1 files changed, 59 insertions, 2 deletions
diff --git a/test/Analysis/uninit-vals.m b/test/Analysis/uninit-vals.m
index 1cd57590df..57e83e3f97 100644
--- a/test/Analysis/uninit-vals.m
+++ b/test/Analysis/uninit-vals.m
@@ -1,7 +1,13 @@
-// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-store=region -verify %s
-// expected-no-diagnostics
+// RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.Malloc,debug.ExprInspection -verify %s
 
 typedef unsigned int NSUInteger;
+typedef __typeof__(sizeof(int)) size_t;
+
+void *malloc(size_t);
+void *calloc(size_t nmemb, size_t size);
+void free(void *);
+
+void clang_analyzer_eval(int);
 
 @interface A
 - (NSUInteger)foo;
@@ -32,3 +38,54 @@ void PR10163 (void) {
   float x[2] = {0};
   test_PR10163(x[1]); // no-warning  
 }
+
+
+typedef struct {
+  float x;
+  float y;
+} Point;
+typedef struct {
+  Point origin;
+  int size;
+} Circle;
+
+Point makePoint(float x, float y) {
+  Point result;
+  result.x = x;
+  result.y = y;
+  return result;
+}
+
+void PR14765_test() {
+  Circle *testObj = calloc(sizeof(Circle), 1);
+
+  clang_analyzer_eval(testObj->size == 0); // expected-warning{{TRUE}}
+
+  testObj->origin = makePoint(0.0, 0.0);
+  if (testObj->size > 0) { ; } // warning occurs here
+
+  // FIXME: Assigning to 'testObj->origin' kills the default binding for the
+  // whole region, meaning that we've forgotten that testObj->size should also
+  // default to 0. Tracked by <rdar://problem/12701038>.
+  // This should be TRUE.
+  clang_analyzer_eval(testObj->size == 0); // expected-warning{{UNKNOWN}}
+
+  free(testObj);
+}
+
+void PR14765_incorrectBehavior(Circle *testObj) {
+  int oldSize = testObj->size;
+
+  clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{TRUE}}
+
+  testObj->origin = makePoint(0.0, 0.0);
+
+  // FIXME: Assigning to 'testObj->origin' kills the default binding for the
+  // whole region, meaning that we've forgotten that testObj->size should also
+  // default to 0. Tracked by <rdar://problem/12701038>.
+  // This should be TRUE.
+  clang_analyzer_eval(testObj->size == oldSize); // expected-warning{{UNKNOWN}}
+
+  free(testObj);
+}
+