From c68ec99b1e8d17c25d249d56672cba3fbc7ad679 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Sat, 25 May 2019 18:49:24 -0400
Subject: [PATCH 19/28] FIXME: More test coverage

---
 .../assignments/dereference-on-lhs/input.c         | 27 -------
 .../assignments/dereference-on-lhs/script.py       | 37 ---------
 .../assignments/dereference-on-lhs/stderr.txt      |  4 -
 .../assignments/dereference-on-lhs/stdout.txt      |  0
 .../assignments/dereference-on-rhs/input.c         | 28 -------
 .../assignments/dereference-on-rhs/script.py       | 23 ------
 .../assignments/dereference-on-rhs/stderr.txt      |  4 -
 .../assignments/dereference-on-rhs/stdout.txt      |  0
 .../gcc.dg/TODO-analyzer/assignments/phi/input.c   | 38 ----------
 .../gcc.dg/TODO-analyzer/assignments/phi/script.py | 34 ---------
 .../TODO-analyzer/assignments/phi/stderr.txt       |  7 --
 .../TODO-analyzer/assignments/phi/stdout.txt       |  0
 .../checkers/malloc-checker/correct_usage/input.c  | 31 --------
 .../correct_usage/input.c.cpychecker-log.txt       |  1 -
 .../malloc-checker/correct_usage/script.py         | 23 ------
 .../malloc-checker/correct_usage/stdout.txt        |  0
 .../checkers/malloc-checker/two_ptrs/input.c       | 35 ---------
 .../two_ptrs/input.c.cpychecker-log.txt            |  1 -
 .../checkers/malloc-checker/two_ptrs/script.py     | 23 ------
 .../checkers/malloc-checker/two_ptrs/stderr.txt    |  4 -
 .../checkers/malloc-checker/two_ptrs/stdout.txt    |  0
 .../malloc-checker/unchecked_malloc/input.c        | 28 -------
 .../unchecked_malloc/input.c.cpychecker-log.txt    |  1 -
 .../malloc-checker/unchecked_malloc/script.py      | 23 ------
 .../malloc-checker/unchecked_malloc/stderr.txt     |  4 -
 .../malloc-checker/unchecked_malloc/stdout.txt     |  0
 .../checkers/malloc-checker/use_after_free/input.c | 34 ---------
 .../use_after_free/input.c.cpychecker-log.txt      |  1 -
 .../malloc-checker/use_after_free/script.py        | 23 ------
 .../malloc-checker/use_after_free/stderr.txt       |  4 -
 .../malloc-checker/use_after_free/stdout.txt       |  0
 .../checkers/points_to_stack/putenv/stderr.txt     | 22 ------
 .../checkers/points_to_stack/putenv/stdout.txt     |  0
 .../gcc.dg/TODO-analyzer/facts/meet/input.c        | 41 ----------
 .../gcc.dg/TODO-analyzer/facts/meet/script.py      | 46 -----------
 .../gcc.dg/TODO-analyzer/facts/meet/stdout.txt     |  0
 gcc/testsuite/gcc.dg/TODO-analyzer/looping/input.c | 36 ---------
 .../gcc.dg/TODO-analyzer/looping/script.py         | 23 ------
 .../gcc.dg/TODO-analyzer/looping/stderr.txt        | 13 ----
 .../gcc.dg/TODO-analyzer/looping/stdout.txt        |  0
 .../configure-with-exceptions/getopts.py           |  1 -
 .../regression/configure-with-exceptions/input.c   | 14 ----
 .../regression/configure-with-exceptions/script.py | 23 ------
 .../configure-with-exceptions/stdout.txt           |  0
 .../configure-without-exceptions/getopts.py        |  1 -
 .../configure-without-exceptions/input.c           | 14 ----
 .../configure-without-exceptions/script.py         | 23 ------
 .../configure-without-exceptions/stdout.txt        |  0
 .../TODO-analyzer/regression/return-0/getopts.py   | 23 ------
 .../TODO-analyzer/regression/return-0/input.c      |  4 -
 .../TODO-analyzer/regression/return-0/script.py    | 23 ------
 .../TODO-analyzer/regression/return-0/stdout.txt   |  0
 .../regression/rhs-is-vardecl/input.c              |  8 --
 gcc/testsuite/gcc.dg/analyzer/conditionals.c       | 19 +++++
 gcc/testsuite/gcc.dg/analyzer/data-model-1.c       | 83 ++++++++++++++++++++
 gcc/testsuite/gcc.dg/analyzer/data-model-2.c       | 13 ++++
 gcc/testsuite/gcc.dg/analyzer/data-model-3.c       | 15 ++++
 gcc/testsuite/gcc.dg/analyzer/data-model-4.c       | 16 ++++
 gcc/testsuite/gcc.dg/analyzer/loop-2.c             | 37 +++++++++
 gcc/testsuite/gcc.dg/analyzer/loop-3.c             | 21 ++++++
 gcc/testsuite/gcc.dg/analyzer/malloc-1.c           | 88 ++++++++++++++++++++++
 gcc/testsuite/lib/prune.exp                        |  2 +-
 62 files changed, 293 insertions(+), 754 deletions(-)
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c.cpychecker-log.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c.cpychecker-log.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c.cpychecker-log.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c.cpychecker-log.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/points_to_stack/putenv/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/points_to_stack/putenv/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/looping/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/looping/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/looping/stderr.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/looping/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/getopts.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/getopts.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/getopts.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/input.c
