1  /* In theory each of p0...p3 can be in various malloc states,
       2     independently, so the total combined number of states
       3     at any program point within the loop is NUM_VARS * NUM_STATES.
       4  
       5     However, due to the way the analyzer represents heap-allocated regions
       6     this never terminates, eventually hitting the complexity limit
       7     (PR analyzer/93695).  */
       8  
       9  /* { dg-additional-options "-Wno-analyzer-too-complex -Wno-analyzer-malloc-leak" } */
      10  
      11  #include <stdlib.h>
      12  
      13  extern int get (void);
      14  
      15  void test (void)
      16  {
      17    void *p0 = NULL, *p1 = NULL, *p2 = NULL, *p3 = NULL;
      18    while (get ())
      19      {
      20        switch (get ())
      21  	{
      22  	default:
      23  	case 0:
      24  	  p0 = malloc (16); /* { dg-warning "leak" "" { xfail *-*-* } } */
      25  	  break;
      26  	case 1:
      27  	  free (p0); /* { dg-warning "double-'free' of 'p0'" } */
      28  	  break;
      29  
      30  	case 2:
      31  	  p1 = malloc (16); /* { dg-warning "leak" "" { xfail *-*-* } } */
      32  	  break;
      33  	case 3:
      34  	  free (p1); /* { dg-warning "double-'free' of 'p1'" "" { xfail *-*-* } } */
      35  	  break;
      36  
      37  	case 4:
      38  	  p2 = malloc (16); /* { dg-warning "leak" "" { xfail *-*-* } } */
      39  	  break;
      40  	case 5:
      41  	  free (p2); /* { dg-warning "double-'free' of 'p2'" "" { xfail *-*-* } } */
      42  	  break;
      43  
      44  	case 6:
      45  	  p3 = malloc (16); /* { dg-warning "leak" "" { xfail *-*-* } } */
      46  	  break;
      47  	case 7:
      48  	  free (p3); /* { dg-warning "double-'free' of 'p3'" "" { xfail *-*-* } } */
      49  	  break;
      50  	}
      51      }
      52  }