1  #include <stdlib.h>
       2  #include "analyzer-decls.h"
       3  
       4  typedef void (*fn_ptr_t) (void *);
       5  
       6  void
       7  calls_free (void *victim)
       8  {
       9    free (victim); /* { dg-warning "double-'free' of 'victim'" } */
      10  }
      11  
      12  
      13  void
      14  no_op (void *ptr)
      15  {
      16  }
      17  
      18  void test_1 (void *ptr)
      19  {
      20    fn_ptr_t fn_ptr = calls_free;
      21    __analyzer_eval (fn_ptr == calls_free); /* { dg-warning "TRUE" } */
      22    __analyzer_eval (fn_ptr != NULL); /* { dg-warning "TRUE" } */
      23    __analyzer_eval (fn_ptr == NULL); /* { dg-warning "FALSE" } */
      24    __analyzer_eval (fn_ptr == no_op); /* { dg-warning "FALSE" } */
      25  
      26    fn_ptr (ptr);
      27    fn_ptr (ptr);
      28  }
      29  
      30  /* As above, but with an extra indirection to try to thwart
      31     the optimizer.  */
      32  
      33  void test_2 (void *ptr, fn_ptr_t *fn_ptr)
      34  {
      35    *fn_ptr = calls_free;
      36    __analyzer_eval (*fn_ptr == calls_free); /* { dg-warning "TRUE" } */
      37    __analyzer_eval (*fn_ptr != NULL); /* { dg-warning "TRUE" } */
      38    __analyzer_eval (*fn_ptr == NULL); /* { dg-warning "FALSE" } */
      39    __analyzer_eval (*fn_ptr == no_op); /* { dg-warning "FALSE" } */
      40  
      41    (*fn_ptr) (ptr);
      42    (*fn_ptr) (ptr);
      43  }