From 898bcac31a0c2a2965e1ce550e453af701ef7949 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Wed, 27 Mar 2019 16:18:25 -0400
Subject: [PATCH 157/169] FIXME: malloc-ipa-8.c: remove
 -fdiagnostics-path-summary-format=none; add -fdiagnostics-show-line-numbers
 -fdiagnostics-nn-line-numbers

---
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8.c | 179 +++++++++++++++++++++++----
 1 file changed, 157 insertions(+), 22 deletions(-)

diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8.c
index 80c490c..8cec3e9 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8.c
@@ -2,12 +2,11 @@
 /* TODO: split into two test cases?
    (one for the unchecked malloc, the other for the double-free).  */
 
-/* { dg-options "--analyzer -fdiagnostics-path-summary-format=none -fdump-analyzer-summaries -fanalyzer-checker=malloc -fanalyzer-verbose-state-changes" } */
+/* { dg-options "--analyzer -fdiagnostics-show-line-numbers -fdiagnostics-nn-line-numbers -fdump-analyzer-summaries -fanalyzer-checker=malloc -fanalyzer-verbose-state-changes" } */
 
 #include <stdlib.h>
 
 void *wrapped_malloc (size_t size) /* { dg-warning "summary: add: '<return-value>': 'start' -> 'unchecked'" } */
-/* { dg-message "\\(4\\) entry to 'wrapped_malloc'" "" { target *-*-* } .-1 } */
 {
   return malloc (size); /* { dg-message "this call could return NULL" } */
 }
@@ -15,16 +14,10 @@ void *wrapped_malloc (size_t size) /* { dg-warning "summary: add: '<return-value
 void wrapped_free (void *ptr) /* { dg-warning "summary: add: 'ptr': 'start' -> 'free'" } */
 /* { dg-warning "summary: transition: 'ptr': 'nonnull' -> 'free'" "" { target *-*-* } .-1 } */
 /* { dg-warning "summary: transition: 'ptr': 'free' -> 'stop'" "" { target *-*-* } .-2 } */
-/* { dg-message "\\(10\\) entry to 'wrapped_free'" "" { target *-*-* } .-3 } */
-/* { dg-message "\\(17\\) entry to 'wrapped_free'" "" { target *-*-* } .-4 } */
 {
   free (ptr); /* { dg-warning "double-free of 'ptr' \\\[CWE-415\\\]" } */
-  /* { dg-message "\\(11\\) first 'free' here" "" { target *-*-* } .-1 } */
-  /* { dg-message "\\(12\\) first 'free' here" "" { target *-*-* } .-2 } */
   /* FIXME: unchecked -> free is correct, but start -> free should be pruned
-     from the path.
-     FIXME: do we need a way of turning off the friendlier messages?  */
-  /* { dg-message "\\(18\\) second 'free' here" "" { target *-*-* } .-6 } */
+     from the path.  */
 }
 
 typedef struct boxed_int
@@ -34,7 +27,6 @@ typedef struct boxed_int
 
 boxed_int *
 make_boxed_int (int i) /* { dg-warning "summary: add: '<return-value>': 'start' -> 'nonnull'" } */
-/* { dg-message "\\(3\\) entry to 'make_boxed_int'" "" { target *-*-* } .-1 } */
 {
   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
   result->i = i; /* { dg-warning "use of possibly-NULL 'result'" } */
@@ -45,26 +37,169 @@ make_boxed_int (int i) /* { dg-warning "summary: add: '<return-value>': 'start'
 void
 free_boxed_int (boxed_int *bi) /* { dg-warning "summary: add: 'bi': 'start' -> 'free'" } */
 /* { dg-warning "summary: add: 'bi': 'start' -> 'stop'" "" { target *-*-* } .-1 } */
-/* { dg-message "\\(7\\) entry to 'free_boxed_int'" "" { target *-*-* } .-2 } */
-/* { dg-message "\\(15\\) entry to 'free_boxed_int'" "" { target *-*-* } .-3 } */
 {
-  wrapped_free (bi); /* { dg-message "\\(8\\) state of 'ptr': 'start' -> 'nonnull'" } */
-  /* { dg-message "\\(9\\) first 'free' here" "" { target *-*-* } .-1 } */
-  /* FIXME: these are wrong; they refer to ptr, not bi.
+  wrapped_free (bi);
+  /* FIXME: events here are wrong; they refer to ptr, not bi.
      (was "state of 'ptr': 'start' -> 'free'")
      Also, they should be just start->free, or be skipped.  */
-  /* { dg-message "\\(16\\) calling 'wrapped_free' from 'free_boxed_int'" "" { target *-*-* } .-5 } */
 }
 
-void test (int i) /* { dg-message "\\(1\\) entry to 'test'" } */
+void test (int i)
 {
-  boxed_int *obj = make_boxed_int (i); /* { dg-message "\\(2\\) calling 'make_boxed_int' from 'test'" } */
-  /* { dg-message "\\(5\\) returning to 'test' from 'make_boxed_int'" "" { target *-*-* } .-1 } */
+  boxed_int *obj = make_boxed_int (i);
 
-  free_boxed_int (obj); /* { dg-message "\\(6\\) calling 'free_boxed_int' from 'test'" } */
-  /* { dg-message "\\(13\\) returning to 'test' from 'free_boxed_int'" "" { target *-*-* } .-1 } */
+  free_boxed_int (obj);
 
-  free_boxed_int (obj); /* { dg-message "\\(14\\) calling 'free_boxed_int' from 'test'" } */
+  free_boxed_int (obj);
 }
 
