[analyzer] Fix a regression introduced in malloc with

attributes, introduced in r151188.

+ the test to catch it.

Thanks to Ahmed Charles for pointing this out.

llvm-svn: 151840

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

@@ -442,12 +442,16 @@ ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C,
   if (Att->getModule() != "malloc")
     return 0;
 
+  ProgramStateRef State = C.getState();
+
   for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
        I != E; ++I) {
-    return FreeMemAux(C, CE, C.getState(), *I,
-                      Att->getOwnKind() == OwnershipAttr::Holds);
+    ProgramStateRef StateI = FreeMemAux(C, CE, State, *I,
+                               Att->getOwnKind() == OwnershipAttr::Holds);
+    if (StateI)
+      State = StateI;
   }
-  return 0;
+  return State;
 }
 
 ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,

clang/test/Analysis/malloc-annotations.c

@@ -6,6 +6,8 @@ void *realloc(void *ptr, size_t size);
 void *calloc(size_t nmemb, size_t size);
 void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
 void __attribute((ownership_takes(malloc, 1))) my_free(void *);
+void my_freeBoth(void *, void *)
+       __attribute((ownership_holds(malloc, 1, 2)));
 void __attribute((ownership_returns(malloc, 1))) *my_malloc2(size_t);
 void __attribute((ownership_holds(malloc, 1))) my_hold(void *);
 
@@ -260,3 +262,10 @@ char callocZeroesBad () {
   }
   return result; // expected-warning{{never released}}
 }
+
+void testMultipleFreeAnnotations() {
+  int *p = malloc(12);
+  int *q = malloc(12);
+  my_freeBoth(p, q);
+}
+