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/script.py
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/stdout.txt
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/regression/rhs-is-vardecl/input.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-3.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/data-model-4.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-2.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/loop-3.c

diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/input.c
deleted file mode 100644
index 8234afa..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/input.c
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-
-int *test(int i)
-{
-  int *foo = (int*)malloc(sizeof(int*));
-  *foo = i; /* BUG: result of malloc could be NULL */
-  return foo;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/script.py
deleted file mode 100644
index 5c59776..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/script.py
+++ /dev/null
@@ -1,37 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-def selftest(ctxt, solution):
-    if 0:
-        import sys
-        solution.dump(sys.stderr)
-
-    # Verify that the:
-    #    foo = malloc()
-    # transitions "foo" from "ptr.start" to "ptr.unchecked"
-    node = ctxt.find_call_of('malloc')
-    ctxt.assert_statenames_for_varname(node, 'foo', {'ptr.start'})
-
-    node = ctxt.get_successor(node)
-    ctxt.assert_statenames_for_varname(node, 'foo', {'ptr.unchecked'})
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker], selftest=selftest)
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/stderr.txt
deleted file mode 100644
index 10b4b24..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/stderr.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-tests/sm/assignments/dereference-on-lhs/input.c: In function 'test':
-tests/sm/assignments/dereference-on-lhs/input.c:25:nn: error: dereference of possibly-NULL pointer foo [CWE-690]
-tests/sm/assignments/dereference-on-lhs/input.c:24:nn: note: foo assigned to the result of malloc()
-tests/sm/assignments/dereference-on-lhs/input.c:25:nn: note: dereference of possibly-NULL pointer foo
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-lhs/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/input.c
deleted file mode 100644
index 6a1c472..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/input.c
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-
-int *test(int i)
-{
-  int *foo = (int*)malloc(sizeof(int*));
-  i = *foo; /* BUG: result of malloc could be NULL
-               (fwiw it's also uninitialized) */
-  return foo;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/script.py
deleted file mode 100644
index f5439a2..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/stderr.txt
deleted file mode 100644
index dd63384..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/stderr.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-tests/sm/assignments/dereference-on-rhs/input.c: In function 'test':
-tests/sm/assignments/dereference-on-rhs/input.c:25:nn: error: dereference of possibly-NULL pointer foo [CWE-690]
-tests/sm/assignments/dereference-on-rhs/input.c:24:nn: note: foo assigned to the result of malloc()
-tests/sm/assignments/dereference-on-rhs/input.c:25:nn: note: dereference of possibly-NULL pointer foo
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/dereference-on-rhs/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/input.c
deleted file mode 100644
index b1c939a..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/input.c
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-
-extern void marker(char *buffer);
-
-char *test(int flag)
-{
-  char *buffer;
-
-  if (flag) {
-    buffer = (char*)malloc(4096);
-  } else {
-    buffer = NULL;
-  }
-
-  marker(buffer);
-  buffer[0] = 'a';
-
-  return buffer;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/script.py
deleted file mode 100644
index 6de41ca..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/script.py
+++ /dev/null
@@ -1,34 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-def selftest(ctxt, solution):
-    if 0:
-        import sys
-        solution.dump(sys.stderr)
-
-    # Verify that at
-    #    marker(buffer)
-    # that we have the states from both paths:
-    node = ctxt.find_call_of('marker')
-    ctxt.assert_statenames_for_varname(node, 'buffer', {'ptr.unchecked', 'ptr.null'})
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker], selftest=selftest)
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/stderr.txt
deleted file mode 100644
index 13d76ca..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/stderr.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-tests/sm/assignments/phi/input.c: In function 'test':
-tests/sm/assignments/phi/input.c:35:nn: error: dereference of NULL pointer buffer [CWE-690]
-tests/sm/assignments/phi/input.c:31:nn: note: buffer assigned to 0
