[analyzer] Allow pointers escape through calls containing callback args.

(Since we don't have a generic pointer escape callback, modify
ExprEngineCallAndReturn as well as the malloc checker.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156134 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 10 insertions, 0 deletions

diff --git a/test/Analysis/malloc.cpp b/test/Analysis/malloc.cpp
index 8f80b2b76f..f36d8fcb7b 100644
--- a/test/Analysis/malloc.cpp
+++ b/test/Analysis/malloc.cpp
@@ -14,3 +14,13 @@ struct Foo {
 Foo aFunction() {
     return malloc(10);
 }
+
+// Assume that functions which take a function pointer can free memory even if
+// they are defined in system headers and take the const pointer to the
+// allocated memory. (radar://11160612)
+// Test default parameter.
+int const_ptr_and_callback_def_param(int, const char*, int n, void(*)(void*) = 0);
+void r11160612_3() {
+  char *x = (char*)malloc(12);
+  const_ptr_and_callback_def_param(0, x, 12);
+}