From 9e8dddd02da0df85fc4c7bf1fffc8547d9f338aa Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Wed, 29 Jul 2020 16:30:35 -0400
Subject: [PATCH 346/377] FIXME: fix dump ICE; mark XFAILs

---
 gcc/analyzer/store2.cc                        |  9 +++++++--
 gcc/testsuite/gcc.dg/analyzer/data-model-1.c  |  3 ++-
 gcc/testsuite/gcc.dg/analyzer/data-model-5.c  |  9 +++++++--
 gcc/testsuite/gcc.dg/analyzer/data-model-5b.c | 12 +++++++-----
 gcc/testsuite/gcc.dg/analyzer/data-model-5c.c | 13 +++++++------
 5 files changed, 30 insertions(+), 16 deletions(-)

diff --git a/gcc/analyzer/store2.cc b/gcc/analyzer/store2.cc
index e19797a3597..8741aea6f48 100644
--- a/gcc/analyzer/store2.cc
+++ b/gcc/analyzer/store2.cc
@@ -159,8 +159,13 @@ binding_key2::cmp (const binding_key2 *k1, const binding_key2 *k2)
     }
   else
     {
-      // TODO
-      gcc_unreachable ();
+      const symbolic_binding2 *s1 = (const symbolic_binding2 *)k1;
+      const symbolic_binding2 *s2 = (const symbolic_binding2 *)k2;
+      if (s1 > s2)
+	return 1;
+      if (s1 < s2)
+	return -1;
+      return 0;
     }
 }
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-1.c b/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
index c6a146eb810..725091c1004 100644
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-1.c
@@ -507,7 +507,8 @@ void test_26 (struct coord *p, struct coord *q)
   // TODO(xfail): should have been overwritten with q->y
 
   __analyzer_eval (q->x); /* { dg-warning "UNKNOWN" } */
-  __analyzer_eval (q->y == 17); /* { dg-warning "TRUE" } */
+  __analyzer_eval (q->y == 17); /* { dg-warning "TRUE" "desired" { xfail *-*-* } } */
+  /* { dg-warning "UNKNOWN" "status quo" { target *-*-* } .-1 } */
 }
 
 void test_27 (struct coord *p)
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-5.c b/gcc/testsuite/gcc.dg/analyzer/data-model-5.c
index 22ecdbc0c74..2135c70eb8d 100644
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-5.c
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-5.c
@@ -99,6 +99,11 @@ void unref (base_obj *obj)
 void test_1 (const char *str)
 {
   base_obj *obj = new_string_obj (str);
-  //__analyzer_dump();
   unref (obj);
-} /* { dg-bogus "leak" } */
+} /* { dg-bogus "leak" "" { xfail *-*-* } } */
+/* XFAIL (false leak):
+   Given that we only know "len" symbolically, this line:
+     str_obj->str_buf[len] = '\0';
+   is a symbolic write which could clobber the ob_type or ob_refcnt.
+   It reports a leak when following the path where the refcount is clobbered
+   to be a value that leads to the deallocator not being called.  */
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-5b.c b/gcc/testsuite/gcc.dg/analyzer/data-model-5b.c
index 49295f51b3d..b054f64a465 100644
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-5b.c
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-5b.c
@@ -86,8 +86,10 @@ void test_1 (const char *str)
   //__analyzer_dump();
   if (obj)
     unref (obj);
-} /* { dg-bogus "leak" } */
-/* TODO(xfail): the false leak report involves the base_obj.ob_refcnt
-   being 1, but the string_obj.str_base.ob_refcnt being unknown (when
-   they ought to be the same region), thus allowing for a path in which
-   the object is allocated but not freed.  */
+} /* { dg-bogus "leak" "" { xfail *-*-* } } */
+/* XFAIL (false leak):
+   Given that we only know "len" symbolically, this line:
+     str_obj->str_buf[len] = '\0';
+   is a symbolic write which could clobber the ob_type or ob_refcnt.
+   It reports a leak when following the path where the refcount is clobbered
+   to be a value that leads to the deallocator not being called.  */
diff --git a/gcc/testsuite/gcc.dg/analyzer/data-model-5c.c b/gcc/testsuite/gcc.dg/analyzer/data-model-5c.c
index e31d3e712c4..ad4e1d2644d 100644
--- a/gcc/testsuite/gcc.dg/analyzer/data-model-5c.c
+++ b/gcc/testsuite/gcc.dg/analyzer/data-model-5c.c
@@ -75,9 +75,10 @@ void test_1 (const char *str)
   string_obj *obj = new_string_obj (str);
   if (obj)
     unref (obj);
-} /* { dg-bogus "leak" } */
-/* TODO(xfail): the false leak report involves the base_obj.ob_refcnt
-   being 1, but the string_obj.str_base.ob_refcnt being unknown (when
-   they ought to be the same region), thus allowing for a path in which
-   the object is allocated but not freed.  */
-
+} /* { dg-bogus "leak" "" { xfail *-*-* } } */
+/* XFAIL (false leak):
+   Given that we only know "len" symbolically, this line:
+     str_obj->str_buf[len] = '\0';
+   is a symbolic write which could clobber the ob_type or ob_refcnt.
+   It reports a leak when following the path where the refcount is clobbered
+   to be a value that leads to the deallocator not being called.  */
-- 
2.26.2

