4 files changed, 41 insertions, 116 deletions
diff --git a/test/Analysis/NSString-failed-cases.m b/test/Analysis/NSString-failed-cases.m
deleted file mode 100644
index 2b8242f0d019..000000000000
--- a/test/Analysis/NSString-failed-cases.m
+++ /dev/null
@@ -1,115 +0,0 @@
-// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -analyzer-constraints=basic -verify %s
-// RUN: %clang_cc1 -triple i386-apple-darwin10 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s
-// RUN: %clang_cc1 -DTEST_64 -triple x86_64-apple-darwin10 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -analyzer-constraints=basic -verify %s
-// RUN: %clang_cc1 -DTEST_64 -triple x86_64-apple-darwin10 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -analyzer-constraints=range -verify %s
-// XFAIL: *
-
-//===----------------------------------------------------------------------===//
-// The following code is reduced using delta-debugging from
-// Foundation.h (Mac OS X).
-//
-// It includes the basic definitions for the test cases below.
-// Not directly including Foundation.h directly makes this test case 
-// both svelte and portable to non-Mac platforms.
-//===----------------------------------------------------------------------===//
-
-#ifdef TEST_64
-typedef long long int64_t;
-_Bool OSAtomicCompareAndSwap64Barrier( int64_t __oldValue, int64_t __newValue, volatile int64_t *__theValue );
-#define COMPARE_SWAP_BARRIER OSAtomicCompareAndSwap64Barrier
-typedef int64_t intptr_t;
-#else
-typedef int int32_t;
-_Bool OSAtomicCompareAndSwap32Barrier( int32_t __oldValue, int32_t __newValue, volatile int32_t *__theValue );
-#define COMPARE_SWAP_BARRIER OSAtomicCompareAndSwap32Barrier
-typedef int32_t intptr_t;
-#endif
-
-typedef const void * CFTypeRef;
-typedef const struct __CFString * CFStringRef;
-typedef const struct __CFAllocator * CFAllocatorRef;
-extern const CFAllocatorRef kCFAllocatorDefault;
-extern CFTypeRef CFRetain(CFTypeRef cf);
-void CFRelease(CFTypeRef cf);
-typedef const struct __CFDictionary * CFDictionaryRef;
-const void *CFDictionaryGetValue(CFDictionaryRef theDict, const void *key);
-extern CFStringRef CFStringCreateWithFormat(CFAllocatorRef alloc, CFDictionaryRef formatOptions, CFStringRef format, ...);
-typedef signed char BOOL;
-typedef int NSInteger;
-typedef unsigned int NSUInteger;
-@class NSString, Protocol;
-extern void NSLog(NSString *format, ...) __attribute__((format(__NSString__, 1, 2)));
-typedef NSInteger NSComparisonResult;
-typedef struct _NSZone NSZone;
-@class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator;
-@protocol NSObject
-- (BOOL)isEqual:(id)object;
-- (oneway void)release;
-- (id)retain;
-- (id)autorelease;
-@end
-@protocol NSCopying
-- (id)copyWithZone:(NSZone *)zone;
-@end
-@protocol NSMutableCopying
-- (id)mutableCopyWithZone:(NSZone *)zone;
-@end
-@protocol NSCoding
-- (void)encodeWithCoder:(NSCoder *)aCoder;
-@end
-@interface NSObject <NSObject> {}
-- (id)init;
-+ (id)alloc;
-@end
-extern id NSAllocateObject(Class aClass, NSUInteger extraBytes, NSZone *zone);
-typedef struct {} NSFastEnumerationState;
-@protocol NSFastEnumeration
-- (NSUInteger)countByEnumeratingWithState:(NSFastEnumerationState *)state objects:(id *)stackbuf count:(NSUInteger)len;
-@end
-@class NSString;
-typedef struct _NSRange {} NSRange;
-@interface NSArray : NSObject <NSCopying, NSMutableCopying, NSCoding, NSFastEnumeration>
-- (NSUInteger)count;
-@end
-@interface NSMutableArray : NSArray
-- (void)addObject:(id)anObject;
-- (id)initWithCapacity:(NSUInteger)numItems;
-@end
-typedef unsigned short unichar;
-@class NSData, NSArray, NSDictionary, NSCharacterSet, NSData, NSURL, NSError, NSLocale;
-typedef NSUInteger NSStringCompareOptions;
-@interface NSString : NSObject <NSCopying, NSMutableCopying, NSCoding>    - (NSUInteger)length;
-- (NSComparisonResult)compare:(NSString *)string;
-- (NSComparisonResult)compare:(NSString *)string options:(NSStringCompareOptions)mask;
-- (NSComparisonResult)compare:(NSString *)string options:(NSStringCompareOptions)mask range:(NSRange)compareRange;
-- (NSComparisonResult)compare:(NSString *)string options:(NSStringCompareOptions)mask range:(NSRange)compareRange locale:(id)locale;
-- (NSComparisonResult)caseInsensitiveCompare:(NSString *)string;
-- (NSArray *)componentsSeparatedByCharactersInSet:(NSCharacterSet *)separator;
-+ (id)stringWithFormat:(NSString *)format, ... __attribute__((format(__NSString__, 1, 2)));
-@end
-@interface NSSimpleCString : NSString {} @end
-@interface NSConstantString : NSSimpleCString @end
-extern void *_NSConstantStringClassReference;
-
-//===----------------------------------------------------------------------===//
-// Test cases.  These should all be merged into NSString.m once these tests
-//  stop reporting leaks.
