10 files changed, 81 insertions, 16 deletions
diff --git a/test/Analysis/dead-stores.c b/test/Analysis/dead-stores.c
index 209ca65..1c60027 100644
--- a/test/Analysis/dead-stores.c
+++ b/test/Analysis/dead-stores.c
@@ -450,3 +450,15 @@ int f26_nestedblocks() {
   return y;
 }
 
+// The FOREACH macro in QT uses 'break' statements within statement expressions
+// placed within the increment code of for loops.
+void rdar8014335() {
+  for (int i = 0 ; i != 10 ; ({ break; })) {
+    for ( ; ; ({ ++i; break; })) ;
+    // Note that the next value stored to 'i' is never executed
+    // because the next statement to be executed is the 'break'
+    // in the increment code of the first loop.
+    i = i * 3; // expected-warning{{Value stored to 'i' is never read}}
+  }
+}
+
diff --git a/test/Analysis/inline.c b/test/Analysis/inline.c
index acaf74d..50c1a54 100644
--- a/test/Analysis/inline.c
+++ b/test/Analysis/inline.c
@@ -1,5 +1,5 @@
-// RUN: false
-// XFAIL: *
+// RUN: %clang_cc1 -analyze -analyzer-check-objc-mem -analyzer-inline-call -analyzer-store region -verify %s
+
 int f1() {
   int y = 1;
   y++;
diff --git a/test/Analysis/inline2.c b/test/Analysis/inline2.c
index ec965a6..efdb75c 100644
--- a/test/Analysis/inline2.c
+++ b/test/Analysis/inline2.c
@@ -1,5 +1,4 @@
-// RUN: false
-// XFAIL: *
+// RUN: %clang_cc1 -analyze -analyzer-check-objc-mem -analyzer-inline-call -analyzer-store region -verify %s
 
 // Test parameter 'a' is registered to LiveVariables analysis data although it
 // is not referenced in the function body. 
diff --git a/test/Analysis/inline3.c b/test/Analysis/inline3.c
index 8f45858..884b3ed 100644
--- a/test/Analysis/inline3.c
+++ b/test/Analysis/inline3.c
@@ -1,5 +1,4 @@
-// RUN: false
-// XFAIL: *
+// RUN: %clang_cc1 -analyze -analyzer-check-objc-mem -analyzer-inline-call -analyzer-store region -verify %s
 
 // Test when entering f1(), we set the right AnalysisContext to Environment.
 // Otherwise, block-level expr '1 && a' would not be block-level.
diff --git a/test/Analysis/inline4.c b/test/Analysis/inline4.c
index b2b3c34..5a1d193 100644
--- a/test/Analysis/inline4.c
+++ b/test/Analysis/inline4.c
@@ -1,5 +1,5 @@
-// RUN: false
-// XFAIL: *
+// RUN: %clang_cc1 -analyze -analyzer-check-objc-mem -analyzer-inline-call -analyzer-store region -verify %s
+
 int g(int a) {    
   return a;
 }
diff --git a/test/Analysis/malloc.c b/test/Analysis/malloc.c
index 21b6d46..fe24bc1 100644
--- a/test/Analysis/malloc.c
+++ b/test/Analysis/malloc.c
@@ -6,16 +6,16 @@ void *realloc(void *ptr, size_t size);
 void *calloc(size_t nmemb, size_t size);
 
 void f1() {
-  int *p = malloc(10);
+  int *p = malloc(12);
   return; // expected-warning{{Allocated memory never released. Potential memory leak.}}
 }
 
 void f1_b() {
-  int *p = malloc(10); // expected-warning{{Allocated memory never released. Potential memory leak.}}
+  int *p = malloc(12); // expected-warning{{Allocated memory never released. Potential memory leak.}}
 }
 
 void f2() {
-  int *p = malloc(10);
+  int *p = malloc(12);
   free(p);
   free(p); // expected-warning{{Try to free a memory block that has been released}}
 }
@@ -25,7 +25,7 @@ void f2() {
 // or inter-procedural analysis, this is a conservative answer.
 int *f3() {
   static int *p = 0;
-  p = malloc(10); 
+  p = malloc(12); 
   return p; // no-warning
 }
 