-tests/sm/assignments/phi/input.c:35:nn: note: dereference of NULL pointer buffer
-tests/sm/assignments/phi/input.c:35:nn: error: dereference of possibly-NULL pointer buffer [CWE-690]
-tests/sm/assignments/phi/input.c:29:nn: note: buffer assigned to the result of malloc()
-tests/sm/assignments/phi/input.c:35:nn: note: dereference of possibly-NULL pointer buffer
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/assignments/phi/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c
deleted file mode 100644
index c357663..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-#include <string.h>
-
-int test(void)
-{
-  void *ptr = malloc(4096);
-  if (!ptr)
-    return -1; /* FIXME: with a plain return we have a BB with no gimple, and that breaks my checker */
-  memset(ptr, 0, 4096);
-  free(ptr);
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c.cpychecker-log.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c.cpychecker-log.txt
deleted file mode 100644
index 7499d84..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/input.c.cpychecker-log.txt
+++ /dev/null
@@ -1 +0,0 @@
-gcc.Function('test')
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/script.py
deleted file mode 100644
index d6390c5..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/correct_usage/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c
deleted file mode 100644
index 28a1cdd..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-#include <string.h>
-
-int test(void)
-{
-  void *p = malloc(4096);
-  void *q = malloc(4096);
-  if (p) {
-    memset(p, 0, 4096); /* Not a bug: checked */
-  } else {
-    memset(q, 0, 4096); /* BUG: not checked */
-  }
-  free(p);
-  free(q);
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c.cpychecker-log.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c.cpychecker-log.txt
deleted file mode 100644
index 7499d84..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/input.c.cpychecker-log.txt
+++ /dev/null
@@ -1 +0,0 @@
-gcc.Function('test')
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/script.py
deleted file mode 100644
index d6390c5..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/stderr.txt
deleted file mode 100644
index 7f11a6a..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/stderr.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-tests/sm/checkers/malloc-checker/two_ptrs/input.c: In function 'test':
-tests/sm/checkers/malloc-checker/two_ptrs/input.c:30:nn: error: possibly-NULL pointer q passed as argument 1 to memset [CWE-690]
-tests/sm/checkers/malloc-checker/two_ptrs/input.c:26:nn: note: q assigned to the result of malloc()
-tests/sm/checkers/malloc-checker/two_ptrs/input.c:30:nn: note: possibly-NULL pointer q passed as argument 1 to memset
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/two_ptrs/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c
deleted file mode 100644
index 358f4c9..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-#include <string.h>
-
-void *test(void)
-{
-  void *ptr = malloc(4096);
-  memset(ptr, 0, 4096);
-  return ptr;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c.cpychecker-log.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c.cpychecker-log.txt
deleted file mode 100644
index 7499d84..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/input.c.cpychecker-log.txt
+++ /dev/null
@@ -1 +0,0 @@
-gcc.Function('test')
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/script.py
deleted file mode 100644
index d6390c5..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/stderr.txt
deleted file mode 100644
index c08d698..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/stderr.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-tests/sm/checkers/malloc-checker/unchecked_malloc/input.c: In function 'test':
-tests/sm/checkers/malloc-checker/unchecked_malloc/input.c:26:nn: error: possibly-NULL pointer ptr passed as argument 1 to memset [CWE-690]
-tests/sm/checkers/malloc-checker/unchecked_malloc/input.c:25:nn: note: ptr assigned to the result of malloc()
-tests/sm/checkers/malloc-checker/unchecked_malloc/input.c:26:nn: note: possibly-NULL pointer ptr passed as argument 1 to memset
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/unchecked_malloc/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c
deleted file mode 100644
index ca01596..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-#include <string.h>
-
-void foo(void *ptr);
-
-void test(int i)
-{
-  void *p;
-
-  p = malloc(1024);
-  if (p) {
-    free(p);
-    foo(p);
-  }
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c.cpychecker-log.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c.cpychecker-log.txt
deleted file mode 100644
index 7499d84..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/input.c.cpychecker-log.txt
+++ /dev/null
@@ -1 +0,0 @@
-gcc.Function('test')
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/script.py
deleted file mode 100644
index d6390c5..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/stderr.txt
