[analyzer] Fix a regression introduced in malloc with

attributes, introduced in r151188.

+ the test to catch it.

Thanks to Ahmed Charles for pointing this out.

llvm-svn: 151840

2 files changed, 16 insertions, 3 deletions

diff --git a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index ae81ad6eda0..b74317cc98b 100644
--- a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -442,12 +442,16 @@ ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C,
   if (Att->getModule() != "malloc")
     return 0;
 
+  ProgramStateRef State = C.getState();
+
   for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
        I != E; ++I) {
-    return FreeMemAux(C, CE, C.getState(), *I,
-                      Att->getOwnKind() == OwnershipAttr::Holds);
+    ProgramStateRef StateI = FreeMemAux(C, CE, State, *I,
+                               Att->getOwnKind() == OwnershipAttr::Holds);
+    if (StateI)
+      State = StateI;
   }
-  return 0;
+  return State;
 }
 
 ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
diff --git a/clang/test/Analysis/malloc-annotations.c b/clang/test/Analysis/malloc-annotations.c
index 70b55ebda2b..fbc6391ea50 100644
--- a/clang/test/Analysis/malloc-annotations.c
+++ b/clang/test/Analysis/malloc-annotations.c
@@ -6,6 +6,8 @@ void *realloc(void *ptr, size_t size);
 void *calloc(size_t nmemb, size_t size);
 void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
 void __attribute((ownership_takes(malloc, 1))) my_free(void *);
+void my_freeBoth(void *, void *)
+       __attribute((ownership_holds(malloc, 1, 2)));
 void __attribute((ownership_returns(malloc, 1))) *my_malloc2(size_t);
 void __attribute((ownership_holds(malloc, 1))) my_hold(void *);
 
@@ -260,3 +262,10 @@ char callocZeroesBad () {
   }
   return result; // expected-warning{{never released}}
 }
+
+void testMultipleFreeAnnotations() {
+  int *p = malloc(12);
+  int *q = malloc(12);
+  my_freeBoth(p, q);
+}
+