@@ -34,18 +34,18 @@ int *f3() {
 // functions or inter-procedural analysis, this is a conservative answer.
 static int *p_f4 = 0;
 int *f4() {
-  p_f4 = malloc(10); 
+  p_f4 = malloc(12); 
   return p_f4; // no-warning
 }
 
 int *f5() {
-  int *q = malloc(10);
+  int *q = malloc(12);
   q = realloc(q, 20);
   return q; // no-warning
 }
 
 void f6() {
-  int *p = malloc(10);
+  int *p = malloc(12);
   if (!p)
     return; // no-warning
   else
@@ -67,3 +67,13 @@ void f7() {
   free(x);
   x[0] = 'a'; // expected-warning{{Use dynamically allocated memory after it is freed.}}
 }
+
+void PR6123() {
+  int *x = malloc(11); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
+}
+
+void PR7217() {
+  int *buf = malloc(2); // expected-warning{{Cast a region whose size is not a multiple of the destination type size.}}
+  buf[1] = 'c'; // not crash
+
+}
diff --git a/test/Analysis/method-call.cpp b/test/Analysis/method-call.cpp
index dd89159..47f1444 100644
--- a/test/Analysis/method-call.cpp
+++ b/test/Analysis/method-call.cpp
@@ -1,4 +1,4 @@
-// RUN: %clang_cc1 -analyze -analyzer-check-objc-mem -analyzer-store region -verify %s
+// RUN: %clang_cc1 -analyze -analyzer-check-objc-mem -analyzer-inline-call -analyzer-store region -verify %s
 struct A {
   int x;
   A(int a) { x = a; }
diff --git a/test/Analysis/misc-ps-region-store.m b/test/Analysis/misc-ps-region-store.m
index 4255141..52516ab 100644
--- a/test/Analysis/misc-ps-region-store.m
+++ b/test/Analysis/misc-ps-region-store.m
@@ -1014,3 +1014,22 @@ void pr6854(void * arg) {
   float f = *(float*) a;
 }
 
+// <rdar://problem/8032791> False positive due to symbolic store not find
+//  value because of 'const' qualifier
+double rdar_8032791_2();
+double rdar_8032791_1() {
+   struct R8032791 { double x[2]; double y; }
+   data[3] = {
+     {{1.0, 3.0}, 3.0},  //  1   2   3
+     {{1.0, 1.0}, 0.0},  // 1 1 2 2 3 3
+     {{1.0, 3.0}, 1.0}   //    1   2   3
+   };
+
+   double x = 0.0;
+   for (unsigned i = 0 ; i < 3; i++) {
+     const struct R8032791 *p = &data[i];
+     x += p->y + rdar_8032791_2(); // no-warning
+   }
+   return x;
+}
+
diff --git a/test/Analysis/misc-ps.m b/test/Analysis/misc-ps.m
index 2b21eec..8323c62 100644
--- a/test/Analysis/misc-ps.m
+++ b/test/Analysis/misc-ps.m
@@ -8,6 +8,10 @@
 // RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -analyzer-constraints=basic -verify -fblocks -Wno-unreachable-code %s
 // RUN: %clang_cc1 -triple x86_64-apple-darwin10 -analyze -analyzer-experimental-internal-checks -analyzer-check-objc-mem -analyzer-store=region -analyzer-constraints=range -verify -fblocks -Wno-unreachable-code %s
 
+#ifndef __clang_analyzer__
+#error __clang__analyzer__ not defined
+#endif
+
 typedef struct objc_ivar *Ivar;
 typedef struct objc_selector *SEL;
 typedef signed char BOOL;
@@ -957,3 +961,13 @@ void pr6938_b() {
   }) == 0) {
   }
 }
+
+//===----------------------------------------------------------------------===//
+// <rdar://problem/7979430> - The CFG for code containing an empty
+//  @synchronized block was previously broken (and would crash the analyzer).
+//===----------------------------------------------------------------------===//
+
+void r7979430(id x) {
+  @synchronized(x) {}
+}
+
diff --git a/test/Analysis/retain-release.m b/test/Analysis/retain-release.m
index 3f79c0c..9e5151d 100644
--- a/test/Analysis/retain-release.m
+++ b/test/Analysis/retain-release.m
@@ -1332,3 +1332,15 @@ void test_blocks_1_indirect_retain_via_call(void) {
   ^(NSObject *o){ [o retain]; }(number);
 }
 
+//===--------------------------------------------------------------------===//
+// Test sending message to super that returns an object alias.  Previously
+// this caused a crash in the analyzer.
+//===--------------------------------------------------------------------===//
+
+@interface Rdar8015556 : NSObject {} @end
+@implementation Rdar8015556
+- (id)retain {
+  return [super retain];
+}
+@end
+