deleted file mode 100644
index f0ce7d1..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/stderr.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-tests/sm/checkers/malloc-checker/use_after_free/input.c: In function 'test':
-tests/sm/checkers/malloc-checker/use_after_free/input.c:32:nn: error: use-after-free of p [CWE-416]
-tests/sm/checkers/malloc-checker/use_after_free/input.c:31:nn: note: p passed to free()
-tests/sm/checkers/malloc-checker/use_after_free/input.c:32:nn: note: use-after-free of p
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/malloc-checker/use_after_free/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/points_to_stack/putenv/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/points_to_stack/putenv/stderr.txt
deleted file mode 100644
index f0976f0..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/points_to_stack/putenv/stderr.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-tests/sm/checkers/taint/example/input.c: In function 'test':
-tests/sm/checkers/taint/example/input.c:37:nn: error: use of tainted value tmp.i in array lookup without bounds checking [CWE-129]
-tests/sm/checkers/taint/example/input.c:34:nn: note: tmp passed to fread()
-tests/sm/checkers/taint/example/input.c:37:nn: note: state of tmp ("x.tainted") propagated to tmp.i
-tests/sm/checkers/taint/example/input.c:37:nn: note: use of tainted value tmp.i in array lookup without bounds checking
-tests/sm/checkers/taint/example/input.c: In function 'test4':
-tests/sm/checkers/taint/example/input.c:68:nn: error: use of tainted value tmp.i in array lookup without upper-bound check [CWE-129]
-tests/sm/checkers/taint/example/input.c:65:nn: note: tmp passed to fread()
-tests/sm/checkers/taint/example/input.c:66:nn: note: state of tmp ("x.tainted") propagated to tmp.i
-tests/sm/checkers/taint/example/input.c:66:nn: note: tmp.i compared against 0
-tests/sm/checkers/taint/example/input.c:68:nn: note: use of tainted value tmp.i in array lookup without upper-bound check
-tests/sm/checkers/taint/example/input.c: In function 'test5':
-tests/sm/checkers/taint/example/input.c:81:nn: error: use of tainted value tmp.i in array lookup without lower-bound check [CWE-129]
-tests/sm/checkers/taint/example/input.c:78:nn: note: tmp passed to fread()
-tests/sm/checkers/taint/example/input.c:79:nn: note: state of tmp ("x.tainted") propagated to tmp.i
-tests/sm/checkers/taint/example/input.c:79:nn: note: tmp.i compared against 255
-tests/sm/checkers/taint/example/input.c:81:nn: note: use of tainted value tmp.i in array lookup without lower-bound check
-tests/sm/checkers/taint/example/input.c: In function 'test6':
-tests/sm/checkers/taint/example/input.c:101:nn: error: use of tainted value tmp.i in array lookup without bounds checking [CWE-129]
-tests/sm/checkers/taint/example/input.c:98:nn: note: tmp passed to fread()
-tests/sm/checkers/taint/example/input.c:101:nn: note: state of tmp ("x.tainted") propagated to tmp.i
-tests/sm/checkers/taint/example/input.c:101:nn: note: use of tainted value tmp.i in array lookup without bounds checking
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/points_to_stack/putenv/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/points_to_stack/putenv/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/input.c
deleted file mode 100644
index b222c95..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/input.c
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-extern void marker_A(void);
-extern void marker_B(void);
-extern void marker_C(void);
-extern void marker_D(void);
-
-void test(int flag, unsigned int i)
-{
-  if (!flag) {
-    return;
-  }
-  
-  marker_A();
-
-  if (i>0) {
-    marker_B();
-  } else {
-    marker_C();
-  }
-
-  marker_D();
-
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/script.py
deleted file mode 100644
index 6574be7..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/script.py
+++ /dev/null
@@ -1,46 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-def selftest(ctxt, solution):
-    if 0:
-        import sys
-        solution.dump(sys.stderr)
-
-    # Verify that we know flag != 0 at marker_A:
-    node = ctxt.find_call_of('marker_A')
-    ctxt.assert_fact(node, 'flag', '!=', 0)
-
-    # We should also know it after the conditionals:
-    node = ctxt.find_call_of('marker_B')
-    ctxt.assert_fact(node, 'flag', '!=', 0)
-    ctxt.assert_fact(node, 'i', '!=', 0)
-
-    # and that due to the restricted range of i that i == 0 when !(i>0):
-    node = ctxt.find_call_of('marker_C')
-    ctxt.assert_fact(node, 'flag', '!=', 0)
-    ctxt.assert_fact(node, 'i', '==', 0)
-
-    # We should also know (flag != 0) when control flow merges:
-    node = ctxt.find_call_of('marker_D')
-    ctxt.assert_fact(node, 'flag', '!=', 0)
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker], selftest=selftest)
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/facts/meet/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/looping/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/looping/input.c
