-
- __analyzer_describe (0, p4); /* { dg-message "&v4" } */
- __analyzer_eval (p4 == NULL); /* { dg-message "FALSE" } */
-
- return p1[0];
-}
@@ -1,55 +1,16 @@
/* See e.g. https://en.cppreference.com/w/c/io/fprintf
and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
+/* This test needs not be moved to c-c++-common/analyzer as C++
+ fpermissive already emits errors. */
#include "analyzer-decls.h"
extern int
sprintf(char* dst, const char* fmt, ...)
__attribute__((__nothrow__));
-#define NULL ((void *)0)
-
-int
-test_passthrough (char* dst, const char* fmt)
-{
- /* This assumes that fmt doesn't have any arguments. */
- return sprintf (dst, fmt);
-}
-
-void
-test_known (void)
-{
- char buf[10];
- int res = sprintf (buf, "foo");
- /* TODO: ideally we would know the value of "res" is 3,
- and known the content and strlen of "buf" after the call */
-}
-int
-test_null_dst (void)
-{
- return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
-}
-
-int
-test_null_fmt (char *dst)
-{
- return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */
-}
-
-int
-test_uninit_dst (void)
-{
- char *dst;
- return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
-}
-
-int
-test_uninit_fmt_ptr (char *dst)
-{
- const char *fmt;
- return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
-}
+#define NULL ((void *)0)
int
test_uninit_fmt_buf (char *dst)
@@ -66,12 +27,3 @@ test_fmt_not_terminated (char *dst)
return sprintf (dst, fmt); /* { dg-warning "stack-based buffer over-read" } */
/* { dg-message "while looking for null terminator for argument 2 \\('&fmt'\\) of 'sprintf'..." "event" { target *-*-* } .-1 } */
}
-
-void
-test_strlen_1 (void)
-{
- char buf[10];
- sprintf (buf, "msg: %s\n", "abc");
- __analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
- // TODO: ideally would be TRUE
-}
deleted file mode 100644
@@ -1,23 +0,0 @@
-typedef __SIZE_TYPE__ size_t;
-
-int getrandom (void *__buffer, size_t __length, /* { dg-message "parameter 1 of 'getrandom' marked with attribute 'access \\(write_only, 1, 2\\)'" } */
- unsigned int __flags)
- __attribute__ ((access (__write_only__, 1, 2)));
-
-#define GRND_RANDOM 0x02
-
-void test (int flag)
-{
- char *buf;
-
- if (flag)
- buf = __builtin_malloc (1024);
- else
- buf = (char *)""; /* { dg-message "here" } */
-
- if (getrandom(buf, 16, GRND_RANDOM)) /* { dg-warning "write to string literal" } */
- __builtin_printf("%s\n", buf);
-
- if (flag)
- __builtin_free (buf);
-}