-//===----------------------------------------------------------------------===//
-
-// FIXME: THIS TEST CASE INCORRECTLY REPORTS A LEAK.
-void testOSCompareAndSwapXXBarrier_parameter(NSString **old) {
-  NSString *s = [[NSString alloc] init]; // no-warning
-  if (!COMPARE_SWAP_BARRIER((intptr_t) 0, (intptr_t) s, (intptr_t*) old))
-    [s release];
-  else    
-    [*old release];
-}
-
-// FIXME: THIS TEST CASE INCORRECTLY REPORTS A LEAK.
-void testOSCompareAndSwapXXBarrier_parameter_no_direct_release(NSString **old) {
-  NSString *s = [[NSString alloc] init]; // no-warning
-  if (!COMPARE_SWAP_BARRIER((intptr_t) 0, (intptr_t) s, (intptr_t*) old))
-    return;
-  else    
-    [*old release];
-}
diff --git a/test/Analysis/malloc.c b/test/Analysis/malloc.c
index 4d771eeb4bd3..7d2b71877b91 100644
--- a/test/Analysis/malloc.c
+++ b/test/Analysis/malloc.c
@@ -51,3 +51,9 @@ void f6() {
   else
     free(p);
 }
+
+char *doit2();
+void pr6069() {
+  char *buf = doit2();
+  free(buf);
+}
diff --git a/test/Analysis/misc-ps.m b/test/Analysis/misc-ps.m
index 9543a98fe323..ae42dca3b45e 100644
--- a/test/Analysis/misc-ps.m
+++ b/test/Analysis/misc-ps.m
@@ -811,3 +811,29 @@ int pr6033(int x) {
   return x % y; // expected-warning{{The right operand of '%' is a garbage value}}
 }
 
+struct trie {
+  struct trie* next;
+};
+
+struct kwset {
+  struct trie *trie;
+  unsigned char delta[10];
+  struct trie* next[10];
+  int d;
+};
+
+typedef struct trie trie_t;
+typedef struct kwset kwset_t;
+
+void f(kwset_t *kws, char const *p, char const *q) {
+  struct trie const *trie;
+  struct trie * const *next = kws->next;
+  register unsigned char c;
+  register char const *end = p;
+  register char const *lim = q;
+  register int d = 1;
+  register unsigned char const *delta = kws->delta;
+
+  d = delta[c = (end+=d)[-1]]; // no-warning
+  trie = next[c];
+}
diff --git a/test/Analysis/outofbound.c b/test/Analysis/outofbound.c
index 2142e9e1f73b..68e77caa36bd 100644
--- a/test/Analysis/outofbound.c
+++ b/test/Analysis/outofbound.c
@@ -1,7 +1,15 @@
-// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -verify %s
+// RUN: %clang_cc1 -analyze -analyzer-experimental-internal-checks -analyzer-experimental-checks -checker-cfref -analyzer-store=region -verify %s
+
+typedef __typeof(sizeof(int)) size_t;
+void *malloc(size_t);
 
 char f1() {
   char* s = "abcd";
   char c = s[4]; // no-warning
   return s[5] + c; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
 }
+
+void f2() {
+  int *p = malloc(12);
+  p[3] = 4; // expected-warning{{Access out-of-bound array element (buffer overflow)}}
+}