deleted file mode 100644
index 1bf8f6f..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/looping/input.c
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdlib.h>
-
-void test(int c)
-{
-  int i;
-  char *buffer = (char*)malloc(256);
-
-  for (i=0; i<255; i++) {
-    buffer[i] = c; /* BUG: the malloc could have failed
-                    TODO: the checker doesn't yet pick up on this due to
-                    the pointer arithmetic not picking up on the state */
-                   /* BUG use-after-free the second time through the loop */
-
-    free(buffer); /* BUG: doublefree here on second time through the  loop */
-  }
-
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/looping/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/looping/script.py
deleted file mode 100644
index f5439a2..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/looping/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/looping/stderr.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/looping/stderr.txt
deleted file mode 100644
index ce8212e..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/looping/stderr.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-tests/sm/looping/input.c: In function 'test':
-tests/sm/looping/input.c:28:nn: error: use-after-free of buffer [CWE-416]
-tests/sm/looping/input.c:25:nn: note: buffer assigned to the result of malloc()
-tests/sm/looping/input.c:33:nn: note: buffer passed to free()
-tests/sm/looping/input.c:28:nn: note: use-after-free of buffer
-tests/sm/looping/input.c:33:nn: error: double-free of buffer [CWE-415]
-tests/sm/looping/input.c:25:nn: note: buffer assigned to the result of malloc()
-tests/sm/looping/input.c:33:nn: note: buffer passed to free()
-tests/sm/looping/input.c:33:nn: note: double-free of buffer
-tests/sm/looping/input.c:33:nn: error: use-after-free of buffer [CWE-416]
-tests/sm/looping/input.c:25:nn: note: buffer assigned to the result of malloc()
-tests/sm/looping/input.c:33:nn: note: buffer passed to free()
-tests/sm/looping/input.c:33:nn: note: use-after-free of buffer
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/looping/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/looping/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/getopts.py b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/getopts.py
deleted file mode 100644
index 6803180..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/getopts.py
+++ /dev/null
@@ -1 +0,0 @@
-print('-fexceptions')
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/input.c
deleted file mode 100644
index f5711bf..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/input.c
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
-   Taken from autoconf test
-*/
-
-#include <stdio.h>
-int
-main ()
-{
-  FILE *f = fopen ("conftest.out", "w");
-  return ferror (f) || fclose (f) != 0;
-
-  ;
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/script.py
deleted file mode 100644
index f5439a2..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-with-exceptions/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/getopts.py b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/getopts.py
deleted file mode 100644
index 964cadd..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/getopts.py
+++ /dev/null
@@ -1 +0,0 @@
-print('-O2')
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/input.c
deleted file mode 100644
index f5711bf..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/input.c
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
-   Taken from autoconf test
-*/
-
-#include <stdio.h>
-int
-main ()
-{
-  FILE *f = fopen ("conftest.out", "w");
-  return ferror (f) || fclose (f) != 0;
-
-  ;
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/script.py
deleted file mode 100644
index f5439a2..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/configure-without-exceptions/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/getopts.py b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/getopts.py
deleted file mode 100644
index 8dd3ec3..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/getopts.py
+++ /dev/null
@@ -1,23 +0,0 @@
-"""
-Seeing this error:
-
-    tests/sm/regression/return-0/input.c:4:3: error: Unhandled Python exception raised calling 'execute' method
-    Traceback (most recent call last):
-      File "sm/__init__.py", line 53, in execute
-        solve(ctxt, 'solution')
-      File "sm/solver.py", line 586, in solve
-        solution = ctxt.solve(name)
-      File "sm/solver.py", line 544, in solve
-        find_leaks(self)
-      File "sm/leaks.py", line 59, in find_leaks
-        retval_aliases = get_retval_aliases(ctxt, edge.dstnode)
-      File "sm/leaks.py", line 33, in get_retval_aliases
-        retval = retval.var
-    AttributeError: 'gcc.IntegerCst' object has no attribute 'var'
-with:
-  -O2
-
-With optimization, the return statement directly returns a constant, rather
-than a temporary.