 /* TODO: various strange entries in the path.  */
+
+/* "use of possibly-NULL 'result' [CWE-690]".  */
+/* { dg-begin-multiline-output "" }
+  'make_boxed_int': events 1-2
+          |
+          |   NN | make_boxed_int (int i)
+          |      | ^~~~~~~~~~~~~~
+          |      | |
+          |      | (1) entry to 'make_boxed_int'
+          |   NN | {
+          |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
+          |      |                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+          |      |                                    |
+          |      |                                    (2) calling 'wrapped_malloc' from 'make_boxed_int'
+          |
+          +--> 'wrapped_malloc': events 3-4
+                       |
+                       |   NN | void *wrapped_malloc (size_t size)
+                       |      |       ^~~~~~~~~~~~~~
+                       |      |       |
+                       |      |       (3) entry to 'wrapped_malloc'
+                       |   NN | {
+                       |   NN |   return malloc (size);
+                       |      |          ~~~~~~~~~~~~~
+                       |      |          |
+                       |      |          (4) this call could return NULL (state of '<return-value>': 'start' -> 'unchecked', origin: NULL)
+                       |
+          <------------+
+          |
+  'make_boxed_int': events 5-6
+          |
+          |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
+          |      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+          |      |                                    |
+          |      |                                    (5) returning to 'make_boxed_int' from 'wrapped_malloc'
+          |   NN |   result->i = i;
+          |      |   ~~~~~~~~~~~~~                     
+          |      |             |
+          |      |             (6) 'result' could be NULL ('result' is in state 'unchecked')
+          |
+  { dg-end-multiline-output "" } */
+
+/* Double-free.  */
+/* { dg-begin-multiline-output "" }
+  'test': events 1-2
+     |
+     |   NN | void test (int i)
+     |      |      ^~~~
+     |      |      |
+     |      |      (1) entry to 'test'
+     |   NN | {
+     |   NN |   boxed_int *obj = make_boxed_int (i);
+     |      |                    ~~~~~~~~~~~~~~~~~~
+     |      |                    |
+     |      |                    (2) calling 'make_boxed_int' from 'test'
+     |
+     +--> 'make_boxed_int': event 3
+                  |
+                  |   NN | make_boxed_int (int i)
+                  |      | ^~~~~~~~~~~~~~
+                  |      | |
+                  |      | (3) entry to 'make_boxed_int'
+                  |
+          'wrapped_malloc': event 4
+                  |
+                  |   NN | void *wrapped_malloc (size_t size)
+                  |      |       ^~~~~~~~~~~~~~
+                  |      |       |
+                  |      |       (4) entry to 'wrapped_malloc'
+                  |
+     <------------+
+     |
+  'test': events 5-6
+     |
+     |   NN |   boxed_int *obj = make_boxed_int (i);
+     |      |                    ^~~~~~~~~~~~~~~~~~
+     |      |                    |
+     |      |                    (5) returning to 'test' from 'make_boxed_int'
+     |   NN | 
+     |   NN |   free_boxed_int (obj);
+     |      |   ~~~~~~~~~~~~~~~~~~~~
+     |      |   |
+     |      |   (6) calling 'free_boxed_int' from 'test'
+     |
+     +--> 'free_boxed_int': events 7-9
+                  |
+                  |   NN | free_boxed_int (boxed_int *bi)
+                  |      | ^~~~~~~~~~~~~~
+                  |      | |
+                  |      | (7) entry to 'free_boxed_int'
+                  |......
+                  |   NN |   wrapped_free (bi);
+                  |      |   ~~~~~~~~~~~~~~~~~
+                  |      |   |
+                  |      |   (8) state of 'ptr': 'start' -> 'nonnull' (origin: NULL)
+                  |      |   (9) first 'free' here (state of 'ptr': 'start' -> 'free', origin: NULL)
+                  |
+          'wrapped_free': events 10-12
+                 |
+                 |   NN | void wrapped_free (void *ptr)
+                 |      |      ^~~~~~~~~~~~
+                 |      |      |
+                 |      |      (10) entry to 'wrapped_free'
+                 |......
+                 |   NN |   free (ptr);
+                 |      |   ~~~~~~~~~~
+                 |      |   |
+                 |      |   (11) first 'free' here (state of 'ptr': 'start' -> 'free', origin: NULL)
+                 |      |   (12) first 'free' here (state of 'ptr': 'nonnull' -> 'free', origin: NULL)
+                 |
+     <-----------+
+     |
+  'test': events 13-14
+     |
+     |   NN |   free_boxed_int (obj);
+     |      |   ^~~~~~~~~~~~~~~~~~~~
+     |      |   |
+     |      |   (13) returning to 'test' from 'free_boxed_int'
+     |   NN | 
+     |   NN |   free_boxed_int (obj);
+     |      |   ~~~~~~~~~~~~~~~~~~~~
+     |      |   |
+     |      |   (14) calling 'free_boxed_int' from 'test'
+     |
+     +--> 'free_boxed_int': events 15-16
+                  |
+                  |   NN | free_boxed_int (boxed_int *bi)
+                  |      | ^~~~~~~~~~~~~~
+                  |      | |
+                  |      | (15) entry to 'free_boxed_int'
+                  |......
+                  |   NN |   wrapped_free (bi);
+                  |      |   ~~~~~~~~~~~~~~~~~
+                  |      |   |
+                  |      |   (16) calling 'wrapped_free' from 'free_boxed_int'
+                  |
+                  +--> 'wrapped_free': events 17-18
+                              |
+                              |   NN | void wrapped_free (void *ptr)
+                              |      |      ^~~~~~~~~~~~
+                              |      |      |
+                              |      |      (17) entry to 'wrapped_free'
+                              |......
+                              |   NN |   free (ptr);
+                              |      |   ~~~~~~~~~~
+                              |      |   |
+                              |      |   (18) second 'free' here ('ptr' is in state 'free')
+                              |
+   { dg-end-multiline-output "" } */
-- 
1.8.5.3