-"""
-print('-O2')
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/input.c
deleted file mode 100644
index 115ae04..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/input.c
+++ /dev/null
@@ -1,4 +0,0 @@
-int test(void)
-{
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/script.py b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/script.py
deleted file mode 100644
index f5439a2..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/script.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-#   Copyright 2012, 2013 David Malcolm <dmalcolm@redhat.com>
-#   Copyright 2012, 2013 Red Hat, Inc.
-#
-#   This is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by
-#   the Free Software Foundation, either version 3 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#   General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program.  If not, see
-#   <http://www.gnu.org/licenses/>.
-
-from sm import main
-from sm.parser import parse_file
-
-checker = parse_file('sm/checkers/malloc_checker.sm')
-main([checker])
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/stdout.txt b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/return-0/stdout.txt
deleted file mode 100644
index e69de29..0000000
diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/rhs-is-vardecl/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/regression/rhs-is-vardecl/input.c
deleted file mode 100644
index 37458de..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/regression/rhs-is-vardecl/input.c
+++ /dev/null
@@ -1,8 +0,0 @@
-extern const char *char_ptr;
-
-int test(void)
-{
-  if (strcmp("literal", char_ptr))
-    return 1;
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/analyzer/conditionals.c b/gcc/testsuite/gcc.dg/analyzer/conditionals.c
index 28f6978..e5da0ed 100644
--- a/gcc/testsuite/gcc.dg/analyzer/conditionals.c
+++ b/gcc/testsuite/gcc.dg/analyzer/conditionals.c
@@ -67,6 +67,25 @@ void test_2 (int i, int j, int k)
     }
 }
 
+void test_3 (int flag, unsigned int i)
+{
+  if (!flag) {
+    return;
+  }
+
+  __analyzer_eval (flag); /* { dg-warning "TRUE" } */
+      
+  if (i>0) {
+    __analyzer_eval (i > 0); /* { dg-warning "TRUE" } */
+    __analyzer_eval (flag); /* { dg-warning "TRUE" } */
+  } else {
+    __analyzer_eval (i <= 0); /* { dg-warning "TRUE" } */
+    __analyzer_eval (flag); /* { dg-warning "TRUE" } */
+  }
+
+  __analyzer_eval (flag); /* { dg-warning "TRUE" } */
+}
+
 void test_range_int_gt_lt (int i)
 {
   if (i > 3)
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-1.c b/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
index 14543a9..cd188ef 100644
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
@@ -744,6 +744,89 @@ union u
   int *ptr;
 };
 
+void test_41 (void)
+{
+  union u u;
+  u.i = 42;
+  __analyzer_eval (u.i == 42); /* { dg-warning "TRUE" } */
+}
+
+// FIXME: this currently crashes the analyzer
+#if 0
+void test_42 (void)
+{
+  int i;
+  float f;
+  i = 42;
+  f = i;
+  __analyzer_eval (f == 42.0); /* { d-todo-g-warning "TRUE" } */
+}
+#endif
+
+// FIXME: this currently crashes the analyzer
+#if 0
+void test_43 (void)
+{
+  int i;
+  float f;
+  f = 42.0f;
+  i = f;
+  __analyzer_eval (i == 42); /* { d-todo-g-warning "TRUE" } */
+}
+#endif
+
+struct sbits
+{
+  int b0 : 1;
+  int b123 : 3;
+  int b456 : 3;
+  int b7 : 1;
+};
+
+void test_44 (void)
+{
+  struct sbits bits;
+  bits.b0 = 1;
+  __analyzer_eval (bits.b0 == 1); /* { dg-warning "TRUE" "" { xfail *-*-* } } */
+  /* { dg-warning "FALSE" "" { target *-*-* } .-1 } */
+  // TODO(xfail): ^^^^
+
+  bits.b456 = 5;
+  __analyzer_eval (bits.b456 == 5); /* { dg-warning "TRUE" "" { xfail *-*-* } } */
+  /* { dg-warning "FALSE" "" { target *-*-* } .-1 } */
+  // TODO(xfail): ^^^^
+};
+
+struct ubits
+{
+  unsigned int b0 : 1;
+  unsigned int b123 : 3;
+  unsigned int b456 : 3;
+  unsigned int b7 : 1;
+};
+
+// FIXME: this is an ICE:
+#if 0
+void test_45 (void)
+{
+  struct ubits bits;
+  bits.b0 = 1;
+  __analyzer_eval (bits.b0 == 1); /* { d-todo-g-warning "TRUE" } */
+
+  bits.b456 = 5;
+  __analyzer_eval (bits.b456 == 5); /* { d-todo-g-warning "TRUE" } */
+};
+#endif
+
+extern const char *char_ptr;
+
+int test_46 (void)
+{
+  if (strcmp("literal", char_ptr))
+    return 1;
+  return 0;
+}
+
 /* Coverage:
 
    DONE (perhaps with xfail):
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-2.c b/gcc/testsuite/gcc.dg/analyzer/data-model-2.c
new file mode 100644
index 0000000..fe737fe
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-2.c
@@ -0,0 +1,13 @@
+/* { dg-additional-options "-fanalyzer-region-model -O2" } */
+/* TODO:is there a way to automatically run the tests on various
+   optimizations levels, and with/without debuginfo, rather than
+   hardcoding options?  Adapt from torture .exp, presumably.  */
+
+
+#include <stdlib.h>
+#include <string.h>
+
+int test_1 (void)
+{
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-3.c b/gcc/testsuite/gcc.dg/analyzer/data-model-3.c
new file mode 100644
index 0000000..8aeaaf9
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-3.c
@@ -0,0 +1,15 @@
+/* { dg-additional-options "-fanalyzer-region-model -O2" } */
+/* TODO:is there a way to automatically run the tests on various
+   optimizations levels, and with/without debuginfo, rather than
+   hardcoding options?  Adapt from torture .exp, presumably.  */
+
+#include <stdio.h>
+int
+main ()
+{
+  FILE *f = fopen ("conftest.out", "w");
+  return ferror (f) || fclose (f) != 0;
+
+  ;
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-4.c b/gcc/testsuite/gcc.dg/analyzer/data-model-4.c
new file mode 100644
index 0000000..486d4f5
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-4.c
@@ -0,0 +1,16 @@
+/* { dg-additional-options "-fanalyzer-region-model -fexceptions" } */
+/* TODO:is there a way to automatically run the tests on various
+   optimizations levels, and with/without debuginfo, rather than
+   hardcoding options?  Adapt from torture .exp, presumably.  */
+
+#include <stdio.h>
+int
+main ()
+{
+  FILE *f = fopen ("conftest.out", "w");
+  return ferror (f) || fclose (f) != 0;
+
+  ;
+  return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/analyzer/loop-2.c b/gcc/testsuite/gcc.dg/analyzer/loop-2.c
new file mode 100644
index 0000000..3636000
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/loop-2.c
@@ -0,0 +1,37 @@
+/* FIXME: what if the variant is embedded in a non-SSA var e.g. a field of
+   a struct?
+   Do we still get termination?
+
+   FIXME: no we don't; it effectively counts up to N within the region for
+   the field.
+
+   So we need something smarter to cope with this case.  */
+
+/* { dg-additional-options "-fanalyzer-region-model" } */
+/* { dg-additional-options "-fno-analyzer-state-purge" } */
+
+struct s
+{
+  int i;
+};
+
+void test(void)
+{
+  struct s s;
+
+  for (s.i=0; s.i<256; s.i++) { /* { dg-warning "analysis bailed out early" } */
+    //__analyzer_eval (s.i < 256); /* { d-todo-g-warning "TRUE" } */
+
+    //__analyzer_eval (s.i == 0); /* { d-todo-g-warning "UNKNOWN" "" { xfail *-*-* } } */
+      /* { d-todo-g-warning "TRUE" "" { target *-*-* } .-1 } */
+      /* TODO(xfail^^^): we're only capturing the first iteration, so
+	 we erroneously get i == 0.  */
+
+      //__analyzer_eval (s.i >= 0); /* { d-todo-g-warning "TRUE" } */
+  }
+
+  //__analyzer_eval (s.i >= 256); /* { d-todo-g-warning "TRUE" } */
+  //__analyzer_eval (s.i == 256); /* { d-todo-g-warning "TRUE" "" { xfail *-*-* } } */
+  /* { d-todo-g-warning "UNKNOWN" "" { target *-*-* } .-1 } */
+  /* TODO(xfail^^^): it only figures out i >= 256, rather than i == 256.  */
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/loop-3.c b/gcc/testsuite/gcc.dg/analyzer/loop-3.c
new file mode 100644
index 0000000..e1d6b8b
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/loop-3.c
@@ -0,0 +1,21 @@
+/* { dg-additional-options "-fanalyzer-region-model" } */
+
+#include <stdlib.h>
+
+void test(int c)
+{
+  int i;
+  char *buffer = (char*)malloc(256);
+
+  for (i=0; i<255; i++) {
+    buffer[i] = c; /* BUG: the malloc could have failed
+		      TODO: the checker doesn't yet pick up on this, perhaps
+		      due to the pointer arithmetic not picking up on the
+		      state */
+                   /* TODO: presumably should warn about a use-after-free
+		      on the second time through the loop */
+
+    free(buffer); /* { dg-warning "double-free of 'buffer' } */
+  }
+
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
index 1f139ae..d05c57a 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
@@ -376,6 +376,94 @@ void test_34 (void)
   // TODO(xfail): requires use of region model
 };
 
+int test_35 (void)
+{
+  void *ptr = malloc(4096);
+  if (!ptr)
+    return -1;
+  memset(ptr, 0, 4096);
+  free(ptr);
+  return 0;
+}
+
+void test_36 (void)
+{
+  void *ptr = malloc(4096);
+  if (!ptr)
+    return;
+  memset(ptr, 0, 4096);
+  free(ptr);
+}
+
+void *test_37a (void)
+{
+  void *ptr = malloc(4096); /* { dg-message "this call could return NULL" } */
+  memset(ptr, 0, 4096); /* { dg-warning "use of possibly-NULL 'ptr' where non-null expected" } */
+  return ptr;
+}
+
+int test_37b (void)
+{
+  void *p = malloc(4096);
+  void *q = malloc(4096); /* { dg-message "this call could return NULL" } */
+  if (p) {
+    memset(p, 0, 4096); /* Not a bug: checked */
+  } else {
+    memset(q, 0, 4096); /* { dg-warning "use of possibly-NULL 'q' where non-null expected" } */
+  }
+  free(p);
+  free(q);
+  return 0;
+}
+
+extern void might_use_ptr (void *ptr);
+
+void test_38(int i)
+{
+  void *p;
+
+  p = malloc(1024);
+  if (p) {
+    free(p);
+    might_use_ptr(p); /* TODO: should complain of use-after-free here (CWE-416).  */
+  }
+}
+
+int *
+test_39 (int i)
+{
+  int *p = (int*)malloc(sizeof(int*)); /* { dg-message "this call could return NULL" } */
+  *p = i; /* { dg-warning "use of possibly-NULL 'p'" } */
+  return p;
+}
+
+int *
+test_40 (int i)
+{
+  int *p = (int*)malloc(sizeof(int*));
+  i = *p; /* { dg-warning "use of possibly-NULL 'p'" } */
+  /* TODO: (it's also uninitialized) */
+  return p;
+}
+
+char *
+test_41 (int flag)
+{
+  char *buffer;
+
+  if (flag) {
+    buffer = (char*)malloc(4096);
+  } else {
+    buffer = NULL;
+  }
+
+  buffer[0] = 'a'; /* { dg-warning "use of possibly-NULL 'buffer'" } */
+  /* { dg-warning "use of NULL 'buffer'" "" { target *-*-* } .-1 } */
+
+  return buffer;
+}
+
+
 #if 0
 void test_31 (void *p)
 {
diff --git a/gcc/testsuite/lib/prune.exp b/gcc/testsuite/lib/prune.exp
index 2885e87..176019f 100644
--- a/gcc/testsuite/lib/prune.exp
+++ b/gcc/testsuite/lib/prune.exp
@@ -21,7 +21,7 @@ load_lib multiline.exp
 if ![info exists TEST_ALWAYS_FLAGS] {
     set TEST_ALWAYS_FLAGS ""
 }
-set TEST_ALWAYS_FLAGS "-fno-diagnostics-show-caret -fno-diagnostics-show-line-numbers -fdiagnostics-color=never $TEST_ALWAYS_FLAGS"
+set TEST_ALWAYS_FLAGS "-fno-diagnostics-show-caret -fno-diagnostics-show-line-numbers -fdiagnostics-color=never  -fdiagnostics-urls=never $TEST_ALWAYS_FLAGS"
 
 proc prune_gcc_output { text } {
     global srcdir
-- 
1.8.5.3

